From e3dd5ee609a39266a01e2a7ef2ec5bb3a096e811 Mon Sep 17 00:00:00 2001 From: "JerryAbo [MSFT]" <94194023+jerryabo@users.noreply.github.com> Date: Tue, 10 Oct 2023 20:34:25 -0500 Subject: [PATCH 1/7] Update enroll-a-windows-10-device-automatically-using-group-policy.md Add dependency for auto HAADJ directly in GPO requirements so it is more easily discoverable as a HAADJ missing this info blocks MDM enrollment from succeeding. --- ...roll-a-windows-10-device-automatically-using-group-policy.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md index 031f810c1b..62fce24e34 100644 --- a/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -19,9 +19,11 @@ The enrollment into Intune is triggered by a group policy created on your local - The Active Directory joined device must be running a [supported version of Windows](/windows/release-health/supported-versions-windows-client). - The enterprise has configured a Mobile Device Management (MDM) service. - The on-premises Active Directory must be [integrated with Azure AD (via Azure AD Connect)](/azure/architecture/reference-architectures/identity/azure-ad). +- Service connection point (SCP) configuration. For more information see [configuring the SCP using Microsoft Entra Connect](/azure/active-directory/devices/how-to-hybrid-join). For environments not publishing SCP data to AD, see [Microsoft Entra hybrid join targeted deployment](/azure/active-directory/devices/hybrid-join-control#targeted-deployment-of-microsoft-entra-hybrid-join-on-windows-current-devices). - The device shouldn't already be enrolled in Intune using the classic agents (devices managed using agents fail enrollment with `error 0x80180026`). - The minimum Windows Server version requirement is based on the Hybrid Azure AD join requirement. For more information, see [How to plan your hybrid Azure Active Directory join implementation](/azure/active-directory/devices/hybrid-azuread-join-plan). + > [!TIP] > For more information, see the following topics: > From cc5c3d9a607d7f46fb9fb401b8c7c5ccd626de7e Mon Sep 17 00:00:00 2001 From: Rei Ikei <47890550+reiikei@users.noreply.github.com> Date: Mon, 16 Oct 2023 15:35:54 +0900 Subject: [PATCH 2/7] Update policy-csp-controlpolicyconflict.md Most users are now using 1809 or later versions, and I think this statement is misleading customers. --- .../client-management/mdm/policy-csp-controlpolicyconflict.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md index 485f675610..4c27326f83 100644 --- a/windows/client-management/mdm/policy-csp-controlpolicyconflict.md +++ b/windows/client-management/mdm/policy-csp-controlpolicyconflict.md @@ -49,7 +49,7 @@ If set to 1 then any MDM policy that's set that has an equivalent GP policy will This policy is used to ensure that MDM policy wins over GP when policy is configured on MDM channel. The default value is 0. The MDM policies in Policy CSP will behave as described if this policy value is set 1. > [!NOTE] -> This policy doesn't support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. Windows 10 version 1809 will support using the Delete command to set the value to 0 again, if it was previously set to 1. +> In Windows 10 version 1803, this policy doesn't support the Delete command and doesn’t support setting the value to 0 again after it was previously set to 1. The policy should be set at every sync to ensure the device removes any settings that conflict with MDM just as it does on the very first set of the policy. This ensures that: From 54f1a411e866d58dfff95e61a9c5b1a6c40d2cff Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:53:44 -0400 Subject: [PATCH 3/7] Add additional links Add additional links --- .../activate-using-key-management-service-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 8c36f27930..6d911b23fc 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -191,7 +191,7 @@ For more information about the use and syntax of the script `slmgr.vbs`, see [Sl > [!IMPORTANT] > -> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. +> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. For more information, see (Key Management Services (KMS) activation planning: Network requirements)[/windows-server/get-started/kms-activation-planning#network-requirements] and (Remote Procedure Call (RPC) errors troubleshooting guidance)[/troubleshoot/windows-client/networking/rpc-errors-troubleshooting] ## Related articles From 5ed70a1ef89cb807beb4fab0104f7cdb0fe836d7 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 16 Oct 2023 11:58:28 -0400 Subject: [PATCH 4/7] Update ms.date Update ms.date --- .../activate-using-key-management-service-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 6d911b23fc..12f1d9ac39 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -8,7 +8,7 @@ author: frankroj manager: aaroncz ms.author: frankroj ms.localizationpriority: medium -ms.date: 10/13/2023 +ms.date: 10/16/2023 ms.topic: how-to ms.collection: - highpri From c499dc1ffcdb2971da2102b2b48362181be3a103 Mon Sep 17 00:00:00 2001 From: Frank Rojas <45807133+frankroj@users.noreply.github.com> Date: Mon, 16 Oct 2023 12:04:14 -0400 Subject: [PATCH 5/7] Fix links Fix links --- .../activate-using-key-management-service-vamt.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 12f1d9ac39..b1056c9728 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -191,7 +191,7 @@ For more information about the use and syntax of the script `slmgr.vbs`, see [Sl > [!IMPORTANT] > -> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. For more information, see (Key Management Services (KMS) activation planning: Network requirements)[/windows-server/get-started/kms-activation-planning#network-requirements] and (Remote Procedure Call (RPC) errors troubleshooting guidance)[/troubleshoot/windows-client/networking/rpc-errors-troubleshooting] +> Clients require RPC over TCP/IP connectivity to the KMS host to successfully activate. For more information, see [Key Management Services (KMS) activation planning: Network requirements](/windows-server/get-started/kms-activation-planning#network-requirements) and [Remote Procedure Call (RPC) errors troubleshooting guidance](/troubleshoot/windows-client/networking/rpc-errors-troubleshooting). ## Related articles From da7de5b5aeac0397eccdd5f5e37c2bdf9dcde53e Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Mon, 16 Oct 2023 12:47:35 -0400 Subject: [PATCH 6/7] Added new rules and updates since 2309 --- ...icrosoft-recommended-driver-block-rules.md | 367 +++++++++++++++++- 1 file changed, 362 insertions(+), 5 deletions(-) diff --git a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md index 398a529b8e..3eac346b20 100644 --- a/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md +++ b/windows/security/application-security/application-control/windows-defender-application-control/design/microsoft-recommended-driver-block-rules.md @@ -81,7 +81,7 @@ To check that the policy was successfully applied on your computer: ```xml - 10.0.25930.0 + 10.0.25965.0 {2E07F7E4-194C-4D20-B7C9-6F44A6C5A234} @@ -662,6 +662,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -691,6 +695,90 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -889,6 +977,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -915,6 +1023,22 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + @@ -1171,6 +1295,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -1213,10 +1387,10 @@ To check that the policy was successfully applied on your computer: - + - + @@ -1225,7 +1399,7 @@ To check that the policy was successfully applied on your computer: - + @@ -1241,6 +1415,7 @@ To check that the policy was successfully applied on your computer: + @@ -1353,6 +1528,7 @@ To check that the policy was successfully applied on your computer: + @@ -1476,6 +1652,7 @@ To check that the policy was successfully applied on your computer: + @@ -1994,6 +2171,11 @@ To check that the policy was successfully applied on your computer: + + + + + @@ -2195,6 +2377,7 @@ To check that the policy was successfully applied on your computer: + @@ -2811,6 +2994,10 @@ To check that the policy was successfully applied on your computer: + + + + @@ -2840,6 +3027,90 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3039,6 +3310,26 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + @@ -3065,6 +3356,22 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + @@ -3325,6 +3632,56 @@ To check that the policy was successfully applied on your computer: + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + @@ -3357,7 +3714,7 @@ To check that the policy was successfully applied on your computer: - 10.0.25930.0 + 10.0.25965.0 From 73d1a25dc143090f5856dde935764d90a417979b Mon Sep 17 00:00:00 2001 From: Meghan Stewart <33289333+mestew@users.noreply.github.com> Date: Mon, 16 Oct 2023 13:09:19 -0700 Subject: [PATCH 7/7] edit gpo path --- windows/client-management/manage-windows-copilot.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/manage-windows-copilot.md b/windows/client-management/manage-windows-copilot.md index d8b9867283..bc4adbca9d 100644 --- a/windows/client-management/manage-windows-copilot.md +++ b/windows/client-management/manage-windows-copilot.md @@ -2,7 +2,7 @@ title: Manage Copilot in Windows description: Learn how to manage Copilot in Windows using MDM and group policy. ms.topic: article -ms.date: 09/26/2023 +ms.date: 10/16/2023 appliesto: - ✅ Windows 11 --- @@ -20,7 +20,7 @@ This policy setting allows you to turn off Copilot in Windows. If you enable thi | | Setting | |------------------|---------------------------------------------------------------------------------------------------------| | **CSP** | ./User/Vendor/MSFT/WindowsAI/[TurnOffWindowsCopilot](mdm/policy-csp-windowsai.md#turnoffwindowscopilot) | -| **Group policy** | User Configuration > Administrative Templates > Windows Copilot > **Turn off Windows Copilot** | +| **Group policy** | User Configuration > Administrative Templates > Windows Components > Windows Copilot > **Turn off Windows Copilot** |