From 0131237f1d67aab9d09a044bfd141fde38063b01 Mon Sep 17 00:00:00 2001 From: DocsPreview <49669258+DocsPreview@users.noreply.github.com> Date: Fri, 17 May 2019 16:15:14 -0700 Subject: [PATCH 01/19] Revision moved to higher version when two versions available (#221) (#222) --- .../status-windows-10-1809-and-windows-server-2019.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml index e94c90b28d..cccf3bdb7a 100644 --- a/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml +++ b/windows/release-information/status-windows-10-1809-and-windows-server-2019.yml @@ -65,7 +65,7 @@ sections: - type: markdown text: "
This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

- + @@ -92,7 +92,7 @@ sections: - type: markdown text: "
SummaryOriginating updateStatusLast updated
Unable to access some gov.uk websites
gov.uk websites that don’t support “HSTS” may not be accessible

See details >		OS Build 17763.502

May 14, 2019
KB4494441		Investigating
May 16, 2019
06:41 PM PT
Unable to access some gov.uk websites
gov.uk websites that don’t support “HSTS” may not be accessible

See details >		OS Build 17763.503

May 14, 2019
KB4494441		Investigating
May 16, 2019
06:41 PM PT
Devices with some Asian language packs installed may receive an error
After installing the KB4493509 devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_F

See details >		OS Build 17763.437

April 09, 2019
KB4493509		Mitigated
May 03, 2019
10:59 AM PT
Printing from Microsoft Edge or other UWP apps, you may receive the error 0x80070007
Attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications, you may receive an error.

See details >		OS Build 17763.379

March 12, 2019
KB4489899		Mitigated
May 02, 2019
04:47 PM PT
Issue using PXE to start a device from WDS
Using PXE to start a device from a WDS server configured to use Variable Window Extension may cause the connection to the WDS server to terminate prematurely.

See details >		OS Build 17763.379

March 12, 2019
KB4489899		Mitigated
April 09, 2019
10:00 AM PT
- + From 81d29602dd4b2f6861676f18a7238ea112f48267 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 21 May 2019 15:12:14 -0700 Subject: [PATCH 02/19] Removed warning, updated what's new and policy DDF --- .../mdm/enrollmentstatustracking-csp.md | 4 +- ...ew-in-windows-mdm-enrollment-management.md | 39 +- .../mdm/policy-csp-authentication.md | 5 +- .../mdm/policy-csp-deliveryoptimization.md | 5 +- .../mdm/policy-csp-experience.md | 6 +- .../mdm/policy-csp-internetexplorer.md | 4 +- .../client-management/mdm/policy-csp-power.md | 4 +- .../mdm/policy-csp-search.md | 4 +- .../mdm/policy-csp-system.md | 5 +- .../mdm/policy-csp-update.md | 5 +- .../mdm/policy-csp-windowslogon.md | 4 +- .../client-management/mdm/policy-ddf-file.md | 3522 ++++++++++++++++- 12 files changed, 3375 insertions(+), 232 deletions(-) diff --git a/windows/client-management/mdm/enrollmentstatustracking-csp.md b/windows/client-management/mdm/enrollmentstatustracking-csp.md index 39a6f767c6..2f213bb910 100644 --- a/windows/client-management/mdm/enrollmentstatustracking-csp.md +++ b/windows/client-management/mdm/enrollmentstatustracking-csp.md @@ -6,13 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: ManikaDhiman -ms.date: 04/25/2019 +ms.date: 05/21/2019 --- # EnrollmentStatusTracking CSP -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. During Autopilot deployment, you can configure the Enrollment Status Page (ESP) to block the device use until the required apps are installed. You can select the apps that must be installed before using the device. The EnrollmentStatusTracking configuration service provider (CSP) is used by Intune's agents, such as SideCar to configure ESP for blocking the device use until the required Win32 apps are installed. It tracks the installation status of the required policy providers and the apps they install and sends it to ESP, which displays the installation progress message to the user. For more information on ESP, see [Windows Autopilot Enrollment Status page](https://docs.microsoft.com/en-us/windows/deployment/windows-autopilot/enrollment-status). diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 71fa422e10..ab44a155b2 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -124,7 +124,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s - + @@ -1838,10 +1838,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware ## Frequently Asked Questions -###**Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** +### **Can there be more than 1 MDM server to enroll and manage devices in Windows 10?** No. Only one MDM is allowed. -###**How do I set the maximum number of Azure Active Directory joined devices per user?** +### **How do I set the maximum number of Azure Active Directory joined devices per user?** 1. Login to the portal as tenant admin: https://manage.windowsazure.com. 2. Click Active Directory on the left pane. 3. Choose your tenant. @@ -1851,7 +1851,7 @@ No. Only one MDM is allowed. ![aad maximum joined devices](images/faq-max-devices.png)   -###**What is dmwappushsvc?** +### **What is dmwappushsvc?** Entry | Description --------------- | -------------------- @@ -1860,6 +1860,35 @@ What data is handled by dmwappushsvc? | It is a component handling the internal How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | ## Change history in MDM documentation +### May 2019 + +|New or updated topic | Description| +|--- | ---| +|[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies: DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground

Updated description of the following policies: DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer| +|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy: ShowLockOnUserTile| +|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies: AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage| +|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies: EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn| +|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy: AllowFindMyFiles| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policies: AllowCommercialDataPipeline, TurnOffFileHistory| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies: AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot| +|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies: AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation| +|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes: DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus| + +### April 2019 + +|New or updated topic | Description| +|--- | ---| +|[Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md)|Added the following warning at the end of the Overview section: Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined.| +|[Policy CSP - UserRights](policy-csp-userrights.md)|Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields.| + +### March 2019 + +|New or updated topic | Description| +|--- | ---| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies: AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated description of ConfigStorageSenseDownloadsCleanupThreshold| + ### February 2019 @@ -1915,7 +1944,7 @@ How do I turn if off? | The service can be stopped from the "Services" console o - + diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 58790db16d..19e7ffb900 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/01/2019 +ms.date: 05/21/2019 --- # Policy CSP - Authentication -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index a6226c81d3..bc9b57fc40 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/15/2019 +ms.date: 05/21/2019 --- # Policy CSP - DeliveryOptimization -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 4db9f3f778..066e52e609 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -6,15 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2019 +ms.date: 05/21/2019 --- # Policy CSP - Experience -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. - -
diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 1638a2dde8..c9be35eac1 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -6,13 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/06/2019 +ms.date: 05/21/2019 --- # Policy CSP - InternetExplorer -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index 3b9db5c095..e1aab20c25 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -6,13 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/03/2019 +ms.date: 05/21/2019 --- # Policy CSP - Power -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
diff --git a/windows/client-management/mdm/policy-csp-search.md b/windows/client-management/mdm/policy-csp-search.md index 71f49109e0..03e8096529 100644 --- a/windows/client-management/mdm/policy-csp-search.md +++ b/windows/client-management/mdm/policy-csp-search.md @@ -6,13 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/14/2019 +ms.date: 05/21/2019 --- # Policy CSP - Search -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 92fd30f9bb..63e951ca84 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/09/2019 +ms.date: 05/21/2019 --- # Policy CSP - System -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 9c370fa02c..78dfe6c171 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -6,14 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/08/2019 +ms.date: 05/21/2019 --- # Policy CSP - Update -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. -
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 14369d49d1..986631e067 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -6,13 +6,11 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 05/07/2019 +ms.date: 05/21/2019 --- # Policy CSP - WindowsLogon -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here.
diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index e9e1339f46..86088f08cb 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: MariciaAlforque -ms.date: 08/29/2018 +ms.date: 05/21/2019 --- # Policy DDF file @@ -19,6 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy* You can download the DDF files from the links below: +- [Download the Policy DDF file for Windows 10, version 1803](http://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/PolicyDDF_all_1809.xml) - [Download the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) - [Download the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) - [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) @@ -27,7 +28,7 @@ You can download the DDF files from the links below: - [Download the Policy DDF file for Windows 10, version 1607 release 8C](https://download.microsoft.com/download/6/1/C/61C022FD-6F5D-4F73-9047-17F630899DC4/PolicyDDF_all_version1607_8C.xml) - [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download) -The XML below is the DDF for Windows 10, version 1809. +The XML below is the DDF for Windows 10, version 1903. ``` syntax @@ -53,7 +54,7 @@ The XML below is the DDF for Windows 10, version 1809. - com.microsoft/8.0/MDM/Policy + com.microsoft/9.0/MDM/Policy @@ -1420,12 +1421,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -1653,11 +1654,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -2733,6 +2734,30 @@ Related policy: + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + + + text/plain + + + AllowEnterpriseModeFromToolsMenu @@ -3237,6 +3262,30 @@ Related policy: + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + + + text/plain + + + DisableAdobeFlash @@ -3309,6 +3358,30 @@ Related policy: + + DisableCompatView + + + + + + + + + + + + + + + + + + + text/plain + + + DisableConfiguringHistory @@ -3453,6 +3526,30 @@ Related policy: + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + + + text/plain + + + DisableFirstRunWizard @@ -3501,6 +3598,30 @@ Related policy: + + DisableGeolocation + + + + + + + + + + + + + + + + + + + text/plain + + + DisableHomePageChange @@ -3693,6 +3814,30 @@ Related policy: + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + + + text/plain + + + DoNotAllowActiveXControlsInProtectedMode @@ -6765,6 +6910,30 @@ Related policy: + + NewTabDefaultPage + + + + + + + + + + + + + + + + + + + text/plain + + + NotificationBarInternetExplorerProcesses @@ -10235,7 +10404,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + 0 The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. @@ -10603,12 +10772,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -10862,11 +11031,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -12022,6 +12191,33 @@ Related policy: LastWrite + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + AllowServicePoweredQSA + LastWrite + + AllowEnterpriseModeFromToolsMenu @@ -12589,6 +12785,33 @@ Related policy: LastWrite + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement + VersionListAutomaticDownloadDisable + LastWrite + + DisableAdobeFlash @@ -12670,6 +12893,33 @@ Related policy: LastWrite + + DisableCompatView + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView + CompatView_DisableList + LastWrite + + DisableConfiguringHistory @@ -12832,6 +13082,33 @@ Related policy: LastWrite + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~RSS_Feeds + Disable_Background_Syncing + LastWrite + + DisableFirstRunWizard @@ -12886,6 +13163,33 @@ Related policy: LastWrite + + DisableGeolocation + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + GeolocationDisable + LastWrite + + DisableHomePageChange @@ -13102,6 +13406,33 @@ Related policy: LastWrite + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + RestrictWebAddressSuggest + LastWrite + + DoNotAllowActiveXControlsInProtectedMode @@ -16558,6 +16889,33 @@ Related policy: LastWrite + + NewTabDefaultPage + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + NewTabAction + LastWrite + + NotificationBarInternetExplorerProcesses @@ -19148,7 +19506,7 @@ Related policy: - com.microsoft/8.0/MDM/Policy + com.microsoft/9.0/MDM/Policy @@ -20830,6 +21188,30 @@ Related policy: + + ConfigureWebcamAccessDomainNames + + + + + + + + Specifies a list of domains that are allowed to access the webcam in CXH-based authentication scenarios. + + + + + + + + + + + text/plain + + + EnableFastFirstSignIn @@ -22414,12 +22796,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -22647,11 +23029,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -23525,6 +23907,7 @@ Related policy: + @@ -24870,6 +25253,30 @@ Related policy: + + SecurityIntelligenceLocation + + + + + + + + + + + + + + + + + + + text/plain + + + SignatureUpdateFallbackOrder @@ -25108,6 +25515,54 @@ Related policy: + + DODelayCacheServerFallbackBackground + + + + + + + + + + + + + + + + + + + text/plain + + + + + DODelayCacheServerFallbackForeground + + + + + + + + + + + + + + + + + + + text/plain + + + DODelayForegroundDownloadFromHttp @@ -25731,6 +26186,100 @@ Related policy: + + DeviceHealthMonitoring + + + + + + + + + + + + + + + + + + + + + AllowDeviceHealthMonitoring + + + + + + + + Enable/disable 4Nines device health monitoring on devices. + + + + + + + + + + + text/plain + + + + + ConfigDeviceHealthMonitoringScope + + + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which types of events are monitored. + + + + + + + + + + + text/plain + + + + + ConfigDeviceHealthMonitoringUploadDestination + + + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which destinations are in-scope for monitored events to be uploaded. + + + + + + + + + + + text/plain + + + + DeviceInstallation @@ -27260,6 +27809,35 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + ShowLockOnUserTile + + + + + + + + Shows or hides lock from the user tile menu. +If you enable this policy setting, the lock option will be shown in the User Tile menu. + +If you disable this policy setting, the lock option will never be shown in the User Tile menu. + +If you do not configure this policy setting, users will be able to choose whether they want lock to show through the Power Options Control Panel. + + + + + + + + + + + text/plain + + + ExploitGuard @@ -27634,6 +28212,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + + + text/plain + + + AllowEnterpriseModeFromToolsMenu @@ -28162,6 +28764,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + + + text/plain + + + DisableAdobeFlash @@ -28234,6 +28860,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableCompatView + + + + + + + + + + + + + + + + + + + text/plain + + + DisableConfiguringHistory @@ -28378,6 +29028,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + + + text/plain + + + DisableFirstRunWizard @@ -28426,6 +29100,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableGeolocation + + + + + + + + + + + + + + + + + + + text/plain + + + DisableIgnoringCertificateErrors @@ -28618,6 +29316,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + + + text/plain + + + DoNotAllowActiveXControlsInProtectedMode @@ -31738,6 +32460,30 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor + + NewTabDefaultPage + + + + + + + + + + + + + + + + + + + text/plain + + + NotificationBarInternetExplorerProcesses @@ -34140,7 +34886,8 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l Interactive Logon:Display user information when the session is locked User display name, domain and user names (1) User display name only (2) -Do not display user information (3) +Do not display user information (3) +Domain and user names only (4) @@ -35488,52 +36235,6 @@ The options are: - - Location - - - - - - - - - - - - - - - - - - - - - EnableLocation - - - - - - - - - - - - - - - - - - - text/plain - - - - LockDown @@ -36405,6 +37106,62 @@ The options are: + + EnergySaverBatteryThresholdOnBattery + + + + + + + + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + + + EnergySaverBatteryThresholdPluggedIn + + + + + + + + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + HibernateTimeoutOnBattery @@ -36501,6 +37258,210 @@ The options are: + + SelectLidCloseActionOnBattery + + + + + + + + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectLidCloseActionPluggedIn + + + + + + + + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectPowerButtonActionOnBattery + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectPowerButtonActionPluggedIn + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectSleepButtonActionOnBattery + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + + + SelectSleepButtonActionPluggedIn + + + + + + + + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + StandbyTimeoutOnBattery @@ -36549,6 +37510,122 @@ The options are: + + TurnOffHybridSleepOnBattery + + + + + + + + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + + + TurnOffHybridSleepPluggedIn + + + + + + + + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + + + UnattendedSleepTimeoutOnBattery + + + + + + + + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + + + UnattendedSleepTimeoutPluggedIn + + + + + + + + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + Printers @@ -38321,6 +39398,54 @@ The options are: + + LetAppsActivateWithVoice + + + + + + + + This policy setting specifies whether Windows apps can be activated by voice. + + + + + + + + + + + text/plain + + + + + LetAppsActivateWithVoiceAboveLock + + + + + + + + This policy setting specifies whether Windows apps can be activated by voice while the system is locked. + + + + + + + + + + + text/plain + + + LetAppsGetDiagnosticInfo @@ -39700,6 +40825,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowFindMyFiles + + + + + + + + This feature allows you to disable find my files completely on the machine + + + + + + + + + + + text/plain + + + AllowIndexingEncryptedStoresOrItems @@ -40275,6 +41424,52 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ServiceControlManager + + + + + + + + + + + + + + + + + + + + + SvchostProcessMitigation + + + + + + + + + + + + + + + + + + + text/plain + + + + Settings @@ -41512,6 +42707,150 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowStorageSenseGlobal + + + + + + + + + + + + + + + + + + + text/plain + + + + + AllowStorageSenseTemporaryFilesCleanup + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseCloudContentDehydrationThreshold + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseDownloadsCleanupThreshold + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseGlobalCadence + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigStorageSenseRecycleBinCleanupThreshold + + + + + + + + + + + + + + + + + + + text/plain + + + EnhancedStorageDevices @@ -41606,6 +42945,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AllowCommercialDataPipeline + + + + + + + + + + + + + + + + + + + text/plain + + + AllowDeviceNameInDiagnosticData @@ -41942,6 +43305,30 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + DisableDirectXDatabaseUpdate + + + + + + + + This group policy allows control over whether the DirectX Database Updater task will be run on the system. + + + + + + + + + + + text/plain + + + DisableEnterpriseAuthProxy @@ -42086,6 +43473,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + TurnOffFileHistory + + + + + + + + This policy setting allows you to turn off File History. + +If you enable this policy setting, File History cannot be activated to create regular, automatic backups. + +If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. + + + + + + + + + + + text/plain + + + SystemServices @@ -42964,6 +44379,85 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ConfigureTimeZone + + + + + + + + Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. + + + + + + + + + + + text/plain + + + + + + Troubleshooting + + + + + + + + + + + + + + + + + + + + + AllowRecommendations + + + + + + + + This policy setting applies recommended troubleshooting for known problems on the device and lets administrators configure how it's applied to their domains/IT environments. +Not configuring this policy setting will allow the user to configure if and how recommended troubleshooting is applied. + +Enabling this policy allows you to configure how recommended troubleshooting is applied on the user's device. You can select from one of the following values: +0 = Turn this feature off. +1 = Turn this feature off but still apply critical troubleshooting. +2 = Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. +3 = Run recommended troubleshooting automatically and notify the user after it's been successfully run. +4 = Run recommended troubleshooting automatically without notifying the user. +5 = Allow the user to choose their own recommended troubleshooting settings. + + + + + + + + + + + text/plain + + + Update @@ -43178,6 +44672,36 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + AutomaticMaintenanceWakeUp + + + + + + + + This policy setting allows you to configure Automatic Maintenance wake up policy. + +The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + + + + + + + + + + text/plain + + + AutoRestartDeadlinePeriodInDays @@ -43298,6 +44822,102 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ConfigureDeadlineForFeatureUpdates + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureDeadlineForQualityUpdates + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureDeadlineGracePeriod + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigureDeadlineNoAutoReboot + + + + + + + + + + + + + + + + + + + text/plain + + + ConfigureFeatureUpdateUninstallPeriod @@ -45882,6 +47502,54 @@ Because of these factors, users do not usually need this user right. Warning: If + + AllowAutomaticRestartSignOn + + + + + + + + + + + + + + + + + + + text/plain + + + + + ConfigAutomaticRestartSignOn + + + + + + + + + + + + + + + + + + + text/plain + + + DisableLockScreenAppNotifications @@ -45930,6 +47598,38 @@ Because of these factors, users do not usually need this user right. Warning: If + + EnableFirstLogonAnimation + + + + + + + + This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. + +If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. + +If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. + +If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. + +Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. + + + + + + + + + + + text/plain + + + EnumerateLocalUsersOnDomainJoinedComputers @@ -45978,30 +47678,6 @@ Because of these factors, users do not usually need this user right. Warning: If - - SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart - - - - - - - - - - - - - - - - - - - text/plain - - - WindowsPowerShell @@ -47993,6 +49669,30 @@ Because of these factors, users do not usually need this user right. Warning: If LowestValueMostSecure + + ConfigureWebcamAccessDomainNames + + + + + + Specifies a list of domains that are allowed to access the webcam in CXH-based authentication scenarios. + + + + + + + + + + + text/plain + + LastWrite + ; + + EnableFastFirstSignIn @@ -49356,7 +51056,7 @@ Due to Protected Settings (aka.ms/browserpolicy), this policy will only apply on - + 0 The favorites bar shows your user's links to sites they have added to it. With this policy, you can specify whether to set the favorites bar to always be visible or hidden on any page. If enabled, favorites bar is always visible on any page, and the favorites bar toggle in Settings sets to On, but disabled preventing your users from making changes. An error message also shows at the top of the Settings pane indicating that your organization manages some settings. The show bar/hide bar option is hidden from the context menu. @@ -49724,12 +51424,12 @@ Related policy: If enabled, you must include URLs to the pages, separating multiple pages using angle brackets in the following format: - + <support.contoso.com><support.microsoft.com> If disabled or not configured, the webpages specified in App settings loads as the default Start pages. Version 1703 or later: -If you do not want to send traffic to Microsoft, enable this policy and use the value, which honors domain- and non-domain-joined devices, when it is the only configured URL. +If you do not want to send traffic to Microsoft, enable this policy and use the <about:blank> value, which honors domain- and non-domain-joined devices, when it is the only configured URL. Version 1809: If enabled, and you select either Start page, New Tab page, or previous page in the Configure Open Microsoft Edge With policy, Microsoft Edge ignores the Configure Start Pages policy. If not configured or you set the Configure Open Microsoft Edge With policy to a specific page or pages, Microsoft Edge uses the Configure Start Pages policy. @@ -49983,11 +51683,11 @@ If disabled or not configured, extensions defined as part of this policy get ign Default setting: Disabled or not configured Related policies: Allow Developer Tools Related Documents: -- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) -- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/intune/windows-store-for-business) -- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/intune/apps-deploy) -- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) -- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/intune/lob-apps-windows) +- Find a package family name (PFN) for per-app VPN (https://docs.microsoft.com/en-us/sccm/protect/deploy-use/find-a-pfn-for-per-app-vpn) +- How to manage apps you purchased from the Microsoft Store for Business with Microsoft Intune (https://docs.microsoft.com/en-us/intune/windows-store-for-business) +- How to assign apps to groups with Microsoft Intune (https://docs.microsoft.com/en-us/intune/apps-deploy) +- Manage apps from the Microsoft Store for Business with System Center Configuration Manager (https://docs.microsoft.com/en-us/sccm/apps/deploy-use/manage-apps-from-the-windows-store-for-business) +- How to add Windows line-of-business (LOB) apps to Microsoft Intune (https://docs.microsoft.com/en-us/intune/lob-apps-windows) @@ -52448,6 +54148,34 @@ Related policy: LastWrite + + SecurityIntelligenceLocation + + + + + + + + + + + + + + + + + text/plain + + phone + WindowsDefender.admx + SignatureUpdate_SharedSignaturesLocation + WindowsDefender~AT~WindowsComponents~AntiSpywareDefender~SignatureUpdate + SignatureUpdate_SharedSignaturesLocation + LastWrite + + SignatureUpdateFallbackOrder @@ -52721,6 +54449,62 @@ Related policy: LastWrite + + DODelayCacheServerFallbackBackground + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + DelayCacheServerFallbackBackground + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DelayCacheServerFallbackBackground + LastWrite + + + + DODelayCacheServerFallbackForeground + + + + + 0 + + + + + + + + + + + + text/plain + + + DeliveryOptimization.admx + DelayCacheServerFallbackForeground + DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat + DelayCacheServerFallbackForeground + LastWrite + + DODelayForegroundDownloadFromHttp @@ -52824,7 +54608,7 @@ Related policy: text/plain - + DeliveryOptimization.admx GroupIdSource DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat @@ -53272,9 +55056,6 @@ Related policy: text/plain - DeliveryOptimization.admx - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - SetHoursToLimitBackgroundDownloadBandwidth LastWrite @@ -53307,7 +55088,7 @@ Related policy: + /> @@ -53334,9 +55115,6 @@ Related policy: text/plain - DeliveryOptimization.admx - DeliveryOptimization~AT~WindowsComponents~DeliveryOptimizationCat - SetHoursToLimitForegroundDownloadBandwidth LastWrite @@ -53369,7 +55147,7 @@ Related policy: + /> @@ -53512,6 +55290,96 @@ Related policy: + + DeviceHealthMonitoring + + + + + + + + + + + + + + + + + + + AllowDeviceHealthMonitoring + + + + + 0 + Enable/disable 4Nines device health monitoring on devices. + + + + + + + + + + + text/plain + + + LastWrite + + + + ConfigDeviceHealthMonitoringScope + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which types of events are monitored. + + + + + + + + + + + text/plain + + LastWrite + + + + ConfigDeviceHealthMonitoringUploadDestination + + + + + + If the device is not opted-in to the DeviceHealthMonitoring service via the AllowDeviceHealthMonitoring then this policy has no meaning. For devices which are opted in, the value of this policy modifies which destinations are in-scope for monitored events to be uploaded. + + + + + + + + + + + text/plain + + LastWrite + + + DeviceInstallation @@ -55136,6 +57004,38 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor HighestValueMostSecure + + ShowLockOnUserTile + + + + + 1 + Shows or hides lock from the user tile menu. +If you enable this policy setting, the lock option will be shown in the User Tile menu. + +If you disable this policy setting, the lock option will never be shown in the User Tile menu. + +If you do not configure this policy setting, users will be able to choose whether they want lock to show through the Power Options Control Panel. + + + + + + + + + + + text/plain + + + WindowsExplorer.admx + WindowsExplorer~AT~WindowsExplorer + ShowLockOption + HighestValueMostSecure + + ExploitGuard @@ -55531,6 +57431,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + AllowEnhancedSuggestionsInAddressBar + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + AllowServicePoweredQSA + LastWrite + + AllowEnterpriseModeFromToolsMenu @@ -56125,6 +58052,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableActiveXVersionListAutoDownload + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~SecurityFeatures~IESF_AddOnManagement + VersionListAutomaticDownloadDisable + LastWrite + + DisableAdobeFlash @@ -56206,6 +58160,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableCompatView + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer~CategoryCompatView + CompatView_DisableList + LastWrite + + DisableConfiguringHistory @@ -56368,6 +58349,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableFeedsBackgroundSync + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~RSS_Feeds + Disable_Background_Syncing + LastWrite + + DisableFirstRunWizard @@ -56422,6 +58430,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableGeolocation + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + GeolocationDisable + LastWrite + + DisableIgnoringCertificateErrors @@ -56638,6 +58673,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + DisableWebAddressAutoComplete + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + RestrictWebAddressSuggest + LastWrite + + DoNotAllowActiveXControlsInProtectedMode @@ -60148,6 +62210,33 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor LastWrite + + NewTabDefaultPage + + + + + + + + + + + + + + + + + text/plain + + phone + inetres.admx + inetres~AT~WindowsComponents~InternetExplorer + NewTabAction + LastWrite + + NotificationBarInternetExplorerProcesses @@ -62109,6 +64198,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor phone LastWrite + 0xF000 @@ -62792,7 +64882,8 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l Interactive Logon:Display user information when the session is locked User display name, domain and user names (1) User display name only (2) -Do not display user information (3) +Do not display user information (3) +Domain and user names only (4) @@ -62805,7 +64896,7 @@ Do not display user information (3) text/plain - + phone Windows Settings~Security Settings~Local Policies~Security Options Interactive logon: Display user information when the session is locked @@ -64255,53 +66346,6 @@ The options are: - - Location - - - - - - - - - - - - - - - - - - - EnableLocation - - - - - 0 - - - - - - - - - - - - text/plain - - - LocationProviderAdm.admx - LocationProviderAdm~AT~LocationAndSensors~WindowsLocationProvider - DisableWindowsLocationProvider_1 - LastWrite - - - LockDown @@ -65234,6 +67278,70 @@ The options are: LastWrite + + EnergySaverBatteryThresholdOnBattery + + + + + 0 + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + EnterEsBattThreshold + Power~AT~System~PowerManagementCat~EnergySaverSettingsCat + EsBattThresholdDC + LastWrite + + + + EnergySaverBatteryThresholdPluggedIn + + + + + 0 + This policy setting allows you to specify battery charge level at which Energy Saver is turned on. + +If you enable this policy setting, you must provide a percent value, indicating the battery charge level. Energy Saver will be automatically turned on at (and below) the specified level. + +If you disable or do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + EnterEsBattThreshold + Power~AT~System~PowerManagementCat~EnergySaverSettingsCat + EsBattThresholdAC + LastWrite + + HibernateTimeoutOnBattery @@ -65342,6 +67450,234 @@ The options are: LastWrite + + SelectLidCloseActionOnBattery + + + + + 1 + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectDCSystemLidAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + DCSystemLidAction_2 + LastWrite + + + + SelectLidCloseActionPluggedIn + + + + + 1 + This policy setting specifies the action that Windows takes when a user closes the lid on a mobile PC. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectACSystemLidAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + ACSystemLidAction_2 + LastWrite + + + + SelectPowerButtonActionOnBattery + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectDCPowerButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + DCPowerButtonAction_2 + LastWrite + + + + SelectPowerButtonActionPluggedIn + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the power button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectACPowerButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + ACPowerButtonAction_2 + LastWrite + + + + SelectSleepButtonActionOnBattery + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectDCSleepButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + DCSleepButtonAction_2 + LastWrite + + + + SelectSleepButtonActionPluggedIn + + + + + 1 + This policy setting specifies the action that Windows takes when a user presses the sleep button. + +Possible actions include: +0 - Take no action +1 - Sleep +2 - Hibernate +3 - Shut down + +If you enable this policy setting, you must select the desired action. + +If you disable this policy setting or do not configure it, users can see and change this setting. + + + + + + + + + + + text/plain + + + Power.admx + SelectACSleepButtonAction + Power~AT~System~PowerManagementCat~PowerButtonActionSettingsCat + ACSleepButtonAction_2 + LastWrite + + StandbyTimeoutOnBattery @@ -65396,6 +67732,136 @@ The options are: LastWrite + + TurnOffHybridSleepOnBattery + + + + + 0 + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + DCStandbyWithHiberfileEnable_2 + LastWrite + + + + TurnOffHybridSleepPluggedIn + + + + + 0 + This policy setting allows you to turn off hybrid sleep. + +If you set this to 0, a hiberfile is not generated when the system transitions to sleep (Stand By). + +If you do not configure this policy setting, users control this setting. + + + + + + + + + + + text/plain + + + Power.admx + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + ACStandbyWithHiberfileEnable_2 + LastWrite + + + + UnattendedSleepTimeoutOnBattery + + + + + 0 + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + Power.admx + EnterUnattendedSleepTimeOut + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + UnattendedSleepTimeOutDC + LastWrite + + + + UnattendedSleepTimeoutPluggedIn + + + + + 0 + This policy setting allows you to specify the period of inactivity before Windows transitions to sleep automatically when a user is not present at the computer. + +If you enable this policy setting, you must provide a value, in seconds, indicating how much idle time should elapse before Windows automatically transitions to sleep when left unattended. If you specify 0 seconds, Windows does not automatically transition to sleep. + +If you disable or do not configure this policy setting, users control this setting. + +If the user has configured a slide show to run on the lock screen when the machine is locked, this can prevent the sleep transition from occuring. The "Prevent enabling lock screen slide show" policy setting can be used to disable the slide show feature. + + + + + + + + + + + text/plain + + + Power.admx + EnterUnattendedSleepTimeOut + Power~AT~System~PowerManagementCat~PowerSleepSettingsCat + UnattendedSleepTimeOutAC + LastWrite + + Printers @@ -67427,6 +69893,62 @@ The options are: ; + + LetAppsActivateWithVoice + + + + + 0 + This policy setting specifies whether Windows apps can be activated by voice. + + + + + + + + + + + text/plain + + + AppPrivacy.admx + LetAppsActivateWithVoice_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsActivateWithVoice + HighestValueMostSecure + + + + LetAppsActivateWithVoiceAboveLock + + + + + 0 + This policy setting specifies whether Windows apps can be activated by voice while the system is locked. + + + + + + + + + + + text/plain + + + AppPrivacy.admx + LetAppsActivateWithVoiceAboveLock_Enum + AppPrivacy~AT~WindowsComponents~AppPrivacy + LetAppsActivateWithVoiceAboveLock + HighestValueMostSecure + + LetAppsGetDiagnosticInfo @@ -68989,6 +71511,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AllowFindMyFiles + + + + + 1 + This feature allows you to disable find my files completely on the machine + + + + + + + + + + + text/plain + + + phone + Search.admx + Search~AT~WindowsComponents~Search + AllowFindMyFiles + LowestValueMostSecure + + AllowIndexingEncryptedStoresOrItems @@ -69598,6 +72148,53 @@ Caution: If a Restricted Groups policy is applied, any current member not on the + + ServiceControlManager + + + + + + + + + + + + + + + + + + + SvchostProcessMitigation + + + + + + + + + + + + + + + + + text/plain + + phone + ServiceControlManager.admx + ServiceControlManager~AT~System~ServiceControlManagerCat~ServiceControlManagerSecurityCat + SvchostProcessMitigationEnable + LastWrite + + + Settings @@ -70893,6 +73490,174 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LastWrite + + AllowStorageSenseGlobal + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_AllowStorageSenseGlobal + LastWrite + + + + AllowStorageSenseTemporaryFilesCleanup + + + + + 1 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_AllowStorageSenseTemporaryFilesCleanup + LastWrite + + + + ConfigStorageSenseCloudContentDehydrationThreshold + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseCloudContentDehydrationThreshold + LastWrite + + + + ConfigStorageSenseDownloadsCleanupThreshold + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseDownloadsCleanupThreshold + LastWrite + + + + ConfigStorageSenseGlobalCadence + + + + + 0 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseGlobalCadence + LastWrite + + + + ConfigStorageSenseRecycleBinCleanupThreshold + + + + + 30 + + + + + + + + + + + + text/plain + + + phone + StorageSense.admx + StorageSense~AT~System~StorageSense + SS_ConfigStorageSenseRecycleBinCleanupThreshold + LastWrite + + EnhancedStorageDevices @@ -70995,6 +73760,34 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AllowCommercialDataPipeline + + + + + 0 + + + + + + + + + + + + text/plain + + + DataCollection.admx + AllowCommercialDataPipeline + DataCollection~AT~WindowsComponents~DataCollectionAndPreviewBuilds + AllowCommercialDataPipeline + HighestValueMostSecure + + AllowDeviceNameInDiagnosticData @@ -71367,6 +74160,33 @@ Caution: If a Restricted Groups policy is applied, any current member not on the HighestValueMostSecure + + DisableDirectXDatabaseUpdate + + + + + 0 + This group policy allows control over whether the DirectX Database Updater task will be run on the system. + + + + + + + + + + + text/plain + + + GroupPolicy.admx + GroupPolicy~AT~Network~DirectXDatabase + DisableDirectXDatabaseUpdate + HighestValueMostSecure + + DisableEnterpriseAuthProxy @@ -71528,6 +74348,37 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LastWrite + + TurnOffFileHistory + + + + + 0 + This policy setting allows you to turn off File History. + +If you enable this policy setting, File History cannot be activated to create regular, automatic backups. + +If you disable or do not configure this policy setting, File History can be activated to create regular, automatic backups. + + + + + + + + + + + text/plain + + + FileHistory.admx + FileHistory~AT~WindowsComponents~FileHistory + DisableFileHistory + LowestValueMostSecure + + SystemServices @@ -72432,6 +75283,87 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + ConfigureTimeZone + + + + + + Specifies the time zone to be applied to the device. This is the standard Windows name for the target time zone. + + + + + + + + + + + text/plain + + phone + LastWrite + + + + + Troubleshooting + + + + + + + + + + + + + + + + + + + AllowRecommendations + + + + + 1 + This policy setting applies recommended troubleshooting for known problems on the device and lets administrators configure how it's applied to their domains/IT environments. +Not configuring this policy setting will allow the user to configure if and how recommended troubleshooting is applied. + +Enabling this policy allows you to configure how recommended troubleshooting is applied on the user's device. You can select from one of the following values: +0 = Turn this feature off. +1 = Turn this feature off but still apply critical troubleshooting. +2 = Notify users when recommended troubleshooting is available, then allow the user to run or ignore it. +3 = Run recommended troubleshooting automatically and notify the user after it's been successfully run. +4 = Run recommended troubleshooting automatically without notifying the user. +5 = Allow the user to choose their own recommended troubleshooting settings. + + + + + + + + + + + text/plain + + + phone + MSDT.admx + MSDT~AT~System~Troubleshooting~WdiScenarioCategory + TroubleshootingAllowRecommendations + LowestValueMostSecure + + Update @@ -72671,6 +75603,39 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LowestValueMostSecure + + AutomaticMaintenanceWakeUp + + + + + 1 + This policy setting allows you to configure Automatic Maintenance wake up policy. + +The maintenance wakeup policy specifies if Automatic Maintenance should make a wake request to the OS for the daily scheduled maintenance. Note, that if the OS power wake policy is explicitly disabled, then this setting has no effect. + +If you enable this policy setting, Automatic Maintenance will attempt to set OS wake policy and make a wake request for the daily scheduled time, if required. + +If you disable or do not configure this policy setting, the wake setting as specified in Security and Maintenance/Automatic Maintenance Control Panel will apply. + + + + + + + + + + + text/plain + + + msched.admx + msched~AT~WindowsComponents~MaintenanceScheduler + WakeUpPolicy + HighestValueMostSecure + + AutoRestartDeadlinePeriodInDays @@ -72803,7 +75768,7 @@ Caution: If a Restricted Groups policy is applied, any current member not on the text/plain - + WindowsUpdate.admx BranchReadinessLevelId WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat~DeferUpdateCat @@ -72811,6 +75776,118 @@ Caution: If a Restricted Groups policy is applied, any current member not on the LastWrite + + ConfigureDeadlineForFeatureUpdates + + + + + 7 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineForFeatureUpdates + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineForFeatureUpdates + LastWrite + + + + ConfigureDeadlineForQualityUpdates + + + + + 7 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineForQualityUpdates + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineForQualityUpdates + LastWrite + + + + ConfigureDeadlineGracePeriod + + + + + 2 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineGracePeriod + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineGracePeriod + LastWrite + + + + ConfigureDeadlineNoAutoReboot + + + + + 0 + + + + + + + + + + + + text/plain + + + WindowsUpdate.admx + ConfigureDeadlineNoAutoReboot + WindowsUpdate~AT~WindowsComponents~WindowsUpdateCat + ConfigureDeadlineNoAutoReboot + HighestValueMostSecure + + ConfigureFeatureUpdateUninstallPeriod @@ -75715,6 +78792,60 @@ Because of these factors, users do not usually need this user right. Warning: If + + AllowAutomaticRestartSignOn + + + + + + + + + + + + + + + + + text/plain + + phone + WinLogon.admx + WinLogon~AT~WindowsComponents~Logon + AutomaticRestartSignOn + LastWrite + + + + ConfigAutomaticRestartSignOn + + + + + + + + + + + + + + + + + text/plain + + phone + WinLogon.admx + WinLogon~AT~WindowsComponents~Logon + ConfigAutomaticRestartSignOn + LastWrite + + DisableLockScreenAppNotifications @@ -75769,6 +78900,41 @@ Because of these factors, users do not usually need this user right. Warning: If LastWrite + + EnableFirstLogonAnimation + + + + + 1 + This policy setting allows you to control whether users see the first sign-in animation when signing in to the computer for the first time. This applies to both the first user of the computer who completes the initial setup and users who are added to the computer later. It also controls if Microsoft account users will be offered the opt-in prompt for services during their first sign-in. + +If you enable this policy setting, Microsoft account users will see the opt-in prompt for services, and users with other accounts will see the sign-in animation. + +If you disable this policy setting, users will not see the animation and Microsoft account users will not see the opt-in prompt for services. + +If you do not configure this policy setting, the user who completes the initial Windows setup will see the animation during their first sign-in. If the first user had already completed the initial setup and this policy setting is not configured, users new to this computer will not see the animation. + +Note: The first sign-in animation will not be shown on Server, so this policy will have no effect. + + + + + + + + + + + text/plain + + + Logon.admx + Logon~AT~System~Logon + EnableFirstLogonAnimation + HighestValueMostSecure + + EnumerateLocalUsersOnDomainJoinedComputers @@ -75823,33 +78989,6 @@ Because of these factors, users do not usually need this user right. Warning: If HighestValueMostSecure - - SignInLastInteractiveUserAutomaticallyAfterASystemInitiatedRestart - - - - - - - - - - - - - - - - - text/plain - - phone - WinLogon.admx - WinLogon~AT~WindowsComponents~Logon - AutomaticRestartSignOn - LastWrite - - WindowsPowerShell @@ -76131,4 +79270,5 @@ Because of these factors, users do not usually need this user right. Warning: If + ``` \ No newline at end of file From c4b240236f25b339b3cc02658c977df5139d2895 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 21 May 2019 15:32:10 -0700 Subject: [PATCH 03/19] Updated links --- .../mdm/new-in-windows-mdm-enrollment-management.md | 4 ++++ windows/client-management/mdm/policy-ddf-file.md | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index ab44a155b2..2bcf6c8cab 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -54,6 +54,9 @@ For details about Microsoft mobile device management protocols for Windows 10 s - [What is dmwappushsvc?](#what-is-dmwappushsvc) - **Change history in MDM documentation** + - [May 2019](#may-2019) + - [April 2019](#april-2019) + - [March 2019](#march-2019) - [February 2019](#february-2019) - [January 2019](#january-2019) - [December 2018](#december-2018) @@ -1860,6 +1863,7 @@ What data is handled by dmwappushsvc? | It is a component handling the internal How do I turn if off? | The service can be stopped from the "Services" console on the device (Start > Run > services.msc). However, since this is a component part of the OS and required for the proper functioning of the device, we strongly recommend not to do this. | ## Change history in MDM documentation + ### May 2019 |New or updated topic | Description| diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 86088f08cb..7fe51e91b2 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -19,7 +19,7 @@ This topic shows the OMA DM device description framework (DDF) for the **Policy* You can download the DDF files from the links below: -- [Download the Policy DDF file for Windows 10, version 1803](http://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/PolicyDDF_all_1809.xml) +- [Download the Policy DDF file for Windows 10, version 1809](http://download.microsoft.com/download/7/3/5/735B8537-82F4-4CD1-B059-93984F9FAAC5/PolicyDDF_all_1809.xml) - [Download the Policy DDF file for Windows 10, version 1803](https://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all.xml) - [Download the Policy DDF file for Windows 10, version 1803 release C](http://download.microsoft.com/download/4/9/6/496534EE-8F0C-4F12-B084-A8502DA22430/PolicyDDF_all_1809C_release.xml) - [Download the Policy DDF file for Windows 10, version 1709](https://download.microsoft.com/download/8/C/4/8C43C116-62CB-470B-9B69-76A3E2BC32A8/PolicyDDF_all.xml) From 02fccdfe189c97e11c59aaa66c3f2c42f6403db0 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 21 May 2019 15:52:12 -0700 Subject: [PATCH 04/19] Minor updates --- .../mdm/new-in-windows-mdm-enrollment-management.md | 2 +- .../mdm/policy-configuration-service-provider.md | 2 -- windows/client-management/mdm/policy-ddf-file.md | 2 -- 3 files changed, 1 insertion(+), 5 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 2bcf6c8cab..c2d80ef496 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -95,7 +95,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • [DeliveryOptimization/DODelayCacheServerFallbackBackground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackbackground)
  • [DeliveryOptimization/DODelayCacheServerFallbackForeground](policy-csp-deliveryoptimization.md#deliveryoptimization-dodelaycacheserverfallbackforeground)
  • [Experience/ShowLockOnUserTile](policy-csp-experience.md#experience-showlockonusertile)
    • -
  • [InternetExplorer/AllowEnhancedSuggestionsInAddressBar]((policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar)
    • +
  • [InternetExplorer/AllowEnhancedSuggestionsInAddressBar](policy-csp-internetexplorer.md#internetexplorer-allowenhancedsuggestionsinaddressbar)
  • [InternetExplorer/DisableActiveXVersionListAutoDownload](policy-csp-internetexplorer.md#internetexplorer-disableactivexversionlistautodownload)
  • [InternetExplorer/DisableCompatView](policy-csp-internetexplorer.md#internetexplorer-disablecompatview)
  • [InternetExplorer/DisableFeedsBackgroundSync](policy-csp-internetexplorer.md#internetexplorer-disablefeedsbackgroundsync)
    • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index d909560292..586c0e380e 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -12,8 +12,6 @@ ms.date: 05/01/2019 # Policy CSP -> [!WARNING] -> Some information relates to prereleased products, which may be substantially modified before it's commercially released. Microsoft makes no warranties, expressed or implied, concerning the information provided here. The Policy configuration service provider enables the enterprise to configure policies on Windows 10. Use this configuration service provider to configure any company policies. diff --git a/windows/client-management/mdm/policy-ddf-file.md b/windows/client-management/mdm/policy-ddf-file.md index 7fe51e91b2..7508d7364c 100644 --- a/windows/client-management/mdm/policy-ddf-file.md +++ b/windows/client-management/mdm/policy-ddf-file.md @@ -12,8 +12,6 @@ ms.date: 05/21/2019 # Policy DDF file -> [!WARNING] -> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This topic shows the OMA DM device description framework (DDF) for the **Policy** configuration service provider. DDF files are used only with OMA DM provisioning XML. From 261aad36dc810aa17001352c006f2707b569eb91 Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 21 May 2019 17:46:08 -0700 Subject: [PATCH 05/19] minor update --- ...ew-in-windows-mdm-enrollment-management.md | 23 +++++++++---------- 1 file changed, 11 insertions(+), 12 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index c2d80ef496..568389f6f7 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1869,29 +1869,28 @@ How do I turn if off? | The service can be stopped from the "Services" console o |New or updated topic | Description| |--- | ---| |[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)|Added new CSP in Windows 10, version 1903.| -|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies: DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground

    Updated description of the following policies: DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer| -|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy: ShowLockOnUserTile| -|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies: AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage| -|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies: EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn| -|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy: AllowFindMyFiles| -|[Policy CSP - System](policy-csp-system.md)|Added the following new policies: AllowCommercialDataPipeline, TurnOffFileHistory| -|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies: AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot| -|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies: AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation| -|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes: DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus| +|[Policy CSP - DeliveryOptimization](policy-csp-deliveryoptimization.md)|Added the following new policies:
    DODelayCacheServerFallbackBackground, DODelayCacheServerFallbackForeground.

    Updated description of the following policies:
    DOMinRAMAllowedToPeer, DOMinFileSizeToCache, DOMinDiskSizeAllowedToPeer.| +|[Policy CSP - Experience](policy-csp-experience.md)|Added the following new policy:
    ShowLockOnUserTile.| +|[Policy CSP - InternetExplorer](policy-csp-internetexplorer.md)|Added the following new policies:
    AllowEnhancedSuggestionsInAddressBar, DisableActiveXVersionListAutoDownload, DisableCompatView, DisableFeedsBackgroundSync, DisableGeolocation, DisableWebAddressAutoComplete, NewTabDefaultPage.| +|[Policy CSP - Power](policy-csp-power.md)|Added the following new policies:
    EnergySaverBatteryThresholdOnBattery, EnergySaverBatteryThresholdPluggedIn, SelectLidCloseActionOnBattery, SelectLidCloseActionPluggedIn, SelectPowerButtonActionOnBattery, SelectPowerButtonActionPluggedIn, SelectSleepButtonActionOnBattery, SelectSleepButtonActionPluggedIn, TurnOffHybridSleepOnBattery, TurnOffHybridSleepPluggedIn, UnattendedSleepTimeoutOnBattery, UnattendedSleepTimeoutPluggedIn.| +|[Policy CSP - Search](policy-csp-search.md)|Added the following new policy:
    AllowFindMyFiles.| +|[Policy CSP - System](policy-csp-system.md)|Added the following new policies:
    AllowCommercialDataPipeline, TurnOffFileHistory.| +|[Policy CSP - Update](policy-csp-update.md)|Added the following new policies:
    AutomaticMaintenanceWakeUp, ConfigureDeadlineForFeatureUpdates, ConfigureDeadlineForQualityUpdates, ConfigureDeadlineGracePeriod, ConfigureDeadlineNoAutoReboot.| +|[Policy CSP - WindowsLogon](policy-csp-windowslogon.md)|Added the following new policies:
    AllowAutomaticRestartSignOn, ConfigAutomaticRestartSignOn, EnableFirstLogonAnimation.| +|[DeviceStatus CSP](devicestatus-csp.md)|Updated description of the following nodes:
    DeviceStatus/Antivirus/SignatureStatus, DeviceStatus/Antispyware/SignatureStatus.| ### April 2019 |New or updated topic | Description| |--- | ---| -|[Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md)|Added the following warning at the end of the Overview section: Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined.| +|[Win32 and Desktop Bridge app policy configuration](win32-and-centennial-app-policy-configuration.md)|Added the following warning at the end of the Overview section:
    Some operating system components have built in functionality to check devices for domain membership. MDM enforces the configured policy values only if the devices are domain joined, otherwise it does not. However, you can still import ADMX files and set ADMX-backed policies regardless of whether the device is domain joined or non-domain joined.| |[Policy CSP - UserRights](policy-csp-userrights.md)|Added a note stating if you use Intune custom profiles to assign UserRights policies, you must use the CDATA tag () to wrap the data fields.| ### March 2019 |New or updated topic | Description| |--- | ---| -|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies: AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold| -|[Policy CSP - Storage](policy-csp-storage.md)|Updated description of ConfigStorageSenseDownloadsCleanupThreshold| +|[Policy CSP - Storage](policy-csp-storage.md)|Updated ADMX Info of the following policies:
    AllowStorageSenseGlobal, AllowStorageSenseTemporaryFilesCleanup, ConfigStorageSenseCloudContentDehydrationThreshold, ConfigStorageSenseDownloadsCleanupThreshold, ConfigStorageSenseGlobalCadence, ConfigStorageSenseRecycleBinCleanupThreshold.

    Updated description of ConfigStorageSenseDownloadsCleanupThreshold.| ### February 2019 From 95ec160a886a4dde75f4cb9a222faedc3e20fc01 Mon Sep 17 00:00:00 2001 From: DocsPreview <49669258+DocsPreview@users.noreply.github.com> Date: Tue, 21 May 2019 18:01:33 -0700 Subject: [PATCH 06/19] Latest updates for 1903 product version (#260) (#261) --- .../status-windows-10-1903.yml | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index a98c7d3ed7..6f5714b4dd 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,18 +65,18 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    DetailsOriginating updateStatusHistory
    Unable to access some gov.uk websites
    After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

    Affected platforms:
    • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
    • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
    Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible.
     
     

    Back to top    		OS Build 17763.502

    May 14, 2019
    KB4494441    		Investigating
    		Last updated:
    May 16, 2019
    06:41 PM PT

    Opened:
    May 16, 2019
    01:57 PM PT
    Unable to access some gov.uk websites
    After installing the May 14, 2019 update, some gov.uk websites that don’t support HTTP Strict Transport Security (HSTS) may not be accessible through Internet Explorer 11 or Microsoft Edge.

    Affected platforms:
    • Client: Windows 10, version 1809; Windows 10, version 1803; Windows 10, version 1709; Windows 10, version 1703; Windows 10, version 1607; Windows 10, version 1507; Windows 8.1; Windows 7 SP1 
    • Server: Windows Server, version 1809; Windows Server 2019; Windows Server, version 1803; Windows Server, version 1709; Windows Server 2016; Windows Server 2012 R2; Windows Server 2012; Windows Server 2008 R2 SP1
    Next Steps: Microsoft is working on a resolution and will provide an update as quickly as possible.
     
     

    Back to top    		OS Build 17763.503

    May 14, 2019
    KB4494441    		Investigating
    		Last updated:
    May 16, 2019
    06:41 PM PT

    Opened:
    May 16, 2019
    01:57 PM PT
    Devices with some Asian language packs installed may receive an error
    After installing the April 2019 Cumulative Update (KB4493509), devices with some Asian language packs installed may receive the error, \"0x800f0982 - PSFX_E_MATCHING_COMPONENT_NOT_FOUND.\"

    Affected platforms:
    • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
    • Server: Windows Server, version 1809; Windows Server 2019
    Workaround:
    1. Uninstall and reinstall any recently added language packs. For instructions, see \"Manage the input and display language settings in Windows 10\".
    2. Click Check for Updates and install the April 2019 Cumulative Update. For instructions, see \"Update Windows 10\".
    Note: If reinstalling the language pack does not mitigate the issue, reset your PC as follows:
    1. Go to Settings app -> Recovery.
    2. Click on Get Started under \"Reset this PC\" recovery option.
    3. Select \"Keep my Files\".
    Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 17763.437

    April 09, 2019
    KB4493509    		Mitigated
    		Last updated:
    May 03, 2019
    10:59 AM PT

    Opened:
    May 02, 2019
    04:36 PM PT
    Printing from Microsoft Edge or other UWP apps, you may receive the error 0x80070007
    When attempting to print from Microsoft Edge or other Universal Windows Platform (UWP) applications you may receive the error, \"Your printer has experienced an unexpected configuration problem. 0x80070007e.\"
     
    Affected platforms:
    • Client: Windows 10, version 1809; Windows 10 Enterprise LTSC 2019
    • Server: Windows Server, version 1809; Windows Server 2019
    Workaround: You can use another browser, such as Internet Explorer to print your documents.
     
    Next steps: Microsoft is working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 17763.379

    March 12, 2019
    KB4489899    		Mitigated
    		Last updated:
    May 02, 2019
    04:47 PM PT

    Opened:
    May 02, 2019
    04:47 PM PT
    Windows 10, version 1809 update history may show an update installed twice
    Affected platforms:
    • Client: Windows 10, version 1809
    Cause:
    In certain situations, installing an update requires multiple download and restart steps. In cases where two intermediate steps of the installation complete successfully, the View your Update history page will report that installation completed successfully twice. 

    Resolution:
    No action is required on your part. The update installation may take longer and may require more than one restart, but will install successfully after all intermediate installation steps have completed. We are working on improving this update experience to ensure the Update history correctly reflects the installation of the latest cumulative update (LCU).

    Back to top    		OS Build 17763.503

    May 14, 2019
    KB4494441    		Resolved
    		Resolved:
    May 16, 2019
    02:37 PM PT

    Opened:
    May 14, 2019
    02:56 PM PT
    [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)[EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md)

    Added new CSP in Windows 10, version 1903.

    Added new settings in Windows 10, version 1809.

    [TenantLockdown CSP](\tenantlockdown--csp.md)[TenantLockdown CSP](\tenantlockdown-csp.md)

    Added new CSP in Windows 10, version 1809.

    - - + - - + + + + + + + + + - - - - - -
    SummaryOriginating updateStatusLast updated
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:56 AM PT
    Duplicate folders and documents showing in user profile directory
    If known folders (e.g. Desktop, Documents, or Pictures folders) are redirected, an empty folder with that same name may be created.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:35 AM PT
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    04:47 PM PT
    Audio not working with Dolby Atmos headphones and home theater
    Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:17 AM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    08:34 AM PT
    Error attempting to update with external USB device or memory card attached
    PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:38 AM PT
    Duplicate folders and documents showing in user profile directory
    If known folders (e.g. Desktop, Documents, or Pictures folders) are redirected, an empty folder with that same name may be created.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:16 AM PT
    Error attempting to update with external USB device or memory card attached
    PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:49 PM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:48 PM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:48 PM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    Intermittent loss of Wi-Fi connectivity
    Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:46 PM PT
    AMD RAID driver incompatibility
    Installation process may stop when trying to install Windows 10, version 1903 update on computers that run certain versions of AMD RAID drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:45 PM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct3D (D3D) applications and games may fail to enter full-screen mode on rotated displays.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:45 PM PT
    Older versions of BattlEye anti-cheat software incompatible
    Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:34 AM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:29 AM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:28 AM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:20 AM PT
    Intermittent Wi-Fi connectivity loss
    Some older devices may experience losing Wi-Fi connectivity due to an outdated Qualcomm driver.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:13 AM PT
    AMD RAID driver incompatibility
    Installation process may stop when trying to instal Windows 10, version 1903 update on computers that run certain versions of AMD RAID drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:12 AM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct 3D (D3D) applications and games may fail to enter full-screen mode on rotated displays.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:05 AM PT
    " @@ -92,17 +92,17 @@ sections: - type: markdown text: " - - + - - + + + + + + + + + - - - - - -
    DetailsOriginating updateStatusHistory
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel drivers. After updating to Window 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

    To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.
     
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Restart your device to apply changes to brightness.

    Next steps: We are working on a resolution that will be made available in upcoming release.
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.
     

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:56 AM PT

    Opened:
    May 21, 2019
    07:56 AM PT
    Duplicate folders and documents showing in user profile directory
    If you have redirected known folders (e.g. Desktop, Documents, or Pictures folders) you may see an empty folder with the same name in your %userprofile% directories after updating to Windows 10, version 1903. This may occur if known folders were redirected when you chose to back up your content to OneDrive using the OneDrive wizard, or if you chose to back up your content during the Windows Out-of-Box-Experience (OOBE). This may also occur if you redirected your known folders manually through the Properties dialog box in File Explorer. ​This issue does not cause any user files to be deleted and a solution is in progress.

    To safeguard your update experience, we have applied a quality hold on devices with redirected known folders from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.
    Note We recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:35 AM PT

    Opened:
    May 21, 2019
    07:35 AM PT
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Window 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

    To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Restart your device to apply changes to brightness.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution that will be made available in upcoming release.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:56 AM PT
    Audio not working with Dolby Atmos headphones and home theater
    After updating to Windows 10, version 1903, you may experience loss of audio with Dolby Atmos for home theater (free extension) or Dolby Atmos for headphones (paid extension) acquired through the Microsoft Store due to a licensing configuration error.
     
    This occurs due to an issue with a Microsoft Store licensing component, where license holders are not able to connect to the Dolby Access app and enable Dolby Atmos extensions.
     
    To safeguard your update experience, we have applied protective hold on devices from being offered Windows 10, version 1903 until this issue is resolved. This configuration error will not result in loss of access for the acquired license once the problem is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: We are working on a resolution for Microsoft Store and estimate a solution will be available in mid-June.
    Note We recommend you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved. 

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:17 AM PT

    Opened:
    May 21, 2019
    07:16 AM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to the latest Windows feature update, you have an Intel Audio Display device driver (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8) installed on your machine.
      
    To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809
    Workaround:
    On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

    For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

    Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.
    Note We recommend you do not attempt to update your devices until newer device drivers are installed.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    08:34 AM PT

    Opened:
    May 21, 2019
    07:22 AM PT
    Error attempting to update with external USB device or memory card attached
    If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

    Sample scenario: An update to Windows 10, 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

    Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

    To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To work around this issue, remove all external media, such as USB devices and SD cards, from your computer and restart installation of the Windows 10, version 1903 feature update. The update should then proceed normally.

    Next steps: Microsoft is working on a resolution and estimate a solution will be available in late May.
    Note If you need to keep your external device, SD memory card, or other devices attached to your computer while updating, we recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:38 AM PT

    Opened:
    May 21, 2019
    07:38 AM PT
    Duplicate folders and documents showing in user profile directory
    If you have redirected known folders (e.g. Desktop, Documents, or Pictures folders) you may see an empty folder with the same name in your %userprofile% directories after updating to Windows 10, version 1903. This may occur if known folders were redirected when you chose to back up your content to OneDrive using the OneDrive wizard, or if you chose to back up your content during the Windows Out-of-Box-Experience (OOBE). This may also occur if you redirected your known folders manually through the Properties dialog box in File Explorer. ​This issue does not cause any user files to be deleted and a solution is in progress.

    To safeguard your update experience, we have applied a quality hold on devices with redirected known folders from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.
    Note We recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:16 AM PT

    Opened:
    May 21, 2019
    07:16 AM PT
    Error attempting to update with external USB device or memory card attached
    If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

    Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

    Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

    To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To work around this issue, remove all external media, such as USB devices and SD cards, from your computer and restart installation of the Windows 10, version 1903 feature update. The update should then proceed normally.
    Note If you need to keep your external device, SD memory card, or other devices attached to your computer while updating, we recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: Microsoft is working on a resolution and estimate a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:49 PM PT

    Opened:
    May 21, 2019
    07:38 AM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

    • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
    • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
    Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

    Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  


    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:48 PM PT

    Opened:
    May 21, 2019
    07:29 AM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working, for example:
    • Connecting to (or disconnecting from) an external monitor, dock, or projector
    • Rotating the screen
    • Updating display drivers or making other display mode changes
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you find that your night light settings have stopped working, try turning the night light on and off, or restart your computer.  

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.


    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:48 PM PT

    Opened:
    May 21, 2019
    07:28 AM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
      
    To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809
    Workaround:
    On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

    For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

    Note We recommend you do not attempt to update your devices until newer device drivers are installed.

    Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:22 AM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

    \"Close other apps, error code: 0XA00F4243.”


    To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To temporarily resolve this issue, perform one of the following:

    • Unplug your camera and plug it back in.

    or

    • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

    or

    • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
    Note This workaround will only resolve the issue until your next system restart.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:20 AM PT
    Intermittent loss of Wi-Fi connectivity
    Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

    To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Download and install an updated Wi-Fi driver from your device manufacturer (OEM).
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:46 PM PT

    Opened:
    May 21, 2019
    07:13 AM PT
    AMD RAID driver incompatibility
    Microsoft and AMD have identified an incompatibility with AMD RAID driver versions lower than 9.2.0.105. When you attempt to install the Windows 10, version 1903 update on a Windows 10-based computer with an affected driver version, the installation process stops and you get a message like the following:

    AMD Ryzen™ or AMD Ryzen™ Threadripper™ configured in SATA or NVMe RAID mode.

    “A driver is installed that causes stability problems on Windows. This driver will be disabled. Check with your software/driver provider for an updated version that runs on this version of Windows.”

     
    To safeguard your update experience, we have applied a compatibility hold on devices with these AMD drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To resolve this issue, download the latest AMD RAID drivers directly from AMD at https://www.amd.com/en/support/chipsets/amd-socket-tr4/x399. The drivers must be version 9.2.0.105 or later. Install the drivers on the affected computer, and then restart the installation process for the Windows 10, version 1903 feature update.
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.
     

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:45 PM PT

    Opened:
    May 21, 2019
    07:12 AM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct3D (D3D) applications and games (e.g., 3DMark) may fail to enter full-screen mode on displays where the display orientation has been changed from the default (e.g., a landscape display in portrait mode).

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: To work around this issue, do one of the following:
    • Run applications in windowed mode or, if available, on a secondary non-rotated display. 
    • Change compatibility settings for the applications to “Disable Full Screen Optimizations.”
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:45 PM PT

    Opened:
    May 21, 2019
    07:05 AM PT
    Older versions of BattlEye anti-cheat software incompatible
    Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software. When launching a game that uses an older, impacted version of BattlEye anti-cheat software on a device running Windows 10, version 1903, the device may experience a system crash.

    To safeguard your gaming experience, we have applied a compatibility hold on devices with the impacted versions of BattlEye software used by games installed on your PC. This will prevent Windows 10, version 1903 from being offered until the incompatible version of BattlEye software is no longer installed on the device. 

    Affected platforms:
    • Client: Windows 10, version 1903
    Mitigated: BattlEye has provided an updated patch to known impacted games. For a list of recent games that use BattlEye, go to https://www.battleye.com/.

    Workaround: Before updating your machine, we recommend you do one or more of the following:

    • Verify that your game is up to date with the latest available version of BattlEye software. Some game platforms allow you to validate your game files, which can confirm that your installation is fully up to date.
    • Restart your system and open the game again.
    • Uninstall BattlEye using https://www.battleye.com/downloads/UninstallBE.exe, and then reopen your game.
    • Uninstall and reinstall your game.
    For more troubleshooting options, see https://www.battleye.com/support/faq/.

    Next steps: We are working with BattlEye and gaming partners to ensure games are automatically updated with the latest BattlEye software. We have confirmed the latest version of impacted games do not exhibit this issue. To minimize the chance of hitting this upgrade compatibility hold, please make sure you are running the latest version of your games before attempting to update the operating system.  
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until you have installed an updated version of BattlEye software that resolves this issue.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:34 AM PT

    Opened:
    May 21, 2019
    07:34 AM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers. To safeguard your update experience, we have applied a compatibility hold on certain devices with Realtek or Qualcomm Bluetooth radio drivers from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

    • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
    • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
    Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  
    Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:29 AM PT

    Opened:
    May 21, 2019
    07:29 AM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working. The night light feature may stop working in the following scenarios:

    • Connecting to (or disconnecting from) an external monitor, dock, or projector
    • Rotating the screen
    • Updating display drivers or making other display mode changes
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you find that your night light settings have stopped working, try turning the night light on and off, or restart your computer.  

    Next steps: We are working on a resolution and will provide an update in an upcoming release.
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:28 AM PT

    Opened:
    May 21, 2019
    07:28 AM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

    \"Close other apps, error code: 0XA00F4243.”

    To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To temporarily resolve this issue, perform one of the following:

    • Unplug your camera and plug it back in.

    or

    • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

    or

    • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
    Note This workaround will only resolve the issue until your next system restart.
     
    Next steps: We are working on a resolution and will provide an update in an upcoming release.
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:20 AM PT

    Opened:
    May 21, 2019
    07:20 AM PT
    Intermittent Wi-Fi connectivity loss
    Some older computers may experience losing Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available by your device manufacturer.

    To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Download and install an updated Wi-Fi driver from your computer manufacturer (OEM).
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:13 AM PT

    Opened:
    May 21, 2019
    07:13 AM PT
    AMD RAID driver incompatibility
    Microsoft and Intel have identified an incompatibility with AMD RAID driver versions lower than 9.2.0.105. When you install the Windows 10, version 1903 update on a Windows 10-based computer, the installation process stops and you get a message like the following:
     
    AMD Ryzen™ or AMD Ryzen™ Threadripper™ configured in SATA or NVMe RAID mode.
    “A driver is installed that causes stability problems on Windows. This driver will be disabled. Check with your software/driver provider for an updated version that runs on this version of Windows.”
     
    On computers that have AMD Ryzen™ or AMD Ryzen™ Threadripper™ processors, AMD RAID drivers less than version 9.2.0.105 are not compatible with the this update. If a computer has these drivers installed and configured in RAID mode, it cannot install the Windows 10, version 1903 update.

    Computers with an AMD RAID driver, version 9.2.0.105 or higher, installed will not encounter this issue.

    For more information about this issue, please see the AMD support article.

    To safeguard your update experience, we have applied a quality hold on devices with these AMD drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To resolve this issue, download the latest AMD RAID drivers directly from AMD at https://www.amd.com/en/support/chipsets/amd-socket-tr4/x399. The drivers must be version 9.2.0.105 or later. Install the drivers on the affected computer, and then restart the installation process for the Windows 10, version 1903 feature update.
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.
     

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:12 AM PT

    Opened:
    May 21, 2019
    07:12 AM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct 3D (D3D) applications and games (e.g., 3DMark) may fail to enter full-screen mode on displays where the display orientation has been changed from the default (e.g., a landscape display in portrait mode).

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: To work around this issue, do one of the following:
    • Run applications in windowed mode or, if available, on a secondary non-rotated display. 
    • Change compatibility settings for the applications to “Disable Full Screen Optimizations.”
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:05 AM PT

    Opened:
    May 21, 2019
    07:05 AM PT
    " From f55edfe3a201e7a3cbf4a6e708d41b49ab5c45f1 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 May 2019 00:49:35 -0700 Subject: [PATCH 07/19] fix 2 link issues --- windows/whats-new/whats-new-windows-10-version-1903.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 1373c5d800..c77493d952 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -112,9 +112,9 @@ The draft release of the [security configuration baseline settings](https://blog - [Windows Defender Application Control (WDAC)](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control): In Windows 10, version 1903 WDAC has a number of new features that light up key scenarios and provide feature parity with AppLocker. - [Multiple Policies](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies): WDAC now supports multiple simultaneous code integrity policies for one device in order to enable the following scenarios: 1) enforce and audit side-by-side, 2) simpler targeting for policies with different scope/intent, 3) expanding a policy using a new ‘supplemental’ policy. - - [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules.md): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
    + - [Path-Based Rules](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/create-path-based-rules): The path condition identifies an app by its location in the file system of the computer or on the network instead of a signer or hash identifier. Additionally, WDAC has an option that allows admins to enforce at runtime that only code from paths that are not user-writeable is executed. When code tries to execute at runtime, the directory is scanned and files will be checked for write permissions for non-known admins. If a file is found to be user writeable, the executable is blocked from running unless it is authorized by something other than a path rule like a signer or hash rule.
    This brings WDAC to functionality parity with AppLocker in terms of support for file path rules. WDAC improves upon the security of policies based on file path rules with the availability of the user-writability permission checks at runtime time, which is a capability that is not available with AppLocker. - - [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. + - [Allow COM Object Registration](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy): Previously, WDAC enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. ### Identity Protection From c33f2fb2ceb2ce5efcc3cb61151b81abb883bc58 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 May 2019 00:53:34 -0700 Subject: [PATCH 08/19] edit wifi text remove redundant statement --- windows/deployment/planning/windows-10-1903-removed-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-1903-removed-features.md b/windows/deployment/planning/windows-10-1903-removed-features.md index 690c3dd7dc..92ba071002 100644 --- a/windows/deployment/planning/windows-10-1903-removed-features.md +++ b/windows/deployment/planning/windows-10-1903-removed-features.md @@ -35,7 +35,7 @@ If you have feedback about the proposed replacement of any of these features, yo |Feature |Details| |-----------|---------------------| | Taskbar settings roaming| Roaming of taskbar settings is no longer being developed and we plan to disable this capability in a future release| -|Wi-Fi WEP and TKIP|Wi-Fi networks that are secured with passwords using older WEP and TKIP protocols are not as secure as those secured with new protocols such as WPA, WPA2, and soon WPA3. In this release a warning message will appear when connecting to Wi-Fi networks secured with WEP or TKIP, which are not as secure as those using WPA2 or WPA3. In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | +|Wi-Fi WEP and TKIP|In this release a warning message will appear when connecting to Wi-Fi networks secured with WEP or TKIP, which are not as secure as those using WPA2 or WPA3. In a future release, any connection to a Wi-Fi network using these old ciphers will be disallowed. Wi-Fi routers should be updated to use AES ciphers, available with WPA2 or WPA3. | |Windows To Go|Windows To Go is no longer being developed.

    The feature does not support feature updates and therefore does not enable you to stay current. It also requires a specific type of USB that is no longer supported by many OEMs.| |Print 3D app|Going forward, 3D Builder is the recommended 3D printing app. To 3D print objects on new Windows devices, customers must first install 3D Builder from the Store.| From e97c9edbf32600f76f53add372f89c69bc29f6d9 Mon Sep 17 00:00:00 2001 From: martyav Date: Wed, 22 May 2019 13:19:42 -0400 Subject: [PATCH 09/19] updated note to account for new behavior in v 1.287.60 re: prevent-changes-to-security-settings-with-tamper-protection.md --- ...t-changes-to-security-settings-with-tamper-protection.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index 16fceaea85..e36d5f806e 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -49,4 +49,8 @@ Tamper protection is On by default. If you set tamper protection to **Off**, you 3. Set **Tamper Protection** to **On** or **Off**. >[!NOTE] ->If your computer is running Windows 10 Enterprise E5, you can't change the tamper protection settings from within Windows Security App. \ No newline at end of file +>Tamper Protection blocks attempts to modify Windows Defender Antivirus settings through the registry. +> +>To help ensure that Tamper Protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. +> +>Once you’ve made this update, Tamper Protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors. \ No newline at end of file From 9ccf11255cc5542ce4b897183c98c2a2a8798503 Mon Sep 17 00:00:00 2001 From: Greg Lindsay Date: Wed, 22 May 2019 10:28:31 -0700 Subject: [PATCH 10/19] remove ESP requirement --- .../windows-autopilot/windows-autopilot-reset-remote.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md index 7e67c7eca1..a0415fac11 100644 --- a/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md +++ b/windows/deployment/windows-autopilot/windows-autopilot-reset-remote.md @@ -21,7 +21,7 @@ ms.topic: article When performing a remote Windows Autopilot Reset, an MDM service such an Microsoft Intune can be used to initiate the reset process, avoiding the need for IT staff or other administrators to visit each machine to initiate the process. -To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed, joined to Azure AD, and configured to use the [enrollment status page](enrollment-status.md). This feature is not supported on devices that were enrolled using [Autopilot self deploying mode](self-deploying.md). +To enable a device for a remote Windows Autopilot Reset, the device must be MDM managed and joined to Azure AD. This feature is not supported on devices that were enrolled using [Autopilot self deploying mode](self-deploying.md). ## Triggering a remote Windows Autopilot Reset From 17f254f78d6ab341c3ca5f12bfdff505fcfa5783 Mon Sep 17 00:00:00 2001 From: martyav Date: Wed, 22 May 2019 13:32:22 -0400 Subject: [PATCH 11/19] corrected feature name to use title caps --- ...es-to-security-settings-with-tamper-protection.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md index e36d5f806e..1d22390bfc 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md +++ b/windows/security/threat-protection/windows-defender-antivirus/prevent-changes-to-security-settings-with-tamper-protection.md @@ -19,7 +19,7 @@ ms.author: v-anbic - Windows 10 -Tamper protection helps prevent malicious apps from changing important security settings. These settings include: +Tamper Protection helps prevent malicious apps from changing important security settings. These settings include: - Real-time protection - Cloud-delivered protection @@ -27,7 +27,7 @@ Tamper protection helps prevent malicious apps from changing important security - Behavior monitoring - Removing security intelligence updates -With tamper protection set to **On**, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: +With Tamper Protection set to **On**, you can still change these settings in the Windows Security app. The following apps and methods can't change these settings: - Mobile device management (MDM) apps like Intune - Enterprise configuration management apps like System Center Configuration Manager (SCCM) @@ -36,11 +36,11 @@ With tamper protection set to **On**, you can still change these settings in the - Group Policy - Other Windows Management Instrumentation (WMI) apps -The tamper protection setting doesn't affect how third party antivirus apps register with the Windows Security app. +The Tamper Protection setting doesn't affect how third party antivirus apps register with the Windows Security app. -On computers running Windows 10 Enterprise E5, users can't change the tamper protection setting. +On computers running Windows 10 Enterprise E5, users can't change the Tamper Protection setting. -Tamper protection is On by default. If you set tamper protection to **Off**, you will see a yellow warning in the Windows Security app under **Virus & threat protection**. +Tamper Protection is set to **On** by default. If you set Tamper Protection to **Off**, you will see a yellow warning in the Windows Security app under **Virus & Threat Protection**. ## Configure tamper protection @@ -51,6 +51,6 @@ Tamper protection is On by default. If you set tamper protection to **Off**, you >[!NOTE] >Tamper Protection blocks attempts to modify Windows Defender Antivirus settings through the registry. > ->To help ensure that Tamper Protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. +>To help ensure that Tamper Protection doesn’t interfere with third-party security products or enterprise installation scripts that modify these settings, go to **Windows Security** and update **Security intelligence** to version 1.287.60.0 or later. > >Once you’ve made this update, Tamper Protection will continue to protect your registry settings, and will also log attempts to modify them without returning errors. \ No newline at end of file From ecb6379f4bcae0e3c426f44ae4d809b54ef1d32d Mon Sep 17 00:00:00 2001 From: martyav Date: Wed, 22 May 2019 14:26:45 -0400 Subject: [PATCH 12/19] updated mdatp-for-mac changed any remaining instances of windows atp to microsoft updated what's new w\ health monitoring feature note updated installation section by breaking bullets into subsections - first/third party tools refined wording about SIP --- .../microsoft-defender-atp-mac.md | 34 +++++++++++-------- 1 file changed, 19 insertions(+), 15 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index 264d420897..b14ccc332d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -17,22 +17,23 @@ ms.collection: M365-security-compliance ms.topic: conceptual --- -# Microsoft Defender ATP for Mac +# Microsoft Defender Advanced Threat Protection for Mac >[!IMPORTANT] ->This topic relates to the pre-release version of Microsoft Defender ATP for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. +>This topic relates to the pre-release version of Microsoft Defender Advanced Threat Protection (ATP) for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. -This topic describes how to install and use Microsoft Defender ATP for Mac. +This topic describes how to install and use Microsoft Defender Advanced Threat Protection ATP for Mac. ## What’s new in the public preview -We've been working hard through the private preview period, and we've heard your concerns. We've reduced the delay for when new Mac devices appear in the ATP console after they've been deployed. We've improved threat handling, and enhanced the user experience. We've also made numerous bug fixes. Other updates to Microsoft Defender ATP for Mac include: +Since opening the limited preview, we've been working non-stop to enhance the product, by listening to customer feedback. We've reduced the time it takes for devices to appear in Microsoft Defender Security Center, immediately following deployment. We've improved threat handling, enhanced the user experience, and fixed bugs. Other updates to Microsoft Defender ATP for Mac include: -- Full accessibility +- Enhanced accessibility - Improved performance -- Localization for 37 languages +- improved client product health monitoring +- Localization into 37 languages - Improved anti-tampering protections -- Feedback and samples can now be submitted via the GUI. +- Feedback and samples can now be submitted via the interface. - Product health can be queried with JAMF or the command line. - Admins can set their cloud preference for any location, not just for those in the US. @@ -41,12 +42,16 @@ We've been working hard through the private preview period, and we've heard your There are various methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. In general you'll need to take the following steps: -- Ensure you have a Windows Defender ATP subscription and have access to the Windows Defender ATP Portal +- Ensure you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal - Deploy Microsoft Defender ATP for Mac using one of the following deployment methods: - - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) - - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) - - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) - - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) + - Via the command line tool: + - [Manual deployment](microsoft-defender-atp-mac-install-manually.md) + - Via third party tools: + - [Microsoft Intune-based deployment](microsoft-defender-atp-mac-install-with-intune.md) + - [JAMF-based deployment](microsoft-defender-atp-mac-install-with-jamf.md) + - [Other MDM products](microsoft-defender-atp-mac-install-with-other-mdm.md) + +Whichever method you choose, you will first need to visit the onboarding page in the Microsoft Defender ATP portal. ### Prerequisites @@ -69,7 +74,7 @@ After you've enabled the service, you may need to configure your network or fire The following table lists the services and their associated URLs that your network must be able to connect to. You should ensure there are no firewall or network filtering rules that would deny access to these URLs, or you may need to create an **allow** rule specifically for them: | Service | Description | URL | -| -------------- |:------------------------------------:| --------------------------------------------------------------------:| +| -------------- | ------------------------------------ | -------------------------------------------------------------------- | | ATP | Advanced threat protection service | `https://x.cp.wd.microsoft.com`, `https://cdn.x.cp.wd.microsoft.com` | To test that a connection is not blocked, open `https://x.cp.wd.microsoft.com/api/report` and `https://cdn.x.cp.wd.microsoft.com/ping` in a browser, or run the following command in Terminal: @@ -80,8 +85,7 @@ To test that a connection is not blocked, open `https://x.cp.wd.microsoft.com/ap OK https://cdn.x.cp.wd.microsoft.com/ping ``` -We recommend to keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) ([Wiki](https://en.wikipedia.org/wiki/System_Integrity_Protection)) enabled (default setting) on client machines. -SIP is a built-in macOS security feature that prevents low-level tampering with the OS. +We recommend that you keep [System Integrity Protection](https://support.apple.com/en-us/HT204899) (SIP) enabled on client machines. SIP is a built-in macOS security feature that prevents low-level tampering with the OS, and is enabled by default. ## Resources From 4f8b76e18f79d0de2580fd1b4e318f89b1e2fcb2 Mon Sep 17 00:00:00 2001 From: DocsPreview <49669258+DocsPreview@users.noreply.github.com> Date: Wed, 22 May 2019 12:22:27 -0700 Subject: [PATCH 13/19] Changes GA Date for some issues (#272) --- .../status-windows-10-1903.yml | 48 +++++++++---------- 1 file changed, 24 insertions(+), 24 deletions(-) diff --git a/windows/release-information/status-windows-10-1903.yml b/windows/release-information/status-windows-10-1903.yml index 6f5714b4dd..0c22040811 100644 --- a/windows/release-information/status-windows-10-1903.yml +++ b/windows/release-information/status-windows-10-1903.yml @@ -65,18 +65,18 @@ sections: - type: markdown text: "
    This table offers a summary of current active issues and those issues that have been resolved in the last 30 days.

    - - - - - - - - - - - - + + + + + + + + + + + +
    SummaryOriginating updateStatusLast updated
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    04:47 PM PT
    Audio not working with Dolby Atmos headphones and home theater
    Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:17 AM PT
    Duplicate folders and documents showing in user profile directory
    If known folders (e.g. Desktop, Documents, or Pictures folders) are redirected, an empty folder with that same name may be created.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:16 AM PT
    Error attempting to update with external USB device or memory card attached
    PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:49 PM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:48 PM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:48 PM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    Intermittent loss of Wi-Fi connectivity
    Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:46 PM PT
    AMD RAID driver incompatibility
    Installation process may stop when trying to install Windows 10, version 1903 update on computers that run certain versions of AMD RAID drivers.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:45 PM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct3D (D3D) applications and games may fail to enter full-screen mode on rotated displays.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:45 PM PT
    Older versions of BattlEye anti-cheat software incompatible
    Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software.

    See details >    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:34 AM PT
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Investigating
    		May 21, 2019
    04:47 PM PT
    Audio not working with Dolby Atmos headphones and home theater
    Users may experience audio loss with Dolby Atmos headphones or Dolby Atmos home theater.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:17 AM PT
    Duplicate folders and documents showing in user profile directory
    If known folders (e.g. Desktop, Documents, or Pictures folders) are redirected, an empty folder with that same name may be created.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Investigating
    		May 21, 2019
    07:16 AM PT
    Error attempting to update with external USB device or memory card attached
    PCs with an external USB device or SD memory card attached may get error: \"This PC can't be upgraded to Windows 10.\"

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:49 PM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some versions of Realtek and Qualcomm Bluetooth radio drivers.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:48 PM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:48 PM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in battery drain.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 or Intel RealSense S200 camera apps.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:47 PM PT
    Intermittent loss of Wi-Fi connectivity
    Some older devices may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:46 PM PT
    AMD RAID driver incompatibility
    Installation process may stop when trying to install Windows 10, version 1903 update on computers that run certain versions of AMD RAID drivers.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:45 PM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct3D (D3D) applications and games may fail to enter full-screen mode on rotated displays.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    04:45 PM PT
    Older versions of BattlEye anti-cheat software incompatible
    Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software.

    See details >    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		May 21, 2019
    07:34 AM PT
    " @@ -92,17 +92,17 @@ sections: - type: markdown text: " - - - - - - - - - - - - + + + + + + + + + + + +
    DetailsOriginating updateStatusHistory
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Window 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

    To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Restart your device to apply changes to brightness.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution that will be made available in upcoming release.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:56 AM PT
    Audio not working with Dolby Atmos headphones and home theater
    After updating to Windows 10, version 1903, you may experience loss of audio with Dolby Atmos for home theater (free extension) or Dolby Atmos for headphones (paid extension) acquired through the Microsoft Store due to a licensing configuration error.
     
    This occurs due to an issue with a Microsoft Store licensing component, where license holders are not able to connect to the Dolby Access app and enable Dolby Atmos extensions.
     
    To safeguard your update experience, we have applied protective hold on devices from being offered Windows 10, version 1903 until this issue is resolved. This configuration error will not result in loss of access for the acquired license once the problem is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: We are working on a resolution for Microsoft Store and estimate a solution will be available in mid-June.
    Note We recommend you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved. 

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:17 AM PT

    Opened:
    May 21, 2019
    07:16 AM PT
    Duplicate folders and documents showing in user profile directory
    If you have redirected known folders (e.g. Desktop, Documents, or Pictures folders) you may see an empty folder with the same name in your %userprofile% directories after updating to Windows 10, version 1903. This may occur if known folders were redirected when you chose to back up your content to OneDrive using the OneDrive wizard, or if you chose to back up your content during the Windows Out-of-Box-Experience (OOBE). This may also occur if you redirected your known folders manually through the Properties dialog box in File Explorer. ​This issue does not cause any user files to be deleted and a solution is in progress.

    To safeguard your update experience, we have applied a quality hold on devices with redirected known folders from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.
    Note We recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:16 AM PT

    Opened:
    May 21, 2019
    07:16 AM PT
    Error attempting to update with external USB device or memory card attached
    If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

    Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

    Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

    To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To work around this issue, remove all external media, such as USB devices and SD cards, from your computer and restart installation of the Windows 10, version 1903 feature update. The update should then proceed normally.
    Note If you need to keep your external device, SD memory card, or other devices attached to your computer while updating, we recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: Microsoft is working on a resolution and estimate a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:49 PM PT

    Opened:
    May 21, 2019
    07:38 AM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

    • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
    • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
    Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

    Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  


    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:48 PM PT

    Opened:
    May 21, 2019
    07:29 AM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working, for example:
    • Connecting to (or disconnecting from) an external monitor, dock, or projector
    • Rotating the screen
    • Updating display drivers or making other display mode changes
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you find that your night light settings have stopped working, try turning the night light on and off, or restart your computer.  

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.


    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:48 PM PT

    Opened:
    May 21, 2019
    07:28 AM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
      
    To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809
    Workaround:
    On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

    For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

    Note We recommend you do not attempt to update your devices until newer device drivers are installed.

    Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:22 AM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

    \"Close other apps, error code: 0XA00F4243.”


    To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To temporarily resolve this issue, perform one of the following:

    • Unplug your camera and plug it back in.

    or

    • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

    or

    • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
    Note This workaround will only resolve the issue until your next system restart.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:20 AM PT
    Intermittent loss of Wi-Fi connectivity
    Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

    To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Download and install an updated Wi-Fi driver from your device manufacturer (OEM).
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:46 PM PT

    Opened:
    May 21, 2019
    07:13 AM PT
    AMD RAID driver incompatibility
    Microsoft and AMD have identified an incompatibility with AMD RAID driver versions lower than 9.2.0.105. When you attempt to install the Windows 10, version 1903 update on a Windows 10-based computer with an affected driver version, the installation process stops and you get a message like the following:

    AMD Ryzen™ or AMD Ryzen™ Threadripper™ configured in SATA or NVMe RAID mode.

    “A driver is installed that causes stability problems on Windows. This driver will be disabled. Check with your software/driver provider for an updated version that runs on this version of Windows.”

     
    To safeguard your update experience, we have applied a compatibility hold on devices with these AMD drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To resolve this issue, download the latest AMD RAID drivers directly from AMD at https://www.amd.com/en/support/chipsets/amd-socket-tr4/x399. The drivers must be version 9.2.0.105 or later. Install the drivers on the affected computer, and then restart the installation process for the Windows 10, version 1903 feature update.
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.
     

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:45 PM PT

    Opened:
    May 21, 2019
    07:12 AM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct3D (D3D) applications and games (e.g., 3DMark) may fail to enter full-screen mode on displays where the display orientation has been changed from the default (e.g., a landscape display in portrait mode).

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: To work around this issue, do one of the following:
    • Run applications in windowed mode or, if available, on a secondary non-rotated display. 
    • Change compatibility settings for the applications to “Disable Full Screen Optimizations.”
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:45 PM PT

    Opened:
    May 21, 2019
    07:05 AM PT
    Older versions of BattlEye anti-cheat software incompatible
    Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software. When launching a game that uses an older, impacted version of BattlEye anti-cheat software on a device running Windows 10, version 1903, the device may experience a system crash.

    To safeguard your gaming experience, we have applied a compatibility hold on devices with the impacted versions of BattlEye software used by games installed on your PC. This will prevent Windows 10, version 1903 from being offered until the incompatible version of BattlEye software is no longer installed on the device. 

    Affected platforms:
    • Client: Windows 10, version 1903
    Mitigated: BattlEye has provided an updated patch to known impacted games. For a list of recent games that use BattlEye, go to https://www.battleye.com/.

    Workaround: Before updating your machine, we recommend you do one or more of the following:

    • Verify that your game is up to date with the latest available version of BattlEye software. Some game platforms allow you to validate your game files, which can confirm that your installation is fully up to date.
    • Restart your system and open the game again.
    • Uninstall BattlEye using https://www.battleye.com/downloads/UninstallBE.exe, and then reopen your game.
    • Uninstall and reinstall your game.
    For more troubleshooting options, see https://www.battleye.com/support/faq/.

    Next steps: We are working with BattlEye and gaming partners to ensure games are automatically updated with the latest BattlEye software. We have confirmed the latest version of impacted games do not exhibit this issue. To minimize the chance of hitting this upgrade compatibility hold, please make sure you are running the latest version of your games before attempting to update the operating system.  
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until you have installed an updated version of BattlEye software that resolves this issue.

    Back to top    		OS Build 18362.116

    May 20, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:34 AM PT

    Opened:
    May 21, 2019
    07:34 AM PT
    Display brightness may not respond to adjustments
    Microsoft and Intel have identified a driver compatibility issue on devices configured with certain Intel display drivers. After updating to Window 10, version 1903, brightness settings may sometime appear as if changes applied took effect, yet the actual display brightness doesn't change.

    To safeguard your update experience, we have applied a compatibility hold on devices with certain Intel drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Restart your device to apply changes to brightness.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution that will be made available in upcoming release.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:56 AM PT
    Audio not working with Dolby Atmos headphones and home theater
    After updating to Windows 10, version 1903, you may experience loss of audio with Dolby Atmos for home theater (free extension) or Dolby Atmos for headphones (paid extension) acquired through the Microsoft Store due to a licensing configuration error.
     
    This occurs due to an issue with a Microsoft Store licensing component, where license holders are not able to connect to the Dolby Access app and enable Dolby Atmos extensions.
     
    To safeguard your update experience, we have applied protective hold on devices from being offered Windows 10, version 1903 until this issue is resolved. This configuration error will not result in loss of access for the acquired license once the problem is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: We are working on a resolution for Microsoft Store and estimate a solution will be available in mid-June.
    Note We recommend you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved. 

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:17 AM PT

    Opened:
    May 21, 2019
    07:16 AM PT
    Duplicate folders and documents showing in user profile directory
    If you have redirected known folders (e.g. Desktop, Documents, or Pictures folders) you may see an empty folder with the same name in your %userprofile% directories after updating to Windows 10, version 1903. This may occur if known folders were redirected when you chose to back up your content to OneDrive using the OneDrive wizard, or if you chose to back up your content during the Windows Out-of-Box-Experience (OOBE). This may also occur if you redirected your known folders manually through the Properties dialog box in File Explorer. ​This issue does not cause any user files to be deleted and a solution is in progress.

    To safeguard your update experience, we have applied a quality hold on devices with redirected known folders from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.
    Note We recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Investigating
    		Last updated:
    May 21, 2019
    07:16 AM PT

    Opened:
    May 21, 2019
    07:16 AM PT
    Error attempting to update with external USB device or memory card attached
    If you have an external USB device or SD memory card attached when installing Windows 10, version 1903, you may get an error message stating \"This PC can't be upgraded to Windows 10.\" This is caused by inappropriate drive reassignment during installation.

    Sample scenario: An update to Windows 10, version 1903 is attempted on a computer that has a thumb drive inserted into its USB port. Before the update, the thumb drive is mounted in the system as drive G based on the existing drive configuration. After the feature update is installed; however, the device is reassigned a different drive letter (e.g., drive H).

    Note The drive reassignment is not limited to removable drives. Internal hard drives may also be affected.

    To safeguard your update experience, we have applied a hold on devices with an external USB device or SD memory card attached from being offered Windows 10, version 1903 until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To work around this issue, remove all external media, such as USB devices and SD cards, from your computer and restart installation of the Windows 10, version 1903 feature update. The update should then proceed normally.
    Note If you need to keep your external device, SD memory card, or other devices attached to your computer while updating, we recommend that you do not attempt to manually update to Windows 10, version 1903 using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: Microsoft is working on a resolution and estimate a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:49 PM PT

    Opened:
    May 21, 2019
    07:38 AM PT
    Unable to discover or connect to Bluetooth devices
    Microsoft has identified compatibility issues with some driver versions for Bluetooth radios made by Realtek and Qualcomm. To safeguard your update experience, we have applied a compatibility hold on devices with affected driver versions for Realtek or Qualcomm Bluetooth radios from being offered Windows 10, version 1903 or Windows Server, version 1903 until the driver has been updated.

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: Check with your device manufacturer (OEM) to see if an updated driver is available and install it.

    • For Qualcomm drivers, you will need to install a driver version greater than 10.0.1.11.
    • For Realtek drivers, you will need to install a driver version greater than 1.5.1011.0.
    Note Until an updated driver has been installed, we recommend you do not attempt to manually update using the Update now button or the Media Creation Tool. 

    Next steps: Microsoft is working with Realtek and Qualcomm to release new drivers for all affected system via Windows Update.  


    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:48 PM PT

    Opened:
    May 21, 2019
    07:29 AM PT
    Night light settings do not apply in some cases
    Microsoft has identified some scenarios where night light settings may stop working, for example:
    • Connecting to (or disconnecting from) an external monitor, dock, or projector
    • Rotating the screen
    • Updating display drivers or making other display mode changes
    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: If you find that your night light settings have stopped working, try turning the night light on and off, or restart your computer.  

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.


    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:48 PM PT

    Opened:
    May 21, 2019
    07:28 AM PT
    Intel Audio displays an intcdaud.sys notification
    Microsoft and Intel have identified an issue with a range of Intel Display Audio device drivers that may result in higher than normal battery drain. If you see an intcdaud.sys notification or “What needs your attention” notification when trying to update to Windows 10, version 1903, you have an affected Intel Audio Display device driver installed on your machine (intcdaud.sys, versions 10.25.0.3 through 10.25.0.8).
      
    To safeguard your update experience, we have applied a compatibility hold on devices with drivers from being offered Windows 10, version 1903 until updated device drivers have been installed.

    Affected platforms:
    • Client: Windows 10, version 1903; Windows 10, version 1809
    Workaround:
    On the “What needs your attention\" notification, click the Back button to remain on your current version of Windows 10. (Do not click Confirm as this will proceed with the update and you may experience compatibility issues.) Affected devices will automatically revert to the previous working configuration.

    For more information, see Intel's customer support guidance and the Microsoft knowledge base article KB4465877.

    Note We recommend you do not attempt to update your devices until newer device drivers are installed.

    Next steps: You can opt to wait for newer drivers to be installed automatically through Windows Update or check with the computer manufacturer for the latest device driver software availability and installation procedures.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:22 AM PT
    Cannot launch Camera app
    Microsoft and Intel have identified an issue affecting Intel RealSense SR300 and Intel RealSense S200 cameras when using the Camera app. After updating to the Windows 10 May 2019 Update and launching the Camera app, you may get an error message stating:

    \"Close other apps, error code: 0XA00F4243.”


    To safeguard your update experience, we have applied a protective hold on machines with Intel RealSense SR300 or Intel RealSense S200 cameras installed from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To temporarily resolve this issue, perform one of the following:

    • Unplug your camera and plug it back in.

    or

    • Disable and re-enable the driver in Device Manager. In the Search box, type \"Device Manager\" and press Enter. In the Device Manager dialog box, expand Cameras, then right-click on any RealSense driver listed and select Disable device. Right click on the driver again and select Enable device.

    or

    • Restart the RealSense service. In the Search box, type \"Task Manager\" and hit Enter. In the Task Manager dialog box, click on the Services tab, right-click on RealSense, and select Restart. 
    Note This workaround will only resolve the issue until your next system restart.

    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until this issue has been resolved.

    Next steps: We are working on a resolution and will provide an update in an upcoming release.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:47 PM PT

    Opened:
    May 21, 2019
    07:20 AM PT
    Intermittent loss of Wi-Fi connectivity
    Some older computers may experience loss of Wi-Fi connectivity due to an outdated Qualcomm driver. An updated Wi-Fi driver should be available from your device manufacturer (OEM).

    To safeguard your upgrade experience, we have applied a hold on devices with this Qualcomm driver from being offered Windows 10, version 1903, until the updated driver is installed.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: Download and install an updated Wi-Fi driver from your device manufacturer (OEM).
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:46 PM PT

    Opened:
    May 21, 2019
    07:13 AM PT
    AMD RAID driver incompatibility
    Microsoft and AMD have identified an incompatibility with AMD RAID driver versions lower than 9.2.0.105. When you attempt to install the Windows 10, version 1903 update on a Windows 10-based computer with an affected driver version, the installation process stops and you get a message like the following:

    AMD Ryzen™ or AMD Ryzen™ Threadripper™ configured in SATA or NVMe RAID mode.

    “A driver is installed that causes stability problems on Windows. This driver will be disabled. Check with your software/driver provider for an updated version that runs on this version of Windows.”

     
    To safeguard your update experience, we have applied a compatibility hold on devices with these AMD drivers from being offered Windows 10, version 1903, until this issue is resolved.

    Affected platforms:
    • Client: Windows 10, version 1903
    Workaround: To resolve this issue, download the latest AMD RAID drivers directly from AMD at https://www.amd.com/en/support/chipsets/amd-socket-tr4/x399. The drivers must be version 9.2.0.105 or later. Install the drivers on the affected computer, and then restart the installation process for the Windows 10, version 1903 feature update.
     
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until a new driver has been installed and the Windows 10, version 1903 feature update has been automatically offered to you.
     

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:45 PM PT

    Opened:
    May 21, 2019
    07:12 AM PT
    D3D applications and games may fail to enter full-screen mode on rotated displays
    Some Direct3D (D3D) applications and games (e.g., 3DMark) may fail to enter full-screen mode on displays where the display orientation has been changed from the default (e.g., a landscape display in portrait mode).

    Affected platforms:
    • Client: Windows 10, version 1903
    • Server: Windows Server, version 1903
    Workaround: To work around this issue, do one of the following:
    • Run applications in windowed mode or, if available, on a secondary non-rotated display. 
    • Change compatibility settings for the applications to “Disable Full Screen Optimizations.”
    Next steps: Microsoft is working on a resolution and estimates a solution will be available in late May.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    04:45 PM PT

    Opened:
    May 21, 2019
    07:05 AM PT
    Older versions of BattlEye anti-cheat software incompatible
    Microsoft and BattlEye have identified a compatibility issue with some games that use older versions of BattlEye anti-cheat software. When launching a game that uses an older, impacted version of BattlEye anti-cheat software on a device running Windows 10, version 1903, the device may experience a system crash.

    To safeguard your gaming experience, we have applied a compatibility hold on devices with the impacted versions of BattlEye software used by games installed on your PC. This will prevent Windows 10, version 1903 from being offered until the incompatible version of BattlEye software is no longer installed on the device. 

    Affected platforms:
    • Client: Windows 10, version 1903
    Mitigated: BattlEye has provided an updated patch to known impacted games. For a list of recent games that use BattlEye, go to https://www.battleye.com/.

    Workaround: Before updating your machine, we recommend you do one or more of the following:

    • Verify that your game is up to date with the latest available version of BattlEye software. Some game platforms allow you to validate your game files, which can confirm that your installation is fully up to date.
    • Restart your system and open the game again.
    • Uninstall BattlEye using https://www.battleye.com/downloads/UninstallBE.exe, and then reopen your game.
    • Uninstall and reinstall your game.
    For more troubleshooting options, see https://www.battleye.com/support/faq/.

    Next steps: We are working with BattlEye and gaming partners to ensure games are automatically updated with the latest BattlEye software. We have confirmed the latest version of impacted games do not exhibit this issue. To minimize the chance of hitting this upgrade compatibility hold, please make sure you are running the latest version of your games before attempting to update the operating system.  
    Note We recommend that you do not attempt to manually update using the Update now button or the Media Creation Tool until you have installed an updated version of BattlEye software that resolves this issue.

    Back to top    		OS Build 18362.116

    May 21, 2019
    KB4505057    		Mitigated
    		Last updated:
    May 21, 2019
    07:34 AM PT

    Opened:
    May 21, 2019
    07:34 AM PT
    " From fd690844c0e4b4d6a29b4778f5770ff35302df83 Mon Sep 17 00:00:00 2001 From: martyav Date: Wed, 22 May 2019 15:52:54 -0400 Subject: [PATCH 14/19] copy edits to mdatp pages windows defender -> microsoft defender some grammar corrections & clarifications machine -> device --- ...osoft-defender-atp-mac-install-manually.md | 4 +- ...ft-defender-atp-mac-install-with-intune.md | 60 ++++++++-------- ...soft-defender-atp-mac-install-with-jamf.md | 71 +++++++++---------- .../microsoft-defender-atp-mac-resources.md | 8 +-- .../microsoft-defender-atp-mac.md | 4 +- 5 files changed, 72 insertions(+), 75 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md index 71c901e041..f297a4328b 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-manually.md @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** -[Windows Defender Advanced Threat Protection (Windows Defender ATP) for Mac](microsoft-defender-atp-mac.md) +[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) >[!IMPORTANT] >This topic relates to the pre-release version of Microsoft Defender ATP for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -114,4 +114,4 @@ See [Logging installation issues](microsoft-defender-atp-mac-resources.md#loggin ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Windows Defender ATP for Mac from client devices. \ No newline at end of file +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index 15bfabbd53..e6aaf51861 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** -[Windows Defender Advanced Threat Protection (Windows Defender ATP) for Mac](microsoft-defender-atp-mac.md) +[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) >[!IMPORTANT] >This topic relates to the pre-release version of Microsoft Defender ATP for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -32,13 +32,13 @@ Before you get started, please see [the main Microsoft Defender ATP for Mac page ## Download installation and onboarding packages -Download the installation and onboarding packages from Windows Defender Security Center: +Download the installation and onboarding packages from Microsoft Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. -5. Download IntuneAppUtil from [https://docs.microsoft.com/en-us/intune/lob-apps-macos](https://docs.microsoft.com/en-us/intune/lob-apps-macos). +1. In Microsoft Defender Security Center, go to **Settings** > **Device Management** > **Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and the deployment method to **Mobile Device Management / Microsoft Intune**. +3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. +5. Download **IntuneAppUtil** from [https://docs.microsoft.com/en-us/intune/lob-apps-macos](https://docs.microsoft.com/en-us/intune/lob-apps-macos). ![Windows Defender Security Center screenshot](images/MDATP_2_IntuneAppUtil.png) @@ -80,41 +80,41 @@ Download the installation and onboarding packages from Windows Defender Security to deploy refer to the product documentation. ``` -## Client Machine Setup +## Client device setup -You need no special provisioning for a Mac machine beyond a standard [Company Portal installation](https://docs.microsoft.com/en-us/intune-user-help/enroll-your-device-in-intune-macos-cp). +You need no special provisioning for a Mac device beyond a standard [Company Portal installation](https://docs.microsoft.com/en-us/intune-user-help/enroll-your-device-in-intune-macos-cp). 1. You'll be asked to confirm device management. ![Confirm device management screenshot](images/MDATP_3_ConfirmDeviceMgmt.png) -Select Open System Preferences, locate Management Profile on the list and select the **Approve...** button. Your Management Profile would be displayed as **Verified**: +Select **Open System Preferences**, locate **Management Profile** on the list and select **Approve...**. Your Management Profile would be displayed as **Verified**: ![Management profile screenshot](images/MDATP_4_ManagementProfile.png) -2. Select the **Continue** button and complete the enrollment. +2. Select **Continue** and complete the enrollment. -You can enroll additional machines. Optionally, you can do it later, after system configuration and application package are provisioned. +You can enroll additional devices. Optionally, you can enroll them later, after you have finished provisioning system configuration and application packages. -3. In Intune, open the **Manage > Devices > All devices** blade. You'll see your machine: +3. In Intune, open **Manage** > **Devices** > **All devices**. You'll see your device among those listed: ![Add Devices screenshot](images/MDATP_5_allDevices.png) ## Create System Configuration profiles -1. In Intune open the **Manage > Device configuration** blade. Select **Manage > Profiles > Create Profile**. -2. Choose a name for the profile. Change **Platform=macOS**, **Profile type=Custom**. Select **Configure**. +1. In Intune, open **Manage** > **Device configuration**. Select **Manage** > **Profiles** > **Create Profile**. +2. Choose a name for the profile. Change **Platform=macOS** to **Profile type=Custom**. Select **Configure**. 3. Open the configuration profile and upload intune/kext.xml. This file was created during the Generate settings step above. 4. Select **OK**. ![System configuration profiles screenshot](images/MDATP_6_SystemConfigurationProfiles.png) -5. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. -6. Repeat these steps with the second profile. -7. Create Profile one more time, give it a name, upload the intune/WindowsDefenderATPOnboarding.xml file. -8. Select **Manage > Assignments**. In the Include tab, select **Assign to All Users & All devices**. +5. Select **Manage** > **Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. +6. Repeat steps 1 through 5 for additional profiles. +7. Create a new profile one more time, give it a name, and upload the intune/WindowsDefenderATPOnboarding.xml file. +8. Select **Manage > Assignments**. In the **Include** tab, select **Assign to All Users & All devices**. -After Intune changes are propagated to the enrolled machines, you'll see it on the **Monitor > Device status** blade: +Once the Intune changes are propagated to the enrolled devices, you'll see them listed under **Monitor** > **Device status**: ![System configuration profiles screenshot](images/MDATP_7_DeviceStatusBlade.png) @@ -124,7 +124,7 @@ After Intune changes are propagated to the enrolled machines, you'll see it on t 2. Select **App type=Other/Line-of-business app**. 3. Select **file=wdav.pkg.intunemac**. Select **OK** to upload. 4. Select **Configure** and add the required information. -5. Use **macOS Sierra 10.12** as the minimum OS. Other settings can be any other value. +5. Use **macOS Sierra 10.12** as the minimum OS. Other settings can be any arbitrary value. ![Device status blade screenshot](images/MDATP_8_IntuneAppInfo.png) @@ -132,32 +132,30 @@ After Intune changes are propagated to the enrolled machines, you'll see it on t ![Device status blade screenshot](images/MDATP_9_IntunePkgInfo.png) -7. It will take a while to upload the package. After it's done, select the name and then go to **Assignments** and **Add group**. +7. It may take a few moments to upload the package. After it's done, select the package from the list and go to **Assignments** and **Add group**. ![Client apps screenshot](images/MDATP_10_ClientApps.png) -8. Change **Assignment type=Required**. +8. Change **Assignment type** to **Required**. 9. Select **Included Groups**. Select **Make this app required for all devices=Yes**. Select **Select group to include** and add a group that contains the users you want to target. Select **OK** and **Save**. ![Intune assignments info screenshot](images/MDATP_11_Assignments.png) -10. After some time the application will be published to all enrolled machines. You'll see it on the **Monitor > Device** install status blade: +10. After some time the application will be published to all enrolled devices. You'll see it listed on **Monitor** > **Device**, under **Device install status**: ![Intune device status screenshot](images/MDATP_12_DeviceInstall.png) -## Verify client machine state +## Verify client device state -1. After the configuration profiles are deployed to your machines, on your Mac device, open **System Preferences > Profiles**. +1. After the configuration profiles are deployed to your devices, open **System Preferences** > **Profiles** on your Mac device. ![System Preferences screenshot](images/MDATP_13_SystemPreferences.png) ![System Preferences Profiles screenshot](images/MDATP_14_SystemPreferencesProfiles.png) -2. Verify the three profiles listed there: +2. Verify that the following configuration profiles are present and installed. The **Management Profile** should be the Intune system profile. _Wdav-config_ and _wdav-kext_ are system configuration profiles that we added in Intune.: ![Profiles screenshot](images/MDATP_15_ManagementProfileConfig.png) -3. The **Management Profile** should be the Intune system profile. -4. wdav-config and wdav-kext are system configuration profiles that we added in Intune. -5. You should also see the Microsoft Defender icon in the top-right corner: +3. You should also see the Microsoft Defender icon in the top-right corner: ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) @@ -167,4 +165,4 @@ See [Logging installation issues](microsoft-defender-atp-mac-resources.md#loggin ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Windows Defender ATP for Mac from client devices. \ No newline at end of file +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 4770ec60ec..2f1224ed6d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** -[Windows Defender Advanced Threat Protection (Windows Defender ATP) for Mac](microsoft-defender-atp-mac.md) +[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) >[!IMPORTANT] >This topic relates to the pre-release version of Microsoft Defender ATP for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -36,15 +36,14 @@ In addition, for JAMF deployment, you need to be familiar with JAMF administrati Download the installation and onboarding packages from Windows Defender Security Center: -1. In Windows Defender Security Center, go to **Settings > Machine Management > Onboarding**. -2. In Section 1 of the page, set operating system to **Linux, macOS, iOS or Android** and Deployment method to **Mobile Device Management / Microsoft Intune**. -3. In Section 2 of the page, select **Download installation package**. Save it as wdav.pkg to a local directory. -4. In Section 2 of the page, select **Download onboarding package**. Save it as WindowsDefenderATPOnboardingPackage.zip to the same directory. +1. In Windows Defender Security Center, go to **Settings > device Management > Onboarding**. +2. In Section 1 of the page, set the operating system to **Linux, macOS, iOS or Android** and deployment method to **Mobile Device Management / Microsoft Intune**. +3. In Section 2 of the page, select **Download installation package**. Save it as _wdav.pkg_ to a local directory. +4. In Section 2 of the page, select **Download onboarding package**. Save it as _WindowsDefenderATPOnboardingPackage.zip_ to the same directory. ![Windows Defender Security Center screenshot](images/MDATP_2_IntuneAppUtil.png) -5. From a command prompt, verify that you have the two files. - Extract the contents of the .zip files: +5. From the command prompt, verify that you have the two files. Extract the contents of the .zip files like so: ```bash mavel-macmini:Downloads test$ ls -l @@ -62,19 +61,19 @@ Download the installation and onboarding packages from Windows Defender Security ## Create JAMF Policies -You need to create a configuration profile and a policy to start deploying Microsoft Defender ATP for Mac to client machines. +You need to create a configuration profile and a policy to start deploying Microsoft Defender ATP for Mac to client devices. ### Configuration Profile -The configuration profile contains one custom settings payload that includes: +The configuration profile contains a custom settings payload that includes: - Microsoft Defender ATP for Mac onboarding information -- Approved Kernel Extensions payload to enable the Microsoft kernel driver to run +- Approved Kernel Extensions payload, to enable running the Microsoft kernel driver -1. Upload jamf/WindowsDefenderATPOnboarding.plist as the Property List File. +To set the onboarding information, upload a property list file with the name, _jamf/WindowsDefenderATPOnboarding.plist_. - >[!NOTE] - > You must use exactly "com.microsoft.wdav.atp" as the Preference Domain. + >[!IMPORTANT] + > You must set the the Preference Domain as "com.microsoft.wdav.atp" ![Configuration profile screenshot](images/MDATP_16_PreferenceDomain.png) @@ -89,15 +88,15 @@ To approve the kernel extension: #### Configuration Profile's Scope -Configure the appropriate scope to specify the machines that will receive this configuration profile. +Configure the appropriate scope to specify the devices that will receive the configuration profile. -Open Computers -> Configuration Profiles, select **Scope > Targets**. Select the appropriate Target computers. +Open **Computers** > **Configuration Profiles**, and select **Scope > Targets**. From there, select the devices you want to target. ![Configuration profile scope screenshot](images/MDATP_18_ConfigurationProfilesScope.png) Save the **Configuration Profile**. -Use the **Logs** tab to monitor deployment status for each enrolled machine. +Use the **Logs** tab to monitor deployment status for each enrolled device. ### Package @@ -116,50 +115,50 @@ Your policy should contain a single package for Microsoft Defender. Configure the appropriate scope to specify the computers that will receive this policy. -After you save the Configuration Profile, you can use the Logs tab to monitor the deployment status for each enrolled machine. +After you save the Configuration Profile, you can use the Logs tab to monitor the deployment status for each enrolled device. -## Client machine setup +## Client device setup -You need no special provisioning for a macOS computer beyond the standard JAMF Enrollment. +You'll need no special provisioning for a macOS computer, beyond the standard JAMF Enrollment. > [!NOTE] > After a computer is enrolled, it will show up in the Computers inventory (All Computers). -1. Open the machine details, from **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. +1. Open **Device Profiles**, from the **General** tab, and make sure that **User Approved MDM** is set to **Yes**. If it's currently set to No, the user needs to open **System Preferences > Profiles** and select **Approve** on the MDM Profile. ![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) ![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) -After some time, the machine's User Approved MDM status will change to Yes. +After some time, the device's User Approved MDM status will change to **Yes**. ![MDM status screenshot](images/MDATP_23_MDMStatus.png) -You can enroll additional machines now. Optionally, can do it after system configuration and application packages are provisioned. +You can enroll additional devices at this point. Optionally, you can enroll them later, after you have finished provisioning system configuration and application packages. ## Deployment -Enrolled client machines periodically poll the JAMF Server and install new configuration profiles and policies as soon as they are detected. +Enrolled client devices periodically poll the JAMF Server, and install new configuration profiles and policies as soon as they are detected. -### Status on server +### Status on the server -You can monitor the deployment status in the Logs tab: +You can monitor deployment status in the **Logs** tab: - **Pending** means that the deployment is scheduled but has not yet happened - **Completed** means that the deployment succeeded and is no longer scheduled ![Status on server screenshot](images/MDATP_24_StatusOnServer.png) -### Status on client machine +### Status on client device -After the Configuration Profile is deployed, you'll see the profile on the machine in the **System Preferences > Profiles >** Name of Configuration Profile. +After the Configuration Profile is deployed, you'll see the profile on the device in **System Preferences > Profiles >**, under the name of the configuration profile. ![Status on client screenshot](images/MDATP_25_StatusOnClient.png) -After the policy is applied, you'll see the Microsoft Defender icon in the macOS status bar in the top-right corner. +After the policy is applied, you'll see the Microsoft Defender ATP icon in the macOS status bar in the top-right corner. ![Microsoft Defender icon in status bar screenshot](images/MDATP_Icon_Bar.png) -You can monitor policy installation on a machine by following the JAMF's log file: +You can monitor policy installation on a device by following the JAMF log file: ```bash mavel-mojave:~ testuser$ tail -f /var/log/jamf.log @@ -182,22 +181,22 @@ orgId : "4751b7d4-ea75-4e8f-a1f5-6d640c65bc45" ... ``` -- **licensed**: This confirms that the machine has an ATP license. +- **licensed**: This confirms that the device has an ATP license. -- **orgid**: Your ATP org id, it will be the same for your organization. +- **orgid**: Your Microsoft Defender ATP org id; it will be the same for your organization. ## Check onboarding status -You can check that machines are correctly onboarded by creating a script. For example, the following script checks that enrolled machines are onboarded: +You can check that devices have been correctly onboarded by creating a script. For example, the following script checks enrolled devices for onboarding status: ```bash mdatp --health healthy ``` This script returns: -- 0 if Microsoft Defender ATP is registered with the Windows Defender ATP service -- 1 if the machine is not onboarded -- 3 if the connection to the daemon cannot be established (daemon is not running) +- 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service +- 1 if the device is not yet onboarded +- 3 if the connection to the daemon cannot be established—for example, if daemon is not running ## Logging installation issues @@ -205,4 +204,4 @@ See [Logging installation issues](microsoft-defender-atp-mac-resources.md#loggin ## Uninstallation -See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Windows Defender ATP for Mac from client devices. \ No newline at end of file +See [Uninstalling](microsoft-defender-atp-mac-resources.md#uninstalling) for details on how to remove Microsoft Defender ATP for Mac from client devices. \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md index 7db036c1d0..694e2e86ce 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-resources.md @@ -21,7 +21,7 @@ ms.topic: conceptual **Applies to:** -[Windows Defender Advanced Threat Protection (Windows Defender ATP) for Mac](microsoft-defender-atp-mac.md) +[Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac](microsoft-defender-atp-mac.md) >[!IMPORTANT] >This topic relates to the pre-release version of Microsoft Defender ATP for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. @@ -41,7 +41,7 @@ If you can reproduce a problem, please increase the logging level, run the syste 2. Reproduce the problem -3. Run `mdatp --diagnostic --create` to backup Defender ATP's logs. The command will print out location with generated zip file. +3. Run `mdatp --diagnostic --create` to backup Microsoft Defender ATP's logs. The command will print out location with generated zip file. ```bash mavel-mojave:~ testuser$ mdatp --diagnostic --create @@ -152,6 +152,6 @@ In the Microsoft Defender ATP portal, you'll see two categories of information: ## Known issues - Not fully optimized for performance or disk space yet. -- Full Windows Defender ATP integration is not available yet. -- Mac devices that switch networks may appear multiple times in the APT portal. +- Full Microsoft Defender ATP integration is not available yet. +- Mac devices that switch networks may appear multiple times in the Microsoft Defender ATP portal. - Centrally managed uninstall via Intune is still in development. As an alternative, manually uninstall Microsoft Defender ATP for Mac from each client device. diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md index b14ccc332d..c5f47ef87a 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac.md @@ -22,7 +22,7 @@ ms.topic: conceptual >[!IMPORTANT] >This topic relates to the pre-release version of Microsoft Defender Advanced Threat Protection (ATP) for Mac. Microsoft Defender ATP for Mac is not yet widely available, and this topic only applies to enterprise customers who have been accepted into the preview program. Microsoft makes no warranties, express or implied, with respect to the information provided here. -This topic describes how to install and use Microsoft Defender Advanced Threat Protection ATP for Mac. +This topic describes how to install and use Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP) for Mac. ## What’s new in the public preview @@ -39,7 +39,7 @@ Since opening the limited preview, we've been working non-stop to enhance the pr ## Installing and configuring -There are various methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. +There are several methods and deployment tools that you can use to install and configure Microsoft Defender ATP for Mac. In general you'll need to take the following steps: - Ensure you have a Microsoft Defender ATP subscription and have access to the Microsoft Defender ATP Portal From e137c5b67bf6bbaa2aa5ee8ae8ecaf09c422449d Mon Sep 17 00:00:00 2001 From: martyav Date: Wed, 22 May 2019 16:01:13 -0400 Subject: [PATCH 15/19] wording tweaks to mdatp pages --- .../microsoft-defender-atp-mac-install-with-intune.md | 2 +- .../microsoft-defender-atp-mac-install-with-jamf.md | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md index e6aaf51861..695a6be30d 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-intune.md @@ -94,7 +94,7 @@ Select **Open System Preferences**, locate **Management Profile** on the list an 2. Select **Continue** and complete the enrollment. -You can enroll additional devices. Optionally, you can enroll them later, after you have finished provisioning system configuration and application packages. +You may now enroll additional devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. 3. In Intune, open **Manage** > **Devices** > **All devices**. You'll see your device among those listed: diff --git a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md index 2f1224ed6d..fd9c3d6b85 100644 --- a/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md +++ b/windows/security/threat-protection/windows-defender-antivirus/microsoft-defender-atp-mac-install-with-jamf.md @@ -129,11 +129,11 @@ You'll need no special provisioning for a macOS computer, beyond the standard JA ![MDM approve button screenshot](images/MDATP_21_MDMProfile1.png) ![MDM screenshot](images/MDATP_22_MDMProfileApproved.png) -After some time, the device's User Approved MDM status will change to **Yes**. +After a moment, the device's User Approved MDM status will change to **Yes**. ![MDM status screenshot](images/MDATP_23_MDMStatus.png) -You can enroll additional devices at this point. Optionally, you can enroll them later, after you have finished provisioning system configuration and application packages. +You may now enroll additional devices. You can also enroll them later, after you have finished provisioning system configuration and application packages. ## Deployment @@ -196,7 +196,7 @@ mdatp --health healthy This script returns: - 0 if Microsoft Defender ATP is registered with the Microsoft Defender ATP service - 1 if the device is not yet onboarded -- 3 if the connection to the daemon cannot be established—for example, if daemon is not running +- 3 if the connection to the daemon cannot be established—for example, if the daemon is not running ## Logging installation issues From cfed15eef6afdc0081951e43d88fce79384e51ee Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 May 2019 13:45:06 -0700 Subject: [PATCH 16/19] optimize onboarding content --- .../minimum-requirements.md | 123 +++++++++++++++- .../onboard-configure.md | 137 ++---------------- 2 files changed, 132 insertions(+), 128 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md index b9112f5c8c..f04b35c833 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md +++ b/windows/security/threat-protection/microsoft-defender-atp/minimum-requirements.md @@ -22,7 +22,7 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -There are some minimum requirements for onboarding machines to the service. +There are some minimum requirements for onboarding machines to the service. Learn about the licensing, hardware and software requirements, and other configuration settings to onboard devices to the service. >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-minreqs-abovefoldlink) @@ -45,6 +45,127 @@ For a detailed comparison table of Windows 10 commercial edition comparison, see For more information about licensing requirements for Microsoft Defender ATP platform on Windows Server, see [Protecting Windows Servers with Microsoft Defender ATP](https://techcommunity.microsoft.com/t5/Windows-Defender-ATP/Protecting-Windows-Server-with-Windows-Defender-ATP/ba-p/267114). +## Hardware and software requirements +### Supported Windows versions +- Windows 7 SP1 Enterprise +- Windows 7 SP1 Pro +- Windows 8.1 Enterprise +- Windows 8.1 Pro +- Windows 10, version 1607 or later + - Windows 10 Enterprise + - Windows 10 Education + - Windows 10 Pro + - Windows 10 Pro Education +- Windows server + - Windows Server 2012 R2 + - Windows Server 2016 + - Windows Server 2016, version 1803 + - Windows Server 2019 + +Machines on your network must be running one of these editions. + +The hardware requirements for Microsoft Defender ATP on machines is the same as those for the supported editions. + +> [!NOTE] +> Machines that are running mobile versions of Windows are not supported. + + +### Other supported operating systems +- macOSX +- Linux +- Android + +>[!NOTE] +>You'll need to know the exact Linux distros, Android, and macOS versions that are compatible with Microsoft Defender ATP for the integration to work. + + +### Network and data storage and configuration requirements +When you run the onboarding wizard for the first time, you must choose where your Microsoft Defender Advanced Threat Protection-related information is stored: in the European Union, the United Kingdom, or the United States datacenter. + +> [!NOTE] +> - You cannot change your data storage location after the first-time setup. +> - Review the [Microsoft Defender ATP data storage and privacy](data-storage-privacy.md) for more information on where and how Microsoft stores your data. + + +### Diagnostic data settings +You must ensure that the diagnostic data service is enabled on all the machines in your organization. +By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them. + +**Use the command line to check the Windows 10 diagnostic data service startup type**: + +1. Open an elevated command-line prompt on the machine: + + a. Go to **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc qc diagtrack + ``` + +If the service is enabled, then the result should look like the following screenshot: + +![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) + +If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start. + + + +**Use the command line to set the Windows 10 diagnostic data service to automatically start:** + +1. Open an elevated command-line prompt on the endpoint: + + a. Go to **Start** and type **cmd**. + + b. Right-click **Command prompt** and select **Run as administrator**. + +2. Enter the following command, and press **Enter**: + + ```text + sc config diagtrack start=auto + ``` + +3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: + + ```text + sc qc diagtrack + ``` + + + +#### Internet connectivity +Internet connectivity on machines is required either directly or through proxy. + +The Microsoft Defender ATP sensor can utilize a daily average bandwidth of 5MB to communicate with the Microsoft Defender ATP cloud service and report cyber data. One-off activities such as file uploads and investigation package collection are not included in this daily average bandwidth. + +For more information on additional proxy configuration settings see, [Configure machine proxy and Internet connectivity settings](configure-proxy-internet.md) . + +Before you onboard machines, the diagnostic data service must be enabled. The service is enabled by default in Windows 10. + + +## Windows Defender Antivirus configuration requirement +The Microsoft Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them. + +You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md). + +When Windows Defender Antivirus is not the active antimalware in your organization and you use the Microsoft Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Microsoft Defender ATP must be excluded from this group policy. + +If you are onboarding servers and Windows Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Windows Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Onboard servers](configure-server-endpoints.md). + + +For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). + +## Windows Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled +If you're running Windows Defender Antivirus as the primary antimalware product on your machines, the Microsoft Defender ATP agent will successfully onboard. + +If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy). + + + + + ## Related topic - [Validate licensing and complete setup](licensing.md) - [Onboard machines](onboard-configure.md) diff --git a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md index ad3404e068..e6720fb5ed 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md +++ b/windows/security/threat-protection/microsoft-defender-atp/onboard-configure.md @@ -22,139 +22,18 @@ ms.topic: conceptual **Applies to:** - [Microsoft Defender Advanced Threat Protection (Microsoft Defender ATP)](https://go.microsoft.com/fwlink/p/?linkid=2069559) -You need to turn on the sensor to give visibility within Microsoft Defender ATP. - -For more information, see [Onboard your Windows 10 machines to Microsoft Defender ATP](https://www.youtube.com/watch?v=JT7VGYfeRlA&feature=youtu.be). - [!include[Prerelease information](prerelease.md)] >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-abovefoldlink) -## Licensing requirements -Microsoft Defender Advanced Threat Protection requires one of the following Microsoft Volume Licensing offers: +You'll need to go the onboarding section of the Microsoft Defender ATP portal to onboard any of the supported devices. Depending on the device, you'll be guided with appropriate steps and provided management and deployment tool options suitable for the device. - - Windows 10 Enterprise E5 - - Windows 10 Education E5 - - Microsoft 365 Enterprise E5 which includes Windows 10 Enterprise E5 - -For more information, see [Windows 10 Licensing](https://www.microsoft.com/en-us/Licensing/product-licensing/windows10.aspx#tab=2). - -## Hardware and software requirements -### Supported Windows versions -- Windows 7 SP1 Enterprise -- Windows 7 SP1 Pro -- Windows 8.1 Enterprise -- Windows 8.1 Pro -- Windows 10, version 1607 or later - - Windows 10 Enterprise - - Windows 10 Education - - Windows 10 Pro - - Windows 10 Pro Education -- Windows server - - Windows Server 2012 R2 - - Windows Server 2016 - - Windows Server 2016, version 1803 - - Windows Server 2019 - -Machines on your network must be running one of these editions. - -The hardware requirements for Microsoft Defender ATP on machines is the same as those for the supported editions. - -> [!NOTE] -> Machines that are running mobile versions of Windows are not supported. - - -### Other supported operating systems -- macOSX -- Linux - ->[!NOTE] ->You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work. - - -### Network and data storage and configuration requirements -When you run the onboarding wizard for the first time, you must choose where your Microsoft Defender Advanced Threat Protection-related information is stored: in the European Union, the United Kingdom, or the United States datacenter. - -> [!NOTE] -> - You cannot change your data storage location after the first-time setup. -> - Review the [Microsoft Defender ATP data storage and privacy](data-storage-privacy.md) for more information on where and how Microsoft stores your data. - - -### Diagnostic data settings -You must ensure that the diagnostic data service is enabled on all the machines in your organization. -By default, this service is enabled, but it's good practice to check to ensure that you'll get sensor data from them. - -**Use the command line to check the Windows 10 diagnostic data service startup type**: - -1. Open an elevated command-line prompt on the machine: - - a. Go to **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc qc diagtrack - ``` - -If the service is enabled, then the result should look like the following screenshot: - -![Result of the sc query command for diagtrack](images/windefatp-sc-qc-diagtrack.png) - -If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the service to automatically start. - - - -**Use the command line to set the Windows 10 diagnostic data service to automatically start:** - -1. Open an elevated command-line prompt on the endpoint: - - a. Go to **Start** and type **cmd**. - - b. Right-click **Command prompt** and select **Run as administrator**. - -2. Enter the following command, and press **Enter**: - - ```text - sc config diagtrack start=auto - ``` - -3. A success message is displayed. Verify the change by entering the following command, and press **Enter**: - - ```text - sc qc diagtrack - ``` - - - -#### Internet connectivity -Internet connectivity on machines is required either directly or through proxy. - -The Microsoft Defender ATP sensor can utilize a daily average bandwidth of 5MB to communicate with the Microsoft Defender ATP cloud service and report cyber data. One-off activities such as file uploads and investigation package collection are not included in this daily average bandwidth. - -For more information on additional proxy configuration settings see, [Configure machine proxy and Internet connectivity settings](configure-proxy-internet.md) . - -Before you onboard machines, the diagnostic data service must be enabled. The service is enabled by default in Windows 10. - - -## Windows Defender Antivirus configuration requirement -The Microsoft Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them. - -You must configure Security intelligence updates on the Microsoft Defender ATP machines whether Windows Defender Antivirus is the active antimalware or not. For more information, see [Manage Windows Defender Antivirus updates and apply baselines](../windows-defender-antivirus/manage-updates-baselines-windows-defender-antivirus.md). - -When Windows Defender Antivirus is not the active antimalware in your organization and you use the Microsoft Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Microsoft Defender ATP must be excluded from this group policy. - -If you are onboarding servers and Windows Defender Antivirus is not the active antimalware on your servers, you shouldn't uninstall Windows Defender Antivirus. You'll need to configure it to run on passive mode. For more information, see [Onboard servers](configure-server-endpoints.md). - - -For more information, see [Windows Defender Antivirus compatibility](../windows-defender-antivirus/windows-defender-antivirus-compatibility.md). - -## Windows Defender Antivirus Early Launch Antimalware (ELAM) driver is enabled -If you're running Windows Defender Antivirus as the primary antimalware product on your machines, the Microsoft Defender ATP agent will successfully onboard. - -If you're running a third-party antimalware client and use Mobile Device Management solutions or System Center Configuration Manager (current branch) version 1606, you'll need to ensure that the Windows Defender Antivirus ELAM driver is enabled. For more information, see [Ensure that Windows Defender Antivirus is not disabled by policy](troubleshoot-onboarding.md#ensure-that-windows-defender-antivirus-is-not-disabled-by-a-policy). +In general, to onboard devices to the service: +- Verify that the device fulfills the [minimum requirements](minimum-requirements.md) +- Depending on the device, follow the configuration steps provided in the onboarding section of the Microsoft Defender ATP portal +- Use the appropriate management tool and deployment method for your devices +- Run a detection test to verify that the devices are properly onboarded and reporting to the service ## In this section Topic | Description @@ -168,3 +47,7 @@ Topic | Description [Troubleshoot onboarding issues](troubleshoot-onboarding.md) | Learn about resolving issues that might arise during onboarding. >Want to experience Microsoft Defender ATP? [Sign up for a free trial.](https://www.microsoft.com/en-us/WindowsForBusiness/windows-atp?ocid=docs-wdatp-onboardconfigure-belowfoldlink) + + + + From 0821c6519db96b9b6011916e15960b582453f58b Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 May 2019 13:46:44 -0700 Subject: [PATCH 17/19] preview language --- .../threat-protection/microsoft-defender-atp/preview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 3659e79b88..738e008f9e 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -28,7 +28,7 @@ The Microsoft Defender ATP service is constantly being updated to include new fe Learn about new features in the Microsoft Defender ATP preview release and be among the first to try upcoming features by turning on the preview experience. -For more information on capabilities that are generally available or in preview, see [What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md). +For more information on new capabilities that are generally available, see [What's new in Microsoft Defender ATP](whats-new-in-microsoft-defender-atp.md). ## Turn on preview features You'll have access to upcoming features which you can provide feedback on to help improve the overall experience before features are generally available. From ce0279f79b42448a26a4f5fcd9e257f3cc093ff0 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Wed, 22 May 2019 13:48:53 -0700 Subject: [PATCH 18/19] fix link --- .../threat-protection/microsoft-defender-atp/preview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/microsoft-defender-atp/preview.md b/windows/security/threat-protection/microsoft-defender-atp/preview.md index 738e008f9e..5daf8735f5 100644 --- a/windows/security/threat-protection/microsoft-defender-atp/preview.md +++ b/windows/security/threat-protection/microsoft-defender-atp/preview.md @@ -42,7 +42,7 @@ Turn on the preview experience setting to be among the first to try upcoming fea ## Preview features The following features are included in the preview release: -- [Live response](https://docs.microsoft.com/windows/security/threat-protection/windows-defender-atp/live-response)
    Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. +- [Live response](live-response.md)
    Get instantaneous access to a machine using a remote shell connection. Do in-depth investigative work and take immediate response actions to promptly contain identified threats – real-time. - [Threat & Vulnerability Management](next-gen-threat-and-vuln-mgt.md)
    A new built-in capability that uses a risk-based approach to the discovery, prioritization, and remediation of endpoint vulnerabilities and misconfigurations.