mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-19 04:13:41 +00:00
Merge branch 'MDBranchMachineToDeviceParent' into MDBranchMachineToDeviceChild
This commit is contained in:
ManikaDhiman
@ -25,12 +25,16 @@ ms.topic: article
|
||||
This topic provides an overview of new solutions and online content related to deploying Windows 10 in your organization.
|
||||
|
||||
- For an all-up overview of new features in Windows 10, see [What's new in Windows 10](https://docs.microsoft.com/windows/whats-new/index).
|
||||
- For a detailed list of changes to Windows 10 ITPro TechNet library content, see [Online content change history](#online-content-change-history).
|
||||
|
||||
## Recent changes
|
||||
## Latest news
|
||||
|
||||
[SetupDiag](#setupdiag) is included with Windows 10, version 2004 and later.<br>
|
||||
The [Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/adk-install) is available.<br>
|
||||
New capabilities are available for [Delivery Optimization](#delivery-optimization) and [Windows Update for Business](#windows-update-for-business).<br>
|
||||
VPN support is added to [Windows Autopilot](#windows-autopilot)<br>
|
||||
An in-place upgrade wizard is available in [Configuration Manager](#microsoft-endpoint-configuration-manager).<br>
|
||||
The [Windows ADK](#windows-assessment-and-deployment-kit-adk) for Windows 10, version 2004 is available.<br>
|
||||
The Windows 10 deployment and update [landing page](index.yml) has been redesigned, with additional content added and more content coming soon.<br>
|
||||
|
||||
## The Modern Desktop Deployment Center
|
||||
|
||||
@ -47,7 +51,34 @@ See [Deploy Windows 10 with Microsoft 365](deploy-m365.md) for an overview, whic
|
||||
|
||||
## Windows 10 servicing and support
|
||||
|
||||
- [**Delivery Optimization**](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization): Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon!
|
||||
### Delivery Optimization
|
||||
|
||||
Windows PowerShell cmdlets for Delivery Optimization have been improved:
|
||||
|
||||
- **Get-DeliveryOptimizationStatus** has added the **-PeerInfo** option for a real-time peak behind the scenes on peer-to-peer activity (for example the peer IP Address, bytes received / sent).
|
||||
- **Get-DeliveryOptimizationLogAnalysis** is a new cmdlet that provides a summary of the activity in your DO log (# of downloads, downloads from peers, overall peer efficiency). Use the **-ListConnections** option to for in-depth look at peer-to-peer connections.
|
||||
- **Enable-DeliveryOptimizationVerboseLogs** is a new cmdlet that enables a greater level of logging detail to assist in troubleshooting.
|
||||
|
||||
Additional improvements in [Delivery Optimization](https://docs.microsoft.com/windows/deployment/update/waas-delivery-optimization) include:
|
||||
- Enterprise network [throttling is enhanced](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#new-download-throttling-options-for-delivery-optimization-build-18917) to optimize foreground vs. background throttling.
|
||||
- Automatic cloud-based congestion detection is available for PCs with cloud service support.
|
||||
- Improved Peer Efficiency for enterprises and educational institutions with complex networks is enabled with of [new policies](https://docs.microsoft.com/windows/client-management/mdm/policy-csp-deliveryoptimization). This now supports Microsoft 365 Apps for enterprise updates, and Intune content, with Microsoft Endpoint Configuration Manager content coming soon!
|
||||
|
||||
The following Delivery Optimization policies are removed in the Windows 10, version 2004 release:
|
||||
|
||||
- Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth)
|
||||
- Reason: Replaced with separate policies for foreground and background
|
||||
- Max Upload Bandwidth (DOMaxUploadBandwidth)
|
||||
- Reason: impacts uploads to internet peers only, which isn't used in Enterprises.
|
||||
- Absolute max throttle (DOMaxDownloadBandwidth)
|
||||
- Reason: separated to foreground and background
|
||||
|
||||
### Windows Update for Business
|
||||
|
||||
[Windows Update for Business](https://docs.microsoft.com/windows/deployment/update/waas-manage-updates-wufb) enhancements in this release include:
|
||||
- Intune console updates: target version is now available allowing you to specify which version of Windows 10 you want devices to move to. Additionally, this capability enables you to keep devices on their current version until they reach end of service. Check it out in Intune, also available as a Group Policy and Configuration Service Provider (CSP) policy.
|
||||
- Validation improvements: To ensure devices and end users stay productive and protected, Microsoft uses safeguard holds to block devices from updating when there are known issues that would impact that device. Also, to better enable IT administrators to validate on the latest release, we have created a new policy that enables admins to opt devices out of the built-in safeguard holds.
|
||||
|
||||
- [**Automatic Restart Sign-on (ARSO)**](https://docs.microsoft.com/windows-insider/at-work-pro/wip-4-biz-whats-new#automatic-restart-and-sign-on-arso-for-enterprises-build-18305): Windows will automatically log on as the user and lock their device in order to complete the update, ensuring that when the user returns and unlocks the device, the update will be completed.
|
||||
- [**Windows Update for Business**](https://techcommunity.microsoft.com/t5/Windows-IT-Pro-Blog/Windows-Update-for-Business-and-the-retirement-of-SAC-T/ba-p/339523): There will now be a single, common start date for phased deployments (no more SAC-T designation). In addition, there will be a new notification and reboot scheduling experience for end users, the ability to enforce update installation and reboot deadlines, and the ability to provide end user control over reboots for a specific time period.
|
||||
- **Update rollback improvements**: You can now automatically recover from startup failures by removing updates if the startup failure was introduced after the installation of recent driver or quality updates. When a device is unable to start up properly after the recent installation of Quality of driver updates, Windows will now automatically uninstall the updates to get the device back up and running normally.
|
||||
@ -68,13 +99,16 @@ Windows 10 Enterprise E3 launched in the Cloud Solution Provider (CSP) channel o
|
||||
|
||||
For more information, see [Windows 10 Enterprise E3 in CSP](windows-10-enterprise-e3-overview.md)
|
||||
|
||||
|
||||
## Deployment solutions and tools
|
||||
|
||||
### Windows Autopilot
|
||||
|
||||
[Windows Autopilot](https://docs.microsoft.com/windows/deployment/windows-autopilot/windows-autopilot) streamlines and automates the process of setting up and configuring new devices, with minimal interaction required from the end user. You can also use Windows Autopilot to reset, repurpose and recover devices.
|
||||
|
||||
With the release of Windows 10, version 2004 you can configure [Windows Autopilot user-driven](https://docs.microsoft.com/windows/deployment/windows-autopilot/user-driven) Hybrid Azure Active Directory join with VPN support. This support is also backported to Windows 10, version 1909 and 1903.
|
||||
|
||||
If you configure the language settings in the Autopilot profile and the device is connected to Ethernet, all scenarios will now skip the language, locale, and keyboard pages. In previous versions, this was only supported with self-deploying profiles.
|
||||
|
||||
The following Windows Autopilot features are available in Windows 10, version 1903 and later:
|
||||
|
||||
- [Windows Autopilot for white glove deployment](https://docs.microsoft.com/windows/deployment/windows-autopilot/white-glove) is new in Windows 10, version 1903. "White glove" deployment enables partners or IT staff to pre-provision devices so they are fully configured and business ready for your users.
|
||||
@ -83,6 +117,10 @@ The following Windows Autopilot features are available in Windows 10, version 19
|
||||
- Windows Autopilot is self-updating during OOBE. Starting with the Windows 10, version 1903 Autopilot functional and critical updates will begin downloading automatically during OOBE.
|
||||
- Windows Autopilot will set the [diagnostics data](https://docs.microsoft.com/windows/privacy/windows-diagnostic-data) level to Full on Windows 10 version 1903 and later during OOBE.
|
||||
|
||||
### Microsoft Endpoint Configuration Manager
|
||||
|
||||
An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364).
|
||||
|
||||
### Windows 10 Subscription Activation
|
||||
|
||||
Windows 10 Education support has been added to Windows 10 Subscription Activation.
|
||||
@ -91,9 +129,11 @@ With Windows 10, version 1903, you can step-up from Windows 10 Pro Education to
|
||||
|
||||
### SetupDiag
|
||||
|
||||
[SetupDiag](upgrade/setupdiag.md) is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful.
|
||||
[SetupDiag](upgrade/setupdiag.md) is a command-line tool that can help diagnose why a Windows 10 update failed. SetupDiag works by searching Windows Setup log files. When searching log files, SetupDiag uses a set of rules to match known issues.
|
||||
|
||||
SetupDiag version 1.6.0.42 was released on 08/08/2019.
|
||||
In Windows 10, version 2004, SetupDiag is now automatically installed.
|
||||
|
||||
During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%\$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, Windows Setup now also installs SetupDiag.exe to this directory. If there is an issue with the upgrade, SetupDiag is automatically run to determine the cause of the failure. If the upgrade process proceeds normally, this directory is moved under %SystemDrive%\Windows.Old for cleanup.
|
||||
|
||||
### Upgrade Readiness
|
||||
|
||||
@ -129,21 +169,21 @@ There are many benefits to converting the partition style of a disk to GPT, incl
|
||||
|
||||
For more information, see [MBR2GPT.EXE](mbr-to-gpt.md).
|
||||
|
||||
|
||||
### Microsoft Deployment Toolkit (MDT)
|
||||
|
||||
MDT build 8456 (12/19/2018) is available, including support for Windows 10, version 1809, and Windows Server 2019.
|
||||
|
||||
For more information about MDT, see the [MDT resource page](https://docs.microsoft.com/sccm/mdt/).
|
||||
MDT version 8456 supports Windows 10, version 2004 and earlier operating systems, including Windows Server 2019. There is currently an issue that causes MDT to incorrectly detect that UEFI is present in Windows 10, version 2004. This issue is currently under investigation.
|
||||
|
||||
For the latest information about MDT, see the [MDT release notes](https://docs.microsoft.com/mem/configmgr/mdt/release-notes).
|
||||
|
||||
### Windows Assessment and Deployment Kit (ADK)
|
||||
|
||||
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows. See the following topics:
|
||||
The Windows Assessment and Deployment Kit (Windows ADK) contains tools that can be used by IT Pros to deploy Windows.
|
||||
|
||||
- [What's new in ADK kits and tools](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools)
|
||||
- [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md)
|
||||
Download the Windows ADK and Windows PE add-on for Windows 10, version 2004 [here](https://docs.microsoft.com/windows-hardware/get-started/adk-install).
|
||||
|
||||
For information about what's new in the ADK, see [What's new in the Windows ADK for Windows 10, version 2004](https://docs.microsoft.com/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-2004).
|
||||
|
||||
Also see [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md).
|
||||
|
||||
## Testing and validation guidance
|
||||
|
||||
@ -157,25 +197,15 @@ For more information, see the following guides:
|
||||
- [Deploy Windows 10 in a test lab using Microsoft Deployment Toolkit](windows-10-poc-mdt.md)
|
||||
- [Deploy Windows 10 in a test lab using Microsoft Endpoint Configuration Manager](windows-10-poc-sc-config-mgr.md)
|
||||
|
||||
|
||||
## Troubleshooting guidance
|
||||
|
||||
[Resolve Windows 10 upgrade errors](upgrade/resolve-windows-10-upgrade-errors.md) was published in October of 2016 and will continue to be updated with new fixes. The topic provides a detailed explanation of the Windows 10 upgrade process and instructions on how to locate, interpret, and resolve specific errors that can be encountered during the upgrade process.
|
||||
|
||||
|
||||
## Online content change history
|
||||
|
||||
The following topics provide a change history for Windows 10 ITPro TechNet library content related to deploying and using Windows 10.
|
||||
|
||||
[Change history for Access Protection](/windows/access-protection/change-history-for-access-protection)<br>
|
||||
[Change history for Device Security](/windows/device-security/change-history-for-device-security)<br>
|
||||
[Change history for Threat Protection](/windows/threat-protection/change-history-for-threat-protection)
|
||||
|
||||
## Related topics
|
||||
|
||||
[Overview of Windows as a service](update/waas-overview.md)
|
||||
<BR>[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)
|
||||
<BR>[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)
|
||||
<BR>[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)
|
||||
<BR>[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)
|
||||
<BR>[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)
|
||||
[Overview of Windows as a service](update/waas-overview.md)<br>
|
||||
[Windows 10 deployment considerations](planning/windows-10-deployment-considerations.md)<br>
|
||||
[Windows 10 release information](https://docs.microsoft.com/windows/windows-10/release-information)<br>
|
||||
[Windows 10 Specifications & Systems Requirements](https://www.microsoft.com/windows/windows-10-specifications)<br>
|
||||
[Windows 10 upgrade paths](upgrade/windows-10-upgrade-paths.md)<br>
|
||||
[Windows 10 deployment tools](windows-deployment-scenarios-and-tools.md)<br>
|
||||
|
||||
@ -28,13 +28,23 @@ ms.topic: article
|
||||
|
||||
## About SetupDiag
|
||||
|
||||
<I>Current version of SetupDiag: 1.6.0.42</I>
|
||||
<I>Current downloadable version of SetupDiag: 1.6.0.42</I>
|
||||
>Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues.
|
||||
|
||||
SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful.
|
||||
|
||||
SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode.
|
||||
|
||||
## SetupDiag in Windows 10, version 2004 and later
|
||||
|
||||
With the release of Windows 10, version 2004, SetupDiag is included with Windows Setup.
|
||||
|
||||
During the upgrade process, Windows Setup will extract all its sources files to the **%SystemDrive%$Windows.~bt\Sources** directory. With Windows 10, version 2004 and later, SetupDiag.exe is also installed to this directory. If there is an issue with the upgrade, SetupDiag will automatically run to determine the cause of the failure.
|
||||
|
||||
If the upgrade process proceeds normally, this directory is moved under **%SystemDrive%\Windows.Old** for cleanup. If this directory is deleted, SetupDiag.exe will also be removed.
|
||||
|
||||
## Using SetupDiag
|
||||
|
||||
To quickly use SetupDiag on your current computer:
|
||||
1. Verify that your system meets the [requirements](#requirements) described below. If needed, install the [.NET framework 4.6](https://www.microsoft.com/download/details.aspx?id=48137).
|
||||
2. [Download SetupDiag](https://go.microsoft.com/fwlink/?linkid=870142).
|
||||
|
||||
@ -14,11 +14,13 @@ ms.collection: M365-identity-device-management
|
||||
ms.topic: article
|
||||
ms.reviewer:
|
||||
---
|
||||
|
||||
# Windows Defender Device Guard and Windows Defender Credential Guard hardware readiness tool
|
||||
|
||||
```powershell
|
||||
# Script to find out if machine is Device Guard compliant
|
||||
# requires driver verifier on system.
|
||||
# Script to find out if a machine is Device Guard compliant.
|
||||
# The script requires a driver verifier present on the system.
|
||||
|
||||
param([switch]$Capable, [switch]$Ready, [switch]$Enable, [switch]$Disable, $SIPolicyPath, [switch]$AutoReboot, [switch]$DG, [switch]$CG, [switch]$HVCI, [switch]$HLK, [switch]$Clear, [switch]$ResetVerifier)
|
||||
|
||||
$path = "C:\DGLogs\"
|
||||
@ -36,7 +38,7 @@ $DGVerifySuccess = New-Object System.Text.StringBuilder
|
||||
$Sys32Path = "$env:windir\system32"
|
||||
$DriverPath = "$env:windir\system32\drivers"
|
||||
|
||||
#generated by certutil -encode
|
||||
#generated by certutil -encode
|
||||
$SIPolicy_Encoded = "BQAAAA43RKLJRAZMtVH2AW5WMHbk9wcuTBkgTbfJb0SmxaI0BACNkAgAAAAAAAAA
|
||||
HQAAAAIAAAAAAAAAAAAKAEAAAAAMAAAAAQorBgEEAYI3CgMGDAAAAAEKKwYBBAGC
|
||||
NwoDBQwAAAABCisGAQQBgjc9BAEMAAAAAQorBgEEAYI3PQUBDAAAAAEKKwYBBAGC
|
||||
@ -114,7 +116,7 @@ function LogAndConsoleSuccess($message)
|
||||
|
||||
function LogAndConsoleError($message)
|
||||
{
|
||||
Write-Host $message -foregroundcolor "Red"
|
||||
Write-Host $message -foregroundcolor "Red"
|
||||
Log $message
|
||||
}
|
||||
|
||||
@ -132,16 +134,16 @@ function IsExempted([System.IO.FileInfo] $item)
|
||||
Log $cert.ToString()
|
||||
return 0
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
function CheckExemption($_ModName)
|
||||
{
|
||||
$mod1 = Get-ChildItem $Sys32Path $_ModName
|
||||
$mod2 = Get-ChildItem $DriverPath $_ModName
|
||||
if($mod1)
|
||||
{
|
||||
{
|
||||
Log "NonDriver module" + $mod1.FullName
|
||||
return IsExempted($mod1)
|
||||
return IsExempted($mod1)
|
||||
}
|
||||
elseif($mod2)
|
||||
{
|
||||
@ -184,15 +186,15 @@ function CheckFailedDriver($_ModName, $CIStats)
|
||||
}
|
||||
if($Result.Contains("PASS"))
|
||||
{
|
||||
$CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null
|
||||
$CompatibleModules.AppendLine($_ModName.Trim()) | Out-Null
|
||||
}
|
||||
elseif($FailingStat.Trim().Contains("execute-write"))
|
||||
{
|
||||
$FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
$FailingExecuteWriteCheck.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
}
|
||||
else
|
||||
{
|
||||
$FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
$FailingModules.AppendLine("Module: "+ $_ModName.Trim() + "`r`n`tReason: " + $FailingStat.Trim() ) | Out-Null
|
||||
}
|
||||
Log "Result: " $Result
|
||||
}
|
||||
@ -204,7 +206,7 @@ function ListCIStats($_ModName, $str1)
|
||||
{
|
||||
Log "String := " $str1
|
||||
Log "Warning! CI Stats are missing for " $_ModName
|
||||
return
|
||||
return
|
||||
}
|
||||
$temp_str1 = $str1.Substring($i1)
|
||||
$CIStats = $temp_str1.Substring(0).Trim()
|
||||
@ -245,7 +247,7 @@ function ListDrivers($str)
|
||||
}
|
||||
|
||||
$DriverScanCompletedMessage = "Completed scan. List of Compatible Modules can be found at " + $LogFile
|
||||
LogAndConsole $DriverScanCompletedMessage
|
||||
LogAndConsole $DriverScanCompletedMessage
|
||||
|
||||
if($FailingModules.Length -gt 0 -or $FailingExecuteWriteCheck.Length -gt 0 )
|
||||
{
|
||||
@ -254,7 +256,7 @@ function ListDrivers($str)
|
||||
{
|
||||
LogAndConsoleError $WarningMessage
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning $WarningMessage
|
||||
}
|
||||
@ -321,7 +323,7 @@ function ListSummary()
|
||||
}
|
||||
else
|
||||
{
|
||||
LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n"
|
||||
LogAndConsoleSuccess "Machine is Device Guard / Credential Guard Ready.`n"
|
||||
if(!$HVCI -and !$DG)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Capable" /t REG_DWORD /d 2 /f '
|
||||
@ -336,56 +338,56 @@ function ListSummary()
|
||||
|
||||
|
||||
function Instantiate-Kernel32 {
|
||||
try
|
||||
try
|
||||
{
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
|
||||
public static class Kernel32
|
||||
{
|
||||
[DllImport("kernel32", SetLastError=true, CharSet = CharSet.Ansi)]
|
||||
public static extern IntPtr LoadLibrary(
|
||||
[MarshalAs(UnmanagedType.LPStr)]string lpFileName);
|
||||
|
||||
|
||||
[DllImport("kernel32", CharSet=CharSet.Ansi, ExactSpelling=true, SetLastError=true)]
|
||||
public static extern IntPtr GetProcAddress(
|
||||
IntPtr hModule,
|
||||
string procName);
|
||||
}
|
||||
|
||||
|
||||
"@
|
||||
}
|
||||
catch
|
||||
{
|
||||
Log $_.Exception.Message
|
||||
Log $_.Exception.Message
|
||||
LogAndConsole "Instantiate-Kernel32 failed"
|
||||
}
|
||||
}
|
||||
|
||||
function Instantiate-HSTI {
|
||||
try
|
||||
try
|
||||
{
|
||||
Add-Type -TypeDefinition @"
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Net;
|
||||
|
||||
|
||||
public static class HstiTest3
|
||||
{
|
||||
[DllImport("hstitest.dll", CharSet = CharSet.Unicode)]
|
||||
public static extern int QueryHSTIdetails(
|
||||
ref HstiOverallError pHstiOverallError,
|
||||
public static extern int QueryHSTIdetails(
|
||||
ref HstiOverallError pHstiOverallError,
|
||||
[In, Out] HstiProviderErrorDuple[] pHstiProviderErrors,
|
||||
ref uint pHstiProviderErrorsCount,
|
||||
byte[] hstiPlatformSecurityBlob,
|
||||
ref uint pHstiPlatformSecurityBlobBytes);
|
||||
|
||||
[DllImport("hstitest.dll", CharSet = CharSet.Unicode)]
|
||||
public static extern int QueryHSTI(ref bool Pass);
|
||||
|
||||
public static extern int QueryHSTI(ref bool Pass);
|
||||
|
||||
[StructLayout(LayoutKind.Sequential, CharSet = CharSet.Unicode)]
|
||||
public struct HstiProviderErrorDuple
|
||||
{
|
||||
@ -397,7 +399,7 @@ function Instantiate-HSTI {
|
||||
[MarshalAs(UnmanagedType.ByValTStr, SizeConst = 4096)]
|
||||
internal string ErrorString;
|
||||
}
|
||||
|
||||
|
||||
[FlagsAttribute]
|
||||
public enum HstiProviderErrors : int
|
||||
{
|
||||
@ -425,8 +427,8 @@ function Instantiate-HSTI {
|
||||
BlobVersionMismatch = 0x00000080,
|
||||
PlatformSecurityVersionMismatch = 0x00000100,
|
||||
ProviderError = 0x00000200
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
}
|
||||
"@
|
||||
|
||||
@ -434,9 +436,9 @@ function Instantiate-HSTI {
|
||||
$FuncHandle = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTIdetails")
|
||||
$FuncHandle2 = [Kernel32]::GetProcAddress($LibHandle, "QueryHSTI")
|
||||
|
||||
if ([System.IntPtr]::Size -eq 8)
|
||||
if ([System.IntPtr]::Size -eq 8)
|
||||
{
|
||||
#assuming 64 bit
|
||||
#assuming 64 bit
|
||||
Log "`nKernel32::LoadLibrary 64bit --> 0x$("{0:X16}" -f $LibHandle.ToInt64())"
|
||||
Log "HstiTest2::QueryHSTIdetails 64bit --> 0x$("{0:X16}" -f $FuncHandle.ToInt64())"
|
||||
}
|
||||
@ -450,7 +452,7 @@ function Instantiate-HSTI {
|
||||
$hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $null, [ref] $providerErrorDupleCount, $null, [ref] $blobByteSize)
|
||||
|
||||
[byte[]]$blob = New-Object byte[] $blobByteSize
|
||||
[HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount
|
||||
[HstiTest3+HstiProviderErrorDuple[]]$providerErrors = New-Object HstiTest3+HstiProviderErrorDuple[] $providerErrorDupleCount
|
||||
$hr = [HstiTest3]::QueryHSTIdetails([ref] $overallError, $providerErrors, [ref] $providerErrorDupleCount, $blob, [ref] $blobByteSize)
|
||||
$string = $null
|
||||
$blob | foreach { $string = $string + $_.ToString("X2")+"," }
|
||||
@ -479,7 +481,7 @@ function Instantiate-HSTI {
|
||||
LogAndConsoleError $ErrorMessage
|
||||
$DGVerifyCrit.AppendLine($ErrorMessage) | Out-Null
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning $ErrorMessage
|
||||
$DGVerifyWarn.AppendLine("HSTI is absent") | Out-Null
|
||||
@ -487,9 +489,9 @@ function Instantiate-HSTI {
|
||||
}
|
||||
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
LogAndConsoleError $_.Exception.Message
|
||||
LogAndConsoleError $_.Exception.Message
|
||||
LogAndConsoleError "Instantiate-HSTI failed"
|
||||
}
|
||||
}
|
||||
@ -613,10 +615,10 @@ function ExecuteCommandAndLog($_cmd)
|
||||
$CmdOutput = Invoke-Expression $_cmd | Out-String
|
||||
Log "Output: $CmdOutput"
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
Log "Exception while exectuing $_cmd"
|
||||
Log $_.Exception.Message
|
||||
Log $_.Exception.Message
|
||||
}
|
||||
|
||||
|
||||
@ -676,7 +678,7 @@ function CheckDriverCompat
|
||||
verifier.exe /flags 0x02000000 /all /log.code_integrity
|
||||
|
||||
LogAndConsole "Enabling Driver Verifier and Rebooting system"
|
||||
Log $verifier_state
|
||||
Log $verifier_state
|
||||
LogAndConsole "Please re-execute this script after reboot...."
|
||||
if($AutoReboot)
|
||||
{
|
||||
@ -692,7 +694,7 @@ function CheckDriverCompat
|
||||
else
|
||||
{
|
||||
LogAndConsole "Driver verifier already enabled"
|
||||
Log $verifier_state
|
||||
Log $verifier_state
|
||||
ListDrivers($verifier_state.Trim().ToLowerInvariant())
|
||||
}
|
||||
}
|
||||
@ -700,23 +702,23 @@ function IsDomainController
|
||||
{
|
||||
$_isDC = 0
|
||||
$CompConfig = Get-WmiObject Win32_ComputerSystem
|
||||
foreach ($ObjItem in $CompConfig)
|
||||
foreach ($ObjItem in $CompConfig)
|
||||
{
|
||||
$Role = $ObjItem.DomainRole
|
||||
Log "Role=$Role"
|
||||
Switch ($Role)
|
||||
Switch ($Role)
|
||||
{
|
||||
0 { Log "Standalone Workstation" }
|
||||
1 { Log "Member Workstation" }
|
||||
2 { Log "Standalone Server" }
|
||||
3 { Log "Member Server" }
|
||||
4
|
||||
4
|
||||
{
|
||||
Log "Backup Domain Controller"
|
||||
$_isDC=1
|
||||
break
|
||||
}
|
||||
5
|
||||
5
|
||||
{
|
||||
Log "Primary Domain Controller"
|
||||
$_isDC=1
|
||||
@ -735,7 +737,7 @@ function CheckOSSKU
|
||||
Log "OSNAME:$osname"
|
||||
$SKUarray = @("Enterprise", "Education", "IoT", "Windows Server", "Pro", "Home")
|
||||
$HLKAllowed = @("microsoft windows 10 pro")
|
||||
foreach ($SKUent in $SKUarray)
|
||||
foreach ($SKUent in $SKUarray)
|
||||
{
|
||||
if($osname.ToString().Contains($SKUent.ToLower()))
|
||||
{
|
||||
@ -762,7 +764,7 @@ function CheckOSSKU
|
||||
}
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "OSSKU" /t REG_DWORD /d 2 /f '
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
LogAndConsoleError "This PC edition is Unsupported for Device Guard"
|
||||
$DGVerifyCrit.AppendLine("OS SKU unsupported") | Out-Null
|
||||
@ -773,14 +775,14 @@ function CheckOSSKU
|
||||
function CheckOSArchitecture
|
||||
{
|
||||
$OSArch = $(gwmi win32_operatingsystem).OSArchitecture.ToLower()
|
||||
Log $OSArch
|
||||
if($OSArch.Contains("64-bit"))
|
||||
Log $OSArch
|
||||
if($OSArch -match ("^64\-?\s?bit"))
|
||||
{
|
||||
LogAndConsoleSuccess "64 bit archictecture"
|
||||
LogAndConsoleSuccess "64 bit architecture"
|
||||
}
|
||||
elseif($OSArch.Contains("32-bit"))
|
||||
elseif($OSArch -match ("^32\-?\s?bit"))
|
||||
{
|
||||
LogAndConsoleError "32 bit archictecture"
|
||||
LogAndConsoleError "32 bit architecture"
|
||||
$DGVerifyCrit.AppendLine("32 Bit OS, OS Architecture failure.") | Out-Null
|
||||
}
|
||||
else
|
||||
@ -878,7 +880,7 @@ function CheckTPM
|
||||
function CheckSecureMOR
|
||||
{
|
||||
$isSecureMOR = CheckDGFeatures(4)
|
||||
Log "isSecureMOR= $isSecureMOR "
|
||||
Log "isSecureMOR= $isSecureMOR "
|
||||
if($isSecureMOR -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "Secure MOR is available"
|
||||
@ -904,7 +906,7 @@ function CheckSecureMOR
|
||||
function CheckNXProtection
|
||||
{
|
||||
$isNXProtected = CheckDGFeatures(5)
|
||||
Log "isNXProtected= $isNXProtected "
|
||||
Log "isNXProtected= $isNXProtected "
|
||||
if($isNXProtected -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "NX Protector is available"
|
||||
@ -921,7 +923,7 @@ function CheckNXProtection
|
||||
function CheckSMMProtection
|
||||
{
|
||||
$isSMMMitigated = CheckDGFeatures(6)
|
||||
Log "isSMMMitigated= $isSMMMitigated "
|
||||
Log "isSMMMitigated= $isSMMMitigated "
|
||||
if($isSMMMitigated -eq 1)
|
||||
{
|
||||
LogAndConsoleSuccess "SMM Mitigation is available"
|
||||
@ -938,15 +940,15 @@ function CheckSMMProtection
|
||||
function CheckHSTI
|
||||
{
|
||||
LogAndConsole "Copying HSTITest.dll"
|
||||
try
|
||||
try
|
||||
{
|
||||
$HSTITest_Decoded = [System.Convert]::FromBase64String($HSTITest_Encoded)
|
||||
[System.IO.File]::WriteAllBytes("$env:windir\System32\hstitest.dll",$HSTITest_Decoded)
|
||||
|
||||
}
|
||||
catch
|
||||
catch
|
||||
{
|
||||
LogAndConsole $_.Exception.Message
|
||||
LogAndConsole $_.Exception.Message
|
||||
LogAndConsole "Copying and loading HSTITest.dll failed"
|
||||
}
|
||||
|
||||
@ -959,7 +961,7 @@ function PrintToolVersion
|
||||
LogAndConsole ""
|
||||
LogAndConsole "###########################################################################"
|
||||
LogAndConsole ""
|
||||
LogAndConsole "Readiness Tool Version 3.7.1 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard."
|
||||
LogAndConsole "Readiness Tool Version 3.7.2 Release. `nTool to check if your device is capable to run Device Guard and Credential Guard."
|
||||
LogAndConsole ""
|
||||
LogAndConsole "###########################################################################"
|
||||
LogAndConsole ""
|
||||
@ -1030,7 +1032,7 @@ if(!($Ready) -and !($Capable) -and !($Enable) -and !($Disable) -and !($Clear) -a
|
||||
}
|
||||
|
||||
$user = [Security.Principal.WindowsIdentity]::GetCurrent();
|
||||
$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
$TestForAdmin = (New-Object Security.Principal.WindowsPrincipal $user).IsInRole([Security.Principal.WindowsBuiltinRole]::Administrator)
|
||||
|
||||
if(!$TestForAdmin)
|
||||
{
|
||||
@ -1065,7 +1067,7 @@ if($Ready)
|
||||
{
|
||||
Log "_CGState: $_CGState"
|
||||
PrintCGDetails $_CGState
|
||||
|
||||
|
||||
if($_CGState)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "CG_Running" /t REG_DWORD /d 1 /f'
|
||||
@ -1077,28 +1079,28 @@ if($Ready)
|
||||
}
|
||||
elseif($DG)
|
||||
{
|
||||
Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
Log "_HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
PrintHVCIDetails $_HVCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
|
||||
if($_ConfigCIState -and $_HVCIState)
|
||||
{
|
||||
LogAndConsoleSuccess "HVCI, and Config-CI are enabled and running."
|
||||
|
||||
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 1 /f'
|
||||
}
|
||||
else
|
||||
{
|
||||
LogAndConsoleWarning "Not all services are running."
|
||||
|
||||
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Capabilities\" /v "DG_Running" /t REG_DWORD /d 0 /f'
|
||||
}
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
Log "_CGState: $_CGState, _HVCIState: $_HVCIState, _ConfigCIState: $_ConfigCIState"
|
||||
|
||||
PrintCGDetails $_CGState
|
||||
PrintHVCIDetails $_HVCIState
|
||||
PrintConfigCIDetails $_ConfigCIState
|
||||
@ -1147,7 +1149,7 @@ if($Enable)
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard" /v "HypervisorEnforcedCodeIntegrity" /t REG_DWORD /d 1 /f'
|
||||
}
|
||||
else
|
||||
else
|
||||
{
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Enabled" /t REG_DWORD /d 1 /f'
|
||||
ExecuteCommandAndLog 'REG ADD "HKLM\SYSTEM\CurrentControlSet\Control\DeviceGuard\Scenarios\HypervisorEnforcedCodeIntegrity" /v "Locked" /t REG_DWORD /d 0 /f'
|
||||
@ -1158,8 +1160,8 @@ if($Enable)
|
||||
{
|
||||
if(!$HVCI -and !$CG)
|
||||
{
|
||||
if(!$SIPolicyPath)
|
||||
{
|
||||
if(!$SIPolicyPath)
|
||||
{
|
||||
Log "Writing Decoded SIPolicy.p7b"
|
||||
$SIPolicy_Decoded = [System.Convert]::FromBase64String($SIPolicy_Encoded)
|
||||
[System.IO.File]::WriteAllBytes("$env:windir\System32\CodeIntegrity\SIPolicy.p7b",$SIPolicy_Decoded)
|
||||
@ -1182,7 +1184,7 @@ if($Enable)
|
||||
if(!$_isRedstone)
|
||||
{
|
||||
LogAndConsole "OS Not Redstone, enabling IsolatedUserMode separately"
|
||||
#Enable/Disable IOMMU seperately
|
||||
#Enable/Disable IOMMU separately
|
||||
ExecuteCommandAndLog 'DISM.EXE /Online /Enable-Feature:IsolatedUserMode /NoRestart'
|
||||
}
|
||||
$CmdOutput = DISM.EXE /Online /Enable-Feature:Microsoft-Hyper-V-Hypervisor /All /NoRestart | Out-String
|
||||
@ -1251,7 +1253,7 @@ if($Disable)
|
||||
if(!$_isRedstone)
|
||||
{
|
||||
LogAndConsole "OS Not Redstone, disabling IsolatedUserMode separately"
|
||||
#Enable/Disable IOMMU seperately
|
||||
#Enable/Disable IOMMU separately
|
||||
ExecuteCommandAndLog 'DISM.EXE /Online /disable-Feature /FeatureName:IsolatedUserMode /NoRestart'
|
||||
}
|
||||
$CmdOutput = DISM.EXE /Online /disable-Feature /FeatureName:Microsoft-Hyper-V-Hypervisor /NoRestart | Out-String
|
||||
@ -1270,7 +1272,7 @@ if($Disable)
|
||||
}
|
||||
|
||||
#set of commands to run SecConfig.efi to delete UEFI variables if were set in pre OS
|
||||
#these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always
|
||||
#these steps can be performed even if the UEFI variables were not set - if not set it will lead to No-Op but this can be run in general always
|
||||
#this requires a reboot and accepting the prompt in the Pre-OS which is self explanatory in the message that is displayed in pre-OS
|
||||
$FreeDrive = ls function:[s-z]: -n | ?{ !(test-path $_) } | random
|
||||
Log "FreeDrive=$FreeDrive"
|
||||
@ -1314,7 +1316,7 @@ if($Capable)
|
||||
}
|
||||
$_StepCount = 1
|
||||
if(!$CG)
|
||||
{
|
||||
{
|
||||
LogAndConsole " ====================== Step $_StepCount Driver Compat ====================== "
|
||||
$_StepCount++
|
||||
CheckDriverCompat
|
||||
@ -1323,15 +1325,15 @@ if($Capable)
|
||||
LogAndConsole " ====================== Step $_StepCount Secure boot present ====================== "
|
||||
$_StepCount++
|
||||
CheckSecureBootState
|
||||
|
||||
|
||||
if(!$HVCI -and !$DG -and !$CG)
|
||||
{
|
||||
{
|
||||
#check only if sub-options are absent
|
||||
LogAndConsole " ====================== Step $_StepCount MS UEFI HSTI tests ====================== "
|
||||
$_StepCount++
|
||||
CheckHSTI
|
||||
}
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount OS Architecture ====================== "
|
||||
$_StepCount++
|
||||
CheckOSArchitecture
|
||||
@ -1345,11 +1347,11 @@ if($Capable)
|
||||
CheckVirtualization
|
||||
|
||||
if(!$HVCI -and !$DG)
|
||||
{
|
||||
{
|
||||
LogAndConsole " ====================== Step $_StepCount TPM version ====================== "
|
||||
$_StepCount++
|
||||
CheckTPM
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount Secure MOR ====================== "
|
||||
$_StepCount++
|
||||
CheckSecureMOR
|
||||
@ -1358,11 +1360,11 @@ if($Capable)
|
||||
LogAndConsole " ====================== Step $_StepCount NX Protector ====================== "
|
||||
$_StepCount++
|
||||
CheckNXProtection
|
||||
|
||||
|
||||
LogAndConsole " ====================== Step $_StepCount SMM Mitigation ====================== "
|
||||
$_StepCount++
|
||||
CheckSMMProtection
|
||||
|
||||
|
||||
LogAndConsole " ====================== End Check ====================== "
|
||||
|
||||
LogAndConsole " ====================== Summary ====================== "
|
||||
@ -1371,7 +1373,6 @@ if($Capable)
|
||||
}
|
||||
|
||||
|
||||
|
||||
# SIG # Begin signature block
|
||||
## REPLACE
|
||||
# SIG # End signature block
|
||||
|
||||
@ -63,7 +63,7 @@ The Windows Hello for Business deployment depends on an enterprise public key in
|
||||
|
||||
Key trust deployments do not need client issued certificates for on-premises authentication. Active Directory user accounts are automatically configured for public key mapping by Azure AD Connect synchronizing the public key of the registered Windows Hello for Business credential to an attribute on the user's Active Directory object.
|
||||
|
||||
The minimum required enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party enterprise certification authority. The detailed requirements for the Domain Controller certificate are shown below.
|
||||
The minimum required Enterprise certificate authority that can be used with Windows Hello for Business is Windows Server 2012, but you can also use a third-party Enterprise certification authority. The requirements for the domain controller certificate are shown below. For more details, see [Requirements for domain controller certificates from a third-party CA](https://support.microsoft.com/help/291010/requirements-for-domain-controller-certificates-from-a-third-party-ca).
|
||||
|
||||
* The certificate must have a Certificate Revocation List (CRL) distribution point extension that points to a valid CRL.
|
||||
* The certificate Subject section should contain the directory path of the server object (the distinguished name).
|
||||
@ -71,7 +71,7 @@ The minimum required enterprise certificate authority that can be used with Wind
|
||||
* Optionally, the certificate Basic Constraints section should contain: [Subject Type=End Entity, Path Length Constraint=None].
|
||||
* The certificate Enhanced Key Usage section must contain Client Authentication (1.3.6.1.5.5.7.3.2), Server Authentication (1.3.6.1.5.5.7.3.1), and KDC Authentication (1.3.6.1.5.2.3.5).
|
||||
* The certificate Subject Alternative Name section must contain the Domain Name System (DNS) name.
|
||||
* The certificate template must have an extension that has the BMP data value "DomainController".
|
||||
* The certificate template must have an extension that has the value "DomainController", encoded as a [BMPstring](https://docs.microsoft.com/windows/win32/seccertenroll/about-bmpstring). If you are using Windows Server Enterprise Certificate Authority, this extension is already included in the domain controller certificate template.
|
||||
* The domain controller certificate must be installed in the local computer's certificate store.
|
||||
|
||||
|
||||
|
||||
@ -29,7 +29,9 @@ ms.topic: article
|
||||
|
||||
Microsoft Defender ATP provides a centralized security operations experience for Windows as well as non-Windows platforms. You'll be able to see alerts from various supported operating systems (OS) in Microsoft Defender Security Center and better protect your organization's network.
|
||||
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work.
|
||||
You'll need to know the exact Linux distros and macOS versions that are compatible with Microsoft Defender ATP for the integration to work. For more information, see:
|
||||
- [Microsoft Defender ATP for Linux system requirements](microsoft-defender-atp-linux.md#system-requirements)
|
||||
- [Microsoft Defender ATP for Mac system requirements](microsoft-defender-atp-mac.md#system-requirements).
|
||||
|
||||
## Onboarding non-Windows devices
|
||||
You'll need to take the following steps to onboard non-Windows devices:
|
||||
|
||||
@ -14,7 +14,7 @@ manager: dansimp
|
||||
audience: ITPro
|
||||
ms.collection: M365-security-compliance
|
||||
ms.topic: conceptual
|
||||
ms.date: 06/27/2019
|
||||
ms.date: 05/29/2020
|
||||
---
|
||||
|
||||
# Domain member: Maximum machine account password age
|
||||
@ -42,8 +42,7 @@ For more information, see [Machine Account Password Process](https://techcommuni
|
||||
|
||||
### Best practices
|
||||
|
||||
1. We recommend that you set **Domain member: Maximum machine account password age** to about 30 days. Setting the value to fewer days can increase replication and affect domain controllers. For example, in Windows NT domains, machine passwords were changed every 7 days. The additional replication churn would affect domain controllers in large organizations that have many computers or slow links between sites.
|
||||
2. Some organizations pre-build computers and then store them for later use or ship them to remote locations. When a computer is turned on after being offline more than 30 days, the Netlogon service notices the password age and initiates a secure channel to a domain controller to change it. If the secure channel cannot be established, the computer does not authenticate with the domain. For this reason, some organizations might want to create a special organizational unit (OU) for computers that are prebuilt, and then configure the value for this policy setting to a greater number of days.
|
||||
We recommend that you set **Domain member: Maximum machine account password age** to about 30 days. Setting the value to fewer days can increase replication and affect domain controllers. For example, in Windows NT domains, machine passwords were changed every 7 days. The additional replication churn would affect domain controllers in large organizations that have many computers or slow links between sites.
|
||||
|
||||
### Location
|
||||
|
||||
|
||||
@ -14,7 +14,7 @@ author: jsuther1974
|
||||
ms.reviewer: isbrahm
|
||||
ms.author: dansimp
|
||||
manager: dansimp
|
||||
ms.date: 05/14/2019
|
||||
ms.date: 05/29/2020
|
||||
---
|
||||
|
||||
# Manage Packaged Apps with Windows Defender Application Control
|
||||
@ -65,8 +65,10 @@ Below are the list of steps you can follow to block one or more packaged apps in
|
||||
1. Get the app identifier for an installed package
|
||||
|
||||
```powershell
|
||||
$package = Get-AppxPackage -name <example_app>
|
||||
$package = Get-AppxPackage -name *<example_app>*
|
||||
```
|
||||
Where the name of the app is surrounded by asterisks, for example *windowsstore*
|
||||
|
||||
2. Make a rule by using the New-CIPolicyRule cmdlet
|
||||
|
||||
```powershell
|
||||
@ -119,9 +121,9 @@ If the app you intend to block is not installed on the system you are using the
|
||||
|
||||
3. Copy the GUID in the URL for the app
|
||||
- Example: the GUID for the Microsoft To-Do app is 9nblggh5r558
|
||||
- https://www.microsoft.com/p/microsoft-to-do-list-task-reminder/9nblggh5r558?activetab=pivot:overviewtab
|
||||
- `https://www.microsoft.com/p/microsoft-to-do-list-task-reminder/9nblggh5r558?activetab=pivot:overviewtab`
|
||||
4. Use the GUID in the following REST query URL to retrieve the identifiers for the app
|
||||
- Example: for the Microsoft To-Do app, the URL would be https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblggh5r558/applockerdata
|
||||
- Example: for the Microsoft To-Do app, the URL would be `https://bspmts.mp.microsoft.com/v1/public/catalog/Retail/Products/9nblggh5r558/applockerdata`
|
||||
- The URL will return:
|
||||
|
||||
```
|
||||
@ -141,4 +143,4 @@ The method for allowing specific packaged apps is similar to the method outlined
|
||||
$Rule = New-CIPolicyRule -Package $package -allow
|
||||
```
|
||||
|
||||
Since a lot of system apps are packaged apps, it is generally advised that customers rely on the sample policies in C:\Windows\schemas\CodeIntegrity\ExamplePolicies to help allow all inbox apps by the Store signature already included in the policies and control apps with deny rules.
|
||||
Since a lot of system apps are packaged apps, it is generally advised that customers rely on the sample policies in `C:\Windows\schemas\CodeIntegrity\ExamplePolicies` to help allow all inbox apps by the Store signature already included in the policies and control apps with deny rules.
|
||||
|
||||
@ -60,10 +60,6 @@ An experimental implementation of TLS 1.3 is included in Windows 10, version 190
|
||||
|
||||
## Virtualization
|
||||
|
||||
### Containers on Windows
|
||||
|
||||
This update includes 5 fixes to allow the host to run down-level containers on up-level for process (Argon) isolation. Previously [Containers on Windows](https://docs.microsoft.com/virtualization/windowscontainers/) required matched host and container version. This limited Windows containers from supporting mixed-version container pod scenarios.
|
||||
|
||||
### Windows Sandbox
|
||||
|
||||
[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature is available in Windows 10, version 1903. In Windows 10, version 1909 you have even more control over the level of isolation.
|
||||
|
||||
@ -74,7 +74,7 @@ If you configure the language settings in the Autopilot profile and the device i
|
||||
|
||||
### Microsoft Endpoint Manager
|
||||
|
||||
An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuraton Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364).
|
||||
An in-place upgrade wizard is available in Configuration Manager. For more information, see [Simplifying Windows 10 deployment with Configuration Manager](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/simplifying-windows-10-deployment-with-configuration-manager/ba-p/1214364).
|
||||
|
||||
Also see [What's new in Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/whats-new).
|
||||
|
||||
@ -121,13 +121,9 @@ The following [Delivery Optimization](https://docs.microsoft.com/windows/deploym
|
||||
|
||||
## Virtualization
|
||||
|
||||
### Containers on Windows
|
||||
|
||||
This update includes 5 fixes to allow the host to run down-level containers on up-level for process (Argon) isolation. Previously [Containers on Windows](https://docs.microsoft.com/virtualization/windowscontainers/) required matched host and container version. This limited Windows containers from supporting mixed-version container pod scenarios.
|
||||
|
||||
### Windows Sandbox
|
||||
|
||||
[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature was released with Windows 10, version 1903. Windows 10, version 2004 includes bugfixes and enables even more control over configuration.
|
||||
[Windows Sandbox](https://techcommunity.microsoft.com/t5/Windows-Kernel-Internals/Windows-Sandbox/ba-p/301849) is an isolated desktop environment where you can install software without the fear of lasting impact to your device. This feature was released with Windows 10, version 1903. Windows 10, version 2004 includes bug fixes and enables even more control over configuration.
|
||||
|
||||
[Windows Sandbox configuration](https://docs.microsoft.com/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file) includes:
|
||||
- MappedFolders now supports a destination folder. Previously no destination could be specified, it was always mapped to the Sandbox desktop.
|
||||
@ -235,6 +231,7 @@ For information about Desktop Analytics and this release of Windows 10, see [Wha
|
||||
|
||||
## See Also
|
||||
|
||||
[What’s new in the Windows 10 May 2020 Update](https://blogs.windows.com/windowsexperience/2020/05/27/whats-new-in-the-windows-10-may-2020-update/)<br>
|
||||
[What's New in Windows Server](https://docs.microsoft.com/windows-server/get-started/whats-new-in-windows-server): New and updated features in Windows Server.<br>
|
||||
[Windows 10 Features](https://www.microsoft.com/windows/features): General information about Windows 10 features.<br>
|
||||
[What's New in Windows 10](https://docs.microsoft.com/windows/whats-new/): See what’s new in other versions of Windows 10.<br>
|
||||
|
||||
Reference in New Issue
Block a user