From 3f7664ddd6d2c863550537f89fdd9032aab57b4c Mon Sep 17 00:00:00 2001 From: ManikaDhiman Date: Tue, 14 Apr 2020 12:51:22 -0700 Subject: [PATCH 0001/1214] Updated scope for three settings --- windows/client-management/mdm/policy-csp-start.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index c5e74893fc..5c5334b194 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -820,6 +820,7 @@ The following list shows the supported values: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] +> * User > * Device
@@ -886,6 +887,7 @@ The following list shows the supported values: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] +> * User > * Device
@@ -1443,6 +1445,7 @@ To validate on Desktop, do the following: [Scope](./policy-configuration-service-provider.md#policy-scope): > [!div class = "checklist"] +> * User > * Device
From 5d33f08c16c22d608c6f3286c06e58466ca2c9cf Mon Sep 17 00:00:00 2001 From: Jon Callahan Date: Wed, 10 Jun 2020 15:31:44 -0400 Subject: [PATCH 0002/1214] Updated link for Endpoint Protection link Link for AV reports was linked to Intune classic portal and not the Microsoft Intune Endpoint security portal in MEM --- windows/deployment/update/update-compliance-monitor.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index 311272e93b..f68859fd16 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -19,7 +19,7 @@ ms.topic: article > [!IMPORTANT] > While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. Two planned feature removals for Update Compliance – Microsoft Defender Antivirus reporting and Perspectives – are now scheduled to be removed beginning Monday, May 11, 2020. -> * The retirement of Microsoft Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint Protection for Microsoft Intune](https://docs.microsoft.com/mem/intune/fundamentals/help-secure-windows-pcs-with-endpoint-protection-for-microsoft-intune). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). +> * The retirement of Microsoft Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint security node in Microsoft Intune](https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-antivirus-policy#antivirus-policy-reports). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). > * The Perspectives feature of Update Compliance will be retired Monday, May 11, 2020. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. ## Introduction From cec2eb1a56b0714ffeb49808fe064856cc4f157a Mon Sep 17 00:00:00 2001 From: Jon Callahan Date: Wed, 10 Jun 2020 18:03:45 -0400 Subject: [PATCH 0003/1214] Changed link for Intune AV reports to MEM portal Updated link for Intune AV reporting to non-localized version of Endpoint security docs --- windows/deployment/update/update-compliance-monitor.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index f68859fd16..d5cef48c2d 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -19,7 +19,7 @@ ms.topic: article > [!IMPORTANT] > While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. Two planned feature removals for Update Compliance – Microsoft Defender Antivirus reporting and Perspectives – are now scheduled to be removed beginning Monday, May 11, 2020. -> * The retirement of Microsoft Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint security node in Microsoft Intune](https://docs.microsoft.com/en-us/mem/intune/protect/endpoint-security-antivirus-policy#antivirus-policy-reports). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). +> * The retirement of Microsoft Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint security node in Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-antivirus-policy#antivirus-policy-reports). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). > * The Perspectives feature of Update Compliance will be retired Monday, May 11, 2020. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. ## Introduction From e3163a4dc50cee8a7433a1fd74e0de943bf668ec Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Tue, 1 Sep 2020 13:25:30 +0530 Subject: [PATCH 0004/1214] Update bitlocker-and-adds-faq.md --- .../bitlocker/bitlocker-and-adds-faq.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index d6bad09f03..4d35b5306e 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -49,7 +49,7 @@ BackupToAAD-BitLockerKeyProtector -MountPoint $env:SystemDrive -KeyProtectorId $ ``` > [!IMPORTANT] -> Joining a computer to the domain should be the first step for new computers within an organization. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). +> The first step for new computers within an organization should be to get associated with a domain. After computers are joined to a domain, storing the BitLocker recovery key to AD DS is automatic (when enabled in Group Policy). ## Is there an event log entry recorded on the client computer to indicate the success or failure of the Active Directory backup? @@ -65,7 +65,7 @@ No. By design, BitLocker recovery password entries do not get deleted from AD D If the backup initially fails, such as when a domain controller is unreachable at the time when the BitLocker setup wizard is run, BitLocker does not try again to back up the recovery information to AD DS. -When an administrator selects the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. +When an administrator checks the **Require BitLocker backup to AD DS** check box of the **Store BitLocker recovery information in Active Directory Domain Service (Windows 2008 and Windows Vista)** policy setting, or the equivalent **Do not enable BitLocker until recovery information is stored in AD DS for (operating system | fixed data | removable data) drives** check box in any of the **Choose how BitLocker-protected operating system drives can be recovered**, **Choose how BitLocker-protected fixed data drives can be recovered**, **Choose how BitLocker-protected removable data drives can be recovered** policy settings, this prevents users from enabling BitLocker unless the computer is connected to the domain and the backup of BitLocker recovery information to AD DS succeeds. With these settings configured, if the backup fails, BitLocker cannot be enabled, ensuring that administrators will be able to recover BitLocker-protected drives in the organization. For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). From b4ab67e5f6e8137aaae01041e324728c56215a4d Mon Sep 17 00:00:00 2001 From: Asha Iyengar Date: Wed, 2 Sep 2020 15:46:31 +0530 Subject: [PATCH 0005/1214] Update bitlocker-and-adds-faq.md --- .../bitlocker/bitlocker-and-adds-faq.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md index 4d35b5306e..cd8018ad4a 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md +++ b/windows/security/information-protection/bitlocker/bitlocker-and-adds-faq.md @@ -38,7 +38,7 @@ If BitLocker is enabled on a drive before Group Policy has been applied to enfor For more info, see [BitLocker Group Policy settings](bitlocker-group-policy-settings.md). -The BitLocker Windows Management Instrumentation (WMI) interface does allow administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: +The BitLocker Windows Management Instrumentation (WMI) interface allows administrators to write a script to back up or synchronize an online client's existing recovery information; however, BitLocker does not automatically manage this process. The manage-bde command-line tool can also be used to manually back up recovery information to AD DS. For example, to back up all of the recovery information for the `$env:SystemDrive` to AD DS, you would use the following command script from an elevated command prompt: ```PowerShell $BitLocker = Get-BitLockerVolume -MountPoint $env:SystemDrive @@ -59,7 +59,7 @@ Ultimately, determining whether a legitimate backup exists in AD DS requires qu ## If I change the BitLocker recovery password on my computer and store the new password in AD DS, will AD DS overwrite the old password? -No. By design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. +No, by design, BitLocker recovery password entries do not get deleted from AD DS; therefore, you might see multiple passwords for each drive. To identify the latest password, check the date on the object. ## What happens if the backup initially fails? Will BitLocker retry the backup? From f8a1ac00c59679cffefa274c482e30bdaf5062b4 Mon Sep 17 00:00:00 2001 From: Daniel Keer <4249262+thedxt@users.noreply.github.com> Date: Wed, 28 Jul 2021 13:09:12 -0600 Subject: [PATCH 0006/1214] Update user-account-control-group-policy-and-registry-key-settings.md crorecting ConsentPromptBehaviorUser default state is Prompt for credentials not Prompt for credentials on the secure desktop --- ...er-account-control-group-policy-and-registry-key-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 130688534d..5bb9b7b708 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -32,7 +32,7 @@ There are 10 Group Policy settings that can be configured for User Account Contr | [User Account Control: Admin Approval Mode for the built-in Administrator account](#user-account-control-admin-approval-mode-for-the-built-in-administrator-account) | FilterAdministratorToken | Disabled | | [User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop](#user-account-control-allow-uiaccess-applications-to-prompt-for-elevation-without-using-the-secure-desktop) | EnableUIADesktopToggle | Disabled | | [User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode](#user-account-control-behavior-of-the-elevation-prompt-for-administrators-in-admin-approval-mode) | ConsentPromptBehaviorAdmin | Prompt for consent for non-Windows binaries | -| [User Account Control: Behavior of the elevation prompt for standard users](#user-account-control-behavior-of-the-elevation-prompt-for-standard-users) | ConsentPromptBehaviorUser | Prompt for credentials on the secure desktop | +| [User Account Control: Behavior of the elevation prompt for standard users](#user-account-control-behavior-of-the-elevation-prompt-for-standard-users) | ConsentPromptBehaviorUser | Prompt for credentials | | [User Account Control: Detect application installations and prompt for elevation](#user-account-control-detect-application-installations-and-prompt-for-elevation) | EnableInstallerDetection | Enabled (default for home)
Disabled (default for enterprise) | | [User Account Control: Only elevate executables that are signed and validated](#user-account-control-only-elevate-executables-that-are-signed-and-validated) | ValidateAdminCodeSignatures | Disabled | | [User Account Control: Only elevate UIAccess applications that are installed in secure locations](#user-account-control-only-elevate-uiaccess-applications-that-are-installed-in-secure-locations) | EnableSecureUIAPaths | Enabled | From b3109a3105b4bd1676648d1c4fa8fa6e688faa62 Mon Sep 17 00:00:00 2001 From: Daniel Keer <4249262+thedxt@users.noreply.github.com> Date: Wed, 28 Jul 2021 13:24:52 -0600 Subject: [PATCH 0007/1214] Update user-account-control-group-policy-and-registry-key-settings.md Correcting User Account Control: Behavior of the elevation prompt for standard users default. The default is Prompt for credentials --- ...-account-control-group-policy-and-registry-key-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md index 5bb9b7b708..6f65b3199e 100644 --- a/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md +++ b/windows/security/identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md @@ -104,8 +104,8 @@ The **User Account Control: Behavior of the elevation prompt for standard users* The options are: - **Automatically deny elevation requests.** When an operation requires elevation of privilege, a configurable access denied error message is displayed. An enterprise that is running desktops as standard user may choose this setting to reduce help desk calls. -- **Prompt for credentials on the secure desktop.** (Default) When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. -- **Prompt for credentials.** When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +- **Prompt for credentials on the secure desktop.** When an operation requires elevation of privilege, the user is prompted on the secure desktop to enter a different user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. +- **Prompt for credentials.** (Default) When an operation requires elevation of privilege, the user is prompted to enter an administrative user name and password. If the user enters valid credentials, the operation continues with the applicable privilege. ### User Account Control: Detect application installations and prompt for elevation From 89325afd33efba5591e35d74f4976999acfddc36 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Wed, 4 Aug 2021 12:58:38 -0600 Subject: [PATCH 0008/1214] fix Columns1 --- education/trial-in-a-box/educator-tib-get-started.md | 4 ++-- education/trial-in-a-box/itadmin-tib-get-started.md | 4 ++-- education/windows/test-windows10s-for-edu.md | 2 +- windows/client-management/troubleshoot-windows-freeze.md | 2 +- windows/configuration/ue-v/uev-prepare-for-deployment.md | 2 +- .../update/waas-deployment-rings-windows-10-updates.md | 2 +- windows/deployment/update/waas-manage-updates-wsus.md | 2 +- windows/deployment/update/waas-optimize-windows-10-updates.md | 2 +- windows/deployment/update/waas-overview.md | 2 +- .../update/waas-servicing-channels-windows-10-updates.md | 2 +- .../update/waas-servicing-strategy-windows-10-updates.md | 2 +- windows/deployment/windows-10-poc-sc-config-mgr.md | 4 ++-- windows/deployment/windows-10-pro-in-s-mode.md | 2 +- 13 files changed, 16 insertions(+), 16 deletions(-) diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index 9dab12f4c1..d0251e80ba 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -320,11 +320,11 @@ To graph the equation 3x+4=7, follow these instructions: **Watch what Educators say about Microsoft Education delivering better learning outcomes** Bring out the best in students by providing a platform for collaborating, exploring, personalized learning, and getting things done across all devices. -| | | +|  |  | |:--- |:--- | |
See how one school improves reading skills using Learning Tools Immersive Reader |
Here's how Microsoft Teams creates more robust classroom experiences at all ages. | |
Watch teachers elevate the education of students using OneNote. |
Here what other teachers say about using Minecraft: Education Edition in their classrooms. | -| | | + ## Update your apps diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index 51e0cf23d8..be9a131941 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -22,14 +22,14 @@ manager: dansimp Learn how to quickly deploy and manage devices for your school in 5 quick steps. -| | | +|  |  | | :---: |:--- | | [![Log in to Device A](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | | [![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | | [![Configure Intune for Education](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | | [![Find and deploy apps](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | | [![Create custom folders](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. | -| | | +
To get the most out of Microsoft Education, we've pre-configured your tenant for you so you don't need to set it up. A tenant is representative of an organization. It is a dedicated instance of the Azure AD service that an organization receives and owns when it signs up for a Microsoft cloud service such as Azure, Microsoft Intune, or Office 365. We've also pre-populated the tenant with fictitious Student Information System (SIS) data so you can work with this as you follow the guide. diff --git a/education/windows/test-windows10s-for-edu.md b/education/windows/test-windows10s-for-edu.md index d313477bd1..e81f1a2194 100644 --- a/education/windows/test-windows10s-for-edu.md +++ b/education/windows/test-windows10s-for-edu.md @@ -79,7 +79,7 @@ Make sure all drivers are installed and working properly on your device running Check with your device manufacturer before trying Windows 10 in S mode on your device to see if the drivers are available and supported by the device manufacturer. -| | | | +|   |   |   | | - | - | - | | Acer | Alldocube | American Future Tech | | ASBISC | Asus | Atec | diff --git a/windows/client-management/troubleshoot-windows-freeze.md b/windows/client-management/troubleshoot-windows-freeze.md index 3b6738986f..3ed83421c9 100644 --- a/windows/client-management/troubleshoot-windows-freeze.md +++ b/windows/client-management/troubleshoot-windows-freeze.md @@ -145,7 +145,7 @@ If the computer is no longer frozen and now is running in a good state, use the Use the Dump Check Utility (Dumpchk.exe) to read a memory dump file or verify that the file was created correctly. You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that the memory dump files are not corrupted or invalid. -- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk) +- [Using DumpChk](/windows-hardware/drivers/debugger/dumpchk) - [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk) Learn how to use Dumpchk.exe to check your dump files: diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index 1931dbec5e..bfc7cfa6f3 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -169,7 +169,7 @@ In general, you can synchronize settings that meet the following criteria: If you’ve decided that you need to synchronize settings for custom applications, use this checklist to determine which applications you’ll include. -| | **Description** | +|   | **Description** | |-------|--------------------------| | ![Checklist box](images/uev-checklist-box.gif) | Does this application contain settings that the user can customize? | | ![Checklist box](images/uev-checklist-box.gif) | Is it important for the user that these settings are synchronized? | diff --git a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md index 10b4e2c70d..1e06d44fd8 100644 --- a/windows/deployment/update/waas-deployment-rings-windows-10-updates.md +++ b/windows/deployment/update/waas-deployment-rings-windows-10-updates.md @@ -49,7 +49,7 @@ As Table 1 shows, each combination of servicing channel and deployment group is ## Steps to manage updates for Windows 10 -| | | +|  |  | | --- | --- | | ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | | ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | diff --git a/windows/deployment/update/waas-manage-updates-wsus.md b/windows/deployment/update/waas-manage-updates-wsus.md index c41a64b71e..1533a56a9b 100644 --- a/windows/deployment/update/waas-manage-updates-wsus.md +++ b/windows/deployment/update/waas-manage-updates-wsus.md @@ -331,7 +331,7 @@ Now that you have the **All Windows 10 Upgrades** view, complete the following s ## Steps to manage updates for Windows 10 -| | | +|  |  | | --- | --- | | ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | | ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | diff --git a/windows/deployment/update/waas-optimize-windows-10-updates.md b/windows/deployment/update/waas-optimize-windows-10-updates.md index 2629d7b79a..4a9c314c35 100644 --- a/windows/deployment/update/waas-optimize-windows-10-updates.md +++ b/windows/deployment/update/waas-optimize-windows-10-updates.md @@ -86,7 +86,7 @@ At this point, the download is complete and the update is ready to be installed. ## Steps to manage updates for Windows 10 -| | | +|  |  | | --- | --- | | ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | | ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | diff --git a/windows/deployment/update/waas-overview.md b/windows/deployment/update/waas-overview.md index 6a2e87ff0e..d34bb385f6 100644 --- a/windows/deployment/update/waas-overview.md +++ b/windows/deployment/update/waas-overview.md @@ -182,7 +182,7 @@ With all these options, which an organization chooses depends on the resources, ## Steps to manage updates for Windows 10 -| | | +|  |  | | --- | --- | | ![done](images/checklistdone.png) | Learn about updates and servicing channels (this topic) | | ![to do](images/checklistbox.gif) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | diff --git a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md index 182ef97bfa..51430aba0c 100644 --- a/windows/deployment/update/waas-servicing-channels-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-channels-windows-10-updates.md @@ -162,7 +162,7 @@ Administrators can disable the "Check for updates" option for users by enabling ## Steps to manage updates for Windows 10 -| | | +|  |  | | --- | --- | | ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | | ![done](images/checklistdone.png) | [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | diff --git a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md index c53b3b38d5..a9e7039ffb 100644 --- a/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md +++ b/windows/deployment/update/waas-servicing-strategy-windows-10-updates.md @@ -50,7 +50,7 @@ Each time Microsoft releases a Windows 10 feature update, the IT department shou ## Steps to manage updates for Windows 10 -| | | +|  |  | | --- | --- | | ![done](images/checklistdone.png) | [Learn about updates and servicing channels](waas-overview.md) | | ![done](images/checklistdone.png) | Prepare servicing strategy for Windows 10 updates (this topic) | diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 1179220486..603113f920 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -46,9 +46,9 @@ This guide provides end-to-end instructions to install and configure Microsoft E Topics and procedures in this guide are summarized in the following table. An estimate of the time required to complete each procedure is also provided. Time required to complete procedures will vary depending on the resources available to the Hyper-V host and assigned to VMs, such as processor speed, memory allocation, disk speed, and network speed. -|||| -|--- |--- |--- | + |Topic|Description|Time| +|--- |--- |--- | |[Install prerequisites](#install-prerequisites)|Install prerequisite Windows Server roles and features, download, install and configure SQL Server, configure firewall rules, and install the Windows ADK.|60 minutes| |[Install Microsoft Endpoint Configuration Manager](#install-microsoft-endpoint-configuration-manager)|Download Microsoft Endpoint Configuration Manager, configure prerequisites, and install the package.|45 minutes| |[Download MDOP and install DaRT](#download-mdop-and-install-dart)|Download the Microsoft Desktop Optimization Pack 2015 and install DaRT 10.|15 minutes| diff --git a/windows/deployment/windows-10-pro-in-s-mode.md b/windows/deployment/windows-10-pro-in-s-mode.md index b9533e33af..dfe970649c 100644 --- a/windows/deployment/windows-10-pro-in-s-mode.md +++ b/windows/deployment/windows-10-pro-in-s-mode.md @@ -26,7 +26,7 @@ A number of other transformations are possible depending on which version and ed -| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: | | | +| If a device is running this version of Windows 10 | and this edition of Windows 10 | then you can switch or convert it to this edition of Windows 10 by these methods: |   |  | |-------------|---------------------|-----------------------------------|-------------------------------|--------------------------------------------| | | | **Store for Education** (switch/convert all devices in your tenant) | **Microsoft Store** (switch/convert one device at a time) | **Intune** (switch/convert any number of devices selected by admin) | | **Windows 10, version 1709** | Pro in S mode | Pro EDU | Pro | Not by this method | From c19a697db542edd72138a1d8962715636198dd99 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Thu, 5 Aug 2021 14:42:03 -0700 Subject: [PATCH 0009/1214] Added cscript and wscript to the Microsoft recommended blocklist --- .../microsoft-recommended-block-rules.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 620cfbcd0b..663757d649 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -147,6 +147,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor + @@ -176,6 +177,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor + @@ -887,6 +889,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor + @@ -915,6 +918,7 @@ Pick the correct version of each .dll for the Windows release you plan to suppor + From e57f9663a8892833fae34013f44ce96e83acdf68 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Fri, 6 Aug 2021 09:47:08 -0600 Subject: [PATCH 0010/1214] columnandabsfixes --- .../bitlocker-group-policy-settings.md | 795 +++++++++--------- ...lients-allowed-to-make-remote-sam-calls.md | 10 +- .../event-id-explanations.md | 2 +- ...icrosoft-recommended-driver-block-rules.md | 2 +- 4 files changed, 404 insertions(+), 405 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index b07187e9c4..c1b9853eb5 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -105,15 +105,15 @@ The following policies are used to support customized deployment scenarios in yo This policy setting allows users on devices that are compliant with Modern Standby or the Microsoft Hardware Security Test Interface (HSTI) to not have a PIN for preboot authentication. -||| -|--- |--- | -|Policy description|With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.| -|Introduced|Windows 10, version 1703| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|This setting overrides the **Require startup PIN with TPM** option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.| -|When enabled|Users on Modern Standby and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication.| -|When disabled or not configured|The options of the [Require additional authentication at startup](#bkmk-unlockpol1) policy apply.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.| +|**Introduced**|Windows 10, version 1703| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|This setting overrides the **Require startup PIN with TPM** option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.| +|**When enabled**|Users on Modern Standby and HSTI compliant devices will have the choice to turn on BitLocker without preboot authentication.| +|**When disabled or not configured**|The options of the [Require additional authentication at startup](#bkmk-unlockpol1) policy apply.| **Reference** @@ -126,15 +126,15 @@ This policy controls a portion of the behavior of the Network Unlock feature in This policy is used in addition to the BitLocker Drive Encryption Network Unlock Certificate security policy (located in the **Public Key Policies** folder of Local Computer Policy) to allow systems that are connected to a trusted network to properly utilize the Network Unlock feature. -||| -|--- |--- | -|Policy description|With this policy setting, you can control whether a BitLocker-protected computer that is connected to a trusted local area network and joined to a domain can create and use network key protectors on TPM-enabled computers to automatically unlock the operating system drive when the computer is started.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.| -|When disabled or not configured|Clients cannot create and use Network Key Protectors| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control whether a BitLocker-protected computer that is connected to a trusted local area network and joined to a domain can create and use network key protectors on TPM-enabled computers to automatically unlock the operating system drive when the computer is started.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|Clients configured with a BitLocker Network Unlock certificate can create and use Network Key Protectors.| +|**When disabled or not configured**|Clients cannot create and use Network Key Protectors| **Reference** @@ -149,15 +149,15 @@ For more information about Network Unlock, see [BitLocker: How to enable Network This policy setting is used to control which unlock options are available for operating system drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|If one authentication method is required, the other methods cannot be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| -|When enabled|Users can configure advanced startup options in the BitLocker Setup Wizard.| -|When disabled or not configured|Users can configure only basic options on computers with a TPM.

Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with a Trusted Platform Module (TPM). This policy setting is applied when you turn on BitLocker.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|If one authentication method is required, the other methods cannot be allowed. Use of BitLocker with a TPM startup key or with a TPM startup key and a PIN must be disallowed if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.| +|**When enabled**|Users can configure advanced startup options in the BitLocker Setup Wizard.| +|**When disabled or not configured**|Users can configure only basic options on computers with a TPM.

Only one of the additional authentication options can be required at startup; otherwise, a policy error occurs.| **Reference** @@ -197,15 +197,15 @@ There are four options for TPM-enabled computers or devices: This policy setting permits the use of enhanced PINs when you use an unlock method that includes a PIN. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| -|When disabled or not configured|Enhanced PINs will not be used.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether enhanced startup PINs are used with BitLocker.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|All new BitLocker startup PINs that are set will be enhanced PINs. Existing drives that were protected by using standard startup PINs are not affected.| +|**When disabled or not configured**|Enhanced PINs will not be used.| **Reference** @@ -218,15 +218,15 @@ Enhanced startup PINs permit the use of characters (including uppercase and lowe This policy setting is used to set a minimum PIN length when you use an unlock method that includes a PIN. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.| -|When disabled or not configured|Users can configure a startup PIN of any length between 6 and 20 digits.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure a minimum length for a TPM startup PIN. This policy setting is applied when you turn on BitLocker. The startup PIN must have a minimum length of 4 digits, and it can have a maximum length of 20 digits. By default, the minimum PIN length is 6.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|You can require that startup PINs set by users must have a minimum length you choose that is between 4 and 20 digits.| +|**When disabled or not configured**|Users can configure a startup PIN of any length between 6 and 20 digits.| **Reference** @@ -255,15 +255,15 @@ If the minimum PIN length is reduced from the default of six characters, then th This policy setting allows you to block direct memory access (DMA) for all hot pluggable PCI ports until a user signs in to Windows. -| | | -|---------|---------| -|Policy description|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| -|Introduced|Windows 10, version 1703| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|Every time the user locks the scree, DMA will be blocked on hot pluggable PCI ports until the user signs in again.| -|When disabled or not configured|DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| +| |   | +|:---|:---| +|**Policy description**|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| +|**Introduced**|Windows 10, version 1703| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|Every time the user locks the scree, DMA will be blocked on hot pluggable PCI ports until the user signs in again.| +|**When disabled or not configured**|DMA is available on hot pluggable PCI devices if the device is turned on, regardless of whether a user is signed in.| **Reference** @@ -273,15 +273,15 @@ This policy setting is only enforced when BitLocker or device encryption is enab This policy setting allows you to configure whether standard users are allowed to change the PIN or password that is used to protect the operating system drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|Standard users are not allowed to change BitLocker PINs or passwords.| -|When disabled or not configured|Standard users are permitted to change BitLocker PINs or passwords.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether standard users are allowed to change the PIN or password used to protect the operating system drive.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|Standard users are not allowed to change BitLocker PINs or passwords.| +|**When disabled or not configured**|Standard users are permitted to change BitLocker PINs or passwords.| **Reference** @@ -291,15 +291,15 @@ To change the PIN or password, the user must be able to provide the current PIN This policy controls how non-TPM based systems utilize the password protector. Used in conjunction with the **Password must meet complexity requirements** policy, this policy allows administrators to require password length and complexity for using the password protector. By default, passwords must be eight characters in length. Complexity configuration options determine how important domain connectivity is for the client. For the strongest password security, administrators should choose **Require password complexity** because it requires domain connectivity, and it requires that the BitLocker password meets the same password complexity requirements as domain sign-in passwords. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|Passwords cannot be used if FIPS-compliance is enabled.


**NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.| -|When enabled|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.| -|When disabled or not configured|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify the constraints for passwords that are used to unlock operating system drives that are protected with BitLocker.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|Passwords cannot be used if FIPS-compliance is enabled.


**NOTE:** The **System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options** specifies whether FIPS-compliance is enabled.| +|**When enabled**|Users can configure a password that meets the requirements you define. To enforce complexity requirements for the password, select **Require complexity**.| +|**When disabled or not configured**|The default length constraint of 8 characters will apply to operating system drive passwords and no complexity checks will occur.| **Reference** @@ -321,15 +321,15 @@ When this policy setting is enabled, you can set the option **Configure password This policy setting is used to control what unlock options are available for computers running Windows Server 2008 or Windows Vista. -||| -|--- |--- | -|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.| -|Introduced|Windows Server 2008 and Windows Vista| -|Drive type|Operating system drives (Windows Server 2008 and Windows Vista)| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|If you choose to require an additional authentication method, other authentication methods cannot be allowed.| -|When enabled|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.| -|When disabled or not configured|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control whether the BitLocker Setup Wizard on computers running Windows Vista or Windows Server 2008 can set up an additional authentication method that is required each time the computer starts.| +|**Introduced**|Windows Server 2008 and Windows Vista| +|**Drive type**|Operating system drives (Windows Server 2008 and Windows Vista)| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|If you choose to require an additional authentication method, other authentication methods cannot be allowed.| +|**When enabled**|The BitLocker Setup Wizard displays the page that allows the user to configure advanced startup options for BitLocker. You can further configure setting options for computers with or without a TPM.| +|**When disabled or not configured**|The BitLocker Setup Wizard displays basic steps that allow users to enable BitLocker on computers with a TPM. In this basic wizard, no additional startup key or startup PIN can be configured.| **Reference** @@ -358,16 +358,16 @@ To hide the advanced page on a TPM-enabled computer or device, set these options This policy setting is used to require, allow, or deny the use of smart cards with fixed data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| -|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.| -|When disabled|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.| -|When not configured|Smart cards can be used to authenticate user access to a BitLocker-protected drive.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify whether smart cards can be used to authenticate user access to the BitLocker-protected fixed data drives on a computer.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| +|**When enabled**|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on fixed data drives** check box.| +|**When disabled**|Users cannot use smart cards to authenticate their access to BitLocker-protected fixed data drives.| +|**When not configured**|Smart cards can be used to authenticate user access to a BitLocker-protected drive.| **Reference** @@ -378,16 +378,16 @@ This policy setting is used to require, allow, or deny the use of smart cards wi This policy setting is used to require, allow, or deny the use of passwords with fixed data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.| -|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.| -|When disabled|The user is not allowed to use a password.| -|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected fixed data drives.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|To use password complexity, the **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy\Password must meet complexity requirements** policy setting must also be enabled.| +|**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for fixed data drive**. To enforce complexity requirements on the password, select **Require complexity**.| +|**When disabled**|The user is not allowed to use a password.| +|**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| **Reference** @@ -414,16 +414,16 @@ Enabling this policy setting requires that connectivity to a domain be establish This policy setting is used to require, allow, or deny the use of smart cards with removable data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| -|When enabled|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.| -|When disabled or not configured|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.| -|When not configured|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify whether smart cards can be used to authenticate user access to BitLocker-protected removable data drives on a computer.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|To use smart cards with BitLocker, you may also need to modify the object identifier setting in the **Computer Configuration\Administrative Templates\BitLocker Drive Encryption\Validate smart card certificate usage rule compliance** policy setting to match the object identifier of your smart card certificates.| +|**When enabled**|Smart cards can be used to authenticate user access to the drive. You can require smart card authentication by selecting the **Require use of smart cards on removable data drives** check box.| +|**When disabled or not configured**|Users are not allowed to use smart cards to authenticate their access to BitLocker-protected removable data drives.| +|**When not configured**|Smart cards are available to authenticate user access to a BitLocker-protected removable data drive.| **Reference** @@ -434,16 +434,16 @@ This policy setting is used to require, allow, or deny the use of smart cards wi This policy setting is used to require, allow, or deny the use of passwords with removable data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.| -|When enabled|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.| -|When disabled|The user is not allowed to use a password.| -|When not configured|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify whether a password is required to unlock BitLocker-protected removable data drives.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|To use password complexity, the **Password must meet complexity requirements** policy setting, which is located at **Computer Configuration\Windows Settings\Security Settings\Account Policies\Password Policy** must also be enabled.| +|**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.| +|**When disabled**|The user is not allowed to use a password.| +|**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| **Reference** If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at @@ -469,15 +469,15 @@ For information about this setting, see [System cryptography: Use FIPS-compliant This policy setting is used to determine what certificate to use with BitLocker. -||| -|--- |--- | -|Policy description|With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed and removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.| -|When disabled or not configured|The default object identifier is used.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can associate an object identifier from a smart card certificate to a BitLocker-protected drive.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed and removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|The object identifier that is specified in the **Object identifier** setting must match the object identifier in the smart card certificate.| +|**When disabled or not configured**|The default object identifier is used.| **Reference** @@ -494,15 +494,15 @@ The default object identifier is 1.3.6.1.4.1.311.67.1.1. This policy setting allows users to enable authentication options that require user input from the preboot environment even if the platform indicates a lack of preboot input capability. -||| -|--- |--- | -|Policy description|With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drive| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive| -|Conflicts|None| -|When enabled|Devices must have an alternative means of preboot input (such as an attached USB keyboard).| -|When disabled or not configured|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can allow users to enable authentication options that require user input from the preboot environment, even if the platform indicates a lack of preboot input capability.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drive| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drive| +|**Conflicts**|None| +|**When enabled**|Devices must have an alternative means of preboot input (such as an attached USB keyboard).| +|**When disabled or not configured**|The Windows Recovery Environment must be enabled on tablets to support entering the BitLocker recovery password.| **Reference** @@ -522,15 +522,15 @@ If you do not enable this policy setting, the following options in the **Require This policy setting is used to require encryption of fixed drives prior to granting Write access. -||| -|--- |--- | -|Policy description|With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|See the Reference section for a description of conflicts.| -|When enabled|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| -|When disabled or not configured|All fixed data drives on the computer are mounted with Read and Write access.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can set whether BitLocker protection is required for fixed data drives to be writable on a computer.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|See the Reference section for a description of conflicts.| +|**When enabled**|All fixed data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|**When disabled or not configured**|All fixed data drives on the computer are mounted with Read and Write access.| **Reference** @@ -550,15 +550,15 @@ Conflict considerations include: This policy setting is used to require that removable drives are encrypted prior to granting Write access, and to control whether BitLocker-protected removable drives that were configured in another organization can be opened with Write access. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|See the Reference section for a description of conflicts.| -|When enabled|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| -|When disabled or not configured|All removable data drives on the computer are mounted with Read and Write access.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether BitLocker protection is required for a computer to be able to write data to a removable data drive.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|See the Reference section for a description of conflicts.| +|**When enabled**|All removable data drives that are not BitLocker-protected are mounted as Read-only. If the drive is protected by BitLocker, it is mounted with Read and Write access.| +|**When disabled or not configured**|All removable data drives on the computer are mounted with Read and Write access.| **Reference** @@ -577,16 +577,16 @@ Conflict considerations include: This policy setting is used to prevent users from turning BitLocker on or off on removable data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can control the use of BitLocker on removable data drives.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|None| -|When enabled|You can select property settings that control how users can configure BitLocker.| -|When disabled|Users cannot use BitLocker on removable data drives.| -|When not configured|Users can use BitLocker on removable data drives.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control the use of BitLocker on removable data drives.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|None| +|**When enabled**|You can select property settings that control how users can configure BitLocker.| +|**When disabled**|Users cannot use BitLocker on removable data drives.| +|**When not configured**|Users can use BitLocker on removable data drives.| **Reference** @@ -603,15 +603,15 @@ The options for choosing property settings that control how users can configure This policy setting is used to control the encryption method and cipher strength. -||| -|--- |--- | -|Policy description|With this policy setting, you can control the encryption method and strength for drives.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.| -|When disabled or not configured|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control the encryption method and strength for drives.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.| +|**When disabled or not configured**|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| **Reference** @@ -633,16 +633,16 @@ When this policy setting is disabled or not configured, BitLocker will use the d This policy controls how BitLocker reacts to systems that are equipped with encrypted drives when they are used as fixed data volumes. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|None| -|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| -|When disabled|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| -|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on fixed data drives and to specify which encryption algorithms BitLocker can use with hardware-based encryption.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|None| +|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|**When disabled**|BitLocker cannot use hardware-based encryption with fixed data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| **Reference** @@ -658,16 +658,16 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls how BitLocker reacts when encrypted drives are used as operating system drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| -|When disabled|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| -|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on operating system drives and specify which encryption algorithms it can use with hardware-based encryption.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|**When disabled**|BitLocker cannot use hardware-based encryption with operating system drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| **Reference** @@ -685,16 +685,16 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls how BitLocker reacts to encrypted drives when they are used as removable data drives. Using hardware-based encryption can improve the performance of drive operations that involve frequent reading or writing of data to the drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Removable data drive| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|None| -|When enabled|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| -|When disabled|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| -|When not configured|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can manage BitLocker’s use of hardware-based encryption on removable data drives and specify which encryption algorithms it can use with hardware-based encryption.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Removable data drive| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|None| +|**When enabled**|You can specify additional options that control whether BitLocker software-based encryption is used instead of hardware-based encryption on computers that do not support hardware-based encryption. You can also specify whether you want to restrict the encryption algorithms and cipher suites that are used with hardware-based encryption.| +|**When disabled**|BitLocker cannot use hardware-based encryption with removable data drives, and BitLocker software-based encryption is used by default when the drive in encrypted.| +|**When not configured**|BitLocker software-based encryption is used irrespective of hardware-based encryption ability.| **Reference** @@ -712,15 +712,15 @@ The encryption algorithm that is used by hardware-based encryption is set when t This policy controls whether fixed data drives utilize Used Space Only encryption or Full encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page so no encryption selection displays to the user. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Fixed data drive| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|None| -|When enabled|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.| -|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Fixed data drive| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|None| +|**When enabled**|This policy defines the encryption type that BitLocker uses to encrypt drives, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| **Reference** @@ -735,15 +735,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo This policy controls whether operating system drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drive| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| -|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drive| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| **Reference** @@ -758,15 +758,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo This policy controls whether fixed data drives utilize Full encryption or Used Space Only encryption. Setting this policy also causes the BitLocker Setup Wizard to skip the encryption options page, so no encryption selection displays to the user. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure the encryption type that is used by BitLocker.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Removable data drive| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|None| -|When enabled|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| -|When disabled or not configured|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure the encryption type that is used by BitLocker.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Removable data drive| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|None| +|**When enabled**|The encryption type that BitLocker uses to encrypt drives is defined by this policy, and the encryption type option is not presented in the BitLocker Setup Wizard.| +|**When disabled or not configured**|The BitLocker Setup Wizard asks the user to select the encryption type before turning on BitLocker.| **Reference** @@ -781,15 +781,15 @@ For more information about the tool to manage BitLocker, see [Manage-bde](/windo This policy setting is used to configure recovery methods for operating system drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| -|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| -|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control how BitLocker-protected operating system drives are recovered in the absence of the required startup key information.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

When using data recovery agents, you must enable the **Provide the unique identifiers for your organization** policy setting.| +|**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected operating system drives.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| **Reference** @@ -815,15 +815,15 @@ Select the **Do not enable BitLocker until recovery information is stored in AD This policy setting is used to configure recovery methods for BitLocker-protected drives on computers running Windows Server 2008 or Windows Vista. -||| -|--- |--- | -|Policy description|With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.| -|Introduced|Windows Server 2008 and Windows Vista| -|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| -|When enabled|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| -|When disabled or not configured|The BitLocker Setup Wizard presents users with ways to store recovery options.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control whether the BitLocker Setup Wizard can display and specify BitLocker recovery options.| +|**Introduced**|Windows Server 2008 and Windows Vista| +|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|This policy setting provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. If you choose the **Do not allow** option for both user recovery options, you must enable the **Store BitLocker recovery information in Active Directory Domain Services (Windows Server 2008 and Windows Vista)** policy setting to prevent a policy error.| +|**When enabled**|You can configure the options that the Bitlocker Setup Wizard displays to users for recovering BitLocker encrypted data.| +|**When disabled or not configured**|The BitLocker Setup Wizard presents users with ways to store recovery options.| **Reference** @@ -844,15 +844,15 @@ Saving the recovery password to a USB drive stores the 48-digit recovery passwor This policy setting is used to configure the storage of BitLocker recovery information in AD DS. This provides an administrative method of recovering data that is encrypted by BitLocker to prevent data loss due to lack of key information. -||| -|--- |--- | -|Policy description|With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.| -|Introduced|Windows Server 2008 and Windows Vista| -|Drive type|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| -|When disabled or not configured|BitLocker recovery information is not backed up to AD DS.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can manage the AD DS backup of BitLocker Drive Encryption recovery information.| +|**Introduced**|Windows Server 2008 and Windows Vista| +|**Drive type**|Operating system drives and fixed data drives on computers running Windows Server 2008 and Windows Vista.| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|BitLocker recovery information is automatically and silently backed up to AD DS when BitLocker is turned on for a computer.| +|**When disabled or not configured**|BitLocker recovery information is not backed up to AD DS.| **Reference** @@ -875,15 +875,15 @@ For more information about this setting, see [TPM Group Policy settings](/window This policy setting is used to configure the default folder for recovery passwords. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.| -|Introduced|Windows Vista| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| -|When disabled or not configured|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify the default path that is displayed when the BitLocker Setup Wizard prompts the user to enter the location of a folder in which to save the recovery password.| +|**Introduced**|Windows Vista| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|You can specify the path that will be used as the default folder location when the user chooses the option to save the recovery password in a folder. You can specify a fully qualified path or include the target computer's environment variables in the path. If the path is not valid, the BitLocker Setup Wizard displays the computer's top-level folder view.| +|**When disabled or not configured**|The BitLocker Setup Wizard displays the computer's top-level folder view when the user chooses the option to save the recovery password in a folder.| **Reference** @@ -896,15 +896,15 @@ This policy setting is applied when you turn on BitLocker. This policy setting is used to configure recovery methods for fixed data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| -|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| -|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control how BitLocker-protected fixed data drives are recovered in the absence of the required credentials.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected fixed data drives.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| **Reference** @@ -930,16 +930,15 @@ Select the **Do not enable BitLocker until recovery information is stored in AD This policy setting is used to configure recovery methods for removable data drives. -||| -|--- |--- | -|Policy description|With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled. -When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| -|When enabled|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| -|When disabled or not configured|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control how BitLocker-protected removable data drives are recovered in the absence of the required credentials.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|You must disallow the use of recovery keys if the **Deny write access to removable drives not protected by BitLocker** policy setting is enabled.

When using data recovery agents, you must enable and configure the **Provide the unique identifiers for your organization** policy setting.| +|**When enabled**|You can control the methods that are available to users to recover data from BitLocker-protected removable data drives.| +|**When disabled or not configured**|The default recovery options are supported for BitLocker recovery. By default, a data recovery agent is allowed, the recovery options can be specified by the user (including the recovery password and recovery key), and recovery information is not backed up to AD DS.| **Reference** @@ -962,15 +961,15 @@ Select the **Do not enable BitLocker until recovery information is stored in AD This policy setting is used to configure the entire recovery message and to replace the existing URL that is displayed on the pre-boot recovery screen when the operating system drive is locked. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| -|Introduced|Windows 10| -|Drive type|Operating system drives| -|Policy path|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| -|Conflicts|None| -|When enabled|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| -|When disabled or not configured|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| +|**Introduced**|Windows 10| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| +|**Conflicts**|None| +|**When enabled**|The customized message and URL are displayed on the pre-boot recovery screen. If you have previously enabled a custom recovery message and URL and want to revert to the default message and URL, you must keep the policy setting enabled and select the **Use default recovery message and URL** option.| +|**When disabled or not configured**|If the setting has not been previously enabled the default pre-boot recovery screen is displayed for BitLocker recovery. If the setting previously was enabled and is subsequently disabled the last message in Boot Configuration Data (BCD) is displayed whether it was the default recovery message or the custom message.| **Reference** @@ -992,15 +991,15 @@ Once you enable the setting you have three options: This policy controls how BitLocker-enabled system volumes are handled in conjunction with the Secure Boot feature. Enabling this feature forces Secure Boot validation during the boot process and verifies Boot Configuration Data (BCD) settings according to the Secure Boot policy. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| -|When enabled or not configured|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.| -|When disabled|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether Secure Boot will be allowed as the platform integrity provider for BitLocker operating system drives.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|If you enable **Allow Secure Boot for integrity validation**, make sure the **Configure TPM platform validation profile for native UEFI firmware configurations** Group Policy setting is not enabled or include PCR 7 to allow BitLocker to use Secure Boot for platform or BCD integrity validation.

For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|**When enabled or not configured**|BitLocker uses Secure Boot for platform integrity if the platform is capable of Secure Boot-based integrity validation.| +|**When disabled**|BitLocker uses legacy platform integrity validation, even on systems that are capable of Secure Boot-based integrity validation.| **Reference** @@ -1014,15 +1013,15 @@ When this policy is enabled and the hardware is capable of using Secure Boot for This policy setting is used to establish an identifier that is applied to all drives that are encrypted in your organization. -||| -|--- |--- | -|Policy description|With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.| -|When enabled|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.| -|When disabled or not configured|The identification field is not required.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can associate unique organizational identifiers to a new drive that is enabled with BitLocker.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|Identification fields are required to manage certificate-based data recovery agents on BitLocker-protected drives. BitLocker manages and updates certificate-based data recovery agents only when the identification field is present on a drive and it is identical to the value that is configured on the computer.| +|**When enabled**|You can configure the identification field on the BitLocker-protected drive and any allowed identification field that is used by your organization.| +|**When disabled or not configured**|The identification field is not required.| **Reference** @@ -1044,15 +1043,15 @@ Multiple values separated by commas can be entered in the identification and all This policy setting is used to control whether the computer's memory will be overwritten the next time the computer is restarted. -||| -|--- |--- | -|Policy description|With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.| -|Introduced|Windows Vista| -|Drive type|All drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| -|Conflicts|None| -|When enabled|The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.| -|When disabled or not configured|BitLocker secrets are removed from memory when the computer restarts.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control computer restart performance at the risk of exposing BitLocker secrets.| +|**Introduced**|Windows Vista| +|**Drive type**|All drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| +|**Conflicts**|None| +|**When enabled**|The computer will not overwrite memory when it restarts. Preventing memory overwrite may improve restart performance, but it increases the risk of exposing BitLocker secrets.| +|**When disabled or not configured**|BitLocker secrets are removed from memory when the computer restarts.| **Reference** @@ -1062,15 +1061,15 @@ This policy setting is applied when you turn on BitLocker. BitLocker secrets inc This policy setting determines what values the TPM measures when it validates early boot components before it unlocks an operating system drive on a computer with a BIOS configuration or with UEFI firmware that has the Compatibility Support Module (CSM) enabled. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| -|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|**When disabled or not configured**|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| **Reference** @@ -1112,15 +1111,15 @@ The following list identifies all of the PCRs available: This policy setting determines what values the TPM measures when it validates early boot components before unlocking a drive on a computer running Windows Vista, Windows Server 2008, or Windows 7. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| -|Introduced|Windows Server 2008 and Windows Vista| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| -|When disabled or not configured|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure how the computer's TPM security hardware secures the BitLocker encryption key.| +|**Introduced**|Windows Server 2008 and Windows Vista| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|You can configure the boot components that the TPM validates before unlocking access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|**When disabled or not configured**|The TPM uses the default platform validation profile or the platform validation profile that is specified by the setup script.| **Reference** @@ -1162,15 +1161,15 @@ The following list identifies all of the PCRs available: This policy setting determines what values the TPM measures when it validates early boot components before unlocking an operating system drive on a computer with native UEFI firmware configurations. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation,

If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| -|When enabled|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| -|When disabled or not configured|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure how the computer's Trusted Platform Module (TPM) security hardware secures the BitLocker encryption key.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|Setting this policy with PCR 7 omitted, overrides the **Allow Secure Boot for integrity validation** Group Policy setting, and it prevents BitLocker from using Secure Boot for platform or Boot Configuration Data (BCD) integrity validation.

If your environments use TPM and Secure Boot for platform integrity checks, this policy should not be configured.

For more information about PCR 7, see [Platform Configuration Register (PCR)](#bkmk-pcr) in this topic.| +|**When enabled**|Before you turn on BitLocker, you can configure the boot components that the TPM validates before it unlocks access to the BitLocker-encrypted operating system drive. If any of these components change while BitLocker protection is in effect, the TPM does not release the encryption key to unlock the drive. Instead, the computer displays the BitLocker Recovery console and requires that the recovery password or the recovery key is provided to unlock the drive.| +|**When disabled or not configured**|BitLocker uses the default platform validation profile or the platform validation profile that is specified by the setup script.| **Reference** @@ -1210,16 +1209,16 @@ The following list identifies all of the PCRs available: This policy setting determines if you want platform validation data to refresh when Windows is started following a BitLocker recovery. A platform validation data profile consists of the values in a set of Platform Configuration Register (PCR) indices that range from 0 to 23. -||| -|--- |--- | -|Policy description|With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|None| -|When enabled|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| -|When disabled|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.| -|When not configured|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can control whether platform validation data is refreshed when Windows is started following a BitLocker recovery.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|None| +|**When enabled**|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| +|**When disabled**|Platform validation data is not refreshed when Windows is started following a BitLocker recovery.| +|**When not configured**|Platform validation data is refreshed when Windows is started following a BitLocker recovery.| **Reference** @@ -1229,16 +1228,16 @@ For more information about the recovery process, see the [BitLocker recovery gui This policy setting determines specific Boot Configuration Data (BCD) settings to verify during platform validation. A platform validation uses the data in the platform validation profile, which consists of a set of Platform Configuration Register (PCR) indices that range from 0 to 23. -||| -|--- |--- | -|Policy description|With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.| -|Introduced|Windows Server 2012 and Windows 8| -|Drive type|Operating system drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| -|Conflicts|When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored (as defined by the **Allow Secure Boot for integrity validation** Group Policy setting).| -|When enabled|You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.| -|When disabled|The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.| -|When not configured|The computer verifies the default BCD settings in Windows.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can specify Boot Configuration Data (BCD) settings to verify during platform validation.| +|**Introduced**|Windows Server 2012 and Windows 8| +|**Drive type**|Operating system drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| +|**Conflicts**|When BitLocker is using Secure Boot for platform and Boot Configuration Data integrity validation, the **Use enhanced Boot Configuration Data validation profile** Group Policy setting is ignored (as defined by the **Allow Secure Boot for integrity validation** Group Policy setting).| +|**When enabled**|You can add additional BCD settings, exclude the BCD settings you specify, or combine inclusion and exclusion lists to create a customized BCD validation profile, which gives you the ability to verify those BCD settings.| +|**When disabled**|The computer reverts to a BCD profile validation similar to the default BCD profile that is used by Windows 7.| +|**When not configured**|The computer verifies the default BCD settings in Windows.| **Reference** @@ -1249,15 +1248,15 @@ This policy setting determines specific Boot Configuration Data (BCD) settings t This policy setting is used to control whether access to drives is allowed by using the BitLocker To Go Reader, and if the application is installed on the drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Fixed data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| -|Conflicts|None| -|When enabled and When not configured|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| -|When disabled|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether fixed data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with Service Pack 3 (SP3), or Windows XP with Service Pack 2 (SP2).| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Fixed data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Fixed Data Drives| +|**Conflicts**|None| +|**When enabled and When not configured**|Fixed data drives that are formatted with the FAT file system can be unlocked on computers running Windows Server 2008, Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| +|**When disabled**|Fixed data drives that are formatted with the FAT file system and are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| **Reference** @@ -1270,15 +1269,15 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go This policy setting controls access to removable data drives that are using the BitLocker To Go Reader and whether the BitLocker To Go Reader can be installed on the drive. -||| -|--- |--- | -|Policy description|With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.| -|Introduced|Windows Server 2008 R2 and Windows 7| -|Drive type|Removable data drives| -|Policy path|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| -|Conflicts|None| -|When enabled and When not configured|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| -|When disabled|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| +| |   | +|:---|:---| +|**Policy description**|With this policy setting, you can configure whether removable data drives that are formatted with the FAT file system can be unlocked and viewed on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2.| +|**Introduced**|Windows Server 2008 R2 and Windows 7| +|**Drive type**|Removable data drives| +|**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Removable Data Drives| +|**Conflicts**|None| +|**When enabled and When not configured**|Removable data drives that are formatted with the FAT file system can be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2, and their content can be viewed. These operating systems have Read-only access to BitLocker-protected drives.| +|**When disabled**|Removable data drives that are formatted with the FAT file system that are BitLocker-protected cannot be unlocked on computers running Windows Vista, Windows XP with SP3, or Windows XP with SP2. BitLocker To Go Reader (bitlockertogo.exe) is not installed.| **Reference** @@ -1291,15 +1290,15 @@ When this policy setting is enabled, select the **Do not install BitLocker To Go You can configure the Federal Information Processing Standard (FIPS) setting for FIPS compliance. As an effect of FIPS compliance, users cannot create or save a BitLocker password for recovery or as a key protector. The use of a recovery key is permitted. -||| -|--- |--- | -|Policy description|Notes| -|Introduced|Windows Server 2003 with SP1| -|Drive type|System-wide| -|Policy path|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**| -|Conflicts|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.| -|When enabled|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.| -|When disabled or not configured|No BitLocker encryption key is generated| +| |   | +|:---|:---| +|**Policy description**|Notes| +|**Introduced**|Windows Server 2003 with SP1| +|**Drive type**|System-wide| +|**Policy path**|Local Policies\Security Options\System cryptography: **Use FIPS compliant algorithms for encryption, hashing, and signing**| +|**Conflicts**|Some applications, such as Terminal Services, do not support FIPS-140 on all operating systems.| +|**When enabled**|Users will be unable to save a recovery password to any location. This includes AD DS and network folders. In addition, you cannot use WMI or the BitLocker Drive Encryption Setup wizard to create a recovery password.| +|**When disabled or not configured**|No BitLocker encryption key is generated| **Reference** diff --git a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md index 7f98409069..66c3926643 100644 --- a/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md +++ b/windows/security/threat-protection/security-policy-settings/network-access-restrict-clients-allowed-to-make-remote-sam-calls.md @@ -89,12 +89,12 @@ Administrators can test whether applying the same restriction earlier versions o In other words, the hotfix in each KB article provides the necessary code and functionality, but you need to configure the restriction after you install the hotfix—no restrictions are enabled by default after the hotfix is installed on earlier versions of Windows. -| |Default SDDL |Translated SDDL| Comments +| |Default SDDL |Translated SDDL| Comments | |---|---|---|---| -|Windows Server 2016 (or later) domain controller (reading Active Directory)|“”|-|Everyone has read permissions to preserve compatibility.| -|Earlier domain controller |-|-|No access check is performed by default.| -|Windows 10, version 1607 (or later) non-domain controller|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
  AceType:0x00
  (ACCESS\_ALLOWED_ACE_TYPE)
  AceSize:0x0018
  InheritFlags:0x00
  Access Mask:0x00020000
  AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

  SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. | -|Earlier non-domain controller |-|-|No access check is performed by default.| +|**Windows Server 2016 (or later) domain controller (reading Active Directory)**|“”|-|Everyone has read permissions to preserve compatibility.| +|**Earlier domain controller** |-|-|No access check is performed by default.| +|**Windows 10, version 1607 (or later) non-domain controller**|O:SYG:SYD:(A;;RC;;;BA)| Owner: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
Primary group: NTAUTHORITY/SYSTEM (WellKnownGroup) (S-1-5-18)
DACL:
• Revision: 0x02
• Size: 0x0020
• Ace Count: 0x001
• Ace[00]-------------------------
  AceType:0x00
  (ACCESS\_ALLOWED_ACE_TYPE)
  AceSize:0x0018
  InheritFlags:0x00
  Access Mask:0x00020000
  AceSid: BUILTIN\Administrators (Alias) (S-1-5-32-544)

  SACL: Not present |Grants RC access (READ_CONTROL, also known as STANDARD_RIGHTS_READ) only to members of the local (built-in) Administrators group. | +|**Earlier non-domain controller** |-|-|No access check is performed by default.| ## Policy management diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index 6ac3422250..a351aca3d9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -45,7 +45,7 @@ A Windows Defender Application Control (WDAC) policy logs events locally in Wind | 8028 | Audit script/MSI file generated by Windows LockDown Policy (WLDP) being called by the script hosts themselves. Note: there is no WDAC enforcement on third-party script hosts. | | 8029 | Block script/MSI file | | 8036| COM object was blocked. To learn more about COM object authorization, see [Allow COM object registration in a Windows Defender Application Control policy](allow-com-object-registration-in-windows-defender-application-control-policy.md). | -| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | | +| 8038 | Signing information event correlated with either an 8028 or 8029 event. One 8038 event is generated for each signature of a script file. Contains the total number of signatures on a script file and an index as to which signature it is. Unsigned script files will generate a single 8038 event with TotalSignatureCount 0. Correlated in the "System" portion of the event data under "Correlation ActivityID". | ## Optional Intelligent Security Graph (ISG) or Managed Installer (MI) diagnostic events diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index d409657e10..c19d0a9e41 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -29,7 +29,7 @@ Microsoft has strict requirements for code running in kernel. Consequently, mali - Hypervisor-protected code integrity (HVCI) enabled devices - Windows 10 in S mode (S mode) devices -Microsoft recommends enabling [HVCI](https://docs.microsoft.com/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. +Microsoft recommends enabling [HVCI](/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity) or S mode to protect your devices against security threats. If this is not possible, Microsoft recommends blocking the following list of drivers by merging this policy with your existing Windows Defender Application Control policy. Blocking kernel drivers without sufficient testing can result in devices or software to malfunction, and in rare cases, blue screen. It is recommended to first validate this policy in [audit mode](audit-windows-defender-application-control-policies.md) and review the audit block events. > [!Note] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. It is recommended that this policy be first validated in audit mode before rolling the rules into enforcement mode. From 39f00224749db7dd0b2fff491d44a0521c3c3972 Mon Sep 17 00:00:00 2001 From: Diana Hanson Date: Fri, 6 Aug 2021 09:58:28 -0600 Subject: [PATCH 0011/1214] Apply suggestions from code review --- .../bitlocker/bitlocker-group-policy-settings.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index c1b9853eb5..c695b4b77c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -444,6 +444,7 @@ This policy setting is used to require, allow, or deny the use of passwords with |**When enabled**|Users can configure a password that meets the requirements you define. To require the use of a password, select **Require password for removable data drive**. To enforce complexity requirements on the password, select **Require complexity**.| |**When disabled**|The user is not allowed to use a password.| |**When not configured**|Passwords are supported with the default settings, which do not include password complexity requirements and require only 8 characters.| + **Reference** If you choose to allow the use of a password, you can require a password to be used, enforce complexity requirements, and configure a minimum length. For the complexity requirement setting to be effective, the Group Policy setting **Password must meet complexity requirements**, which is located at From b1c3e7f0e1168f93ab0e5ba0a0ced3d991831351 Mon Sep 17 00:00:00 2001 From: Diana Hanson Date: Fri, 6 Aug 2021 10:05:19 -0600 Subject: [PATCH 0012/1214] Deleted empty space after last pipe --- .../event-id-explanations.md | 26 +++++++++---------- 1 file changed, 13 insertions(+), 13 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index a351aca3d9..b09aee0f21 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -91,7 +91,7 @@ A list of other relevant event IDs and their corresponding description. | Event ID | Description | |-------|------| -| 3001 | An unsigned driver was attempted to load on the system. | +| 3001 | An unsigned driver was attempted to load on the system. | | 3002 | Code Integrity could not verify the boot image as the page hash could not be found. | | 3004 | Code Integrity could not verify the file as the page hash could not be found. | | 3010 | The catalog containing the signature for the file under validation is invalid. | @@ -101,27 +101,27 @@ A list of other relevant event IDs and their corresponding description. | 3024 | Windows application control was unable to refresh the boot catalog file. | | 3026 | The catalog loaded is signed by a signing certificate that has been revoked by Microsoft and/or the certificate issuing authority. | | 3033 | The file under validation did not meet the requirements to pass the application control policy. | -| 3034 | The file under validation would not meet the requirements to pass the application control policy if the policy was enforced. The file was allowed since the policy is in audit mode. |  +| 3034 | The file under validation would not meet the requirements to pass the application control policy if the policy was enforced. The file was allowed since the policy is in audit mode. | | 3036 | The signed file under validation is signed by a code signing certificate that has been revoked by Microsoft or the certificate issuing authority. | -| 3064 | If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. |  -| 3065 | [Ignored] If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. | +| 3064 | If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. The DLL was allowed since the policy is in audit mode. | +| 3065 | [Ignored] If the policy was enforced, a user mode DLL under validation would not meet the requirements to pass the application control policy. | | 3074 | Page hash failure while hypervisor-protected code integrity was enabled. | | 3075 | This event monitors the performance of the Code Integrity policy check a file. | | 3079 | The file under validation did not meet the requirements to pass the application control policy. | | 3080 | If the policy was in enforced mode, the file under validation would not have met the requirements to pass the application control policy. | | 3081 | The file under validation did not meet the requirements to pass the application control policy. | -| 3082 | If the policy was in enforced mode, the non-WHQL driver would have been denied by the policy. | +| 3082 | If the policy was in enforced mode, the non-WHQL driver would have been denied by the policy. | | 3084 | Code Integrity will enforce the WHQL Required policy setting on this session. | | 3085 | Code Integrity will not enforce the WHQL Required policy setting on this session. | | 3086 | The file under validation does not meet the signing requirements for an isolated user mode (IUM) process. | -| 3095 | This Code Integrity policy cannot be refreshed and must be rebooted instead. | -| 3097 | The Code Integrity policy cannot be refreshed. | +| 3095 | This Code Integrity policy cannot be refreshed and must be rebooted instead. | +| 3097 | The Code Integrity policy cannot be refreshed. | | 3100 | The application control policy was refreshed but was unsuccessfully activated. Retry. | -| 3101 | Code Integrity started refreshing the policy. | -| 3102 | Code Integrity finished refreshing the policy. | -| 3103 | Code Integrity is ignoring the policy refresh. | -| 3104 | The file under validation does not meet the signing requirements for a PPL (protected process light) process. | -| 3105 | Code Integrity is attempting to refresh the policy. | +| 3101 | Code Integrity started refreshing the policy. | +| 3102 | Code Integrity finished refreshing the policy. | +| 3103 | Code Integrity is ignoring the policy refresh. | +| 3104 | The file under validation does not meet the signing requirements for a PPL (protected process light) process. | +| 3105 | Code Integrity is attempting to refresh the policy. | | 3108 | Windows mode change event was successful. | | 3110 | Windows mode change event was unsuccessful. | -| 3111 | The file under validation did not meet the hypervisor-protected code integrity (HVCI) policy. | +| 3111 | The file under validation did not meet the hypervisor-protected code integrity (HVCI) policy. | From 8bf02cbba48c87688dbefee7c75053eab6ae0302 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Tue, 10 Aug 2021 17:57:09 +0530 Subject: [PATCH 0013/1214] Updated --- .../mdm/policy-csp-activexcontrols.md | 2 +- .../policy-csp-admx-activexinstallservice.md | 2 +- .../mdm/policy-csp-admx-addremoveprograms.md | 10 +-- .../mdm/policy-csp-admx-appcompat.md | 18 ++-- .../mdm/policy-csp-admx-appxpackagemanager.md | 2 +- .../mdm/policy-csp-admx-appxruntime.md | 8 +- .../mdm/policy-csp-admx-attachmentmanager.md | 10 +-- .../mdm/policy-csp-admx-auditsettings.md | 2 +- .../mdm/policy-csp-admx-bits.md | 28 +++--- .../mdm/policy-csp-admx-ciphersuiteorder.md | 4 +- .../mdm/policy-csp-admx-com.md | 4 +- .../mdm/policy-csp-admx-controlpanel.md | 8 +- .../policy-csp-admx-controlpaneldisplay.md | 48 +++++------ .../mdm/policy-csp-admx-cpls.md | 2 +- .../policy-csp-admx-credentialproviders.md | 6 +- .../mdm/policy-csp-admx-credssp.md | 22 ++--- .../mdm/policy-csp-admx-credui.md | 4 +- .../mdm/policy-csp-admx-ctrlaltdel.md | 8 +- .../mdm/policy-csp-admx-datacollection.md | 2 +- .../mdm/policy-csp-admx-desktop.md | 58 ++++++------- .../mdm/policy-csp-admx-deviceinstallation.md | 16 ++-- .../mdm/policy-csp-admx-devicesetup.md | 4 +- .../mdm/policy-csp-admx-digitallocker.md | 4 +- ...policy-csp-admx-distributedlinktracking.md | 2 +- .../mdm/policy-csp-admx-dnsclient.md | 44 +++++----- .../mdm/policy-csp-admx-dwm.md | 12 +-- .../mdm/policy-csp-admx-eaime.md | 24 +++--- .../mdm/policy-csp-admx-encryptfilesonmove.md | 2 +- .../mdm/policy-csp-admx-enhancedstorage.md | 12 +-- .../mdm/policy-csp-admx-errorreporting.md | 54 ++++++------ .../mdm/policy-csp-admx-eventforwarding.md | 4 +- .../mdm/policy-csp-admx-eventlog.md | 42 ++++----- .../mdm/policy-csp-admx-explorer.md | 10 +-- .../policy-csp-admx-fileservervssprovider.md | 2 +- .../mdm/policy-csp-admx-filesys.md | 16 ++-- .../mdm/policy-csp-admx-folderredirection.md | 14 +-- .../mdm/policy-csp-admx-globalization.md | 48 +++++------ .../mdm/policy-csp-admx-grouppolicy.md | 86 +++++++++---------- .../mdm/policy-csp-admx-help.md | 8 +- .../mdm/policy-csp-admx-helpandsupport.md | 8 +- .../mdm/policy-csp-windowssandbox.md | 12 +-- .../mdm/policy-csp-wirelessdisplay.md | 4 +- 42 files changed, 338 insertions(+), 338 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index d760021b1e..0ed2ddc357 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -92,7 +92,7 @@ Note: Wild card characters cannot be used when specifying the host URLs. ADMX Info: -- GP English name: *Approved Installation Sites for ActiveX Controls* +- GP Friendly name: *Approved Installation Sites for ActiveX Controls* - GP name: *ApprovedActiveXInstallSites* - GP path: *Windows Components/ActiveX Installer Service* - GP ADMX file name: *ActiveXInstallService.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index a4020d12f2..67982daf0e 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -95,7 +95,7 @@ If the trusted site uses the HTTPS protocol, this policy setting can also contro ADMX Info: -- GP English name: *Establish ActiveX installation policy for sites in Trusted zones* +- GP Friendly name: *Establish ActiveX installation policy for sites in Trusted zones* - GP name: *AxISURLZonePolicies* - GP path: *Windows Components\ActiveX Installer Service* - GP ADMX file name: *ActiveXInstallService.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 647cff6ce4..0c7c4b543b 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -125,7 +125,7 @@ If you disable this setting or do not configure it, all programs (Category: All) ADMX Info: -- GP English name: *Specify default category for Add New Programs* +- GP Friendly name: *Specify default category for Add New Programs* - GP name: *DefaultCategory* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -206,7 +206,7 @@ If you disable this setting or do not configure it, the "Add a program from CD-R ADMX Info: -- GP English name: *Hide the "Add a program from CD-ROM or floppy disk" option* +- GP Friendly name: *Hide the "Add a program from CD-ROM or floppy disk" option* - GP name: *NoAddFromCDorFloppy* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -287,7 +287,7 @@ If you disable this setting or do not configure it, "Add programs from Microsoft ADMX Info: -- GP English name: *Hide the "Add programs from Microsoft" option* +- GP Friendly name: *Hide the "Add programs from Microsoft" option* - GP name: *NoAddFromInternet* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -370,7 +370,7 @@ If you disable this setting or do not configure it, "Add programs from your netw ADMX Info: -- GP English name: *Hide the "Add programs from your network" option* +- GP Friendly name: *Hide the "Add programs from your network" option* - GP name: *NoAddFromNetwork* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -447,7 +447,7 @@ If you disable this setting or do not configure it, the Add New Programs button ADMX Info: -- GP English name: *Hide Add New Programs page* +- GP Friendly name: *Hide Add New Programs page* - GP name: *NoAddPage* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index ff2c292c54..e145a37e11 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -131,7 +131,7 @@ If the status is set to Not Configured, the OS falls back on a local policy set ADMX Info: -- GP English name: *Prevent access to 16-bit applications* +- GP Friendly name: *Prevent access to 16-bit applications* - GP name: *AppCompatPrevent16BitMach* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -202,7 +202,7 @@ Enabling this policy setting removes the property page from the context-menus, b ADMX Info: -- GP English name: *Remove Program Compatibility Property Page* +- GP Friendly name: *Remove Program Compatibility Property Page* - GP name: *AppCompatRemoveProgramCompatPropPage* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -277,7 +277,7 @@ Disabling telemetry will take effect on any newly launched applications. To ensu ADMX Info: -- GP English name: *Turn off Application Telemetry* +- GP Friendly name: *Turn off Application Telemetry* - GP name: *AppCompatTurnOffApplicationImpactTelemetry* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -353,7 +353,7 @@ Reboot the system after changing the setting to ensure that your system accurate ADMX Info: -- GP English name: *Turn off SwitchBack Compatibility Engine* +- GP Friendly name: *Turn off SwitchBack Compatibility Engine* - GP name: *AppCompatTurnOffSwitchBack* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -431,7 +431,7 @@ This option is useful to server administrators who require faster performance an ADMX Info: -- GP English name: *Turn off Application Compatibility Engine* +- GP Friendly name: *Turn off Application Compatibility Engine* - GP name: *AppCompatTurnOffEngine* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -498,7 +498,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting ex ADMX Info: -- GP English name: *Turn off Program Compatibility Assistant* +- GP Friendly name: *Turn off Program Compatibility Assistant* - GP name: *AppCompatTurnOffProgramCompatibilityAssistant_1* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -572,7 +572,7 @@ If you disable or do not configure this policy setting, the PCA will be turned o ADMX Info: -- GP English name: *Turn off Program Compatibility Assistant* +- GP Friendly name: *Turn off Program Compatibility Assistant* - GP name: *AppCompatTurnOffProgramCompatibilityAssistant_2* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -645,7 +645,7 @@ If you disable or do not configure this policy setting, Steps Recorder will be e ADMX Info: -- GP English name: *Turn off Steps Recorder* +- GP Friendly name: *Turn off Steps Recorder* - GP name: *AppCompatTurnOffUserActionRecord* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -721,7 +721,7 @@ If you disable or do not configure this policy setting, the Inventory Collector ADMX Info: -- GP English name: *Turn off Inventory Collector* +- GP Friendly name: *Turn off Inventory Collector* - GP name: *AppCompatTurnOffProgramInventory* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index 9a4ac00b81..f3aef0211f 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -97,7 +97,7 @@ If you disable or do not configure this policy setting, Group Policy blocks depl ADMX Info: -- GP English name: *Allow deployment operations in special profiles* +- GP Friendly name: *Allow deployment operations in special profiles* - GP name: *AllowDeploymentInSpecialProfiles* - GP path: *Windows Components\App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index de1358be57..c30dafd023 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -99,7 +99,7 @@ If you disable or don't set this policy setting, Windows Store apps will only us ADMX Info: -- GP English name: *Turn on dynamic Content URI Rules for Windows store apps* +- GP Friendly name: *Turn on dynamic Content URI Rules for Windows store apps* - GP name: *AppxRuntimeApplicationContentUriRules* - GP path: *Windows Components\App runtime* - GP ADMX file name: *AppXRuntime.admx* @@ -169,7 +169,7 @@ If you disable or do not configure this policy setting, Windows Store apps can o ADMX Info: -- GP English name: *Block launching desktop apps associated with a file.* +- GP Friendly name: *Block launching desktop apps associated with a file.* - GP name: *AppxRuntimeBlockFileElevation* - GP path: *Windows Components\App runtime* - GP ADMX file name: *AppXRuntime.admx* @@ -241,7 +241,7 @@ If you disable or do not configure this policy setting, all Universal Windows ap ADMX Info: -- GP English name: *Block launching Universal Windows apps with Windows Runtime API access from hosted content.* +- GP Friendly name: *Block launching Universal Windows apps with Windows Runtime API access from hosted content.* - GP name: *AppxRuntimeBlockHostedAppAccessWinRT* - GP path: *Windows Components\App runtime* - GP ADMX file name: *AppXRuntime.admx* @@ -314,7 +314,7 @@ If you disable or do not configure this policy setting, Windows Store apps can o ADMX Info: -- GP English name: *Block launching desktop apps associated with a URI scheme* +- GP Friendly name: *Block launching desktop apps associated with a URI scheme* - GP name: *AppxRuntimeBlockProtocolElevation* - GP path: *Windows Components\App runtime* - GP ADMX file name: *AppXRuntime.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index 8bc9cf11ea..7a82136079 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -108,7 +108,7 @@ If you do not configure this policy setting, Windows uses its default trust logi ADMX Info: -- GP English name: *Trust logic for file attachments* +- GP Friendly name: *Trust logic for file attachments* - GP name: *AM_EstimateFileHandlerRisk* - GP path: *Windows Components\Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* @@ -185,7 +185,7 @@ If you do not configure this policy setting, Windows sets the default risk level ADMX Info: -- GP English name: *Default risk level for file attachments* +- GP Friendly name: *Default risk level for file attachments* - GP name: *AM_SetFileRiskLevel* - GP path: *Windows Components\Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* @@ -256,7 +256,7 @@ If you do not configure this policy setting, Windows uses its built-in list of h ADMX Info: -- GP English name: *Inclusion list for high risk file types* +- GP Friendly name: *Inclusion list for high risk file types* - GP name: *AM_SetHighRiskInclusion* - GP path: *Windows Components\Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* @@ -327,7 +327,7 @@ If you do not configure this policy setting, Windows uses its default trust logi ADMX Info: -- GP English name: *Inclusion list for low file types* +- GP Friendly name: *Inclusion list for low file types* - GP name: *AM_SetLowRiskInclusion* - GP path: *Windows Components\Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* @@ -398,7 +398,7 @@ If you do not configure this policy setting, Windows uses its default trust logi ADMX Info: -- GP English name: *Inclusion list for moderate risk file types* +- GP Friendly name: *Inclusion list for moderate risk file types* - GP name: *AM_SetModRiskInclusion* - GP path: *Windows Components\Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 45e3546cb4..56d9939332 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -95,7 +95,7 @@ Default is Not configured. ADMX Info: -- GP English name: *Include command line in process creation events* +- GP Friendly name: *Include command line in process creation events* - GP name: *IncludeCmdLine* - GP path: *System/Audit Process Creation* - GP ADMX file name: *AuditSettings.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index a9c4c671d0..9a5fd957e7 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -132,7 +132,7 @@ If you disable or do not configure this policy setting, the BITS client uses Win ADMX Info: -- GP English name: *Do not allow the BITS client to use Windows Branch Cache* +- GP Friendly name: *Do not allow the BITS client to use Windows Branch Cache* - GP name: *BITS_DisableBranchCache* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -204,7 +204,7 @@ If you disable or do not configure this policy setting, the computer attempts to ADMX Info: -- GP English name: *Do not allow the computer to act as a BITS Peercaching client* +- GP Friendly name: *Do not allow the computer to act as a BITS Peercaching client* - GP name: *BITS_DisablePeercachingClient* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -276,7 +276,7 @@ If you disable or do not configure this policy setting, the computer will offer ADMX Info: -- GP English name: *Do not allow the computer to act as a BITS Peercaching server* +- GP Friendly name: *Do not allow the computer to act as a BITS Peercaching server* - GP name: *BITS_DisablePeercachingServer* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -348,7 +348,7 @@ If you disable or do not configure this policy setting, the BITS peer caching fe ADMX Info: -- GP English name: *Allow BITS Peercaching* +- GP Friendly name: *Allow BITS Peercaching* - GP name: *BITS_EnablePeercaching* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -425,7 +425,7 @@ If you disable this policy setting or do not configure it, the default value of ADMX Info: -- GP English name: *Limit the maximum network bandwidth used for Peercaching* +- GP Friendly name: *Limit the maximum network bandwidth used for Peercaching* - GP name: *BITS_MaxBandwidthServedForPeers* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -499,7 +499,7 @@ If you disable or do not configure this policy setting, the limits defined for w ADMX Info: -- GP English name: *Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers* +- GP Friendly name: *Set up a maintenance schedule to limit the maximum network bandwidth used for BITS background transfers* - GP name: *BITS_MaxBandwidthV2_Maintenance* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -571,7 +571,7 @@ If you disable or do not configure this policy setting, BITS uses all available ADMX Info: -- GP English name: *Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers* +- GP Friendly name: *Set up a work schedule to limit the maximum network bandwidth used for BITS background transfers* - GP name: *BITS_MaxBandwidthV2_Work* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -644,7 +644,7 @@ If you disable or do not configure this policy setting, the default size of the ADMX Info: -- GP English name: *Limit the BITS Peercache size* +- GP Friendly name: *Limit the BITS Peercache size* - GP name: *BITS_MaxCacheSize* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -716,7 +716,7 @@ If you disable or do not configure this policy setting, files that have not been ADMX Info: -- GP English name: *Limit the age of files in the BITS Peercache* +- GP Friendly name: *Limit the age of files in the BITS Peercache* - GP name: *BITS_MaxContentAge* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -789,7 +789,7 @@ If you disable or do not configure this policy setting, the default value of 90 ADMX Info: -- GP English name: *Limit the maximum BITS job download time* +- GP Friendly name: *Limit the maximum BITS job download time* - GP name: *BITS_MaxDownloadTime* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -861,7 +861,7 @@ If you disable or do not configure this policy setting, BITS will use the defaul ADMX Info: -- GP English name: *Limit the maximum number of files allowed in a BITS job* +- GP Friendly name: *Limit the maximum number of files allowed in a BITS job* - GP name: *BITS_MaxFilesPerJob* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -933,7 +933,7 @@ If you disable or do not configure this policy setting, BITS will use the defaul ADMX Info: -- GP English name: *Limit the maximum number of BITS jobs for this computer* +- GP Friendly name: *Limit the maximum number of BITS jobs for this computer* - GP name: *BITS_MaxJobsPerMachine* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -1005,7 +1005,7 @@ If you disable or do not configure this policy setting, BITS will use the defaul ADMX Info: -- GP English name: *Limit the maximum number of BITS jobs for each user* +- GP Friendly name: *Limit the maximum number of BITS jobs for each user* - GP name: *BITS_MaxJobsPerUser* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* @@ -1077,7 +1077,7 @@ If you disable or do not configure this policy setting, BITS will limit ranges t ADMX Info: -- GP English name: *Limit the maximum number of ranges that can be added to the file in a BITS job* +- GP Friendly name: *Limit the maximum number of ranges that can be added to the file in a BITS job* - GP name: *BITS_MaxRangesPerFile* - GP path: *Network\Background Intelligent Transfer Service (BITS)* - GP ADMX file name: *Bits.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index b258029bba..44e91fe2e9 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -96,7 +96,7 @@ For information about supported cipher suites, see [Cipher Suites in TLS/SSL (Sc ADMX Info: -- GP English name: *SSL Cipher Suite Order* +- GP Friendly name: *SSL Cipher Suite Order* - GP name: *SSLCipherSuiteOrder* - GP path: *Network/SSL Configuration Settings* - GP ADMX file name: *CipherSuiteOrder.admx* @@ -179,7 +179,7 @@ CertUtil.exe -DisplayEccCurve ADMX Info: -- GP English name: *ECC Curve Order* +- GP Friendly name: *ECC Curve Order* - GP name: *SSLCurveOrder* - GP path: *Network/SSL Configuration Settings* - GP ADMX file name: *CipherSuiteOrder.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index fe5fda7a65..13d4fabf45 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -98,7 +98,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Download missing COM components* +- GP Friendly name: *Download missing COM components* - GP name: *AppMgmt_COM_SearchForCLSID_1* - GP path: *System* - GP ADMX file name: *COM.admx* @@ -173,7 +173,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Download missing COM components* +- GP Friendly name: *Download missing COM components* - GP name: *AppMgmt_COM_SearchForCLSID_2* - GP path: *System* - GP ADMX file name: *COM.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index e2b1569c90..9dec30ad01 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -107,7 +107,7 @@ If both the "Hide specified Control Panel items" setting and the "Show only spec ADMX Info: -- GP English name: *Hide specified Control Panel items* +- GP Friendly name: *Hide specified Control Panel items* - GP name: *DisallowCpls* - GP path: *Control Panel* - GP ADMX file name: *ControlPanel.admx* @@ -181,7 +181,7 @@ If this policy setting is not configured, the Control Panel opens to the view us ADMX Info: -- GP English name: *Always open All Control Panel Items when opening Control Panel* +- GP Friendly name: *Always open All Control Panel Items when opening Control Panel* - GP name: *ForceClassicControlPanel* - GP path: *Control Panel* - GP ADMX file name: *ControlPanel.admx* @@ -262,7 +262,7 @@ If users try to select a Control Panel item from the Properties item on a contex ADMX Info: -- GP English name: *Prohibit access to Control Panel and PC settings* +- GP Friendly name: *Prohibit access to Control Panel and PC settings* - GP name: *NoControlPanel* - GP path: *Control Panel* - GP ADMX file name: *ControlPanel.admx* @@ -339,7 +339,7 @@ If both the "Hide specified Control Panel items" setting and the "Show only spec ADMX Info: -- GP English name: *Show only specified Control Panel items* +- GP Friendly name: *Show only specified Control Panel items* - GP name: *RestrictCpls* - GP path: *Control Panel* - GP ADMX file name: *ControlPanel.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index 970899b339..f1f3907cbe 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -159,7 +159,7 @@ Also, see the "Prohibit access to the Control Panel" (User Configuration\Adminis ADMX Info: -- GP English name: *Disable the Display Control Panel* +- GP Friendly name: *Disable the Display Control Panel* - GP name: *CPL_Display_Disable* - GP path: *Control Panel\Display* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -226,7 +226,7 @@ This setting prevents users from using Control Panel to add, configure, or chang ADMX Info: -- GP English name: *Hide Settings tab* +- GP Friendly name: *Hide Settings tab* - GP name: *CPL_Display_HideSettings* - GP path: *Control Panel\Display* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -297,7 +297,7 @@ For Windows 7 and later, use the "Prevent changing color and appearance" setting ADMX Info: -- GP English name: *Prevent changing color scheme* +- GP Friendly name: *Prevent changing color scheme* - GP name: *CPL_Personalization_DisableColorSchemeChoice* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -369,7 +369,7 @@ If you disable or do not configure this setting, there is no effect. ADMX Info: -- GP English name: *Prevent changing theme* +- GP Friendly name: *Prevent changing theme* - GP name: *CPL_Personalization_DisableThemeChange* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -438,7 +438,7 @@ When enabled on Windows XP and later systems, this setting prevents users and ap ADMX Info: -- GP English name: *Prevent changing visual style for windows and buttons* +- GP Friendly name: *Prevent changing visual style for windows and buttons* - GP name: *CPL_Personalization_DisableVisualStyle* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -511,7 +511,7 @@ Also, see the "Prevent changing Screen Saver" setting. ADMX Info: -- GP English name: *Enable screen saver* +- GP Friendly name: *Enable screen saver* - GP name: *CPL_Personalization_EnableScreenSaver* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -584,7 +584,7 @@ Note: This setting only applies to Enterprise, Education, and Server SKUs. ADMX Info: -- GP English name: *Force a specific default lock screen and logon image* +- GP Friendly name: *Force a specific default lock screen and logon image* - GP name: *CPL_Personalization_ForceDefaultLockScreen* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -653,7 +653,7 @@ If you disable or do not configure this setting, a user may change the font size ADMX Info: -- GP English name: *Prohibit selection of visual style font size* +- GP Friendly name: *Prohibit selection of visual style font size* - GP name: *CPL_Personalization_LockFontSize* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -722,7 +722,7 @@ If you enable this setting, the user will not be able to change their lock scree ADMX Info: -- GP English name: *Prevent changing lock screen and logon image* +- GP Friendly name: *Prevent changing lock screen and logon image* - GP name: *CPL_Personalization_NoChangingLockScreen* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -795,7 +795,7 @@ If the "Force a specific Start background" policy is also set on a supported ver ADMX Info: -- GP English name: *Prevent changing start menu background* +- GP Friendly name: *Prevent changing start menu background* - GP name: *CPL_Personalization_NoChangingStartMenuBackground* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -866,7 +866,7 @@ For systems prior to Windows Vista, this setting hides the Appearance and Themes ADMX Info: -- GP English name: *Prevent changing color and appearance* +- GP Friendly name: *Prevent changing color and appearance* - GP name: *CPL_Personalization_NoColorAppearanceUI* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -941,7 +941,7 @@ Also, see the "Allow only bitmapped wallpaper" setting. ADMX Info: -- GP English name: *Prevent changing desktop background* +- GP Friendly name: *Prevent changing desktop background* - GP name: *CPL_Personalization_NoDesktopBackgroundUI* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1012,7 +1012,7 @@ For systems prior to Windows Vista, this setting also hides the Desktop tab in t ADMX Info: -- GP English name: *Prevent changing desktop icons* +- GP Friendly name: *Prevent changing desktop icons* - GP name: *CPL_Personalization_NoDesktopIconsUI* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1081,7 +1081,7 @@ If you disable or do not configure this policy setting, users that are not requi ADMX Info: -- GP English name: *Do not display the lock screen* +- GP Friendly name: *Do not display the lock screen* - GP name: *CPL_Personalization_NoLockScreen* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1150,7 +1150,7 @@ If you enable this setting, none of the mouse pointer scheme settings can be cha ADMX Info: -- GP English name: *Prevent changing mouse pointers* +- GP Friendly name: *Prevent changing mouse pointers* - GP name: *CPL_Personalization_NoMousePointersUI* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1217,7 +1217,7 @@ This setting prevents users from using Control Panel to add, configure, or chang ADMX Info: -- GP English name: *Prevent changing screen saver* +- GP Friendly name: *Prevent changing screen saver* - GP name: *CPL_Personalization_NoScreenSaverUI* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1286,7 +1286,7 @@ If you enable this setting, none of the Sound Scheme settings can be changed by ADMX Info: -- GP English name: *Prevent changing sounds* +- GP Friendly name: *Prevent changing sounds* - GP name: *CPL_Personalization_NoSoundSchemeUI* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1355,7 +1355,7 @@ If this setting is enabled, the background and accent colors of Windows will be ADMX Info: -- GP English name: *Force a specific background and accent color* +- GP Friendly name: *Force a specific background and accent color* - GP name: *CPL_Personalization_PersonalColors* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1431,7 +1431,7 @@ To ensure that a computer will be password protected, enable the "Enable Screen ADMX Info: -- GP English name: *Password protect the screen saver* +- GP Friendly name: *Password protect the screen saver* - GP name: *CPL_Personalization_ScreenSaverIsSecure* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1510,7 +1510,7 @@ When not configured, whatever wait time is set on the client through the Screen ADMX Info: -- GP English name: *Screen saver timeout* +- GP Friendly name: *Screen saver timeout* - GP name: *CPL_Personalization_ScreenSaverTimeOut* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1586,7 +1586,7 @@ If the specified screen saver is not installed on a computer to which this setti ADMX Info: -- GP English name: *Force specific screen saver* +- GP Friendly name: *Force specific screen saver* - GP name: *CPL_Personalization_SetScreenSaver* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1655,7 +1655,7 @@ If you disable or do not configure this setting, the default theme will be appli ADMX Info: -- GP English name: *Load a specific theme* +- GP Friendly name: *Load a specific theme* - GP name: *CPL_Personalization_SetTheme* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1733,7 +1733,7 @@ If you disable or do not configure this setting, the users can select the visual ADMX Info: -- GP English name: *Force a specific visual style file or force Windows Classic* +- GP Friendly name: *Force a specific visual style file or force Windows Classic* - GP name: *CPL_Personalization_SetVisualStyle* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1802,7 +1802,7 @@ If this setting is set to a nonzero value, then Start uses the specified backgro ADMX Info: -- GP English name: *Force a specific Start background* +- GP Friendly name: *Force a specific Start background* - GP name: *CPL_Personalization_StartBackground* - GP path: *Control Panel\Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 765b443616..6ad7cad008 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -93,7 +93,7 @@ If you disable or do not configure this policy setting, users will be able to cu ADMX Info: -- GP English name: *Apply the default account picture to all users* +- GP Friendly name: *Apply the default account picture to all users* - GP name: *UseDefaultTile* - GP path: *Control Panel/User Accounts* - GP ADMX file name: *Cpls.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index 21edb1f061..b7ed4ab54a 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -100,7 +100,7 @@ If you don't configure this policy setting on a workgroup device, a user on a Co ADMX Info: -- GP English name: *Allow users to select when a password is required when resuming from connected standby* +- GP Friendly name: *Allow users to select when a password is required when resuming from connected standby* - GP name: *AllowDomainDelayLock* - GP path: *System\Logon* - GP ADMX file name: *CredentialProviders.admx* @@ -172,7 +172,7 @@ If you disable or do not configure this policy setting, the system picks the def ADMX Info: -- GP English name: *Assign a default credential provider* +- GP Friendly name: *Assign a default credential provider* - GP name: *DefaultCredentialProvider* - GP path: *System\Logon* - GP ADMX file name: *CredentialProviders.admx* @@ -245,7 +245,7 @@ If you disable or do not configure this policy, all installed and otherwise enab ADMX Info: -- GP English name: *Exclude credential providers* +- GP Friendly name: *Exclude credential providers* - GP name: *ExcludedCredentialProviders* - GP path: *System\Logon* - GP ADMX file name: *CredentialProviders.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 2cc80b3bec..04bbf46ba4 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -131,7 +131,7 @@ If you disable or do not configure (by default) this policy setting, delegation ADMX Info: -- GP English name: *Allow delegating default credentials with NTLM-only server authentication* +- GP Friendly name: *Allow delegating default credentials with NTLM-only server authentication* - GP name: *AllowDefCredentialsWhenNTLMOnly* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -216,7 +216,7 @@ https://go.microsoft.com/fwlink/?LinkId=301508 ADMX Info: -- GP English name: *Allow delegating default credentials* +- GP Friendly name: *Allow delegating default credentials* - GP name: *AllowDefaultCredentials* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -296,7 +296,7 @@ For more information about the vulnerability and servicing requirements for prot ADMX Info: -- GP English name: *Encryption Oracle Remediation* +- GP Friendly name: *Encryption Oracle Remediation* - GP name: *AllowEncryptionOracle* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -378,7 +378,7 @@ If you disable this policy setting, delegation of fresh credentials is not permi ADMX Info: -- GP English name: *Allow delegating fresh credentials* +- GP Friendly name: *Allow delegating fresh credentials* - GP name: *AllowFreshCredentials* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -460,7 +460,7 @@ If you disable this policy setting, delegation of fresh credentials is not permi ADMX Info: -- GP English name: *Allow delegating fresh credentials with NTLM-only server authentication* +- GP Friendly name: *Allow delegating fresh credentials with NTLM-only server authentication* - GP name: *AllowFreshCredentialsWhenNTLMOnly* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -542,7 +542,7 @@ If you disable this policy setting, delegation of saved credentials is not permi ADMX Info: -- GP English name: *Allow delegating saved credentials* +- GP Friendly name: *Allow delegating saved credentials* - GP name: *AllowSavedCredentials* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -624,7 +624,7 @@ If you disable this policy setting, delegation of saved credentials is not permi ADMX Info: -- GP English name: *Allow delegating saved credentials with NTLM-only server authentication* +- GP Friendly name: *Allow delegating saved credentials with NTLM-only server authentication* - GP name: *AllowSavedCredentialsWhenNTLMOnly* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -704,7 +704,7 @@ This policy setting can be used in combination with the "Allow delegating defaul ADMX Info: -- GP English name: *Deny delegating default credentials* +- GP Friendly name: *Deny delegating default credentials* - GP name: *DenyDefaultCredentials* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -784,7 +784,7 @@ This policy setting can be used in combination with the "Allow delegating fresh ADMX Info: -- GP English name: *Deny delegating fresh credentials* +- GP Friendly name: *Deny delegating fresh credentials* - GP name: *DenyFreshCredentials* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -864,7 +864,7 @@ This policy setting can be used in combination with the "Allow delegating saved ADMX Info: -- GP English name: *Deny delegating saved credentials* +- GP Friendly name: *Deny delegating saved credentials* - GP name: *DenySavedCredentials* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* @@ -945,7 +945,7 @@ If you disable or do not configure this policy setting, Restricted Admin and Rem ADMX Info: -- GP English name: *Restrict delegation of credentials to remote servers* +- GP Friendly name: *Restrict delegation of credentials to remote servers* - GP name: *RestrictedRemoteAdministration* - GP path: *System\Credentials Delegation* - GP ADMX file name: *CredSsp.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index f897258fbe..acb7942b92 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -96,7 +96,7 @@ If you disable or do not configure this policy setting, users will enter Windows ADMX Info: -- GP English name: *Require trusted path for credential entry* +- GP Friendly name: *Require trusted path for credential entry* - GP name: *EnableSecureCredentialPrompting* - GP path: *Windows Components\Credential User Interface* - GP ADMX file name: *CredUI.admx* @@ -161,7 +161,7 @@ Available in the latest Windows 10 Insider Preview Build. If you turn this polic ADMX Info: -- GP English name: *Prevent the use of security questions for local accounts* +- GP Friendly name: *Prevent the use of security questions for local accounts* - GP name: *NoLocalPasswordResetQuestions* - GP path: *Windows Components\Credential User Interface* - GP ADMX file name: *CredUI.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index b8b9047875..b42e1e9ad0 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -99,7 +99,7 @@ However, users are still able to change their password when prompted by the syst ADMX Info: -- GP English name: *Remove Change Password* +- GP Friendly name: *Remove Change Password* - GP name: *DisableChangePassword* - GP path: *System/Ctrl+Alt+Del Options* - GP ADMX file name: *CtrlAltDel.admx* @@ -174,7 +174,7 @@ If you disable or do not configure this policy setting, users will be able to lo ADMX Info: -- GP English name: *Remove Lock Computer* +- GP Friendly name: *Remove Lock Computer* - GP name: *DisableLockWorkstation* - GP path: *System/Ctrl+Alt+Del Options* - GP ADMX file name: *CtrlAltDel.admx* @@ -244,7 +244,7 @@ If you disable or do not configure this policy setting, users can access Task Ma ADMX Info: -- GP English name: *Remove Task Manager* +- GP Friendly name: *Remove Task Manager* - GP name: *DisableTaskMgr* - GP path: *System/Ctrl+Alt+Del Options* - GP ADMX file name: *CtrlAltDel.admx* @@ -315,7 +315,7 @@ If you disable or do not configure this policy setting, users can see and select ADMX Info: -- GP English name: *Remove Logoff* +- GP Friendly name: *Remove Logoff* - GP name: *NoLogoff* - GP path: *System/Ctrl+Alt+Del Options* - GP ADMX file name: *CtrlAltDel.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index 28d46d0d21..c2de3fdc86 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -90,7 +90,7 @@ If you disable or do not configure this policy setting, then Microsoft will not ADMX Info: -- GP English name: *Configure the Commercial ID* +- GP Friendly name: *Configure the Commercial ID* - GP name: *CommercialIdPolicy* - GP path: *Windows Components\Data Collection and Preview Builds* - GP ADMX file name: *DataCollection.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 60c1836ab2..4baa5a5da4 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -176,7 +176,7 @@ To see the filter bar, open Network Locations, click Entire Network, and then cl ADMX Info: -- GP English name: *Enable filter in Find dialog box* +- GP Friendly name: *Enable filter in Find dialog box* - GP name: *AD_EnableFilter* - GP path: *Desktop\Active Directory* - GP ADMX file name: *Desktop.admx* @@ -249,7 +249,7 @@ This setting is designed to let users search Active Directory but not tempt them ADMX Info: -- GP English name: *Hide Active Directory folder* +- GP Friendly name: *Hide Active Directory folder* - GP name: *AD_HideDirectoryFolder* - GP path: *Desktop\Active Directory* - GP ADMX file name: *Desktop.admx* @@ -320,7 +320,7 @@ This setting is designed to protect the network and the domain controller from t ADMX Info: -- GP English name: *Maximum size of Active Directory searches* +- GP Friendly name: *Maximum size of Active Directory searches* - GP name: *AD_QueryLimit* - GP path: *Desktop\Active Directory* - GP ADMX file name: *Desktop.admx* @@ -392,7 +392,7 @@ If you disable this setting or do not configure it, Active Desktop is disabled b ADMX Info: -- GP English name: *Enable Active Desktop* +- GP Friendly name: *Enable Active Desktop* - GP name: *ForceActiveDesktopOn* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -464,7 +464,7 @@ If you disable this setting or do not configure it, Active Desktop is disabled b ADMX Info: -- GP English name: *Disable Active Desktop* +- GP Friendly name: *Disable Active Desktop* - GP name: *NoActiveDesktop* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -531,7 +531,7 @@ This is a comprehensive setting that locks down the configuration you establish ADMX Info: -- GP English name: *Prohibit changes* +- GP Friendly name: *Prohibit changes* - GP name: *NoActiveDesktopChanges* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -600,7 +600,7 @@ Also, see "Items displayed in Places Bar" in User Configuration\Administrative T ADMX Info: -- GP English name: *Hide and disable all items on the desktop* +- GP Friendly name: *Hide and disable all items on the desktop* - GP name: *NoDesktop* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -672,7 +672,7 @@ If you disable this setting or do not configure it, the default behavior of the ADMX Info: -- GP English name: *Remove the Desktop Cleanup Wizard* +- GP Friendly name: *Remove the Desktop Cleanup Wizard* - GP name: *NoDesktopCleanupWizard* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -739,7 +739,7 @@ This setting does not prevent the user from starting Internet Explorer by using ADMX Info: -- GP English name: *Hide Internet Explorer icon on desktop* +- GP Friendly name: *Hide Internet Explorer icon on desktop* - GP name: *NoInternetIcon* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -813,7 +813,7 @@ If you do not configure this setting, the default is to display Computer as usua ADMX Info: -- GP English name: *Remove Computer icon on the desktop* +- GP Friendly name: *Remove Computer icon on the desktop* - GP name: *NoMyComputerIcon* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -887,7 +887,7 @@ This setting does not remove the My Documents icon from the Start menu. To do so ADMX Info: -- GP English name: *Remove My Documents icon on the desktop* +- GP Friendly name: *Remove My Documents icon on the desktop* - GP name: *NoMyDocumentsIcon* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -957,7 +957,7 @@ This setting only affects the desktop icon. It does not prevent users from conne ADMX Info: -- GP English name: *Hide Network Locations icon on desktop* +- GP Friendly name: *Hide Network Locations icon on desktop* - GP name: *NoNetHood* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1026,7 +1026,7 @@ If you disable or do not configure this setting, the Properties option is displa ADMX Info: -- GP English name: *Remove Properties from the Computer icon context menu* +- GP Friendly name: *Remove Properties from the Computer icon context menu* - GP name: *NoPropertiesMyComputer* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1099,7 +1099,7 @@ If you disable or do not configure this policy setting, the Properties menu comm ADMX Info: -- GP English name: *Remove Properties from the Documents icon context menu* +- GP Friendly name: *Remove Properties from the Documents icon context menu* - GP name: *NoPropertiesMyDocuments* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1168,7 +1168,7 @@ If you enable this setting, shared folders are not added to Network Locations au ADMX Info: -- GP English name: *Do not add shares of recently opened documents to Network Locations* +- GP Friendly name: *Do not add shares of recently opened documents to Network Locations* - GP name: *NoRecentDocsNetHood* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1240,7 +1240,7 @@ This setting does not prevent the user from using other methods to gain access t ADMX Info: -- GP English name: *Remove Recycle Bin icon from desktop* +- GP Friendly name: *Remove Recycle Bin icon from desktop* - GP name: *NoRecycleBinIcon* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1309,7 +1309,7 @@ If you disable or do not configure this setting, the Properties option is displa ADMX Info: -- GP English name: *Remove Properties from the Recycle Bin context menu* +- GP Friendly name: *Remove Properties from the Recycle Bin context menu* - GP name: *NoRecycleBinProperties* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1376,7 +1376,7 @@ If you enable this setting, users can change the desktop, but some changes, such ADMX Info: -- GP English name: *Don't save settings at exit* +- GP Friendly name: *Don't save settings at exit* - GP name: *NoSaveSettings* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1445,7 +1445,7 @@ If you disable or do not configure this policy, this window minimizing and resto ADMX Info: -- GP English name: *Turn off Aero Shake window minimizing mouse gesture* +- GP Friendly name: *Turn off Aero Shake window minimizing mouse gesture* - GP name: *NoWindowMinimizingShortcuts* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -1521,7 +1521,7 @@ Also, see the "Allow only bitmapped wallpaper" in the same location, and the "Pr ADMX Info: -- GP English name: *Desktop Wallpaper* +- GP Friendly name: *Desktop Wallpaper* - GP name: *Wallpaper* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -1590,7 +1590,7 @@ Also, see the "Disable all items" setting. ADMX Info: -- GP English name: *Prohibit adding items* +- GP Friendly name: *Prohibit adding items* - GP name: *sz_ATC_DisableAdd* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -1662,7 +1662,7 @@ If you enable this setting, items added to the desktop cannot be closed; they al ADMX Info: -- GP English name: *Prohibit closing items* +- GP Friendly name: *Prohibit closing items* - GP name: *sz_ATC_DisableClose* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -1733,7 +1733,7 @@ Also, see the "Prohibit closing items" and "Disable all items" settings. ADMX Info: -- GP English name: *Prohibit deleting items* +- GP Friendly name: *Prohibit deleting items* - GP name: *sz_ATC_DisableDel* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -1800,7 +1800,7 @@ This setting disables the Properties button on the Web tab in Display in Control ADMX Info: -- GP English name: *Prohibit editing items* +- GP Friendly name: *Prohibit editing items* - GP name: *sz_ATC_DisableEdit* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -1870,7 +1870,7 @@ This setting removes all Active Desktop items from the desktop. It also removes ADMX Info: -- GP English name: *Disable all items* +- GP Friendly name: *Disable all items* - GP name: *sz_ATC_NoComponents* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -1945,7 +1945,7 @@ You can also use this setting to delete particular Web-based items from users' d ADMX Info: -- GP English name: *Add/Delete items* +- GP Friendly name: *Add/Delete items* - GP name: *sz_AdminComponents_Title* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* @@ -2020,7 +2020,7 @@ Also, see the "Prohibit adjusting desktop toolbars" setting. ADMX Info: -- GP English name: *Prevent adding, dragging, dropping and closing the Taskbar's toolbars* +- GP Friendly name: *Prevent adding, dragging, dropping and closing the Taskbar's toolbars* - GP name: *sz_DB_DragDropClose* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -2092,7 +2092,7 @@ Also, see the "Prevent adding, dragging, dropping and closing the Taskbar's tool ADMX Info: -- GP English name: *Prohibit adjusting desktop toolbars* +- GP Friendly name: *Prohibit adjusting desktop toolbars* - GP name: *sz_DB_Moving* - GP path: *Desktop* - GP ADMX file name: *Desktop.admx* @@ -2159,7 +2159,7 @@ Also, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User ADMX Info: -- GP English name: *Allow only bitmapped wallpaper* +- GP Friendly name: *Allow only bitmapped wallpaper* - GP name: *sz_DWP_NoHTMLPaper* - GP path: *Desktop\Desktop* - GP ADMX file name: *Desktop.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index 6dbde4ba7a..470b11eb3f 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -111,7 +111,7 @@ If you disable or do not configure this policy setting, members of the Administr ADMX Info: -- GP English name: *Allow administrators to override Device Installation Restriction policies* +- GP Friendly name: *Allow administrators to override Device Installation Restriction policies* - GP name: *DeviceInstall_AllowAdminInstall* - GP path: *System\Device Installation\Device Installation Restrictions* - GP ADMX file name: *DeviceInstallation.admx* @@ -180,7 +180,7 @@ If you disable or do not configure this policy setting, Windows displays a defau ADMX Info: -- GP English name: *Display a custom message when installation is prevented by a policy setting* +- GP Friendly name: *Display a custom message when installation is prevented by a policy setting* - GP name: *DeviceInstall_DeniedPolicy_DetailText* - GP path: *System\Device Installation\Device Installation Restrictions* - GP ADMX file name: *DeviceInstallation.admx* @@ -249,7 +249,7 @@ If you disable or do not configure this policy setting, Windows displays a defau ADMX Info: -- GP English name: *Display a custom message title when device installation is prevented by a policy setting* +- GP Friendly name: *Display a custom message title when device installation is prevented by a policy setting* - GP name: *DeviceInstall_DeniedPolicy_SimpleText* - GP path: *System\Device Installation\Device Installation Restrictions* - GP ADMX file name: *DeviceInstallation.admx* @@ -318,7 +318,7 @@ If you disable or do not configure this policy setting, Windows waits 240 second ADMX Info: -- GP English name: *Configure device installation time-out* +- GP Friendly name: *Configure device installation time-out* - GP name: *DeviceInstall_InstallTimeout* - GP path: *System\Device Installation* - GP ADMX file name: *DeviceInstallation.admx* @@ -389,7 +389,7 @@ Note: If no reboot is forced, the device installation restriction right will not ADMX Info: -- GP English name: *Time (in seconds) to force reboot when required for policy changes to take effect* +- GP Friendly name: *Time (in seconds) to force reboot when required for policy changes to take effect* - GP name: *DeviceInstall_Policy_RebootTime* - GP path: *System\Device Installation\Device Installation Restrictions* - GP ADMX file name: *DeviceInstallation.admx* @@ -457,7 +457,7 @@ If you disable or do not configure this policy setting, Windows can install and ADMX Info: -- GP English name: *Prevent installation of removable devices* +- GP Friendly name: *Prevent installation of removable devices* - GP name: *DeviceInstall_Removable_Deny* - GP path: *System\Device Installation\Device Installation Restrictions* - GP ADMX file name: *DeviceInstallation.admx* @@ -526,7 +526,7 @@ If you disable or do not configure this policy setting, Windows creates a system ADMX Info: -- GP English name: *Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point* +- GP Friendly name: *Prevent creation of a system restore point during device activity that would normally prompt creation of a restore point* - GP name: *DeviceInstall_SystemRestore* - GP path: *System\Device Installation* - GP ADMX file name: *DeviceInstallation.admx* @@ -596,7 +596,7 @@ If you disable or do not configure this policy setting, only members of the Admi ADMX Info: -- GP English name: *Allow non-administrators to install drivers for these device setup classes* +- GP Friendly name: *Allow non-administrators to install drivers for these device setup classes* - GP name: *DriverInstall_Classes_AllowUser* - GP path: *System\Device Installation* - GP ADMX file name: *DeviceInstallation.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index 99a7d7da64..8816d46b2e 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -93,7 +93,7 @@ If you disable or do not configure this policy setting, "Found New Hardware" bal ADMX Info: -- GP English name: *Turn off "Found New Hardware" balloons during device installation* +- GP Friendly name: *Turn off "Found New Hardware" balloons during device installation* - GP name: *DeviceInstall_BalloonTips* - GP path: *System\Device Installation* - GP ADMX file name: *DeviceSetup.admx* @@ -164,7 +164,7 @@ If you disable or do not configure this policy setting, members of the Administr ADMX Info: -- GP English name: *Specify search order for device driver source locations* +- GP Friendly name: *Specify search order for device driver source locations* - GP name: *DriverSearchPlaces_SearchOrderConfiguration* - GP path: *System\Device Installation* - GP ADMX file name: *DeviceSetup.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md index 3bd65a3fa2..b41032d0f8 100644 --- a/windows/client-management/mdm/policy-csp-admx-digitallocker.md +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -95,7 +95,7 @@ If you disable or do not configure this setting, Digital Locker can be run. ADMX Info: -- GP English name: *Do not allow Digital Locker to run* +- GP Friendly name: *Do not allow Digital Locker to run* - GP name: *Digitalx_DiableApplication_TitleText_1* - GP path: *Windows Components/Digital Locker* - GP ADMX file name: *DigitalLocker.admx* @@ -166,7 +166,7 @@ If you disable or do not configure this setting, Digital Locker can be run. ADMX Info: -- GP English name: *Do not allow Digital Locker to run* +- GP Friendly name: *Do not allow Digital Locker to run* - GP name: *Digitalx_DiableApplication_TitleText_2* - GP path: *Windows Components/Digital Locker* - GP ADMX file name: *DigitalLocker.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md index d1e758c1e7..1151c3fbae 100644 --- a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md +++ b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md @@ -92,7 +92,7 @@ This policy should not be set unless the DLT server is running on all domain con ADMX Info: -- GP English name: *Allow Distributed Link Tracking clients to use domain resources* +- GP Friendly name: *Allow Distributed Link Tracking clients to use domain resources* - GP name: *DLT_AllowDomainMode* - GP path: *Windows\System!DLT_AllowDomainMode* - GP ADMX file name: *DistributedLinkTracking.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md index 9eab8af0c7..6d020b3a32 100644 --- a/windows/client-management/mdm/policy-csp-admx-dnsclient.md +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -153,7 +153,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Allow NetBT queries for fully qualified domain names* +- GP Friendly name: *Allow NetBT queries for fully qualified domain names* - GP name: *DNS_AllowFQDNNetBiosQueries* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -229,7 +229,7 @@ If you do not configure this policy setting, computers will use their local DNS ADMX Info: -- GP English name: *Allow DNS suffix appending to unqualified multi-label name queries* +- GP Friendly name: *Allow DNS suffix appending to unqualified multi-label name queries* - GP name: *DNS_AppendToMultiLabelName* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -298,7 +298,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Connection-specific DNS suffix* +- GP Friendly name: *Connection-specific DNS suffix* - GP name: *DNS_Domain* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -384,7 +384,7 @@ If you disable this policy setting or do not configure it, DNS clients use the d ADMX Info: -- GP English name: *Primary DNS suffix devolution level* +- GP Friendly name: *Primary DNS suffix devolution level* - GP name: *DNS_DomainNameDevolutionLevel* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -454,7 +454,7 @@ If this policy setting is disabled, or if this policy setting is not configured, ADMX Info: -- GP English name: *Turn off IDN encoding* +- GP Friendly name: *Turn off IDN encoding* - GP name: *DNS_IdnEncoding* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -523,7 +523,7 @@ If this policy setting is disabled, or if this policy setting is not configured, ADMX Info: -- GP English name: *IDN mapping* +- GP Friendly name: *IDN mapping* - GP name: *DNS_IdnMapping* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -594,7 +594,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *DNS servers* +- GP Friendly name: *DNS servers* - GP name: *DNS_NameServer* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -666,7 +666,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Prefer link local responses over DNS when received over a network with higher precedence* +- GP Friendly name: *Prefer link local responses over DNS when received over a network with higher precedence* - GP name: *DNS_PreferLocalResponsesOverLowerOrderDns* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -742,7 +742,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Primary DNS suffix* +- GP Friendly name: *Primary DNS suffix* - GP name: *DNS_PrimaryDnsSuffix* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -816,7 +816,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Register DNS records with connection-specific DNS suffix* +- GP Friendly name: *Register DNS records with connection-specific DNS suffix* - GP name: *DNS_RegisterAdapterName* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -892,7 +892,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Register PTR records* +- GP Friendly name: *Register PTR records* - GP name: *DNS_RegisterReverseLookup* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -961,7 +961,7 @@ If you disable this policy setting, computers may not use dynamic DNS registrati ADMX Info: -- GP English name: *Dynamic update* +- GP Friendly name: *Dynamic update* - GP name: *DNS_RegistrationEnabled* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1034,7 +1034,7 @@ If you disable this policy setting, existing A resource records that contain con ADMX Info: -- GP English name: *Replace addresses in conflicts* +- GP Friendly name: *Replace addresses in conflicts* - GP name: *DNS_RegistrationOverwritesInConflict* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1110,7 +1110,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Registration refresh interval* +- GP Friendly name: *Registration refresh interval* - GP name: *DNS_RegistrationRefreshInterval* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1181,7 +1181,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *TTL value for A and PTR records* +- GP Friendly name: *TTL value for A and PTR records* - GP name: *DNS_RegistrationTtl* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1256,7 +1256,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *DNS suffix search list* +- GP Friendly name: *DNS suffix search list* - GP name: *DNS_SearchList* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1326,7 +1326,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Turn off smart multi-homed name resolution* +- GP Friendly name: *Turn off smart multi-homed name resolution* - GP name: *DNS_SmartMultiHomedNameResolution* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1398,7 +1398,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Turn off smart protocol reordering* +- GP Friendly name: *Turn off smart protocol reordering* - GP name: *DNS_SmartProtocolReorder* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1473,7 +1473,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Update security level* +- GP Friendly name: *Update security level* - GP name: *DNS_UpdateSecurityLevel* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1544,7 +1544,7 @@ If you disable this policy setting, or if you do not configure this policy setti ADMX Info: -- GP English name: *Update top level domain zones* +- GP Friendly name: *Update top level domain zones* - GP name: *DNS_UpdateTopLevelDomainZones* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1631,7 +1631,7 @@ If you disable this policy setting, DNS clients do not attempt to resolve names ADMX Info: -- GP English name: *Primary DNS suffix devolution* +- GP Friendly name: *Primary DNS suffix devolution* - GP name: *DNS_UseDomainNameDevolution* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* @@ -1702,7 +1702,7 @@ If you disable this policy setting, or you do not configure this policy setting, ADMX Info: -- GP English name: *Turn off multicast name resolution* +- GP Friendly name: *Turn off multicast name resolution* - GP name: *Turn_Off_Multicast* - GP path: *Network/DNS Client* - GP ADMX file name: *DnsClient.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-dwm.md b/windows/client-management/mdm/policy-csp-admx-dwm.md index faa2117abe..ad2161edfc 100644 --- a/windows/client-management/mdm/policy-csp-admx-dwm.md +++ b/windows/client-management/mdm/policy-csp-admx-dwm.md @@ -108,7 +108,7 @@ If you disable or do not configure this policy setting, the default internal col ADMX Info: -- GP English name: *Specify a default color* +- GP Friendly name: *Specify a default color* - GP name: *DwmDefaultColorizationColor_1* - GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* - GP ADMX file name: *DWM.admx* @@ -181,7 +181,7 @@ If you disable or do not configure this policy setting, the default internal col ADMX Info: -- GP English name: *Specify a default color* +- GP Friendly name: *Specify a default color* - GP name: *DwmDefaultColorizationColor_2* - GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* - GP ADMX file name: *DWM.admx* @@ -252,7 +252,7 @@ Changing this policy setting requires a logoff for it to be applied. ADMX Info: -- GP English name: *Do not allow window animations* +- GP Friendly name: *Do not allow window animations* - GP name: *DwmDisallowAnimations_1* - GP path: *Windows Components/Desktop Window Manager* - GP ADMX file name: *DWM.admx* @@ -323,7 +323,7 @@ Changing this policy setting requires a logoff for it to be applied. ADMX Info: -- GP English name: *Do not allow window animations* +- GP Friendly name: *Do not allow window animations* - GP name: *DwmDisallowAnimations_2* - GP path: *Windows Components/Desktop Window Manager* - GP ADMX file name: *DWM.admx* @@ -395,7 +395,7 @@ If you disable or do not configure this policy setting, you allow users to chang ADMX Info: -- GP English name: *Do not allow color changes* +- GP Friendly name: *Do not allow color changes* - GP name: *DwmDisallowColorizationColorChanges_1* - GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* - GP ADMX file name: *DWM.admx* @@ -467,7 +467,7 @@ If you disable or do not configure this policy setting, you allow users to chang ADMX Info: -- GP English name: *Do not allow color changes* +- GP Friendly name: *Do not allow color changes* - GP name: *DwmDisallowColorizationColorChanges_2* - GP path: *Windows Components/Desktop Window Manager/Window Frame Coloring* - GP ADMX file name: *DWM.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-eaime.md b/windows/client-management/mdm/policy-csp-admx-eaime.md index 8a85ec79d6..454bd47f86 100644 --- a/windows/client-management/mdm/policy-csp-admx-eaime.md +++ b/windows/client-management/mdm/policy-csp-admx-eaime.md @@ -128,7 +128,7 @@ This policy setting applies to Japanese Microsoft IME only. ADMX Info: -- GP English name: *Do not include Non-Publishing Standard Glyph in the candidate list* +- GP Friendly name: *Do not include Non-Publishing Standard Glyph in the candidate list* - GP name: *L_DoNotIncludeNonPublishingStandardGlyphInTheCandidateList* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -214,7 +214,7 @@ This policy setting applies to Japanese Microsoft IME only. ADMX Info: -- GP English name: *Restrict character code range of conversion* +- GP Friendly name: *Restrict character code range of conversion* - GP name: *L_RestrictCharacterCodeRangeOfConversion* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -290,7 +290,7 @@ This policy setting is applied to Japanese Microsoft IME. ADMX Info: -- GP English name: *Turn off custom dictionary* +- GP Friendly name: *Turn off custom dictionary* - GP name: *L_TurnOffCustomDictionary* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -364,7 +364,7 @@ This policy setting applies to Japanese Microsoft IME only. ADMX Info: -- GP English name: *Turn off history-based predictive input* +- GP Friendly name: *Turn off history-based predictive input* - GP name: *L_TurnOffHistorybasedPredictiveInput* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -440,7 +440,7 @@ This policy setting applies to Japanese Microsoft IME. ADMX Info: -- GP English name: *Turn off Internet search integration* +- GP Friendly name: *Turn off Internet search integration* - GP name: *L_TurnOffInternetSearchIntegration* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -513,7 +513,7 @@ This policy setting is applied to Japanese Microsoft IME. ADMX Info: -- GP English name: *Turn off Open Extended Dictionary* +- GP Friendly name: *Turn off Open Extended Dictionary* - GP name: *L_TurnOffOpenExtendedDictionary* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -584,7 +584,7 @@ This policy setting applies to Japanese Microsoft IME only. ADMX Info: -- GP English name: *Turn off saving auto-tuning data to file* +- GP Friendly name: *Turn off saving auto-tuning data to file* - GP name: *L_TurnOffSavingAutoTuningDataToFile* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -657,7 +657,7 @@ This Policy setting applies to Microsoft CHS Pinyin IME and JPN IME. ADMX Info: -- GP English name: *Turn on cloud candidate* +- GP Friendly name: *Turn on cloud candidate* - GP name: *L_TurnOnCloudCandidate* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -730,7 +730,7 @@ This Policy setting applies only to Microsoft CHS Pinyin IME. ADMX Info: -- GP English name: *Turn on cloud candidate for CHS* +- GP Friendly name: *Turn on cloud candidate for CHS* - GP name: *L_TurnOnCloudCandidateCHS* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -803,7 +803,7 @@ This Policy setting applies only to Microsoft CHS Pinyin IME. ADMX Info: -- GP English name: *Turn on lexicon update* +- GP Friendly name: *Turn on lexicon update* - GP name: *L_TurnOnLexiconUpdate* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -876,7 +876,7 @@ This Policy setting applies only to Microsoft CHS Pinyin IME. ADMX Info: -- GP English name: *Turn on Live Sticker* +- GP Friendly name: *Turn on Live Sticker* - GP name: *L_TurnOnLiveStickers* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* @@ -947,7 +947,7 @@ This policy setting applies to Japanese Microsoft IME and Traditional Chinese IM ADMX Info: -- GP English name: *Turn on misconversion logging for misconversion report* +- GP Friendly name: *Turn on misconversion logging for misconversion report* - GP name: *L_TurnOnMisconversionLoggingForMisconversionReport* - GP path: *Windows Components\IME* - GP ADMX file name: *EAIME.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md index 96abbdd6f2..d5cdf442da 100644 --- a/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md +++ b/windows/client-management/mdm/policy-csp-admx-encryptfilesonmove.md @@ -92,7 +92,7 @@ This setting applies only to files moved within a volume. When files are moved t ADMX Info: -- GP English name: *Do not automatically encrypt files moved to encrypted folders* +- GP Friendly name: *Do not automatically encrypt files moved to encrypted folders* - GP name: *NoEncryptOnMove* - GP path: *System* - GP ADMX file name: *EncryptFilesonMove.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md index 01df1bdf33..a77d1438d2 100644 --- a/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md +++ b/windows/client-management/mdm/policy-csp-admx-enhancedstorage.md @@ -105,7 +105,7 @@ If you disable or do not configure this policy setting, all Enhanced Storage dev ADMX Info: -- GP English name: *Configure list of Enhanced Storage devices usable on your computer* +- GP Friendly name: *Configure list of Enhanced Storage devices usable on your computer* - GP name: *ApprovedEnStorDevices* - GP path: *System\Enhanced Storage Access* - GP ADMX file name: *EnhancedStorage.admx* @@ -174,7 +174,7 @@ If you disable or do not configure this policy setting, all IEEE 1667 silos on E ADMX Info: -- GP English name: *Configure list of IEEE 1667 silos usable on your computer* +- GP Friendly name: *Configure list of IEEE 1667 silos usable on your computer* - GP name: *ApprovedSilos* - GP path: *System\Enhanced Storage Access* - GP ADMX file name: *EnhancedStorage.admx* @@ -243,7 +243,7 @@ If you disable or do not configure this policy setting, a password can be used t ADMX Info: -- GP English name: *Do not allow password authentication of Enhanced Storage devices* +- GP Friendly name: *Do not allow password authentication of Enhanced Storage devices* - GP name: *DisablePasswordAuthentication* - GP path: *System\Enhanced Storage Access* - GP ADMX file name: *EnhancedStorage.admx* @@ -312,7 +312,7 @@ If you disable or do not configure this policy setting, non-Enhanced Storage rem ADMX Info: -- GP English name: *Do not allow non-Enhanced Storage removable devices* +- GP Friendly name: *Do not allow non-Enhanced Storage removable devices* - GP name: *DisallowLegacyDiskDevices* - GP path: *System\Enhanced Storage Access* - GP ADMX file name: *EnhancedStorage.admx* @@ -383,7 +383,7 @@ If you disable or do not configure this policy setting, the Enhanced Storage dev ADMX Info: -- GP English name: *Lock Enhanced Storage when the computer is locked* +- GP Friendly name: *Lock Enhanced Storage when the computer is locked* - GP name: *LockDeviceOnMachineLock* - GP path: *System\Enhanced Storage Access* - GP ADMX file name: *EnhancedStorage.admx* @@ -452,7 +452,7 @@ If you disable or do not configure this policy setting, USB Enhanced Storage dev ADMX Info: -- GP English name: *Allow only USB root hub connected Enhanced Storage devices* +- GP Friendly name: *Allow only USB root hub connected Enhanced Storage devices* - GP name: *RootHubConnectedEnStorDevices* - GP path: *System\Enhanced Storage Access* - GP ADMX file name: *EnhancedStorage.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-errorreporting.md b/windows/client-management/mdm/policy-csp-admx-errorreporting.md index 3757e328fa..f54ecfc994 100644 --- a/windows/client-management/mdm/policy-csp-admx-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-admx-errorreporting.md @@ -180,7 +180,7 @@ For related information, see the Configure Error Reporting and Report Operating ADMX Info: -- GP English name: *Default application reporting settings* +- GP Friendly name: *Default application reporting settings* - GP name: *PCH_AllOrNoneDef* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -251,7 +251,7 @@ If you disable or do not configure this policy setting, the Default application ADMX Info: -- GP English name: *List of applications to never report errors for* +- GP Friendly name: *List of applications to never report errors for* - GP name: *PCH_AllOrNoneEx* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -328,7 +328,7 @@ This setting will be ignored if the 'Configure Error Reporting' setting is disab ADMX Info: -- GP English name: *List of applications to always report errors for* +- GP Friendly name: *List of applications to always report errors for* - GP name: *PCH_AllOrNoneInc* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -418,7 +418,7 @@ See related policy settings Display Error Notification (same folder as this poli ADMX Info: -- GP English name: *Configure Error Reporting* +- GP Friendly name: *Configure Error Reporting* - GP name: *PCH_ConfigureReport* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -491,7 +491,7 @@ See also the Configure Error Reporting policy setting. ADMX Info: -- GP English name: *Report operating system errors* +- GP Friendly name: *Report operating system errors* - GP name: *PCH_ReportOperatingSystemFaults* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -560,7 +560,7 @@ If you disable or do not configure this policy setting, no Windows Error Reporti ADMX Info: -- GP English name: *Configure Report Archive* +- GP Friendly name: *Configure Report Archive* - GP name: *WerArchive_1* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -629,7 +629,7 @@ If you disable or do not configure this policy setting, no Windows Error Reporti ADMX Info: -- GP English name: *Configure Report Archive* +- GP Friendly name: *Configure Report Archive* - GP name: *WerArchive_2* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -698,7 +698,7 @@ If you disable this policy setting, then all memory dumps are uploaded according ADMX Info: -- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP Friendly name: *Automatically send memory dumps for OS-generated error reports* - GP name: *WerAutoApproveOSDumps_1* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -767,7 +767,7 @@ If you disable this policy setting, then all memory dumps are uploaded according ADMX Info: -- GP English name: *Automatically send memory dumps for OS-generated error reports* +- GP Friendly name: *Automatically send memory dumps for OS-generated error reports* - GP name: *WerAutoApproveOSDumps_2* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -836,7 +836,7 @@ If you disable or do not configure this policy setting, WER throttles data by de ADMX Info: -- GP English name: *Do not throttle additional data* +- GP Friendly name: *Do not throttle additional data* - GP name: *WerBypassDataThrottling_1* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -905,7 +905,7 @@ If you disable or do not configure this policy setting, WER throttles data by de ADMX Info: -- GP English name: *Do not throttle additional data* +- GP Friendly name: *Do not throttle additional data* - GP name: *WerBypassDataThrottling_2* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -974,7 +974,7 @@ If you disable or do not configure this policy setting, WER does not send data, ADMX Info: -- GP English name: *Send data when on connected to a restricted/costed network* +- GP Friendly name: *Send data when on connected to a restricted/costed network* - GP name: *WerBypassNetworkCostThrottling_1* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -1043,7 +1043,7 @@ If you disable or do not configure this policy setting, WER does not send data, ADMX Info: -- GP English name: *Send data when on connected to a restricted/costed network* +- GP Friendly name: *Send data when on connected to a restricted/costed network* - GP name: *WerBypassNetworkCostThrottling_2* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -1112,7 +1112,7 @@ If you disable or do not configure this policy setting, WER checks for solutions ADMX Info: -- GP English name: *Send additional data when on battery power* +- GP Friendly name: *Send additional data when on battery power* - GP name: *WerBypassPowerThrottling_1* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -1181,7 +1181,7 @@ If you disable or do not configure this policy setting, WER checks for solutions ADMX Info: -- GP English name: *Send additional data when on battery power* +- GP Friendly name: *Send additional data when on battery power* - GP name: *WerBypassPowerThrottling_2* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -1250,7 +1250,7 @@ If you disable or do not configure this policy setting, Windows Error Reporting ADMX Info: -- GP English name: *Configure Corporate Windows Error Reporting* +- GP Friendly name: *Configure Corporate Windows Error Reporting* - GP name: *WerCER* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -1329,7 +1329,7 @@ If you disable or do not configure this policy setting, then the default consent ADMX Info: -- GP English name: *Customize consent settings* +- GP Friendly name: *Customize consent settings* - GP name: *WerConsentCustomize_1* - GP path: *Windows Components\Windows Error Reporting\Consent* - GP ADMX file name: *ErrorReporting.admx* @@ -1398,7 +1398,7 @@ If you disable or do not configure this policy setting, custom consent policy se ADMX Info: -- GP English name: *Ignore custom consent settings* +- GP Friendly name: *Ignore custom consent settings* - GP name: *WerConsentOverride_1* - GP path: *Windows Components\Windows Error Reporting\Consent* - GP ADMX file name: *ErrorReporting.admx* @@ -1467,7 +1467,7 @@ If you disable or do not configure this policy setting, custom consent policy se ADMX Info: -- GP English name: *Ignore custom consent settings* +- GP Friendly name: *Ignore custom consent settings* - GP name: *WerConsentOverride_2* - GP path: *Windows Components\Windows Error Reporting\Consent* - GP ADMX file name: *ErrorReporting.admx* @@ -1621,7 +1621,7 @@ If this policy setting is disabled or not configured, then the consent level def ADMX Info: -- GP English name: *Configure Default consent* +- GP Friendly name: *Configure Default consent* - GP name: *WerDefaultConsent_2* - GP path: *Windows Components\Windows Error Reporting\Consent* - GP ADMX file name: *ErrorReporting.admx* @@ -1760,7 +1760,7 @@ If you disable or do not configure this policy setting, errors are reported on a ADMX Info: -- GP English name: *List of applications to be excluded* +- GP Friendly name: *List of applications to be excluded* - GP name: *WerExlusion_1* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -1829,7 +1829,7 @@ If you disable or do not configure this policy setting, errors are reported on a ADMX Info: -- GP English name: *List of applications to be excluded* +- GP Friendly name: *List of applications to be excluded* - GP name: *WerExlusion_2* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -1898,7 +1898,7 @@ If you disable or do not configure this policy setting, Windows Error Reporting ADMX Info: -- GP English name: *Disable logging* +- GP Friendly name: *Disable logging* - GP name: *WerNoLogging_1* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -1967,7 +1967,7 @@ If you disable or do not configure this policy setting, Windows Error Reporting ADMX Info: -- GP English name: *Disable logging* +- GP Friendly name: *Disable logging* - GP name: *WerNoLogging_2* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -2036,7 +2036,7 @@ If you disable or do not configure this policy setting, then consent policy sett ADMX Info: -- GP English name: *Do not send additional data* +- GP Friendly name: *Do not send additional data* - GP name: *WerNoSecondLevelData_1* - GP path: *Windows Components\Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -2107,7 +2107,7 @@ If you disable or do not configure this policy setting, Windows Error Reporting ADMX Info: -- GP English name: *Configure Report Queue* +- GP Friendly name: *Configure Report Queue* - GP name: *WerQueue_1* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* @@ -2178,7 +2178,7 @@ If you disable or do not configure this policy setting, Windows Error Reporting ADMX Info: -- GP English name: *Configure Report Queue* +- GP Friendly name: *Configure Report Queue* - GP name: *WerQueue_2* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *ErrorReporting.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md index f07d3af050..bd419345c7 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventforwarding.md +++ b/windows/client-management/mdm/policy-csp-admx-eventforwarding.md @@ -96,7 +96,7 @@ This setting applies across all subscriptions for the forwarder (source computer ADMX Info: -- GP English name: *Configure forwarder resource usage* +- GP Friendly name: *Configure forwarder resource usage* - GP name: *ForwarderResourceUsage* - GP path: *Windows Components/Event Forwarding* - GP ADMX file name: *EventForwarding.admx* @@ -176,7 +176,7 @@ If you disable or do not configure this policy setting, the Event Collector comp ADMX Info: -- GP English name: *Configure target Subscription Manager* +- GP Friendly name: *Configure target Subscription Manager* - GP name: *SubscriptionManager* - GP path: *Windows Components/Event Forwarding* - GP ADMX file name: *EventForwarding.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-eventlog.md b/windows/client-management/mdm/policy-csp-admx-eventlog.md index bdeee9c870..7c171edf2e 100644 --- a/windows/client-management/mdm/policy-csp-admx-eventlog.md +++ b/windows/client-management/mdm/policy-csp-admx-eventlog.md @@ -150,7 +150,7 @@ If the policy setting is disabled, then no new events can be logged. Events can ADMX Info: -- GP English name: *Turn on logging* +- GP Friendly name: *Turn on logging* - GP name: *Channel_LogEnabled* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -219,7 +219,7 @@ If you disable or do not configure this policy setting, the Event Log uses the f ADMX Info: -- GP English name: *Control the location of the log file* +- GP Friendly name: *Control the location of the log file* - GP name: *Channel_LogFilePath_1* - GP path: *Windows Components\Event Log Service\Application* - GP ADMX file name: *EventLog.admx* @@ -288,7 +288,7 @@ If you disable or do not configure this policy setting, the Event Log uses the f ADMX Info: -- GP English name: *Control the location of the log file* +- GP Friendly name: *Control the location of the log file* - GP name: *Channel_LogFilePath_2* - GP path: *Windows Components\Event Log Service\Security* - GP ADMX file name: *EventLog.admx* @@ -357,7 +357,7 @@ If you disable or do not configure this policy setting, the Event Log uses the f ADMX Info: -- GP English name: *Control the location of the log file* +- GP Friendly name: *Control the location of the log file* - GP name: *Channel_LogFilePath_3* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -426,7 +426,7 @@ If you disable or do not configure this policy setting, the Event Log uses the f ADMX Info: -- GP English name: *Turn on logging* +- GP Friendly name: *Turn on logging* - GP name: *Channel_LogFilePath_4* - GP path: *Windows Components\Event Log Service\System* - GP ADMX file name: *EventLog.admx* @@ -495,7 +495,7 @@ If you disable or do not configure this policy setting, the maximum size of the ADMX Info: -- GP English name: *Specify the maximum log file size (KB)* +- GP Friendly name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_3* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -566,7 +566,7 @@ If you do not configure this policy setting and the "Retain old events" policy s ADMX Info: -- GP English name: *Back up log automatically when full* +- GP Friendly name: *Back up log automatically when full* - GP name: *Channel_Log_AutoBackup_1* - GP path: *Windows Components\Event Log Service\Application* - GP ADMX file name: *EventLog.admx* @@ -637,7 +637,7 @@ If you do not configure this policy setting and the "Retain old events" policy s ADMX Info: -- GP English name: *Back up log automatically when full* +- GP Friendly name: *Back up log automatically when full* - GP name: *Channel_Log_AutoBackup_2* - GP path: *Windows Components\Event Log Service\Security* - GP ADMX file name: *EventLog.admx* @@ -708,7 +708,7 @@ If you do not configure this policy setting and the "Retain old events" policy s ADMX Info: -- GP English name: *Back up log automatically when full* +- GP Friendly name: *Back up log automatically when full* - GP name: *Channel_Log_AutoBackup_3* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -779,7 +779,7 @@ If you do not configure this policy setting and the "Retain old events" policy s ADMX Info: -- GP English name: *Back up log automatically when full* +- GP Friendly name: *Back up log automatically when full* - GP name: *Channel_Log_AutoBackup_4* - GP path: *Windows Components\Event Log Service\System* - GP ADMX file name: *EventLog.admx* @@ -851,7 +851,7 @@ If you disable or do not configure this policy setting, all authenticated users ADMX Info: -- GP English name: *Configure log access* +- GP Friendly name: *Configure log access* - GP name: *Channel_Log_FileLogAccess_1* - GP path: *Windows Components\Event Log Service\Application* - GP ADMX file name: *EventLog.admx* @@ -923,7 +923,7 @@ If you disable or do not configure this policy setting, only system software and ADMX Info: -- GP English name: *Configure log access* +- GP Friendly name: *Configure log access* - GP name: *Channel_Log_FileLogAccess_2* - GP path: *Windows Components\Event Log Service\Security* - GP ADMX file name: *EventLog.admx* @@ -995,7 +995,7 @@ If you disable or do not configure this policy setting, all authenticated users ADMX Info: -- GP English name: *Configure log access* +- GP Friendly name: *Configure log access* - GP name: *Channel_Log_FileLogAccess_3* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -1067,7 +1067,7 @@ If you disable or do not configure this policy setting, only system software and ADMX Info: -- GP English name: *Configure log access* +- GP Friendly name: *Configure log access* - GP name: *Channel_Log_FileLogAccess_4* - GP path: *Windows Components\Event Log Service\System* - GP ADMX file name: *EventLog.admx* @@ -1138,7 +1138,7 @@ If you do not configure this policy setting, the previous policy setting configu ADMX Info: -- GP English name: *Configure log access (legacy)* +- GP Friendly name: *Configure log access (legacy)* - GP name: *Channel_Log_FileLogAccess_5* - GP path: *Windows Components\Event Log Service\Application* - GP ADMX file name: *EventLog.admx* @@ -1209,7 +1209,7 @@ If you do not configure this policy setting, the previous policy setting configu ADMX Info: -- GP English name: *Configure log access (legacy)* +- GP Friendly name: *Configure log access (legacy)* - GP name: *Channel_Log_FileLogAccess_6* - GP path: *Windows Components\Event Log Service\Security* - GP ADMX file name: *EventLog.admx* @@ -1280,7 +1280,7 @@ If you do not configure this policy setting, the previous policy setting configu ADMX Info: -- GP English name: *Configure log access (legacy)* +- GP Friendly name: *Configure log access (legacy)* - GP name: *Channel_Log_FileLogAccess_7* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -1351,7 +1351,7 @@ If you do not configure this policy setting, the previous policy setting configu ADMX Info: -- GP English name: *Configure log access (legacy)* +- GP Friendly name: *Configure log access (legacy)* - GP name: *Channel_Log_FileLogAccess_8* - GP path: *Windows Components\Event Log Service\System* - GP ADMX file name: *EventLog.admx* @@ -1422,7 +1422,7 @@ Note: Old events may or may not be retained according to the "Backup log automat ADMX Info: -- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP Friendly name: *Control Event Log behavior when the log file reaches its maximum size* - GP name: *Channel_Log_Retention_2* - GP path: *Windows Components\Event Log Service\Security* - GP ADMX file name: *EventLog.admx* @@ -1493,7 +1493,7 @@ Note: Old events may or may not be retained according to the "Backup log automat ADMX Info: -- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP Friendly name: *Control Event Log behavior when the log file reaches its maximum size* - GP name: *Channel_Log_Retention_3* - GP path: *Windows Components\Event Log Service\Setup* - GP ADMX file name: *EventLog.admx* @@ -1564,7 +1564,7 @@ Note: Old events may or may not be retained according to the "Backup log automat ADMX Info: -- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP Friendly name: *Control Event Log behavior when the log file reaches its maximum size* - GP name: *Channel_Log_Retention_4* - GP path: *Windows Components\Event Log Service\System* - GP ADMX file name: *EventLog.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-explorer.md b/windows/client-management/mdm/policy-csp-admx-explorer.md index 36140f5eeb..be619c2c3b 100644 --- a/windows/client-management/mdm/policy-csp-admx-explorer.md +++ b/windows/client-management/mdm/policy-csp-admx-explorer.md @@ -98,7 +98,7 @@ Available in the latest Windows 10 Insider Preview Build. Sets the target of the ADMX Info: -- GP English name: *Set a support web page link* +- GP Friendly name: *Set a support web page link* - GP name: *AdminInfoUrl* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Explorer.admx* @@ -173,7 +173,7 @@ If you disable or do not configure this policy setting, the menu bar will not be ADMX Info: -- GP English name: *Display the menu bar in File Explorer* +- GP Friendly name: *Display the menu bar in File Explorer* - GP name: *AlwaysShowClassicMenu* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Explorer.admx* @@ -240,7 +240,7 @@ If you enable this policy setting on a machine that does not contain all program ADMX Info: -- GP English name: *Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time* +- GP Friendly name: *Do not reinitialize a pre-existing roamed user profile when it is loaded on a machine for the first time* - GP name: *DisableRoamedProfileInit* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Explorer.admx* @@ -312,7 +312,7 @@ If you disable or do not configure this policy setting, users will be able to ad ADMX Info: -- GP English name: *Prevent users from adding files to the root of their Users Files folder.* +- GP Friendly name: *Prevent users from adding files to the root of their Users Files folder.* - GP name: *PreventItemCreationInUsersFilesFolder* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Explorer.admx* @@ -377,7 +377,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy is similar ADMX Info: -- GP English name: *Turn off common control and window animations* +- GP Friendly name: *Turn off common control and window animations* - GP name: *TurnOffSPIAnimations* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Explorer.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md index 856646d7d1..2896e4cc5a 100644 --- a/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md +++ b/windows/client-management/mdm/policy-csp-admx-fileservervssprovider.md @@ -93,7 +93,7 @@ By default, the RPC protocol message between File Server VSS provider and File S ADMX Info: -- GP English name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.* +- GP Friendly name: *Allow or Disallow use of encryption to protect the RPC protocol messages between File Share Shadow Copy Provider running on application server and File Share Shadow Copy Agent running on the file servers.* - GP name: *Pol_EncryptProtocol* - GP path: *System/File Share Shadow Copy Provider* - GP ADMX file name: *FileServerVSSProvider.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-filesys.md b/windows/client-management/mdm/policy-csp-admx-filesys.md index b3759a2b16..079c55e92e 100644 --- a/windows/client-management/mdm/policy-csp-admx-filesys.md +++ b/windows/client-management/mdm/policy-csp-admx-filesys.md @@ -105,7 +105,7 @@ Available in the latest Windows 10 Insider Preview Build. Compression can add to ADMX Info: -- GP English name: *Do not allow compression on all NTFS volumes* +- GP Friendly name: *Do not allow compression on all NTFS volumes* - GP name: *DisableCompression* - GP path: *System/Filesystem/NTFS* - GP ADMX file name: *FileSys.admx* @@ -173,7 +173,7 @@ A value of 1 will disable delete notifications for all volumes. ADMX Info: -- GP English name: *Disable delete notifications on all volumes* +- GP Friendly name: *Disable delete notifications on all volumes* - GP name: *DisableDeleteNotification* - GP path: *System/Filesystem* - GP ADMX file name: *FileSys.admx* @@ -236,7 +236,7 @@ Available in the latest Windows 10 Insider Preview Build. Encryption can add to ADMX Info: -- GP English name: *Do not allow encryption on all NTFS volumes* +- GP Friendly name: *Do not allow encryption on all NTFS volumes* - GP name: *DisableEncryption* - GP path: *System/Filesystem/NTFS* - GP ADMX file name: *FileSys.admx* @@ -299,7 +299,7 @@ Available in the latest Windows 10 Insider Preview Build. Encrypting the page fi ADMX Info: -- GP English name: *Enable NTFS pagefile encryption* +- GP Friendly name: *Enable NTFS pagefile encryption* - GP name: *EnablePagefileEncryption* - GP path: *System/Filesystem/NTFS* - GP ADMX file name: *FileSys.admx* @@ -362,7 +362,7 @@ Available in the latest Windows 10 Insider Preview Build. Enabling Win32 long pa ADMX Info: -- GP English name: *Enable Win32 long paths* +- GP Friendly name: *Enable Win32 long paths* - GP name: *LongPathsEnabled* - GP path: *System/Filesystem* - GP ADMX file name: *FileSys.admx* @@ -427,7 +427,7 @@ If you enable short names on all volumes then short names will always be generat ADMX Info: -- GP English name: *Short name creation options* +- GP Friendly name: *Short name creation options* - GP name: *ShortNameCreationSettings* - GP path: *System/Filesystem/NTFS* - GP ADMX file name: *FileSys.admx* @@ -501,7 +501,7 @@ For more information, refer to the Windows Help section. ADMX Info: -- GP English name: *Selectively allow the evaluation of a symbolic link* +- GP Friendly name: *Selectively allow the evaluation of a symbolic link* - GP name: *SymlinkEvaluation* - GP path: *System/Filesystem* - GP ADMX file name: *FileSys.admx* @@ -564,7 +564,7 @@ Available in the latest Windows 10 Insider Preview Build. TXF deprecated feature ADMX Info: -- GP English name: *Enable / disable TXF deprecated features* +- GP Friendly name: *Enable / disable TXF deprecated features* - GP name: *TxfDeprecatedFunctionality* - GP path: *System/Filesystem/NTFS* - GP ADMX file name: *FileSys.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-folderredirection.md b/windows/client-management/mdm/policy-csp-admx-folderredirection.md index cfada38cac..ed28fb4638 100644 --- a/windows/client-management/mdm/policy-csp-admx-folderredirection.md +++ b/windows/client-management/mdm/policy-csp-admx-folderredirection.md @@ -114,7 +114,7 @@ If you disable or do not configure this policy setting, redirected shell folders ADMX Info: -- GP English name: *Do not automatically make all redirected folders available offline* +- GP Friendly name: *Do not automatically make all redirected folders available offline* - GP name: *DisableFRAdminPin* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* @@ -187,7 +187,7 @@ If you disable or do not configure this policy setting, all redirected shell fol ADMX Info: -- GP English name: *Do not automatically make specific redirected folders available offline* +- GP Friendly name: *Do not automatically make specific redirected folders available offline* - GP name: *DisableFRAdminPinByFolder* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* @@ -256,7 +256,7 @@ If you disable or do not configure this policy setting, when the path to a redir ADMX Info: -- GP English name: *Enable optimized move of contents in Offline Files cache on Folder Redirection server path change* +- GP Friendly name: *Enable optimized move of contents in Offline Files cache on Folder Redirection server path change* - GP name: *FolderRedirectionEnableCacheRename* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* @@ -328,7 +328,7 @@ If you disable or not configure this policy setting, Windows Vista, Windows 7, W ADMX Info: -- GP English name: *Use localized subfolder names when redirecting Start Menu and My Documents* +- GP Friendly name: *Use localized subfolder names when redirecting Start Menu and My Documents* - GP name: *LocalizeXPRelativePaths_1* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* @@ -400,7 +400,7 @@ If you disable or not configure this policy setting, Windows Vista, Windows 7, W ADMX Info: -- GP English name: *Use localized subfolder names when redirecting Start Menu and My Documents* +- GP Friendly name: *Use localized subfolder names when redirecting Start Menu and My Documents* - GP name: *LocalizeXPRelativePaths_2* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* @@ -473,7 +473,7 @@ If you disable or do not configure this policy setting and the user has redirect ADMX Info: -- GP English name: *Redirect folders on primary computers only* +- GP Friendly name: *Redirect folders on primary computers only* - GP name: *PrimaryComputer_FR_1* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* @@ -546,7 +546,7 @@ If you disable or do not configure this policy setting and the user has redirect ADMX Info: -- GP English name: *Redirect folders on primary computers only* +- GP Friendly name: *Redirect folders on primary computers only* - GP name: *PrimaryComputer_FR_2* - GP path: *System/Folder Redirection* - GP ADMX file name: *FolderRedirection.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-globalization.md b/windows/client-management/mdm/policy-csp-admx-globalization.md index b37e84f406..857ff5d89f 100644 --- a/windows/client-management/mdm/policy-csp-admx-globalization.md +++ b/windows/client-management/mdm/policy-csp-admx-globalization.md @@ -161,7 +161,7 @@ If the policy is Disabled or Not Configured, then the user will be able to use i ADMX Info: -- GP English name: *Disallow copying of user input methods to the system account for sign-in* +- GP Friendly name: *Disallow copying of user input methods to the system account for sign-in* - GP name: *BlockUserInputMethodsForSignIn* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -238,7 +238,7 @@ To set this policy setting on a per-user basis, make sure that you do not config ADMX Info: -- GP English name: *Disallow selection of Custom Locales* +- GP Friendly name: *Disallow selection of Custom Locales* - GP name: *CustomLocalesNoSelect_1* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -315,7 +315,7 @@ To set this policy setting on a per-user basis, make sure that you do not config ADMX Info: -- GP English name: *Disallow selection of Custom Locales* +- GP Friendly name: *Disallow selection of Custom Locales* - GP name: *CustomLocalesNoSelect_2* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -392,7 +392,7 @@ If you disable or do not configure this policy setting, the user can see the Adm ADMX Info: -- GP English name: *Hide Regional and Language Options administrative options* +- GP Friendly name: *Hide Regional and Language Options administrative options* - GP name: *HideAdminOptions* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -466,7 +466,7 @@ If you disable or do not configure this policy setting, the user sees the option ADMX Info: -- GP English name: *Hide the geographic location option* +- GP Friendly name: *Hide the geographic location option* - GP name: *HideCurrentLocation* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -539,7 +539,7 @@ If you enable this policy setting, the user does not see the option for changing ADMX Info: -- GP English name: *Hide the select language group options* +- GP Friendly name: *Hide the select language group options* - GP name: *HideLanguageSelection* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -610,7 +610,7 @@ If you disable or do not configure this policy setting, the user sees the region ADMX Info: -- GP English name: *Hide user locale selection and customization options* +- GP Friendly name: *Hide user locale selection and customization options* - GP name: *HideLocaleSelectAndCustomize* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -693,7 +693,7 @@ This policy setting is related to the "Turn off handwriting personalization" pol ADMX Info: -- GP English name: *Turn off automatic learning* +- GP Friendly name: *Turn off automatic learning* - GP name: *ImplicitDataCollectionOff_1* - GP path: *Control Panel\Regional and Language Options\Handwriting personalization* - GP ADMX file name: *Globalization.admx* @@ -776,7 +776,7 @@ This policy setting is related to the "Turn off handwriting personalization" pol ADMX Info: -- GP English name: *Turn off automatic learning* +- GP Friendly name: *Turn off automatic learning* - GP name: *ImplicitDataCollectionOff_2* - GP path: *Control Panel\Regional and Language Options\Handwriting personalization* - GP ADMX file name: *Globalization.admx* @@ -847,7 +847,7 @@ If you disable or do not configure this policy setting, administrators can selec ADMX Info: -- GP English name: *Restrict system locales* +- GP Friendly name: *Restrict system locales* - GP name: *LocaleSystemRestrict* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -920,7 +920,7 @@ If you disable or do not configure this policy setting, users can select any loc ADMX Info: -- GP English name: *Restrict user locales* +- GP Friendly name: *Restrict user locales* - GP name: *LocaleUserRestrict_1* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -995,7 +995,7 @@ If this policy setting is enabled at the computer level, it cannot be disabled b ADMX Info: -- GP English name: *Restrict user locales* +- GP Friendly name: *Restrict user locales* - GP name: *LocaleUserRestrict_2* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -1066,7 +1066,7 @@ If you disable or do not configure this policy setting, the user can specify whi ADMX Info: -- GP English name: *Restricts the UI language Windows uses for all logged users* +- GP Friendly name: *Restricts the UI language Windows uses for all logged users* - GP name: *LockMachineUILanguage* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1139,7 +1139,7 @@ To enable this policy setting in Windows Server 2003, Windows XP, or Windows 200 ADMX Info: -- GP English name: *Restricts the UI languages Windows should use for the selected user* +- GP Friendly name: *Restricts the UI languages Windows should use for the selected user* - GP name: *LockUserUILanguage* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1212,7 +1212,7 @@ To set this policy setting on a per-user basis, make sure that the per-computer ADMX Info: -- GP English name: *Disallow changing of geographic location* +- GP Friendly name: *Disallow changing of geographic location* - GP name: *PreventGeoIdChange_1* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -1285,7 +1285,7 @@ To set this policy setting on a per-user basis, make sure that the per-computer ADMX Info: -- GP English name: *Disallow changing of geographic location* +- GP Friendly name: *Disallow changing of geographic location* - GP name: *PreventGeoIdChange_2* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -1362,7 +1362,7 @@ To set this policy on a per-user basis, make sure that the per-computer policy i ADMX Info: -- GP English name: *Disallow user override of locale settings* +- GP Friendly name: *Disallow user override of locale settings* - GP name: *PreventUserOverrides_1* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -1439,7 +1439,7 @@ To set this policy on a per-user basis, make sure that the per-computer policy i ADMX Info: -- GP English name: *Disallow user override of locale settings* +- GP Friendly name: *Disallow user override of locale settings* - GP name: *PreventUserOverrides_2* - GP path: *System\Locale Services* - GP ADMX file name: *Globalization.admx* @@ -1510,7 +1510,7 @@ If you disable or do not configure this policy setting, the logged-on user can a ADMX Info: -- GP English name: *Restrict selection of Windows menus and dialogs language* +- GP Friendly name: *Restrict selection of Windows menus and dialogs language* - GP name: *RestrictUILangSelect* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1582,7 +1582,7 @@ Note that the availability and function of this setting is dependent on supporte ADMX Info: -- GP English name: *Turn off autocorrect misspelled words* +- GP Friendly name: *Turn off autocorrect misspelled words* - GP name: *TurnOffAutocorrectMisspelledWords* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1655,7 +1655,7 @@ Note that the availability and function of this setting is dependent on supporte ADMX Info: -- GP English name: *Turn off highlight misspelled words* +- GP Friendly name: *Turn off highlight misspelled words* - GP name: *TurnOffHighlightMisspelledWords* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1727,7 +1727,7 @@ Note that the availability and function of this setting is dependent on supporte ADMX Info: -- GP English name: *Turn off insert a space after selecting a text prediction* +- GP Friendly name: *Turn off insert a space after selecting a text prediction* - GP name: *TurnOffInsertSpace* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1800,7 +1800,7 @@ Note that the availability and function of this setting is dependent on supporte ADMX Info: -- GP English name: *Turn off offer text predictions as I type* +- GP Friendly name: *Turn off offer text predictions as I type* - GP name: *TurnOffOfferTextPredictions* - GP path: *Control Panel\Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -1873,7 +1873,7 @@ If you disable or do not configure this policy setting, Windows does not interpr ADMX Info: -- GP English name: *Century interpretation for Year 2000* +- GP Friendly name: *Century interpretation for Year 2000* - GP name: *Y2K* - GP path: *System* - GP ADMX file name: *Globalization.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md index 45abf7cdd0..cbb70f971a 100644 --- a/windows/client-management/mdm/policy-csp-admx-grouppolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-grouppolicy.md @@ -225,7 +225,7 @@ If you disable this policy setting, the behavior is the same as if it is not con ADMX Info: -- GP English name: *Allow cross-forest user policy and roaming user profiles* +- GP Friendly name: *Allow cross-forest user policy and roaming user profiles* - GP name: *AllowX-ForestPolicy-and-RUP* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -300,7 +300,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure software Installation policy processing* +- GP Friendly name: *Configure software Installation policy processing* - GP name: *CSE_AppMgmt* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -377,7 +377,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure disk quota policy processing* +- GP Friendly name: *Configure disk quota policy processing* - GP name: *CSE_DiskQuota* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -454,7 +454,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure EFS recovery policy processing* +- GP Friendly name: *Configure EFS recovery policy processing* - GP name: *CSE_EFSRecovery* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -529,7 +529,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure folder redirection policy processing* +- GP Friendly name: *Configure folder redirection policy processing* - GP name: *CSE_FolderRedirection* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -606,7 +606,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure Internet Explorer Maintenance policy processing* +- GP Friendly name: *Configure Internet Explorer Maintenance policy processing* - GP name: *CSE_IEM* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -683,7 +683,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure IP security policy processing* +- GP Friendly name: *Configure IP security policy processing* - GP name: *CSE_IPSecurity* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -756,7 +756,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure registry policy processing* +- GP Friendly name: *Configure registry policy processing* - GP name: *CSE_Registry* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -831,7 +831,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure scripts policy processing* +- GP Friendly name: *Configure scripts policy processing* - GP name: *CSE_Scripts* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -906,7 +906,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure security policy processing* +- GP Friendly name: *Configure security policy processing* - GP name: *CSE_Security* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -985,7 +985,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure wired policy processing* +- GP Friendly name: *Configure wired policy processing* - GP name: *CSE_Wired* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1064,7 +1064,7 @@ The "Process even if the Group Policy objects have not changed" option updates a ADMX Info: -- GP English name: *Configure wireless policy processing* +- GP Friendly name: *Configure wireless policy processing* - GP name: *CSE_Wireless* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1133,7 +1133,7 @@ If you disable or do not configure this policy setting, Group Policy will use th ADMX Info: -- GP English name: *Specify workplace connectivity wait time for policy processing* +- GP Friendly name: *Specify workplace connectivity wait time for policy processing* - GP name: *CorpConnSyncWaitTime* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1211,7 +1211,7 @@ If you disable or do not configure this policy setting, interactive users can ge ADMX Info: -- GP English name: *Determine if interactive users can generate Resultant Set of Policy data* +- GP Friendly name: *Determine if interactive users can generate Resultant Set of Policy data* - GP name: *DenyRsopToInteractiveUser_1* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1289,7 +1289,7 @@ If you disable or do not configure this policy setting, interactive users can ge ADMX Info: -- GP English name: *Determine if interactive users can generate Resultant Set of Policy data* +- GP Friendly name: *Determine if interactive users can generate Resultant Set of Policy data* - GP name: *DenyRsopToInteractiveUser_2* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1354,7 +1354,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting pr ADMX Info: -- GP English name: *Turn off Group Policy Client Service AOAC optimization* +- GP Friendly name: *Turn off Group Policy Client Service AOAC optimization* - GP name: *DisableAOACProcessing* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1434,7 +1434,7 @@ Files will always be copied to the GPO if they have a later timestamp. ADMX Info: -- GP English name: *Turn off automatic update of ADM files* +- GP Friendly name: *Turn off automatic update of ADM files* - GP name: *DisableAutoADMUpdate* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1506,7 +1506,7 @@ If you disable or do not configure this policy setting, updates can be applied w ADMX Info: -- GP English name: *Turn off background refresh of Group Policy* +- GP Friendly name: *Turn off background refresh of Group Policy* - GP name: *DisableBackgroundPolicy* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1580,7 +1580,7 @@ If you disable or do not configure this policy setting, Local GPOs continue to b ADMX Info: -- GP English name: *Turn off Local Group Policy Objects processing* +- GP Friendly name: *Turn off Local Group Policy Objects processing* - GP name: *DisableLGPOProcessing* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1656,7 +1656,7 @@ Also, see the "Set Group Policy refresh interval for computers" policy setting t ADMX Info: -- GP English name: *Remove users' ability to invoke machine policy refresh* +- GP Friendly name: *Remove users' ability to invoke machine policy refresh* - GP name: *DisableUsersFromMachGP* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1727,7 +1727,7 @@ If you do not configure this policy setting, the default behavior depends on the ADMX Info: -- GP English name: *Continue experiences on this device* +- GP Friendly name: *Continue experiences on this device* - GP name: *EnableCDP* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1800,7 +1800,7 @@ If you disable this policy setting, the Group Policy client will not cache appli ADMX Info: -- GP English name: *Configure Group Policy Caching* +- GP Friendly name: *Configure Group Policy Caching* - GP name: *EnableLogonOptimization* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1873,7 +1873,7 @@ If you disable or do not configure this policy setting, the Group Policy client ADMX Info: -- GP English name: *Enable Group Policy Caching for Servers* +- GP Friendly name: *Enable Group Policy Caching for Servers* - GP name: *EnableLogonOptimizationOnServerSKU* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -1944,7 +1944,7 @@ If you do not configure this policy setting, the default behavior depends on the ADMX Info: -- GP English name: *Phone-PC linking on this device* +- GP Friendly name: *Phone-PC linking on this device* - GP name: *EnableMMX* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2020,7 +2020,7 @@ In Group Policy Object Editor, preferences have a red icon to distinguish them f ADMX Info: -- GP English name: *Enforce Show Policies Only* +- GP Friendly name: *Enforce Show Policies Only* - GP name: *EnforcePoliciesOnly* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2087,7 +2087,7 @@ This feature can be configured to be in 3 modes: On, Off, and Audit. By default, ADMX Info: -- GP English name: *Untrusted Font Blocking* +- GP Friendly name: *Untrusted Font Blocking* - GP name: *DisableUsersFromMachGP* - GP path: *System\Mitigation Options* - GP ADMX file name: *GroupPolicy.admx* @@ -2165,7 +2165,7 @@ If you disable this setting or do not configure it, the Group Policy Object Edit ADMX Info: -- GP English name: *Configure Group Policy domain controller selection* +- GP Friendly name: *Configure Group Policy domain controller selection* - GP name: *GPDCOptions* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2242,7 +2242,7 @@ Also, see the "Do not detect slow network connections" and related policies in C ADMX Info: -- GP English name: *Configure Group Policy slow link detection* +- GP Friendly name: *Configure Group Policy slow link detection* - GP name: *GPTransferRate_1* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2319,7 +2319,7 @@ Also, see the "Do not detect slow network connections" and related policies in C ADMX Info: -- GP English name: *Configure Group Policy slow link detection* +- GP Friendly name: *Configure Group Policy slow link detection* - GP name: *GPTransferRate_2* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2401,7 +2401,7 @@ This setting is only used when the "Turn off background refresh of Group Policy" ADMX Info: -- GP English name: *Set Group Policy refresh interval for computers* +- GP Friendly name: *Set Group Policy refresh interval for computers* - GP name: *GroupPolicyRefreshRate* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2477,7 +2477,7 @@ This setting also lets you specify how much the actual update interval varies. T ADMX Info: -- GP English name: *Set Group Policy refresh interval for domain controllers* +- GP Friendly name: *Set Group Policy refresh interval for domain controllers* - GP name: *GroupPolicyRefreshRateDC* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2561,7 +2561,7 @@ This setting also lets you specify how much the actual update interval varies. T ADMX Info: -- GP English name: *Set Group Policy refresh interval for users* +- GP Friendly name: *Set Group Policy refresh interval for users* - GP name: *GroupPolicyRefreshRateUser* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2636,7 +2636,7 @@ If you do not configure this policy setting, Group Policy will wait five minutes ADMX Info: -- GP English name: *Configure Logon Script Delay* +- GP Friendly name: *Configure Logon Script Delay* - GP name: *LogonScriptDelay* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2707,7 +2707,7 @@ If this setting is Disabled or Not Configured, the default display name of New G ADMX Info: -- GP English name: *Set default name for new Group Policy objects* +- GP Friendly name: *Set default name for new Group Policy objects* - GP name: *NewGPODisplayName* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2776,7 +2776,7 @@ If you disable this setting or do not configure it, new Group Policy object link ADMX Info: -- GP English name: *Create new Group Policy Object links disabled by default* +- GP Friendly name: *Create new Group Policy Object links disabled by default* - GP name: *NewGPOLinksDisabled* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2862,7 +2862,7 @@ If you disable or do not configure this setting, the Group Policy Object Editor ADMX Info: -- GP English name: *Always use local ADM files for Group Policy Object Editor* +- GP Friendly name: *Always use local ADM files for Group Policy Object Editor* - GP name: *OnlyUseLocalAdminFiles* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -2949,7 +2949,7 @@ Setting flags not specified here to any value other than ? results in undefined ADMX Info: -- GP English name: *Process Mitigation Options* +- GP Friendly name: *Process Mitigation Options* - GP name: *ProcessMitigationOptions* - GP path: *System\Mitigation Options* - GP ADMX file name: *GroupPolicy.admx* @@ -3023,7 +3023,7 @@ If you disable or do not configure this setting, RSoP logging is turned on. By d ADMX Info: -- GP English name: *Turn off Resultant Set of Policy logging* +- GP Friendly name: *Turn off Resultant Set of Policy logging* - GP name: *RSoPLogging* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -3088,7 +3088,7 @@ Available in the latest Windows 10 Insider Preview Build. Enabling this setting ADMX Info: -- GP English name: *Enable AD/DFS domain controller synchronization during policy refresh* +- GP Friendly name: *Enable AD/DFS domain controller synchronization during policy refresh* - GP name: *ResetDfsClientInfoDuringRefreshPolicy* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -3162,7 +3162,7 @@ If you disable this setting or do not configure it, Group Policy will evaluate t ADMX Info: -- GP English name: *Configure Direct Access connections as a fast network connection* +- GP Friendly name: *Configure Direct Access connections as a fast network connection* - GP name: *SlowLinkDefaultForDirectAccess* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -3241,7 +3241,7 @@ If you disable or do not configure this policy setting, detecting a slow network ADMX Info: -- GP English name: *Change Group Policy processing to run asynchronously when a slow network connection is detected.* +- GP Friendly name: *Change Group Policy processing to run asynchronously when a slow network connection is detected.* - GP name: *SlowlinkDefaultToAsync* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -3310,7 +3310,7 @@ If you disable or do not configure this policy setting, Group Policy will use th ADMX Info: -- GP English name: *Specify startup policy processing wait time* +- GP Friendly name: *Specify startup policy processing wait time* - GP name: *SyncWaitTime* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* @@ -3388,7 +3388,7 @@ If you disable this setting or do not configure it, the user's Group Policy Obje ADMX Info: -- GP English name: *Configure user Group Policy loopback processing mode* +- GP Friendly name: *Configure user Group Policy loopback processing mode* - GP name: *UserPolicyMode* - GP path: *System\Group Policy* - GP ADMX file name: *GroupPolicy.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-help.md b/windows/client-management/mdm/policy-csp-admx-help.md index f1ea850871..fcdb9696af 100644 --- a/windows/client-management/mdm/policy-csp-admx-help.md +++ b/windows/client-management/mdm/policy-csp-admx-help.md @@ -101,7 +101,7 @@ If you disable or do not configure this policy setting, DEP is turned on for HTM ADMX Info: -- GP English name: *Turn off Data Execution Prevention for HTML Help Executible* +- GP Friendly name: *Turn off Data Execution Prevention for HTML Help Executible* - GP name: *DisableHHDEP* - GP path: *System* - GP ADMX file name: *Help.admx* @@ -184,7 +184,7 @@ For additional options, see the "Restrict these programs from being launched fro ADMX Info: -- GP English name: *Restrict potentially unsafe HTML Help functions to specified folders* +- GP Friendly name: *Restrict potentially unsafe HTML Help functions to specified folders* - GP name: *HelpQualifiedRootDir_Comp* - GP path: *System* - GP ADMX file name: *Help.admx* @@ -258,7 +258,7 @@ If you disable or do not configure this policy setting, users can run all applic ADMX Info: -- GP English name: *Restrict these programs from being launched from Help* +- GP Friendly name: *Restrict these programs from being launched from Help* - GP name: *RestrictRunFromHelp* - GP path: *System* - GP ADMX file name: *Help.admx* @@ -331,7 +331,7 @@ If you disable or do not configure this policy setting, users can run all applic ADMX Info: -- GP English name: *Restrict these programs from being launched from Help* +- GP Friendly name: *Restrict these programs from being launched from Help* - GP name: *RestrictRunFromHelp_Comp* - GP path: *System* - GP ADMX file name: *Help.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md index bd11b4a210..15a6785034 100644 --- a/windows/client-management/mdm/policy-csp-admx-helpandsupport.md +++ b/windows/client-management/mdm/policy-csp-admx-helpandsupport.md @@ -99,7 +99,7 @@ If you disable or do not configure this policy setting, the default behavior app ADMX Info: -- GP English name: *Turn off Active Help* +- GP Friendly name: *Turn off Active Help* - GP name: *ActiveHelp* - GP path: *Windows Components/Online Assistance* - GP ADMX file name: *HelpAndSupport.admx* @@ -170,7 +170,7 @@ Users can use the control to provide feedback on the quality and usefulness of t ADMX Info: -- GP English name: *Turn off Help Ratings* +- GP Friendly name: *Turn off Help Ratings* - GP name: *HPExplicitFeedback* - GP path: *System/Internet Communication Management/Internet Communication settings* - GP ADMX file name: *HelpAndSupport.admx* @@ -238,7 +238,7 @@ If you disable or do not configure this policy setting, users can turn on the He ADMX Info: -- GP English name: *Turn off Help Experience Improvement Program* +- GP Friendly name: *Turn off Help Experience Improvement Program* - GP name: *HPImplicitFeedback* - GP path: *System/Internet Communication Management/Internet Communication settings* - GP ADMX file name: *HelpAndSupport.admx* @@ -307,7 +307,7 @@ If you disable or do not configure this policy setting, users can access online ADMX Info: -- GP English name: *Turn off Windows Online* +- GP Friendly name: *Turn off Windows Online* - GP name: *HPOnlineAssistance* - GP path: *System/Internet Communication Management/Internet Communication settings* - GP ADMX file name: *HelpAndSupport.admx* diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index 77c69597e9..e1e54793b4 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -109,7 +109,7 @@ If audio input is enabled, a user will be able to disable audio input from their ADMX Info: -- GP English Name: *Allow audio input in Windows Sandbox* +- GP Friendly name: *Allow audio input in Windows Sandbox* - GP name: *AllowAudioInput* - GP path: *Windows Components/Windows Sandbox* - GP ADMX file name: *WindowsSandbox.admx* @@ -194,7 +194,7 @@ If clipboard sharing is enabled, a user will be able to disable clipboard sharin ADMX Info: -- GP English Name: *Allow clipboard sharing with Windows Sandbox* +- GP Friendly name: *Allow clipboard sharing with Windows Sandbox* - GP name: *AllowClipboardRedirection* - GP path: *Windows Components/Windows Sandbox* - GP ADMX file name: *WindowsSandbox.admx* @@ -279,7 +279,7 @@ If networking is enabled, a user will be able to disable networking from their o ADMX Info: -- GP English Name: *Allow networking in Windows Sandbox* +- GP Friendly name: *Allow networking in Windows Sandbox* - GP name: *AllowNetworking* - GP path: *Windows Components/Windows Sandbox* - GP ADMX file name: *WindowsSandbox.admx* @@ -362,7 +362,7 @@ If printer sharing is enabled, a user will be able to disable printer sharing fr ADMX Info: -- GP English Name: *Allow printer sharing with Windows Sandbox* +- GP Friendly name: *Allow printer sharing with Windows Sandbox* - GP name: *AllowPrinterRedirection* - GP path: *Windows Components/Windows Sandbox* - GP ADMX file name: *WindowsSandbox.admx* @@ -449,7 +449,7 @@ If vGPU is enabled, a user will be able to disable vGPU support from their own c ADMX Info: -- GP English Name: *Allow vGPU sharing for Windows Sandbox* +- GP Friendly name: *Allow vGPU sharing for Windows Sandbox* - GP name: *AllowVGPU* - GP path: *Windows Components/Windows Sandbox* - GP ADMX file name: *WindowsSandbox.admx* @@ -535,7 +535,7 @@ If video input is enabled, users will be able to disable video input from their ADMX Info: -- GP English Name: *Allow video input in Windows Sandbox* +- GP Friendly name: *Allow video input in Windows Sandbox* - GP name: *AllowVideoInput* - GP path: *Windows Components/Windows Sandbox* - GP ADMX file name: *WindowsSandbox.admx* diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 58e9f7e4b9..b1b0988561 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -334,7 +334,7 @@ Value type is integer. ADMX Info: -- GP English name: *Don't allow this PC to be projected to* +- GP Friendly name: *Don't allow this PC to be projected to* - GP name: *AllowProjectionToPC* - GP path: *Windows Components/Connect* - GP ADMX file name: *WirelessDisplay.admx* @@ -520,7 +520,7 @@ Value type is integer. ADMX Info: -- GP English name: *Require pin for pairing* +- GP Friendly name: *Require pin for pairing* - GP name: *RequirePinForPairing* - GP path: *Windows Components/Connect* - GP ADMX file name: *WirelessDisplay.admx* From 849b928112bd58bfa47d3213efe2c3efe378022e Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Wed, 11 Aug 2021 00:32:36 +0530 Subject: [PATCH 0014/1214] Updated --- .../mdm/policy-csp-privacy.md | 170 +++++++++--------- .../mdm/policy-csp-remoteassistance.md | 8 +- .../mdm/policy-csp-settings.md | 6 +- .../mdm/policy-csp-smartscreen.md | 6 +- .../mdm/policy-csp-speech.md | 2 +- .../client-management/mdm/policy-csp-start.md | 6 +- .../mdm/policy-csp-storage.md | 18 +- .../mdm/policy-csp-system.md | 38 ++-- .../mdm/policy-csp-systemservices.md | 12 +- .../mdm/policy-csp-textinput.md | 4 +- .../mdm/policy-csp-troubleshooting.md | 2 +- .../mdm/policy-csp-update.md | 104 +++++------ .../mdm/policy-csp-userrights.md | 58 +++--- .../client-management/mdm/policy-csp-wifi.md | 4 +- .../policy-csp-windowsconnectionmanager.md | 2 +- ...olicy-csp-windowsdefendersecuritycenter.md | 44 ++--- .../mdm/policy-csp-windowsinkworkspace.md | 4 +- .../mdm/policy-csp-windowslogon.md | 14 +- .../mdm/policy-csp-windowspowershell.md | 2 +- 19 files changed, 252 insertions(+), 252 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-privacy.md b/windows/client-management/mdm/policy-csp-privacy.md index ca873b0393..681623a2d3 100644 --- a/windows/client-management/mdm/policy-csp-privacy.md +++ b/windows/client-management/mdm/policy-csp-privacy.md @@ -412,7 +412,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow Clipboard synchronization across devices* +- GP Friendly name: *Allow Clipboard synchronization across devices* - GP name: *AllowCrossDeviceClipboard* - GP path: *System/OS Policies* - GP ADMX file name: *OSPolicy.admx* @@ -480,7 +480,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow input personalization* +- GP Friendly name: *Allow input personalization* - GP name: *AllowInputPersonalization* - GP path: *Control Panel/Regional and Language Options* - GP ADMX file name: *Globalization.admx* @@ -548,7 +548,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Turn off the advertising ID* +- GP Friendly name: *Turn off the advertising ID* - GP name: *DisableAdvertisingId* - GP path: *System/User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -622,7 +622,7 @@ In some enterprise managed environments, the privacy settings may be set by poli ADMX Info: -- GP English name: *Don't launch privacy settings experience on user logon* +- GP Friendly name: *Don't launch privacy settings experience on user logon* - GP name: *DisablePrivacyExperience* - GP path: *Windows Components/OOBE* - GP ADMX file name: *OOBE.admx* @@ -690,7 +690,7 @@ Added in Windows 10, version 1709. Allows IT Admins to allow Apps/OS to publish ADMX Info: -- GP English name: *Enables Activity Feed* +- GP Friendly name: *Enables Activity Feed* - GP name: *EnableActivityFeed* - GP path: *System/OS Policies* - GP ADMX file name: *OSPolicy.admx* @@ -759,7 +759,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access account information* +- GP Friendly name: *Let Windows apps access account information* - GP name: *LetAppsAccessAccountInfo* - GP element: *LetAppsAccessAccountInfo_Enum* - GP path: *Windows Components/App Privacy* @@ -827,7 +827,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access account information* +- GP Friendly name: *Let Windows apps access account information* - GP name: *LetAppsAccessAccountInfo* - GP element: *LetAppsAccessAccountInfo_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -887,7 +887,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access account information* +- GP Friendly name: *Let Windows apps access account information* - GP name: *LetAppsAccessAccountInfo* - GP element: *LetAppsAccessAccountInfo_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -947,7 +947,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access account information* +- GP Friendly name: *Let Windows apps access account information* - GP name: *LetAppsAccessAccountInfo* - GP element: *LetAppsAccessAccountInfo_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1013,7 +1013,7 @@ Value type is integer. ADMX Info: -- GP English name: *Let Windows apps access background spatial perception* +- GP Friendly name: *Let Windows apps access background spatial perception* - GP name: *LetAppsAccessBackgroundSpatialPerception* - GP element: *LetAppsAccessBackgroundSpatialPerception_Enum* - GP path: *Windows Components/App Privacy* @@ -1087,7 +1087,7 @@ Value type is chr. ADMX Info: -- GP English name: *Let Windows apps access background spatial perception* +- GP Friendly name: *Let Windows apps access background spatial perception* - GP name: *LetAppsAccessBackgroundSpatialPerception* - GP element: *LetAppsAccessBackgroundSpatialPerception_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1156,7 +1156,7 @@ Value type is chr. ADMX Info: -- GP English name: *Let Windows apps access background spatial perception* +- GP Friendly name: *Let Windows apps access background spatial perception* - GP name: *LetAppsAccessBackgroundSpatialPerception* - GP element: *LetAppsAccessBackgroundSpatialPerception_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1226,7 +1226,7 @@ Value type is chr. ADMX Info: -- GP English name: *Let Windows apps access background spatial perception* +- GP Friendly name: *Let Windows apps access background spatial perception* - GP name: *LetAppsAccessBackgroundSpatialPerception* - GP element: *LetAppsAccessBackgroundSpatialPerception_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1292,7 +1292,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access the calendar* +- GP Friendly name: *Let Windows apps access the calendar* - GP name: *LetAppsAccessCalendar* - GP element: *LetAppsAccessCalendar_Enum* - GP path: *Windows Components/App Privacy* @@ -1360,7 +1360,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the calendar* +- GP Friendly name: *Let Windows apps access the calendar* - GP name: *LetAppsAccessCalendar* - GP element: *LetAppsAccessCalendar_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1420,7 +1420,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the calendar* +- GP Friendly name: *Let Windows apps access the calendar* - GP name: *LetAppsAccessCalendar* - GP element: *LetAppsAccessCalendar_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1480,7 +1480,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the calendar* +- GP Friendly name: *Let Windows apps access the calendar* - GP name: *LetAppsAccessCalendar* - GP element: *LetAppsAccessCalendar_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1543,7 +1543,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access call history* +- GP Friendly name: *Let Windows apps access call history* - GP name: *LetAppsAccessCallHistory* - GP element: *LetAppsAccessCallHistory_Enum* - GP path: *Windows Components/App Privacy* @@ -1611,7 +1611,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access call history* +- GP Friendly name: *Let Windows apps access call history* - GP name: *LetAppsAccessCallHistory* - GP element: *LetAppsAccessCallHistory_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1671,7 +1671,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access call history* +- GP Friendly name: *Let Windows apps access call history* - GP name: *LetAppsAccessCallHistory* - GP element: *LetAppsAccessCallHistory_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1731,7 +1731,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access call history* +- GP Friendly name: *Let Windows apps access call history* - GP name: *LetAppsAccessCallHistory* - GP element: *LetAppsAccessCallHistory_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1794,7 +1794,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access the camera* +- GP Friendly name: *Let Windows apps access the camera* - GP name: *LetAppsAccessCamera* - GP element: *LetAppsAccessCamera_Enum* - GP path: *Windows Components/App Privacy* @@ -1862,7 +1862,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the camera* +- GP Friendly name: *Let Windows apps access the camera* - GP name: *LetAppsAccessCamera* - GP element: *LetAppsAccessCamera_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1922,7 +1922,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the camera* +- GP Friendly name: *Let Windows apps access the camera* - GP name: *LetAppsAccessCamera* - GP element: *LetAppsAccessCamera_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -1982,7 +1982,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the camera* +- GP Friendly name: *Let Windows apps access the camera* - GP name: *LetAppsAccessCamera* - GP element: *LetAppsAccessCamera_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2045,7 +2045,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access contacts* +- GP Friendly name: *Let Windows apps access contacts* - GP name: *LetAppsAccessContacts* - GP element: *LetAppsAccessContacts_Enum* - GP path: *Windows Components/App Privacy* @@ -2113,7 +2113,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access contacts* +- GP Friendly name: *Let Windows apps access contacts* - GP name: *LetAppsAccessContacts* - GP element: *LetAppsAccessContacts_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2173,7 +2173,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access contacts* +- GP Friendly name: *Let Windows apps access contacts* - GP name: *LetAppsAccessContacts* - GP element: *LetAppsAccessContacts_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2233,7 +2233,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access contacts* +- GP Friendly name: *Let Windows apps access contacts* - GP name: *LetAppsAccessContacts* - GP element: *LetAppsAccessContacts_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2296,7 +2296,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access email* +- GP Friendly name: *Let Windows apps access email* - GP name: *LetAppsAccessEmail* - GP element: *LetAppsAccessEmail_Enum* - GP path: *Windows Components/App Privacy* @@ -2364,7 +2364,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access email* +- GP Friendly name: *Let Windows apps access email* - GP name: *LetAppsAccessEmail* - GP element: *LetAppsAccessEmail_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2424,7 +2424,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access email* +- GP Friendly name: *Let Windows apps access email* - GP name: *LetAppsAccessEmail* - GP element: *LetAppsAccessEmail_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2484,7 +2484,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access email* +- GP Friendly name: *Let Windows apps access email* - GP name: *LetAppsAccessEmail* - GP element: *LetAppsAccessEmail_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2751,7 +2751,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access location* +- GP Friendly name: *Let Windows apps access location* - GP name: *LetAppsAccessLocation* - GP element: *LetAppsAccessLocation_Enum* - GP path: *Windows Components/App Privacy* @@ -2819,7 +2819,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access location* +- GP Friendly name: *Let Windows apps access location* - GP name: *LetAppsAccessLocation* - GP element: *LetAppsAccessLocation_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2879,7 +2879,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access location* +- GP Friendly name: *Let Windows apps access location* - GP name: *LetAppsAccessLocation* - GP element: *LetAppsAccessLocation_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -2939,7 +2939,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access location* +- GP Friendly name: *Let Windows apps access location* - GP name: *LetAppsAccessLocation* - GP element: *LetAppsAccessLocation_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3002,7 +3002,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access messaging* +- GP Friendly name: *Let Windows apps access messaging* - GP name: *LetAppsAccessMessaging* - GP element: *LetAppsAccessMessaging_Enum* - GP path: *Windows Components/App Privacy* @@ -3070,7 +3070,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access messaging* +- GP Friendly name: *Let Windows apps access messaging* - GP name: *LetAppsAccessMessaging* - GP element: *LetAppsAccessMessaging_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3130,7 +3130,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access messaging* +- GP Friendly name: *Let Windows apps access messaging* - GP name: *LetAppsAccessMessaging* - GP element: *LetAppsAccessMessaging_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3190,7 +3190,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access messaging* +- GP Friendly name: *Let Windows apps access messaging* - GP name: *LetAppsAccessMessaging* - GP element: *LetAppsAccessMessaging_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3253,7 +3253,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access the microphone* +- GP Friendly name: *Let Windows apps access the microphone* - GP name: *LetAppsAccessMicrophone* - GP element: *LetAppsAccessMicrophone_Enum* - GP path: *Windows Components/App Privacy* @@ -3321,7 +3321,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the microphone* +- GP Friendly name: *Let Windows apps access the microphone* - GP name: *LetAppsAccessMicrophone* - GP element: *LetAppsAccessMicrophone_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3381,7 +3381,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the microphone* +- GP Friendly name: *Let Windows apps access the microphone* - GP name: *LetAppsAccessMicrophone* - GP element: *LetAppsAccessMicrophone_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3441,7 +3441,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access the microphone* +- GP Friendly name: *Let Windows apps access the microphone* - GP name: *LetAppsAccessMicrophone* - GP element: *LetAppsAccessMicrophone_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3504,7 +3504,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access motion* +- GP Friendly name: *Let Windows apps access motion* - GP name: *LetAppsAccessMotion* - GP element: *LetAppsAccessMotion_Enum* - GP path: *Windows Components/App Privacy* @@ -3572,7 +3572,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access motion* +- GP Friendly name: *Let Windows apps access motion* - GP name: *LetAppsAccessMotion* - GP element: *LetAppsAccessMotion_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3632,7 +3632,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access motion* +- GP Friendly name: *Let Windows apps access motion* - GP name: *LetAppsAccessMotion* - GP element: *LetAppsAccessMotion_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3692,7 +3692,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access motion* +- GP Friendly name: *Let Windows apps access motion* - GP name: *LetAppsAccessMotion* - GP element: *LetAppsAccessMotion_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3755,7 +3755,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access notifications* +- GP Friendly name: *Let Windows apps access notifications* - GP name: *LetAppsAccessNotifications* - GP element: *LetAppsAccessNotifications_Enum* - GP path: *Windows Components/App Privacy* @@ -3823,7 +3823,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access notifications* +- GP Friendly name: *Let Windows apps access notifications* - GP name: *LetAppsAccessNotifications* - GP element: *LetAppsAccessNotifications_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3883,7 +3883,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access notifications* +- GP Friendly name: *Let Windows apps access notifications* - GP name: *LetAppsAccessNotifications* - GP element: *LetAppsAccessNotifications_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -3943,7 +3943,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access notifications* +- GP Friendly name: *Let Windows apps access notifications* - GP name: *LetAppsAccessNotifications* - GP element: *LetAppsAccessNotifications_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4006,7 +4006,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps make phone calls* +- GP Friendly name: *Let Windows apps make phone calls* - GP name: *LetAppsAccessPhone* - GP element: *LetAppsAccessPhone_Enum* - GP path: *Windows Components/App Privacy* @@ -4074,7 +4074,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps make phone calls* +- GP Friendly name: *Let Windows apps make phone calls* - GP name: *LetAppsAccessPhone* - GP element: *LetAppsAccessPhone_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4134,7 +4134,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps make phone calls* +- GP Friendly name: *Let Windows apps make phone calls* - GP name: *LetAppsAccessPhone* - GP element: *LetAppsAccessPhone_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4194,7 +4194,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps make phone calls* +- GP Friendly name: *Let Windows apps make phone calls* - GP name: *LetAppsAccessPhone* - GP element: *LetAppsAccessPhone_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4257,7 +4257,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps control radios* +- GP Friendly name: *Let Windows apps control radios* - GP name: *LetAppsAccessRadios* - GP element: *LetAppsAccessRadios_Enum* - GP path: *Windows Components/App Privacy* @@ -4325,7 +4325,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps control radios* +- GP Friendly name: *Let Windows apps control radios* - GP name: *LetAppsAccessRadios* - GP element: *LetAppsAccessRadios_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4385,7 +4385,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps control radios* +- GP Friendly name: *Let Windows apps control radios* - GP name: *LetAppsAccessRadios* - GP element: *LetAppsAccessRadios_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4445,7 +4445,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps control radios* +- GP Friendly name: *Let Windows apps control radios* - GP name: *LetAppsAccessRadios* - GP element: *LetAppsAccessRadios_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4505,7 +4505,7 @@ Added in Windows 10, version 1703. Specifies whether Windows apps can access tas ADMX Info: -- GP English name: *Let Windows apps access Tasks* +- GP Friendly name: *Let Windows apps access Tasks* - GP name: *LetAppsAccessTasks* - GP element: *LetAppsAccessTasks_Enum* - GP path: *Windows Components/App Privacy* @@ -4565,7 +4565,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family N ADMX Info: -- GP English name: *Let Windows apps access Tasks* +- GP Friendly name: *Let Windows apps access Tasks* - GP name: *LetAppsAccessTasks* - GP element: *LetAppsAccessTasks_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4625,7 +4625,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family N ADMX Info: -- GP English name: *Let Windows apps access Tasks* +- GP Friendly name: *Let Windows apps access Tasks* - GP name: *LetAppsAccessTasks* - GP element: *LetAppsAccessTasks_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4685,7 +4685,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family N ADMX Info: -- GP English name: *Let Windows apps access Tasks* +- GP Friendly name: *Let Windows apps access Tasks* - GP name: *LetAppsAccessTasks* - GP element: *LetAppsAccessTasks_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4748,7 +4748,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access trusted devices* +- GP Friendly name: *Let Windows apps access trusted devices* - GP name: *LetAppsAccessTrustedDevices* - GP element: *LetAppsAccessTrustedDevices_Enum* - GP path: *Windows Components/App Privacy* @@ -4816,7 +4816,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access trusted devices* +- GP Friendly name: *Let Windows apps access trusted devices* - GP name: *LetAppsAccessTrustedDevices* - GP element: *LetAppsAccessTrustedDevices_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4876,7 +4876,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access trusted devices* +- GP Friendly name: *Let Windows apps access trusted devices* - GP name: *LetAppsAccessTrustedDevices* - GP element: *LetAppsAccessTrustedDevices_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4936,7 +4936,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access trusted devices* +- GP Friendly name: *Let Windows apps access trusted devices* - GP name: *LetAppsAccessTrustedDevices* - GP element: *LetAppsAccessTrustedDevices_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -4996,7 +4996,7 @@ Specifies if Windows apps can be activated by voice. ADMX Info: -- GP English name: *Allow voice activation* +- GP Friendly name: *Allow voice activation* - GP name: *LetAppsActivateWithVoice* - GP element: *LetAppsActivateWithVoice_Enum* - GP path: *Windows Components/App Privacy* @@ -5064,7 +5064,7 @@ Specifies if Windows apps can be activated by voice while the screen is locked. ADMX Info: -- GP English name: *Allow voice activation above locked screen* +- GP Friendly name: *Allow voice activation above locked screen* - GP name: *LetAppsActivateWithVoiceAboveLock* - GP element: *LetAppsActivateWithVoiceAboveLock_Enum* - GP path: *Windows Components/App Privacy* @@ -5135,7 +5135,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP Friendly name: *Let Windows apps access diagnostic information about other apps* - GP name: *LetAppsGetDiagnosticInfo* - GP element: *LetAppsGetDiagnosticInfo_Enum* - GP path: *Windows Components/App Privacy* @@ -5203,7 +5203,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP Friendly name: *Let Windows apps access diagnostic information about other apps* - GP name: *LetAppsGetDiagnosticInfo* - GP element: *LetAppsGetDiagnosticInfo_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5263,7 +5263,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP Friendly name: *Let Windows apps access diagnostic information about other apps* - GP name: *LetAppsGetDiagnosticInfo* - GP element: *LetAppsGetDiagnosticInfo_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5323,7 +5323,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps access diagnostic information about other apps* +- GP Friendly name: *Let Windows apps access diagnostic information about other apps* - GP name: *LetAppsGetDiagnosticInfo* - GP element: *LetAppsGetDiagnosticInfo_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5388,7 +5388,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps run in the background* +- GP Friendly name: *Let Windows apps run in the background* - GP name: *LetAppsRunInBackground* - GP element: *LetAppsRunInBackground_Enum* - GP path: *Windows Components/App Privacy* @@ -5456,7 +5456,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps run in the background* +- GP Friendly name: *Let Windows apps run in the background* - GP name: *LetAppsRunInBackground* - GP element: *LetAppsRunInBackground_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5516,7 +5516,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps run in the background* +- GP Friendly name: *Let Windows apps run in the background* - GP name: *LetAppsRunInBackground* - GP element: *LetAppsRunInBackground_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5576,7 +5576,7 @@ Added in Windows 10, version 1703. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps run in the background* +- GP Friendly name: *Let Windows apps run in the background* - GP name: *LetAppsRunInBackground* - GP element: *LetAppsRunInBackground_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5639,7 +5639,7 @@ Most restricted value is 2. ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* +- GP Friendly name: *Let Windows apps communicate with unpaired devices* - GP name: *LetAppsSyncWithDevices* - GP element: *LetAppsSyncWithDevices_Enum* - GP path: *Windows Components/App Privacy* @@ -5707,7 +5707,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* +- GP Friendly name: *Let Windows apps communicate with unpaired devices* - GP name: *LetAppsSyncWithDevices* - GP element: *LetAppsSyncWithDevices_ForceAllowTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5767,7 +5767,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* +- GP Friendly name: *Let Windows apps communicate with unpaired devices* - GP name: *LetAppsSyncWithDevices* - GP element: *LetAppsSyncWithDevices_ForceDenyTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5827,7 +5827,7 @@ Added in Windows 10, version 1607. List of semi-colon delimited Package Family ADMX Info: -- GP English name: *Let Windows apps communicate with unpaired devices* +- GP Friendly name: *Let Windows apps communicate with unpaired devices* - GP name: *LetAppsSyncWithDevices* - GP element: *LetAppsSyncWithDevices_UserInControlOfTheseApps_List* - GP path: *Windows Components/App Privacy* @@ -5887,7 +5887,7 @@ Added in Windows 10, version 1709. Allows It Admins to enable publishing of user ADMX Info: -- GP English name: *Allow publishing of User Activities* +- GP Friendly name: *Allow publishing of User Activities* - GP name: *PublishUserActivities* - GP path: *System/OS Policies* - GP ADMX file name: *OSPolicy.admx* @@ -5953,7 +5953,7 @@ Allows ActivityFeed to upload published 'User Activities'. ADMX Info: -- GP English name: *Allow upload of User Activities* +- GP Friendly name: *Allow upload of User Activities* - GP name: *UploadUserActivities* - GP path: *System/OS Policies* - GP ADMX file name: *OSPolicy.admx* diff --git a/windows/client-management/mdm/policy-csp-remoteassistance.md b/windows/client-management/mdm/policy-csp-remoteassistance.md index 340bef38c2..a515e2b28f 100644 --- a/windows/client-management/mdm/policy-csp-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-remoteassistance.md @@ -105,7 +105,7 @@ If you do not configure this policy setting, the user sees the default warning m ADMX Info: -- GP English name: *Customize warning messages* +- GP Friendly name: *Customize warning messages* - GP name: *RA_Options* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* @@ -177,7 +177,7 @@ If you do not configure this setting, application-based settings are used. ADMX Info: -- GP English name: *Turn on session logging* +- GP Friendly name: *Turn on session logging* - GP name: *RA_Logging* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* @@ -257,7 +257,7 @@ If you enable this policy setting you should also enable appropriate firewall ex ADMX Info: -- GP English name: *Configure Solicited Remote Assistance* +- GP Friendly name: *Configure Solicited Remote Assistance* - GP name: *RA_Solicit* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* @@ -360,7 +360,7 @@ Allow Remote Desktop Exception ADMX Info: -- GP English name: *Configure Offer Remote Assistance* +- GP Friendly name: *Configure Offer Remote Assistance* - GP name: *RA_Unsolicit* - GP path: *System/Remote Assistance* - GP ADMX file name: *remoteassistance.admx* diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 1e16989ede..4a109d3361 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -360,7 +360,7 @@ If disabled, Settings will not contact Microsoft content services to retrieve ti ADMX Info: -- GP English name: *Allow Online Tips* +- GP Friendly name: *Allow Online Tips* - GP name: *AllowOnlineTips* - GP element: *CheckBox_AllowOnlineTips* - GP path: *Control Panel* @@ -784,7 +784,7 @@ Added in Windows 10, version 1703. Allows IT Admins to configure the default se ADMX Info: -- GP English name: *Show additional calendar* +- GP Friendly name: *Show additional calendar* - GP name: *ConfigureTaskbarCalendar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -877,7 +877,7 @@ hide:network-wifi ADMX Info: -- GP English name: *Settings Page Visibility* +- GP Friendly name: *Settings Page Visibility* - GP name: *SettingsPageVisibility* - GP element: *SettingsPageVisibilityBox* - GP path: *Control Panel* diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index 2cdf136faf..3f4e279889 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -88,7 +88,7 @@ Added in Windows 10, version 1703. Allows IT Admins to control whether users ar ADMX Info: -- GP English name: *Configure App Install Control* +- GP Friendly name: *Configure App Install Control* - GP name: *ConfigureAppInstallControl* - GP path: *Windows Components/Windows Defender SmartScreen/Explorer* - GP ADMX file name: *SmartScreen.admx* @@ -154,7 +154,7 @@ Added in Windows 10, version 1703. Allows IT Admins to configure SmartScreen fo ADMX Info: -- GP English name: *Configure Windows Defender SmartScreen* +- GP Friendly name: *Configure Windows Defender SmartScreen* - GP name: *ShellConfigureSmartScreen* - GP path: *Windows Components/Windows Defender SmartScreen/Explorer* - GP ADMX file name: *SmartScreen.admx* @@ -220,7 +220,7 @@ Added in Windows 10, version 1703. Allows IT Admins to control whether users ca ADMX Info: -- GP English name: *Configure Windows Defender SmartScreen* +- GP Friendly name: *Configure Windows Defender SmartScreen* - GP name: *ShellConfigureSmartScreen* - GP element: *ShellConfigureSmartScreen_Dropdown* - GP path: *Windows Components/Windows Defender SmartScreen/Explorer* diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 39cd9db038..59b7531703 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -79,7 +79,7 @@ Added in Windows 10, version 1607. Specifies whether the device will receive up ADMX Info: -- GP English name: *Allow Automatic Update of Speech Data* +- GP Friendly name: *Allow Automatic Update of Speech Data* - GP name: *AllowSpeechModelUpdate* - GP path: *Windows Components/Speech* - GP ADMX file name: *Speech.admx* diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 1519ff7e40..5e96138d2c 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -756,7 +756,7 @@ Enabling this policy prevents context menus from being invoked in the Start Menu ADMX Info: -- GP English name: *Disable context menus in the Start Menu* +- GP Friendly name: *Disable context menus in the Start Menu* - GP name: *DisableContextMenusInStart* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1242,7 +1242,7 @@ Value type is integer. ADMX Info: -- GP English name: *Remove the People Bar from the taskbar* +- GP Friendly name: *Remove the People Bar from the taskbar* - GP name: *HidePeopleBar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1454,7 +1454,7 @@ Added in Windows 10, version 1703. Allows IT Admins to configure Start by hidin ADMX Info: -- GP English name: *Remove "Recently added" list from Start Menu* +- GP Friendly name: *Remove "Recently added" list from Start Menu* - GP name: *HideRecentlyAddedApps* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index e55afed42c..ecd7532d32 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -105,7 +105,7 @@ Value type is integer. ADMX Info: -- GP English name: *Allow downloading updates to the Disk Failure Prediction Model* +- GP Friendly name: *Allow downloading updates to the Disk Failure Prediction Model* - GP name: *SH_AllowDiskHealthModelUpdates* - GP path: *System/Storage Health* - GP ADMX file name: *StorageHealth.admx* @@ -176,7 +176,7 @@ If you do not configure this policy setting, Storage Sense is turned off by defa ADMX Info: -- GP English name: *Allow Storage Sense* +- GP Friendly name: *Allow Storage Sense* - GP name: *SS_AllowStorageSenseGlobal* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -252,7 +252,7 @@ If you do not configure this policy setting, Storage Sense will delete the user ADMX Info: -- GP English name: *Allow Storage Sense Temporary Files cleanup* +- GP Friendly name: *Allow Storage Sense Temporary Files cleanup* - GP name: *SS_AllowStorageSenseTemporaryFilesCleanup* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -328,7 +328,7 @@ If you disable or do not configure this policy setting, then Storage Sense will ADMX Info: -- GP English name: *Configure Storage Sense Cloud Content dehydration threshold* +- GP Friendly name: *Configure Storage Sense Cloud Content dehydration threshold* - GP name: *SS_ConfigStorageSenseCloudContentDehydrationThreshold* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -404,7 +404,7 @@ If you disable or do not configure this policy setting, then Storage Sense will ADMX Info: -- GP English name: *Configure Storage Storage Downloads cleanup threshold* +- GP Friendly name: *Configure Storage Storage Downloads cleanup threshold* - GP name: *SS_ConfigStorageSenseDownloadsCleanupThreshold* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -486,7 +486,7 @@ If you do not configure this policy setting, then the Storage Sense cadence is s ADMX Info: -- GP English name: *Configure Storage Sense cadence* +- GP Friendly name: *Configure Storage Sense cadence* - GP name: *SS_ConfigStorageSenseGlobalCadence* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -562,7 +562,7 @@ If you disable or do not configure this policy setting, Storage Sense will delet ADMX Info: -- GP English name: *Configure Storage Sense Recycle Bin cleanup threshold* +- GP Friendly name: *Configure Storage Sense Recycle Bin cleanup threshold* - GP name: *SS_ConfigStorageSenseRecycleBinCleanupThreshold* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -641,7 +641,7 @@ If you disable or do not configure this policy setting, Windows will activate un ADMX Info: -- GP English name: *Do not allow Windows to activate Enhanced Storage devices* +- GP Friendly name: *Do not allow Windows to activate Enhanced Storage devices* - GP name: *TCGSecurityActivationDisabled* - GP path: *System/Enhanced Storage Access* - GP ADMX file name: *enhancedstorage.admx* @@ -707,7 +707,7 @@ Supported values: ADMX Info: -- GP English name: *Removable Disks: Deny write access* +- GP Friendly name: *Removable Disks: Deny write access* - GP name: *RemovableDisks_DenyWrite_Access_2* - GP element: *RemovableDisks_DenyWrite_Access_2* - GP path: *System/Removable Storage Access* diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index f199fbc4c1..b02ba826b4 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -158,7 +158,7 @@ If you enable or do not configure this policy setting, users can download and in ADMX Info: -- GP English name: *Toggle user control over Insider builds* +- GP Friendly name: *Toggle user control over Insider builds* - GP name: *AllowBuildPreview* - GP path: *Data Collection and Preview Builds* - GP ADMX file name: *AllowBuildPreview.admx* @@ -234,7 +234,7 @@ See the documentation at [ConfigureWDD](https://aka.ms/ConfigureWDD) for informa ADMX Info: -- GP English name: *Allow commercial data pipeline* +- GP Friendly name: *Allow commercial data pipeline* - GP name: *AllowCommercialDataPipeline* - GP element: *AllowCommercialDataPipeline* - GP path: *Data Collection and Preview Builds* @@ -333,7 +333,7 @@ This policy allows the device name to be sent to Microsoft as part of Windows di ADMX Info: -- GP English name: *Allow device name to be sent in Windows diagnostic data* +- GP Friendly name: *Allow device name to be sent in Windows diagnostic data* - GP name: *AllowDeviceNameInDiagnosticData* - GP element: *AllowDeviceNameInDiagnosticData* - GP path: *Data Collection and Preview Builds* @@ -526,7 +526,7 @@ This setting is used by lower-level components for text display and fond handlin ADMX Info: -- GP English name: *Enable Font Providers* +- GP Friendly name: *Enable Font Providers* - GP name: *EnableFontProviders* - GP path: *Network/Fonts* - GP ADMX file name: *GroupPolicy.admx* @@ -603,7 +603,7 @@ For example, an app's original Location setting is Off. The administrator then s ADMX Info: -- GP English name: *Turn off location* +- GP Friendly name: *Turn off location* - GP name: *DisableLocation_2* - GP path: *Windows Components/Location and Sensors* - GP ADMX file name: *Sensors.admx* @@ -822,7 +822,7 @@ Most restrictive value is 0. ADMX Info: -- GP English name: *Allow Telemetry* +- GP Friendly name: *Allow Telemetry* - GP name: *AllowTelemetry* - GP element: *AllowTelemetry* - GP path: *Data Collection and Preview Builds* @@ -889,7 +889,7 @@ If you disable or do not configure this policy setting, devices will not appear ADMX Info: -- GP English name: *Allow Update Compliance Processing* +- GP Friendly name: *Allow Update Compliance Processing* - GP name: *AllowUpdateComplianceProcessing* - GP element: *AllowUpdateComplianceProcessing* - GP path: *Data Collection and Preview Builds* @@ -1047,7 +1047,7 @@ If your malware detection application does not include an Early Launch Antimalwa ADMX Info: -- GP English name: *Boot-Start Driver Initialization Policy* +- GP Friendly name: *Boot-Start Driver Initialization Policy* - GP name: *POL_DriverLoadPolicy_Name* - GP path: *System/Early Launch Antimalware* - GP ADMX file name: *earlylauncham.admx* @@ -1107,7 +1107,7 @@ Value type is string. ADMX Info: -- GP English name: *Configure Microsoft 365 Update Readiness upload endpoint* +- GP Friendly name: *Configure Microsoft 365 Update Readiness upload endpoint* - GP name: *ConfigureMicrosoft365UploadEndpoint* - GP element: *ConfigureMicrosoft365UploadEndpoint* - GP path: *Data Collection and Preview Builds* @@ -1174,7 +1174,7 @@ If you set this policy setting to "Enable telemetry change notifications" or don ADMX Info: -- GP English name: *Configure telemetry opt-in change notifications.* +- GP Friendly name: *Configure telemetry opt-in change notifications.* - GP name: *ConfigureTelemetryOptInChangeNotification* - GP element: *ConfigureTelemetryOptInChangeNotification* - GP path: *Data Collection and Preview Builds* @@ -1242,7 +1242,7 @@ If you set this policy setting to "Enable Telemetry opt-in Settings" or don't co ADMX Info: -- GP English name: *Configure telemetry opt-in setting user interface.* +- GP Friendly name: *Configure telemetry opt-in setting user interface.* - GP name: *ConfigureTelemetryOptInSettingsUx* - GP element: *ConfigureTelemetryOptInSettingsUx* - GP path: *Data Collection and Preview Builds* @@ -1305,7 +1305,7 @@ If you disable or don't configure this policy setting, the Delete diagnostic dat ADMX Info: -- GP English name: *Disable deleting diagnostic data* +- GP Friendly name: *Disable deleting diagnostic data* - GP name: *DisableDeviceDelete* - GP element: *DisableDeviceDelete* - GP path: *Data Collection and Preview Builds* @@ -1372,7 +1372,7 @@ If you disable or don't configure this policy setting, the Diagnostic Data Viewe ADMX Info: -- GP English name: *Disable diagnostic data viewer.* +- GP Friendly name: *Disable diagnostic data viewer.* - GP name: *DisableDiagnosticDataViewer* - GP element: *DisableDiagnosticDataViewer* - GP path: *Data Collection and Preview Builds* @@ -1437,7 +1437,7 @@ This policy setting blocks the Connected User Experience and Telemetry service f ADMX Info: -- GP English name: *Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service* +- GP Friendly name: *Configure Authenticated Proxy usage for the Connected User Experience and Telemetry service* - GP name: *DisableEnterpriseAuthProxy* - GP element: *DisableEnterpriseAuthProxy* - GP path: *Data Collection and Preview Builds* @@ -1501,7 +1501,7 @@ If you disable or do not configure this policy setting, apps and features can wo ADMX Info: -- GP English name: *Prevent the usage of OneDrive for file storage* +- GP Friendly name: *Prevent the usage of OneDrive for file storage* - GP name: *PreventOnedriveFileSync* - GP path: *Windows Components/OneDrive* - GP ADMX file name: *SkyDrive.admx* @@ -1588,7 +1588,7 @@ Also, see the "Turn off System Restore configuration" policy setting. If the "Tu ADMX Info: -- GP English name: *Turn off System Restore* +- GP Friendly name: *Turn off System Restore* - GP name: *SR_DisableSR* - GP path: *System/System Restore* - GP ADMX file name: *systemrestore.admx* @@ -1717,7 +1717,7 @@ If you disable or do not configure this policy setting, then the level of diagno ADMX Info: -- GP English name: *Limit Enhanced diagnostic data to the minimum required by Windows Analytics* +- GP Friendly name: *Limit Enhanced diagnostic data to the minimum required by Windows Analytics* - GP name: *LimitEnhancedDiagnosticDataWindowsAnalytics* - GP element: *LimitEnhancedDiagnosticDataWindowsAnalytics* - GP path: *Data Collection and Preview Builds* @@ -1775,7 +1775,7 @@ If you disable or do not configure this policy setting, Connected User Experienc ADMX Info: -- GP English name: *Configure Connected User Experiences and Telemetry* +- GP Friendly name: *Configure Connected User Experiences and Telemetry* - GP name: *TelemetryProxy* - GP element: *TelemetryProxyName* - GP path: *Data Collection and Preview Builds* @@ -1835,7 +1835,7 @@ If you disable or do not configure this policy setting, File History can be acti ADMX Info: -- GP English name: *Turn off File History* +- GP Friendly name: *Turn off File History* - GP name: *DisableFileHistory* - GP path: *Windows Components/File History* - GP ADMX file name: *FileHistory.admx* diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index a7f98a6c0c..1e4e35d190 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -94,7 +94,7 @@ Added in Windows 10, version 1803. This setting determines whether the service's GP Info: -- GP English name: *HomeGroup Listener* +- GP Friendly name: *HomeGroup Listener* - GP path: *Windows Settings/Security Settings/System Services* @@ -151,7 +151,7 @@ Added in Windows 10, version 1803. This setting determines whether the service's GP Info: -- GP English name: *HomeGroup Provider* +- GP Friendly name: *HomeGroup Provider* - GP path: *Windows Settings/Security Settings/System Services* @@ -208,7 +208,7 @@ Added in Windows 10, version 1803. This setting determines whether the service's GP Info: -- GP English name: *Xbox Accessory Management Service* +- GP Friendly name: *Xbox Accessory Management Service* - GP path: *Windows Settings/Security Settings/System Services* @@ -265,7 +265,7 @@ Added in Windows 10, version 1803. This setting determines whether the service's GP Info: -- GP English name: *Xbox Live Auth Manager* +- GP Friendly name: *Xbox Live Auth Manager* - GP path: *Windows Settings/Security Settings/System Services* @@ -322,7 +322,7 @@ Added in Windows 10, version 1803. This setting determines whether the service's GP Info: -- GP English name: *Xbox Live Game Save* +- GP Friendly name: *Xbox Live Game Save* - GP path: *Windows Settings/Security Settings/System Services* @@ -379,7 +379,7 @@ Added in Windows 10, version 1803. This setting determines whether the service's GP Info: -- GP English name: *Xbox Live Networking Service* +- GP Friendly name: *Xbox Live Networking Service* - GP path: *Windows Settings/Security Settings/System Services* diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 99360d692b..444e70c323 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -716,7 +716,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow Uninstallation of Language Features* +- GP Friendly name: *Allow Uninstallation of Language Features* - GP name: *AllowLanguageFeaturesUninstall* - GP path: *Windows Components/Text Input* - GP ADMX file name: *TextInput.admx* @@ -782,7 +782,7 @@ This policy setting controls the ability to send inking and typing data to Micro ADMX Info: -- GP English name: *Improve inking and typing recognition* +- GP Friendly name: *Improve inking and typing recognition* - GP name: *AllowLinguisticDataCollection* - GP path: *Windows Components/Text Input* - GP ADMX file name: *TextInput.admx* diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index c7862d0866..6c74dd7725 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -77,7 +77,7 @@ This policy setting allows IT admins to configure how to apply recommended troub ADMX Info: -- GP English name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* +- GP Friendly name: *Troubleshooting: Allow users to access recommended troubleshooting for known problems* - GP name: *TroubleshootingAllowRecommendations* - GP path: *Troubleshooting and Diagnostics/Microsoft Support Diagnostic Tool* - GP ADMX file name: *MSDT.admx* diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 94f7b317fd..1813782b4c 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -271,7 +271,7 @@ The default is 17 (5 PM). ADMX Info: -- GP English name: *Turn off auto-restart for updates during active hours* +- GP Friendly name: *Turn off auto-restart for updates during active hours* - GP name: *ActiveHours* - GP element: *ActiveHoursEndTime* - GP path: *Windows Components/Windows Update* @@ -335,7 +335,7 @@ The default value is 18 (hours). ADMX Info: -- GP English name: *Specify active hours range for auto-restarts* +- GP Friendly name: *Specify active hours range for auto-restarts* - GP name: *ActiveHoursMaxRange* - GP element: *ActiveHoursMaxRange* - GP path: *Windows Components/Windows Update* @@ -402,7 +402,7 @@ The default value is 8 (8 AM). ADMX Info: -- GP English name: *Turn off auto-restart for updates during active hours* +- GP Friendly name: *Turn off auto-restart for updates during active hours* - GP name: *ActiveHours* - GP element: *ActiveHoursStartTime* - GP path: *Windows Components/Windows Update* @@ -466,7 +466,7 @@ If the policy is not configured, end-users get the default behavior (Auto instal ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *AutoUpdateMode* - GP path: *Windows Components/Windows Update* @@ -546,7 +546,7 @@ This policy is accessible through the Update setting in the user interface or Gr ADMX Info: -- GP English name: *Allow updates to be downloaded automatically over metered connections* +- GP Friendly name: *Allow updates to be downloaded automatically over metered connections* - GP name: *AllowAutoWindowsUpdateDownloadOverMeteredNetwork* - GP path: *Windows Components/Windows Update* - GP ADMX file name: *WindowsUpdate.admx* @@ -612,7 +612,7 @@ Added in Windows 10, version 1607. Allows the IT admin to manage whether to sca ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *AllowMUUpdateServiceId* - GP path: *Windows Components/Windows Update* @@ -748,7 +748,7 @@ Enabling this policy will disable that functionality, and may cause connection t ADMX Info: -- GP English name: *Specify intranet Microsoft update service location* +- GP Friendly name: *Specify intranet Microsoft update service location* - GP name: *CorpWuURL* - GP path: *Windows Components/Windows Update* - GP ADMX file name: *WindowsUpdate.admx* @@ -830,7 +830,7 @@ If any of the following two policies are enabled, this policy has no effect: ADMX Info: -- GP English name: *Specify deadline before auto-restart for update installation* +- GP Friendly name: *Specify deadline before auto-restart for update installation* - GP name: *AutoRestartDeadline* - GP element: *AutoRestartDeadline* - GP path: *Windows Components/Windows Update* @@ -906,7 +906,7 @@ If any of the following two policies are enabled, this policy has no effect: ADMX Info: -- GP English name: *Specify deadline before auto-restart for update installation* +- GP Friendly name: *Specify deadline before auto-restart for update installation* - GP name: *AutoRestartDeadline* - GP element: *AutoRestartDeadlineForFeatureUpdates* - GP path: *Windows Components/Windows Update* @@ -968,7 +968,7 @@ The default value is 15 (minutes). ADMX Info: -- GP English name: *Configure auto-restart reminder notifications for updates* +- GP Friendly name: *Configure auto-restart reminder notifications for updates* - GP name: *AutoRestartNotificationConfig* - GP element: *AutoRestartNotificationSchd* - GP path: *Windows Components/Windows Update* @@ -1032,7 +1032,7 @@ Added in Windows 10, version 1703. Allows the IT Admin to specify the method by ADMX Info: -- GP English name: *Configure auto-restart required notification for updates* +- GP Friendly name: *Configure auto-restart required notification for updates* - GP name: *AutoRestartRequiredNotificationDismissal* - GP element: *AutoRestartRequiredNotificationDismissal* - GP path: *Windows Components/Windows Update* @@ -1105,7 +1105,7 @@ If you disable or do not configure this policy setting, the wake setting as spec ADMX Info: -- GP English name: *Automatic Maintenance WakeUp Policy* +- GP Friendly name: *Automatic Maintenance WakeUp Policy* - GP name: *WakeUpPolicy* - GP path: *Windows Components/Maintenance Scheduler* - GP ADMX file name: *msched.admx* @@ -1175,7 +1175,7 @@ Added in Windows 10, version 1607. Allows the IT admin to set which branch a de ADMX Info: -- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* - GP name: *DeferFeatureUpdates* - GP element: *BranchReadinessLevelId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -1245,7 +1245,7 @@ Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, ADMX Info: -- GP English name: *Specify deadlines for automatic updates and restarts* +- GP Friendly name: *Specify deadlines for automatic updates and restarts* - GP name: *ConfigureDeadlineForFeatureUpdates* - GP element: *ConfigureDeadlineForFeatureUpdates* - GP path: *Administrative Templates\Windows Components\WindowsUpdate* @@ -1316,7 +1316,7 @@ Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, ADMX Info: -- GP English name: *Specify deadlines for automatic updates and restarts* +- GP Friendly name: *Specify deadlines for automatic updates and restarts* - GP name: *ConfigureDeadlineForQualityUpdates* - GP element: *ConfigureDeadlineForQualityUpdates* - GP path: *Administrative Templates\Windows Components\WindowsUpdate* @@ -1388,7 +1388,7 @@ Added in Windows 10, version 1903. Also available in Windows 10, versions 1809, ADMX Info: -- GP English name: *Specify deadlines for automatic updates and restarts* +- GP Friendly name: *Specify deadlines for automatic updates and restarts* - GP name: *ConfigureDeadlineGracePeriod* - GP element: *ConfigureDeadlineGracePeriod* - GP path: *Administrative Templates\Windows Components\WindowsUpdate* @@ -1461,7 +1461,7 @@ When disabled, if the device has installed the required updates and is outside o ADMX Info: -- GP English name: *Specify deadlines for automatic updates and restarts* +- GP Friendly name: *Specify deadlines for automatic updates and restarts* - GP name: *ConfigureDeadlineNoAutoReboot* - GP element: *ConfigureDeadlineNoAutoReboot* - GP path: *Administrative Templates\Windows Components\WindowsUpdate* @@ -1590,7 +1590,7 @@ Supported values are 0-365 days. ADMX Info: -- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* - GP name: *DeferFeatureUpdates* - GP element: *DeferFeatureUpdatesPeriodId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -1652,7 +1652,7 @@ Supported values are 0-30. ADMX Info: -- GP English name: *Select when Quality Updates are received* +- GP Friendly name: *Select when Quality Updates are received* - GP name: *DeferQualityUpdates* - GP element: *DeferQualityUpdatesPeriodId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -1929,7 +1929,7 @@ Added in Windows 10, version 1703. Specifies the scan frequency from every 1 - 2 ADMX Info: -- GP English name: *Automatic Updates detection frequency* +- GP Friendly name: *Automatic Updates detection frequency* - GP name: *DetectionFrequency_Title* - GP element: *DetectionFrequency_Hour2* - GP path: *Windows Components/Windows Update* @@ -1995,7 +1995,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. ADMX Info: -- GP English name: *Do not allow update deferral policies to cause scans against Windows Update* +- GP Friendly name: *Do not allow update deferral policies to cause scans against Windows Update* - GP name: *DisableDualScan* - GP path: *Windows Components/Windows Update* - GP ADMX file name: *WindowsUpdate.admx* @@ -2074,7 +2074,7 @@ IT admins can, if necessary, opt devices out of safeguard protections using this ADMX Info: -- GP English name: *Disable safeguards for Feature Updates* +- GP Friendly name: *Disable safeguards for Feature Updates* - GP name: *DisableWUfBSafeguards* - GP path: *Windows Components/Windows Update/Windows Update for Business* - GP ADMX file name: *WindowsUpdate.admx* @@ -2158,7 +2158,7 @@ If any of the following policies are configured, this policy has no effect: ADMX Info: -- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* - GP name: *EngagedRestartTransitionSchedule* - GP element: *EngagedRestartDeadline* - GP path: *Windows Components/Windows Update* @@ -2231,7 +2231,7 @@ If any of the following policies are configured, this policy has no effect: ADMX Info: -- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* - GP name: *EngagedRestartTransitionSchedule* - GP element: *EngagedRestartDeadlineForFeatureUpdates* - GP path: *Windows Components/Windows Update* @@ -2302,7 +2302,7 @@ If any of the following policies are configured, this policy has no effect: ADMX Info: -- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* - GP name: *EngagedRestartTransitionSchedule* - GP element: *EngagedRestartSnoozeSchedule* - GP path: *Windows Components/Windows Update* @@ -2373,7 +2373,7 @@ If any of the following policies are configured, this policy has no effect: ADMX Info: -- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* - GP name: *EngagedRestartTransitionSchedule* - GP element: *EngagedRestartSnoozeScheduleForFeatureUpdates* - GP path: *Windows Components/Windows Update* @@ -2444,7 +2444,7 @@ If any of the following policies are configured, this policy has no effect: ADMX Info: -- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* - GP name: *EngagedRestartTransitionSchedule* - GP element: *EngagedRestartTransitionSchedule* - GP path: *Windows Components/Windows Update* @@ -2515,7 +2515,7 @@ If any of the following policies are configured, this policy has no effect: ADMX Info: -- GP English name: *Specify Engaged restart transition and notification schedule for updates* +- GP Friendly name: *Specify Engaged restart transition and notification schedule for updates* - GP name: *EngagedRestartTransitionSchedule* - GP element: *EngagedRestartTransitionScheduleForFeatureUpdates* - GP path: *Windows Components/Windows Update* @@ -2578,7 +2578,7 @@ Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update ( ADMX Info: -- GP English name: *Do not include drivers with Windows Updates* +- GP Friendly name: *Do not include drivers with Windows Updates* - GP name: *ExcludeWUDriversInQualityUpdate* - GP path: *Windows Components/Windows Update* - GP ADMX file name: *WindowsUpdate.admx* @@ -2647,7 +2647,7 @@ Added in the April service release of Windows 10, version 1607. Allows Windows U ADMX Info: -- GP English name: *Specify intranet Microsoft update service location* +- GP Friendly name: *Specify intranet Microsoft update service location* - GP name: *CorpWuURL* - GP element: *CorpWUFillEmptyContentUrls* - GP path: *Windows Components/Windows Update* @@ -2856,7 +2856,7 @@ Added in Windows 10, version 1709. Used to manage Windows 10 Insider Preview bu ADMX Info: -- GP English name: *Manage preview builds* +- GP Friendly name: *Manage preview builds* - GP name: *ManagePreviewBuilds* - GP element: *ManagePreviewBuildsId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -3001,7 +3001,7 @@ Added in Windows 10, version 1607. Allows IT Admins to pause feature updates fo ADMX Info: -- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* - GP name: *DeferFeatureUpdates* - GP element: *PauseFeatureUpdatesId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -3070,7 +3070,7 @@ Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, ADMX Info: -- GP English name: *Select when Preview Builds and Feature Updates are received* +- GP Friendly name: *Select when Preview Builds and Feature Updates are received* - GP name: *DeferFeatureUpdates* - GP element: *PauseFeatureUpdatesStartId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -3130,7 +3130,7 @@ Added in Windows 10, version 1607. Allows IT Admins to pause quality updates. F ADMX Info: -- GP English name: *Select when Quality Updates are received* +- GP Friendly name: *Select when Quality Updates are received* - GP name: *DeferQualityUpdates* - GP element: *PauseQualityUpdatesId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -3199,7 +3199,7 @@ Value type is string (yyyy-mm-dd, ex. 2018-10-28). Supported operations are Add, ADMX Info: -- GP English name: *Select when Quality Updates are received* +- GP Friendly name: *Select when Quality Updates are received* - GP name: *DeferQualityUpdates* - GP element: *PauseQualityUpdatesStartId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -3405,7 +3405,7 @@ The default value is 15 (minutes). ADMX Info: -- GP English name: *Configure auto-restart warning notifications schedule for updates* +- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* - GP name: *RestartWarnRemind* - GP element: *RestartWarn* - GP path: *Windows Components/Windows Update* @@ -3475,7 +3475,7 @@ The default value is 4 (hours). ADMX Info: -- GP English name: *Configure auto-restart warning notifications schedule for updates* +- GP Friendly name: *Configure auto-restart warning notifications schedule for updates* - GP name: *RestartWarnRemind* - GP element: *RestartWarnRemind* - GP path: *Windows Components/Windows Update* @@ -3543,7 +3543,7 @@ Supported operations are Add, Delete, Get, and Replace. ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *AutoUpdateSchDay* - GP path: *Windows Components/Windows Update* @@ -3620,7 +3620,7 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *AutoUpdateSchEveryWeek* - GP path: *Windows Components/Windows Update* @@ -3684,7 +3684,7 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *AutoUpdateSchFirstWeek* - GP path: *Windows Components/Windows Update* @@ -3748,7 +3748,7 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *ScheduledInstallFourthWeek* - GP path: *Windows Components/Windows Update* @@ -3812,7 +3812,7 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *ScheduledInstallSecondWeek* - GP path: *Windows Components/Windows Update* @@ -3876,7 +3876,7 @@ Added in Windows 10, version 1709. Enables the IT admin to schedule the update i ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *ScheduledInstallThirdWeek* - GP path: *Windows Components/Windows Update* @@ -3948,7 +3948,7 @@ The default value is 3. ADMX Info: -- GP English name: *Configure Automatic Updates* +- GP Friendly name: *Configure Automatic Updates* - GP name: *AutoUpdateCfg* - GP element: *AutoUpdateSchTime* - GP path: *Windows Components/Windows Update* @@ -4008,7 +4008,7 @@ Added in Windows 10, version 1703. Allows the IT Admin to disable auto-restart ADMX Info: -- GP English name: *Turn off auto-restart notifications for update installations* +- GP Friendly name: *Turn off auto-restart notifications for update installations* - GP name: *AutoRestartNotificationDisable* - GP element: *AutoRestartNotificationSchd* - GP path: *Windows Components/Windows Update* @@ -4195,7 +4195,7 @@ When you set this policy along with Update/ActiveHoursStart, Update/ActiveHoursE ADMX Info: -- GP English name: *Update Power Policy for Cart Restarts* +- GP Friendly name: *Update Power Policy for Cart Restarts* - GP name: *SetEDURestart* - GP path: *Windows Components/Windows Update* - GP ADMX file name: *WindowsUpdate.admx* @@ -4264,7 +4264,7 @@ This policy setting does not impact those customers who have, per Microsoft reco ADMX Info: -- GP English name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* +- GP Friendly name: *Select the proxy behavior for Windows Update client for detecting updates with non-TLS (HTTP) based service* - GP name: *Select the proxy behavior* - GP element: *Select the proxy behavior* - GP path: *Windows Components/Windows Update/Specify intranet Microsoft update service location* @@ -4332,7 +4332,7 @@ Available in Windows 10, version 1803 and later. Enables IT administrators to sp ADMX Info: -- GP English name: *Select the target Feature Update version* +- GP Friendly name: *Select the target Feature Update version* - GP name: *TargetReleaseVersion* - GP element: *TargetReleaseVersionId* - GP path: *Windows Components/Windows Update/Windows Update for Business* @@ -4410,7 +4410,7 @@ Options: ADMX Info: -- GP English name: *Display options for update notifications* +- GP Friendly name: *Display options for update notifications* - GP name: *UpdateNotificationLevel* - GP path: *Windows Components/Windows Update* - GP ADMX file name: *WindowsUpdate.admx* @@ -4483,7 +4483,7 @@ Supported operations are Get and Replace. ADMX Info: -- GP English name: *Specify intranet Microsoft update service location* +- GP Friendly name: *Specify intranet Microsoft update service location* - GP name: *CorpWuURL* - GP element: *CorpWUURL_Name* - GP path: *Windows Components/Windows Update* @@ -4581,7 +4581,7 @@ Value type is string and the default value is an empty string, "". If the settin ADMX Info: -- GP English name: *Specify intranet Microsoft update service location* +- GP Friendly name: *Specify intranet Microsoft update service location* - GP name: *CorpWuURL* - GP element: *CorpWUContentHost_Name* - GP path: *Windows Components/Windows Update* @@ -4602,4 +4602,4 @@ Footnotes: - 7 - Available in Windows 10, version 1909. - 8 - Available in Windows 10, version 2004. - \ No newline at end of file +1` \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 4a44915184..7ac5e6f283 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -243,7 +243,7 @@ This user right is used by Credential Manager during Backup/Restore. No accounts GP Info: -- GP English name: *Access Credential Manager as a trusted caller* +- GP Friendly name: *Access Credential Manager as a trusted caller* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -302,7 +302,7 @@ This user right determines which users and groups are allowed to connect to the GP Info: -- GP English name: *Access this computer from the network* +- GP Friendly name: *Access this computer from the network* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -361,7 +361,7 @@ This user right allows a process to impersonate any user without authentication. GP Info: -- GP English name: *Act as part of the operating system* +- GP Friendly name: *Act as part of the operating system* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -420,7 +420,7 @@ This user right determines which users can log on to the computer. GP Info: -- GP English name: *Allow log on locally* +- GP Friendly name: *Allow log on locally* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -479,7 +479,7 @@ This user right determines which users can bypass file, directory, registry, and GP Info: -- GP English name: *Back up files and directories* +- GP Friendly name: *Back up files and directories* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -536,7 +536,7 @@ This user right determines which users and groups can change the time and date o GP Info: -- GP English name: *Change the system time* +- GP Friendly name: *Change the system time* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -595,7 +595,7 @@ This security setting determines whether users can create global objects that ar GP Info: -- GP English name: *Create global objects* +- GP Friendly name: *Create global objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -652,7 +652,7 @@ This user right determines which users and groups can call an internal applicati GP Info: -- GP English name: *Create a pagefile* +- GP Friendly name: *Create a pagefile* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -709,7 +709,7 @@ This user right determines which accounts can be used by processes to create a d GP Info: -- GP English name: *Create permanent shared objects* +- GP Friendly name: *Create permanent shared objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -770,7 +770,7 @@ This user right determines if the user can create a symbolic link from the compu GP Info: -- GP English name: *Create symbolic links* +- GP Friendly name: *Create symbolic links* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -829,7 +829,7 @@ This user right determines which accounts can be used by processes to create a t GP Info: -- GP English name: *Create a token object* +- GP Friendly name: *Create a token object* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -888,7 +888,7 @@ This user right determines which users can attach a debugger to any process or t GP Info: -- GP English name: *Debug programs* +- GP Friendly name: *Debug programs* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -945,7 +945,7 @@ This user right determines which users are prevented from accessing a computer o GP Info: -- GP English name: *Deny access to this computer from the network* +- GP Friendly name: *Deny access to this computer from the network* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1004,7 +1004,7 @@ This security setting determines which service accounts are prevented from regis GP Info: -- GP English name: *Deny log on Locally* +- GP Friendly name: *Deny log on Locally* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1061,7 +1061,7 @@ This user right determines which users and groups are prohibited from logging on GP Info: -- GP English name: *Deny log on through Remote Desktop Services* +- GP Friendly name: *Deny log on through Remote Desktop Services* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1120,7 +1120,7 @@ This user right determines which users can set the Trusted for Delegation settin GP Info: -- GP English name: *Enable computer and user accounts to be trusted for delegation* +- GP Friendly name: *Enable computer and user accounts to be trusted for delegation* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1177,7 +1177,7 @@ This user right determines which accounts can be used by a process to add entrie GP Info: -- GP English name: *Generate security audits* +- GP Friendly name: *Generate security audits* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1244,7 +1244,7 @@ Because of these factors, users do not usually need this user right. GP Info: -- GP English name: *Impersonate a client after authentication* +- GP Friendly name: *Impersonate a client after authentication* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1301,7 +1301,7 @@ This user right determines which accounts can use a process with Write Property GP Info: -- GP English name: *Increase scheduling priority* +- GP Friendly name: *Increase scheduling priority* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* > [!WARNING] @@ -1365,7 +1365,7 @@ This user right determines which users can dynamically load and unload device dr GP Info: -- GP English name: *Load and unload device drivers* +- GP Friendly name: *Load and unload device drivers* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1422,7 +1422,7 @@ This user right determines which accounts can use a process to keep data in phys GP Info: -- GP English name: *Lock pages in memory* +- GP Friendly name: *Lock pages in memory* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1479,7 +1479,7 @@ This user right determines which users can specify object access auditing option GP Info: -- GP English name: *Manage auditing and security log* +- GP Friendly name: *Manage auditing and security log* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1536,7 +1536,7 @@ This user right determines which users and groups can run maintenance tasks on a GP Info: -- GP English name: *Perform volume maintenance tasks* +- GP Friendly name: *Perform volume maintenance tasks* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1595,7 +1595,7 @@ This user right determines who can modify firmware environment values. Firmware GP Info: -- GP English name: *Modify firmware environment values* +- GP Friendly name: *Modify firmware environment values* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1652,7 +1652,7 @@ This user right determines which user accounts can modify the integrity label of GP Info: -- GP English name: *Modify an object label* +- GP Friendly name: *Modify an object label* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1709,7 +1709,7 @@ This user right determines which users can use performance monitoring tools to m GP Info: -- GP English name: *Profile single process* +- GP Friendly name: *Profile single process* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1766,7 +1766,7 @@ This user right determines which users are allowed to shut down a computer from GP Info: -- GP English name: *Force shutdown from a remote system* +- GP Friendly name: *Force shutdown from a remote system* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1825,7 +1825,7 @@ This user right determines which users can bypass file, directory, registry, and GP Info: -- GP English name: *Restore files and directories* +- GP Friendly name: *Restore files and directories* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* @@ -1884,7 +1884,7 @@ This user right determines which users can take ownership of any securable objec GP Info: -- GP English name: *Take ownership of files or other objects* +- GP Friendly name: *Take ownership of files or other objects* - GP path: *Windows Settings/Security Settings/Local Policies/User Rights Assignment* diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index db63da7a5a..0db9332538 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -112,7 +112,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services* +- GP Friendly name: *Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services* - GP name: *WiFiSense* - GP path: *Network/WLAN Service/WLAN Settings* - GP ADMX file name: *wlansvc.admx* @@ -180,7 +180,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Prohibit use of Internet Connection Sharing on your DNS domain network* +- GP Friendly name: *Prohibit use of Internet Connection Sharing on your DNS domain network* - GP name: *NC_ShowSharedAccessUI* - GP path: *Network/Network Connections* - GP ADMX file name: *NetworkConnections.admx* diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 4f89b78bcf..08a46d3820 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -98,7 +98,7 @@ If this policy setting is not configured or is disabled, computers are allowed t ADMX Info: -- GP English name: *Prohibit connection to non-domain networks when connected to domain authenticated network* +- GP Friendly name: *Prohibit connection to non-domain networks when connected to domain authenticated network* - GP name: *WCM_BlockNonDomain* - GP path: *Network/Windows Connection Manager* - GP ADMX file name: *WCM.admx* diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index a4cd3536f0..10c2f369a9 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -143,7 +143,7 @@ Value type is string. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Specify contact company name* +- GP Friendly name: *Specify contact company name* - GP name: *EnterpriseCustomization_CompanyName* - GP element: *Presentation_EnterpriseCustomization_CompanyName* - GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* @@ -203,7 +203,7 @@ Added in Windows 10, next major release. Use this policy setting to specify if t ADMX Info: -- GP English name: *Hide the Account protection area* +- GP Friendly name: *Hide the Account protection area* - GP name: *AccountProtection_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/Account protection* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -271,7 +271,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide the App and browser protection area* +- GP Friendly name: *Hide the App and browser protection area* - GP name: *AppBrowserProtection_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/App and browser protection* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -351,7 +351,7 @@ Supported values: ADMX Info: -- GP English name: *Disable the Clear TPM button* +- GP Friendly name: *Disable the Clear TPM button* - GP name: *DeviceSecurity_DisableClearTpmButton* - GP path: *Windows Components/Windows Security/Device security* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -419,7 +419,7 @@ Added in Windows 10, next major release. Use this policy setting if you want to ADMX Info: -- GP English name: *Hide the Device security area* +- GP Friendly name: *Hide the Device security area* - GP name: *DeviceSecurity_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/Device security* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -490,7 +490,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide non-critical notifications* +- GP Friendly name: *Hide non-critical notifications* - GP name: *Notifications_DisableEnhancedNotifications* - GP path: *Windows Components/Windows Defender Security Center/Notifications* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -558,7 +558,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide the Family options area* +- GP Friendly name: *Hide the Family options area* - GP name: *FamilyOptions_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/Family options* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -626,7 +626,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide the Device performance and health area* +- GP Friendly name: *Hide the Device performance and health area* - GP name: *DevicePerformanceHealth_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/Device performance and health* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -694,7 +694,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide the Firewall and network protection area* +- GP Friendly name: *Hide the Firewall and network protection area* - GP name: *FirewallNetworkProtection_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/Firewall and network protection* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -762,7 +762,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide all notifications* +- GP Friendly name: *Hide all notifications* - GP name: *Notifications_DisableNotifications* - GP path: *Windows Components/Windows Defender Security Center/Notifications* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -842,7 +842,7 @@ Supported values: ADMX Info: -- GP English name: *Hide the TPM Firmware Update recommendation.* +- GP Friendly name: *Hide the TPM Firmware Update recommendation.* - GP name: *DeviceSecurity_DisableTpmFirmwareUpdateWarning* - GP path: *Windows Components/Windows Security/Device security* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -912,7 +912,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Hide the Virus and threat protection area* +- GP Friendly name: *Hide the Virus and threat protection area* - GP name: *VirusThreatProtection_UILockdown* - GP path: *Windows Components/Windows Defender Security Center/Virus and threat protection* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -980,7 +980,7 @@ Value type is integer. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Prevent users from modifying settings* +- GP Friendly name: *Prevent users from modifying settings* - GP name: *AppBrowserProtection_DisallowExploitProtectionOverride* - GP path: *Windows Components/Windows Defender Security Center/App and browser protection* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1048,7 +1048,7 @@ Value type is string. Supported operations are Add, Get, Replace and Delete. ADMX Info: -- GP English name: *Specify contact email address or Email ID* +- GP Friendly name: *Specify contact email address or Email ID* - GP name: *EnterpriseCustomization_Email* - GP element: *Presentation_EnterpriseCustomization_Email* - GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* @@ -1110,7 +1110,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. ADMX Info: -- GP English name: *Configure customized notifications* +- GP Friendly name: *Configure customized notifications* - GP name: *EnterpriseCustomization_EnableCustomizedToasts* - GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1178,7 +1178,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. ADMX Info: -- GP English name: *Configure customized contact information* +- GP Friendly name: *Configure customized contact information* - GP name: *EnterpriseCustomization_EnableInAppCustomization* - GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1244,7 +1244,7 @@ Added in Windows 10, version 1803. Use this policy setting to hide the Ransomwar ADMX Info: -- GP English name: *Hide the Ransomware data recovery area* +- GP Friendly name: *Hide the Ransomware data recovery area* - GP name: *VirusThreatProtection_HideRansomwareRecovery* - GP path: *Windows Components/Windows Defender Security Center/Virus and threat protection* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1310,7 +1310,7 @@ Added in Windows 10, version 1803. Use this policy to hide the Secure boot area ADMX Info: -- GP English name: *Hide the Secure boot area* +- GP Friendly name: *Hide the Secure boot area* - GP name: *DeviceSecurity_HideSecureBoot* - GP path: *Windows Components/Windows Defender Security Center/Device security* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1376,7 +1376,7 @@ Added in Windows 10, version 1803. Use this policy to hide the Security processo ADMX Info: -- GP English name: *Hide the Security processor (TPM) troubleshooter page* +- GP Friendly name: *Hide the Security processor (TPM) troubleshooter page* - GP name: *DeviceSecurity_HideTPMTroubleshooting* - GP path: *Windows Components/Windows Defender Security Center/Device security* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1458,7 +1458,7 @@ Supported values: ADMX Info: -- GP English name: *Hide Windows Security Systray* +- GP Friendly name: *Hide Windows Security Systray* - GP name: *Systray_HideSystray* - GP path: *Windows Components/Windows Security/Systray* - GP ADMX file name: *WindowsDefenderSecurityCenter.admx* @@ -1528,7 +1528,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. ADMX Info: -- GP English name: *Specify contact phone number or Skype ID* +- GP Friendly name: *Specify contact phone number or Skype ID* - GP name: *EnterpriseCustomization_Phone* - GP element: *Presentation_EnterpriseCustomization_Phone* - GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* @@ -1590,7 +1590,7 @@ Value type is Value type is string. Supported operations are Add, Get, Replace, ADMX Info: -- GP English name: *Specify contact website* +- GP Friendly name: *Specify contact website* - GP name: *EnterpriseCustomization_URL* - GP element: *Presentation_EnterpriseCustomization_URL* - GP path: *Windows Components/Windows Defender Security Center/Enterprise Customization* diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index e60269d795..b352b0818c 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -82,7 +82,7 @@ Added in Windows 10, version 1607. Show recommended app suggestions in the ink ADMX Info: -- GP English name: *Allow suggested apps in Windows Ink Workspace* +- GP Friendly name: *Allow suggested apps in Windows Ink Workspace* - GP name: *AllowSuggestedAppsInWindowsInkWorkspace* - GP path: *Windows Components/Windows Ink Workspace* - GP ADMX file name: *WindowsInkWorkspace.admx* @@ -148,7 +148,7 @@ Added in Windows 10, version 1607. Specifies whether to allow the user to acces ADMX Info: -- GP English name: *Allow Windows Ink Workspace* +- GP Friendly name: *Allow Windows Ink Workspace* - GP name: *AllowWindowsInkWorkspace* - GP element: *AllowWindowsInkWorkspaceDropdown* - GP path: *Windows Components/Windows Ink Workspace* diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index c7ccb54106..4d822efc0c 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -114,7 +114,7 @@ If you disable this policy setting, the device does not configure automatic sign ADMX Info: -- GP English name: *Sign-in and lock last interactive user automatically after a restart* +- GP Friendly name: *Sign-in and lock last interactive user automatically after a restart* - GP name: *AutomaticRestartSignOn* - GP path: *Windows Components/Windows Logon Options* - GP ADMX file name: *WinLogon.admx* @@ -199,7 +199,7 @@ If you disable or do not configure this setting, automatic sign on defaults to t ADMX Info: -- GP English name: *Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot* +- GP Friendly name: *Configure the mode of automatically signing in and locking last interactive user after a restart or cold boot* - GP name: *ConfigAutomaticRestartSignOn* - GP path: *Windows Components/Windows Logon Options* - GP ADMX file name: *WinLogon.admx* @@ -278,7 +278,7 @@ If you disable or do not configure this policy setting, users can choose which a ADMX Info: -- GP English name: *Turn off app notifications on the lock screen* +- GP Friendly name: *Turn off app notifications on the lock screen* - GP name: *DisableLockScreenAppNotifications* - GP path: *System/Logon* - GP ADMX file name: *logon.admx* @@ -373,7 +373,7 @@ Here is an example to enable this policy: ADMX Info: -- GP English name: *Do not display network selection UI* +- GP Friendly name: *Do not display network selection UI* - GP name: *DontDisplayNetworkSelectionUI* - GP path: *System/Logon* - GP ADMX file name: *logon.admx* @@ -441,7 +441,7 @@ If you do not configure this policy setting, the user who completes the initial ADMX Info: -- GP English name: *Show first sign-in animation* +- GP Friendly name: *Show first sign-in animation* - GP name: *EnableFirstLogonAnimation* - GP path: *System/Logon* - GP ADMX file name: *Logon.admx* @@ -522,7 +522,7 @@ If you disable or do not configure this policy setting, the Logon UI will not en ADMX Info: -- GP English name: *Enumerate local users on domain-joined computers* +- GP Friendly name: *Enumerate local users on domain-joined computers* - GP name: *EnumerateLocalUsers* - GP path: *System/Logon* - GP ADMX file name: *logon.admx* @@ -581,7 +581,7 @@ Added in Windows 10, version 1703. This policy setting allows you to hide the Sw ADMX Info: -- GP English name: *Hide entry points for Fast User Switching* +- GP Friendly name: *Hide entry points for Fast User Switching* - GP name: *HideFastUserSwitching* - GP path: *System/Logon* - GP ADMX file name: *Logon.admx* diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index b60def1361..3cf0a24d74 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -95,7 +95,7 @@ Note: This policy setting exists under both Computer Configuration and User Conf ADMX Info: -- GP English name: *Turn on PowerShell Script Block Logging* +- GP Friendly name: *Turn on PowerShell Script Block Logging* - GP name: *EnableScriptBlockLogging* - GP path: *Windows Components/Windows PowerShell* - GP ADMX file name: *PowerShellExecutionPolicy.admx* From f14f6cad560f70c2a6bcf5fd206f3e30e1e83021 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Wed, 11 Aug 2021 14:02:14 +0530 Subject: [PATCH 0015/1214] Updated --- .../mdm/policy-csp-datausage.md | 2 +- .../mdm/policy-csp-defender.md | 78 +-- .../mdm/policy-csp-deliveryoptimization.md | 54 +- .../mdm/policy-csp-desktop.md | 2 +- .../mdm/policy-csp-deviceguard.md | 8 +- .../mdm/policy-csp-deviceinstallation.md | 18 +- .../mdm/policy-csp-devicelock.md | 6 +- .../mdm/policy-csp-display.md | 10 +- .../mdm/policy-csp-dmaguard.md | 2 +- .../mdm/policy-csp-education.md | 4 +- .../mdm/policy-csp-errorreporting.md | 10 +- .../mdm/policy-csp-eventlogservice.md | 8 +- .../mdm/policy-csp-experience.md | 34 +- .../mdm/policy-csp-exploitguard.md | 2 +- .../mdm/policy-csp-fileexplorer.md | 4 +- .../mdm/policy-csp-handwriting.md | 2 +- .../mdm/policy-csp-internetexplorer.md | 514 +++++++++--------- .../mdm/policy-csp-kerberos.md | 10 +- .../mdm/policy-csp-lanmanworkstation.md | 2 +- .../mdm/policy-csp-licensing.md | 4 +- ...policy-csp-localpoliciessecurityoptions.md | 94 ++-- .../mdm/policy-csp-lockdown.md | 2 +- .../client-management/mdm/policy-csp-maps.md | 2 +- .../mdm/policy-csp-messaging.md | 2 +- .../mdm/policy-csp-multitasking.md | 2 +- .../mdm/policy-csp-networkisolation.md | 14 +- .../mdm/policy-csp-notifications.md | 6 +- .../client-management/mdm/policy-csp-power.md | 44 +- .../mdm/policy-csp-printers.md | 6 +- .../client-management/mdm/policy-csp-start.md | 8 +- .../mdm/policy-csp-storage.md | 18 +- .../mdm/policy-csp-system.md | 2 +- 32 files changed, 487 insertions(+), 487 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-datausage.md b/windows/client-management/mdm/policy-csp-datausage.md index cb540b3415..652bf56c3c 100644 --- a/windows/client-management/mdm/policy-csp-datausage.md +++ b/windows/client-management/mdm/policy-csp-datausage.md @@ -112,7 +112,7 @@ If this policy setting is disabled or is not configured, the cost of 4G connecti ADMX Info: -- GP English name: *Set 4G Cost* +- GP Friendly name: *Set 4G Cost* - GP name: *SetCost4G* - GP path: *Network/WWAN Service/WWAN Media Cost* - GP ADMX file name: *wwansvc.admx* diff --git a/windows/client-management/mdm/policy-csp-defender.md b/windows/client-management/mdm/policy-csp-defender.md index f70dd9c0e5..c7445826de 100644 --- a/windows/client-management/mdm/policy-csp-defender.md +++ b/windows/client-management/mdm/policy-csp-defender.md @@ -203,7 +203,7 @@ Allows or disallows scanning of archives. ADMX Info: -- GP English name: *Scan archive files* +- GP Friendly name: *Scan archive files* - GP name: *Scan_DisableArchiveScanning* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -273,7 +273,7 @@ Allows or disallows Windows Defender Behavior Monitoring functionality. ADMX Info: -- GP English name: *Turn on behavior monitoring* +- GP Friendly name: *Turn on behavior monitoring* - GP name: *RealtimeProtection_DisableBehaviorMonitoring* - GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -343,7 +343,7 @@ To best protect your PC, Windows Defender will send information to Microsoft abo ADMX Info: -- GP English name: *Join Microsoft MAPS* +- GP Friendly name: *Join Microsoft MAPS* - GP name: *SpynetReporting* - GP element: *SpynetReporting* - GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* @@ -414,7 +414,7 @@ Allows or disallows scanning of email. ADMX Info: -- GP English name: *Turn on e-mail scanning* +- GP Friendly name: *Turn on e-mail scanning* - GP name: *Scan_DisableEmailScanning* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -484,7 +484,7 @@ Allows or disallows a full scan of mapped network drives. ADMX Info: -- GP English name: *Run full scan on mapped network drives* +- GP Friendly name: *Run full scan on mapped network drives* - GP name: *Scan_DisableScanningMappedNetworkDrivesForFullScan* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -554,7 +554,7 @@ Allows or disallows a full scan of removable drives. During a quick scan, remova ADMX Info: -- GP English name: *Scan removable drives* +- GP Friendly name: *Scan removable drives* - GP name: *Scan_DisableRemovableDriveScanning* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -624,7 +624,7 @@ Allows or disallows Windows Defender IOAVP Protection functionality. ADMX Info: -- GP English name: *Scan all downloaded files and attachments* +- GP Friendly name: *Scan all downloaded files and attachments* - GP name: *RealtimeProtection_DisableIOAVProtection* - GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -756,7 +756,7 @@ Allows or disallows Windows Defender On Access Protection functionality. ADMX Info: -- GP English name: *Monitor file and program activity on your computer* +- GP Friendly name: *Monitor file and program activity on your computer* - GP name: *RealtimeProtection_DisableOnAccessProtection* - GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -826,7 +826,7 @@ Allows or disallows Windows Defender Realtime Monitoring functionality. ADMX Info: -- GP English name: *Turn off real-time protection* +- GP Friendly name: *Turn off real-time protection* - GP name: *DisableRealtimeMonitoring* - GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* - GP ADMX file name: *WindowsDefender.admx* @@ -896,7 +896,7 @@ Allows or disallows a scanning of network files. ADMX Info: -- GP English name: *Scan network files* +- GP Friendly name: *Scan network files* - GP name: *Scan_DisableScanningNetworkFiles* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* - GP ADMX file name: *WindowsDefender.admx* @@ -1028,7 +1028,7 @@ Allows or disallows user access to the Windows Defender UI. If disallowed, all W ADMX Info: -- GP English name: *Enable headless UI mode* +- GP Friendly name: *Enable headless UI mode* - GP name: *UX_Configuration_UILockdown* - GP path: *Windows Components/Microsoft Defender Antivirus/Client Interface* - GP ADMX file name: *WindowsDefender.admx* @@ -1100,7 +1100,7 @@ Value type is string. ADMX Info: -- GP English name: *Exclude files and paths from Attack Surface Reduction Rules* +- GP Friendly name: *Exclude files and paths from Attack Surface Reduction Rules* - GP name: *ExploitGuard_ASR_ASROnlyExclusions* - GP element: *ExploitGuard_ASR_ASROnlyExclusions* - GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* @@ -1168,7 +1168,7 @@ Value type is string. ADMX Info: -- GP English name: *Configure Attack Surface Reduction rules* +- GP Friendly name: *Configure Attack Surface Reduction rules* - GP name: *ExploitGuard_ASR_Rules* - GP element: *ExploitGuard_ASR_Rules* - GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Attack Surface Reduction* @@ -1235,7 +1235,7 @@ The default value is 50. ADMX Info: -- GP English name: *Specify the maximum percentage of CPU utilization during a scan* +- GP Friendly name: *Specify the maximum percentage of CPU utilization during a scan* - GP name: *Scan_AvgCPULoadFactor* - GP element: *Scan_AvgCPULoadFactor* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -1312,7 +1312,7 @@ OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/CheckForSignaturesBeforeRunni ADMX Info: -- GP English name: *Check for the latest virus and spyware definitions before running a scheduled scan* +- GP Friendly name: *Check for the latest virus and spyware definitions before running a scheduled scan* - GP name: *CheckForSignaturesBeforeRunningScan* - GP element: *CheckForSignaturesBeforeRunningScan* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -1392,7 +1392,7 @@ For more information about specific values that are supported, see the Microsoft ADMX Info: -- GP English name: *Select cloud protection level* +- GP Friendly name: *Select cloud protection level* - GP name: *MpEngine_MpCloudBlockLevel* - GP element: *MpCloudBlockLevel* - GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* @@ -1471,7 +1471,7 @@ For example, if the desired timeout is 60 seconds, specify 50 seconds in this se ADMX Info: -- GP English name: *Configure extended cloud check* +- GP Friendly name: *Configure extended cloud check* - GP name: *MpEngine_MpBafsExtendedTimeout* - GP element: *MpBafsExtendedTimeout* - GP path: *Windows Components/Microsoft Defender Antivirus/MpEngine* @@ -1534,7 +1534,7 @@ Added in Windows 10, version 1709. This policy setting allows user-specified app ADMX Info: -- GP English name: *Configure allowed applications* +- GP Friendly name: *Configure allowed applications* - GP name: *ExploitGuard_ControlledFolderAccess_AllowedApplications* - GP element: *ExploitGuard_ControlledFolderAccess_AllowedApplications* - GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* @@ -1597,7 +1597,7 @@ Added in Windows 10, version 1709. This policy settings allows adding user-speci ADMX Info: -- GP English name: *Configure protected folders* +- GP Friendly name: *Configure protected folders* - GP name: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* - GP element: *ExploitGuard_ControlledFolderAccess_ProtectedFolders* - GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* @@ -1664,7 +1664,7 @@ The default value is 0, which keeps items in quarantine, and does not automatica ADMX Info: -- GP English name: *Configure removal of items from Quarantine folder* +- GP Friendly name: *Configure removal of items from Quarantine folder* - GP name: *Quarantine_PurgeItemsAfterDelay* - GP element: *Quarantine_PurgeItemsAfterDelay* - GP path: *Windows Components/Microsoft Defender Antivirus/Quarantine* @@ -1739,7 +1739,7 @@ OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupFullScan ADMX Info: -- GP English name: *Turn on catch-up full scan* +- GP Friendly name: *Turn on catch-up full scan* - GP name: *Scan_DisableCatchupFullScan* - GP element: *Scan_DisableCatchupFullScan* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -1819,7 +1819,7 @@ OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/DisableCatchupQuickScan ADMX Info: -- GP English name: *Turn on catch-up quick scan* +- GP Friendly name: *Turn on catch-up quick scan* - GP name: *Scan_DisableCatchupQuickScan* - GP element: *Scan_DisableCatchupQuickScan* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -1891,7 +1891,7 @@ Added in Windows 10, version 1709. This policy enables setting the state (On/Off ADMX Info: -- GP English name: *Configure Controlled folder access* +- GP Friendly name: *Configure Controlled folder access* - GP name: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* - GP element: *ExploitGuard_ControlledFolderAccess_EnableControlledFolderAccess* - GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Controlled Folder Access* @@ -1968,7 +1968,7 @@ Supported values: ADMX Info: -- GP English name: *Configure low CPU priority for scheduled scans* +- GP Friendly name: *Configure low CPU priority for scheduled scans* - GP name: *Scan_LowCpuPriority* - GP element: *Scan_LowCpuPriority* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -2046,7 +2046,7 @@ If you do not configure this policy, network blocking will be disabled by defaul ADMX Info: -- GP English name: *Prevent users and apps from accessing dangerous websites* +- GP Friendly name: *Prevent users and apps from accessing dangerous websites* - GP name: *ExploitGuard_EnableNetworkProtection* - GP element: *ExploitGuard_EnableNetworkProtection* - GP path: *Windows Components/Microsoft Defender Antivirus/Windows Defender Exploit Guard/Network Protection* @@ -2118,7 +2118,7 @@ Allows an administrator to specify a list of file type extensions to ignore duri ADMX Info: -- GP English name: *Path Exclusions* +- GP Friendly name: *Path Exclusions* - GP name: *Exclusions_Paths* - GP element: *Exclusions_PathsList* - GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* @@ -2182,7 +2182,7 @@ Allows an administrator to specify a list of directory paths to ignore during a ADMX Info: -- GP English name: *Extension Exclusions* +- GP Friendly name: *Extension Exclusions* - GP name: *Exclusions_Extensions* - GP element: *Exclusions_ExtensionsList* - GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* @@ -2252,7 +2252,7 @@ Each file type must be separated by a **|**. For example, "C:\\Example.exe|C:\\E ADMX Info: -- GP English name: *Process Exclusions* +- GP Friendly name: *Process Exclusions* - GP name: *Exclusions_Processes* - GP element: *Exclusions_ProcessesList* - GP path: *Windows Components/Microsoft Defender Antivirus/Exclusions* @@ -2319,7 +2319,7 @@ Added in Windows 10, version 1607. Specifies the level of detection for potenti ADMX Info: -- GP English name: *Configure detection for potentially unwanted applications* +- GP Friendly name: *Configure detection for potentially unwanted applications* - GP name: *Root_PUAProtection* - GP element: *Root_PUAProtection* - GP path: *Windows Components/Microsoft Defender Antivirus* @@ -2394,7 +2394,7 @@ Controls which sets of files should be monitored. ADMX Info: -- GP English name: *Configure monitoring for incoming and outgoing file and program activity* +- GP Friendly name: *Configure monitoring for incoming and outgoing file and program activity* - GP name: *RealtimeProtection_RealtimeScanDirection* - GP element: *RealtimeProtection_RealtimeScanDirection* - GP path: *Windows Components/Microsoft Defender Antivirus/Real-time Protection* @@ -2466,7 +2466,7 @@ Selects whether to perform a quick scan or full scan. ADMX Info: -- GP English name: *Specify the scan type to use for a scheduled scan* +- GP Friendly name: *Specify the scan type to use for a scheduled scan* - GP name: *Scan_ScanParameters* - GP element: *Scan_ScanParameters* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -2546,7 +2546,7 @@ The default value is 120 ADMX Info: -- GP English name: *Specify the time for a daily quick scan* +- GP Friendly name: *Specify the time for a daily quick scan* - GP name: *Scan_ScheduleQuickScantime* - GP element: *Scan_ScheduleQuickScantime* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -2617,7 +2617,7 @@ Selects the day that the Windows Defender scan should run. ADMX Info: -- GP English name: *Specify the day of the week to run a scheduled scan* +- GP Friendly name: *Specify the day of the week to run a scheduled scan* - GP name: *Scan_ScheduleDay* - GP element: *Scan_ScheduleDay* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -2704,7 +2704,7 @@ The default value is 120. ADMX Info: -- GP English name: *Specify the time of day to run a scheduled scan* +- GP Friendly name: *Specify the time of day to run a scheduled scan* - GP name: *Scan_ScheduleTime* - GP element: *Scan_ScheduleTime* - GP path: *Windows Components/Microsoft Defender Antivirus/Scan* @@ -2783,7 +2783,7 @@ OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFallbackOrder ADMX Info: -- GP English name: *Define the order of sources for downloading definition updates* +- GP Friendly name: *Define the order of sources for downloading definition updates* - GP name: *SignatureUpdate_FallbackOrder* - GP element: *SignatureUpdate_FallbackOrder* - GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* @@ -2862,7 +2862,7 @@ OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateFileSharesSour ADMX Info: -- GP English name: *Define file shares for downloading definition updates* +- GP Friendly name: *Define file shares for downloading definition updates* - GP name: *SignatureUpdate_DefinitionUpdateFileSharesSources* - GP element: *SignatureUpdate_DefinitionUpdateFileSharesSources* - GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* @@ -2942,7 +2942,7 @@ OMA-URI Path: ./Vendor/MSFT/Policy/Config/Defender/SignatureUpdateInterval ADMX Info: -- GP English name: *Specify the interval to check for definition updates* +- GP Friendly name: *Specify the interval to check for definition updates* - GP name: *SignatureUpdate_SignatureUpdateInterval* - GP element: *SignatureUpdate_SignatureUpdateInterval* - GP path: *Windows Components/Microsoft Defender Antivirus/Signature Updates* @@ -3010,7 +3010,7 @@ Checks for the user consent level in Windows Defender to send data. If the requi ADMX Info: -- GP English name: *Send file samples when further analysis is required* +- GP Friendly name: *Send file samples when further analysis is required* - GP name: *SubmitSamplesConsent* - GP element: *SubmitSamplesConsent* - GP path: *Windows Components/Microsoft Defender Antivirus/MAPS* @@ -3101,7 +3101,7 @@ The following list shows the supported values for possible actions: ADMX Info: -- GP English name: *Specify threat alert levels at which default action should not be taken when detected* +- GP Friendly name: *Specify threat alert levels at which default action should not be taken when detected* - GP name: *Threats_ThreatSeverityDefaultAction* - GP element: *Threats_ThreatSeverityDefaultActionList* - GP path: *Windows Components/Microsoft Defender Antivirus/Threats* diff --git a/windows/client-management/mdm/policy-csp-deliveryoptimization.md b/windows/client-management/mdm/policy-csp-deliveryoptimization.md index 1031aada9c..a1644a0373 100644 --- a/windows/client-management/mdm/policy-csp-deliveryoptimization.md +++ b/windows/client-management/mdm/policy-csp-deliveryoptimization.md @@ -172,7 +172,7 @@ The default value is 10. ADMX Info: -- GP English name: *Absolute Max Cache Size (in GB)* +- GP Friendly name: *Absolute Max Cache Size (in GB)* - GP name: *AbsoluteMaxCacheSize* - GP element: *AbsoluteMaxCacheSize* - GP path: *Windows Components/Delivery Optimization* @@ -236,7 +236,7 @@ Added in Windows 10, version 1703. Specifies whether the device is allowed to p ADMX Info: -- GP English name: *Enable Peer Caching while the device connects via VPN* +- GP Friendly name: *Enable Peer Caching while the device connects via VPN* - GP name: *AllowVPNPeerCaching* - GP element: *AllowVPNPeerCaching* - GP path: *Windows Components/Delivery Optimization* @@ -306,7 +306,7 @@ One or more values can be added as either fully qualified domain names (FQDN) or ADMX Info: -- GP English name: *Cache Server Hostname* +- GP Friendly name: *Cache Server Hostname* - GP name: *CacheHost* - GP element: *CacheHost* - GP path: *Windows Components/Delivery Optimization* @@ -376,7 +376,7 @@ This policy allows you to configure one or more Delivery Optimization in Network ADMX Info: -- GP English name: *Cache Server Hostname Source* +- GP Friendly name: *Cache Server Hostname Source* - GP name: *CacheHostSource* - GP element: *CacheHostSource* - GP path: *Windows Components/Delivery Optimization* @@ -457,7 +457,7 @@ After the max delay is reached, the download will resume using HTTP, either down ADMX Info: -- GP English name: *Delay background download from http (in secs)* +- GP Friendly name: *Delay background download from http (in secs)* - GP name: *DelayBackgroundDownloadFromHttp* - GP element: *DelayBackgroundDownloadFromHttp* - GP path: *Windows Components/Delivery Optimization* @@ -520,7 +520,7 @@ Specifies the time in seconds to delay the fallback from Cache Server to the HTT ADMX Info: -- GP English name: *Delay Background download Cache Server fallback (in seconds)* +- GP Friendly name: *Delay Background download Cache Server fallback (in seconds)* - GP name: *DelayCacheServerFallbackBackground* - GP element: *DelayCacheServerFallbackBackground* - GP path: *Windows Components/Delivery Optimization* @@ -593,7 +593,7 @@ Specifies the time in seconds to delay the fallback from Cache Server to the HTT ADMX Info: -- GP English name: *Delay Foreground download Cache Server fallback (in seconds)* +- GP Friendly name: *Delay Foreground download Cache Server fallback (in seconds)* - GP name: *DelayCacheServerFallbackForeground* - GP element: *DelayCacheServerFallbackForeground* - GP path: *Windows Components/Delivery Optimization* @@ -667,7 +667,7 @@ The recommended value is 1 minute (60). ADMX Info: -- GP English name: *Delay Foreground download from http (in secs)* +- GP Friendly name: *Delay Foreground download from http (in secs)* - GP name: *DelayForegroundDownloadFromHttp* - GP element: *DelayForegroundDownloadFromHttp* - GP path: *Windows Components/Delivery Optimization* @@ -739,7 +739,7 @@ Specifies the download method that Delivery Optimization can use in downloads of ADMX Info: -- GP English name: *Download Mode* +- GP Friendly name: *Download Mode* - GP name: *DownloadMode* - GP element: *DownloadMode* - GP path: *Windows Components/Delivery Optimization* @@ -816,7 +816,7 @@ This Policy specifies an arbitrary group ID that the device belongs to. Use this ADMX Info: -- GP English name: *Group ID* +- GP Friendly name: *Group ID* - GP name: *GroupId* - GP element: *GroupId* - GP path: *Windows Components/Delivery Optimization* @@ -886,7 +886,7 @@ Starting with Windows 10, version 1903, you can use the Azure Active Directory ( ADMX Info: -- GP English name: *Select the source of Group IDs* +- GP Friendly name: *Select the source of Group IDs* - GP name: *GroupIdSource* - GP element: *GroupIdSource* - GP path: *Windows Components/Delivery Optimization* @@ -958,7 +958,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts ADMX Info: -- GP English name: *Maximum Background Download Bandwidth (in KB/s)* +- GP Friendly name: *Maximum Background Download Bandwidth (in KB/s)* - GP name: *MaxBackgroundDownloadBandwidth* - GP element: *MaxBackgroundDownloadBandwidth* - GP path: *Windows Components/Delivery Optimization* @@ -1024,7 +1024,7 @@ The default value is 259200 seconds (3 days). ADMX Info: -- GP English name: *Max Cache Age (in seconds)* +- GP Friendly name: *Max Cache Age (in seconds)* - GP name: *MaxCacheAge* - GP element: *MaxCacheAge* - GP path: *Windows Components/Delivery Optimization* @@ -1090,7 +1090,7 @@ The default value is 20. ADMX Info: -- GP English name: *Max Cache Size (percentage)* +- GP Friendly name: *Max Cache Size (percentage)* - GP name: *MaxCacheSize* - GP element: *MaxCacheSize* - GP path: *Windows Components/Delivery Optimization* @@ -1175,7 +1175,7 @@ The default value 0 (zero) means that Delivery Optimization dynamically adjusts ADMX Info: -- GP English name: *Maximum Foreground Download Bandwidth (in KB/s)* +- GP Friendly name: *Maximum Foreground Download Bandwidth (in KB/s)* - GP name: *MaxForegroundDownloadBandwidth* - GP element: *MaxForegroundDownloadBandwidth* - GP path: *Windows Components/Delivery Optimization* @@ -1260,7 +1260,7 @@ The default value is 500. ADMX Info: -- GP English name: *Minimum Background QoS (in KB/s)* +- GP Friendly name: *Minimum Background QoS (in KB/s)* - GP name: *MinBackgroundQos* - GP element: *MinBackgroundQos* - GP path: *Windows Components/Delivery Optimization* @@ -1325,7 +1325,7 @@ The default value is 0. The value 0 (zero) means "not limited" and the cloud ser ADMX Info: -- GP English name: *Allow uploads while the device is on battery while under set Battery level (percentage)* +- GP Friendly name: *Allow uploads while the device is on battery while under set Battery level (percentage)* - GP name: *MinBatteryPercentageAllowedToUpload* - GP element: *MinBatteryPercentageAllowedToUpload* - GP path: *Windows Components/Delivery Optimization* @@ -1394,7 +1394,7 @@ The default value is 32 GB. ADMX Info: -- GP English name: *Minimum disk size allowed to use Peer Caching (in GB)* +- GP Friendly name: *Minimum disk size allowed to use Peer Caching (in GB)* - GP name: *MinDiskSizeAllowedToPeer* - GP element: *MinDiskSizeAllowedToPeer* - GP path: *Windows Components/Delivery Optimization* @@ -1460,7 +1460,7 @@ The default value is 100 MB. ADMX Info: -- GP English name: *Minimum Peer Caching Content File Size (in MB)* +- GP Friendly name: *Minimum Peer Caching Content File Size (in MB)* - GP name: *MinFileSizeToCache* - GP element: *MinFileSizeToCache* - GP path: *Windows Components/Delivery Optimization* @@ -1526,7 +1526,7 @@ The default value is 4 GB. ADMX Info: -- GP English name: *Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB)* +- GP Friendly name: *Minimum RAM capacity (inclusive) required to enable use of Peer Caching (in GB)* - GP name: *MinRAMAllowedToPeer* - GP element: *MinRAMAllowedToPeer* - GP path: *Windows Components/Delivery Optimization* @@ -1592,7 +1592,7 @@ By default, %SystemDrive% is used to store the cache. ADMX Info: -- GP English name: *Modify Cache Drive* +- GP Friendly name: *Modify Cache Drive* - GP name: *ModifyCacheDrive* - GP element: *ModifyCacheDrive* - GP path: *Windows Components/Delivery Optimization* @@ -1660,7 +1660,7 @@ The default value is 20. ADMX Info: -- GP English name: *Monthly Upload Data Cap (in GB)* +- GP Friendly name: *Monthly Upload Data Cap (in GB)* - GP name: *MonthlyUploadDataCap* - GP element: *MonthlyUploadDataCap* - GP path: *Windows Components/Delivery Optimization* @@ -1722,7 +1722,7 @@ Note that downloads from LAN peers will not be throttled even when this policy i ADMX Info: -- GP English name: *Maximum Background Download Bandwidth (percentage)* +- GP Friendly name: *Maximum Background Download Bandwidth (percentage)* - GP name: *PercentageMaxBackgroundBandwidth* - GP element: *PercentageMaxBackgroundBandwidth* - GP path: *Windows Components/Delivery Optimization* @@ -1797,7 +1797,7 @@ Note that downloads from LAN peers will not be throttled even when this policy i ADMX Info: -- GP English name: *Maximum Foreground Download Bandwidth (percentage)* +- GP Friendly namee: *Maximum Foreground Download Bandwidth (percentage)* - GP name: *PercentageMaxForegroundBandwidth* - GP element: *PercentageMaxForegroundBandwidth* - GP path: *Windows Components/Delivery Optimization* @@ -1860,7 +1860,7 @@ Option 1 (Subnet mask) applies to both Download Mode LAN (1) and Group (2). ADMX Info: -- GP English name: *Select a method to restrict Peer Selection* +- GP Friendly name: *Select a method to restrict Peer Selection* - GP name: *RestrictPeerSelectionBy* - GP element: *RestrictPeerSelectionBy* - GP path: *Windows Components/Delivery Optimization* @@ -1933,7 +1933,7 @@ Added in Windows 10, version 1803. Specifies the maximum background downloa ADMX Info: -- GP English name: *Set Business Hours to Limit Background Download Bandwidth* +- GP Friendly name: *Set Business Hours to Limit Background Download Bandwidth* - GP name: *SetHoursToLimitBackgroundDownloadBandwidth* - GP path: *Windows Components/Delivery Optimization* - GP ADMX file name: *DeliveryOptimization.admx* @@ -2007,7 +2007,7 @@ Added in Windows 10, version 1803. Specifies the maximum foreground downloa ADMX Info: -- GP English name: *Set Business Hours to Limit Foreground Download Bandwidth* +- GP Friendly name: *Set Business Hours to Limit Foreground Download Bandwidth* - GP name: *SetHoursToLimitForegroundDownloadBandwidth* - GP path: *Windows Components/Delivery Optimization* - GP ADMX file name: *DeliveryOptimization.admx* diff --git a/windows/client-management/mdm/policy-csp-desktop.md b/windows/client-management/mdm/policy-csp-desktop.md index dfbed26745..9a3bcc48ee 100644 --- a/windows/client-management/mdm/policy-csp-desktop.md +++ b/windows/client-management/mdm/policy-csp-desktop.md @@ -90,7 +90,7 @@ If you enable this setting, users are unable to type a new location in the Targe ADMX Info: -- GP English name: *Prohibit User from manually redirecting Profile Folders* +- GP Friendly name: *Prohibit User from manually redirecting Profile Folders* - GP name: *DisablePersonalDirChange* - GP path: *Desktop* - GP ADMX file name: *desktop.admx* diff --git a/windows/client-management/mdm/policy-csp-deviceguard.md b/windows/client-management/mdm/policy-csp-deviceguard.md index 64e37f5868..157279f8f5 100644 --- a/windows/client-management/mdm/policy-csp-deviceguard.md +++ b/windows/client-management/mdm/policy-csp-deviceguard.md @@ -95,7 +95,7 @@ For more information about System Guard, see [Introducing Windows Defender Syste ADMX Info: -- GP English name: *Turn On Virtualization Based Security* +- GP Friendly name: *Turn On Virtualization Based Security* - GP name: *VirtualizationBasedSecurity* - GP element: *SystemGuardDrop* - GP path: *System/Device Guard* @@ -164,7 +164,7 @@ Added in Windows 10, version 1709. Turns on virtualization based security(VBS) a ADMX Info: -- GP English name: *Turn On Virtualization Based Security* +- GP Friendly name: *Turn On Virtualization Based Security* - GP name: *VirtualizationBasedSecurity* - GP path: *System/Device Guard* - GP ADMX file name: *DeviceGuard.admx* @@ -230,7 +230,7 @@ Added in Windows 10, version 1709. This setting lets users turn on Credential Gu ADMX Info: -- GP English name: *Turn On Virtualization Based Security* +- GP Friendly name: *Turn On Virtualization Based Security* - GP name: *VirtualizationBasedSecurity* - GP element: *CredentialIsolationDrop* - GP path: *System/Device Guard* @@ -298,7 +298,7 @@ Added in Windows 10, version 1709. Specifies the platform security level at the ADMX Info: -- GP English name: *Turn On Virtualization Based Security* +- GP Friendly name: *Turn On Virtualization Based Security* - GP name: *VirtualizationBasedSecurity* - GP element: *RequirePlatformSecurityFeaturesDrop* - GP path: *System/Device Guard* diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 62ce04adc6..9d7aa06011 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -129,7 +129,7 @@ Peripherals can be specified by their [hardware identity](/windows-hardware/driv ADMX Info: -- GP English name: *Allow installation of devices that match any of these device IDs* +- GP Friendly name: *Allow installation of devices that match any of these device IDs* - GP name: *DeviceInstall_IDs_Allow* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -253,7 +253,7 @@ Peripherals can be specified by their [device instance ID](/windows-hardware/dri ADMX Info: -- GP English name: *Allow installation of devices that match any of these device instance IDs* +- GP Friendly name: *Allow installation of devices that match any of these device instance IDs* - GP name: *DeviceInstall_Instance_IDs_Allow* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -376,7 +376,7 @@ Peripherals can be specified by their [hardware identity](/windows-hardware/driv ADMX Info: -- GP English name: *Allow installation of devices using drivers that match these device setup classes* +- GP Friendly name: *Allow installation of devices using drivers that match these device setup classes* - GP name: *DeviceInstall_Classes_Allow* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -509,7 +509,7 @@ If you disable or do not configure this policy setting, the default evaluation i ADMX Info: -- GP English name: *Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria* +- GP Friendly name: *Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria* - GP name: *DeviceInstall_Allow_Deny_Layered* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -618,7 +618,7 @@ If you disable or do not configure this policy setting, the setting in the Devic ADMX Info: -- GP English name: *Prevent device metadata retrieval from the Internet* +- GP Friendly name: *Prevent device metadata retrieval from the Internet* - GP name: *DeviceMetadata_PreventDeviceMetadataFromNetwork* - GP path: *System/Device Installation* - GP ADMX file name: *DeviceSetup.admx* @@ -700,7 +700,7 @@ If you disable or do not configure this policy setting, Windows is allowed to in ADMX Info: -- GP English name: *Prevent installation of devices not described by other policy settings* +- GP Friendly name: *Prevent installation of devices not described by other policy settings* - GP name: *DeviceInstall_Unspecified_Deny* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -817,7 +817,7 @@ Peripherals can be specified by their [hardware identity](/windows-hardware/driv ADMX Info: -- GP English name: *Prevent installation of devices that match any of these device IDs* +- GP Friendly name: *Prevent installation of devices that match any of these device IDs* - GP name: *DeviceInstall_IDs_Deny* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -934,7 +934,7 @@ Peripherals can be specified by their [device instance ID](/windows-hardware/dri ADMX Info: -- GP English name: *Prevent installation of devices that match any of these device instance IDs* +- GP Friendly name: *Prevent installation of devices that match any of these device instance IDs* - GP name: *DeviceInstall_Instance_IDs_Deny* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* @@ -1064,7 +1064,7 @@ Peripherals can be specified by their [hardware identity](/windows-hardware/driv ADMX Info: -- GP English name: *Prevent installation of devices using drivers that match these device setup classes* +- GP Friendly name: *Prevent installation of devices using drivers that match these device setup classes* - GP name: *DeviceInstall_Classes_Deny* - GP path: *System/Device Installation/Device Installation Restrictions* - GP ADMX file name: *deviceinstallation.admx* diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index 730e173e27..b394ffb753 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -969,7 +969,7 @@ Configure the minimum password age to be more than 0 if you want Enforce passwor GP Info: -- GP English name: *Minimum password age* +- GP Friendly name: *Minimum password age* - GP path: *Windows Settings/Security Settings/Account Policies/Password Policy* @@ -1037,7 +1037,7 @@ If you enable this setting, users will no longer be able to enable or disable lo ADMX Info: -- GP English name: *Prevent enabling lock screen camera* +- GP Friendly name: *Prevent enabling lock screen camera* - GP name: *CPL_Personalization_NoLockScreenCamera* - GP path: *Control Panel/Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* @@ -1107,7 +1107,7 @@ If you enable this setting, users will no longer be able to modify slide show se ADMX Info: -- GP English name: *Prevent enabling lock screen slide show* +- GP Friendly name: *Prevent enabling lock screen slide show* - GP name: *CPL_Personalization_NoLockScreenSlideshow* - GP path: *Control Panel/Personalization* - GP ADMX file name: *ControlPanelDisplay.admx* diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 82dbb630ae..fb0f2838d1 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -91,7 +91,7 @@ This policy allows you to disable Per-Process System DPI for a semicolon-separat ADMX Info: -- GP English name: *Configure Per-Process System DPI settings* +- GP Friendly name: *Configure Per-Process System DPI settings* - GP name: *DisplayPerProcessSystemDpiSettings* - GP element: *DisplayDisablePerProcessSystemDpiSettings* - GP path: *System/Display* @@ -164,7 +164,7 @@ Enabling this setting lets you specify the system-wide default for desktop appli ADMX Info: -- GP English name: *Configure Per-Process System DPI settings* +- GP Friendly name: *Configure Per-Process System DPI settings* - GP name: *DisplayPerProcessSystemDpiSettings* - GP element: *DisplayGlobalPerProcessSystemDpiSettings* - GP path: *System/Display* @@ -231,7 +231,7 @@ This policy allows you to enable Per-Process System DPI for a semicolon-separate ADMX Info: -- GP English name: *Configure Per-Process System DPI settings* +- GP Friendly name: *Configure Per-Process System DPI settings* - GP name: *DisplayPerProcessSystemDpiSettings* - GP element: *DisplayEnablePerProcessSystemDpiSettings* - GP path: *System/Display* @@ -299,7 +299,7 @@ If GDI DPI Scaling is configured to both turn off and turn on an application, th ADMX Info: -- GP English name: *Turn off GdiDPIScaling for applications* +- GP Friendly name: *Turn off GdiDPIScaling for applications* - GP name: *DisplayTurnOffGdiDPIScaling* - GP element: *DisplayTurnOffGdiDPIScalingPrompt* - GP path: *System/Display* @@ -374,7 +374,7 @@ If GDI DPI Scaling is configured to both turn off and turn on an application, th ADMX Info: -- GP English name: *Turn on GdiDPIScaling for applications* +- GP Friendly name: *Turn on GdiDPIScaling for applications* - GP name: *DisplayTurnOnGdiDPIScaling* - GP element: *DisplayTurnOnGdiDPIScalingPrompt* - GP path: *System/Display* diff --git a/windows/client-management/mdm/policy-csp-dmaguard.md b/windows/client-management/mdm/policy-csp-dmaguard.md index 24279ffb4d..2ca5164a50 100644 --- a/windows/client-management/mdm/policy-csp-dmaguard.md +++ b/windows/client-management/mdm/policy-csp-dmaguard.md @@ -93,7 +93,7 @@ Supported values: ADMX Info: -- GP English name: *Enumeration policy for external devices incompatible with Kernel DMA Protection* +- GP Friendly name: *Enumeration policy for external devices incompatible with Kernel DMA Protection* - GP name: *DmaGuardEnumerationPolicy* - GP path: *System/Kernel DMA Protection* - GP ADMX file name: *dmaguard.admx* diff --git a/windows/client-management/mdm/policy-csp-education.md b/windows/client-management/mdm/policy-csp-education.md index 18cce493eb..7d2b8ebb1e 100644 --- a/windows/client-management/mdm/policy-csp-education.md +++ b/windows/client-management/mdm/policy-csp-education.md @@ -86,7 +86,7 @@ Added in Windows 10, version 2004. This policy setting allows you to control whe ADMX Info: -- GP English name: *Allow Graphing Calculator* +- GP Friendly name: *Allow Graphing Calculator* - GP name: *AllowGraphingCalculator* - GP path: *Windows Components/Calculator* - GP ADMX file name: *Programs.admx* @@ -203,7 +203,7 @@ Added in Windows 10, version 1709. Allows IT Admins to prevent user installatio ADMX Info: -- GP English name: *Prevent addition of printers* +- GP Friendly name: *Prevent addition of printers* - GP name: *NoAddPrinter* - GP path: *Control Panel/Printers* - GP ADMX file name: *Printing.admx* diff --git a/windows/client-management/mdm/policy-csp-errorreporting.md b/windows/client-management/mdm/policy-csp-errorreporting.md index b4f27cc7c0..a24a91ef51 100644 --- a/windows/client-management/mdm/policy-csp-errorreporting.md +++ b/windows/client-management/mdm/policy-csp-errorreporting.md @@ -112,7 +112,7 @@ If you disable or do not configure this policy setting, then the default consent ADMX Info: -- GP English name: *Customize consent settings* +- GP Friendly name: *Customize consent settings* - GP name: *WerConsentCustomize_2* - GP path: *Windows Components/Windows Error Reporting/Consent* - GP ADMX file name: *ErrorReporting.admx* @@ -182,7 +182,7 @@ If you disable or do not configure this policy setting, the Turn off Windows Err ADMX Info: -- GP English name: *Disable Windows Error Reporting* +- GP Friendly name: *Disable Windows Error Reporting* - GP name: *WerDisable_2* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -256,7 +256,7 @@ See also the Configure Error Reporting policy setting. ADMX Info: -- GP English name: *Display Error Notification* +- GP Friendly name: *Display Error Notification* - GP name: *PCH_ShowUI* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -326,7 +326,7 @@ If you disable or do not configure this policy setting, then consent policy sett ADMX Info: -- GP English name: *Do not send additional data* +- GP Friendly name: *Do not send additional data* - GP name: *WerNoSecondLevelData_2* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* @@ -396,7 +396,7 @@ If you disable or do not configure this policy setting, Windows Error Reporting ADMX Info: -- GP English name: *Prevent display of the user interface for critical errors* +- GP Friendly name: *Prevent display of the user interface for critical errors* - GP name: *WerDoNotShowUI* - GP path: *Windows Components/Windows Error Reporting* - GP ADMX file name: *ErrorReporting.admx* diff --git a/windows/client-management/mdm/policy-csp-eventlogservice.md b/windows/client-management/mdm/policy-csp-eventlogservice.md index d86bd44edc..43366ce6ff 100644 --- a/windows/client-management/mdm/policy-csp-eventlogservice.md +++ b/windows/client-management/mdm/policy-csp-eventlogservice.md @@ -101,7 +101,7 @@ Note: Old events may or may not be retained according to the "Backup log automat ADMX Info: -- GP English name: *Control Event Log behavior when the log file reaches its maximum size* +- GP Friendly name: *Control Event Log behavior when the log file reaches its maximum size* - GP name: *Channel_Log_Retention_1* - GP path: *Windows Components/Event Log Service/Application* - GP ADMX file name: *eventlog.admx* @@ -171,7 +171,7 @@ If you disable or do not configure this policy setting, the maximum size of the ADMX Info: -- GP English name: *Specify the maximum log file size (KB)* +- GP Friendly name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_1* - GP path: *Windows Components/Event Log Service/Application* - GP ADMX file name: *eventlog.admx* @@ -241,7 +241,7 @@ If you disable or do not configure this policy setting, the maximum size of the ADMX Info: -- GP English name: *Specify the maximum log file size (KB)* +- GP Friendly name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_2* - GP path: *Windows Components/Event Log Service/Security* - GP ADMX file name: *eventlog.admx* @@ -311,7 +311,7 @@ If you disable or do not configure this policy setting, the maximum size of the ADMX Info: -- GP English name: *Specify the maximum log file size (KB)* +- GP Friendly name: *Specify the maximum log file size (KB)* - GP name: *Channel_LogMaxSize_4* - GP path: *Windows Components/Event Log Service/System* - GP ADMX file name: *eventlog.admx* diff --git a/windows/client-management/mdm/policy-csp-experience.md b/windows/client-management/mdm/policy-csp-experience.md index 90192d37ac..ff50ae9cb0 100644 --- a/windows/client-management/mdm/policy-csp-experience.md +++ b/windows/client-management/mdm/policy-csp-experience.md @@ -152,7 +152,7 @@ Value type is integer. Supported values: ADMX Info: -- GP English name: *Allow Clipboard History* +- GP Friendly name: *Allow Clipboard History* - GP name: *AllowClipboardHistory* - GP path: *System/OS Policies* - GP ADMX file name: *OSPolicy.admx* @@ -229,7 +229,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow Cortana* +- GP Friendly name: *Allow Cortana* - GP name: *AllowCortana* - GP path: *Windows Components/Search* - GP ADMX file name: *Search.admx* @@ -361,7 +361,7 @@ When Find My Device is off, the device and its location are not registered and t ADMX Info: -- GP English name: *Turn On/Off Find My Device* +- GP Friendly name: *Turn On/Off Find My Device* - GP name: *FindMy_AllowFindMyDeviceConfig* - GP path: *Windows Components/Find My Device* - GP ADMX file name: *FindMy.admx* @@ -642,7 +642,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Do not use diagnostic data for tailored experiences* +- GP Friendly name: *Do not use diagnostic data for tailored experiences* - GP name: *DisableTailoredExperiencesWithDiagnosticData* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -712,7 +712,7 @@ Specifies whether to allow app and content suggestions from third-party software ADMX Info: -- GP English name: *Do not suggest third-party content in Windows spotlight* +- GP Friendly name: *Do not suggest third-party content in Windows spotlight* - GP name: *DisableThirdPartySuggestions* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -785,7 +785,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Turn off Microsoft consumer experiences* +- GP Friendly name: *Turn off Microsoft consumer experiences* - GP name: *DisableWindowsConsumerFeatures* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -857,7 +857,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Turn off all Windows spotlight features* +- GP Friendly name: *Turn off all Windows spotlight features* - GP name: *DisableWindowsSpotlightFeatures* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -928,7 +928,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Turn off Windows Spotlight on Action Center* +- GP Friendly name: *Turn off Windows Spotlight on Action Center* - GP name: *DisableWindowsSpotlightOnActionCenter* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -998,7 +998,7 @@ Added in Windows 10, version 1803. This policy allows IT admins to turn off Sugg ADMX Info: -- GP English name: *Turn off Windows Spotlight on Settings* +- GP Friendly name: *Turn off Windows Spotlight on Settings* - GP name: *DisableWindowsSpotlightOnSettings* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -1070,7 +1070,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Turn off the Windows Welcome Experience* +- GP Friendly name: *Turn off the Windows Welcome Experience* - GP name: *DisableWindowsSpotlightWindowsWelcomeExperience* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -1136,7 +1136,7 @@ Enables or disables Windows Tips / soft landing. ADMX Info: -- GP English name: *Do not show Windows tips* +- GP Friendly name: *Do not show Windows tips* - GP name: *DisableSoftLanding* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -1264,7 +1264,7 @@ Allows IT admins to specify whether spotlight should be used on the user's lock ADMX Info: -- GP English name: *Configure Windows spotlight on lock screen* +- GP Friendly name: *Configure Windows spotlight on lock screen* - GP name: *ConfigureWindowsSpotlight* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -1333,7 +1333,7 @@ If you disable or do not configure this policy setting, Windows experiences will ADMX Info: -- GP English name: *Turn off cloud optimized content* +- GP Friendly name: *Turn off cloud optimized content* - GP name: *DisableCloudOptimizedContent* - GP path: *Windows Components/Cloud Content* - GP ADMX file name: *CloudContent.admx* @@ -1403,7 +1403,7 @@ If you disable or do not configure this policy setting, users can control how of ADMX Info: -- GP English name: *Do not show feedback notifications* +- GP Friendly name: *Do not show feedback notifications* - GP name: *DoNotShowFeedbackNotifications* - GP path: *Data Collection and Preview Builds* - GP ADMX file name: *FeedbackNotifications.admx* @@ -1472,7 +1472,7 @@ Related policy: ADMX Info: -- GP English name: *Do not sync browser settings* +- GP Friendly name: *Do not sync browser settings* - GP name: *DisableWebBrowserSettingSync* - GP path: *Windows Components/Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -1567,7 +1567,7 @@ Related policy: ADMX Info: -- GP English name: *Prevent users from turning on browser syncing* +- GP Friendly name: *Prevent users from turning on browser syncing* - GP name: *PreventUsersFromTurningOnBrowserSyncing* - GP path: *Windows Components/Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -1664,7 +1664,7 @@ If you do not configure this policy setting, the lock option is shown in the Use ADMX Info: -- GP English name: *Show lock in the user tile menu* +- GP Friendly name: *Show lock in the user tile menu* - GP name: *ShowLockOption* - GP path: *File Explorer* - GP ADMX file name: *WindowsExplorer.admx* diff --git a/windows/client-management/mdm/policy-csp-exploitguard.md b/windows/client-management/mdm/policy-csp-exploitguard.md index 80e9be3716..e192bd9e82 100644 --- a/windows/client-management/mdm/policy-csp-exploitguard.md +++ b/windows/client-management/mdm/policy-csp-exploitguard.md @@ -81,7 +81,7 @@ The system settings require a reboot; the application settings do not require a ADMX Info: -- GP English name: *Use a common set of exploit protection settings* +- GP Friendly name: *Use a common set of exploit protection settings* - GP name: *ExploitProtection_Name* - GP element: *ExploitProtection_Name* - GP path: *Windows Components/Windows Defender Exploit Guard/Exploit Protection* diff --git a/windows/client-management/mdm/policy-csp-fileexplorer.md b/windows/client-management/mdm/policy-csp-fileexplorer.md index 58b2bf5175..82dce114b4 100644 --- a/windows/client-management/mdm/policy-csp-fileexplorer.md +++ b/windows/client-management/mdm/policy-csp-fileexplorer.md @@ -89,7 +89,7 @@ Disabling data execution prevention can allow certain legacy plug-in application ADMX Info: -- GP English name: *Turn off Data Execution Prevention for Explorer* +- GP Friendly name: *Turn off Data Execution Prevention for Explorer* - GP name: *NoDataExecutionPrevention* - GP path: *File Explorer* - GP ADMX file name: *Explorer.admx* @@ -155,7 +155,7 @@ Disabling heap termination on corruption can allow certain legacy plug-in applic ADMX Info: -- GP English name: *Turn off heap termination on corruption* +- GP Friendly name: *Turn off heap termination on corruption* - GP name: *NoHeapTerminationOnCorruption* - GP path: *File Explorer* - GP ADMX file name: *Explorer.admx* diff --git a/windows/client-management/mdm/policy-csp-handwriting.md b/windows/client-management/mdm/policy-csp-handwriting.md index dea9168e36..615be07c90 100644 --- a/windows/client-management/mdm/policy-csp-handwriting.md +++ b/windows/client-management/mdm/policy-csp-handwriting.md @@ -85,7 +85,7 @@ The docked mode is especially useful in Kiosk mode where you do not expect the e ADMX Info: -- GP English name: *Handwriting Panel Default Mode Docked* +- GP Friendly name: *Handwriting Panel Default Mode Docked* - GP name: *PanelDefaultModeDocked* - GP path: *Windows Components/Handwriting* - GP ADMX file name: *Handwriting.admx* diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 5760215ef8..8222726809 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -863,7 +863,7 @@ If you disable or do not configure this policy setting, the user can configure t ADMX Info: -- GP English name: *Add a specific list of search providers to the user's list of search providers* +- GP Friendly name: *Add a specific list of search providers to the user's list of search providers* - GP name: *AddSearchProvider* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -934,7 +934,7 @@ If you disable or do not configure this policy setting, ActiveX Filtering is not ADMX Info: -- GP English name: *Turn on ActiveX Filtering* +- GP Friendly name: *Turn on ActiveX Filtering* - GP name: *TurnOnActiveXFiltering* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -1011,7 +1011,7 @@ If you disable this policy setting, the list is deleted. The 'Deny all add-ons u ADMX Info: -- GP English name: *Add-on List* +- GP Friendly name: *Add-on List* - GP name: *AddonManagement_AddOnList* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -1083,7 +1083,7 @@ If you do not configure this setting, the user has the freedom of turning on Aut ADMX Info: -- GP English name: *Turn on the auto-complete feature for user names and passwords on forms* +- GP Friendly name: *Turn on the auto-complete feature for user names and passwords on forms* - GP name: *RestrictFormSuggestPW* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -1154,7 +1154,7 @@ If you disable or do not configure this policy setting, the user can choose whet ADMX Info: -- GP English name: *Turn on certificate address mismatch warning* +- GP Friendly name: *Turn on certificate address mismatch warning* - GP name: *IZ_PolicyWarnCertMismatch* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -1229,7 +1229,7 @@ If the "Prevent access to Delete Browsing History" policy setting is enabled, th ADMX Info: -- GP English name: *Allow deleting browsing history on exit* +- GP Friendly name: *Allow deleting browsing history on exit* - GP name: *DBHDisableDeleteOnExit* - GP path: *Windows Components/Internet Explorer/Delete Browsing History* - GP ADMX file name: *inetres.admx* @@ -1302,7 +1302,7 @@ If you do not configure this policy, users will be able to turn on or turn off E ADMX Info: -- GP English name: *Turn on Enhanced Protected Mode* +- GP Friendly name: *Turn on Enhanced Protected Mode* - GP name: *Advanced_EnableEnhancedProtectedMode* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -1375,7 +1375,7 @@ If you do not configure this policy setting, users can change the Suggestions se ADMX Info: -- GP English name: *Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar* +- GP Friendly name: *Allow Microsoft services to provide enhanced suggestions as the user types in the Address bar* - GP name: *AllowServicePoweredQSA* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -1457,7 +1457,7 @@ If you disable or don't configure this policy setting, the menu option won't app ADMX Info: -- GP English name: *Let users turn on and use Enterprise Mode from the Tools menu* +- GP Friendly name: *Let users turn on and use Enterprise Mode from the Tools menu* - GP name: *EnterpriseModeEnable* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -1528,7 +1528,7 @@ If you disable or don't configure this policy setting, Internet Explorer opens a ADMX Info: -- GP English name: *Use the Enterprise Mode IE website list* +- GP Friendly name: *Use the Enterprise Mode IE website list* - GP name: *EnterpriseModeSiteList* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -1600,7 +1600,7 @@ If you disable this policy, system defaults will be used. ADMX Info: -- GP English name: *Allow fallback to SSL 3.0 (Internet Explorer)* +- GP Friendly name: *Allow fallback to SSL 3.0 (Internet Explorer)* - GP name: *Advanced_EnableSSL3Fallback* - GP path: *Windows Components/Internet Explorer/Security Features* - GP ADMX file name: *inetres.admx* @@ -1671,7 +1671,7 @@ If you disable or do not configure this policy setting, the user can add and rem ADMX Info: -- GP English name: *Use Policy List of Internet Explorer 7 sites* +- GP Friendly name: *Use Policy List of Internet Explorer 7 sites* - GP name: *CompatView_UsePolicyList* - GP path: *Windows Components/Internet Explorer/Compatibility View* - GP ADMX file name: *inetres.admx* @@ -1744,7 +1744,7 @@ If you do not configure this policy setting, Internet Explorer uses an Internet ADMX Info: -- GP English name: *Turn on Internet Explorer Standards Mode for local intranet* +- GP Friendly name: *Turn on Internet Explorer Standards Mode for local intranet* - GP name: *CompatView_IntranetSites* - GP path: *Windows Components/Internet Explorer/Compatibility View* - GP ADMX file name: *inetres.admx* @@ -1821,7 +1821,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Internet Zone Template* +- GP Friendly name: *Internet Zone Template* - GP name: *IZ_PolicyInternetZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -1898,7 +1898,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Intranet Zone Template* +- GP Friendly name: *Intranet Zone Template* - GP name: *IZ_PolicyIntranetZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -1975,7 +1975,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Local Machine Zone Template* +- GP Friendly name: *Local Machine Zone Template* - GP name: *IZ_PolicyLocalMachineZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2052,7 +2052,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Locked-Down Internet Zone Template* +- GP Friendly name: *Locked-Down Internet Zone Template* - GP name: *IZ_PolicyInternetZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2129,7 +2129,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Locked-Down Intranet Zone Template* +- GP Friendly name: *Locked-Down Intranet Zone Template* - GP name: *IZ_PolicyIntranetZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2206,7 +2206,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Locked-Down Local Machine Zone Template* +- GP Friendly name: *Locked-Down Local Machine Zone Template* - GP name: *IZ_PolicyLocalMachineZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2283,7 +2283,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Locked-Down Restricted Sites Zone Template* +- GP Friendly name: *Locked-Down Restricted Sites Zone Template* - GP name: *IZ_PolicyRestrictedSitesZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2354,7 +2354,7 @@ If you disable or do not configure this policy setting, Internet Explorer does n ADMX Info: -- GP English name: *Go to an intranet site for a one-word entry in the Address bar* +- GP Friendly name: *Go to an intranet site for a one-word entry in the Address bar* - GP name: *UseIntranetSiteForOneWordEntry* - GP path: *Windows Components/Internet Explorer/Internet Settings/Advanced settings/Browsing* - GP ADMX file name: *inetres.admx* @@ -2426,7 +2426,7 @@ For more information, see [https://go.microsoft.com/fwlink/?linkid=2102115](/dep ADMX Info: -- GP English name: *Allow "Save Target As" in Internet Explorer mode* +- GP Friendly name: *Allow "Save Target As" in Internet Explorer mode* - GP name: *AllowSaveTargetAsInIEMode* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -2518,7 +2518,7 @@ The list is a set of pairs of strings. Each string is separated by F000. Each pa ADMX Info: -- GP English name: *Site to Zone Assignment List* +- GP Friendly name: *Site to Zone Assignment List* - GP name: *IZ_Zonemaps* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2616,7 +2616,7 @@ If you do not configure this policy, users can choose to run or install files wi ADMX Info: -- GP English name: *Allow software to run or install even if the signature is invalid* +- GP Friendly name: *Allow software to run or install even if the signature is invalid* - GP name: *Advanced_InvalidSignatureBlock* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -2689,7 +2689,7 @@ If you do not configure this policy setting, the user can turn on and turn off t ADMX Info: -- GP English name: *Turn on Suggested Sites* +- GP Friendly name: *Turn on Suggested Sites* - GP name: *EnableSuggestedSites* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -2766,7 +2766,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Trusted Sites Zone Template* +- GP Friendly name: *Trusted Sites Zone Template* - GP name: *IZ_PolicyTrustedSitesZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2843,7 +2843,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Locked-Down Trusted Sites Zone Template* +- GP Friendly name: *Locked-Down Trusted Sites Zone Template* - GP name: *IZ_PolicyTrustedSitesZoneLockdownTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2920,7 +2920,7 @@ Note. It is recommended to configure template policy settings in one Group Polic ADMX Info: -- GP English name: *Restricted Sites Zone Template* +- GP Friendly name: *Restricted Sites Zone Template* - GP name: *IZ_PolicyRestrictedSitesZoneTemplate* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -2993,7 +2993,7 @@ If you do not configure this policy setting, Internet Explorer will not check se ADMX Info: -- GP English name: *Check for server certificate revocation* +- GP Friendly name: *Check for server certificate revocation* - GP name: *Advanced_CertificateRevocation* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -3066,7 +3066,7 @@ If you do not configure this policy, Internet Explorer will not check the digita ADMX Info: -- GP English name: *Check for signatures on downloaded programs* +- GP Friendly name: *Check for signatures on downloaded programs* - GP name: *Advanced_DownloadSignatures* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -3156,7 +3156,7 @@ If the Windows Update for the next version of Microsoft Edge* or Microsoft Edge ADMX Info: -- GP English name: *Configure which channel of Microsoft Edge to use for opening redirected sites* +- GP Friendly name: *Configure which channel of Microsoft Edge to use for opening redirected sites* - GP name: *NeedEdgeBrowser* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -3433,7 +3433,7 @@ If you do not configure this policy setting, Internet Explorer requires consiste ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_5* - GP path: *Windows Components/Internet Explorer/Security Features/Consistent Mime Handling* - GP ADMX file name: *inetres.admx* @@ -3504,7 +3504,7 @@ If you disable or do not configure this setting, IE continues to download update ADMX Info: -- GP English name: *Turn off automatic download of the ActiveX VersionList* +- GP Friendly name: *Turn off automatic download of the ActiveX VersionList* - GP name: *VersionListAutomaticDownloadDisable* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -3588,7 +3588,7 @@ Note that Adobe Flash can still be disabled through the "Add-on List" and "Deny ADMX Info: -- GP English name: *Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects* +- GP Friendly name: *Turn off Adobe Flash in Internet Explorer and prevent applications from using Internet Explorer technology to instantiate Flash objects* - GP name: *DisableFlashInIE* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -3659,7 +3659,7 @@ If you disable or do not configure this policy setting, the user can bypass Wind ADMX Info: -- GP English name: *Prevent bypassing SmartScreen Filter warnings* +- GP Friendly name: *Prevent bypassing SmartScreen Filter warnings* - GP name: *DisableSafetyFilterOverride* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -3730,7 +3730,7 @@ If you disable or do not configure this policy setting, the user can bypass Wind ADMX Info: -- GP English name: *Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet* +- GP Friendly name: *Prevent bypassing SmartScreen Filter warnings about files that are not commonly downloaded from the Internet* - GP name: *DisableSafetyFilterOverrideForAppRepUnknown* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -3801,7 +3801,7 @@ If you disable or do not configure this policy setting, the user can use the Com ADMX Info: -- GP English name: *Turn off Compatibility View* +- GP Friendly name: *Turn off Compatibility View* - GP name: *CompatView_DisableList* - GP path: *Windows Components/Internet Explorer/Compatibility View* - GP ADMX file name: *inetres.admx* @@ -3883,7 +3883,7 @@ If you disable or do not configure this policy setting, a user can set the numbe ADMX Info: -- GP English name: *Disable "Configuring History"* +- GP Friendly name: *Disable "Configuring History"* - GP name: *RestrictHistory* - GP path: *Windows Components/Internet Explorer/Delete Browsing History* - GP ADMX file name: *inetres.admx* @@ -3954,7 +3954,7 @@ If you disable or do not configure this policy setting, the crash detection feat ADMX Info: -- GP English name: *Turn off Crash Detection* +- GP Friendly name: *Turn off Crash Detection* - GP name: *AddonManagement_RestrictCrashDetection* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -4027,7 +4027,7 @@ If you do not configure this policy setting, the user can choose to participate ADMX Info: -- GP English name: *Prevent participation in the Customer Experience Improvement Program* +- GP Friendly name: *Prevent participation in the Customer Experience Improvement Program* - GP name: *SQM_DisableCEIP* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -4102,7 +4102,7 @@ If the "Prevent access to Delete Browsing History" policy setting is enabled, th ADMX Info: -- GP English name: *Prevent deleting websites that the user has visited* +- GP Friendly name: *Prevent deleting websites that the user has visited* - GP name: *DBHDisableDeleteHistory* - GP path: *Windows Components/Internet Explorer/Delete Browsing History* - GP ADMX file name: *inetres.admx* @@ -4173,7 +4173,7 @@ If you disable or do not configure this policy setting, the user can set the Fee ADMX Info: -- GP English name: *Prevent downloading of enclosures* +- GP Friendly name: *Prevent downloading of enclosures* - GP name: *Disable_Downloading_of_Enclosures* - GP path: *Windows Components/RSS Feeds* - GP ADMX file name: *inetres.admx* @@ -4246,7 +4246,7 @@ Note: SSL 2.0 is off by default and is no longer supported starting with Windows ADMX Info: -- GP English name: *Turn off encryption support* +- GP Friendly name: *Turn off encryption support* - GP name: *Advanced_SetWinInetProtocols* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -4317,7 +4317,7 @@ If you disable or do not configure this policy setting, the user can synchronize ADMX Info: -- GP English name: *Turn off background synchronization for feeds and Web Slices* +- GP Friendly name: *Turn off background synchronization for feeds and Web Slices* - GP name: *Disable_Background_Syncing* - GP path: *Windows Components/RSS Feeds* - GP ADMX file name: *inetres.admx* @@ -4403,7 +4403,7 @@ If you disable or do not configure this policy setting, Internet Explorer may ru ADMX Info: -- GP English name: *Prevent running First Run wizard* +- GP Friendly name: *Prevent running First Run wizard* - GP name: *NoFirstRunCustomise* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -4478,7 +4478,7 @@ If you don't configure this setting, users can turn this behavior on or off, usi ADMX Info: -- GP English name: *Turn off the flip ahead with page prediction feature* +- GP Friendly name: *Turn off the flip ahead with page prediction feature* - GP name: *Advanced_DisableFlipAhead* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -4551,7 +4551,7 @@ If you do not configure this policy setting, browser geolocation support can be ADMX Info: -- GP English name: *Turn off browser geolocation* +- GP Friendly name: *Turn off browser geolocation* - GP name: *GeolocationDisable* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -4632,7 +4632,7 @@ If you disable or do not configure this policy setting, the Home page box is ena ADMX Info: -- GP English name: *Disable changing home page settings* +- GP Friendly name: *Disable changing home page settings* - GP name: *RestrictHomePage* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -4708,7 +4708,7 @@ If you disable, or do not configure this policy, all sites are opened using the ADMX Info: -- GP English name: *Disable Internet Explorer 11 as a standalone browser* +- GP Friendly name: *Disable Internet Explorer 11 as a standalone browser* - GP name: *DisableInternetExplorerApp* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -4797,7 +4797,7 @@ If you disable or do not configure this policy setting, the user can choose to i ADMX Info: -- GP English name: *Prevent ignoring certificate errors* +- GP Friendly name: *Prevent ignoring certificate errors* - GP name: *NoCertError* - GP path: *Windows Components/Internet Explorer/Internet Control Panel* - GP ADMX file name: *inetres.admx* @@ -4872,7 +4872,7 @@ If you do not configure this policy setting, InPrivate Browsing can be turned on ADMX Info: -- GP English name: *Turn off InPrivate Browsing* +- GP Friendly name: *Turn off InPrivate Browsing* - GP name: *DisableInPrivateBrowsing* - GP path: *Windows Components/Internet Explorer/Privacy* - GP ADMX file name: *inetres.admx* @@ -4947,7 +4947,7 @@ If you don't configure this policy setting, users can turn this feature on or of ADMX Info: -- GP English name: *Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows* +- GP Friendly name: *Turn on 64-bit tab processes when running in Enhanced Protected Mode on 64-bit versions of Windows* - GP name: *Advanced_EnableEnhancedProtectedMode64Bit* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -5018,7 +5018,7 @@ If you disable or do not configure this policy setting, the user can configure p ADMX Info: -- GP English name: *Prevent changing proxy settings* +- GP Friendly name: *Prevent changing proxy settings* - GP name: *RestrictProxy* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5089,7 +5089,7 @@ If you disable or do not configure this policy setting, the user can change the ADMX Info: -- GP English name: *Prevent changing the default search provider* +- GP Friendly name: *Prevent changing the default search provider* - GP name: *NoSearchProvider* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5162,7 +5162,7 @@ Note: If the “Disable Changing Home Page Settings” policy is enabled, the us ADMX Info: -- GP English name: *Disable changing secondary home page settings* +- GP Friendly name: *Disable changing secondary home page settings* - GP name: *SecondaryHomePages* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5233,7 +5233,7 @@ If you disable or do not configure this policy setting, the feature is turned on ADMX Info: -- GP English name: *Turn off the Security Settings Check feature* +- GP Friendly name: *Turn off the Security Settings Check feature* - GP name: *Disable_Security_Settings_Check* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5305,7 +5305,7 @@ This policy is intended to help the administrator maintain version control for I ADMX Info: -- GP English name: *Disable Periodic Check for Internet Explorer software updates* +- GP Friendly name: *Disable Periodic Check for Internet Explorer software updates* - GP name: *NoUpdateCheck* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5378,7 +5378,7 @@ If you do not configure this policy setting, users can choose to turn the auto-c ADMX Info: -- GP English name: *Turn off the auto-complete feature for web addresses* +- GP Friendly name: *Turn off the auto-complete feature for web addresses* - GP name: *RestrictWebAddressSuggest* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5464,7 +5464,7 @@ If you disable or do not configure this policy setting, Internet Explorer notifi ADMX Info: -- GP English name: *Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled* +- GP Friendly name: *Do not allow ActiveX controls to run in Protected Mode when Enhanced Protected Mode is enabled* - GP name: *Advanced_DisableEPMCompat* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Advanced Page* - GP ADMX file name: *inetres.admx* @@ -5540,7 +5540,7 @@ Also, see the "Security zones: Use only machine settings" policy. ADMX Info: -- GP English name: *Security Zones: Do not allow users to add/delete sites* +- GP Friendly name: *Security Zones: Do not allow users to add/delete sites* - GP name: *Security_zones_map_edit* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5616,7 +5616,7 @@ Also, see the "Security zones: Use only machine settings" policy. ADMX Info: -- GP English name: *Security Zones: Do not allow users to change policies* +- GP Friendly name: *Security Zones: Do not allow users to change policies* - GP name: *Security_options_edit* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -5689,7 +5689,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T ADMX Info: -- GP English name: *Turn off blocking of outdated ActiveX controls for Internet Explorer* +- GP Friendly name: *Turn off blocking of outdated ActiveX controls for Internet Explorer* - GP name: *VerMgmtDisable* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -5766,7 +5766,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T ADMX Info: -- GP English name: *Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains* +- GP Friendly name: *Turn off blocking of outdated ActiveX controls for Internet Explorer on specific domains* - GP name: *VerMgmtDomainAllowlist* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -5839,7 +5839,7 @@ If you do not configure this policy setting, users choose whether to force local ADMX Info: -- GP English name: *Intranet Sites: Include all local (intranet) sites not listed in other zones* +- GP Friendly name: *Intranet Sites: Include all local (intranet) sites not listed in other zones* - GP name: *IZ_IncludeUnspecifiedLocalSites* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -5912,7 +5912,7 @@ If you do not configure this policy setting, users choose whether network paths ADMX Info: -- GP English name: *Intranet Sites: Include all network paths (UNCs)* +- GP Friendly name: *Intranet Sites: Include all network paths (UNCs)* - GP name: *IZ_UNCAsIntranet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page* - GP ADMX file name: *inetres.admx* @@ -5985,7 +5985,7 @@ If you do not configure this policy setting, users cannot load a page in the zon ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6058,7 +6058,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6129,7 +6129,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6204,7 +6204,7 @@ If you do not configure this policy setting, a script can perform a clipboard op ADMX Info: -- GP English name: *Allow cut, copy or paste operations from the clipboard via script* +- GP Friendly name: *Allow cut, copy or paste operations from the clipboard via script* - GP name: *IZ_PolicyAllowPasteViaScript_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6277,7 +6277,7 @@ If you do not configure this policy setting, users can drag files or copy and pa ADMX Info: -- GP English name: *Allow drag and drop or copy and paste files* +- GP Friendly name: *Allow drag and drop or copy and paste files* - GP name: *IZ_PolicyDropOrPasteFiles_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6350,7 +6350,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6423,7 +6423,7 @@ If you do not configure this policy setting, Web sites from less privileged zone ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6496,7 +6496,7 @@ If you do not configure this policy setting, the user can decide whether to load ADMX Info: -- GP English name: *Allow loading of XAML files* +- GP Friendly name: *Allow loading of XAML files* - GP name: *IZ_Policy_XAML_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6569,7 +6569,7 @@ If you do not configure this policy setting, Internet Explorer will execute unsi ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6640,7 +6640,7 @@ If you disable this policy setting, the user does not see the per-site ActiveX p ADMX Info: -- GP English name: *Allow only approved domains to use ActiveX controls without prompt* +- GP Friendly name: *Allow only approved domains to use ActiveX controls without prompt* - GP name: *IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6711,7 +6711,7 @@ If you disable this policy setting, the TDC Active X control will run from all s ADMX Info: -- GP English name: *Allow only approved domains to use the TDC ActiveX control* +- GP Friendly name: *Allow only approved domains to use the TDC ActiveX control* - GP name: *IZ_PolicyAllowTDCControl_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6784,7 +6784,7 @@ If you do not configure this policy setting, the possible harmful actions contai ADMX Info: -- GP English name: *Allow script-initiated windows without size or position constraints* +- GP Friendly name: *Allow script-initiated windows without size or position constraints* - GP name: *IZ_PolicyWindowsRestrictionsURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6857,7 +6857,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scripting of Internet Explorer WebBrowser controls* +- GP Friendly name: *Allow scripting of Internet Explorer WebBrowser controls* - GP name: *IZ_Policy_WebBrowserControl_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -6930,7 +6930,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7005,7 +7005,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7076,7 +7076,7 @@ If you disable or do not configure this policy setting, script is not allowed to ADMX Info: -- GP English name: *Allow updates to status bar via script* +- GP Friendly name: *Allow updates to status bar via script* - GP name: *IZ_Policy_ScriptStatusBar_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7149,7 +7149,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7224,7 +7224,7 @@ If you do not configure or disable this policy setting, VBScript is prevented fr ADMX Info: -- GP English name: *Allow VBScript to run in Internet Explorer* +- GP Friendly name: *Allow VBScript to run in Internet Explorer* - GP name: *IZ_PolicyAllowVBScript_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7297,7 +7297,7 @@ If you don't configure this policy setting, Internet Explorer always checks with ADMX Info: -- GP English name: *Don't run antimalware programs against ActiveX controls* +- GP Friendly name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7370,7 +7370,7 @@ If you do not configure this policy setting, users are queried whether to downlo ADMX Info: -- GP English name: *Download signed ActiveX controls* +- GP Friendly name: *Download signed ActiveX controls* - GP name: *IZ_PolicyDownloadSignedActiveX_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7443,7 +7443,7 @@ If you do not configure this policy setting, users cannot run unsigned controls. ADMX Info: -- GP English name: *Download unsigned ActiveX controls* +- GP Friendly name: *Download unsigned ActiveX controls* - GP name: *IZ_PolicyDownloadUnsignedActiveX_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7514,7 +7514,7 @@ If you disable this policy setting, the XSS Filter is turned off for sites in th ADMX Info: -- GP English name: *Turn on Cross-Site Scripting Filter* +- GP Friendly name: *Turn on Cross-Site Scripting Filter* - GP name: *IZ_PolicyTurnOnXSSFilter_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7589,7 +7589,7 @@ In Internet Explorer 9 and earlier versions, if you disable this policy or do no ADMX Info: -- GP English name: *Enable dragging of content from different domains across windows* +- GP Friendly name: *Enable dragging of content from different domains across windows* - GP name: *IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7664,7 +7664,7 @@ In Internet Explorer 9 and earlier versions, if you disable this policy setting ADMX Info: -- GP English name: *Enable dragging of content from different domains within a window* +- GP Friendly name: *Enable dragging of content from different domains within a window* - GP name: *IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Internet* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7737,7 +7737,7 @@ If you do not configure this policy setting, the MIME Sniffing Safety Feature wi ADMX Info: -- GP English name: *Enable MIME Sniffing* +- GP Friendly name: *Enable MIME Sniffing* - GP name: *IZ_PolicyMimeSniffingURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7810,7 +7810,7 @@ If you do not configure this policy setting, the user can turn on or turn off Pr ADMX Info: -- GP English name: *Turn on Protected Mode* +- GP Friendly name: *Turn on Protected Mode* - GP name: *IZ_Policy_TurnOnProtectedMode_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7883,7 +7883,7 @@ If you do not configure this policy setting, the user can choose whether path in ADMX Info: -- GP English name: *Include local path when user is uploading files to a server* +- GP Friendly name: *Include local path when user is uploading files to a server* - GP name: *IZ_Policy_LocalPathForUpload_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -7958,7 +7958,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8078,7 +8078,7 @@ If you do not configure this policy setting, the permission is set to High Safet ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8151,7 +8151,7 @@ If you do not configure this policy setting, users are queried to choose whether ADMX Info: -- GP English name: *Launching applications and files in an IFRAME* +- GP Friendly name: *Launching applications and files in an IFRAME* - GP name: *IZ_PolicyLaunchAppsAndFilesInIFRAME_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8232,7 +8232,7 @@ If you do not configure this policy setting, logon is set to Automatic logon onl ADMX Info: -- GP English name: *Logon options* +- GP Friendly name: *Logon options* - GP name: *IZ_PolicyLogon_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8305,7 +8305,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8378,7 +8378,7 @@ If you do not configure this policy setting, Internet Explorer will execute sign ADMX Info: -- GP English name: *Run .NET Framework-reliant components signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components signed with Authenticode* - GP name: *IZ_PolicySignedFrameworkComponentsURLaction_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8451,7 +8451,7 @@ If you do not configure this policy setting, the user can configure how the comp ADMX Info: -- GP English name: *Show security warning for potentially unsafe files* +- GP Friendly name: *Show security warning for potentially unsafe files* - GP name: *IZ_Policy_UnsafeFiles_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8524,7 +8524,7 @@ If you do not configure this policy setting, most unwanted pop-up windows are pr ADMX Info: -- GP English name: *Use Pop-up Blocker* +- GP Friendly name: *Use Pop-up Blocker* - GP name: *IZ_PolicyBlockPopupWindows_1* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Internet Zone* - GP ADMX file name: *inetres.admx* @@ -8597,7 +8597,7 @@ If you do not configure this policy setting, users are queried to choose whether ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -8670,7 +8670,7 @@ If you do not configure this policy setting, users will receive a prompt when a ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -8741,7 +8741,7 @@ If you disable or do not configure this setting, users will receive a file downl ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -8814,7 +8814,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -8887,7 +8887,7 @@ If you do not configure this policy setting, Web sites from less privileged zone ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -8960,7 +8960,7 @@ If you do not configure this policy setting, Internet Explorer will execute unsi ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9033,7 +9033,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9108,7 +9108,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9181,7 +9181,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9254,7 +9254,7 @@ If you don't configure this policy setting, Internet Explorer won't check with y ADMX Info: -- GP English name: *Don't run antimalware programs against ActiveX controls* +- GP Friendly name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9329,7 +9329,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9408,7 +9408,7 @@ If you do not configure this policy setting, the permission is set to Medium Saf ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9481,7 +9481,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_3* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -9562,7 +9562,7 @@ For more information on how to use this policy together with other related polic ADMX Info: -- GP English name: *Keep all Intranet Sites in Internet Explorer* +- GP Friendly name: *Keep all Intranet Sites in Internet Explorer* - GP name: *KeepIntranetSitesInInternetExplorer* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -9653,7 +9653,7 @@ If you do not configure this policy setting, users can load a page in the zone t ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -9726,7 +9726,7 @@ If you do not configure this policy setting, users will receive a prompt when a ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -9797,7 +9797,7 @@ If you disable or do not configure this setting, users will receive a file downl ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -9870,7 +9870,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -9943,7 +9943,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10016,7 +10016,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10089,7 +10089,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10164,7 +10164,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10237,7 +10237,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10310,7 +10310,7 @@ If you don't configure this policy setting, Internet Explorer won't check with y ADMX Info: -- GP English name: *Don't run antimalware programs against ActiveX controls* +- GP Friendly name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10385,7 +10385,7 @@ If you do not configure this policy setting, users are queried whether to allow ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10464,7 +10464,7 @@ If you do not configure this policy setting, the permission is set to Medium Saf ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10537,7 +10537,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_9* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -10610,7 +10610,7 @@ If you do not configure this policy setting, users cannot load a page in the zon ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -10683,7 +10683,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -10754,7 +10754,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -10827,7 +10827,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -10900,7 +10900,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -10973,7 +10973,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11046,7 +11046,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11121,7 +11121,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11194,7 +11194,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11269,7 +11269,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11348,7 +11348,7 @@ If you do not configure this policy setting, Java applets are disabled. ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11421,7 +11421,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_2* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Internet Zone* - GP ADMX file name: *inetres.admx* @@ -11500,7 +11500,7 @@ If you do not configure this policy setting, Java applets are disabled. ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -11573,7 +11573,7 @@ If you do not configure this policy setting, users are queried to choose whether ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -11646,7 +11646,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -11717,7 +11717,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -11790,7 +11790,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -11863,7 +11863,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -11936,7 +11936,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -12009,7 +12009,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -12084,7 +12084,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -12157,7 +12157,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -12232,7 +12232,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -12305,7 +12305,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_4* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Intranet Zone* - GP ADMX file name: *inetres.admx* @@ -12378,7 +12378,7 @@ If you do not configure this policy setting, users can load a page in the zone t ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12451,7 +12451,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12522,7 +12522,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12595,7 +12595,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12668,7 +12668,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12741,7 +12741,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12814,7 +12814,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12889,7 +12889,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -12962,7 +12962,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -13037,7 +13037,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -13116,7 +13116,7 @@ If you do not configure this policy setting, Java applets are disabled. ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -13189,7 +13189,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_10* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Local Machine Zone* - GP ADMX file name: *inetres.admx* @@ -13262,7 +13262,7 @@ If you do not configure this policy setting, users cannot load a page in the zon ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13335,7 +13335,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13406,7 +13406,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13479,7 +13479,7 @@ If you do not configure this policy setting, users are queried whether to allow ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13552,7 +13552,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13625,7 +13625,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13698,7 +13698,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13773,7 +13773,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13846,7 +13846,7 @@ If you do not configure this policy setting, users cannot preserve information i ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -13921,7 +13921,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14000,7 +14000,7 @@ If you do not configure this policy setting, Java applets are disabled. ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14073,7 +14073,7 @@ If you do not configure this policy setting, users cannot open other windows and ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_8* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14146,7 +14146,7 @@ If you do not configure this policy setting, users can load a page in the zone t ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14219,7 +14219,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14290,7 +14290,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14363,7 +14363,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14436,7 +14436,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14509,7 +14509,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14582,7 +14582,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14657,7 +14657,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14730,7 +14730,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14805,7 +14805,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14884,7 +14884,7 @@ If you do not configure this policy setting, Java applets are disabled. ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -14957,7 +14957,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_6* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Locked-Down Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -15030,7 +15030,7 @@ If you do not configure this policy setting, the MK Protocol is prevented for Fi ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_3* - GP path: *Windows Components/Internet Explorer/Security Features/MK Protocol Security Restriction* - GP ADMX file name: *inetres.admx* @@ -15103,7 +15103,7 @@ If you do not configure this policy setting, MIME sniffing will never promote a ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_6* - GP path: *Windows Components/Internet Explorer/Security Features/Mime Sniffing Safety Feature* - GP ADMX file name: *inetres.admx* @@ -15174,7 +15174,7 @@ If you disable or do not configure this policy setting, users can select their p ADMX Info: -- GP English name: *Specify default behavior for a new tab* +- GP Friendly name: *Specify default behavior for a new tab* - GP name: *NewTabAction* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -15261,7 +15261,7 @@ If you do not configure this policy setting, the Notification bar will be displa ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_10* - GP path: *Windows Components/Internet Explorer/Security Features/Notification bar* - GP ADMX file name: *inetres.admx* @@ -15332,7 +15332,7 @@ If you disable or do not configure this policy setting, the user is prompted to ADMX Info: -- GP English name: *Prevent managing SmartScreen Filter* +- GP Friendly name: *Prevent managing SmartScreen Filter* - GP name: *Disable_Managing_Safety_Filter_IE9* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -15403,7 +15403,7 @@ If you disable or do not configure this policy setting, ActiveX controls can be ADMX Info: -- GP English name: *Prevent per-user installation of ActiveX controls* +- GP Friendly name: *Prevent per-user installation of ActiveX controls* - GP name: *DisablePerUserActiveXInstall* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -15476,7 +15476,7 @@ If you do not configure this policy setting, any zone can be protected from zone ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_9* - GP path: *Windows Components/Internet Explorer/Security Features/Protection From Zone Elevation* - GP ADMX file name: *inetres.admx* @@ -15549,7 +15549,7 @@ For more information, see "Outdated ActiveX Controls" in the Internet Explorer T ADMX Info: -- GP English name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer* +- GP Friendly name: *Remove "Run this time" button for outdated ActiveX controls in Internet Explorer* - GP name: *VerMgmtDisableRunThisTime* - GP path: *Windows Components/Internet Explorer/Security Features/Add-on Management* - GP ADMX file name: *inetres.admx* @@ -15622,7 +15622,7 @@ If you do not configure this policy setting, the user's preference will be used ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_11* - GP path: *Windows Components/Internet Explorer/Security Features/Restrict ActiveX Install* - GP ADMX file name: *inetres.admx* @@ -15695,7 +15695,7 @@ If you do not configure this policy setting, the user's preference determines wh ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_12* - GP path: *Windows Components/Internet Explorer/Security Features/Restrict File Download* - GP ADMX file name: *inetres.admx* @@ -15768,7 +15768,7 @@ If you do not configure this policy setting, users cannot load a page in the zon ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -15841,7 +15841,7 @@ If you do not configure this policy setting, script code on pages in the zone is ADMX Info: -- GP English name: *Allow active scripting* +- GP Friendly name: *Allow active scripting* - GP name: *IZ_PolicyActiveScripting_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -15914,7 +15914,7 @@ If you do not configure this policy setting, ActiveX control installations will ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -15985,7 +15985,7 @@ If you disable or do not configure this setting, file downloads that are not use ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16058,7 +16058,7 @@ If you do not configure this policy setting, binary and script behaviors are not ADMX Info: -- GP English name: *Allow binary and script behaviors* +- GP Friendly name: *Allow binary and script behaviors* - GP name: *IZ_PolicyBinaryBehaviors_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16133,7 +16133,7 @@ If you do not configure this policy setting, a script cannot perform a clipboard ADMX Info: -- GP English name: *Allow cut, copy or paste operations from the clipboard via script* +- GP Friendly name: *Allow cut, copy or paste operations from the clipboard via script* - GP name: *IZ_PolicyAllowPasteViaScript_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16206,7 +16206,7 @@ If you do not configure this policy setting, users are queried to choose whether ADMX Info: -- GP English name: *Allow drag and drop or copy and paste files* +- GP Friendly name: *Allow drag and drop or copy and paste files* - GP name: *IZ_PolicyDropOrPasteFiles_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16279,7 +16279,7 @@ If you do not configure this policy setting, files are prevented from being down ADMX Info: -- GP English name: *Allow file downloads* +- GP Friendly name: *Allow file downloads* - GP name: *IZ_PolicyFileDownload_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16352,7 +16352,7 @@ If you do not configure this policy setting, users are queried whether to allow ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16425,7 +16425,7 @@ If you do not configure this policy setting, the possibly harmful navigations ar ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16498,7 +16498,7 @@ If you do not configure this policy setting, the user can decide whether to load ADMX Info: -- GP English name: *Allow loading of XAML files* +- GP Friendly name: *Allow loading of XAML files* - GP name: *IZ_Policy_XAML_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16571,7 +16571,7 @@ If you do not configure this policy setting, a user's browser that loads a page ADMX Info: -- GP English name: *Allow META REFRESH* +- GP Friendly name: *Allow META REFRESH* - GP name: *IZ_PolicyAllowMETAREFRESH_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16644,7 +16644,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16715,7 +16715,7 @@ If you disable this policy setting, the user does not see the per-site ActiveX p ADMX Info: -- GP English name: *Allow only approved domains to use ActiveX controls without prompt* +- GP Friendly name: *Allow only approved domains to use ActiveX controls without prompt* - GP name: *IZ_PolicyOnlyAllowApprovedDomainsToUseActiveXWithoutPrompt_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16786,7 +16786,7 @@ If you disable this policy setting, the TDC Active X control will run from all s ADMX Info: -- GP English name: *Allow only approved domains to use the TDC ActiveX control* +- GP Friendly name: *Allow only approved domains to use the TDC ActiveX control* - GP name: *IZ_PolicyAllowTDCControl_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16859,7 +16859,7 @@ If you do not configure this policy setting, the possible harmful actions contai ADMX Info: -- GP English name: *Allow script-initiated windows without size or position constraints* +- GP Friendly name: *Allow script-initiated windows without size or position constraints* - GP name: *IZ_PolicyWindowsRestrictionsURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -16932,7 +16932,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scripting of Internet Explorer WebBrowser controls* +- GP Friendly name: *Allow scripting of Internet Explorer WebBrowser controls* - GP name: *IZ_Policy_WebBrowserControl_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17005,7 +17005,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17080,7 +17080,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17151,7 +17151,7 @@ If you disable or do not configure this policy setting, script is not allowed to ADMX Info: -- GP English name: *Allow updates to status bar via script* +- GP Friendly name: *Allow updates to status bar via script* - GP name: *IZ_Policy_ScriptStatusBar_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17224,7 +17224,7 @@ If you do not configure this policy setting, users cannot preserve information i ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17299,7 +17299,7 @@ If you do not configure or disable this policy setting, VBScript is prevented fr ADMX Info: -- GP English name: *Allow VBScript to run in Internet Explorer* +- GP Friendly name: *Allow VBScript to run in Internet Explorer* - GP name: *IZ_PolicyAllowVBScript_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17372,7 +17372,7 @@ If you don't configure this policy setting, Internet Explorer always checks with ADMX Info: -- GP English name: *Don't run antimalware programs against ActiveX controls* +- GP Friendly name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17445,7 +17445,7 @@ If you do not configure this policy setting, signed controls cannot be downloade ADMX Info: -- GP English name: *Download signed ActiveX controls* +- GP Friendly name: *Download signed ActiveX controls* - GP name: *IZ_PolicyDownloadSignedActiveX_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17518,7 +17518,7 @@ If you do not configure this policy setting, users cannot run unsigned controls. ADMX Info: -- GP English name: *Download unsigned ActiveX controls* +- GP Friendly name: *Download unsigned ActiveX controls* - GP name: *IZ_PolicyDownloadUnsignedActiveX_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17589,7 +17589,7 @@ If you disable this policy setting, the XSS Filter is turned off for sites in th ADMX Info: -- GP English name: *Turn on Cross-Site Scripting Filter* +- GP Friendly name: *Turn on Cross-Site Scripting Filter* - GP name: *IZ_PolicyTurnOnXSSFilter_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17664,7 +17664,7 @@ In Internet Explorer 9 and earlier versions, if you disable this policy or do no ADMX Info: -- GP English name: *Enable dragging of content from different domains across windows* +- GP Friendly name: *Enable dragging of content from different domains across windows* - GP name: *IZ_PolicyDragDropAcrossDomainsAcrossWindows_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17739,7 +17739,7 @@ In Internet Explorer 9 and earlier versions, if you disable this policy setting ADMX Info: -- GP English name: *Enable dragging of content from different domains within a window* +- GP Friendly name: *Enable dragging of content from different domains within a window* - GP name: *IZ_PolicyDragDropAcrossDomainsWithinWindow_Both_Restricted* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17812,7 +17812,7 @@ If you do not configure this policy setting, the actions that may be harmful can ADMX Info: -- GP English name: *Enable MIME Sniffing* +- GP Friendly name: *Enable MIME Sniffing* - GP name: *IZ_PolicyMimeSniffingURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17885,7 +17885,7 @@ If you do not configure this policy setting, the user can choose whether path in ADMX Info: -- GP English name: *Include local path when user is uploading files to a server* +- GP Friendly name: *Include local path when user is uploading files to a server* - GP name: *IZ_Policy_LocalPathForUpload_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -17960,7 +17960,7 @@ If you do not configure this policy setting, ActiveX controls that cannot be mad ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18039,7 +18039,7 @@ If you do not configure this policy setting, Java applets are disabled. ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18112,7 +18112,7 @@ If you do not configure this policy setting, users are prevented from running ap ADMX Info: -- GP English name: *Launching applications and files in an IFRAME* +- GP Friendly name: *Launching applications and files in an IFRAME* - GP name: *IZ_PolicyLaunchAppsAndFilesInIFRAME_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18193,7 +18193,7 @@ If you do not configure this policy setting, logon is set to Prompt for username ADMX Info: -- GP English name: *Logon options* +- GP Friendly name: *Logon options* - GP name: *IZ_PolicyLogon_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18266,7 +18266,7 @@ If you do not configure this policy setting, users cannot open other windows and ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18341,7 +18341,7 @@ If you do not configure this policy setting, controls and plug-ins are prevented ADMX Info: -- GP English name: *Run ActiveX controls and plugins* +- GP Friendly name: *Run ActiveX controls and plugins* - GP name: *IZ_PolicyRunActiveXControls_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18414,7 +18414,7 @@ If you do not configure this policy setting, Internet Explorer will not execute ADMX Info: -- GP English name: *Run .NET Framework-reliant components signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components signed with Authenticode* - GP name: *IZ_PolicySignedFrameworkComponentsURLaction_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18489,7 +18489,7 @@ If you do not configure this policy setting, script interaction is prevented fro ADMX Info: -- GP English name: *Script ActiveX controls marked safe for scripting* +- GP Friendly name: *Script ActiveX controls marked safe for scripting* - GP name: *IZ_PolicyScriptActiveXMarkedSafe_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18564,7 +18564,7 @@ If you do not configure this policy setting, scripts are prevented from accessin ADMX Info: -- GP English name: *Scripting of Java applets* +- GP Friendly name: *Scripting of Java applets* - GP name: *IZ_PolicyScriptingOfJavaApplets_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18637,7 +18637,7 @@ If you do not configure this policy setting, the user can configure how the comp ADMX Info: -- GP English name: *Show security warning for potentially unsafe files* +- GP Friendly name: *Show security warning for potentially unsafe files* - GP name: *IZ_Policy_UnsafeFiles_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18710,7 +18710,7 @@ If you do not configure this policy setting, the user can turn on or turn off Pr ADMX Info: -- GP English name: *Turn on Protected Mode* +- GP Friendly name: *Turn on Protected Mode* - GP name: *IZ_Policy_TurnOnProtectedMode_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18783,7 +18783,7 @@ If you do not configure this policy setting, most unwanted pop-up windows are pr ADMX Info: -- GP English name: *Use Pop-up Blocker* +- GP Friendly name: *Use Pop-up Blocker* - GP name: *IZ_PolicyBlockPopupWindows_7* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Restricted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -18856,7 +18856,7 @@ If you do not configure this policy setting, popup windows and other restriction ADMX Info: -- GP English name: *Internet Explorer Processes* +- GP Friendly name: *Internet Explorer Processes* - GP name: *IESF_PolicyExplorerProcesses_8* - GP path: *Windows Components/Internet Explorer/Security Features/Scripted Window Security Restrictions* - GP ADMX file name: *inetres.admx* @@ -18927,7 +18927,7 @@ If you disable or do not configure this policy setting, the user can configure h ADMX Info: -- GP English name: *Restrict search providers to a specific list* +- GP Friendly name: *Restrict search providers to a specific list* - GP name: *SpecificSearchProvider* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -19001,7 +19001,7 @@ Also, see the "Security zones: Do not allow users to change policies" policy. ADMX Info: -- GP English name: *Security Zones: Use only machine settings* +- GP Friendly name: *Security Zones: Use only machine settings* - GP name: *Security_HKLM_only* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -19075,7 +19075,7 @@ If you disable, or not configure this setting, then it opens all sites based on ADMX Info: -- GP English name: *Send all sites not included in the Enterprise Mode Site List to Microsoft Edge* +- GP Friendly name: *Send all sites not included in the Enterprise Mode Site List to Microsoft Edge* - GP name: *RestrictInternetExplorer* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -19166,7 +19166,7 @@ If you disable or do not configure this policy setting, ActiveX controls, includ ADMX Info: -- GP English name: *Specify use of ActiveX Installer Service for installation of ActiveX controls* +- GP Friendly name: *Specify use of ActiveX Installer Service for installation of ActiveX controls* - GP name: *OnlyUseAXISForActiveXInstall* - GP path: *Windows Components/Internet Explorer* - GP ADMX file name: *inetres.admx* @@ -19239,7 +19239,7 @@ If you do not configure this policy setting, users can load a page in the zone t ADMX Info: -- GP English name: *Access data sources across domains* +- GP Friendly name: *Access data sources across domains* - GP name: *IZ_PolicyAccessDataSourcesAcrossDomains_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19312,7 +19312,7 @@ If you do not configure this policy setting, users will receive a prompt when a ADMX Info: -- GP English name: *Automatic prompting for ActiveX controls* +- GP Friendly name: *Automatic prompting for ActiveX controls* - GP name: *IZ_PolicyNotificationBarActiveXURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19383,7 +19383,7 @@ If you disable or do not configure this setting, users will receive a file downl ADMX Info: -- GP English name: *Automatic prompting for file downloads* +- GP Friendly name: *Automatic prompting for file downloads* - GP name: *IZ_PolicyNotificationBarDownloadURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19456,7 +19456,7 @@ If you do not configure this policy setting, HTML fonts can be downloaded automa ADMX Info: -- GP English name: *Allow font downloads* +- GP Friendly name: *Allow font downloads* - GP name: *IZ_PolicyFontDownload_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19529,7 +19529,7 @@ If you do not configure this policy setting, a warning is issued to the user tha ADMX Info: -- GP English name: *Web sites in less privileged Web content zones can navigate into this zone* +- GP Friendly name: *Web sites in less privileged Web content zones can navigate into this zone* - GP name: *IZ_PolicyZoneElevationURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19602,7 +19602,7 @@ If you do not configure this policy setting, Internet Explorer will execute unsi ADMX Info: -- GP English name: *Run .NET Framework-reliant components not signed with Authenticode* +- GP Friendly name: *Run .NET Framework-reliant components not signed with Authenticode* - GP name: *IZ_PolicyUnsignedFrameworkComponentsURLaction_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19675,7 +19675,7 @@ If you do not configure this policy setting, the user can enable or disable scri ADMX Info: -- GP English name: *Allow scriptlets* +- GP Friendly name: *Allow scriptlets* - GP name: *IZ_Policy_AllowScriptlets_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19750,7 +19750,7 @@ Note: In Internet Explorer 7, this policy setting controls whether Phishing Filt ADMX Info: -- GP English name: *Turn on SmartScreen Filter scan* +- GP Friendly name: *Turn on SmartScreen Filter scan* - GP name: *IZ_Policy_Phishing_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19823,7 +19823,7 @@ If you do not configure this policy setting, users can preserve information in t ADMX Info: -- GP English name: *Userdata persistence* +- GP Friendly name: *Userdata persistence* - GP name: *IZ_PolicyUserdataPersistence_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19896,7 +19896,7 @@ If you don't configure this policy setting, Internet Explorer won't check with y ADMX Info: -- GP English name: *Don't run antimalware programs against ActiveX controls* +- GP Friendly name: *Don't run antimalware programs against ActiveX controls* - GP name: *IZ_PolicyAntiMalwareCheckingOfActiveXControls_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -19971,7 +19971,7 @@ If you do not configure this policy setting, users are queried whether to allow ADMX Info: -- GP English name: *Initialize and script ActiveX controls not marked as safe* +- GP Friendly name: *Initialize and script ActiveX controls not marked as safe* - GP name: *IZ_PolicyScriptActiveXNotMarkedSafe_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -20050,7 +20050,7 @@ If you do not configure this policy setting, the permission is set to Low Safety ADMX Info: -- GP English name: *Java permissions* +- GP Friendly name: *Java permissions* - GP name: *IZ_PolicyJavaPermissions_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* @@ -20123,7 +20123,7 @@ If you do not configure this policy setting, users can open windows and frames f ADMX Info: -- GP English name: *Navigate windows and frames across different domains* +- GP Friendly name: *Navigate windows and frames across different domains* - GP name: *IZ_PolicyNavigateSubframesAcrossDomains_5* - GP path: *Windows Components/Internet Explorer/Internet Control Panel/Security Page/Trusted Sites Zone* - GP ADMX file name: *inetres.admx* diff --git a/windows/client-management/mdm/policy-csp-kerberos.md b/windows/client-management/mdm/policy-csp-kerberos.md index b5331fa661..2b2391edc6 100644 --- a/windows/client-management/mdm/policy-csp-kerberos.md +++ b/windows/client-management/mdm/policy-csp-kerberos.md @@ -104,7 +104,7 @@ If you disable or do not configure this policy setting, the Kerberos client does ADMX Info: -- GP English name: *Use forest search order* +- GP Friendly name: *Use forest search order* - GP name: *ForestSearch* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* @@ -173,7 +173,7 @@ If you disable or do not configure this policy setting, the client devices will ADMX Info: -- GP English name: *Kerberos client support for claims, compound authentication and Kerberos armoring* +- GP Friendly name: *Kerberos client support for claims, compound authentication and Kerberos armoring* - GP name: *EnableCbacAndArmor* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* @@ -247,7 +247,7 @@ If you disable or do not configure this policy setting, the client computers in ADMX Info: -- GP English name: *Fail authentication requests when Kerberos armoring is not available* +- GP Friendly name: *Fail authentication requests when Kerberos armoring is not available* - GP name: *ClientRequireFast* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* @@ -317,7 +317,7 @@ If you disable or do not configure this policy setting, the Kerberos client requ ADMX Info: -- GP English name: *Require strict KDC validation* +- GP Friendly name: *Require strict KDC validation* - GP name: *ValidateKDC* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* @@ -391,7 +391,7 @@ Note: This policy setting configures the existing MaxTokenSize registry value in ADMX Info: -- GP English name: *Set maximum Kerberos SSPI context token buffer size* +- GP Friendly name: *Set maximum Kerberos SSPI context token buffer size* - GP name: *MaxTokenSize* - GP path: *System/Kerberos* - GP ADMX file name: *Kerberos.admx* diff --git a/windows/client-management/mdm/policy-csp-lanmanworkstation.md b/windows/client-management/mdm/policy-csp-lanmanworkstation.md index bb03f10884..f7c4cf4015 100644 --- a/windows/client-management/mdm/policy-csp-lanmanworkstation.md +++ b/windows/client-management/mdm/policy-csp-lanmanworkstation.md @@ -85,7 +85,7 @@ Insecure guest logons are used by file servers to allow unauthenticated access t ADMX Info: -- GP English name: *Enable insecure guest logons* +- GP Friendly name: *Enable insecure guest logons* - GP name: *Pol_EnableInsecureGuestLogons* - GP path: *Network/Lanman Workstation* - GP ADMX file name: *LanmanWorkstation.admx* diff --git a/windows/client-management/mdm/policy-csp-licensing.md b/windows/client-management/mdm/policy-csp-licensing.md index bfef6090cc..3bc05c7260 100644 --- a/windows/client-management/mdm/policy-csp-licensing.md +++ b/windows/client-management/mdm/policy-csp-licensing.md @@ -82,7 +82,7 @@ Added in Windows 10, version 1607. Enables or Disable Windows license reactivat ADMX Info: -- GP English name: *Control Device Reactivation for Retail devices* +- GP Friendly name: *Control Device Reactivation for Retail devices* - GP name: *AllowWindowsEntitlementReactivation* - GP path: *Windows Components/Software Protection Platform* - GP ADMX file name: *AVSValidationGP.admx* @@ -148,7 +148,7 @@ Added in Windows 10, version 1607. Enabling this setting prevents this computer ADMX Info: -- GP English name: *Turn off KMS Client Online AVS Validation* +- GP Friendly name: *Turn off KMS Client Online AVS Validation* - GP name: *NoAcquireGT* - GP path: *Windows Components/Software Protection Platform* - GP ADMX file name: *AVSValidationGP.admx* diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 0d4580ee4b..c004295d70 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -224,7 +224,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Accounts: Block Microsoft accounts* +- GP Friendly name: *Accounts: Block Microsoft accounts* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -302,7 +302,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Accounts: Limit local account use of blank passwords to console logon only* +- GP Friendly name: *Accounts: Limit local account use of blank passwords to console logon only* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -371,7 +371,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Accounts: Rename administrator account* +- GP Friendly name: *Accounts: Rename administrator account* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -434,7 +434,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Accounts: Rename guest account* +- GP Friendly name: *Accounts: Rename guest account* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -498,7 +498,7 @@ Disabling this policy may tempt users to try and physically remove the laptop fr GP Info: -- GP English name: *Devices: Allow undock without having to log on* +- GP Friendly name: *Devices: Allow undock without having to log on* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -562,7 +562,7 @@ Default: This policy is not defined and only Administrators have this ability. GP Info: -- GP English name: *Devices: Allowed to format and eject removable media* +- GP Friendly name: *Devices: Allowed to format and eject removable media* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -628,7 +628,7 @@ This setting does not affect the ability to add a local printer. This setting do GP Info: -- GP English name: *Devices: Prevent users from installing printer drivers* +- GP Friendly name: *Devices: Prevent users from installing printer drivers* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -691,7 +691,7 @@ Default: This policy is not defined and CD-ROM access is not restricted to the l GP Info: -- GP English name: *Devices: Restrict CD-ROM access to locally logged-on user only* +- GP Friendly name: *Devices: Restrict CD-ROM access to locally logged-on user only* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -751,7 +751,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Display user information when the session is locked* +- GP Friendly name: *Interactive logon: Display user information when the session is locked* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -824,7 +824,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Don't display last signed-in* +- GP Friendly name: *Interactive logon: Don't display last signed-in* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -897,7 +897,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Don't display username at sign-in* +- GP Friendly name: *Interactive logon: Don't display username at sign-in* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -971,7 +971,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Do not require CTRL+ALT+DEL* +- GP Friendly name: *Interactive logon: Do not require CTRL+ALT+DEL* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1040,7 +1040,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Machine inactivity limit* +- GP Friendly name: *Interactive logon: Machine inactivity limit* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1109,7 +1109,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Message text for users attempting to log on* +- GP Friendly name: *Interactive logon: Message text for users attempting to log on* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1172,7 +1172,7 @@ Value type is string. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Interactive logon: Message title for users attempting to log on* +- GP Friendly name: *Interactive logon: Message title for users attempting to log on* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1251,7 +1251,7 @@ On Windows Vista and above: For this setting to work, the Smart Card Removal Pol GP Info: -- GP English name: *Interactive logon: Smart card removal behavior* +- GP Friendly name: *Interactive logon: Smart card removal behavior* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1327,7 +1327,7 @@ For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. GP Info: -- GP English name: *Microsoft network client: Digitally sign communications (if server agrees)* +- GP Friendly name: *Microsoft network client: Digitally sign communications (if server agrees)* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1390,7 +1390,7 @@ Default: Disabled. GP Info: -- GP English name: *Microsoft network client: Send unencrypted password to third-party SMB servers* +- GP Friendly name: *Microsoft network client: Send unencrypted password to third-party SMB servers* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1459,7 +1459,7 @@ Default:This policy is not defined, which means that the system treats it as 15 GP Info: -- GP English name: *Microsoft network server: Amount of idle time required before suspending session* +- GP Friendly name: *Microsoft network server: Amount of idle time required before suspending session* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1556,7 +1556,7 @@ For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. GP Info: -- GP English name: *Microsoft network server: Digitally sign communications (always)* +- GP Friendly name: *Microsoft network server: Digitally sign communications (always)* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1636,7 +1636,7 @@ For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. GP Info: -- GP English name: *Microsoft network server: Digitally sign communications (if client agrees)* +- GP Friendly name: *Microsoft network server: Digitally sign communications (if client agrees)* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1709,7 +1709,7 @@ This policy has no impact on domain controllers. GP Info: -- GP English name: *Network access: Do not allow anonymous enumeration of SAM accounts* +- GP Friendly name: *Network access: Do not allow anonymous enumeration of SAM accounts* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1772,7 +1772,7 @@ Default: Disabled. GP Info: -- GP English name: *Network access: Do not allow anonymous enumeration of SAM accounts and shares* +- GP Friendly name: *Network access: Do not allow anonymous enumeration of SAM accounts and shares* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1835,7 +1835,7 @@ Default: Enabled. GP Info: -- GP English name: *Network access: Restrict anonymous access to Named Pipes and Shares* +- GP Friendly name: *Network access: Restrict anonymous access to Named Pipes and Shares* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1898,7 +1898,7 @@ This policy is supported on at least Windows Server 2016. GP Info: -- GP English name: *Network access: Restrict clients allowed to make remote calls to SAM* +- GP Friendly name: *Network access: Restrict clients allowed to make remote calls to SAM* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -1959,7 +1959,7 @@ When a service connects with the device identity, signing and encryption are sup GP Info: -- GP English name: *Network security: Allow Local System to use computer identity for NTLM* +- GP Friendly name: *Network security: Allow Local System to use computer identity for NTLM* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2027,7 +2027,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Network security: Allow PKU2U authentication requests to this computer to use online identities.* +- GP Friendly name: *Network security: Allow PKU2U authentication requests to this computer to use online identities.* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2101,7 +2101,7 @@ This setting can affect the ability of computers running Windows 2000 Server, Wi GP Info: -- GP English name: *Network security: Do not store LAN Manager hash value on next password change* +- GP Friendly name: *Network security: Do not store LAN Manager hash value on next password change* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2184,7 +2184,7 @@ Windows Vista, Windows Server 2008, Windows 7, and Windows Server 2008 R2: Send GP Info: -- GP English name: *Network security: LAN Manager authentication level* +- GP Friendly name: *Network security: LAN Manager authentication level* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2252,7 +2252,7 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption. GP Info: -- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* +- GP Friendly name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2320,7 +2320,7 @@ Windows 7 and Windows Server 2008 R2: Require 128-bit encryption GP Info: -- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) servers* +- GP Friendly name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) servers* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2385,7 +2385,7 @@ The naming format for servers on this exception list is the fully qualified doma GP Info: -- GP English name: *Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication* +- GP Friendly name: *Network security: Restrict NTLM: Add remote server exceptions for NTLM authentication* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2464,7 +2464,7 @@ This policy is supported on at least Windows 7 or Windows Server 2008 R2. GP Info: -- GP English name: *Network security: Restrict NTLM: Audit Incoming NTLM Traffic* +- GP Friendly name: *Network security: Restrict NTLM: Audit Incoming NTLM Traffic* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2543,7 +2543,7 @@ This policy is supported on at least Windows 7 or Windows Server 2008 R2. GP Info: -- GP English name: *Network security: Restrict NTLM: Incoming NTLM traffic* +- GP Friendly name: *Network security: Restrict NTLM: Incoming NTLM traffic* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2622,7 +2622,7 @@ This policy is supported on at least Windows 7 or Windows Server 2008 R2. GP Info: -- GP English name: *Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers* +- GP Friendly name: *Network security: Restrict NTLM: Outgoing NTLM traffic to remote servers* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2699,7 +2699,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *Shutdown: Allow system to be shut down without having to log on* +- GP Friendly name: *Shutdown: Allow system to be shut down without having to log on* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2770,7 +2770,7 @@ Default: Disabled. GP Info: -- GP English name: *Shutdown: Clear virtual memory pagefile* +- GP Friendly name: *Shutdown: Clear virtual memory pagefile* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2837,7 +2837,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop* +- GP Friendly name: *User Account Control: Allow UIAccess applications to prompt for elevation without using the secure desktop* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2920,7 +2920,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode* +- GP Friendly name: *User Account Control: Behavior of the elevation prompt for administrators in Admin Approval Mode* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -2980,7 +2980,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Behavior of the elevation prompt for standard users* +- GP Friendly name: *User Account Control: Behavior of the elevation prompt for standard users* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3053,7 +3053,7 @@ Disabled: Application installation packages are not detected and prompted for el GP Info: -- GP English name: *User Account Control: Detect application installations and prompt for elevation* +- GP Friendly name: *User Account Control: Detect application installations and prompt for elevation* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3118,7 +3118,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Only elevate executables that are signed and validated* +- GP Friendly name: *User Account Control: Only elevate executables that are signed and validated* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3190,7 +3190,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Only elevate UIAccess applications that are installed in secure locations* +- GP Friendly name: *User Account Control: Only elevate UIAccess applications that are installed in secure locations* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3258,7 +3258,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Run all administrators in Admin Approval Mode* +- GP Friendly name: *User Account Control: Run all administrators in Admin Approval Mode* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3323,7 +3323,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Switch to the secure desktop when prompting for elevation* +- GP Friendly name: *User Account Control: Switch to the secure desktop when prompting for elevation* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3388,7 +3388,7 @@ The options are: GP Info: -- GP English name: *User Account Control: Admin Approval Mode for the Built-in Administrator account* +- GP Friendly name: *User Account Control: Admin Approval Mode for the Built-in Administrator account* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* @@ -3449,7 +3449,7 @@ Value type is integer. Supported operations are Add, Get, Replace, and Delete. GP Info: -- GP English name: *User Account Control: Virtualize file and registry write failures to per-user locations* +- GP Friendly name: *User Account Control: Virtualize file and registry write failures to per-user locations* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* diff --git a/windows/client-management/mdm/policy-csp-lockdown.md b/windows/client-management/mdm/policy-csp-lockdown.md index bc065532ed..774ac1a21f 100644 --- a/windows/client-management/mdm/policy-csp-lockdown.md +++ b/windows/client-management/mdm/policy-csp-lockdown.md @@ -81,7 +81,7 @@ The easiest way to verify the policy is to restart the explorer process or to re ADMX Info: -- GP English name: *Allow edge swipe* +- GP Friendly name: *Allow edge swipe* - GP name: *AllowEdgeSwipe* - GP path: *Windows Components/Edge UI* - GP ADMX file name: *EdgeUI.admx* diff --git a/windows/client-management/mdm/policy-csp-maps.md b/windows/client-management/mdm/policy-csp-maps.md index 34c246f134..ce0ddd9868 100644 --- a/windows/client-management/mdm/policy-csp-maps.md +++ b/windows/client-management/mdm/policy-csp-maps.md @@ -145,7 +145,7 @@ After the policy is applied, you can verify the settings in the user interface i ADMX Info: -- GP English name: *Turn off Automatic Download and Update of Map Data* +- GP Friendly name: *Turn off Automatic Download and Update of Map Data* - GP name: *TurnOffAutoUpdate* - GP path: *Windows Components/Maps* - GP ADMX file name: *WinMaps.admx* diff --git a/windows/client-management/mdm/policy-csp-messaging.md b/windows/client-management/mdm/policy-csp-messaging.md index 43fe8e0e47..8b8b95188e 100644 --- a/windows/client-management/mdm/policy-csp-messaging.md +++ b/windows/client-management/mdm/policy-csp-messaging.md @@ -79,7 +79,7 @@ Added in Windows 10, version 1607. Enables text message back up and restore and ADMX Info: -- GP English name: *Allow Message Service Cloud Sync* +- GP Friendly name: *Allow Message Service Cloud Sync* - GP name: *AllowMessageSync* - GP path: *Windows Components/Messaging* - GP ADMX file name: *messaging.admx* diff --git a/windows/client-management/mdm/policy-csp-multitasking.md b/windows/client-management/mdm/policy-csp-multitasking.md index fd1e3372e8..9c58b25ef3 100644 --- a/windows/client-management/mdm/policy-csp-multitasking.md +++ b/windows/client-management/mdm/policy-csp-multitasking.md @@ -95,7 +95,7 @@ This policy only applies to the Alt+Tab switcher. When the policy is not enabled ADMX Info: -- GP English name: *Configure the inclusion of Edge tabs into Alt-Tab* +- GP Friendly name: *Configure the inclusion of Edge tabs into Alt-Tab* - GP name: *BrowserAltTabBlowout* - GP path: *Windows Components/Multitasking* - GP ADMX file name: *Multitasking.admx* diff --git a/windows/client-management/mdm/policy-csp-networkisolation.md b/windows/client-management/mdm/policy-csp-networkisolation.md index e438503509..8646c8830d 100644 --- a/windows/client-management/mdm/policy-csp-networkisolation.md +++ b/windows/client-management/mdm/policy-csp-networkisolation.md @@ -100,7 +100,7 @@ Contains a list of Enterprise resource domains hosted in the cloud that need to ADMX Info: -- GP English name: *Enterprise resource domains hosted in the cloud* +- GP Friendly name: *Enterprise resource domains hosted in the cloud* - GP name: *WF_NetIsolation_EnterpriseCloudResources* - GP element: *WF_NetIsolation_EnterpriseCloudResourcesBox* - GP path: *Network/Network Isolation* @@ -160,7 +160,7 @@ Sets the enterprise IP ranges that define the computers in the enterprise networ ADMX Info: -- GP English name: *Private network ranges for apps* +- GP Friendly name: *Private network ranges for apps* - GP name: *WF_NetIsolation_PrivateSubnet* - GP element: *WF_NetIsolation_PrivateSubnetBox* - GP path: *Network/Network Isolation* @@ -233,7 +233,7 @@ Integer value that tells the client to accept the configured list and not to use ADMX Info: -- GP English name: *Subnet definitions are authoritative* +- GP Friendly name: *Subnet definitions are authoritative* - GP name: *WF_NetIsolation_Authoritative_Subnet* - GP path: *Network/Network Isolation* - GP ADMX file name: *NetworkIsolation.admx* @@ -292,7 +292,7 @@ This is the comma-separated list of internal proxy servers. For example "157.54. ADMX Info: -- GP English name: *Intranet proxy servers for apps* +- GP Friendly name: *Intranet proxy servers for apps* - GP name: *WF_NetIsolation_Intranet_Proxies* - GP element: *WF_NetIsolation_Intranet_ProxiesBox* - GP path: *Network/Network Isolation* @@ -413,7 +413,7 @@ This is a comma-separated list of proxy servers. Any server on this list is cons ADMX Info: -- GP English name: *Internet proxy servers for apps* +- GP Friendly name: *Internet proxy servers for apps* - GP name: *WF_NetIsolation_Domain_Proxies* - GP element: *WF_NetIsolation_Domain_ProxiesBox* - GP path: *Network/Network Isolation* @@ -473,7 +473,7 @@ Integer value that tells the client to accept the configured list of proxies and ADMX Info: -- GP English name: *Proxy definitions are authoritative* +- GP Friendly name: *Proxy definitions are authoritative* - GP name: *WF_NetIsolation_Authoritative_Proxies* - GP path: *Network/Network Isolation* - GP ADMX file name: *NetworkIsolation.admx* @@ -532,7 +532,7 @@ List of domain names that can used for work or personal resource. ADMX Info: -- GP English name: *Domains categorized as both work and personal* +- GP Friendly name: *Domains categorized as both work and personal* - GP name: *WF_NetIsolation_NeutralResources* - GP element: *WF_NetIsolation_NeutralResourcesBox* - GP path: *Network/Network Isolation* diff --git a/windows/client-management/mdm/policy-csp-notifications.md b/windows/client-management/mdm/policy-csp-notifications.md index 34f3bd6b74..b9cb69c43d 100644 --- a/windows/client-management/mdm/policy-csp-notifications.md +++ b/windows/client-management/mdm/policy-csp-notifications.md @@ -96,7 +96,7 @@ No reboots or service restarts are required for this policy setting to take effe ADMX Info: -- GP English name: *Turn off notifications network usage* +- GP Friendly name: *Turn off notifications network usage* - GP name: *NoCloudNotification* - GP path: *Start Menu and Taskbar/Notifications* - GP ADMX file name: *WPN.admx* @@ -170,7 +170,7 @@ No reboot or service restart is required for this policy to take effect. ADMX Info: -- GP English name: *Turn off notification mirroring* +- GP Friendly name: *Turn off notification mirroring* - GP name: *NoNotificationMirroring* - GP path: *Start Menu and Taskbar/Notifications* - GP ADMX file name: *WPN.admx* @@ -242,7 +242,7 @@ No reboots or service restarts are required for this policy setting to take effe ADMX Info: -- GP English name: *Turn off tile notifications* +- GP Friendly name: *Turn off tile notifications* - GP name: *NoTileNotification* - GP path: *Start Menu and Taskbar/Notifications* - GP ADMX file name: *WPN.admx* diff --git a/windows/client-management/mdm/policy-csp-power.md b/windows/client-management/mdm/policy-csp-power.md index e710db1e1b..c9c793a619 100644 --- a/windows/client-management/mdm/policy-csp-power.md +++ b/windows/client-management/mdm/policy-csp-power.md @@ -153,7 +153,7 @@ If you disable this policy setting, standby states (S1-S3) are not allowed. ADMX Info: -- GP English name: *Allow standby states (S1-S3) when sleeping (on battery)* +- GP Friendly name: *Allow standby states (S1-S3) when sleeping (on battery)* - GP name: *AllowStandbyStatesDC_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -223,7 +223,7 @@ If you disable this policy setting, standby states (S1-S3) are not allowed. ADMX Info: -- GP English name: *Allow standby states (S1-S3) when sleeping (plugged in)* +- GP Friendly name: *Allow standby states (S1-S3) when sleeping (plugged in)* - GP name: *AllowStandbyStatesAC_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -295,7 +295,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Turn off the display (on battery)* +- GP Friendly name: *Turn off the display (on battery)* - GP name: *VideoPowerDownTimeOutDC_2* - GP path: *System/Power Management/Video and Display Settings* - GP ADMX file name: *power.admx* @@ -367,7 +367,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Turn off the display (plugged in)* +- GP Friendly name: *Turn off the display (plugged in)* - GP name: *VideoPowerDownTimeOutAC_2* - GP path: *System/Power Management/Video and Display Settings* - GP ADMX file name: *power.admx* @@ -431,7 +431,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Energy Saver Battery Threshold (on battery)* +- GP Friendly name: *Energy Saver Battery Threshold (on battery)* - GP name: *EsBattThresholdDC* - GP element: *EnterEsBattThreshold* - GP path: *System/Power Management/Energy Saver Settings* @@ -504,7 +504,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Energy Saver Battery Threshold (plugged in)* +- GP Friendly name: *Energy Saver Battery Threshold (plugged in)* - GP name: *EsBattThresholdAC* - GP element: *EnterEsBattThreshold* - GP path: *System/Power Management/Energy Saver Settings* @@ -586,7 +586,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Specify the system hibernate timeout (on battery)* +- GP Friendly name: *Specify the system hibernate timeout (on battery)* - GP name: *DCHibernateTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -658,7 +658,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Specify the system hibernate timeout (plugged in)* +- GP Friendly name: *Specify the system hibernate timeout (plugged in)* - GP name: *ACHibernateTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -728,7 +728,7 @@ If you disable this policy setting, the user is not prompted for a password when ADMX Info: -- GP English name: *Require a password when a computer wakes (on battery)* +- GP Friendly name: *Require a password when a computer wakes (on battery)* - GP name: *DCPromptForPasswordOnResume_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -798,7 +798,7 @@ If you disable this policy setting, the user is not prompted for a password when ADMX Info: -- GP English name: *Require a password when a computer wakes (plugged in)* +- GP Friendly name: *Require a password when a computer wakes (plugged in)* - GP name: *ACPromptForPasswordOnResume_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -861,7 +861,7 @@ If you disable this policy setting or do not configure it, users can see and cha ADMX Info: -- GP English name: *Select the lid switch action (on battery)* +- GP Friendly name: *Select the lid switch action (on battery)* - GP name: *DCSystemLidAction_2* - GP element: *SelectDCSystemLidAction* - GP path: *System/Power Management/Button Settings* @@ -940,7 +940,7 @@ If you disable this policy setting or do not configure it, users can see and cha ADMX Info: -- GP English name: *Select the lid switch action (plugged in)* +- GP Friendly name: *Select the lid switch action (plugged in)* - GP name: *ACSystemLidAction_2* - GP element: *SelectACSystemLidAction* - GP path: *System/Power Management/Button Settings* @@ -1019,7 +1019,7 @@ If you disable this policy setting or do not configure it, users can see and cha ADMX Info: -- GP English name: *Select the Power button action (on battery)* +- GP Friendly name: *Select the Power button action (on battery)* - GP name: *DCPowerButtonAction_2* - GP element: *SelectDCPowerButtonAction* - GP path: *System/Power Management/Button Settings* @@ -1098,7 +1098,7 @@ If you disable this policy setting or do not configure it, users can see and cha ADMX Info: -- GP English name: *Select the Power button action (plugged in)* +- GP Friendly name: *Select the Power button action (plugged in)* - GP name: *ACPowerButtonAction_2* - GP element: *SelectACPowerButtonAction* - GP path: *System/Power Management/Button Settings* @@ -1177,7 +1177,7 @@ If you disable this policy setting or do not configure it, users can see and cha ADMX Info: -- GP English name: *Select the Sleep button action (on battery)* +- GP Friendly name: *Select the Sleep button action (on battery)* - GP name: *DCSleepButtonAction_2* - GP element: *SelectDCSleepButtonAction* - GP path: *System/Power Management/Button Settings* @@ -1256,7 +1256,7 @@ If you disable this policy setting or do not configure it, users can see and cha ADMX Info: -- GP English name: *Select the Sleep button action (plugged in)* +- GP Friendly name: *Select the Sleep button action (plugged in)* - GP name: *ACSleepButtonAction_2* - GP element: *SelectACSleepButtonAction* - GP path: *System/Power Management/Button Settings* @@ -1344,7 +1344,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Specify the system sleep timeout (on battery)* +- GP Friendly name: *Specify the system sleep timeout (on battery)* - GP name: *DCStandbyTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -1416,7 +1416,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Specify the system sleep timeout (plugged in)* +- GP Friendly name: *Specify the system sleep timeout (plugged in)* - GP name: *ACStandbyTimeOut_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -1479,7 +1479,7 @@ If you set this policy setting to 1 or do not configure this policy setting, use ADMX Info: -- GP English name: *Turn off hybrid sleep (on battery)* +- GP Friendly name: *Turn off hybrid sleep (on battery)* - GP name: *DCStandbyWithHiberfileEnable_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -1555,7 +1555,7 @@ If you set this policy setting to 1 or do not configure this policy setting, use ADMX Info: -- GP English name: *Turn off hybrid sleep (plugged in)* +- GP Friendly name: *Turn off hybrid sleep (plugged in)* - GP name: *ACStandbyWithHiberfileEnable_2* - GP path: *System/Power Management/Sleep Settings* - GP ADMX file name: *power.admx* @@ -1633,7 +1633,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Specify the unattended sleep timeout (on battery)* +- GP Friendly name: *Specify the unattended sleep timeout (on battery)* - GP name: *UnattendedSleepTimeOutDC* - GP element: *EnterUnattendedSleepTimeOut* - GP path: *System/Power Management/Sleep Settings* @@ -1709,7 +1709,7 @@ If the user has configured a slide show to run on the lock screen when the machi ADMX Info: -- GP English name: *Specify the unattended sleep timeout (plugged in)* +- GP Friendly name: *Specify the unattended sleep timeout (plugged in)* - GP name: *UnattendedSleepTimeOutAC* - GP element: *EnterUnattendedSleepTimeOut* - GP path: *System/Power Management/Sleep Settings* diff --git a/windows/client-management/mdm/policy-csp-printers.md b/windows/client-management/mdm/policy-csp-printers.md index e93f27025d..90268db913 100644 --- a/windows/client-management/mdm/policy-csp-printers.md +++ b/windows/client-management/mdm/policy-csp-printers.md @@ -109,7 +109,7 @@ If you disable this policy setting: ADMX Info: -- GP English name: *Point and Print Restrictions* +- GP Friendly name: *Point and Print Restrictions* - GP name: *PointAndPrint_Restrictions_Win7* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -204,7 +204,7 @@ If you disable this policy setting: ADMX Info: -- GP English name: *Point and Print Restrictions* +- GP Friendly name: *Point and Print Restrictions* - GP name: *PointAndPrint_Restrictions* - GP path: *Control Panel/Printers* - GP ADMX file name: *Printing.admx* @@ -276,7 +276,7 @@ Note: This settings takes priority over the setting "Automatically publish new p ADMX Info: -- GP English name: *Allow printers to be published* +- GP Friendly name: *Allow printers to be published* - GP name: *PublishPrinters* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 1519ff7e40..f8c10ffd3f 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -756,7 +756,7 @@ Enabling this policy prevents context menus from being invoked in the Start Menu ADMX Info: -- GP English name: *Disable context menus in the Start Menu* +- GP Friendly name: *Disable context menus in the Start Menu* - GP name: *DisableContextMenusInStart* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1242,7 +1242,7 @@ Value type is integer. ADMX Info: -- GP English name: *Remove the People Bar from the taskbar* +- GP Friendly name: *Remove the People Bar from the taskbar* - GP name: *HidePeopleBar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1454,7 +1454,7 @@ Added in Windows 10, version 1703. Allows IT Admins to configure Start by hidin ADMX Info: -- GP English name: *Remove "Recently added" list from Start Menu* +- GP Friendly name: *Remove "Recently added" list from Start Menu* - GP name: *HideRecentlyAddedApps* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2083,7 +2083,7 @@ For further details on how to customize the Start layout, please see [Customize ADMX Info: -- GP English name: *Start Layout* +- GP Friendly name: *Start Layout* - GP name: *LockedStartLayout* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index e55afed42c..ecd7532d32 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -105,7 +105,7 @@ Value type is integer. ADMX Info: -- GP English name: *Allow downloading updates to the Disk Failure Prediction Model* +- GP Friendly name: *Allow downloading updates to the Disk Failure Prediction Model* - GP name: *SH_AllowDiskHealthModelUpdates* - GP path: *System/Storage Health* - GP ADMX file name: *StorageHealth.admx* @@ -176,7 +176,7 @@ If you do not configure this policy setting, Storage Sense is turned off by defa ADMX Info: -- GP English name: *Allow Storage Sense* +- GP Friendly name: *Allow Storage Sense* - GP name: *SS_AllowStorageSenseGlobal* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -252,7 +252,7 @@ If you do not configure this policy setting, Storage Sense will delete the user ADMX Info: -- GP English name: *Allow Storage Sense Temporary Files cleanup* +- GP Friendly name: *Allow Storage Sense Temporary Files cleanup* - GP name: *SS_AllowStorageSenseTemporaryFilesCleanup* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -328,7 +328,7 @@ If you disable or do not configure this policy setting, then Storage Sense will ADMX Info: -- GP English name: *Configure Storage Sense Cloud Content dehydration threshold* +- GP Friendly name: *Configure Storage Sense Cloud Content dehydration threshold* - GP name: *SS_ConfigStorageSenseCloudContentDehydrationThreshold* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -404,7 +404,7 @@ If you disable or do not configure this policy setting, then Storage Sense will ADMX Info: -- GP English name: *Configure Storage Storage Downloads cleanup threshold* +- GP Friendly name: *Configure Storage Storage Downloads cleanup threshold* - GP name: *SS_ConfigStorageSenseDownloadsCleanupThreshold* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -486,7 +486,7 @@ If you do not configure this policy setting, then the Storage Sense cadence is s ADMX Info: -- GP English name: *Configure Storage Sense cadence* +- GP Friendly name: *Configure Storage Sense cadence* - GP name: *SS_ConfigStorageSenseGlobalCadence* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -562,7 +562,7 @@ If you disable or do not configure this policy setting, Storage Sense will delet ADMX Info: -- GP English name: *Configure Storage Sense Recycle Bin cleanup threshold* +- GP Friendly name: *Configure Storage Sense Recycle Bin cleanup threshold* - GP name: *SS_ConfigStorageSenseRecycleBinCleanupThreshold* - GP path: *System/Storage Sense* - GP ADMX file name: *StorageSense.admx* @@ -641,7 +641,7 @@ If you disable or do not configure this policy setting, Windows will activate un ADMX Info: -- GP English name: *Do not allow Windows to activate Enhanced Storage devices* +- GP Friendly name: *Do not allow Windows to activate Enhanced Storage devices* - GP name: *TCGSecurityActivationDisabled* - GP path: *System/Enhanced Storage Access* - GP ADMX file name: *enhancedstorage.admx* @@ -707,7 +707,7 @@ Supported values: ADMX Info: -- GP English name: *Removable Disks: Deny write access* +- GP Friendly name: *Removable Disks: Deny write access* - GP name: *RemovableDisks_DenyWrite_Access_2* - GP element: *RemovableDisks_DenyWrite_Access_2* - GP path: *System/Removable Storage Access* diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index f199fbc4c1..456891257d 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -158,7 +158,7 @@ If you enable or do not configure this policy setting, users can download and in ADMX Info: -- GP English name: *Toggle user control over Insider builds* +- GP Friendly name: *Toggle user control over Insider builds* - GP name: *AllowBuildPreview* - GP path: *Data Collection and Preview Builds* - GP ADMX file name: *AllowBuildPreview.admx* From 03de01061cf3760e584195d649568b1de4f077c3 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Wed, 11 Aug 2021 15:13:29 +0530 Subject: [PATCH 0016/1214] Updated --- .../mdm/policy-csp-admx-wincal.md | 4 +- .../policy-csp-admx-windowsanytimeupgrade.md | 2 +- .../mdm/policy-csp-admx-windowsconnectnow.md | 6 +- .../mdm/policy-csp-admx-windowsexplorer.md | 142 +++++++++--------- .../policy-csp-admx-windowsfileprotection.md | 8 +- .../mdm/policy-csp-admx-windowsmediadrm.md | 2 +- .../mdm/policy-csp-admx-windowsmediaplayer.md | 42 +++--- ...policy-csp-admx-windowsremotemanagement.md | 4 +- .../mdm/policy-csp-admx-windowsstore.md | 10 +- .../mdm/policy-csp-admx-wininit.md | 6 +- .../mdm/policy-csp-admx-winlogon.md | 12 +- .../mdm/policy-csp-admx-winsrv.md | 2 +- .../mdm/policy-csp-admx-wlansvc.md | 6 +- .../mdm/policy-csp-admx-wpn.md | 12 +- .../mdm/policy-csp-applicationdefaults.md | 4 +- .../mdm/policy-csp-applicationmanagement.md | 24 +-- .../mdm/policy-csp-appruntime.md | 2 +- .../mdm/policy-csp-appvirtualization.md | 56 +++---- .../mdm/policy-csp-attachmentmanager.md | 4 +- .../client-management/mdm/policy-csp-audit.md | 118 +++++++-------- .../mdm/policy-csp-authentication.md | 2 +- .../mdm/policy-csp-autoplay.md | 6 +- .../client-management/mdm/policy-csp-bits.md | 12 +- .../mdm/policy-csp-browser.md | 110 +++++++------- .../mdm/policy-csp-camera.md | 2 +- .../mdm/policy-csp-cellular.md | 10 +- .../mdm/policy-csp-connectivity.md | 14 +- .../mdm/policy-csp-credentialproviders.md | 4 +- .../mdm/policy-csp-credentialsdelegation.md | 2 +- .../mdm/policy-csp-credentialsui.md | 4 +- .../mdm/policy-csp-cryptography.md | 2 +- 31 files changed, 317 insertions(+), 317 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-wincal.md b/windows/client-management/mdm/policy-csp-admx-wincal.md index de5d9fde63..a289a23d5b 100644 --- a/windows/client-management/mdm/policy-csp-admx-wincal.md +++ b/windows/client-management/mdm/policy-csp-admx-wincal.md @@ -95,7 +95,7 @@ The default is for Windows Calendar to be turned on. ADMX Info: -- GP English name: *Turn off Windows Calendar* +- GP Friendly name: *Turn off Windows Calendar* - GP name: *TurnOffWinCal_1* - GP path: *Windows Components\Windows Calendar* - GP ADMX file name: *WinCal.admx* @@ -168,7 +168,7 @@ The default is for Windows Calendar to be turned on. ADMX Info: -- GP English name: *Turn off Windows Calendar* +- GP Friendly name: *Turn off Windows Calendar* - GP name: *TurnOffWinCal_2* - GP path: *Windows Components\Windows Calendar* - GP ADMX file name: *WinCal.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md b/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md index 5902416124..ab4c4a6c88 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsanytimeupgrade.md @@ -91,7 +91,7 @@ If you disable this policy setting or set it to Not Configured, the wizard will ADMX Info: -- GP English name: *Prevent the wizard from running.* +- GP Friendly name: *Prevent the wizard from running.* - GP name: *Disabled* - GP path: *Windows Components\Add features to Windows 10* - GP ADMX file name: *WindowsAnytimeUpgrade.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md index d65677d585..80b1fb90ac 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsconnectnow.md @@ -96,7 +96,7 @@ If you disable or do not configure this policy setting, users can access the wiz ADMX Info: -- GP English name: *Prohibit access of the Windows Connect Now wizards* +- GP Friendly name: *Prohibit access of the Windows Connect Now wizards* - GP name: *WCN_DisableWcnUi_1* - GP path: *Network\Windows Connect Now* - GP ADMX file name: *WindowsConnectNow.admx* @@ -165,7 +165,7 @@ If you disable or do not configure this policy setting, users can access the wiz ADMX Info: -- GP English name: *Prohibit access of the Windows Connect Now wizards* +- GP Friendly name: *Prohibit access of the Windows Connect Now wizards* - GP name: *WCN_DisableWcnUi_2* - GP path: *Network\Windows Connect Now* - GP ADMX file name: *WindowsConnectNow.admx* @@ -240,7 +240,7 @@ The default for this policy setting allows operations over all media. ADMX Info: -- GP English name: *Configuration of wireless settings using Windows Connect Now* +- GP Friendly name: *Configuration of wireless settings using Windows Connect Now* - GP name: *WCN_EnableRegistrar* - GP path: *Network\Windows Connect Now* - GP ADMX file name: *WindowsConnectNow.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md index 352dd76846..7ffcac7be2 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsexplorer.md @@ -304,7 +304,7 @@ If you disable or do not configure this policy setting, Folder Redirection does ADMX Info: -- GP English name: *Verify old and new Folder Redirection targets point to the same share before redirecting* +- GP Friendly name: *Verify old and new Folder Redirection targets point to the same share before redirecting* - GP name: *CheckSameSourceAndTargetForFRAndDFS* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -379,7 +379,7 @@ If you disable or not configure this policy, the default File Explorer behavior ADMX Info: -- GP English name: *Turn on Classic Shell* +- GP Friendly name: *Turn on Classic Shell* - GP name: *ClassicShell* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -448,7 +448,7 @@ If you disable or do not configure this setting, the default behavior of not dis ADMX Info: -- GP English name: *Display confirmation dialog when deleting files* +- GP Friendly name: *Display confirmation dialog when deleting files* - GP name: *ConfirmFileDelete* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -518,7 +518,7 @@ If you disable or do not configure this policy setting, no changes are made to t ADMX Info: -- GP English name: *Location where all default Library definition files for users/machines reside.* +- GP Friendly name: *Location where all default Library definition files for users/machines reside.* - GP name: *DefaultLibrariesLocation* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -588,7 +588,7 @@ This disables access to user-defined properties, and properties stored in NTFS s ADMX Info: -- GP English name: *Disable binding directly to IPropertySetStorage without intermediate layers.* +- GP Friendly name: *Disable binding directly to IPropertySetStorage without intermediate layers.* - GP name: *DisableBindDirectlyToPropertySetStorage* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -667,7 +667,7 @@ If you disable or do not configure this policy, all default Windows Libraries fe ADMX Info: -- GP English name: *Turn off Windows Libraries features that rely on indexed file data* +- GP Friendly name: *Turn off Windows Libraries features that rely on indexed file data* - GP name: *DisableIndexedLibraryExperience* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -740,7 +740,7 @@ You can specify a known folder using its known folder id or using its canonical ADMX Info: -- GP English name: *Disable Known Folders* +- GP Friendly name: *Disable Known Folders* - GP name: *DisableKnownFolders* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -812,7 +812,7 @@ These suggestions are based on their past entries into the Search Box. ADMX Info: -- GP English name: *Turn off display of recent search entries in the File Explorer search box* +- GP Friendly name: *Turn off display of recent search entries in the File Explorer search box* - GP name: *DisableSearchBoxSuggestions* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -885,7 +885,7 @@ If you disable or do not configure this policy setting, file shortcut icons that ADMX Info: -- GP English name: *Allow the use of remote paths in file shortcut icons* +- GP Friendly name: *Allow the use of remote paths in file shortcut icons* - GP name: *EnableShellShortcutIconRemotePath* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -964,7 +964,7 @@ If you do not configure this policy, SmartScreen will be enabled by default, but ADMX Info: -- GP English name: *Configure Windows Defender SmartScreen* +- GP Friendly name: *Configure Windows Defender SmartScreen* - GP name: *EnableSmartScreen* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -1035,7 +1035,7 @@ For shell extensions to run on a per-user basis, there must be an entry at HKEY_ ADMX Info: -- GP English name: *Allow only per user or approved shell extensions* +- GP Friendly name: *Allow only per user or approved shell extensions* - GP name: *EnforceShellExtensionSecurity* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -1105,7 +1105,7 @@ If you disable or do not configure this policy setting, users can choose how the ADMX Info: -- GP English name: *Start File Explorer with ribbon minimized* +- GP Friendly name: *Start File Explorer with ribbon minimized* - GP name: *ExplorerRibbonStartsMinimized* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -1174,7 +1174,7 @@ If you disable or do not configure this policy setting, File Explorer shows snip ADMX Info: -- GP English name: *Turn off the display of snippets in Content view mode* +- GP Friendly name: *Turn off the display of snippets in Content view mode* - GP name: *HideContentViewModeSnippets* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -1248,7 +1248,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_Internet* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1322,7 +1322,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_InternetLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1396,7 +1396,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_Intranet* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1470,7 +1470,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_IntranetLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1544,7 +1544,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_LocalMachine* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1618,7 +1618,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_LocalMachineLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1692,7 +1692,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_Restricted* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1766,7 +1766,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_RestrictedLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1840,7 +1840,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_Trusted* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1914,7 +1914,7 @@ Changes to this setting may not be applied until the user logs off from Windows. ADMX Info: -- GP English name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* +- GP Friendly name: *Allow previewing and custom thumbnails of OpenSearch query results in File Explorer* - GP name: *IZ_Policy_OpenSearchPreview_TrustedLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -1986,7 +1986,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_Internet* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Internet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2058,7 +2058,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_InternetLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Internet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2130,7 +2130,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_Intranet* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Intranet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2202,7 +2202,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_IntranetLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Intranet Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2274,7 +2274,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_LocalMachine* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Local Machine Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2346,7 +2346,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_LocalMachineLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Local Machine Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2418,7 +2418,7 @@ If you do not configure this policy setting, users cannot perform OpenSearch que ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_Restricted* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Restricted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2491,7 +2491,7 @@ If you do not configure this policy setting, users cannot perform OpenSearch que ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_RestrictedLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Restricted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2564,7 +2564,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_Trusted* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Trusted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2636,7 +2636,7 @@ If you do not configure this policy setting, users can perform OpenSearch querie ADMX Info: -- GP English name: *Allow OpenSearch queries in File Explorer* +- GP Friendly name: *Allow OpenSearch queries in File Explorer* - GP name: *IZ_Policy_OpenSearchQuery_TrustedLockdown* - GP path: *Windows Components\Internet Explorer\Internet Control Panel\Security Page\Locked-Down Trusted Sites Zone* - GP ADMX file name: *WindowsExplorer.admx* @@ -2707,7 +2707,7 @@ If you disable or do not configure this policy setting, Windows searches for the ADMX Info: -- GP English name: *Do not track Shell shortcuts during roaming* +- GP Friendly name: *Do not track Shell shortcuts during roaming* - GP name: *LinkResolveIgnoreLinkInfo* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -2776,7 +2776,7 @@ If you disable or do not configure this policy setting, by default, the system d ADMX Info: -- GP English name: *Maximum number of recent documents* +- GP Friendly name: *Maximum number of recent documents* - GP name: *MaxRecentDocs* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -2849,7 +2849,7 @@ If you disable or do not configure this policy setting, the Back button is displ ADMX Info: -- GP English name: *Hide the common dialog back button* +- GP Friendly name: *Hide the common dialog back button* - GP name: *NoBackButton* - GP path: *Windows Components\File Explorer\Common Open File Dialog* - GP ADMX file name: *WindowsExplorer.admx* @@ -2921,7 +2921,7 @@ If you disable or do not configure this policy setting, users are able to use th ADMX Info: -- GP English name: *Remove CD Burning features* +- GP Friendly name: *Remove CD Burning features* - GP name: *NoCDBurning* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -2993,7 +2993,7 @@ If you disable or do not configure this policy setting, thumbnail views are cach ADMX Info: -- GP English name: *Turn off caching of thumbnail pictures* +- GP Friendly name: *Turn off caching of thumbnail pictures* - GP name: *NoCacheThumbNailPictures* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3064,7 +3064,7 @@ If you disable or do not configure this policy setting, users are allowed to tur ADMX Info: -- GP English name: *Remove UI to change menu animation setting* +- GP Friendly name: *Remove UI to change menu animation setting* - GP name: *NoChangeAnimation* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3131,7 +3131,7 @@ Effects, such as transitory underlines, are designed to enhance the user's exper ADMX Info: -- GP English name: *Remove UI to change keyboard navigation indicator setting* +- GP Friendly name: *Remove UI to change keyboard navigation indicator setting* - GP name: *NoChangeKeyboardNavigationIndicators* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3200,7 +3200,7 @@ If you disable or do not configure this policy setting, the DFS tab is available ADMX Info: -- GP English name: *Remove DFS tab* +- GP Friendly name: *Remove DFS tab* - GP name: *NoDFSTab* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3274,7 +3274,7 @@ If you disable or do not configure this policy setting, all drives are displayed ADMX Info: -- GP English name: *Hide these specified drives in My Computer* +- GP Friendly name: *Hide these specified drives in My Computer* - GP name: *NoDrives* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3348,7 +3348,7 @@ To remove computers in the user's workgroup or domain from lists of network reso ADMX Info: -- GP English name: *No Entire Network in Network Locations* +- GP Friendly name: *No Entire Network in Network Locations* - GP name: *NoEntireNetwork* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3422,7 +3422,7 @@ To see an example of the standard Open dialog box, start WordPad and, on the Fil ADMX Info: -- GP English name: *Hide the dropdown list of recent files* +- GP Friendly name: *Hide the dropdown list of recent files* - GP name: *NoFileMRU* - GP path: *Windows Components\File Explorer\Common Open File Dialog* - GP ADMX file name: *WindowsExplorer.admx* @@ -3489,7 +3489,7 @@ This setting does not prevent users from using other methods to perform tasks av ADMX Info: -- GP English name: *Remove File menu from File Explorer* +- GP Friendly name: *Remove File menu from File Explorer* - GP name: *NoFileMenu* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3560,7 +3560,7 @@ If you disable or do not configure this policy setting, users can open Folder Op ADMX Info: -- GP English name: *Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon* +- GP Friendly name: *Do not allow Folder Options to be opened from the Options button on the View tab of the ribbon* - GP name: *NoFolderOptions* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3625,7 +3625,7 @@ Available in the latest Windows 10 Insider Preview Build. Removes the Hardware t ADMX Info: -- GP English name: *Remove Hardware tab* +- GP Friendly name: *Remove Hardware tab* - GP name: *NoHardwareTab* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3697,7 +3697,7 @@ This setting does not remove the Computer Management item from the Start menu (S ADMX Info: -- GP English name: *Hides the Manage item on the File Explorer context menu* +- GP Friendly name: *Hides the Manage item on the File Explorer context menu* - GP name: *NoManageMyComputerVerb* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3769,7 +3769,7 @@ If you disable or do not configure this policy setting, the Shared Documents fol ADMX Info: -- GP English name: *Remove Shared Documents from My Computer* +- GP Friendly name: *Remove Shared Documents from My Computer* - GP name: *NoMyComputerSharedDocuments* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3843,7 +3843,7 @@ This setting does not prevent users from connecting to another computer by typin ADMX Info: -- GP English name: *Remove "Map Network Drive" and "Disconnect Network Drive"* +- GP Friendly name: *Remove "Map Network Drive" and "Disconnect Network Drive"* - GP name: *NoNetConnectDisconnect* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3910,7 +3910,7 @@ If this group policy is enabled, no notifications will be shown. If the group po ADMX Info: -- GP English name: *Do not show the 'new application installed' notification* +- GP Friendly name: *Do not show the 'new application installed' notification* - GP name: *NoNewAppAlert* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -3980,7 +3980,7 @@ To see an example of the standard Open dialog box, start WordPad and, on the Fil ADMX Info: -- GP English name: *Hide the common dialog places bar* +- GP Friendly name: *Hide the common dialog places bar* - GP name: *NoPlacesBar* - GP path: *Windows Components\File Explorer\Common Open File Dialog* - GP ADMX file name: *WindowsExplorer.admx* @@ -4049,7 +4049,7 @@ If you disable or do not configure this setting, files and folders deleted using ADMX Info: -- GP English name: *Do not move deleted files to the Recycle Bin* +- GP Friendly name: *Do not move deleted files to the Recycle Bin* - GP name: *NoRecycleFiles* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4122,7 +4122,7 @@ By default, users are not prompted for alternate logon credentials when installi ADMX Info: -- GP English name: *Do not request alternate credentials* +- GP Friendly name: *Do not request alternate credentials* - GP name: *NoRunAsInstallPrompt* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4191,7 +4191,7 @@ If you do not configure this policy (default), there will be an "Internet" link ADMX Info: -- GP English name: *Remove the Search the Internet "Search again" link* +- GP Friendly name: *Remove the Search the Internet "Search again" link* - GP name: *NoSearchInternetTryHarderButton* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4260,7 +4260,7 @@ If you disable or do not configure this setting, users will be able to access th ADMX Info: -- GP English name: *Remove Security tab* +- GP Friendly name: *Remove Security tab* - GP name: *NoSecurityTab* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4329,7 +4329,7 @@ This policy setting does not affect the Search items on the File Explorer contex ADMX Info: -- GP English name: *Remove Search button from File Explorer* +- GP Friendly name: *Remove Search button from File Explorer* - GP name: *NoShellSearchButton* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4399,7 +4399,7 @@ If you disable or do not configure this policy setting, File Explorer will sort ADMX Info: -- GP English name: *Turn off numerical sorting in File Explorer* +- GP Friendly name: *Turn off numerical sorting in File Explorer* - GP name: *NoStrCmpLogical* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4466,7 +4466,7 @@ If you enable this setting, menus do not appear when you right-click the desktop ADMX Info: -- GP English name: *Remove File Explorer's default context menu* +- GP Friendly name: *Remove File Explorer's default context menu* - GP name: *NoViewContextMenu* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4540,7 +4540,7 @@ To use this setting, select a drive or combination of drives from the drop-down ADMX Info: -- GP English name: *Prevent access to drives from My Computer* +- GP Friendly name: *Prevent access to drives from My Computer* - GP name: *NoViewOnDrive* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4611,7 +4611,7 @@ If you disable or do not configure this setting, the Windows Key hotkeys are ava ADMX Info: -- GP English name: *Turn off Windows Key hotkeys* +- GP Friendly name: *Turn off Windows Key hotkeys* - GP name: *NoWindowsHotKeys* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4684,7 +4684,7 @@ To remove network computers from lists of network resources, use the "No Entire ADMX Info: -- GP English name: *No Computers Near Me in Network Locations* +- GP Friendly name: *No Computers Near Me in Network Locations* - GP name: *NoWorkgroupContents* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4766,7 +4766,7 @@ If you disable or do not configure this setting the default list of items will b ADMX Info: -- GP English name: *Items displayed in Places Bar* +- GP Friendly name: *Items displayed in Places Bar* - GP name: *PlacesBar* - GP path: *Windows Components\File Explorer\Common Open File Dialog* - GP ADMX file name: *WindowsExplorer.admx* @@ -4842,7 +4842,7 @@ If the dialog box does not appear, the installation proceeds with the current us ADMX Info: -- GP English name: *Request credentials for network installations* +- GP Friendly name: *Request credentials for network installations* - GP name: *PromptRunasInstallNetPath* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4914,7 +4914,7 @@ If you disable or do not configure this setting, users can change the total amou ADMX Info: -- GP English name: *Maximum allowed Recycle Bin size* +- GP Friendly name: *Maximum allowed Recycle Bin size* - GP name: *RecycleBinSize* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -4985,7 +4985,7 @@ If you do not configure this policy setting the protocol is in the protected mod ADMX Info: -- GP English name: *Turn off shell protocol protected mode* +- GP Friendly name: *Turn off shell protocol protected mode* - GP name: *ShellProtocolProtectedModeTitle_1* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -5056,7 +5056,7 @@ If you do not configure this policy setting the protocol is in the protected mod ADMX Info: -- GP English name: *Turn off shell protocol protected mode* +- GP Friendly name: *Turn off shell protocol protected mode* - GP name: *ShellProtocolProtectedModeTitle_2* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -5127,7 +5127,7 @@ If you do not configure this policy setting, users will be able to choose whethe ADMX Info: -- GP English name: *Show hibernate in the power options menu* +- GP Friendly name: *Show hibernate in the power options menu* - GP name: *ShowHibernateOption* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -5198,7 +5198,7 @@ If you do not configure this policy setting, users will be able to choose whethe ADMX Info: -- GP English name: *Show sleep in the power options menu* +- GP Friendly name: *Show sleep in the power options menu* - GP name: *ShowSleepOption* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -5271,7 +5271,7 @@ If you disable or do not configure this policy setting, no Libraries or Search C ADMX Info: -- GP English name: *Pin Libraries or Search Connectors to the "Search again" links and the Start menu* +- GP Friendly name: *Pin Libraries or Search Connectors to the "Search again" links and the Start menu* - GP name: *TryHarderPinnedLibrary* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* @@ -5344,7 +5344,7 @@ If you disable or do not configure this policy setting, no custom Internet searc ADMX Info: -- GP English name: *Pin Internet search sites to the "Search again" links and the Start menu* +- GP Friendly name: *Pin Internet search sites to the "Search again" links and the Start menu* - GP name: *TryHarderPinnedOpenSearch* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *WindowsExplorer.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsfileprotection.md b/windows/client-management/mdm/policy-csp-admx-windowsfileprotection.md index 66662cba51..bc2f8b6a02 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsfileprotection.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsfileprotection.md @@ -99,7 +99,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting hi ADMX Info: -- GP English name: *Hide the file scan progress window* +- GP Friendly name: *Hide the file scan progress window* - GP name: *WFPShowProgress* - GP path: *Windows File Protection!SfcShowProgress* - GP ADMX file name: *WindowsFileProtection.admx* @@ -173,7 +173,7 @@ To indicate that the cache size is unlimited, select "4294967295" as the maximum ADMX Info: -- GP English name: *Limit Windows File Protection cache size* +- GP Friendly name: *Limit Windows File Protection cache size* - GP name: *WFPQuota* - GP path: *System\Windows File Protection* - GP ADMX file name: *WindowsFileProtection.admx* @@ -251,7 +251,7 @@ This setting delays each startup. ADMX Info: -- GP English name: *Set Windows File Protection scanning* +- GP Friendly name: *Set Windows File Protection scanning* - GP name: *WFPScan* - GP path: *System\Windows File Protection* - GP ADMX file name: *WindowsFileProtection.admx* @@ -333,7 +333,7 @@ If both the "Hide specified Control Panel items" setting and the "Show only spec ADMX Info: -- GP English name: *Specify Windows File Protection cache location* +- GP Friendly name: *Specify Windows File Protection cache location* - GP name: *WFPDllCacheDir* - GP path: *System\Windows File Protection* - GP ADMX file name: *WindowsFileProtection.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md index 301c276ef2..43885e4dc8 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediadrm.md @@ -92,7 +92,7 @@ When this policy is either disabled or not configured, Windows Media DRM functio ADMX Info: -- GP English name: *Prevent Windows Media DRM Internet Access* +- GP Friendly name: *Prevent Windows Media DRM Internet Access* - GP name: *DisableOnline* - GP path: *Windows Components\Windows Media Digital Rights Management* - GP ADMX file name: *WindowsMediaDRM.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md index 86aa3334d8..73bedb6677 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsmediaplayer.md @@ -162,7 +162,7 @@ If you do not configure this policy setting, users can configure the HTTP proxy ADMX Info: -- GP English name: *Configure HTTP Proxy* +- GP Friendly name: *Configure HTTP Proxy* - GP name: *ConfigureHTTPProxySettings* - GP path: *Windows Components\Windows Media Player\Networking* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -242,7 +242,7 @@ If you do not configure this policy setting, users can configure the MMS proxy s ADMX Info: -- GP English name: *Configure MMS Proxy* +- GP Friendly name: *Configure MMS Proxy* - GP name: *ConfigureMMSProxySettings* - GP path: *Windows Components\Windows Media Player\Networking* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -320,7 +320,7 @@ If you do not configure this policy setting, users can configure the RTSP proxy ADMX Info: -- GP English name: *Configure RTSP Proxy* +- GP Friendly name: *Configure RTSP Proxy* - GP name: *ConfigureRTSPProxySettings* - GP path: *Windows Components\Windows Media Player\Networking* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -391,7 +391,7 @@ If you disable or do not configure this policy setting, the dialog boxes are dis ADMX Info: -- GP English name: *Prevent Automatic Updates* +- GP Friendly name: *Prevent Automatic Updates* - GP name: *DisableAutoUpdate* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -460,7 +460,7 @@ If you disable or do not configure this policy setting, the Network tab appears ADMX Info: -- GP English name: *Hide Network Tab* +- GP Friendly name: *Hide Network Tab* - GP name: *DisableNetworkSettings* - GP path: *Windows Components\Windows Media Player\Networking* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -531,7 +531,7 @@ If you do not configure this policy setting, and the "Set and lock skin" policy ADMX Info: -- GP English name: *Do Not Show First Use Dialog Boxes* +- GP Friendly name: *Do Not Show First Use Dialog Boxes* - GP name: *DisableSetupFirstUseConfiguration* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -602,7 +602,7 @@ When this policy is not configured and the Set and Lock Skin policy is enabled, ADMX Info: -- GP English name: *Do Not Show Anchor* +- GP Friendly name: *Do Not Show Anchor* - GP name: *DoNotShowAnchor* - GP path: *Windows Components\Windows Media Player\User Interface* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -675,7 +675,7 @@ Video smoothing is available only on the Windows XP Home Edition and Windows XP ADMX Info: -- GP English name: *Prevent Video Smoothing* +- GP Friendly name: *Prevent Video Smoothing* - GP name: *DontUseFrameInterpolation* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -746,7 +746,7 @@ If you do not configure this policy setting, users can change the setting for th ADMX Info: -- GP English name: *Allow Screen Saver* +- GP Friendly name: *Allow Screen Saver* - GP name: *EnableScreenSaver* - GP path: *Windows Components\Windows Media Player\Playback* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -817,7 +817,7 @@ If you disable or do not configure this policy setting, the Privacy tab is not h ADMX Info: -- GP English name: *Prevent Automatic Updates* +- GP Friendly name: *Prevent Automatic Updates* - GP name: *HidePrivacyTab* - GP path: *Windows Components\Windows Media Player\User Interface* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -886,7 +886,7 @@ If you disable or do not configure this policy setting, users can configure the ADMX Info: -- GP English name: *Hide Security Tab* +- GP Friendly name: *Hide Security Tab* - GP name: *HideSecurityTab* - GP path: *Windows Components\Windows Media Player\User Interface* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -960,7 +960,7 @@ If you disable or do not configure this policy setting, users can change the buf ADMX Info: -- GP English name: *Configure Network Buffering* +- GP Friendly name: *Configure Network Buffering* - GP name: *NetworkBuffering* - GP path: *Windows Components\Windows Media Player\Networking* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1031,7 +1031,7 @@ If you do not configure this policy setting, users can change the setting for th ADMX Info: -- GP English name: *Prevent Codec Download* +- GP Friendly name: *Prevent Codec Download* - GP name: *PolicyCodecUpdate* - GP path: *Windows Components\Windows Media Player\Playback* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1100,7 +1100,7 @@ If you disable or do not configure this policy setting, users can change the set ADMX Info: -- GP English name: *Prevent CD and DVD Media Information Retrieval* +- GP Friendly name: *Prevent CD and DVD Media Information Retrieval* - GP name: *PreventCDDVDMetadataRetrieval* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1169,7 +1169,7 @@ If you disable or do not configure this policy setting, anyone using Windows Med ADMX Info: -- GP English name: *Prevent Media Sharing* +- GP Friendly name: *Prevent Media Sharing* - GP name: *PreventLibrarySharing* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1238,7 +1238,7 @@ If you disable or do not configure this policy setting, users can change the set ADMX Info: -- GP English name: *Prevent Music File Media Information Retrieval* +- GP Friendly name: *Prevent Music File Media Information Retrieval* - GP name: *PreventMusicFileMetadataRetrieval* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1307,7 +1307,7 @@ If you disable or do not configure this policy setting, the user can choose whet ADMX Info: -- GP English name: *Prevent Quick Launch Toolbar Shortcut Creation* +- GP Friendly name: *Prevent Quick Launch Toolbar Shortcut Creation* - GP name: *PreventQuickLaunchShortcut* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1375,7 +1375,7 @@ If you disable or do not configure this policy setting, the Player automatically ADMX Info: -- GP English name: *PPrevent Radio Station Preset Retrieval* +- GP Friendly name: *PPrevent Radio Station Preset Retrieval* - GP name: *PreventRadioPresetsRetrieval* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1444,7 +1444,7 @@ If you disable or do not configure this policy setting, users can choose whether ADMX Info: -- GP English name: *Prevent Desktop Shortcut Creation* +- GP Friendly name: *Prevent Desktop Shortcut Creation* - GP name: *PreventWMPDeskTopShortcut* - GP path: *Windows Components\Windows Media Player* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1517,7 +1517,7 @@ If you disable or do not configure this policy setting, users can display the Pl ADMX Info: -- GP English name: *Set and Lock Skin* +- GP Friendly name: *Set and Lock Skin* - GP name: *SkinLockDown* - GP path: *Windows Components\Windows Media Player\User Interface* - GP ADMX file name: *WindowsMediaPlayer.admx* @@ -1590,7 +1590,7 @@ If you disable this policy setting, the Protocols for MMS URLs and Multicast str ADMX Info: -- GP English name: *Streaming Media Protocols* +- GP Friendly name: *Streaming Media Protocols* - GP name: *WindowsStreamingMediaProtocols* - GP path: *Windows Components\Windows Media Player\Networking* - GP ADMX file name: *WindowsMediaPlayer.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md index 89752639b2..71e5c8b5aa 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsremotemanagement.md @@ -91,7 +91,7 @@ If you enable this policy setting, the WinRM service does not accept Kerberos cr ADMX Info: -- GP English name: *Disallow Kerberos authentication* +- GP Friendly name: *Disallow Kerberos authentication* - GP name: *DisallowKerberos_1* - GP path: *Windows Components\Windows Remote Management (WinRM)\WinRM Service* - GP ADMX file name: *WindowsRemoteManagement.admx* @@ -161,7 +161,7 @@ If you disable or do not configure this policy setting, the WinRM client uses th ADMX Info: -- GP English name: *Disallow Kerberos authentication* +- GP Friendly name: *Disallow Kerberos authentication* - GP name: *DisallowKerberos_2* - GP path: *Windows Components\Windows Remote Management (WinRM)\WinRM Client* - GP ADMX file name: *WindowsRemoteManagement.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-windowsstore.md b/windows/client-management/mdm/policy-csp-admx-windowsstore.md index ce460a7d15..815572c120 100644 --- a/windows/client-management/mdm/policy-csp-admx-windowsstore.md +++ b/windows/client-management/mdm/policy-csp-admx-windowsstore.md @@ -102,7 +102,7 @@ If you don't configure this setting, the automatic download of app updates is de ADMX Info: -- GP English name: *Turn off Automatic Download of updates on Win8 machines* +- GP Friendly name: *Turn off Automatic Download of updates on Win8 machines* - GP name: *DisableAutoDownloadWin8* - GP path: *Windows Components\Store* - GP ADMX file name: *WindowsStore.admx* @@ -173,7 +173,7 @@ If you disable or do not configure this setting the Store application will offer ADMX Info: -- GP English name: *Turn off the offer to update to the latest version of Windows* +- GP Friendly name: *Turn off the offer to update to the latest version of Windows* - GP name: *DisableOSUpgrade_1* - GP path: *Windows Components\Store* - GP ADMX file name: *WindowsStore.admx* @@ -244,7 +244,7 @@ If you disable or do not configure this setting the Store application will offer ADMX Info: -- GP English name: *Turn off the offer to update to the latest version of Windows* +- GP Friendly name: *Turn off the offer to update to the latest version of Windows* - GP name: *DisableOSUpgrade_2* - GP path: *Windows Components\Store* - GP ADMX file name: *WindowsStore.admx* @@ -315,7 +315,7 @@ If you disable or don't configure this setting, access to the Store application ADMX Info: -- GP English name: *Turn off the Store application* +- GP Friendly name: *Turn off the Store application* - GP name: *RemoveWindowsStore_1* - GP path: *Windows Components\Store* - GP ADMX file name: *WindowsStore.admx* @@ -386,7 +386,7 @@ If you disable or don't configure this setting, access to the Store application ADMX Info: -- GP English name: *Turn off the Store application* +- GP Friendly name: *Turn off the Store application* - GP name: *RemoveWindowsStore_2* - GP path: *Windows Components\Store* - GP ADMX file name: *WindowsStore.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-wininit.md b/windows/client-management/mdm/policy-csp-admx-wininit.md index 29981fc6c6..bff41ec699 100644 --- a/windows/client-management/mdm/policy-csp-admx-wininit.md +++ b/windows/client-management/mdm/policy-csp-admx-wininit.md @@ -96,7 +96,7 @@ If you disable or do not configure this policy setting, the system creates the n ADMX Info: -- GP English name: *Turn off legacy remote shutdown interface* +- GP Friendly name: *Turn off legacy remote shutdown interface* - GP name: *DisableNamedPipeShutdownPolicyDescription* - GP path: *Windows Components\Shutdown Options* - GP ADMX file name: *WinInit.admx* @@ -165,7 +165,7 @@ If you disable or do not configure this policy setting, the local setting is use ADMX Info: -- GP English name: *Require use of fast startup* +- GP Friendly name: *Require use of fast startup* - GP name: *Hiberboot* - GP path: *System\Shutdown* - GP ADMX file name: *WinInit.admx* @@ -234,7 +234,7 @@ If you disable or do not configure this policy setting, the default timeout valu ADMX Info: -- GP English name: *Timeout for hung logon sessions during shutdown* +- GP Friendly name: *Timeout for hung logon sessions during shutdown* - GP name: *ShutdownTimeoutHungSessionsDescription* - GP path: *Windows Components\Shutdown Options* - GP ADMX file name: *WinInit.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-winlogon.md b/windows/client-management/mdm/policy-csp-admx-winlogon.md index 1867096ce5..357f16b165 100644 --- a/windows/client-management/mdm/policy-csp-admx-winlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-winlogon.md @@ -108,7 +108,7 @@ If you disable this setting or do not configure it, the setting is ignored and t ADMX Info: -- GP English name: *Custom User Interface* +- GP Friendly name: *Custom User Interface* - GP name: *CustomShell* - GP path: *System* - GP ADMX file name: *WinLogon.admx* @@ -179,7 +179,7 @@ If you disable or do not configure this setting, messages about the previous log ADMX Info: -- GP English name: *Display information about previous logons during user logon* +- GP Friendly name: *Display information about previous logons during user logon* - GP name: *DisplayLastLogonInfoDescription* - GP path: *Windows Components\Windows Logon Options* - GP ADMX file name: *WinLogon.admx* @@ -252,7 +252,7 @@ If you disable or do not configure this setting, users receive warnings before t ADMX Info: -- GP English name: *Remove logon hours expiration warnings* +- GP Friendly name: *Remove logon hours expiration warnings* - GP name: *LogonHoursNotificationPolicyDescription* - GP path: *Windows Components\Windows Logon Options* - GP ADMX file name: *WinLogon.admx* @@ -326,7 +326,7 @@ If you disable or do not configure this setting, the system takes no action when ADMX Info: -- GP English name: *Set action to take when logon hours expire* +- GP Friendly name: *Set action to take when logon hours expire* - GP name: *LogonHoursPolicyDescription* - GP path: *Windows Components\Windows Logon Options* - GP ADMX file name: *WinLogon.admx* @@ -396,7 +396,7 @@ If disabled or not configured, no popup will be displayed to the user. ADMX Info: -- GP English name: *Report when logon server was not available during user logon* +- GP Friendly name: *Report when logon server was not available during user logon* - GP name: *ReportCachedLogonPolicyDescription* - GP path: *Windows Components\Windows Logon Options* - GP ADMX file name: *WinLogon.admx* @@ -470,7 +470,7 @@ If you disable or do not configure this setting, only Ease of Access application ADMX Info: -- GP English name: *Disable or enable software Secure Attention Sequence* +- GP Friendly name: *Disable or enable software Secure Attention Sequence* - GP name: *SoftwareSASGeneration* - GP path: *Windows Components\Windows Logon Options* - GP ADMX file name: *WinLogon.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-winsrv.md b/windows/client-management/mdm/policy-csp-admx-winsrv.md index afef9cf403..30d6f460e5 100644 --- a/windows/client-management/mdm/policy-csp-admx-winsrv.md +++ b/windows/client-management/mdm/policy-csp-admx-winsrv.md @@ -94,7 +94,7 @@ By default, such applications are automatically terminated if they attempt to ca ADMX Info: -- GP English name: *Turn off automatic termination of applications that block or cancel shutdown* +- GP Friendly name: *Turn off automatic termination of applications that block or cancel shutdown* - GP name: *AllowBlockingAppsAtShutdown* - GP path: *System\Shutdown Options* - GP ADMX file name: *Winsrv.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-wlansvc.md b/windows/client-management/mdm/policy-csp-admx-wlansvc.md index 8dc6686b17..83fdd75390 100644 --- a/windows/client-management/mdm/policy-csp-admx-wlansvc.md +++ b/windows/client-management/mdm/policy-csp-admx-wlansvc.md @@ -98,7 +98,7 @@ If this policy setting is enabled, a drop-down list box presenting possible cost ADMX Info: -- GP English name: *Set Cost* +- GP Friendly name: *Set Cost* - GP name: *IncludeCmdLine* - GP path: *Network\WLAN Service\WLAN Media Cost* - GP ADMX file name: *wlansvc.admx* @@ -167,7 +167,7 @@ If this policy setting is disabled or is not configured, by default Push Button ADMX Info: -- GP English name: *Require PIN pairing* +- GP Friendly name: *Require PIN pairing* - GP name: *SetPINEnforced* - GP path: *Network\Wireless Display* - GP ADMX file name: *wlansvc.admx* @@ -236,7 +236,7 @@ If this policy setting is disabled or is not configured, by default Push Button ADMX Info: -- GP English name: *Prefer PIN pairing* +- GP Friendly name: *Prefer PIN pairing* - GP name: *SetPINPreferred* - GP path: *Network\Wireless Display* - GP ADMX file name: *wlansvc.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-wpn.md b/windows/client-management/mdm/policy-csp-admx-wpn.md index 99ac55e97e..6538f66279 100644 --- a/windows/client-management/mdm/policy-csp-admx-wpn.md +++ b/windows/client-management/mdm/policy-csp-admx-wpn.md @@ -107,7 +107,7 @@ If you do not configure this policy setting, voice and video calls will be allow ADMX Info: -- GP English name: *Turn off calls during Quiet Hours* +- GP Friendly name: *Turn off calls during Quiet Hours* - GP name: *NoCallsDuringQuietHours* - GP path: *Start Menu and Taskbar\Notifications* - GP ADMX file name: *WPN.admx* @@ -178,7 +178,7 @@ No reboots or service restarts are required for this policy setting to take effe ADMX Info: -- GP English name: *Turn off toast notifications on the lock screen* +- GP Friendly name: *Turn off toast notifications on the lock screen* - GP name: *NoLockScreenToastNotification* - GP path: *Start Menu and Taskbar\Notifications* - GP ADMX file name: *WPN.admx* @@ -249,7 +249,7 @@ If you do not configure this policy setting, Quiet Hours are enabled by default ADMX Info: -- GP English name: *Turn off Quiet Hours* +- GP Friendly name: *Turn off Quiet Hours* - GP name: *NoQuietHours* - GP path: *Start Menu and Taskbar\Notifications* - GP ADMX file name: *WPN.admx* @@ -324,7 +324,7 @@ No reboots or service restarts are required for this policy setting to take effe ADMX Info: -- GP English name: *Turn off toast notifications* +- GP Friendly name: *Turn off toast notifications* - GP name: *NoToastNotification* - GP path: *Start Menu and Taskbar\Notifications* - GP ADMX file name: *WPN.admx* @@ -395,7 +395,7 @@ If you do not configure this policy setting, a default value will be used, which ADMX Info: -- GP English name: *Set the time Quiet Hours begins each day* +- GP Friendly name: *Set the time Quiet Hours begins each day* - GP name: *QuietHoursDailyBeginMinute* - GP path: *Start Menu and Taskbar\Notifications* - GP ADMX file name: *WPN.admx* @@ -466,7 +466,7 @@ If you do not configure this policy setting, a default value will be used, which ADMX Info: -- GP English name: *Set the time Quiet Hours ends each day* +- GP Friendly name: *Set the time Quiet Hours ends each day* - GP name: *QuietHoursDailyEndMinute* - GP path: *Start Menu and Taskbar\Notifications* - GP ADMX file name: *WPN.admx* diff --git a/windows/client-management/mdm/policy-csp-applicationdefaults.md b/windows/client-management/mdm/policy-csp-applicationdefaults.md index eb4a7086d1..87aec967af 100644 --- a/windows/client-management/mdm/policy-csp-applicationdefaults.md +++ b/windows/client-management/mdm/policy-csp-applicationdefaults.md @@ -84,7 +84,7 @@ If policy is enabled and the client machine is Azure Active Directory joined, th ADMX Info: -- GP English name: *Set a default associations configuration file* +- GP Friendly name: *Set a default associations configuration file* - GP name: *DefaultAssociationsConfiguration* - GP element: *DefaultAssociationsConfiguration_TextBox* - GP path: *File Explorer* @@ -204,7 +204,7 @@ If you do not configure this policy setting, the default behavior depends on the ADMX Info: -- GP English name: *Configure web-to-app linking with app URI handlers* +- GP Friendly name: *Configure web-to-app linking with app URI handlers* - GP name: *EnableAppUriHandlers* - GP path: *System/Group Policy* - GP ADMX file name: *GroupPolicy.admx* diff --git a/windows/client-management/mdm/policy-csp-applicationmanagement.md b/windows/client-management/mdm/policy-csp-applicationmanagement.md index 9bbbdcc162..983dc1cc33 100644 --- a/windows/client-management/mdm/policy-csp-applicationmanagement.md +++ b/windows/client-management/mdm/policy-csp-applicationmanagement.md @@ -118,7 +118,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow all trusted apps to install* +- GP Friendly name: *Allow all trusted apps to install* - GP name: *AppxDeploymentAllowAllTrustedApps* - GP path: *Windows Components/App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* @@ -188,7 +188,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Turn off Automatic Download and Install of updates* +- GP Friendly name: *Turn off Automatic Download and Install of updates* - GP name: *DisableAutoInstall* - GP path: *Windows Components/Store* - GP ADMX file name: *WindowsStore.admx* @@ -256,7 +256,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allows development of Windows Store apps and installing them from an integrated development environment (IDE)* +- GP Friendly name: *Allows development of Windows Store apps and installing them from an integrated development environment (IDE)* - GP name: *AllowDevelopmentWithoutDevLicense* - GP path: *Windows Components/App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* @@ -328,7 +328,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Enables or disables Windows Game Recording and Broadcasting* +- GP Friendly name: *Enables or disables Windows Game Recording and Broadcasting* - GP name: *AllowGameDVR* - GP path: *Windows Components/Windows Game Recording and Broadcasting* - GP ADMX file name: *GameDVR.admx* @@ -395,7 +395,7 @@ The following list shows the supported values: ADMX Info: -- GP English name: *Allow a Windows app to share application data between users* +- GP Friendly name: *Allow a Windows app to share application data between users* - GP name: *AllowSharedLocalAppData* - GP path: *Windows Components/App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* @@ -469,7 +469,7 @@ If you disable or do not configure this policy, all users will be able to initia ADMX Info: -- GP English name: *Prevent non-admin users from installing packaged Windows apps* +- GP Friendly name: *Prevent non-admin users from installing packaged Windows apps* - GP name: *BlockNonAdminUserInstall* - GP path: *Windows Components/App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* @@ -539,7 +539,7 @@ Added in Windows 10, version 1607. Boolean value that disables the launch of al ADMX Info: -- GP English name: *Disable all apps from Microsoft Store* +- GP Friendly name: *Disable all apps from Microsoft Store* - GP name: *DisableStoreApps* - GP path: *Windows Components/Store* - GP ADMX file name: *WindowsStore.admx* @@ -684,7 +684,7 @@ This policy setting is designed for less restrictive environments. It can be use ADMX Info: -- GP English name: *Allow user control over installs* +- GP Friendly name: *Allow user control over installs* - GP name: *EnableUserControl* - GP path: *Windows Components/Windows Installer* - GP ADMX file name: *MSI.admx* @@ -756,7 +756,7 @@ Caution: Skilled users can take advantage of the permissions this policy setting ADMX Info: -- GP English name: *Always install with elevated privileges* +- GP Friendly name: *Always install with elevated privileges* - GP name: *AlwaysInstallElevated* - GP path: *Windows Components/Windows Installer* - GP ADMX file name: *MSI.admx* @@ -823,7 +823,7 @@ Most restricted value is 1. ADMX Info: -- GP English name: *Only display the private store within the Microsoft Store* +- GP Friendly name: *Only display the private store within the Microsoft Store* - GP name: *RequirePrivateStoreOnly* - GP path: *Windows Components/Store* - GP ADMX file name: *WindowsStore.admx* @@ -891,7 +891,7 @@ Most restricted value is 1. ADMX Info: -- GP English name: *Prevent users' app data from being stored on non-system volumes* +- GP Friendly name: *Prevent users' app data from being stored on non-system volumes* - GP name: *RestrictAppDataToSystemVolume* - GP path: *Windows Components/App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* @@ -959,7 +959,7 @@ Most restricted value is 1. ADMX Info: -- GP English name: *Disable installing Windows apps on non-system volumes* +- GP Friendly name: *Disable installing Windows apps on non-system volumes* - GP name: *DisableDeploymentToNonSystemVolumes* - GP path: *Windows Components/App Package Deployment* - GP ADMX file name: *AppxPackageManager.admx* diff --git a/windows/client-management/mdm/policy-csp-appruntime.md b/windows/client-management/mdm/policy-csp-appruntime.md index 2a224f8bfe..5985ed58aa 100644 --- a/windows/client-management/mdm/policy-csp-appruntime.md +++ b/windows/client-management/mdm/policy-csp-appruntime.md @@ -90,7 +90,7 @@ If you disable or do not configure this policy setting, users will need to sign ADMX Info: -- GP English name: *Allow Microsoft accounts to be optional* +- GP Friendly name: *Allow Microsoft accounts to be optional* - GP name: *AppxRuntimeMicrosoftAccountsOptional* - GP path: *Windows Components/App runtime* - GP ADMX file name: *AppXRuntime.admx* diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index 63cdb4036d..08865e0dd4 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -167,7 +167,7 @@ This policy setting allows you to enable or disable Microsoft Application Virtua ADMX Info: -- GP English name: *Enable App-V Client* +- GP Friendly name: *Enable App-V Client* - GP name: *EnableAppV* - GP path: *System/App-V* - GP ADMX file name: *appv.admx* @@ -233,7 +233,7 @@ Enables Dynamic Virtualization of supported shell extensions, browser helper obj ADMX Info: -- GP English name: *Enable Dynamic Virtualization* +- GP Friendly name: *Enable Dynamic Virtualization* - GP name: *Virtualization_JITVEnable* - GP path: *System/App-V/Virtualization* - GP ADMX file name: *appv.admx* @@ -299,7 +299,7 @@ Enables automatic cleanup of appv packages that were added after Windows10 anniv ADMX Info: -- GP English name: *Enable automatic cleanup of unused appv packages* +- GP Friendly name: *Enable automatic cleanup of unused appv packages* - GP name: *PackageManagement_AutoCleanupEnable* - GP path: *System/App-V/PackageManagement* - GP ADMX file name: *appv.admx* @@ -365,7 +365,7 @@ Enables scripts defined in the package manifest of configuration files that shou ADMX Info: -- GP English name: *Enable Package Scripts* +- GP Friendly name: *Enable Package Scripts* - GP name: *Scripting_Enable_Package_Scripts* - GP path: *System/App-V/Scripting* - GP ADMX file name: *appv.admx* @@ -431,7 +431,7 @@ Enables a UX to display to the user when a publishing refresh is performed on th ADMX Info: -- GP English name: *Enable Publishing Refresh UX* +- GP Friendly name: *Enable Publishing Refresh UX* - GP name: *Enable_Publishing_Refresh_UX* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -507,7 +507,7 @@ Data Block Size: This value specifies the maximum size in bytes to transmit to t ADMX Info: -- GP English name: *Reporting Server* +- GP Friendly name: *Reporting Server* - GP name: *Reporting_Server_Policy* - GP path: *System/App-V/Reporting* - GP ADMX file name: *appv.admx* @@ -573,7 +573,7 @@ Specifies the file paths relative to %userprofile% that do not roam with a user' ADMX Info: -- GP English name: *Roaming File Exclusions* +- GP Friendly name: *Roaming File Exclusions* - GP name: *Integration_Roaming_File_Exclusions* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -639,7 +639,7 @@ Specifies the registry paths that do not roam with a user profile. Example usage ADMX Info: -- GP English name: *Roaming Registry Exclusions* +- GP Friendly name: *Roaming Registry Exclusions* - GP name: *Integration_Roaming_Registry_Exclusions* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -705,7 +705,7 @@ Specifies how new packages should be loaded automatically by App-V on a specific ADMX Info: -- GP English name: *Specify what to load in background (aka AutoLoad)* +- GP Friendly name: *Specify what to load in background (aka AutoLoad)* - GP name: *Steaming_Autoload* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -771,7 +771,7 @@ Migration mode allows the App-V client to modify shortcuts and FTA's for package ADMX Info: -- GP English name: *Enable Migration Mode* +- GP Friendly name: *Enable Migration Mode* - GP name: *Client_Coexistence_Enable_Migration_mode* - GP path: *System/App-V/Client Coexistence* - GP ADMX file name: *appv.admx* @@ -837,7 +837,7 @@ Specifies the location where symbolic links are created to the current version o ADMX Info: -- GP English name: *Integration Root User* +- GP Friendly name: *Integration Root User* - GP name: *Integration_Root_User* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -903,7 +903,7 @@ Specifies the location where symbolic links are created to the current version o ADMX Info: -- GP English name: *Integration Root Global* +- GP Friendly name: *Integration Root Global* - GP name: *Integration_Root_Global* - GP path: *System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -987,7 +987,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: -- GP English name: *Publishing Server 1 Settings* +- GP Friendly name: *Publishing Server 1 Settings* - GP name: *Publishing_Server1_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -1071,7 +1071,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: -- GP English name: *Publishing Server 2 Settings* +- GP Friendly name: *Publishing Server 2 Settings* - GP name: *Publishing_Server2_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -1155,7 +1155,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: -- GP English name: *Publishing Server 3 Settings* +- GP Friendly name: *Publishing Server 3 Settings* - GP name: *Publishing_Server3_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -1239,7 +1239,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: -- GP English name: *Publishing Server 4 Settings* +- GP Friendly name: *Publishing Server 4 Settings* - GP name: *Publishing_Server4_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -1323,7 +1323,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: -- GP English name: *Publishing Server 5 Settings* +- GP Friendly name: *Publishing Server 5 Settings* - GP name: *Publishing_Server5_Policy* - GP path: *System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -1389,7 +1389,7 @@ Specifies the path to a valid certificate in the certificate store. ADMX Info: -- GP English name: *Certificate Filter For Client SSL* +- GP Friendly name: *Certificate Filter For Client SSL* - GP name: *Streaming_Certificate_Filter_For_Client_SSL* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1455,7 +1455,7 @@ This setting controls whether virtualized applications are launched on Windows 8 ADMX Info: -- GP English name: *Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection* +- GP Friendly name: *Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection* - GP name: *Streaming_Allow_High_Cost_Launch* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1521,7 +1521,7 @@ Specifies the CLSID for a compatible implementation of the IAppvPackageLocationP ADMX Info: -- GP English name: *Location Provider* +- GP Friendly name: *Location Provider* - GP name: *Streaming_Location_Provider* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1587,7 +1587,7 @@ Specifies directory where all new applications and updates will be installed. ADMX Info: -- GP English name: *Package Installation Root* +- GP Friendly name: *Package Installation Root* - GP name: *Streaming_Package_Installation_Root* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1653,7 +1653,7 @@ Overrides source location for downloading package content. ADMX Info: -- GP English name: *Package Source Root* +- GP Friendly name: *Package Source Root* - GP name: *Streaming_Package_Source_Root* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1719,7 +1719,7 @@ Specifies the number of seconds between attempts to reestablish a dropped sessio ADMX Info: -- GP English name: *Reestablishment Interval* +- GP Friendly name: *Reestablishment Interval* - GP name: *Streaming_Reestablishment_Interval* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1785,7 +1785,7 @@ Specifies the number of times to retry a dropped session. ADMX Info: -- GP English name: *Reestablishment Retries* +- GP Friendly name: *Reestablishment Retries* - GP name: *Streaming_Reestablishment_Retries* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1851,7 +1851,7 @@ Specifies that streamed package contents will be not be saved to the local hard ADMX Info: -- GP English name: *Shared Content Store (SCS) mode* +- GP Friendly name: *Shared Content Store (SCS) mode* - GP name: *Streaming_Shared_Content_Store_Mode* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1917,7 +1917,7 @@ If enabled, the App-V client will support BrancheCache compatible HTTP streaming ADMX Info: -- GP English name: *Enable Support for BranchCache* +- GP Friendly name: *Enable Support for BranchCache* - GP name: *Streaming_Support_Branch_Cache* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1983,7 +1983,7 @@ Verifies Server certificate revocation status before streaming using HTTPS. ADMX Info: -- GP English name: *Verify certificate revocation list* +- GP Friendly name: *Verify certificate revocation list* - GP name: *Streaming_Verify_Certificate_Revocation_List* - GP path: *System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -2049,7 +2049,7 @@ Specifies a list of process paths (may contain wildcards) which are candidates f ADMX Info: -- GP English name: *Virtual Component Process Allow List* +- GP Friendly name: *Virtual Component Process Allow List* - GP name: *Virtualization_JITVAllowList* - GP path: *System/App-V/Virtualization* - GP ADMX file name: *appv.admx* diff --git a/windows/client-management/mdm/policy-csp-attachmentmanager.md b/windows/client-management/mdm/policy-csp-attachmentmanager.md index e808f11e13..aa15e81d84 100644 --- a/windows/client-management/mdm/policy-csp-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-attachmentmanager.md @@ -98,7 +98,7 @@ If you do not configure this policy setting, Windows marks file attachments with ADMX Info: -- GP English name: *Do not preserve zone information in file attachments* +- GP Friendly name: *Do not preserve zone information in file attachments* - GP name: *AM_MarkZoneOnSavedAtttachments* - GP path: *Windows Components/Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* @@ -170,7 +170,7 @@ If you do not configure this policy setting, Windows hides the check box and Unb ADMX Info: -- GP English name: *Hide mechanisms to remove zone information* +- GP Friendly name: *Hide mechanisms to remove zone information* - GP name: *AM_RemoveZoneInfo* - GP path: *Windows Components/Attachment Manager* - GP ADMX file name: *AttachmentManager.admx* diff --git a/windows/client-management/mdm/policy-csp-audit.md b/windows/client-management/mdm/policy-csp-audit.md index 73c539f766..5d063b5378 100644 --- a/windows/client-management/mdm/policy-csp-audit.md +++ b/windows/client-management/mdm/policy-csp-audit.md @@ -255,7 +255,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Account Lockout* +- GP Friendly name: *Audit Account Lockout* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -329,7 +329,7 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser GP Info: -- GP English name: *Audit Group Membership* +- GP Friendly name: *Audit Group Membership* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -405,7 +405,7 @@ Volume: High. GP Info: -- GP English name: *Audit IPsec Extended Mode* +- GP Friendly name: *Audit IPsec Extended Mode* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -480,7 +480,7 @@ Volume: High. GP Info: -- GP English name: *Audit IPsec Main Mode* +- GP Friendly name: *Audit IPsec Main Mode* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -554,7 +554,7 @@ Volume: High. GP Info: -- GP English name: *Audit IPsec Quick Mode* +- GP Friendly name: *Audit IPsec Quick Mode* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -629,7 +629,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Logoff* +- GP Friendly name: *Audit Logoff* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -707,7 +707,7 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser GP Info: -- GP English name: *Audit Logon* +- GP Friendly name: *Audit Logon* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -781,7 +781,7 @@ Volume: Medium or High on NPS and IAS server. No volume on other computers. GP Info: -- GP English name: *Audit Network Policy Server* +- GP Friendly name: *Audit Network Policy Server* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -861,7 +861,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Other Logon Logoff Events* +- GP Friendly name: *Audit Other Logon Logoff Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -935,7 +935,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Special Logon* +- GP Friendly name: *Audit Special Logon* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -1011,7 +1011,7 @@ Volume: Low on a client computer. Medium on a domain controller or a network ser GP Info: -- GP English name: *Audit User Device Claims* +- GP Friendly name: *Audit User Device Claims* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Logon/Logoff* @@ -1085,7 +1085,7 @@ Volume: High on domain controllers. GP Info: -- GP English name: *Audit Credential Validation* +- GP Friendly name: *Audit Credential Validation* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* @@ -1160,7 +1160,7 @@ Volume: High on Kerberos Key Distribution Center servers. GP Info: -- GP English name: *Audit Kerberos Authentication Service* +- GP Friendly name: *Audit Kerberos Authentication Service* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* @@ -1235,7 +1235,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Kerberos Service Ticket Operations* +- GP Friendly name: *Audit Kerberos Service Ticket Operations* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* @@ -1308,7 +1308,7 @@ Currently, there are no events in this subcategory. GP Info: -- GP English name: *Audit Other Account Logon Events* +- GP Friendly name: *Audit Other Account Logon Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Logon* @@ -1385,7 +1385,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Application Group Management* +- GP Friendly name: *Audit Application Group Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -1460,7 +1460,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Computer Account Management* +- GP Friendly name: *Audit Computer Account Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -1541,7 +1541,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Distribution Group Management* +- GP Friendly name: *Audit Distribution Group Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -1621,7 +1621,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Other Account Management Events* +- GP Friendly name: *Audit Other Account Management Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -1699,7 +1699,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Security Group Management* +- GP Friendly name: *Audit Security Group Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -1781,7 +1781,7 @@ Volume: Low. GP Info: -- GP English name: *Audit User Account Management* +- GP Friendly name: *Audit User Account Management* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Account Management* @@ -1854,7 +1854,7 @@ Volume: High. GP Info: -- GP English name: *Audit Detailed Directory Service Replication* +- GP Friendly name: *Audit Detailed Directory Service Replication* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* @@ -1930,7 +1930,7 @@ Volume: High on domain controllers. None on client computers. GP Info: -- GP English name: *Audit Directory Service Access* +- GP Friendly name: *Audit Directory Service Access* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* @@ -2012,7 +2012,7 @@ Volume: High on domain controllers only. GP Info: -- GP English name: *Audit Directory Service Changes* +- GP Friendly name: *Audit Directory Service Changes* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* @@ -2090,7 +2090,7 @@ Volume: Medium on domain controllers. None on client computers. GP Info: -- GP English name: *Audit Directory Service Replication* +- GP Friendly name: *Audit Directory Service Replication* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/DS Access* @@ -2165,7 +2165,7 @@ Volume: Low. GP Info: -- GP English name: *Audit DPAPI Activity* +- GP Friendly name: *Audit DPAPI Activity* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* @@ -2239,7 +2239,7 @@ Volume: Low. GP Info: -- GP English name: *Audit PNP Activity* +- GP Friendly name: *Audit PNP Activity* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* @@ -2313,7 +2313,7 @@ Volume: Depends on how the computer is used. GP Info: -- GP English name: *Audit Process Creation* +- GP Friendly name: *Audit Process Creation* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* @@ -2387,7 +2387,7 @@ Volume: Depends on how the computer is used. GP Info: -- GP English name: *Audit Process Termination* +- GP Friendly name: *Audit Process Termination* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* @@ -2461,7 +2461,7 @@ Volume: High on RPC servers. GP Info: -- GP English name: *Audit RPC Events* +- GP Friendly name: *Audit RPC Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* @@ -2532,7 +2532,7 @@ Volume: High. GP Info: -- GP English name: *Audit Token Right Adjusted* +- GP Friendly name: *Audit Token Right Adjusted* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Detailed Tracking* @@ -2609,7 +2609,7 @@ Volume: Depends on the applications that are generating them. GP Info: -- GP English name: *Audit Application Generated* +- GP Friendly name: *Audit Application Generated* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -2687,7 +2687,7 @@ Volume: Potentially high on a file server when the proposed policy differs signi GP Info: -- GP English name: *Audit Central Access Policy Staging* +- GP Friendly name: *Audit Central Access Policy Staging* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -2777,7 +2777,7 @@ Volume: Medium or Low on computers running Active Directory Certificate Services GP Info: -- GP English name: *Audit Certification Services* +- GP Friendly name: *Audit Certification Services* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -2853,7 +2853,7 @@ Volume: High on a file server or domain controller because of SYSVOL network acc GP Info: -- GP English name: *Audit Detailed File Share* +- GP Friendly name: *Audit Detailed File Share* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -2929,7 +2929,7 @@ Volume: High on a file server or domain controller because of SYSVOL network acc GP Info: -- GP English name: *Audit File Share* +- GP Friendly name: *Audit File Share* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3006,7 +3006,7 @@ Volume: Depends on how the file system SACLs are configured. GP Info: -- GP English name: *Audit File System* +- GP Friendly name: *Audit File System* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3091,7 +3091,7 @@ Volume: High. GP Info: -- GP English name: *Audit Filtering Platform Connection* +- GP Friendly name: *Audit Filtering Platform Connection* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3163,7 +3163,7 @@ Volume: High. GP Info: -- GP English name: *Audit Filtering Platform Packet Drop* +- GP Friendly name: *Audit Filtering Platform Packet Drop* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3240,7 +3240,7 @@ Volume: Depends on how SACLs are configured. GP Info: -- GP English name: *Audit Handle Manipulation* +- GP Friendly name: *Audit Handle Manipulation* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3315,7 +3315,7 @@ Volume: High if auditing access of global system objects is enabled. GP Info: -- GP English name: *Audit Kernel Object* +- GP Friendly name: *Audit Kernel Object* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3397,7 +3397,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Other Object Access Events* +- GP Friendly name: *Audit Other Object Access Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3474,7 +3474,7 @@ Volume: Depends on how registry SACLs are configured. GP Info: -- GP English name: *Audit Registry* +- GP Friendly name: *Audit Registry* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3548,7 +3548,7 @@ If you do not configure this policy setting, no audit event is generated when an GP Info: -- GP English name: *Audit Removable Storage* +- GP Friendly name: *Audit Removable Storage* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3632,7 +3632,7 @@ Volume: High on domain controllers. For information about reducing the amount of GP Info: -- GP English name: *Audit SAM* +- GP Friendly name: *Audit SAM* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Object Access* @@ -3720,7 +3720,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Authentication Policy Change* +- GP Friendly name: *Audit Authentication Policy Change* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* @@ -3800,7 +3800,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Authorization Policy Change* +- GP Friendly name: *Audit Authorization Policy Change* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* @@ -3879,7 +3879,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Filtering Platform Policy Change* +- GP Friendly name: *Audit Filtering Platform Policy Change* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* @@ -3961,7 +3961,7 @@ Volume: Low. GP Info: -- GP English name: *Audit MPSSVC Rule Level Policy Change* +- GP Friendly name: *Audit MPSSVC Rule Level Policy Change* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* @@ -4039,7 +4039,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Other Policy Change Events* +- GP Friendly name: *Audit Other Policy Change Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* @@ -4122,7 +4122,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Policy Change* +- GP Friendly name: *Audit Policy Change* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Policy Change* @@ -4228,7 +4228,7 @@ Volume: Very High. GP Info: -- GP English name: *Audit Non Sensitive Privilege Use* +- GP Friendly name: *Audit Non Sensitive Privilege Use* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* @@ -4298,7 +4298,7 @@ Not used. GP Info: -- GP English name: *Audit Other Privilege Use Events* +- GP Friendly name: *Audit Other Privilege Use Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* @@ -4387,7 +4387,7 @@ Volume: High. GP Info: -- GP English name: *Audit Sensitive Privilege Use* +- GP Friendly name: *Audit Sensitive Privilege Use* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/Privilege Use* @@ -4467,7 +4467,7 @@ Volume: Low. GP Info: -- GP English name: *Audit IPsec Driver* +- GP Friendly name: *Audit IPsec Driver* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* @@ -4542,7 +4542,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Other System Events* +- GP Friendly name: *Audit Other System Events* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* @@ -4617,7 +4617,7 @@ Volume: Low. GP Info: -- GP English name: *Audit Security State Change* +- GP Friendly name: *Audit Security State Change* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* @@ -4694,7 +4694,7 @@ Volume: Low. Security system extension events are generated more often on a doma GP Info: -- GP English name: *Audit Security System Extension* +- GP Friendly name: *Audit Security System Extension* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* @@ -4771,7 +4771,7 @@ Volume: Low. GP Info: -- GP English name: *Audit System Integrity* +- GP Friendly name: *Audit System Integrity* - GP path: *Windows Settings/Security Settings/Advanced Audit Policy Configuration/System Audit Policies/System* diff --git a/windows/client-management/mdm/policy-csp-authentication.md b/windows/client-management/mdm/policy-csp-authentication.md index 1b75bd9a6b..490bc43255 100644 --- a/windows/client-management/mdm/policy-csp-authentication.md +++ b/windows/client-management/mdm/policy-csp-authentication.md @@ -344,7 +344,7 @@ In the next major release of Windows 10, the default for this policy for consume ADMX Info: -- GP English name: *Allow companion device for secondary authentication* +- GP Friendly name: *Allow companion device for secondary authentication* - GP name: *MSSecondaryAuthFactor_AllowSecondaryAuthenticationDevice* - GP path: *Windows Components/Microsoft Secondary Authentication Factor* - GP ADMX file name: *DeviceCredential.admx* diff --git a/windows/client-management/mdm/policy-csp-autoplay.md b/windows/client-management/mdm/policy-csp-autoplay.md index 15b769497e..0eca05d2bb 100644 --- a/windows/client-management/mdm/policy-csp-autoplay.md +++ b/windows/client-management/mdm/policy-csp-autoplay.md @@ -97,7 +97,7 @@ If you disable or do not configure this policy setting, AutoPlay is enabled for ADMX Info: -- GP English name: *Disallow Autoplay for non-volume devices* +- GP Friendly name: *Disallow Autoplay for non-volume devices* - GP name: *NoAutoplayfornonVolume* - GP path: *Windows Components/AutoPlay Policies* - GP ADMX file name: *AutoPlay.admx* @@ -177,7 +177,7 @@ If you disable or not configure this policy setting, Windows Vista or later will ADMX Info: -- GP English name: *Set the default behavior for AutoRun* +- GP Friendly name: *Set the default behavior for AutoRun* - GP name: *NoAutorun* - GP path: *Windows Components/AutoPlay Policies* - GP ADMX file name: *AutoPlay.admx* @@ -258,7 +258,7 @@ Note: This policy setting appears in both the Computer Configuration and User Co ADMX Info: -- GP English name: *Turn off Autoplay* +- GP Friendly name: *Turn off Autoplay* - GP name: *Autorun* - GP path: *Windows Components/AutoPlay Policies* - GP ADMX file name: *AutoPlay.admx* diff --git a/windows/client-management/mdm/policy-csp-bits.md b/windows/client-management/mdm/policy-csp-bits.md index 2bcc10ea45..02abb3111c 100644 --- a/windows/client-management/mdm/policy-csp-bits.md +++ b/windows/client-management/mdm/policy-csp-bits.md @@ -114,7 +114,7 @@ Consider using this setting to prevent BITS transfers from competing for network ADMX Info: -- GP English name: *Limit the maximum network bandwidth for BITS background transfers* +- GP Friendly name: *Limit the maximum network bandwidth for BITS background transfers* - GP name: *BITS_MaxBandwidth* - GP element: *BITS_BandwidthLimitSchedTo* - GP path: *Network/Background Intelligent Transfer Service (BITS)* @@ -197,7 +197,7 @@ Consider using this setting to prevent BITS transfers from competing for network ADMX Info: -- GP English name: *Limit the maximum network bandwidth for BITS background transfers* +- GP Friendly name: *Limit the maximum network bandwidth for BITS background transfers* - GP name: *BITS_MaxBandwidth* - GP element: *BITS_BandwidthLimitSchedFrom* - GP path: *Network/Background Intelligent Transfer Service (BITS)* @@ -280,7 +280,7 @@ Consider using this setting to prevent BITS transfers from competing for network ADMX Info: -- GP English name: *Limit the maximum network bandwidth for BITS background transfers* +- GP Friendly name: *Limit the maximum network bandwidth for BITS background transfers* - GP name: *BITS_MaxBandwidth* - GP element: *BITS_MaxTransferRateText* - GP path: *Network/Background Intelligent Transfer Service (BITS)* @@ -358,7 +358,7 @@ For example, you can specify that background jobs are by default to transfer onl ADMX Info: -- GP English name: *Set default download behavior for BITS jobs on costed networks* +- GP Friendly name: *Set default download behavior for BITS jobs on costed networks* - GP name: *BITS_SetTransferPolicyOnCostedNetwork* - GP element: *BITS_TransferPolicyNormalPriorityValue* - GP path: *Network/Background Intelligent Transfer Service (BITS)* @@ -436,7 +436,7 @@ For example, you can specify that foreground jobs are by default to transfer onl ADMX Info: -- GP English name: *Set default download behavior for BITS jobs on costed networks* +- GP Friendly name: *Set default download behavior for BITS jobs on costed networks* - GP name: *BITS_SetTransferPolicyOnCostedNetwork* - GP element: *BITS_TransferPolicyForegroundPriorityValue* - GP path: *Network/Background Intelligent Transfer Service (BITS)* @@ -517,7 +517,7 @@ If you disable or do not configure this policy setting, the default value of 90 ADMX Info: -- GP English name: *Timeout for inactive BITS jobs* +- GP Friendly name: *Timeout for inactive BITS jobs* - GP name: *BITS_Job_Timeout* - GP element: *BITS_Job_Timeout_Time* - GP path: *Network/Background Intelligent Transfer Service (BITS)* diff --git a/windows/client-management/mdm/policy-csp-browser.md b/windows/client-management/mdm/policy-csp-browser.md index ca1ff0bcbb..14cd612597 100644 --- a/windows/client-management/mdm/policy-csp-browser.md +++ b/windows/client-management/mdm/policy-csp-browser.md @@ -248,7 +248,7 @@ ms.localizationpriority: medium ADMX Info: -- GP English name: *Allow Address bar drop-down list suggestions* +- GP Friendly name: *Allow Address bar drop-down list suggestions* - GP name: *AllowAddressBarDropdown* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -317,7 +317,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure Autofill* +- GP Friendly name: *Configure Autofill* - GP name: *AllowAutofill* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -397,7 +397,7 @@ To verify AllowAutofill is set to 0 (not allowed): ADMX Info: -- GP English name: *Allow configuration updates for the Books Library* +- GP Friendly name: *Allow configuration updates for the Books Library* - GP name: *AllowConfigurationUpdateForBooksLibrary* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -464,7 +464,7 @@ Supported values: ADMX Info: -- GP English name: *Configure cookies* +- GP Friendly name: *Configure cookies* - GP name: *Cookies* - GP element: *CookiesListBox* - GP path: *Windows Components/Microsoft Edge* @@ -546,7 +546,7 @@ To verify AllowCookies is set to 0 (not allowed): ADMX Info: -- GP English name: *Allow Developer Tools* +- GP Friendly name: *Allow Developer Tools* - GP name: *AllowDeveloperTools* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -614,7 +614,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure Do Not Track* +- GP Friendly name: *Configure Do Not Track* - GP name: *AllowDoNotTrack* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -694,7 +694,7 @@ To verify AllowDoNotTrack is set to 0 (not allowed): ADMX Info: -- GP English name: *Allow Extensions* +- GP Friendly name: *Allow Extensions* - GP name: *AllowExtensions* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -763,7 +763,7 @@ Supported values: ADMX Info: -- GP English name: *Allow Adobe Flash* +- GP Friendly name: *Allow Adobe Flash* - GP name: *AllowFlash* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -833,7 +833,7 @@ Supported values: ADMX Info: -- GP English name: *Configure the Adobe Flash Click-to-Run setting* +- GP Friendly name: *Configure the Adobe Flash Click-to-Run setting* - GP name: *AllowFlashClickToRun* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -904,7 +904,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Allow FullScreen Mode* +- GP Friendly name: *Allow FullScreen Mode* - GP name: *AllowFullScreenMode* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -979,7 +979,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow InPrivate browsing* +- GP Friendly name: *Allow InPrivate browsing* - GP name: *AllowInPrivate* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1052,7 +1052,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow Microsoft Compatibility List* +- GP Friendly name: *Allow Microsoft Compatibility List* - GP name: *AllowCVList* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1122,7 +1122,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure Password Manager* +- GP Friendly name: *Configure Password Manager* - GP name: *AllowPasswordManager* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1200,7 +1200,7 @@ To verify AllowPasswordManager is set to 0 (not allowed): ADMX Info: -- GP English name: *Configure Pop-up Blocker* +- GP Friendly name: *Configure Pop-up Blocker* - GP name: *AllowPopups* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1280,7 +1280,7 @@ To verify AllowPopups is set to 0 (not allowed): ADMX Info: -- GP English name: *Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed* +- GP Friendly name: *Allow Microsoft Edge to pre-launch at Windows startup, when the system is idle, and each time Microsoft Edge is closed* - GP name: *AllowPrelaunch* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1357,7 +1357,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow printing* +- GP Friendly name: *Allow printing* - GP name: *AllowPrinting* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1434,7 +1434,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow Saving History* +- GP Friendly name: *Allow Saving History* - GP name: *AllowSavingHistory* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1515,7 +1515,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow search engine customization* +- GP Friendly name: *Allow search engine customization* - GP name: *AllowSearchEngineCustomization* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1584,7 +1584,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure search suggestions in Address bar* +- GP Friendly name: *Configure search suggestions in Address bar* - GP name: *AllowSearchSuggestionsinAddressBar* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1656,7 +1656,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow sideloading of Extensions* +- GP Friendly name: *Allow sideloading of Extensions* - GP name: *AllowSideloadingOfExtensions* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1731,7 +1731,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure Windows Defender SmartScreen* +- GP Friendly name: *Configure Windows Defender SmartScreen* - GP name: *AllowSmartScreen* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1810,7 +1810,7 @@ To verify AllowSmartScreen is set to 0 (not allowed): ADMX Info: -- GP English name: *Allow Microsoft Edge to start and load the Start and New Tab pages in the background at Windows startup and each time Microsoft Edge is closed* +- GP Friendly name: *Allow Microsoft Edge to start and load the Start and New Tab pages in the background at Windows startup and each time Microsoft Edge is closed* - GP name: *AllowTabPreloading* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1886,7 +1886,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Allow web content on New Tab page* +- GP Friendly name: *Allow web content on New Tab page* - GP name: *AllowWebContentOnNewTabPage* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -1963,7 +1963,7 @@ Supported values: ADMX Info: -- GP English name: *Always show the Books Library in Microsoft Edge* +- GP Friendly name: *Always show the Books Library in Microsoft Edge* - GP name: *AlwaysEnableBooksLibrary* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -2034,7 +2034,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow clearing browsing data on exit* +- GP Friendly name: *Allow clearing browsing data on exit* - GP name: *AllowClearingBrowsingDataOnExit* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -2118,7 +2118,7 @@ To verify that browsing data is cleared on exit (ClearBrowsingDataOnExit is set ADMX Info: -- GP English name: *Configure additional search engines* +- GP Friendly name: *Configure additional search engines* - GP name: *ConfigureAdditionalSearchEngines* - GP element: *ConfigureAdditionalSearchEngines_Prompt* - GP path: *Windows Components/Microsoft Edge* @@ -2189,7 +2189,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure Favorites Bar* +- GP Friendly name: *Configure Favorites Bar* - GP name: *ConfigureFavoritesBar* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -2265,7 +2265,7 @@ Supported values: ADMX Info: -- GP English name: *Configure Home Button* +- GP Friendly name: *Configure Home Button* - GP name: *ConfigureHomeButton* - GP element: *ConfigureHomeButtonDropdown* - GP path: *Windows Components/Microsoft Edge* @@ -2350,7 +2350,7 @@ For this policy to work, you must configure Microsoft Edge in assigned access; o ADMX Info: -- GP English name: *Configure kiosk mode* +- GP Friendly name: *Configure kiosk mode* - GP name: *ConfigureKioskMode* - GP element: *ConfigureKioskMode_TextBox* - GP path: *Windows Components/Microsoft Edge* @@ -2433,7 +2433,7 @@ You must set ConfigureKioskMode to enabled (1 - InPrivate public browsing) and c ADMX Info: -- GP English name: *Configure kiosk reset after idle timeout* +- GP Friendly name: *Configure kiosk reset after idle timeout* - GP name: *ConfigureKioskResetAfterIdleTimeout* - GP element: *ConfigureKioskResetAfterIdleTimeout_TextBox* - GP path: *Windows Components/Microsoft Edge* @@ -2516,7 +2516,7 @@ When you enable this policy and select an option, and also enter the URLs of the ADMX Info: -- GP English name: *Configure Open Microsoft Edge With* +- GP Friendly name: *Configure Open Microsoft Edge With* - GP name: *ConfigureOpenEdgeWith* - GP element: *ConfigureOpenEdgeWithListBox* - GP path: *Windows Components/Microsoft Edge* @@ -2598,7 +2598,7 @@ Supported values: ADMX Info: -- GP English name: *Configure collection of browsing data for Microsoft 365 Analytics* +- GP Friendly name: *Configure collection of browsing data for Microsoft 365 Analytics* - GP name: *ConfigureTelemetryForMicrosoft365Analytics* - GP element: *ZonesListBox* - GP path: *Data Collection and Preview Builds* @@ -2683,7 +2683,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Disable lockdown of Start pages* +- GP Friendly name: *Disable lockdown of Start pages* - GP name: *DisableLockdownOfStartPages* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -2752,7 +2752,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Allow extended telemetry for the Books tab* +- GP Friendly name: *Allow extended telemetry for the Books tab* - GP name: *EnableExtendedBooksTelemetry* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -2826,7 +2826,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Configure the Enterprise Mode Site List* +- GP Friendly name: *Configure the Enterprise Mode Site List* - GP name: *EnterpriseModeSiteList* - GP element: *EnterSiteListPrompt* - GP path: *Windows Components/Microsoft Edge* @@ -2965,7 +2965,7 @@ When you enable the Configure Open Microsoft Edge With policy and select an opti ADMX Info: -- GP English name: *Configure Start pages* +- GP Friendly name: *Configure Start pages* - GP name: *HomePages* - GP element: *HomePagesPrompt* - GP path: *Windows Components/Microsoft Edge* @@ -3036,7 +3036,7 @@ Supported values: ADMX Info: -- GP English name: *Prevent changes to Favorites on Microsoft Edge* +- GP Friendly name: *Prevent changes to Favorites on Microsoft Edge* - GP name: *LockdownFavorites* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3105,7 +3105,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent access to the about:flags page in Microsoft Edge* +- GP Friendly name: *Prevent access to the about:flags page in Microsoft Edge* - GP name: *PreventAccessToAboutFlagsInMicrosoftEdge* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3174,7 +3174,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent certificate error overrides* +- GP Friendly name: *Prevent certificate error overrides* - GP name: *PreventCertErrorOverrides* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3250,7 +3250,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent the First Run webpage from opening on Microsoft Edge* +- GP Friendly name: *Prevent the First Run webpage from opening on Microsoft Edge* - GP name: *PreventFirstRunPage* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3320,7 +3320,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start* +- GP Friendly name: *Prevent Microsoft Edge from gathering Live Tile information when pinning a site to Start* - GP name: *PreventLiveTileDataCollection* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3388,7 +3388,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent bypassing Windows Defender SmartScreen prompts for sites* +- GP Friendly name: *Prevent bypassing Windows Defender SmartScreen prompts for sites* - GP name: *PreventSmartScreenPromptOverride* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3457,7 +3457,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent bypassing Windows Defender SmartScreen prompts for files* +- GP Friendly name: *Prevent bypassing Windows Defender SmartScreen prompts for files* - GP name: *PreventSmartScreenPromptOverrideForFiles* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3525,7 +3525,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Prevent turning off required extensions* +- GP Friendly name: *Prevent turning off required extensions* - GP name: *PreventTurningOffRequiredExtensions* - GP element: *PreventTurningOffRequiredExtensions_Prompt* - GP path: *Windows Components/Microsoft Edge* @@ -3603,7 +3603,7 @@ Supported values: ADMX Info: -- GP English name: *Prevent using Localhost IP address for WebRTC* +- GP Friendly name: *Prevent using Localhost IP address for WebRTC* - GP name: *HideLocalHostIPAddress* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3688,7 +3688,7 @@ To define a default list of favorites: ADMX Info: -- GP English name: *Provision Favorites* +- GP Friendly name: *Provision Favorites* - GP name: *ConfiguredFavorites* - GP element: *ConfiguredFavoritesPrompt* - GP path: *Windows Components/Microsoft Edge* @@ -3754,7 +3754,7 @@ ADMX Info: ADMX Info: -- GP English name: *Send all intranet sites to Internet Explorer 11* +- GP Friendly name: *Send all intranet sites to Internet Explorer 11* - GP name: *SendIntranetTraffictoInternetExplorer* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -3831,7 +3831,7 @@ Most restricted value: 0 ADMX Info: -- GP English name: *Set default search engine* +- GP Friendly name: *Set default search engine* - GP name: *SetDefaultSearchEngine* - GP element: *SetDefaultSearchEngine_Prompt* - GP path: *Windows Components/Microsoft Edge* @@ -3902,7 +3902,7 @@ Most restricted value: 1 ADMX Info: -- GP English name: *Set Home Button URL* +- GP Friendly name: *Set Home Button URL* - GP name: *SetHomeButtonURL* - GP element: *SetHomeButtonURLPrompt* - GP path: *Windows Components/Microsoft Edge* @@ -3977,7 +3977,7 @@ Supported values: ADMX Info: -- GP English name: *Set New Tab page URL* +- GP Friendly name: *Set New Tab page URL* - GP name: *SetNewTabPageURL* - GP element: *SetNewTabPageURLPrompt* - GP path: *Windows Components/Microsoft Edge* @@ -4054,7 +4054,7 @@ Supported values: ADMX Info: -- GP English name: *Show message when opening sites in Internet Explorer* +- GP Friendly name: *Show message when opening sites in Internet Explorer* - GP name: *ShowMessageWhenOpeningSitesInInternetExplorer* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -4128,7 +4128,7 @@ With this policy, you can either allow (default) or suppress this notification. ADMX Info: -- GP English name: *Suppress Edge Deprecation Notification* +- GP Friendly name: *Suppress Edge Deprecation Notification* - GP name: *SuppressEdgeDeprecationNotification* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -4197,7 +4197,7 @@ Supported values: ADMX Info: -- GP English name: *Keep favorites in sync between Internet Explorer and Microsoft Edge* +- GP Friendly name: *Keep favorites in sync between Internet Explorer and Microsoft Edge* - GP name: *SyncFavoritesBetweenIEAndMicrosoftEdge* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -4276,7 +4276,7 @@ To verify that favorites are in synchronized between Internet Explorer and Micro ADMX Info: -- GP English name: *Unlock Home Button* +- GP Friendly name: *Unlock Home Button* - GP name: *UnlockHomeButton* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* @@ -4350,7 +4350,7 @@ Supported values: ADMX Info: -- GP English name: *Allow a shared Books folder* +- GP Friendly name: *Allow a shared Books folder* - GP name: *UseSharedFolderForBooks* - GP path: *Windows Components/Microsoft Edge* - GP ADMX file name: *MicrosoftEdge.admx* diff --git a/windows/client-management/mdm/policy-csp-camera.md b/windows/client-management/mdm/policy-csp-camera.md index 93e5c5d6cf..22a1a37ce3 100644 --- a/windows/client-management/mdm/policy-csp-camera.md +++ b/windows/client-management/mdm/policy-csp-camera.md @@ -81,7 +81,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Allow Use of Camera* +- GP Friendly name: *Allow Use of Camera* - GP name: *L_AllowCamera* - GP path: *Windows Components/Camera* - GP ADMX file name: *Camera.admx* diff --git a/windows/client-management/mdm/policy-csp-cellular.md b/windows/client-management/mdm/policy-csp-cellular.md index ccd0ab26c1..7e776b0469 100644 --- a/windows/client-management/mdm/policy-csp-cellular.md +++ b/windows/client-management/mdm/policy-csp-cellular.md @@ -103,7 +103,7 @@ If an app is open when this Group Policy object is applied on a device, employee ADMX Info: -- GP English name: *Let Windows apps access cellular data* +- GP Friendly name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_Enum* - GP path: *Network/WWAN Service/Cellular Data Access* @@ -171,7 +171,7 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N ADMX Info: -- GP English name: *Let Windows apps access cellular data* +- GP Friendly name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_ForceAllowTheseApps_List* - GP path: *Network/WWAN Service/Cellular Data Access* @@ -231,7 +231,7 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N ADMX Info: -- GP English name: *Let Windows apps access cellular data* +- GP Friendly name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_ForceDenyTheseApps_List* - GP path: *Network/WWAN Service/Cellular Data Access* @@ -291,7 +291,7 @@ Added in Windows 10, version 1709. List of semi-colon delimited Package Family N ADMX Info: -- GP English name: *Let Windows apps access cellular data* +- GP Friendly name: *Let Windows apps access cellular data* - GP name: *LetAppsAccessCellularData* - GP element: *LetAppsAccessCellularData_UserInControlOfTheseApps_List* - GP path: *Network/WWAN Service/Cellular Data Access* @@ -361,7 +361,7 @@ If this policy setting is disabled or is not configured, the link to the per-app ADMX Info: -- GP English name: *Set Per-App Cellular Access UI Visibility* +- GP Friendly name: *Set Per-App Cellular Access UI Visibility* - GP name: *ShowAppCellularAccessUI* - GP path: *Network/WWAN Service/WWAN UI Settings* - GP ADMX file name: *wwansvc.admx* diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index 9e0b691757..90a5286d6f 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -243,7 +243,7 @@ Most restricted value is 0. ADMX Info: -- GP English name: *Prohibit connection to roaming Mobile Broadband networks* +- GP Friendly name: *Prohibit connection to roaming Mobile Broadband networks* - GP name: *WCM_DisableRoaming* - GP path: *Network/Windows Connection Manager* - GP ADMX file name: *WCM.admx* @@ -658,7 +658,7 @@ Also, see the "Web-based printing" policy setting in Computer Configuration/Admi ADMX Info: -- GP English name: *Turn off printing over HTTP* +- GP Friendly name: *Turn off printing over HTTP* - GP name: *DisableHTTPPrinting_2* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -732,7 +732,7 @@ If you disable or do not configure this policy setting, users can download print ADMX Info: -- GP English name: *Turn off downloading of print drivers over HTTP* +- GP Friendly name: *Turn off downloading of print drivers over HTTP* - GP name: *DisableWebPnPDownload_2* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -806,7 +806,7 @@ See the documentation for the web publishing and online ordering wizards for mor ADMX Info: -- GP English name: *Turn off Internet download for Web publishing and online ordering wizards* +- GP Friendly name: *Turn off Internet download for Web publishing and online ordering wizards* - GP name: *ShellPreventWPWDownload_2* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -867,7 +867,7 @@ Value type is integer. ADMX Info: -- GP English name: *Turn off Windows Network Connectivity Status Indicator active tests* +- GP Friendly name: *Turn off Windows Network Connectivity Status Indicator active tests* - GP name: *NoActiveProbe* - GP path: *Internet Communication settings* - GP ADMX file name: *ICM.admx* @@ -935,7 +935,7 @@ If you enable this policy, Windows only allows access to the specified UNC paths ADMX Info: -- GP English name: *Hardened UNC Paths* +- GP Friendly name: *Hardened UNC Paths* - GP name: *Pol_HardenedPaths* - GP path: *Network/Network Provider* - GP ADMX file name: *networkprovider.admx* @@ -1007,7 +1007,7 @@ If you disable this setting or do not configure it, the user will be able to cre ADMX Info: -- GP English name: *Prohibit installation and configuration of Network Bridge on your DNS domain network* +- GP Friendly name: *Prohibit installation and configuration of Network Bridge on your DNS domain network* - GP name: *NC_AllowNetBridge_NLA* - GP path: *Network/Network Connections* - GP ADMX file name: *NetworkConnections.admx* diff --git a/windows/client-management/mdm/policy-csp-credentialproviders.md b/windows/client-management/mdm/policy-csp-credentialproviders.md index 89e4817ce7..cf333911ba 100644 --- a/windows/client-management/mdm/policy-csp-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-credentialproviders.md @@ -100,7 +100,7 @@ To configure Windows Hello for Business, use the Administrative Template policie ADMX Info: -- GP English name: *Turn on convenience PIN sign-in* +- GP Friendly name: *Turn on convenience PIN sign-in* - GP name: *AllowDomainPINLogon* - GP path: *System/Logon* - GP ADMX file name: *credentialproviders.admx* @@ -172,7 +172,7 @@ Note that the user's domain password will be cached in the system vault when usi ADMX Info: -- GP English name: *Turn off picture password sign-in* +- GP Friendly name: *Turn off picture password sign-in* - GP name: *BlockDomainPicturePassword* - GP path: *System/Logon* - GP ADMX file name: *credentialproviders.admx* diff --git a/windows/client-management/mdm/policy-csp-credentialsdelegation.md b/windows/client-management/mdm/policy-csp-credentialsdelegation.md index 71447f45ab..d4806508e7 100644 --- a/windows/client-management/mdm/policy-csp-credentialsdelegation.md +++ b/windows/client-management/mdm/policy-csp-credentialsdelegation.md @@ -92,7 +92,7 @@ If you disable or do not configure this policy setting, Restricted Administratio ADMX Info: -- GP English name: *Remote host allows delegation of non-exportable credentials* +- GP Friendly name: *Remote host allows delegation of non-exportable credentials* - GP name: *AllowProtectedCreds* - GP path: *System/Credentials Delegation* - GP ADMX file name: *CredSsp.admx* diff --git a/windows/client-management/mdm/policy-csp-credentialsui.md b/windows/client-management/mdm/policy-csp-credentialsui.md index 5ccf34a12e..5fdff42127 100644 --- a/windows/client-management/mdm/policy-csp-credentialsui.md +++ b/windows/client-management/mdm/policy-csp-credentialsui.md @@ -98,7 +98,7 @@ The policy applies to all Windows components and applications that use the Windo ADMX Info: -- GP English name: *Do not display the password reveal button* +- GP Friendly name: *Do not display the password reveal button* - GP name: *DisablePasswordReveal* - GP path: *Windows Components/Credential User Interface* - GP ADMX file name: *credui.admx* @@ -168,7 +168,7 @@ If you disable this policy setting, users will always be required to type a user ADMX Info: -- GP English name: *Enumerate administrator accounts on elevation* +- GP Friendly name: *Enumerate administrator accounts on elevation* - GP name: *EnumerateAdministrators* - GP path: *Windows Components/Credential User Interface* - GP ADMX file name: *credui.admx* diff --git a/windows/client-management/mdm/policy-csp-cryptography.md b/windows/client-management/mdm/policy-csp-cryptography.md index b141d4387b..88e34b4df9 100644 --- a/windows/client-management/mdm/policy-csp-cryptography.md +++ b/windows/client-management/mdm/policy-csp-cryptography.md @@ -82,7 +82,7 @@ Allows or disallows the Federal Information Processing Standard (FIPS) policy. ADMX Info: -- GP English name: *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing* +- GP Friendly name: *System cryptography: Use FIPS-compliant algorithms for encryption, hashing, and signing* - GP path: *Windows Settings/Security Settings/Local Policies/Security Options* From 7c19070c012e2d311be1a439e6eb054a7a4a569f Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Wed, 11 Aug 2021 16:51:18 +0530 Subject: [PATCH 0017/1214] removed references to Windows 10 Mobile --- .../sideload-apps-in-windows-10.md | 35 ------------------- .../manage-corporate-devices.md | 3 +- .../new-policies-for-windows-10.md | 2 +- 3 files changed, 2 insertions(+), 38 deletions(-) diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index fe07daba50..7c926cf8e4 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -17,7 +17,6 @@ ms.date: 05/20/2019 **Applies to** - Windows 10 -- Windows 10 Mobile > [!NOTE] > As of Windows Insider Build 18956, sideloading is enabled by default. Now, you can deploy a signed package onto a device without a special configuration. @@ -87,40 +86,6 @@ You can sideload apps on managed or unmanaged devices. **To install the app** - From the folder with the appx package, run the PowerShell `Add-AppxPackage` command to install the appx package. -## How do I sideload an app on mobile -You can sideload apps on managed or unmanaged devices. - -**To turn on sideloading for a managed device** - -- Deploy an enterprise policy. - -**To turn on sideloading for unmanaged devices** - -1. Open **Settings**. - -2. Click **Update & Security** > **For developers**. - -3. On **Use developer features**, select **Sideload apps**. - -**To import the security certificate for managed devices** - -1. Open the security certificate for the appx package, and select **Install Certificate**. - -2. On the **Certificate Import Wizard**, select **Local Machine**. - -3. Import the certificate to the **Trusted Root Certification Authorities** folder. - -**To import the security certificate for unmanaged devices** - -- You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package to a Windows 10 mobile device, see runtime instructions on [Build and apply a provisioning package]( https://go.microsoft.com/fwlink/p/?LinkId=619164). - -**To install the app** - -- From an email, tap a xap, appx, or appx bundle package. - - -OR- - - With your mobile device tethered to a desktop, click a xap, appx, or appx bundle package from the files system to install the app.   diff --git a/windows/client-management/manage-corporate-devices.md b/windows/client-management/manage-corporate-devices.md index 4fc41d68c1..f7fdbd3994 100644 --- a/windows/client-management/manage-corporate-devices.md +++ b/windows/client-management/manage-corporate-devices.md @@ -22,7 +22,6 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile You can use the same management tools to manage all device types running Windows 10 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, System Center tools, and so on, will continue to work for Windows 10. @@ -36,7 +35,7 @@ You can use the same management tools to manage all device types running Windows | [New policies for Windows 10](new-policies-for-windows-10.md) | New Group Policy settings added in Windows 10 | | [Group Policies that apply only to Windows 10 Enterprise and Windows 10 Education](group-policies-for-enterprise-and-education-editions.md) | Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education | | [Changes to Group Policy settings for Start in Windows 10](/windows/configuration/changes-to-start-policies-in-windows-10) | Changes to the Group Policy settings that you use to manage Start | -| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 and Windows 10 Mobile in their organizations | +| [Introduction to configuration service providers (CSPs) for IT pros](/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers) | How IT pros and system administrators can take advantage of many settings available through CSPs to configure devices running Windows 10 in their organizations | ## Learn more diff --git a/windows/client-management/new-policies-for-windows-10.md b/windows/client-management/new-policies-for-windows-10.md index 793835661a..183335b55e 100644 --- a/windows/client-management/new-policies-for-windows-10.md +++ b/windows/client-management/new-policies-for-windows-10.md @@ -481,7 +481,7 @@ For a spreadsheet of Group Policy settings included in Windows 10 and Windows Se ## New MDM policies -Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, and Windows 10 Mobile includes settings from Windows Phone 8.1, plus new or enhanced settings for Windows 10, such as: +Mobile device management (MDM) for Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education includes settings from Windows Phone 8.1, plus new or enhanced settings for Windows 10, such as: - Defender (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education only) From e2fe9b0e1f5cc5ba3148f6de94eafe5c340b6175 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Wed, 11 Aug 2021 17:33:06 +0530 Subject: [PATCH 0018/1214] Update toc.yml --- windows/application-management/toc.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index 282bdafc46..795441caa1 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -260,7 +260,5 @@ items: href: per-user-services-in-windows.md - name: Disabling System Services in Windows Server href: /windows-server/security/windows-services/security-guidelines-for-disabling-system-services-in-windows-server - - name: Deploy app upgrades on Windows 10 Mobile - href: deploy-app-upgrades-windows-10-mobile.md - name: How to keep apps removed from Windows 10 from returning during an update href: remove-provisioned-apps-during-update.md \ No newline at end of file From dbeb233396cc395928a64ad609b4e119f8e58077 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Thu, 12 Aug 2021 13:12:59 +0530 Subject: [PATCH 0019/1214] redirected topics and removed a cross reference --- .openpublishing.redirection.json | 12 ++++++++++++ .../upgrade/upgrade-windows-phone-8-1-to-10.md | 4 ---- 2 files changed, 12 insertions(+), 4 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6a465d87b3..4756e91351 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18944,6 +18944,18 @@ "source_path": "windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md", "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false + }, + { + "source_path": "windows/client-management/windows-10-mobile-and-mdm.md", + "redirect_url": "/windows/client-management/index.yml", + "redirect_document_id": false + }, + { + "source_path": "windows/application-management/deploy-app-upgrades-windows-10-mobile.md", + "redirect_url": "/windows/application-management/index.yml", + "redirect_document_id": false } + + ] } diff --git a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md index 8d2dad79dd..fd07fae01c 100644 --- a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md +++ b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md @@ -108,7 +108,3 @@ Some enterprises may want to block their users from installing the Windows 10 Mo http://windowsphone.com/s?appid=fbe47e4f-7769-4103-910e-dca8c43e0b07 For more information about how to do this, see [Try it out: restrict Windows Phone 8.1 apps](/previous-versions/windows/it-pro/windows-phone/cc182269(v=technet.10)). - -## Related topics - -[Windows 10 Mobile and mobile device management](/windows/client-management/windows-10-mobile-and-mdm) \ No newline at end of file From 9d31712deb27f4f4a14b55112bad7d5be794fa1e Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Thu, 12 Aug 2021 13:21:33 +0530 Subject: [PATCH 0020/1214] deleted two topics that were redirected --- .../deploy-app-upgrades-windows-10-mobile.md | 61 - .../windows-10-mobile-and-mdm.md | 1090 ----------------- 2 files changed, 1151 deletions(-) delete mode 100644 windows/application-management/deploy-app-upgrades-windows-10-mobile.md delete mode 100644 windows/client-management/windows-10-mobile-and-mdm.md diff --git a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md b/windows/application-management/deploy-app-upgrades-windows-10-mobile.md deleted file mode 100644 index 59b3dc2209..0000000000 --- a/windows/application-management/deploy-app-upgrades-windows-10-mobile.md +++ /dev/null @@ -1,61 +0,0 @@ ---- -title: Application upgrades on Windows 10 Mobile -description: Learn how to deploy upgrades to applications running on Windows 10 Mobile. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: mobile -ms.author: greglin -author: greg-lindsay -ms.date: 07/21/2017 -ms.reviewer: -manager: dansimp -ms.topic: article ---- -# Deploy application upgrades on Windows 10 Mobile - -> Applies to: Windows 10 - -When you have a new version of an application, how do you get that to the Windows 10 Mobile devices in your environment? With [application supersedence in Microsoft Endpoint Configuration Manager](/configmgr/apps/deploy-use/revise-and-supersede-applications#application-supersedence). - -There are two steps to deploy an app upgrade: - -1. [Define the supersedence](#define-app-supersedence) - this lets Configuration Manager know that the old version should be replaced by the new version. -2. [Deploy the upgrade](#deploy-the-app-upgrade) to your users. - -The following steps walk you through the upgrade deployment process - we have an upgraded version of the Walking Scorer app (moving from version 12.23.2.0 to 12.23.3.0). Because we previously used Configuration Manager to deploy the existing version, we'll use it now to upgrade the app. - -Before you can deploy the upgrade, make sure you import the new version of the app and distribute it to your manage.microsoft.com distribution point. - - - -## Define app supersedence - -1. In the Configuration Manager console, open the Software Library, and then find the new version of your app. - ![The Software Library in Configuration Manager](media/app-upgrade-cm-console.png) - -2. Right-click the new version, and then click **Properties**. -3. Click the **Supersedence** tab - there shouldn't be any supersedence rules yet. We'll add one next. - ![The list of supersedence rules for the app](media/app-upgrade-no-supersedence.png) - -4. Click **Add**, browse to the existing (older) version of the app that you're upgrading, and then click **OK**. -5. Under **New Deployment Type** select the new version of the app. (When you imported the new version, it comes in as a new deployment type. If you're upgrading a Universal application, you'll see only one type here.) - ![Create a supersedence rule for the new version of the app](media/app-upgrade-supersede-deploy-type.png) - > [!IMPORTANT] - > Do **NOT** select **Uninstall**. This tells Configuration Manager to uninstall the old version, but it does **NOT** then install the new version. - -6. Click **OK**. -7. If you have other versions of the same app, repeat steps 4-6 for each version. Click **OK** when you're done. - -> [!NOTE] -> Need to remove a supersedence? (Maybe the new version turned out to be flaky and you don't want users to get it yet.) On the **Supersedence** tab for the *new* version of the app, double-click the older version in the list of supersedence rules, and then change the **New Deployment Type** to **Do not replace**. - -## Deploy the app upgrade - -You're now ready to deploy the upgrade. On the **Home** tab in Configuration Manager, select the new version of the app, and then click **Deploy**, and follow the instructions in the wizard. When asked, set the **Purpose** to **Required**. - -You don't need to delete the deployment associated with the older version of the app. The status for that deployment will change to **Requirements not met** in the **Monitoring** view: - -![Monitoring view in Configuration Manager for the old version of the app](media/app-upgrade-old-version.png) - -If you haven't deployed an app through Configuration Manager before, check out [Deploy applications with Microsoft Endoint Configuration Manager](/configmgr/apps/deploy-use/deploy-applications). You can also see how to delete deployments (although you don't have to) and notify users about the upgraded app. \ No newline at end of file diff --git a/windows/client-management/windows-10-mobile-and-mdm.md b/windows/client-management/windows-10-mobile-and-mdm.md deleted file mode 100644 index dda6ed1f76..0000000000 --- a/windows/client-management/windows-10-mobile-and-mdm.md +++ /dev/null @@ -1,1090 +0,0 @@ ---- -title: Windows 10 Mobile deployment and management guide (Windows 10) -description: This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. -ms.assetid: 6CAA1004-CB65-4FEC-9B84-61AAD2125E5E -ms.reviewer: -manager: dansimp -ms.author: dansimp -keywords: Mobile, diagnostic data, BYOD, MDM -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.pagetype: mobile, devices, security -ms.localizationpriority: medium -author: dansimp -ms.date: -ms.topic: article ---- - -# Windows 10 Mobile deployment and management guide - -**Applies to:** -- Windows 10 Mobile, version 1511 and Windows 10 Mobile, version 1607 - -This guide helps IT professionals plan for and deploy Windows 10 Mobile devices. - -Employees increasingly depend on smartphones to complete daily work tasks, but these devices introduce unique management and security challenges. Whether providing corporate devices or allowing people to use their personal devices, IT needs to deploy and manage mobile devices and apps quickly to meet business goals. However, they also need to ensure that the apps and data on those mobile devices are protected against cybercrime or loss. Windows 10 Mobile helps organizations directly address these challenges with robust, flexible, built-in mobile device and app management technologies. -Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement, by using a comprehensive mobile device management solution. - -**In this article** -- [Deploy](#deploy) -- [Configure](#configure) -- [Apps](#apps) -- [Manage](#manage) -- [Retire](#retire) - - -## Deploy - -Windows 10 Mobile has a built-in device management client to deploy, configure, maintain, and support smartphones. Common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT), this client provides a single interface through which mobile device management (MDM) solutions can manage any device that runs Windows 10. Because the MDM client integrates with identity management, the effort required to manage devices throughout the lifecycle is greatly reduced. -Windows 10 includes comprehensive MDM capabilities that can be managed by Microsoft management solutions, such as Microsoft Intune or Microsoft Endpoint Configuration Manager, as well as many third-party MDM solutions. There is no need to install an additional, custom MDM app to enroll devices and bring them under MDM control. All MDM system vendors have equal access to Windows 10 Mobile device management application programming interfaces (APIs), giving IT organizations the freedom to select the system that best fits their management requirements, whether Microsoft Intune or a third-party MDM product. For more information about Windows 10 Mobile device management APIs, see [Mobile device management](./mdm/index.md). - -### Deployment scenarios - -*Applies to: Corporate and personal devices* - -The built-in MDM client is common to all editions of the Windows 10 operating system, including desktop, mobile, and Internet of Things (IoT). The client provides a single interface through which you can manage any device that runs Windows 10. The client has two important roles: device enrollment in an MDM system and device management. - -Organizations typically have two scenarios to consider when it comes to device deployment: Bring Your Own (BYO) personal devices and Choose Your Own (CYO) company-owned devices. In both cases, the device must be enrolled in an MDM system, which would configure it with settings appropriate for the organization and the employee. -Windows 10 Mobile device management capabilities support both personal devices used in the BYO scenario and corporate devices used in the CYO scenario. The operating system offers a flexible approach to registering devices with directory services and MDM systems. IT organizations can provision comprehensive device-configuration profiles based on their business needs to control and protect mobile business data. Apps can be provisioned easily to personal or corporate devices through the Microsoft Store for Business, or by using their MDM system, which can also work with the Microsoft Store for Business for public store apps. -Knowing who owns the device and what the employee uses it for are the major factors in determining your management strategy and which controls your organization should put in place. Whether personal devices, corporate devices, or a mixture of the two, deployment processes and configuration policies may differ. - -For **personal devices**, companies need to be able to manage corporate apps and data on the device without impeding the employee’s ability to personalize it to meet their individual needs. The employee owns the device and corporate policy allows them to use it for both business and personal purposes, with the ability to add personal apps at their discretion. The main concern with personal devices is how organizations can prevent corporate data from being compromised, while still keeping personal data private and under the sole control of the employee. This requires that the device be able to support separation of apps and data with strict control of business and personal data traffic. - -For **corporate devices**, organizations have a lot more control. IT can provide a selected list of supported device models to employees, or they can directly purchase and preconfigure them. Because devices are owned by the company, employees can be limited as to how much they can personalize these devices. Security and privacy concerns may be easier to navigate, because the device falls entirely under existing company policy. - -### Device enrollment - -*Applies to: Corporate and personal devices* - -The way in which personal and corporate devices are enrolled into an MDM system differs. Your operations team should consider these differences when determining which approach is best for mobile workers in your organization. - -**Device initialization and enrollment considerations** - - ----- - - - - - - - - - - - - - - - - - - - - - - -
Personal devicesCorporate devices
OwnershipEmployeeOrganization
Device Initialization - -In the out-of-box experience (OOBE), the first time the employee starts the device, they are requested to add a cloud identity to the device.The primary identity on the device is a personal identity. Personal devices are initiated with a Microsoft Account (MSA), which uses a personal email address. The primary identity on the device is an organizational identity. Corporate devices are initialized with an organizational account (account@corporatedomain.ext). -Initialization of a device with a corporate account is unique to Windows 10. No other mobile platform currently offers this capability. The default option is to use an Azure Active Directory (Azure AD) organizational identity. -Skipping the account setup in OOBE results in the creation of a local account. The only option to add a cloud account later is to add an MSA, putting this device into a personal device deployment scenario. To start over, the device must be reset. -
Device Enrollment - -Enrolling devices in an MDM system helps control and protect corporate data while keeping workers productive. Device enrollment can be initiated by employees. They can add an Azure account as a secondary account to the Windows 10 Mobile device. Provided the MDM system is registered with your Azure AD, the device is automatically enrolled in the MDM system when the user adds an Azure AD account as a secondary account (MSA+Azure AD+MDM). If your organization does not have Azure AD, the employee’s device is automatically enrolled into your organization’s MDM system (MSA+MDM). -MDM enrollment can also be initiated with a provisioning package. This option enables IT to offer easy-to-use self-service enrollment of personal devices. Provisioning is currently only supported for MDM-only enrollment (MSA+MDM). -The user initiates MDM enrollment by joining the device to the Azure AD instance of their organization. The device is automatically enrolled in the MDM system when the device registers in Azure AD. This requires your MDM system to be registered with your Azure AD (Azure AD+MDM).
- -Microsoft recommends Azure AD registration and automatic MDM enrollment for corporate devices (Azure AD+MDM) and personal devices (MSA+Azure AD+MDM). This requires Azure AD Premium. - -### Identity management - -*Applies to: Corporate and personal devices* - -Employees can use only one account to initialize a device so it’s imperative that your organization controls which account is enabled first. The account chosen determines who controls the device and influences your management capabilities. - -> [!NOTE] -> Why must the user add an account to the device in OOBE? Windows 10 Mobile are single user devices and the user accounts give access to a number of default cloud services that enhance the productivity and entertainment value of the phone for the user. Such services are: Store for downloading apps, Groove for music and entertainment, Xbox for gaming, and so on. Both an [MSA](https://www.microsoft.com/account/) and an [Azure AD account](https://www.microsoft.com/server-cloud/products/azure-active-directory/?WT.srch=1&WT.mc_id=SEM_%5B_uniqid%5D&utm_source=Bing&utm_medium=CPC&utm_term=azure%20ad&utm_campaign=Enterprise_Mobility_Suite) provide access to these services. - -The following table describes the impact of identity choice on device management characteristics of the personal and corporate device scenarios. - -**Identity choice considerations for device management** - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Personal identityWork identity
First account on the deviceMicrosoft AccountAzure AD account
Ease of enrollmentEmployees use their Microsoft Account to activate the device. Then, they use their Azure AD account (organizational identity) to register the device in Azure AD and enroll it with the company’s MDM solution (MSA+Azure AD+MDM).Employees use their Azure AD account to register the device in Azure AD and automatically enroll it with the organization’s MDM solution (Azure AD+MDM – requires Azure AD Premium).
Credential managementEmployees sign in to the device with Microsoft Account credentials. -Users cannot sign in to devices with Azure AD credentials, even if they add the credentials after initial activation with a Microsoft Account. -Employees sign in to the device with Azure AD credentials. -IT can block the addition of a personal identity, such as an MSA or Google Account. IT controls all devices access policies, without limitations. -
Ability to block the use of a personal identity on the deviceNoYes
User settings and data roaming across multiple Windows devicesUser and app settings roam across all devices activated with the same personal identity through OneDrive.If the device is activated with an MSA, then adds an Azure AD account, user an app settings roam. If you add your MSA to an Azure AD-joined device, this is not the case. Microsoft is investigating Enterprise roaming for a future release.
Level of controlOrganizations can apply most of the available restrictive policies to devices and disable the Microsoft account. You can prevent users from reclaiming full control over their devices by unenrolling them from the organization’s MDM solution or resetting the device. Legal limitations may apply. For more information, contact your legal department.Organizations are free to apply any restrictive policies to devices to bring them in line with corporate standards and compliance regulations. They can also prevent the user from unenrolling the device from the enterprise.
Information ProtectionYou can apply policies to help protect and contain corporate apps and data on the devices and prevent intellectual property leaks, but still provide employees with full control over personal activities like downloading and installing apps and games.Companies can block personal use of devices. Using organizational identities to initialize devices gives organizations complete control over devices and allows them to prevent personalization.
App purchasesEmployees can purchase and install apps from the Store using a personal credit card.Employees can install apps from your Store for Business. Employees cannot install or purchase app from the Store without the addition of an MSA.
- - -> [!NOTE] -> In the context of [Windows-as-a-Service](/windows/deployment/update/), differentiation of MDM capabilities may change in the future. - -### Infrastructure choices - -*Applies to: Corporate and personal devices* - -For both personal and corporate deployment scenarios, an MDM system is the essential infrastructure required to deploy and manage Windows 10 Mobile devices. An Azure AD Premium subscription is recommended as an identity provider and required to support certain capabilities. Windows 10 Mobile allows you to have a pure cloud-based infrastructure or a hybrid infrastructure that combines Azure AD identity management with an on-premises management system to manage devices. Microsoft now also supports a pure on-premises solution to manage Windows 10 Mobile devices with [Configuration Manager](/mem/configmgr/mdm/understand/what-happened-to-hybrid). - -**Azure Active Directory** -Azure AD is a cloud-based directory service that provides identity and access management. You can integrate it with existing on-premises directories to create a hybrid identity solution. Organizations that use Microsoft Office 365 or Intune are already using Azure AD, which has three editions: Free Basic, and Premium (see [Azure Active Directory editions](/azure/active-directory/fundamentals/active-directory-whatis)). All editions support Azure AD device registration, but the Premium edition is required to enable MDM auto-enrollment and conditional access based on device state. - -**Mobile Device Management** -Microsoft [Intune](https://www.microsoft.com/server-cloud/products/microsoft-intune/overview.aspx), part of the Enterprise Mobility + Security, is a cloud-based MDM system that manages devices off premises. Intune uses Azure AD for identity management so employees use the same credentials to enroll devices in Intune that they use to sign into Microsoft 365. Intune supports devices that run other operating systems, such as iOS and Android, to provide a complete MDM solution. -Multiple MDM systems support Windows 10 and most support personal and corporate device deployment scenarios. Most industry-leading MDM vendors already support integration with Azure AD. You can find the MDM vendors that support Azure AD in [Azure Marketplace](https://azure.microsoft.com/marketplace/). If your organization doesn’t use Azure AD, the user must use an MSA during OOBE before enrolling the device in your MDM using a corporate account. - -> [!NOTE] -> Although not covered in this guide, you can use Exchange ActiveSync (EAS) to manage mobile devices instead of using a full-featured MDM system. EAS is available in Microsoft Exchange Server 2010 or later and Microsoft 365. -In addition, Microsoft recently added MDM capabilities powered by Intune to Microsoft 365, called Basic Mobility and Security for Microsoft 365. Basic Mobility and Security for Microsoft 365 supports mobile devices only, such as those running Windows 10 Mobile, iOS, and Android. Basic Mobility and Security for Microsoft 365 offers a subset of the management capabilities found in Intune, including the ability to remotely wipe a device, block a device from accessing Exchange Server email, and configure device policies (e.g., passcode requirements). For more information, see [Overview of Basic Mobility and Security for Microsoft 365](/microsoft-365/admin/basic-mobility-security/overview). - -**Cloud services** -On mobile devices that run Windows 10 Mobile, users can easily connect to cloud services that provide user notifications and collect diagnostic and usage data. Windows 10 Mobile enables organizations to manage how devices consume these cloud services. - -**Windows Push Notification Services** -The Windows Push Notification Services enable software developers to send toast, tile, badge, and raw updates from their cloud services. It provides a mechanism to deliver updates to users in a power-efficient and dependable way. -However, push notifications can affect battery life so the battery saver in Windows 10 Mobile limits background activity on the devices to extend battery life. Users can configure battery saver to turn on automatically when the battery drops below a set threshold. Windows 10 Mobile disables the receipt of push notifications to save energy when battery saver is on. -However, there is an exception to this behavior. In Windows 10 Mobile, the Always allowed battery saver setting (found in the Settings app) allows apps to receive push notifications even when battery saver is on. Users can manually configure this list, or IT can use the MDM system to configure the battery saver settings URI scheme in Windows 10 Mobile (ms-settings:batterysaver-settings). - -For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide). - -**Windows Update for Business** -Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. - -**Microsoft Store for Business** -The Microsoft Store for Business is the place where IT administrators can find, acquire, manage, and distribute apps to Windows 10 devices. This includes both internal line-of-business (LOB) apps, as well as commercially available third-party apps. - -## Configure - -MDM administrators can define and implement policy settings on any personal or corporate device enrolled in an MDM system. The configuration settings you use depend on the deployment scenario, and corporate devices offer IT the broadest range of control. - -> [!NOTE] -> This guide helps IT professionals understand management options available for the Windows 10 Mobile OS. Please consult your MDM system documentation to understand how these policies are enabled by your MDM vendor. -Not all MDM systems support every setting described in this guide. Some support custom policies through OMA-URI XML files. See [Microsoft Intune support for Custom Policies](/intune/deploy-use/windows-10-policy-settings-in-microsoft-intune#custom-uri-settings-for-windows-10-devices). Naming conventions may also vary among MDM vendors. - -### Account profile - -*Applies to: Corporate devices* - -Enforcing what accounts employees can use on a corporate device is important for avoiding data leaks and protecting privacy. Limiting the device to just one account controlled by the organization reduces the risk of a data breach. However, you can choose to allow employees to add a personal Microsoft Account or other consumer email accounts. - -- **Allow Microsoft Account** Specifies whether users are allowed to add a Microsoft Account to the device and use this account to authenticate to cloud services, such as purchasing apps in Microsoft Store, Xbox, or Groove. -- **Allow Adding Non-Microsoft Accounts** Specifies whether users are allowed to add email accounts other than a Microsoft Account. - -### Email accounts - -*Applies to: Corporate and personal devices* - -Email and associated calendar and contacts are the primary apps that users access on their smartphones. Configuring them properly is key to the success of any mobility program. In both corporate and personal device deployment scenarios, these email account settings get deployed immediately after enrollment. Using your corporate MDM system, you can define corporate email account profiles, deploy them to devices, and manage inbox policies. - -- Most corporate email systems leverage **Exchange ActiveSync (EAS)**. For more details on configuring EAS email profiles, see the [Exchange ActiveSync CSP](./mdm/activesync-csp.md). -- **Simple Mail Transfer Protocol (SMTP)** email accounts can also be configured with your MDM system. For more detailed information on SMTP email profile configuration, see the [Email CSP](./mdm/email2-csp.md). Microsoft Intune does not currently support the creation of an SMTP email profile. - -### Device Lock restrictions - -*Applies to: Corporate and personal devices* - -It’s common practice to protect a device that contains corporate information with a passcode when it is not in use. As a best practice, Microsoft recommends that you implement a device lock policy for Windows 10 Mobile devices for securing apps and data. You can use a complex password or numeric PIN to lock devices. Introduced with Windows 10, [Windows Hello](https://windows.microsoft.com/en-us/windows-10/getstarted-what-is-hello) allows you to use a PIN, a companion device (like Microsoft band), or biometrics to validate your identity to unlock Windows 10 Mobile devices. - -> [!NOTE] -> When Windows 10 first shipped, it included Microsoft Passport and Windows Hello, which worked together to provide multifactor authentication. To simplify deployment and improve supportability, Microsoft has combined these technologies into a single solution under the Windows Hello name. Customers who have already deployed these technologies will not experience any change in functionality. Customers who have yet to evaluate Windows Hello will find it easier to deploy due to simplified policies, documentation, and semantics. -To use Windows Hello with biometrics, specialized hardware, including fingerprint reader, illuminated IR sensor, or other biometric sensors is required. Hardware-based protection of the Windows Hello credentials requires TPM 1.2 or greater; if no TPM exists or is configured, credentials/keys protection will be software-based. -Companion devices must be paired with a Windows 10 PC using Bluetooth. To use a Windows Hello companion device that enables the user to roam with their Windows Hello credentials requires the Pro or Enterprise edition of Windows 10. - -Most of the device lock restriction policies have been available through Exchange ActiveSync and MDM since Windows Phone 7 and are still available today for Windows 10 Mobile. If you are deploying Windows 10 devices in a personal device deployment scenario, these settings would apply: - -- **Device Password Enabled** Specifies whether users are required to use a device lock password. -- **Allow Simple Device Password** Specifies whether users can use a simple password (for example, 1111 or 1234). -- **Alphanumeric Device Password Required** Specifies whether users need to use an alphanumeric password. When configured, Windows prompts the user with a full device keyboard to enter a complex password. When not configured, the user can enter a numeric PIN on the keyboard. -- **Min Device Password Complex Characters** The number of password element types (uppercase letters, lowercase letters, numbers, or punctuation) required to create strong passwords. -- **Device Password History** The number of passwords Windows 10 Mobile remembers in the password history. (Users cannot reuse passwords in the history to create new passwords.) -- **Min Device Password Length** The minimum number of characters required to create new passwords. -- **Max Inactivity Time Device Lock** The number of minutes of inactivity before devices are locked and require a password to unlock. -- **Allow Idle Return Without Password** Specifies whether users are required to re-authenticate when their devices return from a sleep state before the inactivity time was reached. -- **Max Device Password Failed Attempts** The number of authentication failures allowed before a device is wiped. (A value of zero disables device wipe functionality.) -- **Screen Timeout While Locked** The number of minutes before the lock screen times out. (This policy influences device power management.) -- **Allow Screen Timeout While Locked User Configuration** Specifies whether users can manually configure screen timeout while the device is on the lock screen. (Windows 10 Mobile ignores the **Screen Timeout While Locked** setting if you disable this setting.) - -Settings related to Windows Hello would be important device lock settings to configure if you are deploying devices using the corporate deployment scenario. -Microsoft made it a requirement for all users to create a numeric passcode as part of Azure AD Join. This policy default requires users to select a four-digit passcode, but this can be configured with an Azure AD-registered MDM system to whatever passcode complexity your organization desires. If you are using Azure AD with an automatic MDM enrollment mechanism, these policy settings are automatically applied during device enrollment. - -You may notice that some of the settings are very similar, specifically those related to passcode length, history, expiration, and complexity. If you set the policy in multiple places, both policies are applied, with the strongest policy retained. Read [PassportForWork CSP](./mdm/passportforwork-csp.md), [DeviceLock CSP](./mdm/devicelock-csp.md) (Windows Phone 8.1), and [Policy CSP](./mdm/policy-configuration-service-provider.md) for more detailed information. - -### Prevent changing of settings - -*Applies to: Corporate devices* - -Employees are usually allowed to change certain personal device settings that you may want to lock down on corporate devices. Employees can interactively adjust certain settings of the phone through the settings applets. Using MDM, you can limit what users are allowed to change, including: - -- **Allow Your Account** Specifies whether users are allowed to change account configuration in the **Your Email and Accounts** panel in Settings -- **Allow VPN** Specifies whether users are allowed to change VPN settings -- **Allow Data Sense** Specifies whether users are allowed to change Data Sense settings -- **Allow Date Time** Specifies whether users are allowed to change data and time setting -- **Allow Edit Device Name** Specifies whether users are allowed to change the device name -- **Allow Speech Model Update** Specifies whether the device receives updates to the speech recognition and speech synthesis models (to improve accuracy and performance) - -### Hardware restrictions - -*Applies to: Corporate devices* - -Windows 10 Mobile devices use state-of-the-art technology that includes popular hardware features such as cameras, global positioning system (GPS) sensors, microphones, speakers, near-field communication (NFC) radios, storage card slots, USB interfaces, Bluetooth interfaces, cellular radios, and Wi-Fi. You can use hardware restrictions to control the availability of these features. - -The following is a list of the MDM settings that Windows 10 Mobile supports to configure hardware restrictions: - -> [!NOTE] -> Some of these hardware restrictions provide connectivity and assist in data protection. - -- **Allow NFC:** Specifies whether the NFC radio is enabled -- **Allow USB Connection:** Specifies whether the USB connection is enabled (doesn’t affect USB charging) -- **Allow Bluetooth:** Specifies whether users can enable and use the Bluetooth radio on their devices -- **Allow Bluetooth Advertising:** Specifies whether the device can act as a source for Bluetooth advertisements and be discoverable to other devices -- **Allow Bluetooth Discoverable Mode:** Specifies whether the device can discover other devices (such as headsets) -- **Allow Bluetooth pre-pairing** Specifies whether to allow specific bundled Bluetooth peripherals to automatically pair with the host device -- **Bluetooth Services Allowed List:** The list of Bluetooth services and profiles to which the device can connect -- **Set Bluetooth Local Device Name:** The local Bluetooth device name -- **Allow Camera:** Specifies whether the camera is enabled -- **Allow Storage Card:** Specifies whether the storage card slot is enabled -- **Allow Voice Recording:** Specifies whether the user can use the microphone to create voice recordings -- **Allow Location:** Specifies whether the device can use the GPS sensor or other methods to determine location so applications can use location information - -### Certificates - -*Applies to: Personal and corporate devices* - -Certificates help improve security by providing account authentication, Wi-Fi authentication, VPN encryption, and SSL encryption of web content. Although users can manage certificates on devices manually, it’s a best practice to use your MDM system to manage those certificates throughout their entire lifecycle – from enrollment through renewal and revocation. -To install certificates manually, you can post them on Microsoft Edge website or send them directly by using email, which is ideal for testing purposes. -Using Simple Certificate Enrollment Protocol (SCEP) and MDM systems, certificate management is completely transparent and requires no user intervention, helping improve user productivity, and reduce support calls. Your MDM system can automatically deploy these certificates to the devices’ certificate stores after you enroll the device, as long as the MDM system supports the SCEP or Personal Information Exchange (PFX). The MDM server can also query and delete SCEP enrolled client certificate (including user installed certificates), or trigger a new enrollment request before the current certificate is expired. -In addition to SCEP certificate management, Windows 10 Mobile supports deployment of PFX certificates. The table below lists the Windows 10 Mobile PFX certificate deployment settings. -For more detailed information about MDM certificate management, see [Client Certificate Install CSP](./mdm/clientcertificateinstall-csp.md) and [Install digital certificates on Windows 10 Mobile](/windows/access-protection/installing-digital-certificates-on-windows-10-mobile). -Use the Allow Manual Root Certificate Installation setting to prevent users from manually installing root and intermediate CA certificates intentionally or accidentally. - -> [!NOTE] -> To diagnose certificate-related issues on Windows 10 Mobile devices, use the free Certificates app in Microsoft Store. This Windows 10 Mobile app can help you: -> - View a summary of all personal certificates -> - View the details of individual certificates -> - View the certificates used for VPN, Wi-Fi, and email authentication -> - Identify which certificates may have expired -> - Verify the certificate path and confirm that you have the correct intermediate and root CA certificates -> - View the certificate keys stored in the device TPM - -### Wi-Fi profiles - -*Applies to: Corporate and personal devices* - -Wi-Fi is used on mobile devices as much as, or more than, cellular data connections. Most corporate Wi-Fi networks require certificates and other complex information to restrict and secure user access. This advanced Wi-Fi information is difficult for typical users to configure, but MDM systems can fully configure these Wi-Fi profiles without user intervention. -You can create multiple Wi-Fi profiles in your MDM system. The Windows 10 Mobile Wi-Fi connection profile settings that can be configured by administrators include: - -- **SSID** The case-sensitive name of the Wi-Fi network Service Set Identifier -- **Security type** The type of security the Wi-Fi network uses; can be one of the following authentication types: - - Open 802.11 - - Shared 802.11 - - WPA-Enterprise 802.11 - - WPA-Personal 802.11 - - WPA2-Enterprise 802.11 - - WPA2-Personal 802.11 -- **Authentication encryption** The type of encryption the authentication uses; can be one of the following encryption methods: - - None (no encryption) - - Wired Equivalent Privacy - - Temporal Key Integrity Protocol - - Advanced Encryption Standard (AES) -- **Extensible Authentication Protocol Transport Layer Security (EAP-TLS)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use EAP-TLS with certificates for authentication -- **Protected Extensible Authentication Protocol with Microsoft Challenge Handshake Authentication Protocol version 2 (PEAP-MSCHAPv2)** WPA-Enterprise 802.11 and WPA2-Enterprise 802.11 security types can use PEAP-MSCHAPv2 with a user name and password for authentication -- **Shared key** WPA-Personal 802.11 and WPA2-Personal 802.11 security types can use a shared key for authentication. -- **Proxy** The configuration of any network proxy that the Wi-Fi connection requires (to specify the proxy server, use its fully qualified domain name [FQDN], Internet Protocol version 4 [IPv4] address, IP version 6 [IPv6] address, or IPvFuture address) -- **Disable Internet connectivity checks** Whether the Wi-Fi connection should check for Internet connectivity -- **Proxy auto-configuration URL** A URL that specifies the proxy auto-configuration file -- **Enable Web Proxy Auto-Discovery Protocol (WPAD)** Specifies whether WPAD is enabled - -In addition, you can set the following device wide Wi-Fi settings: -- **Allow Auto Connect to Wi-Fi Sense Hotspots** Specifies whether the device automatically detects and connects to Wi-Fi networks -- **Allow Manual Wi-Fi Configuration** Specifies whether the user can manually configure Wi-Fi settings -- **Allow Wi-Fi** Specifies whether the Wi-Fi hardware is enabled -- **Allow Internet Sharing** Allows or disallows Internet sharing -- **WLAN Scan Mode** Specifies how actively the device scans for Wi-Fi networks - -For more detailed information about Wi-Fi connection profile settings, see [Wi-Fi CSP](./mdm/wifi-csp.md) and [Policy CSP](./mdm/policy-configuration-service-provider.md). - -### APN profiles - -*Applies to: Corporate devices* - -An Access Point Name (APN) defines network paths for cellular data connectivity. Typically, you define just one APN for a device in collaboration with a mobile operator, but you can define multiple APNs if your company uses multiple mobile operators. -An APN provides a private connection to the corporate network that is unavailable to other companies on the mobile operator network. -You can define and deploy APN profiles in MDM systems that configure cellular data connectivity for Windows 10 Mobile. Devices running Windows 10 Mobile can have only one APN profile. The following lists the MDM settings that Windows 10 Mobile supports for APN profiles: - -- **APN name** The APN name -- *IP connection type* The IP connection type; set to one of the following values: - - IPv4 only - - IPv6 only - - IPv4 and IPv6 concurrently - - IPv6 with IPv4 provided by 46xlat -- **LTE attached** Specifies whether the APN should be attached as part of an LTE Attach -- **APN class ID** The globally unique identifier that defines the APN class to the modem -- **APN authentication type** The APN authentication type; set to one of the following values: - - None - - Auto - - PAP - - CHAP - - MSCHAPv2 -- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type -- **Password** The password for the user account specified in User name -- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile -- **Always on** Specifies whether the connection manager automatically attempts to connect to the APN when it is available -- **Connection enabled** Specifies whether the APN connection is enabled -- **Allow user control** Allows users to connect with other APNs than the enterprise APN -- **Hide view** Specifies whether the cellular UX allows the user to view enterprise APNs - -For more detailed information about APN settings, see [APN CSP](./mdm/enterpriseapn-csp.md). - -### Proxy - -*Applies to: Corporate devices* - -The following lists the Windows 10 Mobile settings for managing APN proxy settings for Windows 10 Mobile device connectivity: - -- **Connection name** Specifies the name of the connection the proxy is associated with (this is the APN name of a configured connection) -- **Bypass Local** Specifies whether the proxy should be bypassed when local hosts are accessed by the device -- **Enable** Specifies whether the proxy is enabled -- **Exception** Specifies a semi-colon delimited list of external hosts which should bypass the proxy when accessed -- **User Name** Specifies the username used to connect to the proxy -- **Password** Specifies the password used to connect to the proxy -- **Server** Specifies the name of the proxy server -- **Proxy connection type** The proxy connection type, supporting: Null proxy, HTTP, WAP, SOCKS4 -- **Port** The port number of the proxy connection - -For more details on proxy settings, see [CM_ProxyEntries CSP](./mdm/cm-proxyentries-csp.md). - -### VPN - -*Applies to: Corporate and personal devices* - -Organizations often use a VPN to control access to apps and resources on their company’s intranet. In addition to native Microsoft Point-to-Point Tunneling Protocol (PPTP), Layer 2 Tunneling Protocol (L2TP), and Internet Key Exchange Protocol version 2 (IKEv2) VPNs, Windows 10 Mobile supports SSL VPN connections, which require a downloadable plugin from the Microsoft Store and are specific to the VPN vendor of your choice. These plugins work like apps and can be installed directly from the Microsoft Store using your MDM system (see App Management). - -You can create and provision multiple VPN connection profiles and then deploy them to managed devices that run Windows 10 Mobile. -To create a VPN profile that uses native Windows 10 Mobile VPN protocols (such as IKEv2, PPTP, or L2TP), you can use the following settings: - -- **VPN Servers** The VPN server for the VPN profile -- **Routing policy type** The type of routing policy the VPN profile uses can be set to one of the following values: - - Split tunnel: Only network traffic destined to the intranet goes through the VPN connection - - Force tunnel: All traffic goes through the VPN connection -- **Tunneling protocol type** The tunneling protocol used for VPN profiles that use native Windows 10 Mobile VPN protocols can be one the following values: PPTP, L2TP, IKEv2, Automatic -- **User authentication method** The user authentication method for the VPN connection can have a value of EAP or MSChapv2 (Windows 10 Mobile does not support the value MSChapv2 for IKEv2-based VPN connections) -- **Machine certificate** The machine certificate used for IKEv2-based VPN connections -- **EAP configuration** To create a single sign-on experience for VPN users using certificate authentication, you need to create an Extensible Authentication Protocol (EAP) configuration XML file and include it in the VPN profile -- **L2tpPsk** The pre-shared key used for an L2TP connection -- **Cryptography Suite** Enable the selection of cryptographic suite attributes used for IPsec tunneling - -> [!NOTE] -> The easiest way to create a profile for a single sign-on experience with an EAP configuration XML is through the rasphone tool on a Windows 10 PC. Once you run the rasphone.exe, the configuration wizard walks you through the necessary steps. For step-by-step instructions on creating the EAP configuration XML blob, see EAP configuration. You can use the resulting XML blob in the MDM system to create the VPN profile on Windows 10 Mobile phone. If you have multiple certificates on the devices, you may want to configure filtering conditions for automatic certificate selection, so the employee does not need to select an authentication certificate every time the VPN is turned on. See this article for details. Windows 10 for PCs and Windows 10 Mobile have the same VPN client. - -Microsoft Store–based VPN plugins for the VPN connection allow you to create a VPN plugin profile with the following attributes: - -- **VPN server** A comma-separated list of VPN servers; you can specify the servers with a URL, fully qualified host name, or IP address -- **Custom configuration** An HTML-encoded XML blob for SSL–VPN plugin–specific configuration information (such as authentication information) that the plugin provider requires -- **Microsoft Store VPN plugin family name** Specifies the Microsoft Store package family name for the Microsoft Store–based VPN plugin - -In addition, you can specify per VPN profile: - -- **App Trigger List** You can add an App Trigger List to every VPN profile. The app specified in the list automatically triggers the VPN profile for intranet connectivity. When multiple VPN profiles are needed to serve multiple apps, the operating system automatically establishes the VPN connection when the user switches between apps. Only one VPN connection at a time can be active. In the event the device drops the VPN connection, Windows 10 Mobile automatically reconnects to the VPN without user intervention. -- **Route List** List of routes to be added to the routing table for the VPN interface. This is required for split tunneling cases where the VPN server site has more subnets that the default subnet based on the IP assigned to the interface. -- **Domain Name Information List** Name Resolution Policy Table (NRPT) rules for the VPN profile. -- **Traffic Filter List** Specifies a list of rules. Only traffic that matches these rules can be sent via the VPN Interface. -- **DNS suffixes** A comma-separated list of DNS suffixes for the VPN connection. Any DNS suffixes in this list are automatically added to Suffix Search List. -- **Proxy** Any post-connection proxy support required for the VPN connection; including Proxy server name and Automatic proxy configuration URL. Specifies the URL for automatically retrieving proxy server settings. -- **Always on connection** Windows 10 Mobile features always-on VPN, which makes it possible to automatically start a VPN connection when a user signs in. The VPN stays connected until the user manually disconnects it. -- **Remember credentials** Specifies whether the VPN connection caches credentials. -- **Trusted network detection** A comma-separated list of trusted networks that causes the VPN not to connect when the intranet is directly accessible (Wi-Fi). -- **Enterprise Data Protection Mode ID** Enterprise ID, which is an optional field that allows the VPN to automatically trigger based on an app defined with a Windows Information Protection policy. -- **Device Compliance** To set up Azure AD-based Conditional Access for VPN and allow that SSO with a certificate different from the VPN Authentication certificate for Kerberos Authentication in the case of Device Compliance. -- **Lock Down VPN profile** A Lock Down VPN profile has the following characteristics: - - It is an always-on VPN profile. - - It can never be disconnected. - - If the VPN profile is not connected, the user has no network connectivity. - - No other VPN profiles can be connected or modified. -- **ProfileXML** In case your MDM system does not support all the VPN settings you want to configure, you can create an XML file that defines the VPN profile you want to apply to all the fields you require. - -For more details about VPN profiles, see [VPNv2 CSP](./mdm/vpnv2-csp.md). - -Some device-wide settings for managing VPN connections can help you manage VPNs over cellular data connections, which in turn helps reduce costs associated with roaming or data plan charges: -- **Allow VPN** Specifies whether users can change VPN settings -- **Allow VPN Over Cellular** Specifies whether users can establish VPN connections over cellular networks -- **Allow VPN Over Cellular when Roaming** Specifies whether users can establish VPN connections over cellular networks when roaming - -### Storage management - -*Applies to: Corporate and personal devices* - -Protecting the apps and data stored on a device is critical to device security. One method for helping protect your apps and data is to encrypt internal device storage. The [device encryption](/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10#bitlocker-device-encryption) in Windows 10 Mobile helps protect corporate data against unauthorized access, even when an unauthorized user has physical possession of the device. - -Windows 10 Mobile also has the ability to install apps on a secure digital (SD) card. The operating system stores apps on a partition specifically designated for that purpose. This feature is always on so you don’t need to set a policy explicitly to enable it. - -The SD card is uniquely paired with a device. No other devices can see the apps or data on the encrypted partition, but they can access the data stored on the unencrypted partition of the SD card, such as music or photos. This gives users the flexibility to use an SD card while still protecting the confidential apps and data on it. - -You can disable the **Allow Storage Card** setting if you wish to prevent users from using SD cards entirely. If you choose not to encrypt storage, you can help protect your corporate apps and data by using the Restrict app data to the system volume and Restrict apps to the system volume settings. These help ensure that users cannot copy your apps and data to SD cards. - -Here is a list of MDM storage management settings that Windows 10 Mobile provides: - -- **Allow Storage Card** Specifies whether the use of storage cards for data storage is allowed -- **Require Device Encryption** Specifies whether internal storage is encrypted (when a device is encrypted, you cannot use a policy to turn encryption off) -- **Encryption method** Specifies the BitLocker drive encryption method and cipher strength; can be one of the following values: - - AES-Cipher Block Chaining (CBC) 128-bit - - AES-CBC 256-bit - - XEX-based tweaked-codebook mode with cipher text stealing (XTS)–AES (XTS-AES) 128-bit (this is the default) - - XTS-AES-256-bit -- **Allow Federal Information Processing Standard (FIPS) algorithm policy** Specifies whether the device allows or disallows the FIPS algorithm policy -- **SSL cipher suites** Specifies a list of the allowed cryptographic cipher algorithms for SSL connections -- **Restrict app data to the system volume** Specifies whether app data is restricted to the system drive -- **Restrict apps to the system volume** Specifies whether apps are restricted to the system drive - - -## Apps - -*Applies to: Corporate and personal devices* - -User productivity on mobile devices is often driven by apps. - -Windows 10 makes it possible to develop apps that work seamlessly across multiple devices using the Universal Windows Platform (UWP) for Windows apps. UWP converges the application platform for all devices running Windows 10 so that apps run without modification on all editions of Windows 10. This saves developers both time and resources, helping deliver apps to mobile users more quickly and efficiently. This write-once, run-anywhere model also boosts user productivity by providing a consistent, familiar app experience on any device type. - -For compatibility with existing apps, Windows Phone 8.1 apps still run on Windows 10 Mobile devices, easing the migration to the newest platform. Microsoft recommend migrating your apps to UWP to take full advantage of the improvements in Windows 10 Mobile. In addition, bridges have been developed to easily and quickly update existing Windows Phone 8.1 (Silverlight) and iOS apps to the UWP. - -Microsoft also made it easier for organizations to license and purchase UWP apps via Microsoft Store for Business and deploy them to employee devices using the Microsoft Store, or an MDM system, that can be integrated with the Microsoft Store for Business. Putting apps into the hands of mobile workers is critical, but you also need an efficient way to ensure those apps comply with corporate policies for data security. - -To learn more about Universal Windows apps, see the [Guide to Universal Windows Platform (UWP) apps](/windows/uwp/get-started/universal-application-platform-guide) for additional information, or take this [Quick Start Challenge: Universal Windows Apps in Visual Studio](https://mva.microsoft.com/en-US/training-courses/quick-start-challenge-universal-windows-apps-in-visual-studio-14477?l=Be2FMfgmB_505192797). Also, see [Porting apps to Windows 10](/windows/uwp/porting/). - -### Microsoft Store for Business: Sourcing the right app - -*Applies to: Corporate and personal devices* - -The first step in app management is to obtain the apps your users need. You can develop your own apps or source your apps from the Microsoft Store. With Windows Phone 8.1, an MSA was needed to acquire and install apps from the Microsoft Store. With the Microsoft Store for Business, Microsoft enables organizations to acquire apps for employees from a private store with the Microsoft Store, without the need for MSAs on Windows 10 devices. - -Microsoft Store for Business is a web portal that allows IT administrators to find, acquire, manage, and distribute apps to Windows 10 devices. - -Azure AD authenticated managers have access to Microsoft Store for Business functionality and settings, and store managers can create a private category of apps that are specific and private to their organization. (You can get more details about what specific Azure AD accounts have access to Microsoft Store for Business here). Microsoft Store for Business enables organizations to purchase app licenses for their organization and make apps available to their employees. In addition to commercially available apps, your developers can publish line-of-business (LOB) apps to Microsoft Store for Business by request. You can also integrate their Microsoft Store for Business subscriptions with their MDM systems, so the MDM system can distribute and manage apps from Microsoft Store for Business. - -Microsoft Store for Business supports app distribution under two licensing models: online and offline. - -The online model (store-managed) is the recommended method, and supports both personal device and corporate device management scenarios. To install online apps, the device must have Internet access at the time of installation. On corporate devices, an employee can be authenticated with an Azure AD account to install online apps. On personal devices, an employee must register their device with Azure AD to be able to install corporate licensed online apps. -Corporate device users can find company licensed apps in the Store app on their phone in a private catalog. When an MDM system is associated with the Store for Business, IT administrators can present Store apps within the MDM system App Catalog where users can find and install their desired apps. IT administrators can also push required apps directly to employee devices without the employee’s intervention. - -Employees with personal devices can install apps licensed by their organization using the Store app on their device. They can use either the Azure AD account or Microsoft Account within the Store app if they wish to purchase personal apps. If you allow employees with corporate devices to add a secondary Microsoft Account (MSA), the Store app on the device provides a unified method for installing personal and corporate apps. - -Online licensed apps do not need to be transferred or downloaded from the Microsoft Store to the MDM system to be distributed and managed. When an employee chooses a company-owned app, it's automatically installed from the cloud. Also, apps are automatically updated when a new version is available or can be removed if needed. When an app is removed from a device by the MDM system or the user, Microsoft Store for Business reclaims the license so it can be used for another user or on another device. - -To distribute an app offline (organization-managed), the app must be downloaded from the Microsoft Store for Business. This can be accomplished in the Microsoft Store for Business portal by an authorized administrator. Offline licensing requires the app developer to opt-in to the licensing model, as the Microsoft Store is no longer able to track licenses for the developer. If the app developer doesn’t allow download of the app from Microsoft Store, then you must obtain the files directly from the developer or use the online licensing method. - -To install acquired Microsoft Store or LOB apps offline on a Windows 10 Mobile device, IT administrators can use an MDM system. The MDM system distributes the app packages that you downloaded from Microsoft Store (also called sideloading) to Windows 10 Mobile devices. Support for offline app distribution depends on the MDM system you are using, so consult your MDM vendor documentation for details. You can fully automate the app deployment process so that no user intervention is required. - -Microsoft Store apps or LOB apps that have been uploaded to the Microsoft Store for Business are automatically trusted on all Windows devices, as they are cryptographically signed with Microsoft Store certificates. LOB apps that are uploaded to the Microsoft Store for Business are private to your organization and are never visible to other companies or consumers. If you do not want to upload your LOB apps, you have to establish trust for the app on your devices. To establish this trust, you’ll need to generate a signing certificate with your Public Key Infrastructure and add your chain of trust to the trusted certificates on the device (see the certificates section). You can install up to 20 self-signed LOB apps per device with Windows 10 Mobile. To install more than 20 apps on a device, you can purchase a signing certificate from a trusted public Certificate Authority, or upgrade your devices to Windows 10 edition. - -For more information, see [Microsoft Store for Business](/microsoft-store/index). - -### Managing apps - -*Applies to: Corporate devices* - -IT administrators can control which apps are allowed to be installed on Windows 10 Mobile devices and how they should be kept up-to-date. - -Windows 10 Mobile includes AppLocker, which enables administrators to create allowlists or disallow lists of apps from the Microsoft Store. This capability extends to built-in apps, as well, such as Xbox, Groove, text messaging, email, and calendar, etc. The ability to allow or deny apps helps to ensure that people use their mobile devices for their intended purposes. However, it is not always an easy approach to find a balance between what employees need or request and security concerns. Creating allowlists or disallow lists also requires keeping up with the changing app landscape in the Microsoft Store. - -For more information, see [AppLocker CSP](./mdm/applocker-csp.md). - -In addition to controlling which apps are allowed, IT professionals can also implement additional app management settings on Windows 10 Mobile, using an MDM: - -- **Allow All Trusted Apps** Specifies whether users can sideload apps on the device. -- **Allow App Store Auto Update** Specifies whether automatic updates of apps from Microsoft Store are allowed. -- **Allow Developer Unlock** Specifies whether developer unlock is allowed. -- **Allow Shared User App Data** Specifies whether multiple users of the same app can share data. -- **Allow Store** Specifies whether Microsoft Store app is allowed to run. This completely blocks the user from installing apps from the Store, but still allows app distribution through an MDM system. -- **Application Restrictions** An XML blob that defines the app restrictions for a device. The XML blob can contain an app allowlist or deny list. You can allow or deny apps based on their app ID or publisher. See AppLocker above. -- **Disable Store Originated Apps** Disables the launch of all apps from Microsoft Store that came pre-installed or were downloaded before the policy was applied. -- **Require Private Store Only** Specifies whether the private store is exclusively available to users in the Store app on the device. If enabled, only the private store is available. If disabled, the retail catalog and private store are both available. -- **Restrict App Data to System Volume** Specifies whether app data is allowed only on the system drive or can be stored on an SD card. -- **Restrict App to System Volume** Specifies whether app installation is allowed only to the system drive or can be installed on an SD card. -- **Start screen layout** An XML blob used to configure the Start screen (for more information, see [Start layout for Windows 10 Mobile](/windows/configuration/mobile-devices/start-layout-xml-mobile)). - -Find more details on application management options in the [Policy CSP](./mdm/policy-configuration-service-provider.md). - -### Data leak prevention - -*Applies to: Corporate and personal devices* - -One of the biggest challenges in protecting corporate information on mobile devices is keeping that data separate from personal data. Most solutions available to create this data separation require users to login in with a separate username and password to a container that stores all corporate apps and data, an experience that degrades user productivity. - -Windows 10 Mobile includes Windows Information Protection to transparently keep corporate data protected and personal data private. It automatically tags personal and corporate data and applies policies for those apps that can access data classified as corporate. This includes when data is at rest on local or removable storage. Because corporate data is always protected, users cannot copy it to public locations like social media or personal email. - -Windows Information Protection works with all apps, which are classified into two categories: enlightened and unenlightened. Enlightened apps can differentiate between corporate and personal data, correctly determining which to protect based on policies. Corporate data is encrypted at all times and any attempt to copy/paste or share this information with non-corporate apps or users fails. Unenlightened apps consider all data corporate and encrypt everything by default. - -Any app developed on the UWA platform can be enlightened. Microsoft has made a concerted effort to enlighten several of its most popular apps, including: -- Microsoft Edge -- Microsoft People -- Mobile Office apps (Word, Excel, PowerPoint, and OneNote) -- Outlook Mail and Calendar -- Microsoft Photos -- Microsoft OneDrive -- Groove Music -- Microsoft Movies & TV -- Microsoft Messaging - -The following table lists the settings that can be configured for Windows Information Protection: -- **Enforcement level*** Set the enforcement level for information protection: - - Off (no protection) - - Silent mode (encrypt and audit only) - - Override mode (encrypt, prompt, and audit) - - Block mode (encrypt, block, and audit) -- **Enterprise protected domain names*** A list of domains used by the enterprise for its user identities. User identities from one of these domains is considered an enterprise managed account and data associated with it should be protected. -- **Allow user decryption** Allows the user to decrypt files. If not allowed, the user is not able to remove protection from enterprise content through the OS or app user experience. -- **Require protection under lock configuration** Specifies whether the protection under lock feature (also known as encrypt under PIN) should be configured. -- **Data recovery certificate*** Specifies a recovery certificate that can be used for data recovery of encrypted files. This is the same as the data recovery agent (DRA) certificate for encrypting file system (EFS), only delivered through MDM instead of Group Policy. -- **Revoke on unenroll** Specifies whether to revoke the information protection keys when a device unenrolls from the management service. -- **RMS template ID for information protection** Allows the IT admin to configure the details about who has access to RMS-protected files and for how long. -- **Allow Azure RMS for information protection** Specifies whether to allow Azure RMS encryption for information protection. -- **Show information protection icons** Determines whether overlays are added to icons for information protection secured files in web browser and enterprise-only app tiles in the **Start** menu. -- **Status** A read-only bit mask that indicates the current state of information protection on the device. The MDM service can use this value to determine the current overall state of information protection. -- **Enterprise IP Range*** The enterprise IP ranges that define the computers in the enterprise network. Data that comes from those computers is considered part of the enterprise and protected. -- **Enterprise Network Domain Names*** the list of domains that comprise the boundaries of the enterprise. Data from one of these domains that is sent to a device is considered enterprise data and is protected. -- **Enterprise Cloud Resources** A list of Enterprise resource domains hosted in the cloud that need to be protected. - -* Mandatory Windows Information Protection policies. To make Windows Information Protection functional, AppLocker and network isolation settings (specifically Enterprise IP Range and Enterprise Network Domain Names) must be configured. This defines the source of all corporate data that needs protection and also ensures data written to these locations won’t be encrypted by the user’s encryption key so that others in the company can access it. - -For more information on Windows Information Protection, see the [EnterpriseDataProtection CSP](./mdm/enterprisedataprotection-csp.md) and the following in-depth article series [Protect your enterprise data using Windows Information Protection](/windows/threat-protection/windows-information-protection/protect-enterprise-data-using-wip). - -### Managing user activities - -*Applies to: Corporate devices* - -On corporate devices, some user activities expose corporate data to unnecessary risk. For example, users might create a screen capture of corporate information out of an internal LOB app. To mitigate the risk, you can restrict the Windows 10 Mobile user experience to help protect corporate data and prevent data leaks. The following demonstrates those capabilities that can be used to help prevent data leaks: - -- **Allow copy and paste** Specifies whether users can copy and paste content -- **Allow Cortana** Specifies whether users can use Cortana on the device (where available) -- **Allow device discovery** Specifies whether the device discovery user experience is available on the lock screen (for example, controlling whether a device could discover a projector [or other devices] when the lock screen is displayed) -- **Allow input personalization** Specifies whether personally identifiable information can leave the device or be saved locally (e.g., Cortana learning, inking, dictation) -- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (i.e., unenroll the device from the MDM system) -- **Allow screen capture** Specifies whether users are allowed to capture screenshots on the device -- **Allow SIM error dialog prompt** Specifies whether to display a dialog prompt when no SIM card is installed -- **Allow sync my settings** Specifies whether the user experience settings are synchronized between devices (works with Microsoft accounts only) -- **Allow toasts notifications above lock screen** Specifies whether users are able to view toast notification on the device lock screen -- **Allow voice recording** Specifies whether users are allowed to perform voice recordings -- **Do Not Show Feedback Notifications** Prevents devices from showing feedback questions from Microsoft -- **Allow Task Switcher** Allows or disallows task switching on the device to prevent visibility of App screen tombstones in the task switcher -- **Enable Offline Maps Auto Update** Disables the automatic download and update of map data -- **Allow Offline Maps Download Over Metered Connection** Allows the download and update of map data over metered connections - -You can find more details on the experience settings in Policy CSP. - -### Microsoft Edge - -*Applies to: Corporate and personal devices* - -MDM systems also give you the ability to manage Microsoft Edge on mobile devices. Microsoft Edge is the only browser available on Windows 10 Mobile devices. It differs slightly from the desktop version as it does not support Flash or Extensions. Edge is also an excellent PDF viewer as it can be managed and integrates with Windows Information Protection. - -The following settings for Microsoft Edge on Windows 10 Mobile can be managed: - -- **Allow Browser** Specifies whether users can run Microsoft Edge on the device -- **Allow Do Not Track headers** Specifies whether Do Not Track headers are allowed -- **Allow InPrivate** Specifies whether users can use InPrivate browsing -- **Allow Password Manager** Specifies whether users can use Password Manager to save and manage passwords locally -- **Allow Search Suggestions in Address Bar** Specifies whether search suggestions are shown in the address bar -- **Allow Windows Defender SmartScreen** Specifies whether Windows Defender SmartScreen is enabled -- **Cookies** Specifies whether cookies are allowed -- **Favorites** Configure Favorite URLs -- **First Run URL** The URL to open when a user launches Microsoft Edge for the first time -- **Prevent Windows Defender SmartScreen Prompt Override** Specifies whether users can override the Windows Defender SmartScreen warnings for URLs -- **Prevent Smart Screen Prompt Override for Files** Specifies whether users can override the Windows Defender SmartScreen warnings for files - -## Manage - -In enterprise IT environments, the need for security and cost control must be balanced against the desire to provide users with the latest technologies. Since cyberattacks have become an everyday occurrence, it is important to properly maintain the state of your Windows 10 Mobile devices. IT needs to control configuration settings, keeping them from drifting out of compliance, as well as enforce which devices can access internal applications. Windows 10 Mobile delivers the mobile operations management capabilities necessary to ensure that devices are in compliance with corporate policy. - -### Servicing options - -#### A streamlined update process - -*Applies to: Corporate and personal devices* - -Microsoft has streamlined the Windows product engineering and release cycle so new features, experiences, and functionality demanded by the market can be delivered more quickly than ever before. Microsoft plans to deliver two Feature Updates per year (12-month period). Feature Updates establish a Current Branch or CB, and have an associated version. - - ----- - - - - - - - - - - - - - - - - - - - - - - -
BranchVersionRelease Date
Current Branch1511November 2015
Current Branch for Business1511March 2016
Current Branch1607July 2016
- -Microsoft also delivers and installs monthly updates for security and stability directly to Windows 10 Mobile devices. These Quality Updates, released under Microsoft control via Windows Update, are available for all devices running Windows 10 Mobile. Windows 10 Mobile devices consume Feature Updates and Quality Updates as part of the same standard update process. - -Quality Updates are usually smaller than Feature Updates, but the installation process and experience is very similar, though larger updates take more time to install. Enterprise customers can manage the update experience and process on Windows 10 Mobile devices using an MDM system, after upgrading the devices to Enterprise edition. In most cases, policies to manage the update process apply to both feature and quality updates. - -Microsoft aspires to update Windows 10 Mobile devices with the latest updates automatically and without being disruptive for all customers. Out-of-the-box, a Windows 10 Mobile device uses Auto Scan to search for available updates. However, depending on the device’s network and power status, update methods and timing may vary. - - -------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Network connectionDescriptionAuto ScanAuto DownloadAuto InstallAuto Restart
Wi-FiDevice is connected to a personal or corporate Wi-Fi network (no data charges)YesYes/td> -YesYes – outside of Active Hours (forced restart after 7 days if user postpones restart)
CellularDevice is only connected to a cellular network (standard data charges apply)Skips a daily scan if scan was successfully completed in the last 5 daysOnly occurs if update package is small and does not exceed the mobile operator data limit.YesIdem
Cellular -- RoamingDevice is only connected to a cellular network and roaming charges applyNoNoNoIdem
- -#### Keeping track of updates releases - -*Applies to: Corporate and Personal devices* - -Microsoft publishes new feature updates for Windows 10 and Windows 10 Mobile on a regular basis. The [Windows release information page](https://technet.microsoft.com/windows/release-info) is designed to help you determine if your devices are current with the latest Windows 10 feature and quality updates. The release information published on this page, covers both Windows 10 for PCs and Windows 10 Mobile. In addition, the [Windows update history page](https://windows.microsoft.com/en-us/windows-10/update-history-windows-10) helps you understand what these updates are about. - -> [!NOTE] -> We invite IT Professionals to participate in the Windows Insider Program to test updates before they are officially released to make Windows 10 Mobile even better. If you find any issues, please send us feedback by using the Feedback Hub. - -#### Windows as a Service - -*Applies to: Corporate and Personal devices* - -Microsoft created a new way to deliver and install updates to Windows 10 Mobile directly to devices without Mobile Operator approval. This capability helps to simplify update deployments and ongoing management, broadens the base of employees who can be kept current with the latest Windows features and experiences, and lowers total cost of ownership for organizations who no longer have to manage updates to keep devices secure. - -Update availability depends on what servicing option you choose for the device. These servicing options are outlined in the following chart. - - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Servicing optionAvailability of new features for installationMinimum length of servicing lifetimeKey benefitsSupported editions
Windows Insider BuildsAs appropriate during development cycle, released to Windows Insiders onlyVariable, until the next Insider build is released to Windows InsidersAllows Insiders to test new feature and application compatibility before a Feature Update is released/td> -Mobile
Current Branch (CB)Immediately after the Feature Update is published to Windows Update by MicrosoftMicrosoft typically releases two Feature Updates per 12-month period (approximately every four months, though it can potentially be longer)Makes new features available to users as soon as possible
Current Branch for Business (CBB)A minimum of four months after the corresponding Feature Update is first published to Windows Update by MicrosoftA minimum of four months, though it potentially can be longerNoProvides additional time to test new feature before deployment
- -#### Enterprise edition - -*Applies to: Corporate devices* - -While Windows 10 Mobile provides updates directly to user devices from Windows Update, there are many organizations that want to track, test, and schedule updates to corporate devices. To support these requirements, we created the Windows 10 edition. - -Upgrading to Windows 10 edition provides additional device and app management capabilities for organizations that want to: -- **Defer, approve and deploy feature and quality updates:** Windows 10 Mobile devices get updates directly from Windows Update. If you want to curate updates prior to deploying them, an upgrade to Windows 10 edition is required. Once Enterprise edition is enabled, the phone can be set to the Current Branch for Business servicing option, giving IT additional time to test updates before they are released. -- **Deploy an unlimited number of self-signed LOB apps to a single device:** To use an MDM system to deploy LOB apps directly to devices, you must cryptographically sign the software packages with a code signing certificate that your organization’s certificate authority (CA) generates. You can deploy a maximum of 20 self-signed LOB apps to a Windows 10 Mobile device. To deploy more than 20 self-signed LOB apps, Windows 10 is required. -- **Set the diagnostic data level:** Microsoft collects diagnostic data to help keep Windows devices secure and to help Microsoft improve the quality of Windows and Microsoft services. An upgrade to Windows 10 Mobile Enterprise edition is required to set the diagnostic data level so that only diagnostic information required to keep devices secured is gathered. - -To learn more about diagnostic, see [Configure Windows diagnostic data in your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization). - -To activate Windows 10 Mobile Enterprise, use your MDM system or a provisioning package to inject the Windows 10 Enterprise license on a Windows 10 Mobile device. Licenses can be obtained from the Volume Licensing portal. For testing purposes, you can obtain a licensing file from the MSDN download center. A valid MSDN subscription is required. - -For more information on updating a device to Enterprise edition, see [WindowsLicensing CSP](./mdm/windowslicensing-csp.md). - -> [!NOTE] -> We recommend using Enterprise edition only on corporate devices. Once a device has been upgraded, it cannot be downgraded. Even a device wipe or reset will not remove the enterprise license from personal devices. - -#### Deferring and approving updates with MDM - -*Applies to: Corporate devices with Enterprise edition* - -Once a device is upgraded to Windows 10 Mobile Enterprise edition, you can manage devices that receive updates from Windows Update (or Windows Update for Business) with a set of update policies. - -To control Feature Updates, you will need to move your devices to the Current Branch for Business (CBB) servicing option. A device that subscribes to CBB will wait for the next CBB to be published by Microsoft Update. While the device will wait for Feature Updates until the next CBB, Quality Updates will still be received by the device. - -To control monthly Quality Update additional deferral policies, need to be set to your desired deferral period. When Quality Updates are available for your Windows 10 Mobile devices from Windows Update, these updates will not install until your deferral period lapses. This gives IT Professionals some time to test the impact of the updates on devices and apps. - -Before updates are distributed and installed, you may want to test them for issues or application compatibility. IT pros have the ability require updates to be approved. This enables the MDM administrator to select and approve specific updates to be installed on a device and accept the EULA associated with the update on behalf of the user. Please remember that on Windows 10 Mobile all updates are packaged as a “OS updates” and never as individual fixes. - -You may want to choose to handle Quality Updates and Feature Updates in the same way and not wait for the next CBB to be released to your devices. This streamlines the release of updates using the same process for approval and release. You can apply different deferral period by type of update. In version 1607 Microsoft added additional policy settings to enable more granularity to control over updates. - -Once updates are being deployed to your devices, you may want to pause the rollout of updates to enterprise devices. -For example, after you start rolling out a quality update, certain phone models are adversely impacted or users are reporting a specific LOB app is not connecting and updating a database. Problems can occur that did not surface during initial testing. -IT professionals can pause updates to investigate and remediate unexpected issues. - -The following table summarizes applicable update policy settings by version of Windows 10 Mobile. All policy settings are backward compatible, and will be maintained in future Feature Updates. Consult the documentation of your MDM system to understand support for these settings in your MDM. - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - -
Activity (Policy)Version 1511 settingsVersion 1607 settings
Subscribe device to CBB, to defer Feature UpdatesRequireDeferUpgrade - -Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). -Defers feature update for minimum of 4 months after Current Branch was release.BranchReadinessLevel - -Defers Feature Update until next CBB release. Device receives quality updates from Current Branch for Business (CBB). -Defers feature update for minimum of 4 months after Current Branch was release.
Defer UpdatesDeferUpdatePeriod - -Defer Quality Updates for 4 weeks or 28 daysDeferQualityUpdatePeriodInDays - -Defer Feature and Quality Updates for up to 30 days.
Approve UpdatesRequireUpdateApproval - -RequireUpdateApproval - -
Pause Update rollout once an approved update is being deployed, pausing the rollout of the update.PauseDeferrals - -Pause Feature Updates for up to 35 daysPauseQualityUpdates - -Pause Feature Updates for up to 35 days
- -#### Managing the update experience - -*Applies to: Corporate devices with Enterprise edition* - -Set update client experience with [Allowautomaticupdate](./mdm/policy-configuration-service-provider.md) policy for your employees. This allows the IT Pro to influence the way the update client on the devices behaves when scanning, downloading, and installing updates. - -This can include: -- Notifying users prior to downloading updates. -- Automatically downloading updates, and then notifying users to schedule a restart (this is the default behavior if this policy is not configured). -- Automatically downloading and restarting devices with user notification. -- Automatically downloading and restarting devices at a specified time. -- Automatically downloading and restarting devices without user interaction. -- Turning off automatic updates. This option should be used only for systems under regulatory compliance. The device does not receive any updates. - -In addition, in version 1607, you can configure when the update is applied to the employee device to ensure updates installs or reboots don’t interrupt business or worker productivity. Update installs and reboots can be scheduled [outside of active hours](./mdm/policy-configuration-service-provider.md) (supported values are 0-23, where 0 is 12am, 1 is 1am, and so on) or on a specific [day of the week](./mdm/policy-configuration-service-provider.md) (supported values are 0-7, where 0 is every day, 1 is Sunday, 2 is Monday, and so on). - -#### Managing the source of updates with MDM - -*Applies to: Corporate devices with Enterprise edition* - -Although Windows 10 Enterprise enables IT administrators to defer installation of new updates from Windows Update, enterprises may also want additional control over update processes. With this in mind, Microsoft created Windows Update for Business. Microsoft designed Windows Update for Business to provide IT administrators with additional Windows Update-centric management capabilities, such as the ability to deploy updates to groups of devices and to define maintenance windows for installing updates. If you are using a MDM system, the use of Windows Update for Business is not a requirement, as you can manage these features from your MDM system. - -For more information, see [Windows Update for Business](/windows/deployment/update/waas-manage-updates-wufb). - -IT administrators can specify where the device gets updates from with AllowUpdateService. This could be Microsoft Update, Windows Update for Business, or Windows Server Update Services (WSUS). - -#### Managing Updates with Windows Update Server - -*Applies to: Corporate devices with Enterprise edition* - -When using WSUS, set **UpdateServiceUrl** to allow the device to check for updates from a WSUS server instead of Windows Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet, usually handheld devices used for task completion, or other Windows IoT devices. - -For more information, see [managing updates with Windows Server Update Services (WSUS)](/windows/deployment/deploy-whats-new). - -#### Querying the device update status - -*Applies to: Personal and corporate devices* - -In addition to configuring how Windows 10 Mobile Enterprise obtains updates, the MDM administrator can query devices for Windows 10 Mobile update information so that update status can be checked against a list of approved updates: - -The device update status query provides an overview of: -- Installed updates: A list of updates that are installed on the device. -- Installable updates: A list of updates that are available for installation. -- Failed updates: A list of updates that failed during installation, including indication of why the update failed. -- Pending reboot: A list of updates that require a restart to complete update installation. -- Last successful scan time: The last time a successful update scan was completed. -- Defer upgrade: Whether the upgrade is deferred until the next update cycle. - -### Device health - -*Applies to: Personal and corporate devices* - -Device Health Attestation (DHA) is another line of defense that is new to Windows 10 Mobile. It can be used to remotely detect devices that lack a secure configuration or have vulnerabilities that could allow them to be easily exploited by sophisticated attacks. - -Windows 10 Mobile makes it easy to integrate with Microsoft Intune or third-party MDM solutions for an overall view of device health and compliance. Using these solutions together, you can detect jailbroken devices, monitor device compliance, generate compliance reports, alert users or administrators to issues, initiate corrective action, and manage conditional access to resources like Office 365 or VPN. - -The first version of DHA was released in June 2015 for Windows 10 devices that supported TPM 2.0 and operated in an enterprise cloud-based topology. In the Windows 10 anniversary release, DHA capabilities are extended to legacy devices that support TPM 1.2, hybrid, and on-premises environments that have access to the Internet or operate in an air-gapped network. - -The health attestation feature is based on Open Mobile Alliance (OMA) standards. IT managers can use DHA to validate devices that: -- Run Windows 10 operating system (mobile phone or PC) -- Support Trusted Module Platform (TPM 1.2 or 2.0) in discrete of firmware format -- Are managed by a DHA-enabled device management solution (Intune or third-party MDM) -- Operate in cloud, hybrid, on-premises, and BYOD scenarios - -DHA-enabled device management solutions help IT managers create a unified security bar across all managed Windows 10 Mobile devices. This allows IT managers to: -- Collect hardware attested data (highly assured) data remotely -- Monitor device health compliance and detect devices that are vulnerable or could be exploited by sophisticated attacks -- Take actions against potentially compromised devices, such as: -- Trigger corrective actions remotely so offending device is inaccessible (lock, wipe, or brick the device) -- Prevent the device from getting access to high-value assets (conditional access) -- Trigger further investigation and monitoring (route the device to a honeypot for further monitoring) -- Simply alert the user or the admin to fix the issue - -> [!NOTE] -> Windows Device Health Attestation Service can be used for conditional access scenarios that may be enabled by Mobile Device Management solutions (such as Microsoft Intune) and other types of management systems (such as SCCM) purchased separately. - -For more information about health attestation in Windows 10 Mobile, see the [Windows 10 Mobile security guide](/windows/device-security/windows-10-mobile-security-guide). - -This is a list of attributes that are supported by DHA and can trigger the corrective actions mentioned above: -- **Attestation Identity Key (AIK) present** Indicates that an AIK is present (i.e., the device can be trusted more than a device without an AIK). -- **Data Execution Prevention (DEP) enabled** Specifies whether a DEP policy is enabled for the device, indicating that the device can be trusted more than a device without a DEP policy. -- **BitLocker status** BitLocker helps protect the storage on the device. A device with BitLocker can be trusted more than a device without BitLocker. -- **Secure Boot enabled** Specifies whether Secure Boot is enabled on the device. A device with Secure Boot enabled can be trusted more than a device without Secure Boot. Secure Boot is always enabled on Windows 10 Mobile devices. -- **Code integrity enabled** Specifies whether the code integrity of a drive or system file is validated each time it’s loaded into memory. A device with code integrity enabled can be trusted more than a device without code integrity. -- **Safe mode** Specifies whether Windows is running in safe mode. A device that is running Windows in safe mode isn’t as trustworthy as a device running in standard mode. -- **Boot debug enabled** Specifies whether the device has boot debug enabled. A device that has boot debug enabled is less secure (trusted) than a device without boot debug enabled. -- **OS kernel debugging enabled** Specifies whether the device has operating system kernel debugging enabled. A device that has operating system kernel debugging enabled is less secure (trusted) than a device with operating system kernel debugging disabled. -- **Test signing enabled** Specifies whether test signing is disabled. A device that has test signing disabled is more trustworthy than a device that has test signing enabled. -- **Boot Manager Version** The version of the Boot Manager running on the device. The HAS can check this version to determine whether the most current Boot Manager is running, which is more secure (trusted). -- **Code integrity version** Specifies the version of code that is performing integrity checks during the boot sequence. The HAS can check this version to determine whether the most current version of code is running, which is more secure (trusted). -- **Secure Boot Configuration Policy (SBCP) present** Specifies whether the hash of the custom SBCP is present. A device with an SBCP hash present is more trustworthy than a device without an SBCP hash. -- **Boot cycle allowlist** The view of the host platform between boot cycles as defined by the manufacturer compared to a published allowlist. A device that complies with the allowlist is more trustworthy (secure) than a device that is noncompliant. - -#### Example scenario - -Windows 10 mobile has protective measures that work together and integrate with Microsoft Intune or third-party Mobile Device Management (MDM) solutions. IT administrators can monitor and verify compliance to ensure corporate resources are protected end-to–end with the security and trust rooted in the physical hardware of the device. - -Here is what occurs when a smartphone is turned on: -1. Windows 10 Secure Boot protects the boot sequence, enables the device to boot into a defined and trusted configuration, and loads a factory trusted boot loader. -2. Windows 10 Trusted Boot takes control, verifies the digital signature of the Windows kernel, and the components are loaded and executed during the Windows startup process. -3. In parallel to Steps 1 and 2, Windows 10 Mobile TPM (Trusted Platform Modules – measured boot) runs independently in a hardware-protected security zone (isolated from boot execution path monitors boot activities) to create an integrity protected and tamper evident audit trail - signed with a secret that is only accessible by TPM. -4. Devices managed by a DHA-enabled MDM solution send a copy of this audit trail to Microsoft Health Attestation Service (HAS) in a protected, tamper-resistant, and tamper-evident communication channel. -5. Microsoft HAS reviews the audit trails, issues an encrypted/signed report, and forwards it to the device. -6. IT managers can use a DHA-enabled MDM solution to review the report in a protected, tamper-resistant and tamper-evident communication channel. They can assess if a device is running in a compliant (healthy) state, allow access, or trigger corrective action aligned with security needs and enterprise policies. - -### Asset reporting - -*Applies to: Corporate devices with Enterprise edition* - -Device inventory helps organizations better manage devices because it provides in-depth information about those devices. MDM systems collect inventory information remotely and provide reporting capabilities to analyze device resources and information. This data informs IT about the current hardware and software resources of the device (such as installed updates). - -The following list shows examples of the Windows 10 Mobile software and hardware information that a device inventory provides. In addition to this information, the MDM system can read any of the configuration settings described in this guide: - -- **Installed enterprise apps** List of the enterprise apps installed on the device -- **Device name** The device name configured for the device -- **Firmware version** Version of firmware installed on the device -- **Operating system version** Version of the operating system installed on the device -- **Device local time** Local time on the device -- **Processor type** Processor type for the device -- **Device model** Model of the device as defined by the manufacturer -- **Device manufacturer** Manufacturer of the device -- **Device processor architecture** Processor architecture for the device -- **Device language** Language in use on the device -- **Phone number** Phone number assigned to the device -- **Roaming status** Indicates whether the device has a roaming cellular connection -- **International mobile equipment identity (IMEI) and international mobile subscriber identity (IMSI)** Unique identifiers for the cellular connection for the phone (Global System for Mobile Communications networks identify valid devices by using the IMEI, and all cellular networks use the IMSI to identify the device and user) -- **Wi-Fi IP address** IPv4 and IPv6 addresses currently assigned to the Wi-Fi adapter in the device -- **Wi-Fi media access control (MAC) address** MAC address assigned to the Wi-Fi adapter in the device -- **Wi-Fi DNS suffix and subnet mask** DNS suffix and IP subnet mask assigned to the Wi-Fi adapter in the device -- **Secure Boot state** Indicates whether Secure Boot is enabled -- **Enterprise encryption policy compliance** Indicates whether the device is encrypted - -### Manage diagnostic data - -*Applies to: Corporate devices with Windows 10 Mobile Enterprise edition* - -Microsoft uses diagnostics, performance, and usage data from Windows devices to help inform decisions and focus efforts to provide the most robust and valuable platform for your business and the people who count on Windows to enable them to be as productive as possible. Diagnostic data helps keep Windows devices healthy, improve the operating system, and personalize features and services. - -You can control the level of data that diagnostic data systems collect. To configure devices, specify one of these levels in the Allow Telemetry setting with your MDM system. - -For more information, see [Configure Windows diagnostic data in Your organization](/windows/configuration/configure-windows-diagnostic-data-in-your-organization). - -> [!NOTE] -> Diagnostic data can only be managed when the device is upgraded to Windows 10 Mobile Enterprise edition. - -### Remote assistance - -*Applies to: Personal and corporate devices* - -The remote assistance features in Windows 10 Mobile help resolve issues that users might encounter even when the help desk does not have physical access to the device. These features include: -- **Remote lock** Support personnel can remotely lock a device. This ability can help when a user loses his or her mobile device and can retrieve it, but not immediately (such as leaving the device at a customer site). -- **Remote PIN reset** Support personnel can remotely reset the PIN, which helps when users forget their PIN and are unable to access their device. No corporate or user data is lost and users are able to quickly gain access to their devices. -- **Remote ring** Support personnel can remotely make devices ring. This ability can help users locate misplaced devices and, in conjunction with the Remote Lock feature, help ensure that unauthorized users are unable to access the device if they find it. -- **Remote find** Support personnel can remotely locate a device on a map, which helps identify the geographic location of the device. Remote find parameters can be configured via phone settings (see table below). The remote find feature returns the most current latitude, longitude, and altitude of the device. - -**Remote assistance policies** -- **Desired location accuracy** The desired accuracy as a radius value in meters; has a value between 1 and 1,000 meters -- **Maximum remote find** Maximum length of time in minutes that the server will accept a successful remote find; has a value between 0 and 1,000 minutes -- **Remote find timeout** The number of seconds devices should wait for a remote find to finish; has a value between 0 and 1,800 seconds - -These remote management features help organizations reduce the IT effort required to manage devices. They also help users quickly regain use of their device should they misplace it or forget the device password. - -> [!NOTE] -> Microsoft does not provide build-in remote control software, but works with partners to deliver these capabilities and services. With version 1607, remote assistant and control applications are available in the Microsoft Store. - -## Retire - -*Applies to: Corporate and Personal devices* - -Device retirement is the last phase of the device lifecycle, which in today’s business environment averages about 18 months. After that time period, employees want the productivity and performance improvements that come with the latest hardware. It’s important that devices being replaced with newer models are securely retired since you don’t want any company data to remain on discarded devices that could compromise the confidentiality of your data. This is typically not a problem with corporate devices, but it can be more challenging in a personal device scenario. You need to be able to selectively wipe all corporate data without impacting personal apps and data on the device. IT also needs a way to adequately support users who need to wipe devices that are lost or stolen. - -Windows 10 Mobile IT supports device retirement in both personal and corporate scenarios, allowing IT to be confident that corporate data remains confidential and user privacy is protected. - -> [!NOTE] -> All these MDM capabilities are in addition to the device’s software and hardware factory reset features, which employees can use to restore devices to their factory configuration. - -**Personal devices:** Windows 10 mobile supports the USA regulatory requirements for a “kill switch” in case your phone is lost or stolen. Reset protection is a free service on account.microsoft.com that helps ensure that the phone cannot be easily reset and reused. All you need to do to turn on **Reset Protection** is sign in with your Microsoft account and accept the recommended settings. To manually turn it on, you can find it under Settings > Updates & security > Find my phone. At this point, Reset Protection is only available with an MSA, not with Azure AD account. It is also only available in the USA and not in other regions of the world. - -If you choose to completely wipe a device when lost or when an employee leaves the company, make sure you obtain consent from the user and follow any local legislation that protects the user’s personal data. - -A better option than wiping the entire device is to use Windows Information Protection to clean corporate-only data from a personal device. As explained in the Apps chapter, all corporate data is tagged and when the device is unenrolled from your MDM system of your choice, all enterprise encrypted data, apps, settings and profiles are immediately removed from the device without affecting the employee’s existing personal data. A user can initiate unenrollment via the settings screen or unenrollment action can be taken by IT from within the MDM management console. Unenrollment is a management event and is reported to the MDM system. - -**Corporate device:** You can certainly remotely expire the user’s encryption key in case of device theft, but please remember that also makes the encrypted data on other Windows devices unreadable for the user. A better approach for retiring a discarded or lost device is to execute a full device wipe. The help desk or device users can initiate a full device wipe. When the wipe is complete, Windows 10 Mobile returns the device to a clean state and restarts the OOBE process. - -**Settings for personal or corporate device retirement** -- **Allow manual MDM unenrollment** Specifies whether users are allowed to delete the workplace account (unenroll the device from the MDM system) -- **Allow user to reset phone** Specifies whether users are allowed to use Settings or hardware key combinations to return the device to factory defaults - - -## Related topics - -- [Mobile device management](./mdm/index.md) -- [Enterprise Mobility + Security](https://go.microsoft.com/fwlink/p/?LinkId=723984) -- [Overview of Mobile Device Management for Office 365](/microsoft-365/admin/basic-mobility-security/overview) -- [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=722910) - - -## Revision History - -- November 2015 Updated for Windows 10 Mobile (version 1511) -- August 2016 Updated for Windows 10 Mobile Anniversary Update (version 1607) From 8ddd2483f29e835a28386c98b46efc973f16f33a Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Thu, 12 Aug 2021 18:18:41 +0530 Subject: [PATCH 0021/1214] removed references to Windows 10 mobile --- .../change-history-for-update-windows-10.md | 2 +- windows/deployment/update/index.md | 1 - .../deployment/update/waas-configure-wufb.md | 4 -- windows/deployment/update/waas-restart.md | 2 +- windows/deployment/upgrade/submit-errors.md | 2 +- .../upgrade/windows-10-edition-upgrades.md | 6 +-- .../upgrade/windows-10-upgrade-paths.md | 53 +------------------ .../windows-adk-scenarios-for-it-pros.md | 2 +- 8 files changed, 6 insertions(+), 66 deletions(-) diff --git a/windows/deployment/update/change-history-for-update-windows-10.md b/windows/deployment/update/change-history-for-update-windows-10.md index e2ea19dc8e..1f326784c8 100644 --- a/windows/deployment/update/change-history-for-update-windows-10.md +++ b/windows/deployment/update/change-history-for-update-windows-10.md @@ -1,6 +1,6 @@ --- title: Change history for Update Windows 10 (Windows 10) -description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10 and Windows 10 Mobile. +description: This topic lists new and updated topics in the Update Windows 10 documentation for Windows 10. ms.prod: w10 ms.mktglfcycl: manage audience: itpro diff --git a/windows/deployment/update/index.md b/windows/deployment/update/index.md index f0fb882c47..3f72fde718 100644 --- a/windows/deployment/update/index.md +++ b/windows/deployment/update/index.md @@ -16,7 +16,6 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile > **Looking for consumer information?** See [Windows Update: FAQ](https://support.microsoft.com/help/12373/windows-update-faq) diff --git a/windows/deployment/update/waas-configure-wufb.md b/windows/deployment/update/waas-configure-wufb.md index 07e9ae9bde..31c1ef07ab 100644 --- a/windows/deployment/update/waas-configure-wufb.md +++ b/windows/deployment/update/waas-configure-wufb.md @@ -30,7 +30,6 @@ You can use Group Policy or your mobile device management (MDM) service to confi > [!IMPORTANT] > Beginning with Windows 10, version 1903, organizations can use Windows Update for Business policies, regardless of the diagnostic data level chosen. If the diagnostic data level is set to **0 (Security)**, Windows Update for Business policies will still be honored. For instructions, see [Configure the operating system diagnostic data level](/windows/configuration/configure-windows-diagnostic-data-in-your-organization#diagnostic-data-levels). -Some Windows Update for Business policies are not applicable or behave differently for devices running Windows 10 Mobile Enterprise. Specifically, policies pertaining to Feature Updates will not be applied to Windows 10 Mobile Enterprise. All Windows 10 Mobile updates are recognized as Quality Updates, and can only be deferred or paused using the Quality Update policy settings. Additional information is provided in this topic. ## Start by grouping devices @@ -129,9 +128,6 @@ Quality updates are typically published on the second Tuesday of every month, al You can set your system to receive updates for other Microsoft products—known as Microsoft updates (such as Microsoft Office, Visual Studio)—along with Windows updates by setting the **AllowMUUpdateService** policy. When you do this, these Microsoft updates will follow the same deferral and pause rules as all other quality updates. ->[!IMPORTANT] ->This policy defers both Feature and Quality Updates on Windows 10 Mobile Enterprise. - **Policy settings for deferring quality updates** | Policy | Sets registry key under HKLM\Software | diff --git a/windows/deployment/update/waas-restart.md b/windows/deployment/update/waas-restart.md index 000a86eb6f..62a5078e43 100644 --- a/windows/deployment/update/waas-restart.md +++ b/windows/deployment/update/waas-restart.md @@ -158,7 +158,7 @@ In the Group Policy editor, you will see a number of policy settings that pertai | Turn off auto-restart for updates during active hours | ![yes](images/checkmark.png) | Use this policy to configure active hours, during which the device will not be restarted. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | | Always automatically restart at the scheduled time | ![yes](images/checkmark.png) | Use this policy to configure a restart timer (between 15 and 180 minutes) that will start immediately after Windows Update installs important updates. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** policy is enabled. | | Specify deadline before auto-restart for update installation | ![yes](images/checkmark.png) | Use this policy to specify how many days (between 2 and 14) an automatic restart can be delayed. This policy has no effect if the **No auto-restart with logged on users for scheduled automatic updates installations** or **Always automatically restart at the scheduled time** policies are enabled. | -| No auto-restart with logged on users for scheduled automatic updates installations | ![yes](images/checkmark.png) | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates.
There is no equivalent MDM policy setting for Windows 10 Mobile. | +| No auto-restart with logged on users for scheduled automatic updates installations | ![yes](images/checkmark.png) | Use this policy to prevent automatic restart when a user is logged on. This policy applies only when the **Configure Automatic Updates** policy is configured to perform scheduled installations of updates. | | Re-prompt for restart with scheduled installations | ![no](images/crossmark.png) | | | Delay Restart for scheduled installations | ![no](images/crossmark.png) | | | Reschedule Automatic Updates scheduled installations | ![no](images/crossmark.png) | | diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 5839bb088a..d8d9fd5ecf 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -32,7 +32,7 @@ This topic describes how to submit problems with a Windows 10 upgrade to Microso The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). -The Feedback Hub requires Windows 10 or Windows 10 mobile. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. +The Feedback Hub requires Windows 10. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. ## Submit feedback diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 1454fe92ed..2a8de2b590 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -20,7 +20,6 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile With Windows 10, you can quickly upgrade from one edition of Windows 10 to another, provided the upgrade path is supported. For information on what edition of Windows 10 is right for you, see [Compare Windows 10 Editions](https://go.microsoft.com/fwlink/p/?LinkID=690882). For a comprehensive list of all possible upgrade paths to Windows 10, see [Windows 10 upgrade paths](windows-10-upgrade-paths.md). Downgrading the edition of Windows is discussed in the [License expiration](#license-expiration) section on this page. @@ -77,15 +76,12 @@ X = unsupported
## Upgrade using mobile device management (MDM) - To upgrade desktop editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithProductKey** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp). -- To upgrade mobile editions of Windows 10 using MDM, you'll need to enter the product key for the upgraded edition in the **UpgradeEditionWithLicense** policy setting of the **WindowsLicensing** CSP. For more info, see [WindowsLicensing CSP](/windows/client-management/mdm/windowslicensing-csp). ## Upgrade using a provisioning package -Use Windows Configuration Designer to create a provisioning package to upgrade a desktop edition or mobile edition of Windows 10. To get started, [install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). +Use Windows Configuration Designer to create a provisioning package to upgrade a desktop edition. To get started, [install Windows Configuration Designer from the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). - To create a provisioning package for upgrading desktop editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithProductKey** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. -- To create a provisioning package for upgrading mobile editions of Windows 10, go to **Runtime settings > EditionUpgrade > UpgradeEditionWithLicense** in the **Available customizations** panel in Windows ICD and enter the product key for the upgraded edition. - For more info about Windows Configuration Designer, see these topics: - [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package) - [Apply a provisioning package](/windows/configuration/provisioning-packages/provisioning-apply-package) diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index b0a3dcf6d5..90b70d3dee 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -18,7 +18,6 @@ ms.topic: article **Applies to** - Windows 10 -- Windows 10 Mobile ## Upgrade paths @@ -49,8 +48,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar Windows 10 Pro Education Windows 10 Education Windows 10 Enterprise - Windows 10 Mobile - Windows 10 Mobile Enterprise Windows 7 @@ -62,8 +59,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Home Basic @@ -72,8 +67,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Home Premium @@ -82,8 +75,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Professional @@ -92,8 +83,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ ✔ - - Ultimate @@ -102,8 +91,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ ✔ - - Enterprise @@ -112,8 +99,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Windows 8.1 @@ -125,8 +110,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Connected @@ -135,8 +118,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Pro @@ -145,8 +126,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ ✔ - - Pro Student @@ -155,8 +134,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ ✔ - - Pro WMC @@ -165,8 +142,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ ✔ - - Enterprise @@ -175,8 +150,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Embedded Industry @@ -185,8 +158,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ - - Windows RT @@ -195,8 +166,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - Windows Phone 8.1 @@ -205,8 +174,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - - ✔ Windows 10 @@ -218,8 +185,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ - - Pro @@ -228,8 +193,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ ✔ ✔ - - Education @@ -238,8 +201,6 @@ D = Edition downgrade; personal data is maintained, applications and settings ar D - - Enterprise @@ -248,20 +209,8 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ - - - - Mobile - - - - - - - ✔ - - + ## Related Topics diff --git a/windows/deployment/windows-adk-scenarios-for-it-pros.md b/windows/deployment/windows-adk-scenarios-for-it-pros.md index 13b1ae3cea..9c27c2ce11 100644 --- a/windows/deployment/windows-adk-scenarios-for-it-pros.md +++ b/windows/deployment/windows-adk-scenarios-for-it-pros.md @@ -73,7 +73,7 @@ For a list of settings you can change, see [Unattended Windows Setup Reference]( ### Create a Windows image using Windows ICD -Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](/windows/configuration/provisioning-packages/provisioning-install-icd) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education), Windows 10 Mobile, or Windows 10 IoT Core (IoT Core) image. +Introduced in Windows 10, [Windows Imaging and Configuration Designer (ICD)](/windows/configuration/provisioning-packages/provisioning-install-icd) streamlines the customizing and provisioning of a Windows 10 for desktop editions (Home, Pro, Enterprise, and Education) or Windows 10 IoT Core (IoT Core) image. Here are some things you can do with Windows ICD: From b33772be1d511ea1092b9556d2740e7dab7e3e43 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Thu, 12 Aug 2021 18:52:13 +0530 Subject: [PATCH 0022/1214] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6a465d87b3..9939d5877c 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18944,6 +18944,11 @@ "source_path": "windows/privacy/data-processor-service-for-windows-enterprise-public-preview-terms.md", "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false + }, + { + "source_path": "windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md", + "redirect_url": "windows/deployment/upgrade/windows-10-edition-upgrades.md", + "redirect_document_id": false } ] } From e6d89cd2c41a5c0003c04f9aa2caceb3263786f6 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Thu, 12 Aug 2021 23:46:17 +0530 Subject: [PATCH 0023/1214] Updated --- .../mdm/policy-csp-admx-rpc.md | 8 +- .../mdm/policy-csp-admx-scripts.md | 24 +- .../mdm/policy-csp-admx-sdiageng.md | 6 +- .../mdm/policy-csp-admx-securitycenter.md | 2 +- .../mdm/policy-csp-admx-sensors.md | 10 +- .../mdm/policy-csp-admx-servicing.md | 2 +- .../mdm/policy-csp-admx-settingsync.md | 18 +- .../mdm/policy-csp-admx-sharedfolders.md | 4 +- .../mdm/policy-csp-admx-sharing.md | 2 +- ...csp-admx-shellcommandpromptregedittools.md | 8 +- .../mdm/policy-csp-admx-skydrive.md | 2 +- .../mdm/policy-csp-admx-smartcard.md | 32 +-- .../mdm/policy-csp-admx-snmp.md | 6 +- .../mdm/policy-csp-admx-startmenu.md | 134 +++++----- .../mdm/policy-csp-admx-systemrestore.md | 2 +- .../mdm/policy-csp-admx-taskbar.md | 44 +-- .../mdm/policy-csp-admx-tcpip.md | 26 +- .../mdm/policy-csp-admx-thumbnails.md | 6 +- .../mdm/policy-csp-admx-tpm.md | 20 +- ...y-csp-admx-userexperiencevirtualization.md | 252 +++++++++--------- .../mdm/policy-csp-admx-userprofiles.md | 16 +- .../mdm/policy-csp-admx-w32time.md | 8 +- .../mdm/policy-csp-admx-wcm.md | 6 +- 23 files changed, 319 insertions(+), 319 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-rpc.md b/windows/client-management/mdm/policy-csp-admx-rpc.md index 053d6fda1d..c999d05318 100644 --- a/windows/client-management/mdm/policy-csp-admx-rpc.md +++ b/windows/client-management/mdm/policy-csp-admx-rpc.md @@ -119,7 +119,7 @@ You must select an error response type in the drop-down box. ADMX Info: -- GP English name: *Propagate extended error information* +- GP Friendly name: *Propagate extended error information* - GP name: *RpcExtendedErrorInformation* - GP path: *System\Remote Procedure Call* - GP ADMX file name: *RPC.admx* @@ -199,7 +199,7 @@ If you enable this policy setting, then: ADMX Info: -- GP English name: *Ignore Delegation Failure* +- GP Friendly name: *Ignore Delegation Failure* - GP name: *RpcIgnoreDelegationFailure* - GP path: *System\Remote Procedure Call* - GP ADMX file name: *RPC.admx* @@ -280,7 +280,7 @@ If you enable this policy setting, and the IIS server running the RPC HTTP proxy ADMX Info: -- GP English name: *Set Minimum Idle Connection Timeout for RPC/HTTP connections* +- GP Friendly name: *Set Minimum Idle Connection Timeout for RPC/HTTP connections* - GP name: *RpcMinimumHttpConnectionTimeout* - GP path: *System\Remote Procedure Call* - GP ADMX file name: *RPC.admx* @@ -366,7 +366,7 @@ If you enable this policy setting, you can use the drop-down box to determine wh ADMX Info: -- GP English name: *Maintain RPC Troubleshooting State Information* +- GP Friendly name: *Maintain RPC Troubleshooting State Information* - GP name: *RpcStateInformation* - GP path: *System\Remote Procedure Call* - GP ADMX file name: *RPC.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-scripts.md b/windows/client-management/mdm/policy-csp-admx-scripts.md index 8019979d43..c28841c0c5 100644 --- a/windows/client-management/mdm/policy-csp-admx-scripts.md +++ b/windows/client-management/mdm/policy-csp-admx-scripts.md @@ -123,7 +123,7 @@ If you disable or do not configure this policy setting, user account cross-fores ADMX Info: -- GP English name: *Allow logon scripts when NetBIOS or WINS is disabled* +- GP Friendly name: *Allow logon scripts when NetBIOS or WINS is disabled* - GP name: *Allow_Logon_Script_NetbiosDisabled* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -198,7 +198,7 @@ If you disable or do not configure this setting the system lets the combined set ADMX Info: -- GP English name: *Specify maximum wait time for Group Policy scripts* +- GP Friendly name: *Specify maximum wait time for Group Policy scripts* - GP name: *MaxGPOScriptWaitPolicy* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -290,7 +290,7 @@ Within GPO C: C.cmd, C.ps1 ADMX Info: -- GP English name: *Run Windows PowerShell scripts first at computer startup, shutdown* +- GP Friendly name: *Run Windows PowerShell scripts first at computer startup, shutdown* - GP name: *Run_Computer_PS_Scripts_First* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -363,7 +363,7 @@ Also, see the "Run Logon Scripts Visible" setting. ADMX Info: -- GP English name: *Run legacy logon scripts hidden* +- GP Friendly name: *Run legacy logon scripts hidden* - GP name: *Run_Legacy_Logon_Script_Hidden* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -434,7 +434,7 @@ If you disable or do not configure this policy setting, the instructions are sup ADMX Info: -- GP English name: *Display instructions in logoff scripts as they run* +- GP Friendly name: *Display instructions in logoff scripts as they run* - GP name: *Run_Logoff_Script_Visible* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -505,7 +505,7 @@ This policy setting appears in the Computer Configuration and User Configuration ADMX Info: -- GP English name: *Run logon scripts synchronously* +- GP Friendly name: *Run logon scripts synchronously* - GP name: *Run_Logon_Script_Sync_1* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -576,7 +576,7 @@ This policy setting appears in the Computer Configuration and User Configuration ADMX Info: -- GP English name: *Run logon scripts synchronously* +- GP Friendly name: *Run logon scripts synchronously* - GP name: *Run_Logon_Script_Sync_2* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -647,7 +647,7 @@ If you disable or do not configure this policy setting, the instructions are sup ADMX Info: -- GP English name: *Display instructions in logon scripts as they run* +- GP Friendly name: *Display instructions in logon scripts as they run* - GP name: *Run_Logon_Script_Visible* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -718,7 +718,7 @@ If you disable or do not configure this policy setting, the instructions are sup ADMX Info: -- GP English name: *Display instructions in shutdown scripts as they run* +- GP Friendly name: *Display instructions in shutdown scripts as they run* - GP name: *Run_Shutdown_Script_Visible* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -792,7 +792,7 @@ If you disable or do not configure this policy setting, a startup cannot run unt ADMX Info: -- GP English name: *Run startup scripts asynchronously* +- GP Friendly name: *Run startup scripts asynchronously* - GP name: *Run_Startup_Script_Sync* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -866,7 +866,7 @@ If you disable or do not configure this policy setting, the instructions are sup ADMX Info: -- GP English name: *Display instructions in startup scripts as they run* +- GP Friendly name: *Display instructions in startup scripts as they run* - GP name: *Run_Startup_Script_Visible* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* @@ -961,7 +961,7 @@ This policy setting appears in the Computer Configuration and User Configuration ADMX Info: -- GP English name: *Run Windows PowerShell scripts first at user logon, logoff* +- GP Friendly name: *Run Windows PowerShell scripts first at user logon, logoff* - GP name: *Run_User_PS_Scripts_First* - GP path: *System\Scripts* - GP ADMX file name: *Scripts.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-sdiageng.md b/windows/client-management/mdm/policy-csp-admx-sdiageng.md index cf6bf9fdf7..e7a0beefc6 100644 --- a/windows/client-management/mdm/policy-csp-admx-sdiageng.md +++ b/windows/client-management/mdm/policy-csp-admx-sdiageng.md @@ -96,7 +96,7 @@ If you disable this policy setting, users can only access and search troubleshoo ADMX Info: -- GP English name: *Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)* +- GP Friendly name: *Troubleshooting: Allow users to access online troubleshooting content on Microsoft servers from the Troubleshooting Control Panel (via the Windows Online Troubleshooting Service - WOTS)* - GP name: *BetterWhenConnected* - GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* - GP ADMX file name: *sdiageng.admx* @@ -167,7 +167,7 @@ Note that this setting also controls a user's ability to launch standalone troub ADMX Info: -- GP English name: *Troubleshooting: Allow users to access and run Troubleshooting Wizards* +- GP Friendly name: *Troubleshooting: Allow users to access and run Troubleshooting Wizards* - GP name: *ScriptedDiagnosticsExecutionPolicy* - GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* - GP ADMX file name: *sdiageng.admx* @@ -236,7 +236,7 @@ If you disable or do not configure this policy setting, the scripted diagnostics ADMX Info: -- GP English name: *Configure Security Policy for Scripted Diagnostics* +- GP Friendly name: *Configure Security Policy for Scripted Diagnostics* - GP name: *ScriptedDiagnosticsSecurityPolicy* - GP path: *System\Troubleshooting and Diagnostics\Scripted Diagnostics* - GP ADMX file name: *sdiageng.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-securitycenter.md b/windows/client-management/mdm/policy-csp-admx-securitycenter.md index 4e97164a9e..7c06bd2059 100644 --- a/windows/client-management/mdm/policy-csp-admx-securitycenter.md +++ b/windows/client-management/mdm/policy-csp-admx-securitycenter.md @@ -102,7 +102,7 @@ In Windows Vista, this policy setting monitors essential security settings to in ADMX Info: -- GP English name: *Turn on Security Center (Domain PCs only)* +- GP Friendly name: *Turn on Security Center (Domain PCs only)* - GP name: *SecurityCenter_SecurityCenterInDomain* - GP path: *Windows Components\Security Center* - GP ADMX file name: *Securitycenter.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-sensors.md b/windows/client-management/mdm/policy-csp-admx-sensors.md index aa5c26fd6f..47b29235a9 100644 --- a/windows/client-management/mdm/policy-csp-admx-sensors.md +++ b/windows/client-management/mdm/policy-csp-admx-sensors.md @@ -102,7 +102,7 @@ If you disable or do not configure this policy setting, all location scripts wil ADMX Info: -- GP English name: *Turn off location scripting* +- GP Friendly name: *Turn off location scripting* - GP name: *DisableLocationScripting_1* - GP path: *Windows Components\Location and Sensors* - GP ADMX file name: *Sensors.admx* @@ -171,7 +171,7 @@ If you disable or do not configure this policy setting, all location scripts wil ADMX Info: -- GP English name: *Turn off location scripting* +- GP Friendly name: *Turn off location scripting* - GP name: *DisableLocationScripting_2* - GP path: *Windows Components\Location and Sensors* - GP ADMX file name: *Sensors.admx* @@ -240,7 +240,7 @@ If you disable or do not configure this policy setting, all programs on this com ADMX Info: -- GP English name: *Turn off location* +- GP Friendly name: *Turn off location* - GP name: *DisableLocation_1* - GP path: *Windows Components\Location and Sensors* - GP ADMX file name: *Sensors.admx* @@ -309,7 +309,7 @@ If you disable or do not configure this policy setting, all programs on this com ADMX Info: -- GP English name: *Turn off sensors* +- GP Friendly name: *Turn off sensors* - GP name: *DisableSensors_1* - GP path: *Windows Components\Location and Sensors* - GP ADMX file name: *Sensors.admx* @@ -378,7 +378,7 @@ If you disable or do not configure this policy setting, all programs on this com ADMX Info: -- GP English name: *Turn off sensors* +- GP Friendly name: *Turn off sensors* - GP name: *DisableSensors_2* - GP path: *Windows Components\Location and Sensors* - GP ADMX file name: *Sensors.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-servicing.md b/windows/client-management/mdm/policy-csp-admx-servicing.md index 6b62a42e86..c537254102 100644 --- a/windows/client-management/mdm/policy-csp-admx-servicing.md +++ b/windows/client-management/mdm/policy-csp-admx-servicing.md @@ -92,7 +92,7 @@ If you disable or do not configure this policy setting, or if the required files ADMX Info: -- GP English name: *Specify settings for optional component installation and component repair* +- GP Friendly name: *Specify settings for optional component installation and component repair* - GP name: *Servicing* - GP path: *System* - GP ADMX file name: *Servicing.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-settingsync.md b/windows/client-management/mdm/policy-csp-admx-settingsync.md index b79d238174..6f35209bce 100644 --- a/windows/client-management/mdm/policy-csp-admx-settingsync.md +++ b/windows/client-management/mdm/policy-csp-admx-settingsync.md @@ -116,7 +116,7 @@ If you do not set or disable this setting, syncing of the "AppSync" group is on ADMX Info: -- GP English name: *Do not sync Apps* +- GP Friendly name: *Do not sync Apps* - GP name: *DisableAppSyncSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -187,7 +187,7 @@ If you do not set or disable this setting, syncing of the "app settings" group i ADMX Info: -- GP English name: *Do not sync app settings* +- GP Friendly name: *Do not sync app settings* - GP name: *DisableApplicationSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -258,7 +258,7 @@ If you do not set or disable this setting, syncing of the "passwords" group is o ADMX Info: -- GP English name: *Do not sync passwords* +- GP Friendly name: *Do not sync passwords* - GP name: *DisableCredentialsSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -329,7 +329,7 @@ If you do not set or disable this setting, syncing of the "desktop personalizati ADMX Info: -- GP English name: *Do not sync desktop personalization* +- GP Friendly name: *Do not sync desktop personalization* - GP name: *DisableDesktopThemeSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -400,7 +400,7 @@ If you do not set or disable this setting, syncing of the "personalize" group is ADMX Info: -- GP English name: *Do not sync personalize* +- GP Friendly name: *Do not sync personalize* - GP name: *DisablePersonalizationSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -471,7 +471,7 @@ If you do not set or disable this setting, "sync your settings" is on by default ADMX Info: -- GP English name: *Do not sync* +- GP Friendly name: *Do not sync* - GP name: *DisableSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -542,7 +542,7 @@ If you do not set or disable this setting, syncing of the "Start layout" group i ADMX Info: -- GP English name: *Do not sync start settings* +- GP Friendly name: *Do not sync start settings* - GP name: *DisableStartLayoutSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -611,7 +611,7 @@ If you do not set or disable this setting, syncing on metered connections is con ADMX Info: -- GP English name: *Do not sync on metered connections* +- GP Friendly name: *Do not sync on metered connections* - GP name: *DisableSyncOnPaidNetwork* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* @@ -682,7 +682,7 @@ If you do not set or disable this setting, syncing of the "Other Windows setting ADMX Info: -- GP English name: *Do not sync other Windows settings* +- GP Friendly name: *Do not sync other Windows settings* - GP name: *DisableWindowsSettingSync* - GP path: *Windows Components\Sync your settings* - GP ADMX file name: *SettingSync.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md index 467cab854e..cc867fb098 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharedfolders.md +++ b/windows/client-management/mdm/policy-csp-admx-sharedfolders.md @@ -95,7 +95,7 @@ If you disable this policy setting, users cannot publish DFS roots in AD DS and ADMX Info: -- GP English name: *Allow DFS roots to be published* +- GP Friendly name: *Allow DFS roots to be published* - GP name: *PublishDfsRoots* - GP path: *Shared Folders* - GP ADMX file name: *SharedFolders.admx* @@ -168,7 +168,7 @@ If you disable this policy setting, users cannot publish shared folders in AD DS ADMX Info: -- GP English name: *Allow shared folders to be published* +- GP Friendly name: *Allow shared folders to be published* - GP name: *PublishSharedFolders* - GP path: *Shared Folders* - GP ADMX file name: *SharedFolders.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-sharing.md b/windows/client-management/mdm/policy-csp-admx-sharing.md index faccab55d9..b7e9e8ddaa 100644 --- a/windows/client-management/mdm/policy-csp-admx-sharing.md +++ b/windows/client-management/mdm/policy-csp-admx-sharing.md @@ -89,7 +89,7 @@ If you disable or don't configure this policy setting, users can share files out ADMX Info: -- GP English name: *Prevent users from sharing files within their profile.* +- GP Friendly name: *Prevent users from sharing files within their profile.* - GP name: *NoInplaceSharing* - GP path: *Windows Components\Network Sharing* - GP ADMX file name: *Sharing.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md index 223fa3819b..7d8f85894f 100644 --- a/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md +++ b/windows/client-management/mdm/policy-csp-admx-shellcommandpromptregedittools.md @@ -102,7 +102,7 @@ If you disable this policy setting or do not configure it, users can run Cmd.exe ADMX Info: -- GP English name: *Prevent access to the command prompt* +- GP Friendly name: *Prevent access to the command prompt* - GP name: *DisableCMD* - GP path: *System* - GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* @@ -173,7 +173,7 @@ To prevent users from using other administrative tools, use the "Run only specif ADMX Info: -- GP English name: *Prevent access to registry editing tools* +- GP Friendly name: *Prevent access to registry editing tools* - GP name: *DisableRegedit* - GP path: *System* - GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* @@ -249,7 +249,7 @@ This policy setting only prevents users from running programs that are started b ADMX Info: -- GP English name: *Don't run specified Windows applications* +- GP Friendly name: *Don't run specified Windows applications* - GP name: *DisallowApps* - GP path: *System* - GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* @@ -324,7 +324,7 @@ This policy setting only prevents users from running programs that are started b ADMX Info: -- GP English name: *Run only specified Windows applications* +- GP Friendly name: *Run only specified Windows applications* - GP name: *RestrictApps* - GP path: *System* - GP ADMX file name: *Shell-CommandPrompt-RegEditTools.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-skydrive.md b/windows/client-management/mdm/policy-csp-admx-skydrive.md index 464845261e..72c1b9ab34 100644 --- a/windows/client-management/mdm/policy-csp-admx-skydrive.md +++ b/windows/client-management/mdm/policy-csp-admx-skydrive.md @@ -92,7 +92,7 @@ If you enable or disable this setting, do not return the setting to Not Configur ADMX Info: -- GP English name: *Prevent OneDrive from generating network traffic until the user signs in to OneDrive* +- GP Friendly name: *Prevent OneDrive from generating network traffic until the user signs in to OneDrive* - GP name: *PreventNetworkTrafficPreUserSignIn* - GP path: *Windows Components\OneDrive* - GP ADMX file name: *SkyDrive.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-smartcard.md b/windows/client-management/mdm/policy-csp-admx-smartcard.md index 227aeb686b..3b4ac39e4f 100644 --- a/windows/client-management/mdm/policy-csp-admx-smartcard.md +++ b/windows/client-management/mdm/policy-csp-admx-smartcard.md @@ -141,7 +141,7 @@ If you disable or do not configure this policy setting, only certificates that c ADMX Info: -- GP English name: *Allow certificates with no extended key usage certificate attribute* +- GP Friendly name: *Allow certificates with no extended key usage certificate attribute* - GP name: *AllowCertificatesWithNoEKU* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -212,7 +212,7 @@ If you disable or do not configure this policy setting then the integrated unblo ADMX Info: -- GP English name: *Allow Integrated Unblock screen to be displayed at the time of logon* +- GP Friendly name: *Allow Integrated Unblock screen to be displayed at the time of logon* - GP name: *AllowIntegratedUnblock* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -281,7 +281,7 @@ If you disable or do not configure this policy setting, any available smart card ADMX Info: -- GP English name: *Allow signature keys valid for Logon* +- GP Friendly name: *Allow signature keys valid for Logon* - GP name: *AllowSignatureOnlyKeys* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -352,7 +352,7 @@ If you disable or do not configure this policy setting, certificates which are e ADMX Info: -- GP English name: *Allow time invalid certificates* +- GP Friendly name: *Allow time invalid certificates* - GP name: *AllowTimeInvalidCertificates* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -421,7 +421,7 @@ If you disable this policy setting, certificate propagation will not occur and t ADMX Info: -- GP English name: *Turn on certificate propagation from smart card* +- GP Friendly name: *Turn on certificate propagation from smart card* - GP name: *CertPropEnabledString* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -486,7 +486,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting al ADMX Info: -- GP English name: *Configure root certificate clean up* +- GP Friendly name: *Configure root certificate clean up* - GP name: *CertPropRootCleanupString* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -558,7 +558,7 @@ If you disable this policy setting then root certificates will not be propagated ADMX Info: -- GP English name: *Turn on root certificate propagation from smart card* +- GP Friendly name: *Turn on root certificate propagation from smart card* - GP name: *CertPropRootEnabledString* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -630,7 +630,7 @@ If you disable or do not configure this policy setting, plaintext PINs can be re ADMX Info: -- GP English name: *Prevent plaintext PINs from being returned by Credential Manager* +- GP Friendly name: *Prevent plaintext PINs from being returned by Credential Manager* - GP name: *DisallowPlaintextPin* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -702,7 +702,7 @@ If you disable or do not configure this policy setting, ECC certificates on a sm ADMX Info: -- GP English name: *Allow ECC certificates to be used for logon and authentication* +- GP Friendly name: *Allow ECC certificates to be used for logon and authentication* - GP name: *EnumerateECCCerts* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -778,7 +778,7 @@ If you disable this policy setting, no filtering will take place. ADMX Info: -- GP English name: *Filter duplicate logon certificates* +- GP Friendly name: *Filter duplicate logon certificates* - GP name: *FilterDuplicateCerts* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -849,7 +849,7 @@ If you disable or do not configure this setting, Windows will only attempt to re ADMX Info: -- GP English name: *Force the reading of all certificates from the smart card* +- GP Friendly name: *Force the reading of all certificates from the smart card* - GP name: *ForceReadingAllCertificates* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -921,7 +921,7 @@ If you disable or do not configure this policy setting, the default message will ADMX Info: -- GP English name: *Display string when smart card is blocked* +- GP Friendly name: *Display string when smart card is blocked* - GP name: *IntegratedUnblockPromptString* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -992,7 +992,7 @@ If you disable, the subject name will be displayed as it appears in the certific ADMX Info: -- GP English name: *Reverse the subject name stored in a certificate when displaying* +- GP Friendly name: *Reverse the subject name stored in a certificate when displaying* - GP name: *ReverseSubject* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -1064,7 +1064,7 @@ If you disable this policy setting, Smart Card Plug and Play will be disabled an ADMX Info: -- GP English name: *Turn on Smart Card Plug and Play service* +- GP Friendly name: *Turn on Smart Card Plug and Play service* - GP name: *SCPnPEnabled* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -1136,7 +1136,7 @@ If you disable this policy setting, a confirmation message will not be displayed ADMX Info: -- GP English name: *Notify user of successful smart card driver installation* +- GP Friendly name: *Notify user of successful smart card driver installation* - GP name: *SCPnPNotification* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* @@ -1205,7 +1205,7 @@ If you disable or do not configure this policy setting, an optional field that a ADMX Info: -- GP English name: *Allow user name hint* +- GP Friendly name: *Allow user name hint* - GP name: *X509HintsNeeded* - GP path: *Windows Components\Smart Card* - GP ADMX file name: *Smartcard.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-snmp.md b/windows/client-management/mdm/policy-csp-admx-snmp.md index 9e6698333d..62a6c6c8e5 100644 --- a/windows/client-management/mdm/policy-csp-admx-snmp.md +++ b/windows/client-management/mdm/policy-csp-admx-snmp.md @@ -108,7 +108,7 @@ Also, see the other two SNMP settings: "Specify permitted managers" and "Specify ADMX Info: -- GP English name: *Specify communities* +- GP Friendly name: *Specify communities* - GP name: *SNMP_Communities* - GP path: *Network\SNMP* - GP ADMX file name: *Snmp.admx* @@ -188,7 +188,7 @@ Also, see the other two SNMP policy settings: "Specify trap configuration" and " ADMX Info: -- GP English name: *Specify permitted managers* +- GP Friendly name: *Specify permitted managers* - GP name: *SNMP_PermittedManagers* - GP path: *Network\SNMP* - GP ADMX file name: *Snmp.admx* @@ -266,7 +266,7 @@ Also, see the other two SNMP settings: "Specify permitted managers" and "Specify ADMX Info: -- GP English name: *Specify traps for public community* +- GP Friendly name: *Specify traps for public community* - GP name: *SNMP_Traps_Public* - GP path: *Network\SNMP* - GP ADMX file name: *Snmp.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-startmenu.md b/windows/client-management/mdm/policy-csp-admx-startmenu.md index 43eb801c4d..e108cbcee6 100644 --- a/windows/client-management/mdm/policy-csp-admx-startmenu.md +++ b/windows/client-management/mdm/policy-csp-admx-startmenu.md @@ -288,7 +288,7 @@ If you do not configure this policy (default), there will not be a "Search the I ADMX Info: -- GP English name: *Add Search Internet link to Start Menu* +- GP Friendly name: *Add Search Internet link to Start Menu* - GP name: *AddSearchInternetLinkInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -368,7 +368,7 @@ This policy also does not clear items that the user may have pinned to the Jump ADMX Info: -- GP English name: *Clear history of recently opened documents on exit* +- GP Friendly name: *Clear history of recently opened documents on exit* - GP name: *ClearRecentDocsOnExit* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -435,7 +435,7 @@ If you disable or do not configure this policy, the start menu recent programs l ADMX Info: -- GP English name: *Clear the recent programs list for new users* +- GP Friendly name: *Clear the recent programs list for new users* - GP name: *ClearRecentProgForNewUserInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -504,7 +504,7 @@ This setting does not prevent new notifications from appearing. See the "Turn of ADMX Info: -- GP English name: *Clear tile notifications during log on* +- GP Friendly name: *Clear tile notifications during log on* - GP name: *ClearTilesOnExit* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -573,7 +573,7 @@ If you disable or don't configure this policy setting, the desktop apps won't be ADMX Info: -- GP English name: *List desktop apps first in the Apps view* +- GP Friendly name: *List desktop apps first in the Apps view* - GP name: *DesktopAppsFirstInAppsView* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -644,7 +644,7 @@ If you disable or don’t configure this policy setting, the user can configure ADMX Info: -- GP English name: *Search just apps from the Apps view* +- GP Friendly name: *Search just apps from the Apps view* - GP name: *DisableGlobalSearchOnAppsView* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -721,7 +721,7 @@ Also, see "Remove Logoff" in User Configuration\Administrative Templates\System\ ADMX Info: -- GP English name: *Add Logoff to the Start Menu* +- GP Friendly name: *Add Logoff to the Start Menu* - GP name: *ForceStartMenuLogOff* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -792,7 +792,7 @@ If you don’t configure this policy setting, the default setting for the user ADMX Info: -- GP English name: *Go to the desktop instead of Start when signing in* +- GP Friendly name: *Go to the desktop instead of Start when signing in* - GP name: *GoToDesktopOnSignIn* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -866,7 +866,7 @@ If you disable this setting or do not configure it, all Start menu shortcuts app ADMX Info: -- GP English name: *Gray unavailable Windows Installer programs Start Menu shortcuts* +- GP Friendly name: *Gray unavailable Windows Installer programs Start Menu shortcuts* - GP name: *GreyMSIAds* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -935,7 +935,7 @@ If you disable or do not configure this policy setting, the Power button and the ADMX Info: -- GP English name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* +- GP Friendly name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* - GP name: *HidePowerOptions* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1009,7 +1009,7 @@ To Turn off personalized menus without specifying a setting, click Start, click ADMX Info: -- GP English name: *Turn off personalized menus* +- GP Friendly name: *Turn off personalized menus* - GP name: *Intellimenus* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1083,7 +1083,7 @@ If you disable this setting or do not configure it, the user can configure the t ADMX Info: -- GP English name: *Lock the Taskbar* +- GP Friendly name: *Lock the Taskbar* - GP name: *LockTaskbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1152,7 +1152,7 @@ Enabling this setting adds a check box to the Run dialog box, giving users the o ADMX Info: -- GP English name: *Add "Run in Separate Memory Space" check box to Run dialog box* +- GP Friendly name: *Add "Run in Separate Memory Space" check box to Run dialog box* - GP name: *MemCheckBoxInRunDlg* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1225,7 +1225,7 @@ If you do not configure it, the user can choose if they want notifications colla ADMX Info: -- GP English name: *Turn off notification area cleanup* +- GP Friendly name: *Turn off notification area cleanup* - GP name: *NoAutoTrayNotify* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1296,7 +1296,7 @@ If you disable this setting or do not configure it, all pop-up text is displayed ADMX Info: -- GP English name: *Remove Balloon Tips on Start Menu items* +- GP Friendly name: *Remove Balloon Tips on Start Menu items* - GP name: *NoBalloonTip* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1365,7 +1365,7 @@ If you disable or do not configure this setting, you will allow a user to select ADMX Info: -- GP English name: *Prevent users from customizing their Start Screen* +- GP Friendly name: *Prevent users from customizing their Start Screen* - GP name: *NoChangeStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1437,7 +1437,7 @@ If you disable or do not configure this policy setting, the Power button and the ADMX Info: -- GP English name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* +- GP Friendly name: *Remove and prevent access to the Shut Down, Restart, Sleep, and Hibernate commands* - GP name: *NoClose* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1506,7 +1506,7 @@ To see the Program menu items in the All Users profile, on the system drive, go ADMX Info: -- GP English name: *Remove common program groups from Start Menu* +- GP Friendly name: *Remove common program groups from Start Menu* - GP name: *NoCommonGroups* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1582,7 +1582,7 @@ If you disable or do not configure this setting, the Display Favorite item is av ADMX Info: -- GP English name: *Remove Favorites menu from Start Menu* +- GP Friendly name: *Remove Favorites menu from Start Menu* - GP name: *NoFavoritesMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1657,7 +1657,7 @@ If you disable or do not configure this policy setting, the Search link is avail ADMX Info: -- GP English name: *Remove Search link from Start Menu* +- GP Friendly name: *Remove Search link from Start Menu* - GP name: *NoFind* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1724,7 +1724,7 @@ If you disable or do not configure this policy, the start menu will show a link ADMX Info: -- GP English name: *Remove Games link from Start Menu* +- GP Friendly name: *Remove Games link from Start Menu* - GP name: *NoGamesFolderOnStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1795,7 +1795,7 @@ This policy setting only affects the Start menu. It does not remove the Help men ADMX Info: -- GP English name: *Remove Help menu from Start Menu* +- GP Friendly name: *Remove Help menu from Start Menu* - GP name: *NoHelp* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1868,7 +1868,7 @@ This policy setting does not prevent users from pinning programs to the Start M ADMX Info: -- GP English name: *Turn off user tracking* +- GP Friendly name: *Turn off user tracking* - GP name: *NoInstrumentation* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -1942,7 +1942,7 @@ If you disable or do not configure this setting, the all apps list will be visib ADMX Info: -- GP English name: *Remove All Programs list from the Start menu* +- GP Friendly name: *Remove All Programs list from the Start menu* - GP name: *NoMoreProgramsList* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2017,7 +2017,7 @@ Also, see the "Disable programs on Settings menu" and "Disable Control Panel" po ADMX Info: -- GP English name: *Remove Network Connections from Start Menu* +- GP Friendly name: *Remove Network Connections from Start Menu* - GP name: *NoNetAndDialupConnect* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2086,7 +2086,7 @@ If you disable this setting or do not configure it, the "Pinned Programs" list r ADMX Info: -- GP English name: *Remove pinned programs list from the Start Menu* +- GP Friendly name: *Remove pinned programs list from the Start Menu* - GP name: *NoPinnedPrograms* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2166,7 +2166,7 @@ This setting also does not hide document shortcuts displayed in the Open dialog ADMX Info: -- GP English name: *Remove Recent Items menu from Start Menu* +- GP Friendly name: *Remove Recent Items menu from Start Menu* - GP name: *NoRecentDocsMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2240,7 +2240,7 @@ Also, see the "Do not track Shell shortcuts during roaming" and the "Do not use ADMX Info: -- GP English name: *Do not use the search-based method when resolving shell shortcuts* +- GP Friendly name: *Do not use the search-based method when resolving shell shortcuts* - GP name: *NoResolveSearch* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2313,7 +2313,7 @@ Also, see the "Do not track Shell shortcuts during roaming" and the "Do not use ADMX Info: -- GP English name: *Do not use the tracking-based method when resolving shell shortcuts* +- GP Friendly name: *Do not use the tracking-based method when resolving shell shortcuts* - GP name: *NoResolveTrack* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2401,7 +2401,7 @@ If you disable or do not configure this setting, users will be able to access th ADMX Info: -- GP English name: *Remove Run menu from Start Menu* +- GP Friendly name: *Remove Run menu from Start Menu* - GP name: *NoRun* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2475,7 +2475,7 @@ If you disable or do not configure this policy setting, the Default Programs lin ADMX Info: -- GP English name: *Remove Default Programs link from the Start menu.* +- GP Friendly name: *Remove Default Programs link from the Start menu.* - GP name: *NoSMConfigurePrograms* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2549,7 +2549,7 @@ Also, see the "Remove Documents icon on the desktop" policy setting. ADMX Info: -- GP English name: *Remove Documents icon from Start Menu* +- GP Friendly name: *Remove Documents icon from Start Menu* - GP name: *NoSMMyDocuments* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2618,7 +2618,7 @@ If you disable or do not configure this policy setting, the Music icon is availa ADMX Info: -- GP English name: *Remove Music icon from Start Menu* +- GP Friendly name: *Remove Music icon from Start Menu* - GP name: *NoSMMyMusic* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2687,7 +2687,7 @@ If you disable or do not configure this policy setting, the Network icon is avai ADMX Info: -- GP English name: *Remove Network icon from Start Menu* +- GP Friendly name: *Remove Network icon from Start Menu* - GP name: *NoSMMyNetworkPlaces* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2756,7 +2756,7 @@ If you disable or do not configure this policy setting, the Pictures icon is ava ADMX Info: -- GP English name: *Remove Pictures icon from Start Menu* +- GP Friendly name: *Remove Pictures icon from Start Menu* - GP name: *NoSMMyPictures* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2823,7 +2823,7 @@ If you disable or do not configure this policy, the start menu will search for c ADMX Info: -- GP English name: *Do not search communications* +- GP Friendly name: *Do not search communications* - GP name: *NoSearchCommInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2890,7 +2890,7 @@ If you disable or do not configure this policy, the "See all results" link will ADMX Info: -- GP English name: *Remove Search Computer link* +- GP Friendly name: *Remove Search Computer link* - GP name: *NoSearchComputerLinkInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -2957,7 +2957,7 @@ If you disable or do not configure this policy, a "See more results" link will b ADMX Info: -- GP English name: *Remove See More Results / Search Everywhere link* +- GP Friendly name: *Remove See More Results / Search Everywhere link* - GP name: *NoSearchEverywhereLinkInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3024,7 +3024,7 @@ If you disable or do not configure this policy setting, the Start menu will sear ADMX Info: -- GP English name: *Do not search for files* +- GP Friendly name: *Do not search for files* - GP name: *NoSearchFilesInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3091,7 +3091,7 @@ If you disable or do not configure this policy, the start menu will search for f ADMX Info: -- GP English name: *Do not search Internet* +- GP Friendly name: *Do not search Internet* - GP name: *NoSearchInternetInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3158,7 +3158,7 @@ If you disable or do not configure this policy setting, the Start menu search bo ADMX Info: -- GP English name: *Do not search programs and Control Panel items* +- GP Friendly name: *Do not search programs and Control Panel items* - GP name: *NoSearchProgramsInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3231,7 +3231,7 @@ Also, see the "Disable Control Panel," "Disable Display in Control Panel," and " ADMX Info: -- GP English name: *Remove programs on Settings menu* +- GP Friendly name: *Remove programs on Settings menu* - GP name: *NoSetFolders* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3302,7 +3302,7 @@ If you disable or do not configure this policy setting, the Taskbar and Start Me ADMX Info: -- GP English name: *Prevent changes to Taskbar and Start Menu Settings* +- GP Friendly name: *Prevent changes to Taskbar and Start Menu Settings* - GP name: *NoSetTaskbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3371,7 +3371,7 @@ If you disable or do not configure this policy setting, the Downloads link is av ADMX Info: -- GP English name: *Remove Downloads link from Start Menu* +- GP Friendly name: *Remove Downloads link from Start Menu* - GP name: *NoStartMenuDownload* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3438,7 +3438,7 @@ If you disable or do not configure this policy, users can use the Start Menu opt ADMX Info: -- GP English name: *Remove Homegroup link from Start Menu* +- GP Friendly name: *Remove Homegroup link from Start Menu* - GP name: *NoStartMenuHomegroup* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3507,7 +3507,7 @@ If you disable or do not configure this policy setting, the Recorded TV link is ADMX Info: -- GP English name: *Remove Recorded TV link from Start Menu* +- GP Friendly name: *Remove Recorded TV link from Start Menu* - GP name: *NoStartMenuRecordedTV* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3580,7 +3580,7 @@ If you disable this setting or do not configured it, Windows 2000 Professional a ADMX Info: -- GP English name: *Remove user's folders from the Start Menu* +- GP Friendly name: *Remove user's folders from the Start Menu* - GP name: *NoStartMenuSubFolders* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3649,7 +3649,7 @@ If you disable or do not configure this policy setting, the Videos link is avail ADMX Info: -- GP English name: *Remove Videos link from Start Menu* +- GP Friendly name: *Remove Videos link from Start Menu* - GP name: *NoStartMenuVideos* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3722,7 +3722,7 @@ If you do not configure this setting, the default is the new style, and the user ADMX Info: -- GP English name: *Force classic Start Menu* +- GP Friendly name: *Force classic Start Menu* - GP name: *NoStartPage* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3791,7 +3791,7 @@ If you disable or do not configure this setting, the default behavior of the clo ADMX Info: -- GP English name: *Remove Clock from the system notification area* +- GP Friendly name: *Remove Clock from the system notification area* - GP name: *NoTaskBarClock* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3862,7 +3862,7 @@ If you disable or do not configure it, items on the taskbar that share the same ADMX Info: -- GP English name: *Prevent grouping of taskbar items* +- GP Friendly name: *Prevent grouping of taskbar items* - GP name: *NoTaskGrouping* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -3933,7 +3933,7 @@ If this setting is disabled or is not configured, the taskbar displays all toolb ADMX Info: -- GP English name: *Do not display any custom toolbars in the taskbar* +- GP Friendly name: *Do not display any custom toolbars in the taskbar* - GP name: *NoToolbarsOnTaskbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4004,7 +4004,7 @@ This policy setting does not prevent users from using other methods to issue the ADMX Info: -- GP English name: *Remove access to the context menus for the taskbar* +- GP Friendly name: *Remove access to the context menus for the taskbar* - GP name: *NoTrayContextMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4078,7 +4078,7 @@ If this setting is disabled or is not configured, the notification area is shown ADMX Info: -- GP English name: *Hide the notification area* +- GP Friendly name: *Hide the notification area* - GP name: *NoTrayItemsDisplay* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4145,7 +4145,7 @@ If you disable this setting or do not configure it, users can access the uninsta ADMX Info: -- GP English name: *Prevent users from uninstalling applications from Start* +- GP Friendly name: *Prevent users from uninstalling applications from Start* - GP name: *NoUninstallFromStart* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4212,7 +4212,7 @@ If you disable or do not configure this policy, the start menu will display a li ADMX Info: -- GP English name: *Remove user folder link from Start Menu* +- GP Friendly name: *Remove user folder link from Start Menu* - GP name: *NoUserFolderOnStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4283,7 +4283,7 @@ If you disable or do not configure this policy setting, the user name label appe ADMX Info: -- GP English name: *Remove user name from Start Menu* +- GP Friendly name: *Remove user name from Start Menu* - GP name: *NoUserNameOnStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4358,7 +4358,7 @@ Also, see the "Hide the "Add programs from Microsoft" option" policy setting. ADMX Info: -- GP English name: *Remove links and access to Windows Update* +- GP Friendly name: *Remove links and access to Windows Update* - GP name: *NoWindowsUpdate* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4429,7 +4429,7 @@ If you disable or do not configure this setting, the Start Menu power button wil ADMX Info: -- GP English name: *Change Start Menu power button* +- GP Friendly name: *Change Start Menu power button* - GP name: *PowerButtonAction* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4500,7 +4500,7 @@ If you do not configure this policy setting, then users will be able to turn the ADMX Info: -- GP English name: *Show QuickLaunch on Taskbar* +- GP Friendly name: *Show QuickLaunch on Taskbar* - GP name: *QuickLaunchEnabled* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4567,7 +4567,7 @@ If you disable this setting or do not configure it, the "Undock PC" button remai ADMX Info: -- GP English name: *Remove the "Undock PC" button from the Start Menu* +- GP Friendly name: *Remove the "Undock PC" button from the Start Menu* - GP name: *RemoveUnDockPCButton* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4636,7 +4636,7 @@ If you disable or don’t configure this policy setting, the Start screen will a ADMX Info: -- GP English name: *Show the Apps view automatically when the user goes to Start* +- GP Friendly name: *Show the Apps view automatically when the user goes to Start* - GP name: *ShowAppsViewOnStart* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4708,7 +4708,7 @@ If you disable this setting or do not configure it, users cannot access the "Run ADMX Info: -- GP English name: *Show "Run as different user" command on Start* +- GP Friendly name: *Show "Run as different user" command on Start* - GP name: *ShowRunAsDifferentUserInStart* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4777,7 +4777,7 @@ If the Remove Run link from Start Menu policy is set, the Add the Run command to ADMX Info: -- GP English name: *Add the Run command to the Start Menu* +- GP Friendly name: *Add the Run command to the Start Menu* - GP name: *ShowRunInStartMenu* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4846,7 +4846,7 @@ If you disable or don't configure this policy setting, the Start screen will alw ADMX Info: -- GP English name: *Show Start on the display the user is using when they press the Windows logo key* +- GP Friendly name: *Show Start on the display the user is using when they press the Windows logo key* - GP name: *ShowStartOnDisplayWithForegroundOnWinKey* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4921,7 +4921,7 @@ See also: "Remove Logoff" policy setting in User Configuration\Administrative Te ADMX Info: -- GP English name: *Remove Logoff on the Start Menu* +- GP Friendly name: *Remove Logoff on the Start Menu* - GP name: *StartMenuLogOff* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* @@ -4987,7 +4987,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting al ADMX Info: -- GP English name: *Pin Apps to Start when installed* +- GP Friendly name: *Pin Apps to Start when installed* - GP name: *StartPinAppsWhenInstalled* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *StartMenu.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-systemrestore.md b/windows/client-management/mdm/policy-csp-admx-systemrestore.md index d636e16649..00d40074f3 100644 --- a/windows/client-management/mdm/policy-csp-admx-systemrestore.md +++ b/windows/client-management/mdm/policy-csp-admx-systemrestore.md @@ -96,7 +96,7 @@ Also, see the "Turn off System Restore" policy setting. If the "Turn off System ADMX Info: -- GP English name: *Turn off Configuration* +- GP Friendly name: *Turn off Configuration* - GP name: *SR_DisableConfig* - GP path: *System\System Restore* - GP ADMX file name: *SystemRestore.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-taskbar.md b/windows/client-management/mdm/policy-csp-admx-taskbar.md index 4237d69e83..77fdd56a9d 100644 --- a/windows/client-management/mdm/policy-csp-admx-taskbar.md +++ b/windows/client-management/mdm/policy-csp-admx-taskbar.md @@ -157,7 +157,7 @@ A reboot is required for this policy setting to take effect. ADMX Info: -- GP English name: *Remove Notifications and Action Center* +- GP Friendly name: *Remove Notifications and Action Center* - GP name: *DisableNotificationCenter* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -230,7 +230,7 @@ A reboot is required for this policy setting to take effect. ADMX Info: -- GP English name: *Disable showing balloon notifications as toasts.* +- GP Friendly name: *Disable showing balloon notifications as toasts.* - GP name: *EnableLegacyBalloonNotifications* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -299,7 +299,7 @@ If you disable or do not configure this policy setting, the Security and Mainten ADMX Info: -- GP English name: *Remove the Security and Maintenance icon* +- GP Friendly name: *Remove the Security and Maintenance icon* - GP name: *HideSCAHealth* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -368,7 +368,7 @@ If you disable or do not configure this policy setting, the networking icon is d ADMX Info: -- GP English name: *Remove the networking icon* +- GP Friendly name: *Remove the networking icon* - GP name: *HideSCANetwork* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -437,7 +437,7 @@ If you disable or do not configure this policy setting, the battery meter is dis ADMX Info: -- GP English name: *Remove the battery meter* +- GP Friendly name: *Remove the battery meter* - GP name: *HideSCAPower* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -506,7 +506,7 @@ If you disable or do not configure this policy setting, the volume control icon ADMX Info: -- GP English name: *Remove the volume control icon* +- GP Friendly name: *Remove the volume control icon* - GP name: *HideSCAVolume* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -575,7 +575,7 @@ If you disable do not configure this policy setting, feature advertisement ballo ADMX Info: -- GP English name: *Turn off feature advertisement balloon notifications* +- GP Friendly name: *Turn off feature advertisement balloon notifications* - GP name: *NoBalloonFeatureAdvertisements* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -644,7 +644,7 @@ If you disable or do not configure this policy setting, users can pin the Store ADMX Info: -- GP English name: *Do not allow pinning Store app to the Taskbar* +- GP Friendly name: *Do not allow pinning Store app to the Taskbar* - GP name: *NoPinningStoreToTaskbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -713,7 +713,7 @@ If you disable or do not configure this policy setting, users can pin files, fol ADMX Info: -- GP English name: *Do not allow pinning items in Jump Lists* +- GP Friendly name: *Do not allow pinning items in Jump Lists* - GP name: *NoPinningToDestinations* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -782,7 +782,7 @@ If you disable or do not configure this policy setting, users can change the pro ADMX Info: -- GP English name: *Do not allow pinning programs to the Taskbar* +- GP Friendly name: *Do not allow pinning programs to the Taskbar* - GP name: *NoPinningToTaskbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -856,7 +856,7 @@ If you disable or do not configure this policy setting, all files that the user ADMX Info: -- GP English name: *Do not display or track items in Jump Lists from remote locations* +- GP Friendly name: *Do not display or track items in Jump Lists from remote locations* - GP name: *NoRemoteDestinations* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -927,7 +927,7 @@ If you disable or do not configure this policy setting, newly added notification ADMX Info: -- GP English name: *Turn off automatic promotion of notification icons to the taskbar* +- GP Friendly name: *Turn off automatic promotion of notification icons to the taskbar* - GP name: *NoSystraySystemPromotion* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1000,7 +1000,7 @@ If you don’t configure this policy setting, the default setting for the user ADMX Info: -- GP English name: *Show Windows Store apps on the taskbar* +- GP Friendly name: *Show Windows Store apps on the taskbar* - GP name: *ShowWindowsStoreAppsOnTaskbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1071,7 +1071,7 @@ If you disable or do not configure this policy setting, the user will be able to ADMX Info: -- GP English name: *Lock all taskbar settings* +- GP Friendly name: *Lock all taskbar settings* - GP name: *TaskbarLockAll* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1142,7 +1142,7 @@ If you disable or do not configure this policy setting, the users and applicatio ADMX Info: -- GP English name: *Prevent users from adding or removing toolbars* +- GP Friendly name: *Prevent users from adding or removing toolbars* - GP name: *TaskbarNoAddRemoveToolbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1213,7 +1213,7 @@ If you disable or do not configure this policy setting, users are able to rearra ADMX Info: -- GP English name: *Prevent users from rearranging toolbars* +- GP Friendly name: *Prevent users from rearranging toolbars* - GP name: *TaskbarNoDragToolbar* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1284,7 +1284,7 @@ If you disable or do not configure this policy setting, users can show taskbars ADMX Info: -- GP English name: *Do not allow taskbars on more than one display* +- GP Friendly name: *Do not allow taskbars on more than one display* - GP name: *TaskbarNoMultimon* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1355,7 +1355,7 @@ If you disable or do not configure this policy setting, notification balloons ar ADMX Info: -- GP English name: *Turn off all balloon notifications* +- GP Friendly name: *Turn off all balloon notifications* - GP name: *TaskbarNoNotification* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1426,7 +1426,7 @@ If you disable or do not configure this policy setting, users can pin programs s ADMX Info: -- GP English name: *Remove pinned programs from the Taskbar* +- GP Friendly name: *Remove pinned programs from the Taskbar* - GP name: *TaskbarNoPinnedList* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1497,7 +1497,7 @@ If you disable or do not configure this policy setting, users are able to drag t ADMX Info: -- GP English name: *Prevent users from moving taskbar to another screen dock location* +- GP Friendly name: *Prevent users from moving taskbar to another screen dock location* - GP name: *TaskbarNoRedock* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1568,7 +1568,7 @@ If you disable or do not configure this policy setting, users are able to resize ADMX Info: -- GP English name: *Prevent users from resizing the taskbar* +- GP Friendly name: *Prevent users from resizing the taskbar* - GP name: *TaskbarNoResize* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* @@ -1639,7 +1639,7 @@ If you disable or do not configure this policy setting, the taskbar thumbnails a ADMX Info: -- GP English name: *Turn off taskbar thumbnails* +- GP Friendly name: *Turn off taskbar thumbnails* - GP name: *TaskbarNoThumbnail* - GP path: *Start Menu and Taskbar* - GP ADMX file name: *Taskbar.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-tcpip.md b/windows/client-management/mdm/policy-csp-admx-tcpip.md index c4ebc56f82..716a9c9f64 100644 --- a/windows/client-management/mdm/policy-csp-admx-tcpip.md +++ b/windows/client-management/mdm/policy-csp-admx-tcpip.md @@ -126,7 +126,7 @@ If you disable or do not configure this policy setting, the local host setting i ADMX Info: -- GP English name: *Set 6to4 Relay Name* +- GP Friendly name: *Set 6to4 Relay Name* - GP name: *6to4_Router_Name* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -195,7 +195,7 @@ If you disable or do not configure this policy setting, the local host setting i ADMX Info: -- GP English name: *Set 6to4 Relay Name Resolution Interval* +- GP Friendly name: *Set 6to4 Relay Name Resolution Interval* - GP name: *6to4_Router_Name_Resolution_Interval* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -270,7 +270,7 @@ Policy Disabled State: 6to4 is turned off and connectivity with 6to4 will not be ADMX Info: -- GP English name: *Set 6to4 State* +- GP Friendly name: *Set 6to4 State* - GP name: *6to4_State* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -345,7 +345,7 @@ Policy Disabled State: No IP-HTTPS interfaces are present on the host. ADMX Info: -- GP English name: *Set IP-HTTPS State* +- GP Friendly name: *Set IP-HTTPS State* - GP name: *IPHTTPS_ClientState* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -414,7 +414,7 @@ If you disable this policy setting, IP Stateless Autoconfiguration Limits will b ADMX Info: -- GP English name: *Set IP Stateless Autoconfiguration Limits State* +- GP Friendly name: *Set IP Stateless Autoconfiguration Limits State* - GP name: *IP_Stateless_Autoconfiguration_Limits_State* - GP path: *Network\TCPIP Settings\Parameters* - GP ADMX file name: *tcpip.admx* @@ -483,7 +483,7 @@ If you disable or do not configure this policy setting, the local host setting i ADMX Info: -- GP English name: *Set ISATAP Router Name* +- GP Friendly name: *Set ISATAP Router Name* - GP name: *ISATAP_Router_Name* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -558,7 +558,7 @@ Policy Disabled State: No ISATAP interfaces are present on the host. ADMX Info: -- GP English name: *Set ISATAP State* +- GP Friendly name: *Set ISATAP State* - GP name: *ISATAP_State* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -627,7 +627,7 @@ If you disable or do not configure this policy setting, the local host setting i ADMX Info: -- GP English name: *Set Teredo Client Port* +- GP Friendly name: *Set Teredo Client Port* - GP name: *Teredo_Client_Port* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -698,7 +698,7 @@ Policy Enabled State: If Default Qualified is enabled, Teredo will attempt quali ADMX Info: -- GP English name: *Set Teredo Default Qualified* +- GP Friendly name: *Set Teredo Default Qualified* - GP name: *Teredo_Default_Qualified* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -770,7 +770,7 @@ If you disable or do not configure this policy setting, the refresh rate is conf ADMX Info: -- GP English name: *Set Teredo Refresh Rate* +- GP Friendly name: *Set Teredo Refresh Rate* - GP name: *Teredo_Refresh_Rate* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -839,7 +839,7 @@ If you disable or do not configure this policy setting, the local settings on th ADMX Info: -- GP English name: *Set Teredo Server Name* +- GP Friendly name: *Set Teredo Server Name* - GP name: *Teredo_Server_Name* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -916,7 +916,7 @@ Enterprise Client: The Teredo interface is always present, even if the host is o ADMX Info: -- GP English name: *Set Teredo State* +- GP Friendly name: *Set Teredo State* - GP name: *Teredo_State* - GP path: *Network\TCPIP Settings\IPv6 Transition Technologies* - GP ADMX file name: *tcpip.admx* @@ -987,7 +987,7 @@ If you disable this policy setting, Window Scaling Heuristics will be disabled a ADMX Info: -- GP English name: *Set Window Scaling Heuristics State* +- GP Friendly name: *Set Window Scaling Heuristics State* - GP name: *Windows_Scaling_Heuristics_State* - GP path: *Network\TCPIP Settings\Parameters* - GP ADMX file name: *tcpip.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-thumbnails.md b/windows/client-management/mdm/policy-csp-admx-thumbnails.md index d21e77ad3c..8e689c8544 100644 --- a/windows/client-management/mdm/policy-csp-admx-thumbnails.md +++ b/windows/client-management/mdm/policy-csp-admx-thumbnails.md @@ -97,7 +97,7 @@ If you disable or do not configure this policy setting, File Explorer displays o ADMX Info: -- GP English name: *Turn off the display of thumbnails and only display icons.* +- GP Friendly name: *Turn off the display of thumbnails and only display icons.* - GP name: *DisableThumbnails* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Thumbnails.admx* @@ -168,7 +168,7 @@ If you disable or do not configure this policy setting, File Explorer displays o ADMX Info: -- GP English name: *Turn off the display of thumbnails and only display icons on network folders* +- GP Friendly name: *Turn off the display of thumbnails and only display icons on network folders* - GP name: *DisableThumbnailsOnNetworkFolders* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Thumbnails.admx* @@ -239,7 +239,7 @@ If you disable or do not configure this policy setting, File Explorer creates, r ADMX Info: -- GP English name: *Turn off the caching of thumbnails in hidden thumbs.db files* +- GP Friendly name: *Turn off the caching of thumbnails in hidden thumbs.db files* - GP name: *DisableThumbsDBOnNetworkFolders* - GP path: *Windows Components\File Explorer* - GP ADMX file name: *Thumbnails.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-tpm.md b/windows/client-management/mdm/policy-csp-admx-tpm.md index a428786a24..7935207b97 100644 --- a/windows/client-management/mdm/policy-csp-admx-tpm.md +++ b/windows/client-management/mdm/policy-csp-admx-tpm.md @@ -117,7 +117,7 @@ If you disable or do not configure this policy setting, only those TPM commands ADMX Info: -- GP English name: *Configure the list of blocked TPM commands* +- GP Friendly name: *Configure the list of blocked TPM commands* - GP name: *BlockedCommandsList_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -182,7 +182,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting co ADMX Info: -- GP English name: *Configure the system to clear the TPM if it is not in a ready state.* +- GP Friendly name: *Configure the system to clear the TPM if it is not in a ready state.* - GP name: *ClearTPMIfNotReady_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -253,7 +253,7 @@ If you disable or do not configure this policy setting, Windows will block the T ADMX Info: -- GP English name: *Ignore the default list of blocked TPM commands* +- GP Friendly name: *Ignore the default list of blocked TPM commands* - GP name: *IgnoreDefaultList_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -324,7 +324,7 @@ If you disable or do not configure this policy setting, Windows will block the T ADMX Info: -- GP English name: *Ignore the local list of blocked TPM commands* +- GP Friendly name: *Ignore the local list of blocked TPM commands* - GP name: *IgnoreLocalList_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -402,7 +402,7 @@ Choose the operating system managed TPM authentication setting of "None" for com ADMX Info: -- GP English name: *Configure the level of TPM owner authorization information available to the operating system* +- GP Friendly name: *Configure the level of TPM owner authorization information available to the operating system* - GP name: *OSManagedAuth_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -467,7 +467,7 @@ Available in the latest Windows 10 Insider Preview Build. This group policy enab ADMX Info: -- GP English name: *Enable Device Health Attestation Monitoring and Reporting* +- GP Friendly name: *Enable Device Health Attestation Monitoring and Reporting* - GP name: *OptIntoDSHA_Name* - GP path: *System\Device Health Attestation Service* - GP ADMX file name: *TPM.admx* @@ -548,7 +548,7 @@ If this value is not configured, a default value of 480 minutes (8 hours) is use ADMX Info: -- GP English name: *Standard User Lockout Duration* +- GP Friendly name: *Standard User Lockout Duration* - GP name: *StandardUserAuthorizationFailureDuration_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -631,7 +631,7 @@ A value of zero means the OS will not allow standard users to send commands to t ADMX Info: -- GP English name: *Standard User Individual Lockout Threshold* +- GP Friendly name: *Standard User Individual Lockout Threshold* - GP name: *StandardUserAuthorizationFailureIndividualThreshold_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -714,7 +714,7 @@ A value of zero means the OS will not allow standard users to send commands to t ADMX Info: -- GP English name: *Standard User Total Lockout Threshold* +- GP Friendly name: *Standard User Total Lockout Threshold* - GP name: *StandardUserAuthorizationFailureTotalThreshold_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* @@ -779,7 +779,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting co ADMX Info: -- GP English name: *Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.* +- GP Friendly name: *Configure the system to use legacy Dictionary Attack Prevention Parameters setting for TPM 2.0.* - GP name: *UseLegacyDAP_Name* - GP path: *System\Trusted Platform Module Services* - GP ADMX file name: *TPM.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md index 54ba484366..d068903115 100644 --- a/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md +++ b/windows/client-management/mdm/policy-csp-admx-userexperiencevirtualization.md @@ -470,7 +470,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Calculator* +- GP Friendly name: *Calculator* - GP name: *Calculator* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -549,7 +549,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Configure Sync Method* +- GP Friendly name: *Configure Sync Method* - GP name: *ConfigureSyncMethod* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -624,7 +624,7 @@ If you do not configure this policy, no UE-V rollback state is copied to the set ADMX Info: -- GP English name: *VDI Configuration* +- GP Friendly name: *VDI Configuration* - GP name: *ConfigureVdi* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -695,7 +695,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Contact IT Link Text* +- GP Friendly name: *Contact IT Link Text* - GP name: *ContactITDescription* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -765,7 +765,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Contact IT URL* +- GP Friendly name: *Contact IT URL* - GP name: *ContactITUrl* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -842,7 +842,7 @@ If you do not configure this policy setting, any defined values are deleted. ADMX Info: -- GP English name: *Do not synchronize Windows Apps* +- GP Friendly name: *Do not synchronize Windows Apps* - GP name: *DisableWin8Sync* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -914,7 +914,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Synchronize Windows settings* +- GP Friendly name: *Synchronize Windows settings* - GP name: *DisableWindowsOSSettings* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -981,7 +981,7 @@ Reboot is needed for enable to take effect. With Auto-register inbox templates e ADMX Info: -- GP English name: *Enable UEV* +- GP Friendly name: *Enable UEV* - GP name: *EnableUEV* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1053,7 +1053,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Finance* +- GP Friendly name: *Finance* - GP name: *Finance* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1124,7 +1124,7 @@ If you do not configure this policy setting, any defined values are deleted. ADMX Info: -- GP English name: *First Use Notification* +- GP Friendly name: *First Use Notification* - GP name: *FirstUseNotificationEnabled* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1196,7 +1196,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Games* +- GP Friendly name: *Games* - GP name: *Games* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1270,7 +1270,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Internet Explorer 8* +- GP Friendly name: *Internet Explorer 8* - GP name: *InternetExplorer8* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1342,7 +1342,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Internet Explorer 9* +- GP Friendly name: *Internet Explorer 9* - GP name: *InternetExplorer9* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1414,7 +1414,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Internet Explorer 10* +- GP Friendly name: *Internet Explorer 10* - GP name: *InternetExplorer10* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1486,7 +1486,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Internet Explorer 11* +- GP Friendly name: *Internet Explorer 11* - GP name: *InternetExplorer11* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1559,7 +1559,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Internet Explorer Common Settings* +- GP Friendly name: *Internet Explorer Common Settings* - GP name: *InternetExplorerCommon* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1630,7 +1630,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Maps* +- GP Friendly name: *Maps* - GP name: *Maps* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1700,7 +1700,7 @@ If you disable or do not configure this policy setting, no event is written to t ADMX Info: -- GP English name: *Settings package size warning threshold* +- GP Friendly name: *Settings package size warning threshold* - GP name: *MaxPackageSizeInBytes* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1772,7 +1772,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Access 2010* +- GP Friendly name: *Microsoft Access 2010* - GP name: *MicrosoftOffice2010Access* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1844,7 +1844,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 2010 Common Settings* +- GP Friendly name: *Microsoft Office 2010 Common Settings* - GP name: *MicrosoftOffice2010Common* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1915,7 +1915,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Excel 2010* +- GP Friendly name: *Microsoft Excel 2010* - GP name: *MicrosoftOffice2010Excel* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -1987,7 +1987,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft InfoPath 2010* +- GP Friendly name: *Microsoft InfoPath 2010* - GP name: *MicrosoftOffice2010InfoPath* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2059,7 +2059,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Lync 2010* +- GP Friendly name: *Microsoft Lync 2010* - GP name: *MicrosoftOffice2010Lync* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2130,7 +2130,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft OneNote 2010* +- GP Friendly name: *Microsoft OneNote 2010* - GP name: *MicrosoftOffice2010OneNote* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2202,7 +2202,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Outlook 2010* +- GP Friendly name: *Microsoft Outlook 2010* - GP name: *MicrosoftOffice2010Outlook* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2274,7 +2274,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft PowerPoint 2010* +- GP Friendly name: *Microsoft PowerPoint 2010* - GP name: *MicrosoftOffice2010PowerPoint* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2345,7 +2345,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Project 2010* +- GP Friendly name: *Microsoft Project 2010* - GP name: *MicrosoftOffice2010Project* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2417,7 +2417,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Publisher 2010* +- GP Friendly name: *Microsoft Publisher 2010* - GP name: *MicrosoftOffice2010Publisher* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2489,7 +2489,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft SharePoint Designer 2010* +- GP Friendly name: *Microsoft SharePoint Designer 2010* - GP name: *MicrosoftOffice2010SharePointDesigner* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2561,7 +2561,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft SharePoint Workspace 2010* +- GP Friendly name: *Microsoft SharePoint Workspace 2010* - GP name: *MicrosoftOffice2010SharePointWorkspace* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2633,7 +2633,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Visio 2010* +- GP Friendly name: *Microsoft Visio 2010* - GP name: *MicrosoftOffice2010Visio* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2705,7 +2705,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Word 2010* +- GP Friendly name: *Microsoft Word 2010* - GP name: *MicrosoftOffice2010Word* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2776,7 +2776,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Access 2013* +- GP Friendly name: *Microsoft Access 2013* - GP name: *MicrosoftOffice2013Access* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2848,7 +2848,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Access 2013 backup only* +- GP Friendly name: *Access 2013 backup only* - GP name: *MicrosoftOffice2013AccessBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2920,7 +2920,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 2013 Common Settings* +- GP Friendly name: *Microsoft Office 2013 Common Settings* - GP name: *MicrosoftOffice2013Common* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -2993,7 +2993,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Common 2013 backup only* +- GP Friendly name: *Common 2013 backup only* - GP name: *MicrosoftOffice2013CommonBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3066,7 +3066,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Excel 2013* +- GP Friendly name: *Microsoft Excel 2013* - GP name: *MicrosoftOffice2013Excel* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3137,7 +3137,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Excel 2013 backup only* +- GP Friendly name: *Excel 2013 backup only* - GP name: *MicrosoftOffice2013ExcelBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3209,7 +3209,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft InfoPath 2013* +- GP Friendly name: *Microsoft InfoPath 2013* - GP name: *MicrosoftOffice2013InfoPath* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3281,7 +3281,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *InfoPath 2013 backup only* +- GP Friendly name: *InfoPath 2013 backup only* - GP name: *MicrosoftOffice2013InfoPathBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3352,7 +3352,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Lync 2013* +- GP Friendly name: *Microsoft Lync 2013* - GP name: *MicrosoftOffice2013Lync* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3424,7 +3424,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Lync 2013 backup only* +- GP Friendly name: *Lync 2013 backup only* - GP name: *MicrosoftOffice2013LyncBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3496,7 +3496,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft OneDrive for Business 2013* +- GP Friendly name: *Microsoft OneDrive for Business 2013* - GP name: *MicrosoftOffice2013OneDriveForBusiness* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3568,7 +3568,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft OneNote 2013* +- GP Friendly name: *Microsoft OneNote 2013* - GP name: *MicrosoftOffice2013OneNote* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3640,7 +3640,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *OneNote 2013 backup only* +- GP Friendly name: *OneNote 2013 backup only* - GP name: *MicrosoftOffice2013OneNoteBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3711,7 +3711,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Outlook 2013* +- GP Friendly name: *Microsoft Outlook 2013* - GP name: *MicrosoftOffice2013Outlook* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3783,7 +3783,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Outlook 2013 backup only* +- GP Friendly name: *Outlook 2013 backup only* - GP name: *MicrosoftOffice2013OutlookBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3855,7 +3855,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft PowerPoint 2013* +- GP Friendly name: *Microsoft PowerPoint 2013* - GP name: *MicrosoftOffice2013PowerPoint* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3927,7 +3927,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *PowerPoint 2013 backup only* +- GP Friendly name: *PowerPoint 2013 backup only* - GP name: *MicrosoftOffice2013PowerPointBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -3998,7 +3998,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Project 2013* +- GP Friendly name: *Microsoft Project 2013* - GP name: *MicrosoftOffice2013Project* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4070,7 +4070,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Project 2013 backup only* +- GP Friendly name: *Project 2013 backup only* - GP name: *MicrosoftOffice2013ProjectBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4142,7 +4142,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Publisher 2013* +- GP Friendly name: *Microsoft Publisher 2013* - GP name: *MicrosoftOffice2013Publisher* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4214,7 +4214,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Publisher 2013 backup only* +- GP Friendly name: *Publisher 2013 backup only* - GP name: *MicrosoftOffice2013PublisherBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4286,7 +4286,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft SharePoint Designer 2013* +- GP Friendly name: *Microsoft SharePoint Designer 2013* - GP name: *MicrosoftOffice2013SharePointDesigner* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4357,7 +4357,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *SharePoint Designer 2013 backup only* +- GP Friendly name: *SharePoint Designer 2013 backup only* - GP name: *MicrosoftOffice2013SharePointDesignerBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4428,7 +4428,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 2013 Upload Center* +- GP Friendly name: *Microsoft Office 2013 Upload Center* - GP name: *MicrosoftOffice2013UploadCenter* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4500,7 +4500,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Visio 2013* +- GP Friendly name: *Microsoft Visio 2013* - GP name: *MicrosoftOffice2013Visio* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4572,7 +4572,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Visio 2013 backup only* +- GP Friendly name: *Visio 2013 backup only* - GP name: *MicrosoftOffice2013VisioBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4644,7 +4644,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Word 2013* +- GP Friendly name: *Microsoft Word 2013* - GP name: *MicrosoftOffice2013Word* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4716,7 +4716,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Word 2013 backup only* +- GP Friendly name: *Word 2013 backup only* - GP name: *MicrosoftOffice2013WordBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4788,7 +4788,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Access 2016* +- GP Friendly name: *Microsoft Access 2016* - GP name: *MicrosoftOffice2016Access* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4860,7 +4860,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Access 2016 backup only* +- GP Friendly name: *Access 2016 backup only* - GP name: *MicrosoftOffice2016AccessBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -4932,7 +4932,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 2016 Common Settings* +- GP Friendly name: *Microsoft Office 2016 Common Settings* - GP name: *MicrosoftOffice2016Common* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5005,7 +5005,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Common 2016 backup only* +- GP Friendly name: *Common 2016 backup only* - GP name: *MicrosoftOffice2016CommonBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5077,7 +5077,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Excel 2016* +- GP Friendly name: *Microsoft Excel 2016* - GP name: *MicrosoftOffice2016Excel* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5149,7 +5149,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Excel 2016 backup only* +- GP Friendly name: *Excel 2016 backup only* - GP name: *MicrosoftOffice2016ExcelBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5221,7 +5221,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Lync 2016* +- GP Friendly name: *Microsoft Lync 2016* - GP name: *MicrosoftOffice2016Lync* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5293,7 +5293,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Lync 2016 backup only* +- GP Friendly name: *Lync 2016 backup only* - GP name: *MicrosoftOffice2016LyncBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5365,7 +5365,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft OneDrive for Business 2016* +- GP Friendly name: *Microsoft OneDrive for Business 2016* - GP name: *MicrosoftOffice2016OneDriveForBusiness* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5437,7 +5437,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft OneNote 2016* +- GP Friendly name: *Microsoft OneNote 2016* - GP name: *MicrosoftOffice2016OneNote* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5509,7 +5509,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *OneNote 2016 backup only* +- GP Friendly name: *OneNote 2016 backup only* - GP name: *MicrosoftOffice2016OneNoteBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5581,7 +5581,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Outlook 2016* +- GP Friendly name: *Microsoft Outlook 2016* - GP name: *MicrosoftOffice2016Outlook* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5653,7 +5653,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Outlook 2016 backup only* +- GP Friendly name: *Outlook 2016 backup only* - GP name: *MicrosoftOffice2016OutlookBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5725,7 +5725,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft PowerPoint 2016* +- GP Friendly name: *Microsoft PowerPoint 2016* - GP name: *MicrosoftOffice2016PowerPoint* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5797,7 +5797,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *PowerPoint 2016 backup only* +- GP Friendly name: *PowerPoint 2016 backup only* - GP name: *MicrosoftOffice2016PowerPointBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5870,7 +5870,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Project 2016* +- GP Friendly name: *Microsoft Project 2016* - GP name: *MicrosoftOffice2016Project* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -5941,7 +5941,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Project 2016 backup only* +- GP Friendly name: *Project 2016 backup only* - GP name: *MicrosoftOffice2016ProjectBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6013,7 +6013,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Publisher 2016* +- GP Friendly name: *Microsoft Publisher 2016* - GP name: *MicrosoftOffice2016Publisher* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6085,7 +6085,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Publisher 2016 backup only* +- GP Friendly name: *Publisher 2016 backup only* - GP name: *MicrosoftOffice2016PublisherBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6156,7 +6156,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 2016 Upload Center* +- GP Friendly name: *Microsoft Office 2016 Upload Center* - GP name: *MicrosoftOffice2016UploadCenter* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6228,7 +6228,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Visio 2016* +- GP Friendly name: *Microsoft Visio 2016* - GP name: *MicrosoftOffice2016Visio* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6300,7 +6300,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Visio 2016 backup only* +- GP Friendly name: *Visio 2016 backup only* - GP name: *MicrosoftOffice2016VisioBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6372,7 +6372,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Word 2016* +- GP Friendly name: *Microsoft Word 2016* - GP name: *MicrosoftOffice2016Word* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6444,7 +6444,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Word 2016 backup only* +- GP Friendly name: *Word 2016 backup only* - GP name: *MicrosoftOffice2016WordBackup* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6516,7 +6516,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Access 2013* +- GP Friendly name: *Microsoft Office 365 Access 2013* - GP name: *MicrosoftOffice365Access2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6588,7 +6588,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Access 2016* +- GP Friendly name: *Microsoft Office 365 Access 2016* - GP name: *MicrosoftOffice365Access2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6660,7 +6660,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Common 2013* +- GP Friendly name: *Microsoft Office 365 Common 2013* - GP name: *MicrosoftOffice365Common2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6731,7 +6731,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Common 2016* +- GP Friendly name: *Microsoft Office 365 Common 2016* - GP name: *MicrosoftOffice365Common2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6803,7 +6803,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Excel 2013* +- GP Friendly name: *Microsoft Office 365 Excel 2013* - GP name: *MicrosoftOffice365Excel2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6875,7 +6875,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Excel 2016* +- GP Friendly name: *Microsoft Office 365 Excel 2016* - GP name: *MicrosoftOffice365Excel2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -6946,7 +6946,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 InfoPath 2013* +- GP Friendly name: *Microsoft Office 365 InfoPath 2013* - GP name: *MicrosoftOffice365InfoPath2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7018,7 +7018,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Lync 2013* +- GP Friendly name: *Microsoft Office 365 Lync 2013* - GP name: *MicrosoftOffice365Lync2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7090,7 +7090,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Lync 2016* +- GP Friendly name: *Microsoft Office 365 Lync 2016* - GP name: *MicrosoftOffice365Lync2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7162,7 +7162,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 OneNote 2013* +- GP Friendly name: *Microsoft Office 365 OneNote 2013* - GP name: *MicrosoftOffice365OneNote2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7234,7 +7234,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 OneNote 2016* +- GP Friendly name: *Microsoft Office 365 OneNote 2016* - GP name: *MicrosoftOffice365OneNote2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7306,7 +7306,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Outlook 2013* +- GP Friendly name: *Microsoft Office 365 Outlook 2013* - GP name: *MicrosoftOffice365Outlook2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7378,7 +7378,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Outlook 2016* +- GP Friendly name: *Microsoft Office 365 Outlook 2016* - GP name: *MicrosoftOffice365Outlook2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7450,7 +7450,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 PowerPoint 2013* +- GP Friendly name: *Microsoft Office 365 PowerPoint 2013* - GP name: *MicrosoftOffice365PowerPoint2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7522,7 +7522,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 PowerPoint 2016* +- GP Friendly name: *Microsoft Office 365 PowerPoint 2016* - GP name: *MicrosoftOffice365PowerPoint2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7594,7 +7594,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Project 2013* +- GP Friendly name: *Microsoft Office 365 Project 2013* - GP name: *MicrosoftOffice365Project2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7665,7 +7665,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Project 2016* +- GP Friendly name: *Microsoft Office 365 Project 2016* - GP name: *MicrosoftOffice365Project2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7737,7 +7737,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Publisher 2013* +- GP Friendly name: *Microsoft Office 365 Publisher 2013* - GP name: *MicrosoftOffice365Publisher2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7809,7 +7809,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Publisher 2016* +- GP Friendly name: *Microsoft Office 365 Publisher 2016* - GP name: *MicrosoftOffice365Publisher2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7881,7 +7881,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 SharePoint Designer 2013* +- GP Friendly name: *Microsoft Office 365 SharePoint Designer 2013* - GP name: *MicrosoftOffice365SharePointDesigner2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -7953,7 +7953,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Visio 2013* +- GP Friendly name: *Microsoft Office 365 Visio 2013* - GP name: *MicrosoftOffice365Visio2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8025,7 +8025,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Visio 2016* +- GP Friendly name: *Microsoft Office 365 Visio 2016* - GP name: *MicrosoftOffice365Visio2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8097,7 +8097,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Word 2013* +- GP Friendly name: *Microsoft Office 365 Word 2013* - GP name: *MicrosoftOffice365Word2013* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8169,7 +8169,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Microsoft Office 365 Word 2016* +- GP Friendly name: *Microsoft Office 365 Word 2016* - GP name: *MicrosoftOffice365Word2016* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8240,7 +8240,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Music* +- GP Friendly name: *Music* - GP name: *Music* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8312,7 +8312,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *News* +- GP Friendly name: *News* - GP name: *News* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8384,7 +8384,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Notepad* +- GP Friendly name: *Notepad* - GP name: *Notepad* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8457,7 +8457,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Reader* +- GP Friendly name: *Reader* - GP name: *Reader* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8527,7 +8527,7 @@ If you disable or do not configure this policy setting, the default value of 200 ADMX Info: -- GP English name: *Synchronization timeout* +- GP Friendly name: *Synchronization timeout* - GP name: *RepositoryTimeout* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8597,7 +8597,7 @@ If you disable or do not configure this policy setting, the user settings are st ADMX Info: -- GP English name: *Settings storage path* +- GP Friendly name: *Settings storage path* - GP name: *SettingsStoragePath* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8673,7 +8673,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Settings template catalog path* +- GP Friendly name: *Settings template catalog path* - GP name: *SettingsTemplateCatalogPath* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8745,7 +8745,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Sports* +- GP Friendly name: *Sports* - GP name: *Sports* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8811,7 +8811,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting al ADMX Info: -- GP English name: *Use User Experience Virtualization (UE-V)* +- GP Friendly name: *Use User Experience Virtualization (UE-V)* - GP name: *SyncEnabled* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8882,7 +8882,7 @@ If you do not configure this policy setting, any defined values are deleted. ADMX Info: -- GP English name: *Sync settings over metered connections* +- GP Friendly name: *Sync settings over metered connections* - GP name: *SyncOverMeteredNetwork* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -8954,7 +8954,7 @@ If you do not configure this policy setting, any defined values are deleted. ADMX Info: -- GP English name: *Sync settings over metered connections even when roaming* +- GP Friendly name: *Sync settings over metered connections even when roaming* - GP name: *SyncOverMeteredNetworkWhenRoaming* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9026,7 +9026,7 @@ If you do not configure this policy, any defined values will be deleted. ADMX Info: -- GP English name: *Ping the settings storage location before sync* +- GP Friendly name: *Ping the settings storage location before sync* - GP name: *SyncProviderPingEnabled* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9097,7 +9097,7 @@ If you do not configure this policy setting, any defined values are deleted. ADMX Info: -- GP English name: *Sync Unlisted Windows Apps* +- GP Friendly name: *Sync Unlisted Windows Apps* - GP name: *SyncUnlistedWindows8Apps* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9169,7 +9169,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Travel* +- GP Friendly name: *Travel* - GP name: *Travel* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9238,7 +9238,7 @@ If you do not configure this policy setting, any defined values are deleted. ADMX Info: -- GP English name: *Tray Icon* +- GP Friendly name: *Tray Icon* - GP name: *TrayIconEnabled* - GP path: *Windows Components\Microsoft User Experience Virtualization* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9310,7 +9310,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Video* +- GP Friendly name: *Video* - GP name: *Video* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9382,7 +9382,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *Weather* +- GP Friendly name: *Weather* - GP name: *Weather* - GP path: *Windows Components\Microsoft User Experience Virtualization\Windows Apps* - GP ADMX file name: *UserExperienceVirtualization.admx* @@ -9453,7 +9453,7 @@ If you do not configure this policy setting, any defined values will be deleted. ADMX Info: -- GP English name: *WordPad* +- GP Friendly name: *WordPad* - GP name: *Wordpad* - GP path: *Windows Components\Microsoft User Experience Virtualization\Applications* - GP ADMX file name: *UserExperienceVirtualization.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-userprofiles.md b/windows/client-management/mdm/policy-csp-admx-userprofiles.md index 2382a9fb8e..7e23b796b2 100644 --- a/windows/client-management/mdm/policy-csp-admx-userprofiles.md +++ b/windows/client-management/mdm/policy-csp-admx-userprofiles.md @@ -111,7 +111,7 @@ If you disable or do not configure this policy setting, User Profile Service wil ADMX Info: -- GP English name: *Delete user profiles older than a specified number of days on system restart* +- GP Friendly name: *Delete user profiles older than a specified number of days on system restart* - GP name: *CleanupProfiles* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -182,7 +182,7 @@ If you disable or do not configure this policy setting, Windows will always unlo ADMX Info: -- GP English name: *Do not forcefully unload the users registry at user logoff* +- GP Friendly name: *Do not forcefully unload the users registry at user logoff* - GP name: *DontForceUnloadHive* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -256,7 +256,7 @@ If you disable or do not configure this policy setting, Windows will delete the ADMX Info: -- GP English name: *Leave Windows Installer and Group Policy Software Installation Data* +- GP Friendly name: *Leave Windows Installer and Group Policy Software Installation Data* - GP name: *LeaveAppMgmtData* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -334,7 +334,7 @@ If you enable this policy setting, you can: ADMX Info: -- GP English name: *Limit profile size* +- GP Friendly name: *Limit profile size* - GP name: *LimitSize* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -407,7 +407,7 @@ Also, see the "Delete cached copies of roaming profiles" policy setting. ADMX Info: -- GP English name: *Do not log users on with temporary profiles* +- GP Friendly name: *Do not log users on with temporary profiles* - GP name: *ProfileErrorAction* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -480,7 +480,7 @@ If you disable or do not configure this policy setting, Windows considers the ne ADMX Info: -- GP English name: *Control slow network connection timeout for user profiles* +- GP Friendly name: *Control slow network connection timeout for user profiles* - GP name: *SlowLinkTimeOut* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -558,7 +558,7 @@ If the "Set Remote Desktop Services User Home Directory" policy setting is enabl ADMX Info: -- GP English name: *Set user home folder* +- GP Friendly name: *Set user home folder* - GP name: *USER_HOME* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* @@ -631,7 +631,7 @@ If you do not configure or disable this policy the user will have full control o ADMX Info: -- GP English name: *User management of sharing user name, account picture, and domain information with apps (not desktop apps)* +- GP Friendly name: *User management of sharing user name, account picture, and domain information with apps (not desktop apps)* - GP name: *UserInfoAccessAction* - GP path: *System\User Profiles* - GP ADMX file name: *UserProfiles.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-w32time.md b/windows/client-management/mdm/policy-csp-admx-w32time.md index 7a60fbadde..2d0f47d74c 100644 --- a/windows/client-management/mdm/policy-csp-admx-w32time.md +++ b/windows/client-management/mdm/policy-csp-admx-w32time.md @@ -175,7 +175,7 @@ This parameter controls the frequency at which an event that indicates the numbe ADMX Info: -- GP English name: *Global Configuration Settings* +- GP Friendly name: *Global Configuration Settings* - GP name: *W32TIME_POLICY_CONFIG* - GP path: *System\Windows Time Service* - GP ADMX file name: *W32Time.admx* @@ -265,7 +265,7 @@ This value is a bitmask that controls events that may be logged to the System lo ADMX Info: -- GP English name: *Configure Windows NTP Client* +- GP Friendly name: *Configure Windows NTP Client* - GP name: *W32TIME_POLICY_CONFIGURE_NTPCLIENT* - GP path: *System\Windows Time Service\Time Providers* - GP ADMX file name: *W32Time.admx* @@ -336,7 +336,7 @@ If you disable or do not configure this policy setting, the local computer clock ADMX Info: -- GP English name: *Enable Windows NTP Client* +- GP Friendly name: *Enable Windows NTP Client* - GP name: *W32TIME_POLICY_ENABLE_NTPCLIENT* - GP path: *System\Windows Time Service\Time Providers* - GP ADMX file name: *W32Time.admx* @@ -405,7 +405,7 @@ If you disable or do not configure this policy setting, your computer cannot ser ADMX Info: -- GP English name: *Enable Windows NTP Server* +- GP Friendly name: *Enable Windows NTP Server* - GP name: *W32TIME_POLICY_ENABLE_NTPSERVER* - GP path: *System\Windows Time Service\Time Providers* - GP ADMX file name: *W32Time.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-wcm.md b/windows/client-management/mdm/policy-csp-admx-wcm.md index 85f0ad3341..3ec0e0695a 100644 --- a/windows/client-management/mdm/policy-csp-admx-wcm.md +++ b/windows/client-management/mdm/policy-csp-admx-wcm.md @@ -96,7 +96,7 @@ If this policy setting is not configured or is disabled, power management is ena ADMX Info: -- GP English name: *Disable power management in connected standby mode* +- GP Friendly name: *Disable power management in connected standby mode* - GP name: *WCM_DisablePowerManagement* - GP path: *Network\Windows Connection Manager* - GP ADMX file name: *WCM.admx* @@ -173,7 +173,7 @@ This policy setting depends on other group policy settings. For example, if 'Min ADMX Info: -- GP English name: *Enable Windows to soft-disconnect a computer from a network* +- GP Friendly name: *Enable Windows to soft-disconnect a computer from a network* - GP name: *WCM_EnableSoftDisconnect* - GP path: *Network\Windows Connection Manager* - GP ADMX file name: *WCM.admx* @@ -248,7 +248,7 @@ This policy setting is related to the "Enable Windows to soft-disconnect a compu ADMX Info: -- GP English name: *Minimize the number of simultaneous connections to the Internet or a Windows Domain* +- GP Friendly name: *Minimize the number of simultaneous connections to the Internet or a Windows Domain* - GP name: *WCM_MinimizeConnections* - GP path: *Network\Windows Connection Manager* - GP ADMX file name: *WCM.admx* From e053475a65b3fe035261a25feed8e017fce3d90e Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 13 Aug 2021 10:59:43 +0530 Subject: [PATCH 0024/1214] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 4756e91351..2236fa4ae0 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18947,12 +18947,12 @@ }, { "source_path": "windows/client-management/windows-10-mobile-and-mdm.md", - "redirect_url": "/windows/client-management/index.yml", + "redirect_url": "/windows/client-management/index", "redirect_document_id": false }, { "source_path": "windows/application-management/deploy-app-upgrades-windows-10-mobile.md", - "redirect_url": "/windows/application-management/index.yml", + "redirect_url": "/windows/application-management/index", "redirect_document_id": false } From a9143ae0e567066816a7850fa0bdf0e68dcb81b7 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 13 Aug 2021 11:51:51 +0530 Subject: [PATCH 0025/1214] resolved one set of warnings in PR --- .openpublishing.redirection.json | 2 +- windows/deployment/upgrade/submit-errors.md | 2 +- .../upgrade-windows-phone-8-1-to-10.md | 114 ------------------ 3 files changed, 2 insertions(+), 116 deletions(-) delete mode 100644 windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 9939d5877c..43dec14204 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18947,7 +18947,7 @@ }, { "source_path": "windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md", - "redirect_url": "windows/deployment/upgrade/windows-10-edition-upgrades.md", + "redirect_url": "windows/deployment/upgrade/windows-10-edition-upgrades", "redirect_document_id": false } ] diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index d8d9fd5ecf..5fd55b947c 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -69,7 +69,7 @@ After you click Submit, that's all you need to do. Microsoft will receive your f After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. -![share](../images/share.jpg) +![share link](../images/share.jpg) ## Related topics diff --git a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md b/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md deleted file mode 100644 index 8d2dad79dd..0000000000 --- a/windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md +++ /dev/null @@ -1,114 +0,0 @@ ---- -title: Upgrade Windows Phone 8.1 to Windows 10 Mobile in an MDM environment (Windows 10) -ms.reviewer: -manager: laurawi -ms.author: greglin -description: This article describes how to upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using MDM. -keywords: upgrade, update, windows, phone, windows 10, mdm, mobile -ms.prod: w10 -ms.mktglfcycl: deploy -ms.localizationpriority: medium -ms.sitesec: library -ms.pagetype: mdm -audience: itpro -author: greg-lindsay -ms.topic: article ---- - -# Upgrade a Windows Phone 8.1 to Windows 10 Mobile with Mobile Device Management (MDM) - -**Applies to** - -- Windows 10 Mobile - -## Summary - -This article describes how system administrators can upgrade eligible Windows Phone 8.1 devices to Windows 10 Mobile using [Mobile Device Management](/windows/client-management/mdm/) (MDM). - ->[!IMPORTANT] ->If you are not a system administrator, see the [Windows 10 Mobile Upgrade & Updates](https://www.microsoft.com/windows/windows-10-mobile-upgrade) page for details about updating your Windows 8.1 Mobile device to Windows 10 Mobile using the [Upgrade Advisor](https://www.microsoft.com/store/p/upgrade-advisor/9nblggh0f5g4). - -## Upgrading with MDM - -The Windows Phone 8.1 to Windows 10 Mobile upgrade uses an "opt-in" or "seeker" model. To determine if the device is eligible for an upgrade with MDM, see the [How to determine whether an upgrade is available for a device](#howto-upgrade-available) topic in this article. An eligible device must opt-in to be offered the upgrade. For consumers, the Windows 10 Mobile Upgrade Advisor app is available from the Windows Store to perform the opt-in. For Enterprises, Microsoft is offering a centralized management solution through MDM that can push a management policy to each eligible device to perform the opt-in. - -If you use a list of allowed applications (an app allowlist) with MDM, verify that system applications are allow-listed before you upgrade to Windows 10 Mobile. Also, be aware that there are [known issues](/windows/client-management/mdm/new-in-windows-mdm-enrollment-management) with app allowlists that could adversely affect the device after you upgrade. - -Some enterprises might want to control the availability of the Windows 10 Mobile upgrade to their users. With the opt-in model, the enterprise can block the Upgrade Advisor app to prevent their users from upgrading prematurely. For more information about how to restrict the Upgrade Advisor app, see the [How to restrict the Upgrade Advisor app](#howto-restrict) section in this article. Enterprises that have restricted the Upgrade Advisor app can use the solution described in this article to select the upgrade timing on a per-device basis. - -## More information - -To provide enterprises with a solution that's independent of the Upgrade Advisor, a new registry key in the registry configuration service provider (CSP) is available. A special GUID key value is defined. When Microsoft Update (MU) detects the presence of the registry key value on a device, any available upgrade will be made available to the device. - -### Prerequisites - -- Windows Phone 8.1 device with an available upgrade to Windows 10 Mobile. -- Device connected to Wi-Fi or cellular network to perform scan for upgrade. -- Device is already enrolled with an MDM session. -- Device is able to receive the management policy. -- MDM is capable of pushing the management policy to devices. Minimum version numbers for some popular MDM providers that support this solution are: InTune: 5.0.5565, AirWatch: 8.2, Mobile Iron: 9.0. - -### Instructions for the MDM server - -The registry CSP is used to push the GUID value to the following registry key for which the Open Mobile Alliance (OMA) Device Management (DM) client has Read/Write access and for which the Device Update service has Read access. - -``` -[HKLM\Software\Microsoft\Provisioning\OMADM] -"EnterpriseUpgrade"="d369c9b6-2379-466d-9162-afc53361e3c2” -``` - - -The complete SyncML command for the solution is as follows. Note: The SyncML may vary, depending on your MDM solution. - -``` -SyncML xmlns="SYNCML:SYNCML1.1"> - - - 250 - - - ./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade - - - chr - - d369c9b6-2379-466d-9162-afc53361e3c2 - - - - - -``` - -The OMA DM server policy description is provided in the following table: - -|Item |Setting | -|------|------------| -| OMA-URI |./Vendor/MSFT/Registry/HKLM/SOFTWARE/Microsoft/Provisioning/OMADM/EnterpriseUpgrade | -| Data Type |String | -| Value |d369c9b6-2379-466d-9162-afc53361e3c2 | - - -After the device consumes the policy, it will be able to receive an available upgrade. - -To disable the policy, delete the **OMADM** registry key or set the **EnterpriseUpgrade** string value to anything other than the GUID. - -### How to determine whether an upgrade is available for a device - -The Windows 10 Mobile Upgrade Advisor app is not designed or intended for Enterprise customers who want to automate the upgrade process. However, the Windows 10 Mobile Upgrade Advisor app is the best mechanism to determine when an upgrade is available. The app dynamically queries whether the upgrade is released for this device model and associated mobile operator (MO). - -We recommend that enterprises use a pilot device with the Windows 10 Mobile Upgrade Advisor app installed. The pilot device provides the device model and MO used by the enterprise. When you run the app on the pilot device, it will tell you that either an upgrade is available, that the device is eligible for upgrade, or that an upgrade is not available for this device. - -Note: The availability of Windows 10 Mobile as an update for existing Windows Phone 8.1 devices varies by device manufacturer, device model, country or region, mobile operator or service provider, hardware limitations, and other factors. To check for compatibility and other important installation information, see the [Windows 10 Mobile FAQ](https://support.microsoft.com/help/10599/windows-10-mobile-how-to-get) page. - -### How to restrict the Upgrade Advisor app - -Some enterprises may want to block their users from installing the Windows 10 Mobile Upgrade Advisor app. With Windows Phone 8.1, you can allow or deny individual apps by adding specific app publishers or the app globally unique identifier (GUID) from the Window Phone Store to an allow or deny XML list. The GUID for a particular application can be found in the URL for the app in the phone store. For example, the GUID to the Windows 10 Mobile Upgrade Adviser (fbe47e4f-7769-4103-910e-dca8c43e0b07) is displayed in the following URL: - -http://windowsphone.com/s?appid=fbe47e4f-7769-4103-910e-dca8c43e0b07 - -For more information about how to do this, see [Try it out: restrict Windows Phone 8.1 apps](/previous-versions/windows/it-pro/windows-phone/cc182269(v=technet.10)). - -## Related topics - -[Windows 10 Mobile and mobile device management](/windows/client-management/windows-10-mobile-and-mdm) \ No newline at end of file From 5a095a4fcfa04e3e9c9542e99b83a6d7d8cc2e5a Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 13 Aug 2021 12:54:00 +0530 Subject: [PATCH 0026/1214] removed a disallowed HTML attribute --- windows/deployment/upgrade/windows-10-upgrade-paths.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/upgrade/windows-10-upgrade-paths.md b/windows/deployment/upgrade/windows-10-upgrade-paths.md index 90b70d3dee..8970d2a5cf 100644 --- a/windows/deployment/upgrade/windows-10-upgrade-paths.md +++ b/windows/deployment/upgrade/windows-10-upgrade-paths.md @@ -50,7 +50,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar Windows 10 Enterprise - Windows 7 + Windows 7 Starter @@ -101,7 +101,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar ✔ - Windows 8.1 + Windows 8.1 (Core) @@ -176,7 +176,7 @@ D = Edition downgrade; personal data is maintained, applications and settings ar - Windows 10 + Windows 10 Home From 25903ef452615043883ea8a46cd79ef3c1b6b010 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 13 Aug 2021 12:57:06 +0530 Subject: [PATCH 0027/1214] Update windows-10-edition-upgrades.md --- windows/deployment/upgrade/windows-10-edition-upgrades.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 2a8de2b590..57307ee3d0 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -165,7 +165,7 @@ You can move directly from Enterprise to any valid destination edition. In this Enterprise - Starting edition + Starting edition Home From c0cfc4fec8b2d1ce0d2098308b1685f8edd4fcae Mon Sep 17 00:00:00 2001 From: John Flores Date: Fri, 13 Aug 2021 11:26:57 -0400 Subject: [PATCH 0028/1214] [Device Identity] Migrate device registration topic to Azure AD docs --- .openpublishing.redirection.json | 5 ++ .../hello-how-it-works-device-registration.md | 89 ------------------- .../hello-for-business/toc.yml | 2 - 3 files changed, 5 insertions(+), 91 deletions(-) delete mode 100644 windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 6a465d87b3..873cf53f16 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -215,6 +215,11 @@ "redirect_url": "/surface/manage-surface-driver-and-firmware-updates", "redirect_document_id": false }, + { + "source_path": "windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md", + "redirect_url": "/azure/active-directory/devices/device-registration-how-it-works", + "redirect_document_id": false + }, { "source_path": "windows/security/threat-protection/windows-defender-exploit-guard/collect-cab-files-exploit-guard-submission.md", "redirect_url": "/microsoft-365/security/defender-endpoint/troubleshoot-exploit-protection-mitigations", diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md deleted file mode 100644 index e91ce1f65c..0000000000 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-device-registration.md +++ /dev/null @@ -1,89 +0,0 @@ ---- -title: How Windows Hello for Business works - Device Registration -description: Explains registration, authentication, key material, and infrastructure for Windows Hello for Business. -ms.prod: w10 -ms.mktglfcycl: deploy -ms.sitesec: library -ms.pagetype: security -audience: ITPro -author: mapalko -ms.author: mapalko -manager: dansimp -ms.collection: M365-identity-device-management -ms.topic: article -localizationpriority: medium -ms.date: 08/19/2018 -ms.reviewer: ---- -# Windows Hello for Business and Device Registration - -**Applies to:** -- Windows 10 - -Device Registration is a prerequisite to Windows Hello for Business provisioning. Device registration occurs regardless of a cloud, hybrid, or on-premises deployments. For cloud and hybrid deployments, devices register with Azure Active Directory. For on-premises deployments, devices registered with the enterprise device registration service hosted by Active Directory Federation Services (AD FS). - -[Azure AD joined in Managed environments](#azure-ad-joined-in-managed-environments)
-[Azure AD joined in Federated environments](#azure-ad-joined-in-federated-environments)
-[Hybrid Azure AD joined in Managed environments](#hybrid-azure-ad-joined-in-managed-environments)
-[Hybrid Azure AD joined in Federated environments](#hybrid-azure-ad-joined-in-federated-environments)
- -## Azure AD joined in Managed environments -![Azure AD joined in Managed environments](images/howitworks/devreg-aadj-managed.png) - -| Phase | Description | -| :----: | :----------- | -|A | The most common way Azure AD joined devices register with Azure is during the out-of-box-experience (OOBE) where it loads the Azure AD join web application in the Cloud Experience Host (CXH) application. The application sends a GET request to the Azure OpenID configuration endpoint to discover authorization endpoints. Azure returns the OpenID configuration, which includes the authorization endpoints, to application as JSON document.| -|B | The application builds a sign-in request for the authorization end point and collects user credentials.| -|C | After the user provides their user name (in UPN format), the application sends a GET request to Azure to discover corresponding realm information for the user. This determines if the environment is managed or federated. Azure returns the information in a JSON object. The application determines the environment is managed (non-federated).
The last step in this phase has the application create an authentication buffer and if in OOBE, temporarily caches it for automatic sign-in at the end of OOBE. The application POSTs the credentials to Azure Active Directory where they are validated. Azure Active Directory returns an ID token with claims.| -|D | The application looks for MDM terms of use (the mdm_tou_url claim). If present, the application retrieves the terms of use from the claim's value, present the contents to the user, and waits for the user to accept the terms of use. This step is optional and skipped if the claim is not present or if the claim value is empty.| -|E | The application sends a device registration discovery request to the Azure Device Registration Service (ADRS). Azure DRS returns a discovery data document, which returns tenant specific URIs to complete device registration.| -|F | The application creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| -|G | The application sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client.| -|H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the process continues with MDM enrollment.| - -[Return to top](#windows-hello-for-business-and-device-registration) -## Azure AD joined in Federated environments -![Azure AD joined in Managed environments](images/howitworks/devreg-aadj-federated.png) - -| Phase | Description | -| :----: | :----------- | -|A | The most common way Azure AD joined devices register with Azure is during the out-of-box-experience (OOBE) where it loads the Azure AD join web application in the Cloud Experience Host (CXH) application. The application sends a GET request to the Azure OpenID configuration endpoint to discover authorization endpoints. Azure returns the OpenID configuration, which includes the authorization endpoints, to application as JSON document.| -|B | The application builds a sign-in request for the authorization end point and collects user credentials.| -|C | After the user provides their user name (in UPN format), the application sends a GET request to Azure to discover corresponding realm information for the user. This determines if the environment is managed or federated. Azure returns the information in a JSON object. The application determines the environment is federated.
The application redirects to the AuthURL value (on-premises STS sign-in page) in the returned JSON realm object. The application collects credentials through the STS web page.| -|D | The application POST the credential to the on-premises STS, which may require additional factors of authentication. The on-premises STS authenticates the user and returns a token. The application POSTs the token to Azure Active Directory for authentication. Azure Active Directory validates the token and returns an ID token with claims.| -|E | The application looks for MDM terms of use (the mdm_tou_url claim). If present, the application retrieves the terms of use from the claim's value, present the contents to the user, and waits for the user to accept the terms of use. This step is optional and skipped if the claim is not present or if the claim value is empty.| -|F | The application sends a device registration discovery request to the Azure Device Registration Service (ADRS). Azure DRS returns a discovery data document, which returns tenant specific URIs to complete device registration.| -|G | The application creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| -|H | The application sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client.| -|I | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the process continues with MDM enrollment.| - -[Return to top](#windows-hello-for-business-and-device-registration) -## Hybrid Azure AD joined in Managed environments -![Hybrid Azure AD joined in Managed environments](images/howitworks/devreg-hybrid-haadj-managed.png) - -| Phase | Description | -| :----: | :----------- | -| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in.| -|B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.| -|C | For the managed environment, the task creates an initial authentication credential in the form of a self-signed certificate. The task write the certificate to the userCertificate attribute on the computer object in Active Directory using LDAP. -|D |The computer cannot authenticate to Azure DRS until a device object representing the computer that includes the certificate on the userCertificate attribute is created in Azure Active Directory. Azure AD Connect detects an attribute change. On the next synchronization cycle, Azure AD Connect sends the userCertificate, object GUID, and computer SID to Azure DRS. Azure DRS uses the attribute information to create a device object in Azure Active Directory.| -|E | The Automatic Device Join task triggers with each user sign-in or every hour, and tries to authenticate the computer to Azure Active Directory using the corresponding private key of the public key in the userCertificate attribute. Azure Active Directory authenticates the computer and issues a ID token to the computer.| -|F | The task creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| -|G | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then updates the device object in Azure Active Directory and sends the device ID and the device certificate to the client.| -|H | Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.| - -[Return to top](#windows-hello-for-business-and-device-registration) -## Hybrid Azure AD joined in Federated environments -![Hybrid Azure AD joined in Managed environments](images/howitworks/devreg-hybrid-haadj-federated.png) - -| Phase | Description | -| :----: | :----------- | -| A | The user signs in to a domain joined Windows 10 computers using domain credentials. This can be user name and password or smart card authentication. The user sign-in triggers the Automatic Device Join task. Note: the Automatic Device Join tasks is triggered on domain join as well as retried every hour. It does not solely depend on the user sign-in. | -|B | The task queries Active Directory using the LDAP protocol for the keywords attribute on service connection point stored in the configuration partition in Active Directory (CN=62a0ff2e-97b9-4513-943f-0d221bd30080,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=corp,DC=contoso,DC=com). The value returned in the keywords attribute determines if device registration is directed to Azure Device Registration Service (ADRS) or the enterprise device registration service hosted on-premises.| -|C | For the federated environments, the computer authenticates the enterprise device registration endpoint using Windows integrated authentication. The enterprise device registration service creates and returns a token that includes claims for the object GUID, computer SID, and domain joined state. The task submits the token and claims to Azure Active Directory where it is validated. Azure Active Directory returns an ID token to the running task. -|D | The application creates TPM bound (preferred) RSA 2048 bit key-pair known as the device key (dkpub/dkpriv). The application create a certificate request using dkpub and the public key and signs the certificate request with using dkpriv. Next, the application derives second key pair from the TPM's storage root key. This is the transport key (tkpub/tkpriv).| -|E | To provide SSO for on-premises federated application, the task requests an enterprise PRT from the on-premises STS. Windows Server 2016 running the Active Directory Federation Services role validate the request and return it the running task.| -|F | The task sends a device registration request to Azure DRS that includes the ID token, certificate request, tkpub, and attestation data. Azure DRS validates the ID token, creates a device ID, and creates a certificate based on the included certificate request. Azure DRS then writes a device object in Azure Active Directory and sends the device ID and the device certificate to the client. Device registration completes by receiving the device ID and the device certificate from Azure DRS. The device ID is saved for future reference (viewable from dsregcmd.exe /status), and the device certificate is installed in the Personal store of the computer. With device registration complete, the task exits.| -|G | If Azure AD Connect device write-back is enabled, Azure AD Connect requests updates from Azure Active Directory at its next synchronization cycle (device write-back is required for hybrid deployment using certificate trust). Azure Active Directory correlates the device object with a matching synchronized computer object. Azure AD Connect receives the device object that includes the object GUID and computer SID and writes the device object to Active Directory.| - -[Return to top](#windows-hello-for-business-and-device-registration) diff --git a/windows/security/identity-protection/hello-for-business/toc.yml b/windows/security/identity-protection/hello-for-business/toc.yml index 60161ce7da..f0c08b1c66 100644 --- a/windows/security/identity-protection/hello-for-business/toc.yml +++ b/windows/security/identity-protection/hello-for-business/toc.yml @@ -17,8 +17,6 @@ href: hello-how-it-works.md - name: Technical Deep Dive items: - - name: Device Registration - href: hello-how-it-works-device-registration.md - name: Provisioning href: hello-how-it-works-provisioning.md - name: Authentication From 4703174427b0cba0e07b8234680541473a4d10b7 Mon Sep 17 00:00:00 2001 From: Crimsonfox89 <40465227+Crimsonfox89@users.noreply.github.com> Date: Fri, 13 Aug 2021 21:44:12 +0100 Subject: [PATCH 0029/1214] Typo fix "to option to" -> "the option to" --- windows/deployment/update/waas-wu-settings.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/update/waas-wu-settings.md b/windows/deployment/update/waas-wu-settings.md index c136773bec..eb37c09b3c 100644 --- a/windows/deployment/update/waas-wu-settings.md +++ b/windows/deployment/update/waas-wu-settings.md @@ -47,7 +47,7 @@ You can use Group Policy settings or mobile device management (MDM) to configure With Windows 10, admins have a lot of flexibility in configuring how their devices scan and receive updates. -[Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them to option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates. +[Specify Intranet Microsoft update service location](#specify-intranet-microsoft-update-service-location) allows admins to point devices to an internal Microsoft update service location, while [Do not connect to any Windows Update Internet locations](#do-not-connect-to-any-windows-update-internet-locations) gives them the option to restrict devices to just that internal update service. [Automatic Updates Detection Frequency](#automatic-updates-detection-frequency) controls how frequently devices scan for updates. You can make custom device groups that'll work with your internal Microsoft update service by using [Enable client-side targeting](#enable-client-side-targeting). You can also make sure your devices receive updates that were not signed by Microsoft from your internal Microsoft update service, through [Allow signed updates from an intranet Microsoft update service location](#allow-signed-updates-from-an-intranet-microsoft-update-service-location). @@ -255,4 +255,4 @@ HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\ - [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) - [Configure BranchCache for Windows 10 updates](waas-branchcache.md) - [Configure Windows Update for Business](waas-configure-wufb.md) -- [Manage device restarts after updates](waas-restart.md) \ No newline at end of file +- [Manage device restarts after updates](waas-restart.md) From 7957e51836965752954a4385e0892ed7abb71f38 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 16 Aug 2021 00:49:16 +0530 Subject: [PATCH 0030/1214] Updated --- .../mdm/policy-csp-admx-mmcsnapins.md | 162 +++++++++--------- .../mdm/policy-csp-admx-msapolicy.md | 2 +- .../mdm/policy-csp-admx-msched.md | 4 +- .../mdm/policy-csp-admx-msdt.md | 6 +- .../mdm/policy-csp-admx-msi.md | 48 +++--- .../mdm/policy-csp-admx-nca.md | 16 +- .../mdm/policy-csp-admx-ncsi.md | 14 +- .../mdm/policy-csp-admx-netlogon.md | 70 ++++---- .../mdm/policy-csp-admx-networkconnections.md | 54 +++--- .../mdm/policy-csp-admx-offlinefiles.md | 94 +++++----- .../mdm/policy-csp-admx-peertopeercaching.md | 18 +- .../policy-csp-admx-performancediagnostics.md | 8 +- .../mdm/policy-csp-admx-power.md | 50 +++--- ...licy-csp-admx-powershellexecutionpolicy.md | 8 +- .../mdm/policy-csp-admx-printing.md | 52 +++--- .../mdm/policy-csp-admx-printing2.md | 18 +- .../mdm/policy-csp-admx-programs.md | 14 +- .../mdm/policy-csp-admx-reliability.md | 8 +- .../mdm/policy-csp-admx-remoteassistance.md | 4 +- .../mdm/policy-csp-admx-removablestorage.md | 64 +++---- 20 files changed, 357 insertions(+), 357 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md index 688de0b909..c628cc0a3f 100644 --- a/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md +++ b/windows/client-management/mdm/policy-csp-admx-mmcsnapins.md @@ -407,7 +407,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Administrative Templates (Computers)* +- GP Friendly name: *Administrative Templates (Computers)* - GP name: *MMC_ADMComputers_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -484,7 +484,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Administrative Templates (Computers)* +- GP Friendly name: *Administrative Templates (Computers)* - GP name: *MMC_ADMComputers_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -562,7 +562,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Administrative Templates (Users)* +- GP Friendly name: *Administrative Templates (Users)* - GP name: *MMC_ADMUsers_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -640,7 +640,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Administrative Templates (Users)* +- GP Friendly name: *Administrative Templates (Users)* - GP name: *MMC_ADMUsers_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -718,7 +718,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *ADSI Edit* +- GP Friendly name: *ADSI Edit* - GP name: *MMC_ADSI* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -796,7 +796,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Active Directory Domains and Trusts* +- GP Friendly name: *Active Directory Domains and Trusts* - GP name: *MMC_ActiveDirDomTrusts* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -874,7 +874,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Active Directory Sites and Services* +- GP Friendly name: *Active Directory Sites and Services* - GP name: *MMC_ActiveDirSitesServices* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -952,7 +952,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Active Directory Users and Computers* +- GP Friendly name: *Active Directory Users and Computers* - GP name: *MMC_ActiveDirUsersComp* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1030,7 +1030,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *AppleTalk Routing* +- GP Friendly name: *AppleTalk Routing* - GP name: *MMC_AppleTalkRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1108,7 +1108,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Authorization Manager* +- GP Friendly name: *Authorization Manager* - GP name: *MMC_AuthMan* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1186,7 +1186,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Certification Authority* +- GP Friendly name: *Certification Authority* - GP name: *MMC_CertAuth* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1263,7 +1263,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Certification Authority Policy Settings* +- GP Friendly name: *Certification Authority Policy Settings* - GP name: *MMC_CertAuthPolSet* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1340,7 +1340,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Certificates* +- GP Friendly name: *Certificates* - GP name: *MMC_Certs* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1417,7 +1417,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Certificate Templates* +- GP Friendly name: *Certificate Templates* - GP name: *MMC_CertsTemplate* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1494,7 +1494,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Component Services* +- GP Friendly name: *Component Services* - GP name: *MMC_ComponentServices* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1571,7 +1571,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Computer Management* +- GP Friendly name: *Computer Management* - GP name: *MMC_ComputerManagement* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1648,7 +1648,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Connection Sharing (NAT)* +- GP Friendly name: *Connection Sharing (NAT)* - GP name: *MMC_ConnectionSharingNAT* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1725,7 +1725,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *DCOM Configuration Extension* +- GP Friendly name: *DCOM Configuration Extension* - GP name: *MMC_DCOMCFG* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1802,7 +1802,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Distributed File System* +- GP Friendly name: *Distributed File System* - GP name: *MMC_DFS* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1879,7 +1879,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *DHCP Relay Management* +- GP Friendly name: *DHCP Relay Management* - GP name: *MMC_DHCPRelayMgmt* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -1956,7 +1956,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Device Manager* +- GP Friendly name: *Device Manager* - GP name: *MMC_DeviceManager_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2033,7 +2033,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Device Manager* +- GP Friendly name: *Device Manager* - GP name: *MMC_DeviceManager_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2110,7 +2110,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Disk Defragmenter* +- GP Friendly name: *Disk Defragmenter* - GP name: *MMC_DiskDefrag* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2187,7 +2187,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Disk Management* +- GP Friendly name: *Disk Management* - GP name: *MMC_DiskMgmt* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2264,7 +2264,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Enterprise PKI* +- GP Friendly name: *Enterprise PKI* - GP name: *MMC_EnterprisePKI* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2341,7 +2341,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Event Viewer* +- GP Friendly name: *Event Viewer* - GP name: *MMC_EventViewer_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2418,7 +2418,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Event Viewer (Windows Vista)* +- GP Friendly name: *Event Viewer (Windows Vista)* - GP name: *MMC_EventViewer_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2495,7 +2495,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Event Viewer* +- GP Friendly name: *Event Viewer* - GP name: *MMC_EventViewer_3* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2572,7 +2572,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Event Viewer (Windows Vista)* +- GP Friendly name: *Event Viewer (Windows Vista)* - GP name: *MMC_EventViewer_4* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2650,7 +2650,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Event Viewer (Windows Vista)* +- GP Friendly name: *Event Viewer (Windows Vista)* - GP name: *MMC_EventViewer_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2727,7 +2727,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *FAX Service* +- GP Friendly name: *FAX Service* - GP name: *MMC_FAXService* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2804,7 +2804,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Failover Clusters Manager* +- GP Friendly name: *Failover Clusters Manager* - GP name: *MMC_FailoverClusters* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -2881,7 +2881,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Folder Redirection* +- GP Friendly name: *Folder Redirection* - GP name: *MMC_FolderRedirection_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -2958,7 +2958,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Folder Redirection* +- GP Friendly name: *Folder Redirection* - GP name: *MMC_FolderRedirection_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -3035,7 +3035,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *FrontPage Server Extensions* +- GP Friendly name: *FrontPage Server Extensions* - GP name: *MMC_FrontPageExt* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3112,7 +3112,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Group Policy Management* +- GP Friendly name: *Group Policy Management* - GP name: *MMC_GroupPolicyManagementSnapIn* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* - GP ADMX file name: *MMCSnapins.admx* @@ -3189,7 +3189,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Group Policy Object Editor* +- GP Friendly name: *Group Policy Object Editor* - GP name: *MMC_GroupPolicySnapIn* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* - GP ADMX file name: *MMCSnapins.admx* @@ -3268,7 +3268,7 @@ When the Group Policy tab is inaccessible, it does not appear in the site, domai ADMX Info: -- GP English name: *Group Policy tab for Active Directory Tools* +- GP Friendly name: *Group Policy tab for Active Directory Tools* - GP name: *MMC_GroupPolicyTab* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* - GP ADMX file name: *MMCSnapins.admx* @@ -3345,7 +3345,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Health Registration Authority (HRA)* +- GP Friendly name: *Health Registration Authority (HRA)* - GP name: *MMC_HRA* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3422,7 +3422,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Internet Authentication Service (IAS)* +- GP Friendly name: *Internet Authentication Service (IAS)* - GP name: *MMC_IAS* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3499,7 +3499,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IAS Logging* +- GP Friendly name: *IAS Logging* - GP name: *MMC_IASLogging* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3576,7 +3576,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Internet Explorer Maintenance* +- GP Friendly name: *Internet Explorer Maintenance* - GP name: *MMC_IEMaintenance_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -3653,7 +3653,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Internet Explorer Maintenance* +- GP Friendly name: *Internet Explorer Maintenance* - GP name: *MMC_IEMaintenance_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -3730,7 +3730,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IGMP Routing* +- GP Friendly name: *IGMP Routing* - GP name: *MMC_IGMPRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3807,7 +3807,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Internet Information Services* +- GP Friendly name: *Internet Information Services* - GP name: *MMC_IIS* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3884,7 +3884,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IP Routing* +- GP Friendly name: *IP Routing* - GP name: *MMC_IPRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -3961,7 +3961,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IP Security Policy Management* +- GP Friendly name: *IP Security Policy Management* - GP name: *MMC_IPSecManage_GP* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -4038,7 +4038,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IPX RIP Routing* +- GP Friendly name: *IPX RIP Routing* - GP name: *MMC_IPXRIPRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4115,7 +4115,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IPX Routing* +- GP Friendly name: *IPX Routing* - GP name: *MMC_IPXRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4192,7 +4192,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IPX SAP Routing* +- GP Friendly name: *IPX SAP Routing* - GP name: *MMC_IPXSAPRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4269,7 +4269,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Indexing Service* +- GP Friendly name: *Indexing Service* - GP name: *MMC_IndexingService* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4346,7 +4346,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IP Security Policy Management* +- GP Friendly name: *IP Security Policy Management* - GP name: *MMC_IpSecManage* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4423,7 +4423,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *IP Security Monitor* +- GP Friendly name: *IP Security Monitor* - GP name: *MMC_IpSecMonitor* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4500,7 +4500,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Local Users and Groups* +- GP Friendly name: *Local Users and Groups* - GP name: *MMC_LocalUsersGroups* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4577,7 +4577,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Logical and Mapped Drives* +- GP Friendly name: *Logical and Mapped Drives* - GP name: *MMC_LogicalMappedDrives* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4654,7 +4654,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Network Policy Server (NPS)* +- GP Friendly name: *Network Policy Server (NPS)* - GP name: *MMC_NPSUI* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4731,7 +4731,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *NAP Client Configuration* +- GP Friendly name: *NAP Client Configuration* - GP name: *MMC_NapSnap* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4808,7 +4808,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *NAP Client Configuration* +- GP Friendly name: *NAP Client Configuration* - GP name: *MMC_NapSnap_GP* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -4885,7 +4885,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *.Net Framework Configuration* +- GP Friendly name: *.Net Framework Configuration* - GP name: *MMC_Net_Framework* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -4962,7 +4962,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Online Responder* +- GP Friendly name: *Online Responder* - GP name: *MMC_OCSP* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5039,7 +5039,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *OSPF Routing* +- GP Friendly name: *OSPF Routing* - GP name: *MMC_OSPFRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5116,7 +5116,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Performance Logs and Alerts* +- GP Friendly name: *Performance Logs and Alerts* - GP name: *MMC_PerfLogsAlerts* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5193,7 +5193,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Public Key Policies* +- GP Friendly name: *Public Key Policies* - GP name: *MMC_PublicKey* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5270,7 +5270,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *QoS Admission Control* +- GP Friendly name: *QoS Admission Control* - GP name: *MMC_QoSAdmission* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5347,7 +5347,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *RAS Dialin - User Node* +- GP Friendly name: *RAS Dialin - User Node* - GP name: *MMC_RAS_DialinUser* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5424,7 +5424,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *RIP Routing* +- GP Friendly name: *RIP Routing* - GP name: *MMC_RIPRouting* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5501,7 +5501,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Remote Installation Services* +- GP Friendly name: *Remote Installation Services* - GP name: *MMC_RIS* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -5578,7 +5578,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Routing and Remote Access* +- GP Friendly name: *Routing and Remote Access* - GP name: *MMC_RRA* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5655,7 +5655,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Removable Storage Management* +- GP Friendly name: *Removable Storage Management* - GP name: *MMC_RSM* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5732,7 +5732,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Removable Storage* +- GP Friendly name: *Removable Storage* - GP name: *MMC_RemStore* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5809,7 +5809,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Remote Access* +- GP Friendly name: *Remote Access* - GP name: *MMC_RemoteAccess* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5886,7 +5886,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Remote Desktops* +- GP Friendly name: *Remote Desktops* - GP name: *MMC_RemoteDesktop* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -5963,7 +5963,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Resultant Set of Policy snap-in* +- GP Friendly name: *Resultant Set of Policy snap-in* - GP name: *MMC_ResultantSetOfPolicySnapIn* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy* - GP ADMX file name: *MMCSnapins.admx* @@ -6040,7 +6040,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Routing* +- GP Friendly name: *Routing* - GP name: *MMC_Routing* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -6117,7 +6117,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Security Configuration and Analysis* +- GP Friendly name: *Security Configuration and Analysis* - GP name: *MMC_SCA* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -6194,7 +6194,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *SMTP Protocol* +- GP Friendly name: *SMTP Protocol* - GP name: *MMC_SMTPProtocol* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -6271,7 +6271,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *SNMP* +- GP Friendly name: *SNMP* - GP name: *MMC_SNMP* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Extension snap-ins* - GP ADMX file name: *MMCSnapins.admx* @@ -6348,7 +6348,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Scripts (Startup/Shutdown)* +- GP Friendly name: *Scripts (Startup/Shutdown)* - GP name: *MMC_ScriptsMachine_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -6425,7 +6425,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Scripts (Startup/Shutdown)* +- GP Friendly name: *Scripts (Startup/Shutdown)* - GP name: *MMC_ScriptsMachine_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -6502,7 +6502,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Scripts (Logon/Logoff)* +- GP Friendly name: *Scripts (Logon/Logoff)* - GP name: *MMC_ScriptsUser_1* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Group Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* @@ -6579,7 +6579,7 @@ When a snap-in is prohibited, it does not appear in the Add/Remove Snap-in windo ADMX Info: -- GP English name: *Scripts (Logon/Logoff)* +- GP Friendly name: *Scripts (Logon/Logoff)* - GP name: *MMC_ScriptsUser_2* - GP path: *Windows Components\Microsoft Management Console\Restricted/Permitted snap-ins\Group Policy\Resultant Set of Policy snap-in extensions* - GP ADMX file name: *MMCSnapins.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-msapolicy.md b/windows/client-management/mdm/policy-csp-admx-msapolicy.md index c94cb373ac..99d423e98d 100644 --- a/windows/client-management/mdm/policy-csp-admx-msapolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-msapolicy.md @@ -92,7 +92,7 @@ By default, this setting is Disabled. This setting does not affect whether users ADMX Info: -- GP English name: *Block all consumer Microsoft account user authentication* +- GP Friendly name: *Block all consumer Microsoft account user authentication* - GP name: *MicrosoftAccount_DisableUserAuth* - GP path: *Windows Components\Microsoft account* - GP ADMX file name: *MSAPolicy.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-msched.md b/windows/client-management/mdm/policy-csp-admx-msched.md index 85cdf6f62c..0264d6cb1d 100644 --- a/windows/client-management/mdm/policy-csp-admx-msched.md +++ b/windows/client-management/mdm/policy-csp-admx-msched.md @@ -93,7 +93,7 @@ If you disable or do not configure this policy setting, the daily scheduled time ADMX Info: -- GP English name: *Automatic Maintenance Activation Boundary* +- GP Friendly name: *Automatic Maintenance Activation Boundary* - GP name: *ActivationBoundaryPolicy* - GP path: *Windows Components\Maintenance Scheduler* - GP ADMX file name: *msched.admx* @@ -166,7 +166,7 @@ If you disable this policy setting, no random delay will be applied to Automatic ADMX Info: -- GP English name: *Automatic Maintenance Random Delay* +- GP Friendly name: *Automatic Maintenance Random Delay* - GP name: *RandomDelayPolicy* - GP path: *Windows Components\Maintenance Scheduler* - GP ADMX file name: *msched.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-msdt.md b/windows/client-management/mdm/policy-csp-admx-msdt.md index 4af5ccff52..a8bf9c9ad2 100644 --- a/windows/client-management/mdm/policy-csp-admx-msdt.md +++ b/windows/client-management/mdm/policy-csp-admx-msdt.md @@ -102,7 +102,7 @@ No reboots or service restarts are required for this policy setting to take effe ADMX Info: -- GP English name: *Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider* +- GP Friendly name: *Microsoft Support Diagnostic Tool: Turn on MSDT interactive communication with support provider* - GP name: *MsdtSupportProvider* - GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* - GP ADMX file name: *MSDT.admx* @@ -189,7 +189,7 @@ The DPS can be configured with the Services snap-in to the Microsoft Management ADMX Info: -- GP English name: *Microsoft Support Diagnostic Tool: Restrict tool download* +- GP Friendly name: *Microsoft Support Diagnostic Tool: Restrict tool download* - GP name: *MsdtToolDownloadPolicy* - GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* - GP ADMX file name: *MSDT.admx* @@ -264,7 +264,7 @@ This policy setting will only take effect when the Diagnostic Policy Service (DP ADMX Info: -- GP English name: *Microsoft Support Diagnostic Tool: Configure execution level* +- GP Friendly name: *Microsoft Support Diagnostic Tool: Configure execution level* - GP name: *WdiScenarioExecutionPolicy* - GP path: *System\Troubleshooting and Diagnostics\Microsoft Support Diagnostic Tool* - GP ADMX file name: *MSDT.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-msi.md b/windows/client-management/mdm/policy-csp-admx-msi.md index b3f1bd2e74..0970c6a14e 100644 --- a/windows/client-management/mdm/policy-csp-admx-msi.md +++ b/windows/client-management/mdm/policy-csp-admx-msi.md @@ -162,7 +162,7 @@ If you disable or do not configure this policy setting, by default, only system ADMX Info: -- GP English name: *Allow users to browse for source while elevated* +- GP Friendly name: *Allow users to browse for source while elevated* - GP name: *AllowLockdownBrowse* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -236,7 +236,7 @@ Also, see the "Prevent removable media source for any install" policy setting. ADMX Info: -- GP English name: *Allow users to use media source while elevated* +- GP Friendly name: *Allow users to use media source while elevated* - GP name: *AllowLockdownMedia* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -307,7 +307,7 @@ This policy setting does not affect installations that run in the user's securit ADMX Info: -- GP English name: *Allow users to patch elevated products* +- GP Friendly name: *Allow users to patch elevated products* - GP name: *AllowLockdownPatch* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -383,7 +383,7 @@ If you disable or do not configure this policy setting, Windows Installer will u ADMX Info: -- GP English name: *Prohibit use of Restart Manager* +- GGP Friendly name: *Prohibit use of Restart Manager* - GP name: *DisableAutomaticApplicationShutdown* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -459,7 +459,7 @@ Also, see the "Enable user to browse for source while elevated" policy setting. ADMX Info: -- GP English name: *Remove browse dialog box for new source* +- GP Friendly name: *Remove browse dialog box for new source* - GP name: *DisableBrowse* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -529,7 +529,7 @@ If you disable or do not configure this policy setting, it enables faster applic ADMX Info: -- GP English name: *Prohibit flyweight patching* +- GP Friendly name: *Prohibit flyweight patching* - GP name: *DisableFlyweightPatching* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -603,7 +603,7 @@ If you disable or do not configure this policy setting, Windows Installer will a ADMX Info: -- GP English name: *Turn off logging via package settings* +- GP Friendly name: *Turn off logging via package settings* - GP name: *DisableLoggingFromPackage* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -679,7 +679,7 @@ This policy setting affects Windows Installer only. It does not prevent users fr ADMX Info: -- GP English name: *Turn off Windows Installer* +- GP Friendly name: *Turn off Windows Installer* - GP name: *DisableMSI* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -753,7 +753,7 @@ Also, see the "Enable user to use media source while elevated" and "Hide the 'Ad ADMX Info: -- GP English name: *Prevent removable media source for any installation* +- GP Friendly name: *Prevent removable media source for any installation* - GP name: *DisableMedia* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -828,7 +828,7 @@ Also, see the "Enable user to patch elevated products" policy setting. ADMX Info: -- GP English name: *Prevent users from using Windows Installer to install updates and upgrades* +- GP Friendly name: *Prevent users from using Windows Installer to install updates and upgrades* - GP name: *DisablePatch* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -899,7 +899,7 @@ This policy setting appears in the Computer Configuration and User Configuration ADMX Info: -- GP English name: *Prohibit rollback* +- GP Friendly name: *Prohibit rollback* - GP name: *DisableRollback_1* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -971,7 +971,7 @@ This policy setting appears in the Computer Configuration and User Configuration ADMX Info: -- GP English name: *Prohibit rollback* +- GP Friendly name: *Prohibit rollback* - GP name: *DisableRollback_2* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1041,7 +1041,7 @@ If you disable or do not configure this policy setting, by default, the shared c ADMX Info: -- GP English name: *Turn off shared components* +- GP Friendly name: *Turn off shared components* - GP name: *DisableSharedComponent* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1113,7 +1113,7 @@ If you disable or do not configure this policy setting, Windows Installer logs t ADMX Info: -- GP English name: *Specify the types of events Windows Installer records in its transaction log* +- GP Friendly name: *Specify the types of events Windows Installer records in its transaction log* - GP name: *MSILogging* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1186,7 +1186,7 @@ If you disable or do not configure this policy setting, users without administra ADMX Info: -- GP English name: *Prohibit non-administrators from applying vendor signed updates* +- GP Friendly name: *Prohibit non-administrators from applying vendor signed updates* - GP name: *MSI_DisableLUAPatching* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1259,7 +1259,7 @@ If you disable or do not configure this policy setting, a user can remove an upd ADMX Info: -- GP English name: *Prohibit removal of updates* +- GP Friendly name: *Prohibit removal of updates* - GP name: *MSI_DisablePatchUninstall* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1330,7 +1330,7 @@ If you disable or do not configure this policy setting, by default, the Windows ADMX Info: -- GP English name: *Turn off creation of System Restore checkpoints* +- GP Friendly name: *Turn off creation of System Restore checkpoints* - GP name: *MSI_DisableSRCheckPoints* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1401,7 +1401,7 @@ If you enable this policy setting and "Hide User Installs" is selected, the inst ADMX Info: -- GP English name: *Prohibit User Installs* +- GP Friendly name: *Prohibit User Installs* - GP name: *MSI_DisableUserInstalls* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1478,7 +1478,7 @@ If you disable or do not configure this policy setting, the Windows Installer wi ADMX Info: -- GP English name: *Enforce upgrade component rules* +- GP Friendly name: *Enforce upgrade component rules* - GP name: *MSI_EnforceUpgradeComponentRules* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1554,7 +1554,7 @@ If you disable or do not configure this policy setting, the Windows Installer wi ADMX Info: -- GP English name: *Control maximum size of baseline file cache* +- GP Friendly name: *Control maximum size of baseline file cache* - GP name: *MSI_MaxPatchCacheSize* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1624,7 +1624,7 @@ If you disable or do not configure this policy setting, embedded UI is allowed t ADMX Info: -- GP English name: *Prevent embedded UI* +- GP Friendly name: *Prevent embedded UI* - GP name: *MsiDisableEmbeddedUI* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1696,7 +1696,7 @@ This policy setting is designed for enterprises that use Web-based tools to dist ADMX Info: -- GP English name: *Prevent Internet Explorer security prompt for Windows Installer scripts* +- GP Friendly name: *Prevent Internet Explorer security prompt for Windows Installer scripts* - GP name: *SafeForScripting* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1772,7 +1772,7 @@ To exclude a file source, omit or delete the letter representing that source typ ADMX Info: -- GP English name: *Specify the order in which Windows Installer searches for installation files* +- GP Friendly name: *Specify the order in which Windows Installer searches for installation files* - GP name: *SearchOrder* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* @@ -1850,7 +1850,7 @@ If you do not configure this policy setting on Windows 2000 Professional, Window ADMX Info: -- GP English name: *Save copies of transform files in a secure location on workstation* +- GP Friendly name: *Save copies of transform files in a secure location on workstation* - GP name: *TransformsSecure* - GP path: *Windows Components\Windows Installer* - GP ADMX file name: *MSI.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-nca.md b/windows/client-management/mdm/policy-csp-admx-nca.md index da4cff082f..f35134f108 100644 --- a/windows/client-management/mdm/policy-csp-admx-nca.md +++ b/windows/client-management/mdm/policy-csp-admx-nca.md @@ -121,7 +121,7 @@ You must configure this setting to have complete NCA functionality. ADMX Info: -- GP English name: *Corporate Resources* +- GP Friendly name: *Corporate Resources* - GP name: *CorporateResources* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -186,7 +186,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting sp ADMX Info: -- GP English name: *Custom Commands* +- GP Friendly name: *Custom Commands* - GP name: *CustomCommands* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -257,7 +257,7 @@ You must configure this setting to have complete NCA functionality. ADMX Info: -- GP English name: *IPsec Tunnel Endpoints* +- GP Friendly name: *IPsec Tunnel Endpoints* - GP name: *DTEs* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -324,7 +324,7 @@ If this setting is not configured, the string that appears for DirectAccess conn ADMX Info: -- GP English name: *Friendly Name* +- GP Friendly name: *Friendly Name* - GP name: *FriendlyName* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -400,7 +400,7 @@ If this setting is not configured, users do not have Connect or Disconnect optio ADMX Info: -- GP English name: *Prefer Local Names Allowed* +- GP Friendly name: *Prefer Local Names Allowed* - GP name: *LocalNamesOn* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -466,7 +466,7 @@ Set this to Disabled to keep NCA probing actively all the time. If this setting ADMX Info: -- GP English name: *DirectAccess Passive Mode* +- GP Friendly name: *DirectAccess Passive Mode* - GP name: *PassiveMode* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -535,7 +535,7 @@ If this setting is not configured, the entry for DirectAccess connectivity appea ADMX Info: -- GP English name: *User Interface* +- GP Friendly name: *User Interface* - GP name: *ShowUI* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* @@ -602,7 +602,7 @@ When the user sends the log files to the Administrator, NCA uses the default e-m ADMX Info: -- GP English name: *Support Email Address* +- GP Friendly name: *Support Email Address* - GP name: *SupportEmail* - GP path: *Network\DirectAccess Client Experience Settings* - GP ADMX file name: *nca.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-ncsi.md b/windows/client-management/mdm/policy-csp-admx-ncsi.md index 7bca9000d2..4981561468 100644 --- a/windows/client-management/mdm/policy-csp-admx-ncsi.md +++ b/windows/client-management/mdm/policy-csp-admx-ncsi.md @@ -104,7 +104,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting e ADMX Info: -- GP English name: *Specify corporate DNS probe host address* +- GP Friendly name: *Specify corporate DNS probe host address* - GP name: *NCSI_CorpDnsProbeContent* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* @@ -169,7 +169,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting en ADMX Info: -- GP English name: *Specify corporate DNS probe host name* +- GP Friendly name: *Specify corporate DNS probe host name* - GP name: *NCSI_CorpDnsProbeHost* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* @@ -234,7 +234,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting en ADMX Info: -- GP English name: *Specify corporate site prefix list* +- GP Friendly name: *Specify corporate site prefix list* - GP name: *NCSI_CorpSitePrefixes* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* @@ -299,7 +299,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting en ADMX Info: -- GP English name: *Specify corporate Website probe URL* +- GP Friendly name: *Specify corporate Website probe URL* - GP name: *NCSI_CorpWebProbeUrl* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* @@ -367,7 +367,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting en ADMX Info: -- GP English name: *Specify domain location determination URL* +- GP Friendly name: *Specify domain location determination URL* - GP name: *NCSI_DomainLocationDeterminationUrl* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* @@ -432,7 +432,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting en ADMX Info: -- GP English name: *Specify global DNS* +- GP Friendly name: *Specify global DNS* - GP name: *NCSI_GlobalDns* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* @@ -497,7 +497,7 @@ Available in the latest Windows 10 Insider Preview Build. This Policy setting en ADMX Info: -- GP English name: *Specify passive polling* +- GP Friendly name: *Specify passive polling* - GP name: *NCSI_PassivePolling* - GP path: *Network\Network Connectivity Status Indicator* - GP ADMX file name: *NCSI.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-netlogon.md b/windows/client-management/mdm/policy-csp-admx-netlogon.md index 76c9223297..f8c2d7401e 100644 --- a/windows/client-management/mdm/policy-csp-admx-netlogon.md +++ b/windows/client-management/mdm/policy-csp-admx-netlogon.md @@ -200,7 +200,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Specify address lookup behavior for DC locator ping* +- GP Friendly name: *Specify address lookup behavior for DC locator ping* - GP name: *Netlogon_AddressLookupOnPingBehavior* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -273,7 +273,7 @@ If you do not configure this policy setting, DC Locator APIs can return IPv4/IPv ADMX Info: -- GP English name: *Return domain controller address type* +- GP Friendly name: *Return domain controller address type* - GP name: *Netlogon_AddressTypeReturned* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -346,7 +346,7 @@ If you disable this policy setting, when the AllowSingleLabelDnsDomain policy is ADMX Info: -- GP English name: *Use DNS name resolution when a single-label domain name is used, by appending different registered DNS suffixes, if the AllowSingleLabelDnsDomain setting is not enabled.* +- GP Friendly name: *Use DNS name resolution when a single-label domain name is used, by appending different registered DNS suffixes, if the AllowSingleLabelDnsDomain setting is not enabled.* - GP name: *Netlogon_AllowDnsSuffixSearch* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -421,7 +421,7 @@ If you do not configure this policy setting, Net Logon will not allow the negoti ADMX Info: -- GP English name: *Allow cryptography algorithms compatible with Windows NT 4.0* +- GP Friendly name: *Allow cryptography algorithms compatible with Windows NT 4.0* - GP name: *Netlogon_AllowNT4Crypto* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -496,7 +496,7 @@ If you do not configure this policy setting, it is not applied to any computers, ADMX Info: -- GP English name: *Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC* +- GP Friendly name: *Use DNS name resolution with a single-label domain name instead of NetBIOS name resolution to locate the DC* - GP name: *Netlogon_AllowSingleLabelDnsDomain* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -569,7 +569,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Use automated site coverage by the DC Locator DNS SRV Records* +- GP Friendly name: *Use automated site coverage by the DC Locator DNS SRV Records* - GP name: *Netlogon_AutoSiteCoverage* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -645,7 +645,7 @@ If you disable this policy setting, the DC location algorithm can use NetBIOS-ba ADMX Info: -- GP English name: *Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails* +- GP Friendly name: *Do not use NetBIOS-based discovery for domain controller location when DNS-based discovery fails* - GP name: *Netlogon_AvoidFallbackNetbiosDiscovery* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -720,7 +720,7 @@ If you do not configure this policy setting, it is not applied to any DCs. ADMX Info: -- GP English name: *Contact PDC on logon failure* +- GP Friendly name: *Contact PDC on logon failure* - GP name: *Netlogon_AvoidPdcOnWan* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -798,7 +798,7 @@ If the value of this setting is less than the value specified in the NegativeCac ADMX Info: -- GP English name: *Use initial DC discovery retry setting for background callers* +- GP Friendly name: *Use initial DC discovery retry setting for background callers* - GP name: *Netlogon_BackgroundRetryInitialPeriod* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -878,7 +878,7 @@ If the value for this setting is too small and the DC is not available, the freq ADMX Info: -- GP English name: *Use maximum DC discovery retry interval setting for background callers* +- GP Friendly name: *Use maximum DC discovery retry interval setting for background callers* - GP name: *Netlogon_BackgroundRetryMaximumPeriod* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -950,7 +950,7 @@ The default value for this setting is to not quit retrying (0). The maximum valu ADMX Info: -- GP English name: *Use final DC discovery retry setting for background callers* +- GP Friendly name: *Use final DC discovery retry setting for background callers* - GP name: *Netlogon_BackgroundRetryQuitTime* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -1017,7 +1017,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting de ADMX Info: -- GP English name: *Use positive periodic DC cache refresh for background callers* +- GP Friendly name: *Use positive periodic DC cache refresh for background callers* - GP name: *Netlogon_BackgroundSuccessfulRefreshPeriod* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -1092,7 +1092,7 @@ If you disable this policy setting or do not configure it, the default behavior ADMX Info: -- GP English name: *Specify log file debug output level* +- GP Friendly name: *Specify log file debug output level* - GP name: *Netlogon_DebugFlag* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -1191,7 +1191,7 @@ If you do not configure this policy setting, DCs use their local configuration. ADMX Info: -- GP English name: *Specify DC Locator DNS records not registered by the DCs* +- GP Friendly name: *Specify DC Locator DNS records not registered by the DCs* - GP name: *Netlogon_DnsAvoidRegisterRecords* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1267,7 +1267,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Specify Refresh Interval of the DC Locator DNS records* +- GP Friendly name: *Specify Refresh Interval of the DC Locator DNS records* - GP name: *Netlogon_DnsRefreshInterval* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1343,7 +1343,7 @@ A reboot is not required for changes to this setting to take effect. ADMX Info: -- GP English name: *Use lowercase DNS host names when registering domain controller SRV records* +- GP Friendly name: *Use lowercase DNS host names when registering domain controller SRV records* - GP name: *Netlogon_DnsSrvRecordUseLowerCaseHostNames* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1413,7 +1413,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Set TTL in the DC Locator DNS Records* +- GP Friendly name: *Set TTL in the DC Locator DNS Records* - GP name: *Netlogon_DnsTtl* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1484,7 +1484,7 @@ If you do not configure this policy setting, it is not applied to any computers, ADMX Info: -- GP English name: *Specify expected dial-up delay on logon* +- GP Friendly name: *Specify expected dial-up delay on logon* - GP name: *Netlogon_ExpectedDialupDelay* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -1559,7 +1559,7 @@ If you do not configure this policy setting, Force Rediscovery will be used by d ADMX Info: -- GP English name: *Force Rediscovery Interval* +- GP Friendly name: *Force Rediscovery Interval* - GP name: *Netlogon_ForceRediscoveryInterval* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1632,7 +1632,7 @@ If you do not configure this policy setting, it is not applied to any GCs, and G ADMX Info: -- GP English name: *Specify sites covered by the GC Locator DNS SRV Records* +- GP Friendly name: *Specify sites covered by the GC Locator DNS SRV Records* - GP name: *Netlogon_GcSiteCoverage* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1708,7 +1708,7 @@ If you disable or do not configure this policy setting, this DC processes incomi ADMX Info: -- GP English name: *Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names* +- GP Friendly name: *Do not process incoming mailslot messages used for domain controller location based on NetBIOS domain names* - GP name: *Netlogon_IgnoreIncomingMailslotMessages* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1781,7 +1781,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Set Priority in the DC Locator DNS SRV records* +- GP Friendly name: *Set Priority in the DC Locator DNS SRV records* - GP name: *Netlogon_LdapSrvPriority* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1854,7 +1854,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Set Weight in the DC Locator DNS SRV records* +- GP Friendly name: *Set Weight in the DC Locator DNS SRV records* - GP name: *Netlogon_LdapSrvWeight* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -1925,7 +1925,7 @@ If you disable or do not configure this policy setting, the default behavior occ ADMX Info: -- GP English name: *Specify maximum log file size* +- GP Friendly name: *Specify maximum log file size* - GP name: *Netlogon_MaximumLogFileSize* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -1998,7 +1998,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Specify sites covered by the application directory partition DC Locator DNS SRV records* +- GP Friendly name: *Specify sites covered by the application directory partition DC Locator DNS SRV records* - GP name: *Netlogon_NdncSiteCoverage* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -2070,7 +2070,7 @@ The default value for this setting is 45 seconds. The maximum value for this set ADMX Info: -- GP English name: *Specify negative DC Discovery cache setting* +- GP Friendly name: *Specify negative DC Discovery cache setting* - GP name: *Netlogon_NegativeCachePeriod* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2148,7 +2148,7 @@ If you enable this policy setting, domain administrators should ensure that the ADMX Info: -- GP English name: *Set Netlogon share compatibility* +- GP Friendly name: *Set Netlogon share compatibility* - GP name: *Netlogon_NetlogonShareCompatibilityMode* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2217,7 +2217,7 @@ The default value for this setting is 30 minutes (1800). The maximum value for t ADMX Info: -- GP English name: *Specify positive periodic DC Cache refresh for non-background callers* +- GP Friendly name: *Specify positive periodic DC Cache refresh for non-background callers* - GP name: *Netlogon_NonBackgroundSuccessfulRefreshPeriod* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2295,7 +2295,7 @@ If you do not configure this policy setting, it is not applied to any computers, ADMX Info: -- GP English name: *Use urgent mode when pinging domain controllers* +- GP Friendly name: *Use urgent mode when pinging domain controllers* - GP name: *Netlogon_PingUrgencyMode* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2372,7 +2372,7 @@ To enable the setting, click Enabled, and then specify the interval in seconds. ADMX Info: -- GP English name: *Set scavenge interval* +- GP Friendly name: *Set scavenge interval* - GP name: *Netlogon_ScavengeInterval* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2445,7 +2445,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Specify sites covered by the DC Locator DNS SRV records* +- GP Friendly name: *Specify sites covered by the DC Locator DNS SRV records* - GP name: *Netlogon_SiteCoverage* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -2518,7 +2518,7 @@ If you do not configure this policy setting, it is not applied to any computers, ADMX Info: -- GP English name: *Specify site name* +- GP Friendly name: *Specify site name* - GP name: *Netlogon_SiteName* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2596,7 +2596,7 @@ If you enable this policy setting, domain administrators should ensure that the ADMX Info: -- GP English name: *Set SYSVOL share compatibility* +- GP Friendly name: *Set SYSVOL share compatibility* - GP name: *Netlogon_SysvolShareCompatibilityMode* - GP path: *System\Net Logon* - GP ADMX file name: *Netlogon.admx* @@ -2671,7 +2671,7 @@ If you do not configure this policy setting, Try Next Closest Site DC Location w ADMX Info: -- GP English name: *Try Next Closest Site* +- GP Friendly name: *Try Next Closest Site* - GP name: *Netlogon_TryNextClosestSite* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* @@ -2744,7 +2744,7 @@ If you do not configure this policy setting, it is not applied to any DCs, and D ADMX Info: -- GP English name: *Specify dynamic registration of the DC Locator DNS Records* +- GP Friendly name: *Specify dynamic registration of the DC Locator DNS Records* - GP name: *Netlogon_UseDynamicDns* - GP path: *System\Net Logon\DC Locator DNS Records* - GP ADMX file name: *Netlogon.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-networkconnections.md b/windows/client-management/mdm/policy-csp-admx-networkconnections.md index deb0305f18..42d74dc6ad 100644 --- a/windows/client-management/mdm/policy-csp-admx-networkconnections.md +++ b/windows/client-management/mdm/policy-csp-admx-networkconnections.md @@ -180,7 +180,7 @@ The Install and Uninstall buttons appear in the properties dialog box for connec ADMX Info: -- GP English name: *Prohibit adding and removing components for a LAN or remote access connection* +- GP Friendly name: *Prohibit adding and removing components for a LAN or remote access connection* - GP name: *NC_AddRemoveComponents* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -256,7 +256,7 @@ If you disable this setting or do not configure it, the Advanced Settings item i ADMX Info: -- GP English name: *Prohibit access to the Advanced Settings item on the Advanced menu* +- GP Friendly name: *Prohibit access to the Advanced Settings item on the Advanced menu* - GP name: *NC_AdvancedSettings* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -337,7 +337,7 @@ Changing this setting from Enabled to Not Configured does not enable the Advance ADMX Info: -- GP English name: *Prohibit TCP/IP advanced configuration* +- GP Friendly name: *Prohibit TCP/IP advanced configuration* - GP name: *NC_AllowAdvancedTCPIPConfig* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -413,7 +413,7 @@ If you disable this setting or do not configure it, the Properties dialog box fo ADMX Info: -- GP English name: *Prohibit Enabling/Disabling components of a LAN connection* +- GP Friendly name: *Prohibit Enabling/Disabling components of a LAN connection* - GP name: *NC_ChangeBindState* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -495,7 +495,7 @@ When enabled, the "Prohibit deletion of remote access connections" setting takes ADMX Info: -- GP English name: *Ability to delete all user remote access connections* +- GP Friendly name: *Ability to delete all user remote access connections* - GP name: *NC_DeleteAllUserConnection* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -575,7 +575,7 @@ When enabled, this setting takes precedence over the "Ability to delete all user ADMX Info: -- GP English name: *Prohibit deletion of remote access connections* +- GP Friendly name: *Prohibit deletion of remote access connections* - GP name: *NC_DeleteConnection* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -648,7 +648,7 @@ If you disable this setting or do not configure it, the Remote Access Preference ADMX Info: -- GP English name: *Prohibit access to the Remote Access Preferences item on the Advanced menu* +- GP Friendly name: *Prohibit access to the Remote Access Preferences item on the Advanced menu* - GP name: *NC_DialupPrefs* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -717,7 +717,7 @@ If you disable this setting or do not configure it, the "local access only" icon ADMX Info: -- GP English name: *Do not show the "local access only" network icon* +- GP Friendly name: *Do not show the "local access only" network icon* - GP name: *NC_DoNotShowLocalOnlyIcon* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -793,7 +793,7 @@ If you disable this setting or do not configure it, Windows XP settings that exi ADMX Info: -- GP English name: *Enable Windows 2000 Network Connections settings for Administrators* +- GP Friendly name: *Enable Windows 2000 Network Connections settings for Administrators* - GP name: *NC_EnableAdminProhibits* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -866,7 +866,7 @@ If you do not configure this policy setting, traffic between remote client compu ADMX Info: -- GP English name: *Route all traffic through the internal network* +- GP Friendly name: *Route all traffic through the internal network* - GP name: *NC_ForceTunneling* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -935,7 +935,7 @@ If you disable or do not configure this policy setting, a DHCP-configured connec ADMX Info: -- GP English name: *Turn off notifications when a connection has only limited or no connectivity* +- GP Friendly name: *Turn off notifications when a connection has only limited or no connectivity* - GP name: *NC_IpStateChecking* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1019,7 +1019,7 @@ The Local Area Connection Properties dialog box includes a list of the network c ADMX Info: -- GP English name: *Prohibit access to properties of components of a LAN connection* +- GP Friendly name: *Prohibit access to properties of components of a LAN connection* - GP name: *NC_LanChangeProperties* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1095,7 +1095,7 @@ If you do not configure this setting, only Administrators and Network Configurat ADMX Info: -- GP English name: *Ability to Enable/Disable a LAN connection* +- GP Friendly name: *Ability to Enable/Disable a LAN connection* - GP name: *NC_LanConnect* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1173,7 +1173,7 @@ If you disable this setting or do not configure it, a Properties menu item appea ADMX Info: -- GP English name: *Prohibit access to properties of a LAN connection* +- GP Friendly name: *Prohibit access to properties of a LAN connection* - GP name: *NC_LanProperties* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1249,7 +1249,7 @@ If you disable this setting or do not configure it, the Make New Connection icon ADMX Info: -- GP English name: *Prohibit access to the New Connection Wizard* +- GP Friendly name: *Prohibit access to the New Connection Wizard* - GP name: *NC_NewConnectionWizard* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1327,7 +1327,7 @@ If you disable this setting or do not configure it, the Internet Connection Fire ADMX Info: -- GP English name: *Prohibit use of Internet Connection Firewall on your DNS domain network* +- GP Friendly name: *Prohibit use of Internet Connection Firewall on your DNS domain network* - GP name: *NC_PersonalFirewallConfig* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1409,7 +1409,7 @@ If you do not configure this setting, only Administrators and Network Configurat ADMX Info: -- GP English name: *Ability to change properties of an all user remote access connection* +- GP Friendly name: *Ability to change properties of an all user remote access connection* - GP name: *NC_RasAllUserProperties* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1491,7 +1491,7 @@ The Networking tab of the Remote Access Connection Properties dialog box include ADMX Info: -- GP English name: *Prohibit access to properties of components of a remote access connection* +- GP Friendly name: *Prohibit access to properties of components of a remote access connection* - GP name: *NC_RasChangeProperties* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1562,7 +1562,7 @@ If you disable this setting or do not configure it, the Connect and Disconnect o ADMX Info: -- GP English name: *Prohibit connecting and disconnecting a remote access connection* +- GP Friendly name: *Prohibit connecting and disconnecting a remote access connection* - GP name: *NC_RasConnect* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1642,7 +1642,7 @@ If you disable this setting or do not configure it, a Properties menu item appea ADMX Info: -- GP English name: *Prohibit changing properties of a private remote access connection* +- GP Friendly name: *Prohibit changing properties of a private remote access connection* - GP name: *NC_RasMyProperties* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1722,7 +1722,7 @@ This setting does not prevent users from using other programs, such as Internet ADMX Info: -- GP English name: *Ability to rename all user remote access connections* +- GP Friendly name: *Ability to rename all user remote access connections* - GP name: *NC_RenameAllUserRasConnection* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1800,7 +1800,7 @@ If this setting is not configured, only Administrators and Network Configuration ADMX Info: -- GP English name: *Ability to rename LAN connections or remote access connections available to all users* +- GP Friendly name: *Ability to rename LAN connections or remote access connections available to all users* - GP name: *NC_RenameConnection* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1876,7 +1876,7 @@ When the "Ability to rename LAN connections or remote access connections availab ADMX Info: -- GP English name: *Ability to rename LAN connections* +- GP Friendly name: *Ability to rename LAN connections* - GP name: *NC_RenameLanConnection* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -1952,7 +1952,7 @@ If you disable this setting or do not configure it, the Rename option is enabled ADMX Info: -- GP English name: *Prohibit renaming private remote access connections* +- GP Friendly name: *Prohibit renaming private remote access connections* - GP name: *NC_RenameMyRasConnection* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -2034,7 +2034,7 @@ Disabling this setting does not prevent Wireless Hosted Networking from using th ADMX Info: -- GP English name: *Prohibit use of Internet Connection Sharing on your DNS domain network* +- GP Friendly name: *Prohibit use of Internet Connection Sharing on your DNS domain network* - GP name: *NC_ShowSharedAccessUI* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -2107,7 +2107,7 @@ If you disable this setting or do not configure it, the connection status taskba ADMX Info: -- GP English name: *Prohibit viewing of status for an active connection* +- GP Friendly name: *Prohibit viewing of status for an active connection* - GP name: *NC_Statistics* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* @@ -2176,7 +2176,7 @@ If you disable or do not configure this policy setting, domain users can set a n ADMX Info: -- GP English name: *Require domain users to elevate when setting a network's location* +- GP Friendly name: *Require domain users to elevate when setting a network's location* - GP name: *NC_StdDomainUserSetLocation* - GP path: *Network\Network Connections* - GP ADMX file name: *NetworkConnections.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md index d9524a1f82..fa64224da3 100644 --- a/windows/client-management/mdm/policy-csp-admx-offlinefiles.md +++ b/windows/client-management/mdm/policy-csp-admx-offlinefiles.md @@ -227,7 +227,7 @@ If you disable this setting or do not configure it, the system asks users whethe ADMX Info: -- GP English name: *Subfolders always available offline* +- GP Friendly name: *Subfolders always available offline* - GP name: *Pol_AlwaysPinSubFolders* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -301,7 +301,7 @@ If you do not configure this policy setting, no files or folders are made availa ADMX Info: -- GP English name: *Specify administratively assigned Offline Files* +- GP Friendly name: *Specify administratively assigned Offline Files* - GP name: *Pol_AssignedOfflineFiles_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -375,7 +375,7 @@ If you do not configure this policy setting, no files or folders are made availa ADMX Info: -- GP English name: *Specify administratively assigned Offline Files* +- GP Friendly name: *Specify administratively assigned Offline Files* - GP name: *Pol_AssignedOfflineFiles_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -446,7 +446,7 @@ If you disable or do not configure this policy setting, Windows performs a backg ADMX Info: -- GP English name: *Configure Background Sync* +- GP Friendly name: *Configure Background Sync* - GP name: *Pol_BackgroundSyncSettings* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -527,7 +527,7 @@ This setting replaces the Default Cache Size setting used by pre-Windows Vista s ADMX Info: -- GP English name: *Limit disk space used by Offline Files* +- GP Friendly name: *Limit disk space used by Offline Files* - GP name: *Pol_CacheSize* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -611,7 +611,7 @@ Also, see the "Non-default server disconnect actions" setting. ADMX Info: -- GP English name: *Action on server disconnect* +- GP Friendly name: *Action on server disconnect* - GP name: *Pol_CustomGoOfflineActions_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -695,7 +695,7 @@ Also, see the "Non-default server disconnect actions" setting. ADMX Info: -- GP English name: *Action on server disconnect* +- GP Friendly name: *Action on server disconnect* - GP name: *Pol_CustomGoOfflineActions_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -775,7 +775,7 @@ If you do not configure this setting, disk space for automatically cached files ADMX Info: -- GP English name: *Default cache size* +- GP Friendly name: *Default cache size* - GP name: *Pol_DefCacheSize* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -849,7 +849,7 @@ If you do not configure this policy setting, Offline Files is enabled on Windows ADMX Info: -- GP English name: *Allow or Disallow use of the Offline Files feature* +- GP Friendly name: *Allow or Disallow use of the Offline Files feature* - GP name: *Pol_Enabled* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -926,7 +926,7 @@ This setting is applied at user logon. If this setting is changed after user log ADMX Info: -- GP English name: *Encrypt the Offline Files cache* +- GP Friendly name: *Encrypt the Offline Files cache* - GP name: *Pol_EncryptOfflineFiles* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1006,7 +1006,7 @@ To use this setting, in the "Enter" box, select the number corresponding to the ADMX Info: -- GP English name: *Event logging level* +- GP Friendly name: *Event logging level* - GP name: *Pol_EventLoggingLevel_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1086,7 +1086,7 @@ To use this setting, in the "Enter" box, select the number corresponding to the ADMX Info: -- GP English name: *Event logging level* +- GP Friendly name: *Event logging level* - GP name: *Pol_EventLoggingLevel_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1155,7 +1155,7 @@ If you disable or do not configure this policy setting, a user can create a file ADMX Info: -- GP English name: *Enable file screens* +- GP Friendly name: *Enable file screens* - GP name: *Pol_ExclusionListSettings* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1229,7 +1229,7 @@ To use this setting, type the file name extension in the "Extensions" box. To ty ADMX Info: -- GP English name: *Files not cached* +- GP Friendly name: *Files not cached* - GP name: *Pol_ExtExclusionList* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1313,7 +1313,7 @@ Also, see the "Non-default server disconnect actions" setting. ADMX Info: -- GP English name: *Action on server disconnect* +- GP Friendly name: *Action on server disconnect* - GP name: *Pol_GoOfflineAction_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1397,7 +1397,7 @@ Also, see the "Non-default server disconnect actions" setting. ADMX Info: -- GP English name: *Action on server disconnect* +- GP Friendly name: *Action on server disconnect* - GP name: *Pol_GoOfflineAction_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1471,7 +1471,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Prevent use of Offline Files folder* +- GP Friendly name: *Prevent use of Offline Files folder* - GP name: *Pol_NoCacheViewer_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1545,7 +1545,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Prevent use of Offline Files folder* +- GP Friendly name: *Prevent use of Offline Files folder* - GP name: *Pol_NoCacheViewer_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1619,7 +1619,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Prohibit user configuration of Offline Files* +- GP Friendly name: *Prohibit user configuration of Offline Files* - GP name: *Pol_NoConfigCache_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1693,7 +1693,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Prohibit user configuration of Offline Files* +- GP Friendly name: *Prohibit user configuration of Offline Files* - GP name: *Pol_NoConfigCache_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1766,7 +1766,7 @@ If you disable or do not configure this policy setting, users can manually speci ADMX Info: -- GP English name: *Remove "Make Available Offline" command* +- GP Friendly name: *Remove "Make Available Offline" command* - GP name: *Pol_NoMakeAvailableOffline_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1839,7 +1839,7 @@ If you disable or do not configure this policy setting, users can manually speci ADMX Info: -- GP English name: *Remove "Make Available Offline" command* +- GP Friendly name: *Remove "Make Available Offline" command* - GP name: *Pol_NoMakeAvailableOffline_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1916,7 +1916,7 @@ If you do not configure this policy setting, the "Make Available Offline" comman ADMX Info: -- GP English name: *Remove "Make Available Offline" for these files and folders* +- GP Friendly name: *Remove "Make Available Offline" for these files and folders* - GP name: *Pol_NoPinFiles_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -1993,7 +1993,7 @@ If you do not configure this policy setting, the "Make Available Offline" comman ADMX Info: -- GP English name: *Remove "Make Available Offline" for these files and folders* +- GP Friendly name: *Remove "Make Available Offline" for these files and folders* - GP name: *Pol_NoPinFiles_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2073,7 +2073,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Turn off reminder balloons* +- GP Friendly name: *Turn off reminder balloons* - GP name: *Pol_NoReminders_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2153,7 +2153,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Turn off reminder balloons* +- GP Friendly name: *Turn off reminder balloons* - GP name: *Pol_NoReminders_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2226,7 +2226,7 @@ If you disable or do not configure this policy setting, remote files will be not ADMX Info: -- GP English name: *Enable Transparent Caching* +- GP Friendly name: *Enable Transparent Caching* - GP name: *Pol_OnlineCachingSettings* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2297,7 +2297,7 @@ If you disable this setting or do not configure it, the system asks users whethe ADMX Info: -- GP English name: *Subfolders always available offline* +- GP Friendly name: *Subfolders always available offline* - GP name: *Pol_AlwaysPinSubFolders* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2369,7 +2369,7 @@ If you disable this setting or do not configure it, automatically and manually c ADMX Info: -- GP English name: *At logoff, delete local copy of user’s offline files* +- GP Friendly name: *At logoff, delete local copy of user’s offline files* - GP name: *Pol_PurgeAtLogoff* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2438,7 +2438,7 @@ If you disable this policy setting, all administratively assigned folders are sy ADMX Info: -- GP English name: *Turn on economical application of administratively assigned Offline Files* +- GP Friendly name: *Turn on economical application of administratively assigned Offline Files* - GP name: *Pol_QuickAdimPin* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2512,7 +2512,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Reminder balloon frequency* +- GP Friendly name: *Reminder balloon frequency* - GP name: *Pol_ReminderFreq_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2586,7 +2586,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Reminder balloon frequency* +- GP Friendly name: *Reminder balloon frequency* - GP name: *Pol_ReminderFreq_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2655,7 +2655,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Initial reminder balloon lifetime* +- GP Friendly name: *Initial reminder balloon lifetime* - GP name: *Pol_ReminderInitTimeout_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2724,7 +2724,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Initial reminder balloon lifetime* +- GP Friendly name: *Initial reminder balloon lifetime* - GP name: *Pol_ReminderInitTimeout_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2793,7 +2793,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Reminder balloon lifetime* +- GP Friendly name: *Reminder balloon lifetime* - GP name: *Pol_ReminderTimeout_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2862,7 +2862,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Reminder balloon lifetime* +- GP Friendly name: *Reminder balloon lifetime* - GP name: *Pol_ReminderTimeout_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -2941,7 +2941,7 @@ If you disable this policy setting, computers will not use the slow-link mode. ADMX Info: -- GP English name: *Configure slow-link mode* +- GP Friendly name: *Configure slow-link mode* - GP name: *Pol_SlowLinkSettings* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3015,7 +3015,7 @@ If this setting is disabled or not configured, the default threshold value of 64 ADMX Info: -- GP English name: *Configure Slow link speed* +- GP Friendly name: *Configure Slow link speed* - GP name: *Pol_SlowLinkSpeed* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3093,7 +3093,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Synchronize all offline files before logging off* +- GP Friendly name: *Synchronize all offline files before logging off* - GP name: *Pol_SyncAtLogoff_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3171,7 +3171,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Synchronize all offline files before logging off* +- GP Friendly name: *Synchronize all offline files before logging off* - GP name: *Pol_SyncAtLogoff_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3249,7 +3249,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Synchronize all offline files when logging on* +- GP Friendly name: *Synchronize all offline files when logging on* - GP name: *Pol_SyncAtLogon_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3329,7 +3329,7 @@ This setting appears in the Computer Configuration and User Configuration folder ADMX Info: -- GP English name: *Synchronize all offline files when logging on* +- GP Friendly name: *Synchronize all offline files when logging on* - GP name: *Pol_SyncAtLogon_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3401,7 +3401,7 @@ If you disable or do not configuring this setting, files are not synchronized wh ADMX Info: -- GP English name: *Synchronize offline files before suspend* +- GP Friendly name: *Synchronize offline files before suspend* - GP name: *Pol_SyncAtSuspend_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3473,7 +3473,7 @@ If you disable or do not configuring this setting, files are not synchronized wh ADMX Info: -- GP English name: *Synchronize offline files before suspend* +- GP Friendly name: *Synchronize offline files before suspend* - GP name: *Pol_SyncAtSuspend_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3542,7 +3542,7 @@ If this setting is disabled or not configured, synchronization will not run in t ADMX Info: -- GP English name: *Enable file synchronization on costed networks* +- GP Friendly name: *Enable file synchronization on costed networks* - GP name: *Pol_SyncOnCostedNetwork* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3611,7 +3611,7 @@ If you disable or do not configure this policy setting, the "Work offline" comma ADMX Info: -- GP English name: *Remove "Work offline" command* +- GP Friendly name: *Remove "Work offline" command* - GP name: *Pol_WorkOfflineDisabled_1* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* @@ -3680,7 +3680,7 @@ If you disable or do not configure this policy setting, the "Work offline" comma ADMX Info: -- GP English name: *Remove "Work offline" command* +- GP Friendly name: *Remove "Work offline" command* - GP name: *Pol_WorkOfflineDisabled_2* - GP path: *Network\Offline Files* - GP ADMX file name: *OfflineFiles.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md index 7704597e96..790bed78ed 100644 --- a/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md +++ b/windows/client-management/mdm/policy-csp-admx-peertopeercaching.md @@ -124,7 +124,7 @@ Select one of the following: ADMX Info: -- GP English name: *Turn on BranchCache* +- GP Friendly name: *Turn on BranchCache* - GP name: *EnableWindowsBranchCache* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -202,7 +202,7 @@ Select one of the following: ADMX Info: -- GP English name: *Set BranchCache Distributed Cache mode* +- GP Friendly name: *Set BranchCache Distributed Cache mode* - GP name: *EnableWindowsBranchCache_Distributed* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -286,7 +286,7 @@ Hosted cache clients must trust the server certificate that is issued to the hos ADMX Info: -- GP English name: *Set BranchCache Hosted Cache mode* +- GP Friendly name: *Set BranchCache Hosted Cache mode* - GP name: *EnableWindowsBranchCache_Hosted* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -373,7 +373,7 @@ Select one of the following: ADMX Info: -- GP English name: *Enable Automatic Hosted Cache Discovery by Service Connection Point* +- GP Friendly name: *Enable Automatic Hosted Cache Discovery by Service Connection Point* - GP name: *EnableWindowsBranchCache_HostedCacheDiscovery* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -456,7 +456,7 @@ In circumstances where this setting is enabled, you can also select and configur ADMX Info: -- GP English name: *Configure Hosted Cache Servers* +- GP Friendly name: *Configure Hosted Cache Servers* - GP name: *EnableWindowsBranchCache_HostedMultipleServers* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -533,7 +533,7 @@ In circumstances where this policy setting is enabled, you can also select and c ADMX Info: -- GP English name: *Configure BranchCache for network files* +- GP Friendly name: *Configure BranchCache for network files* - GP name: *EnableWindowsBranchCache_SMB* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -617,7 +617,7 @@ In circumstances where this setting is enabled, you can also select and configur ADMX Info: -- GP English name: *Set percentage of disk space used for client computer cache* +- GP Friendly name: *Set percentage of disk space used for client computer cache* - GP name: *SetCachePercent* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -698,7 +698,7 @@ In circumstances where this setting is enabled, you can also select and configur ADMX Info: -- GP English name: *Set age for segments in the data cache* +- GP Friendly name: *Set age for segments in the data cache* - GP name: *SetDataCacheEntryMaxAge* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* @@ -782,7 +782,7 @@ Select from the following versions ADMX Info: -- GP English name: *Configure Client BranchCache Version Support* +- GP Friendly name: *Configure Client BranchCache Version Support* - GP name: *SetDowngrading* - GP path: *Network\BranchCache* - GP ADMX file name: *PeerToPeerCaching.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md index a19a43f761..cd77c701e3 100644 --- a/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md +++ b/windows/client-management/mdm/policy-csp-admx-performancediagnostics.md @@ -107,7 +107,7 @@ This policy setting will only take effect when the Diagnostic Policy Service is ADMX Info: -- GP English name: *Configure Scenario Execution Level* +- GP Friendly name: *Configure Scenario Execution Level* - GP name: *WdiScenarioExecutionPolicy_1* - GP path: *System\Troubleshooting and Diagnostics\Windows Boot Performance Diagnostics* - GP ADMX file name: *PerformanceDiagnostics.admx* @@ -184,7 +184,7 @@ This policy setting will only take effect when the Diagnostic Policy Service is ADMX Info: -- GP English name: *Configure Scenario Execution Level* +- GP Friendly name: *Configure Scenario Execution Level* - GP name: *WdiScenarioExecutionPolicy_2* - GP path: *System\Troubleshooting and Diagnostics\Windows System Responsiveness Performance Diagnostics* - GP ADMX file name: *PerformanceDiagnostics.admx* @@ -261,7 +261,7 @@ This policy setting will only take effect when the Diagnostic Policy Service is ADMX Info: -- GP English name: *Configure Scenario Execution Level* +- GP Friendly name: *Configure Scenario Execution Level* - GP name: *WdiScenarioExecutionPolicy_3* - GP path: *System\Troubleshooting and Diagnostics\Windows Shutdown Performance Diagnostics* - GP ADMX file name: *PerformanceDiagnostics.admx* @@ -338,7 +338,7 @@ This policy setting will only take effect when the Diagnostic Policy Service is ADMX Info: -- GP English name: *Configure Scenario Execution Level* +- GP Friendly name: *Configure Scenario Execution Level* - GP name: *WdiScenarioExecutionPolicy_4* - GP path: *System\Troubleshooting and Diagnostics\Windows Standby/Resume Performance Diagnostics* - GP ADMX file name: *PerformanceDiagnostics.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-power.md b/windows/client-management/mdm/policy-csp-admx-power.md index e7609b69d8..17087dd1d9 100644 --- a/windows/client-management/mdm/policy-csp-admx-power.md +++ b/windows/client-management/mdm/policy-csp-admx-power.md @@ -164,7 +164,7 @@ If you do not configure this policy setting, users control this setting. ADMX Info: -- GP English name: *Allow network connectivity during connected-standby (plugged in)* +- GP Friendly name: *Allow network connectivity during connected-standby (plugged in)* - GP name: *ACConnectivityInStandby_2* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -233,7 +233,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Turn on the ability for applications to prevent sleep transitions (plugged in)* +- GP Friendly name: *Turn on the ability for applications to prevent sleep transitions (plugged in)* - GP name: *ACCriticalSleepTransitionsDisable_2* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -306,7 +306,7 @@ If you disable this policy or do not configure this policy setting, users contro ADMX Info: -- GP English name: *Select the Start menu Power button action (plugged in)* +- GP Friendly name: *Select the Start menu Power button action (plugged in)* - GP name: *ACStartMenuButtonAction_2* - GP path: *System\Power Management\Button Settings* - GP ADMX file name: *Power.admx* @@ -375,7 +375,7 @@ If you disable or do not configure this policy setting, applications, services, ADMX Info: -- GP English name: *Allow applications to prevent automatic sleep (plugged in)* +- GP Friendly name: *Allow applications to prevent automatic sleep (plugged in)* - GP name: *AllowSystemPowerRequestAC* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -444,7 +444,7 @@ If you disable or do not configure this policy setting, applications, services, ADMX Info: -- GP English name: *Allow applications to prevent automatic sleep (on battery)* +- GP Friendly name: *Allow applications to prevent automatic sleep (on battery)* - GP name: *AllowSystemPowerRequestDC* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -513,7 +513,7 @@ If you disable or do not configure this policy setting, the computer does not au ADMX Info: -- GP English name: *Allow automatic sleep with Open Network Files (plugged in)* +- GP Friendly name: *Allow automatic sleep with Open Network Files (plugged in)* - GP name: *AllowSystemSleepWithRemoteFilesOpenAC* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -582,7 +582,7 @@ If you disable or do not configure this policy setting, the computer does not au ADMX Info: -- GP English name: *Allow automatic sleep with Open Network Files (on battery)* +- GP Friendly name: *Allow automatic sleep with Open Network Files (on battery)* - GP name: *AllowSystemSleepWithRemoteFilesOpenDC* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -651,7 +651,7 @@ If you disable or do not configure this policy setting, users can see and change ADMX Info: -- GP English name: *Specify a custom active power plan* +- GP Friendly name: *Specify a custom active power plan* - GP name: *CustomActiveSchemeOverride_2* - GP path: *System\Power Management* - GP ADMX file name: *Power.admx* @@ -725,7 +725,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Critical battery notification action* +- GP Friendly name: *Critical battery notification action* - GP name: *DCBatteryDischargeAction0_2* - GP path: *System\Power Management\Notification Settings* - GP ADMX file name: *Power.admx* @@ -799,7 +799,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Low battery notification action* +- GP Friendly name: *Low battery notification action* - GP name: *DCBatteryDischargeAction1_2* - GP path: *System\Power Management\Notification Settings* - GP ADMX file name: *Power.admx* @@ -870,7 +870,7 @@ If you disable this policy setting or do not configure it, users control this se ADMX Info: -- GP English name: *Critical battery notification level* +- GP Friendly name: *Critical battery notification level* - GP name: *DCBatteryDischargeLevel0_2* - GP path: *System\Power Management\Notification Settings* - GP ADMX file name: *Power.admx* @@ -943,7 +943,7 @@ If you disable or do not configure this policy setting, users can control this s ADMX Info: -- GP English name: *Turn off low battery user notification* +- GP Friendly name: *Turn off low battery user notification* - GP name: *DCBatteryDischargeLevel1UINotification_2* - GP path: *System\Power Management\Notification Settings* - GP ADMX file name: *Power.admx* @@ -1014,7 +1014,7 @@ If you disable this policy setting or do not configure it, users control this se ADMX Info: -- GP English name: *Low battery notification level* +- GP Friendly name: *Low battery notification level* - GP name: *DCBatteryDischargeLevel1_2* - GP path: *System\Power Management\Notification Settings* - GP ADMX file name: *Power.admx* @@ -1085,7 +1085,7 @@ If you do not configure this policy setting, users control this setting. ADMX Info: -- GP English name: *Allow network connectivity during connected-standby (on battery)* +- GP Friendly name: *Allow network connectivity during connected-standby (on battery)* - GP name: *DCConnectivityInStandby_2* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -1154,7 +1154,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Turn on the ability for applications to prevent sleep transitions (on battery)* +- GP Friendly name: *Turn on the ability for applications to prevent sleep transitions (on battery)* - GP name: *DCCriticalSleepTransitionsDisable_2* - GP path: *System\Power Management\Sleep Settings* - GP ADMX file name: *Power.admx* @@ -1227,7 +1227,7 @@ If you disable this policy or do not configure this policy setting, users contro ADMX Info: -- GP English name: *Select the Start menu Power button action (on battery)* +- GP Friendly name: *Select the Start menu Power button action (on battery)* - GP name: *DCStartMenuButtonAction_2* - GP path: *System\Power Management\Button Settings* - GP ADMX file name: *Power.admx* @@ -1296,7 +1296,7 @@ If you disable or do not configure this policy setting, users can see and change ADMX Info: -- GP English name: *Turn Off the hard disk (plugged in)* +- GP Friendly name: *Turn Off the hard disk (plugged in)* - GP name: *DiskACPowerDownTimeOut_2* - GP path: *System\Power Management\Hard Disk Settings* - GP ADMX file name: *Power.admx* @@ -1365,7 +1365,7 @@ If you disable or do not configure this policy setting, users can see and change ADMX Info: -- GP English name: *Turn Off the hard disk (on battery)* +- GP Friendly name: *Turn Off the hard disk (on battery)* - GP name: *DiskDCPowerDownTimeOut_2* - GP path: *System\Power Management\Hard Disk Settings* - GP ADMX file name: *Power.admx* @@ -1440,7 +1440,7 @@ If you disable or do not configure this policy setting, the computer system safe ADMX Info: -- GP English name: *Do not turn off system power after a Windows system shutdown has occurred.* +- GP Friendly name: *Do not turn off system power after a Windows system shutdown has occurred.* - GP name: *Dont_PowerOff_AfterShutdown* - GP path: *System* - GP ADMX file name: *Power.admx* @@ -1511,7 +1511,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Turn on desktop background slideshow (plugged in)* +- GP Friendly name: *Turn on desktop background slideshow (plugged in)* - GP name: *EnableDesktopSlideShowAC* - GP path: *System\Power Management\Video and Display Settings* - GP ADMX file name: *Power.admx* @@ -1582,7 +1582,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Turn on desktop background slideshow (on battery)* +- GP Friendly name: *Turn on desktop background slideshow (on battery)* - GP name: *EnableDesktopSlideShowDC* - GP path: *System\Power Management\Video and Display Settings* - GP ADMX file name: *Power.admx* @@ -1651,7 +1651,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Select an active power plan* +- GP Friendly name: *Select an active power plan* - GP name: *InboxActiveSchemeOverride_2* - GP path: *System\Power Management* - GP ADMX file name: *Power.admx* @@ -1720,7 +1720,7 @@ If you disable or do not configure this policy setting, users control if their c ADMX Info: -- GP English name: *Prompt for password on resume from hibernate/suspend* +- GP Friendly name: *Prompt for password on resume from hibernate/suspend* - GP name: *PW_PromptPasswordOnResume* - GP path: *System\Power Management* - GP ADMX file name: *Power.admx* @@ -1789,7 +1789,7 @@ If you disable or do not configure this policy setting, users control this setti ADMX Info: -- GP English name: *Turn off Power Throttling* +- GP Friendly name: *Turn off Power Throttling* - GP name: *PowerThrottlingTurnOff* - GP path: *System\Power Management\Power Throttling Settings* - GP ADMX file name: *Power.admx* @@ -1858,7 +1858,7 @@ If you disable or do not configure this policy setting, users can see and change ADMX Info: -- GP English name: *Reserve battery notification level* +- GP Friendly name: *Reserve battery notification level* - GP name: *ReserveBatteryNotificationLevel* - GP path: *System\Power Management\Notification Settings* - GP ADMX file name: *Power.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md index cf73077bc0..dff726a8e8 100644 --- a/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md +++ b/windows/client-management/mdm/policy-csp-admx-powershellexecutionpolicy.md @@ -105,7 +105,7 @@ To add modules and snap-ins to the policy setting list, click Show, and then typ ADMX Info: -- GP English name: *Turn on Module Logging* +- GP Friendly name: *Turn on Module Logging* - GP name: *EnableModuleLogging* - GP path: *Windows Components\Windows PowerShell* - GP ADMX file name: *PowerShellExecutionPolicy.admx* @@ -180,7 +180,7 @@ If you disable this policy setting, no scripts are allowed to run. ADMX Info: -- GP English name: *Turn on Script Execution* +- GP Friendly name: *Turn on Script Execution* - GP name: *EnableScripts* - GP path: *Windows Components\Windows PowerShell* - GP ADMX file name: *PowerShellExecutionPolicy.admx* @@ -255,7 +255,7 @@ If you use the OutputDirectory setting to enable transcript logging to a shared ADMX Info: -- GP English name: *Turn on PowerShell Transcription* +- GP Friendly name: *Turn on PowerShell Transcription* - GP name: *EnableTranscripting* - GP path: *Windows Components\Windows PowerShell* - GP ADMX file name: *PowerShellExecutionPolicy.admx* @@ -328,7 +328,7 @@ If this policy setting is disabled or not configured, this policy setting does n ADMX Info: -- GP English name: *Set the default source path for Update-Help* +- GP Friendly name: *Set the default source path for Update-Help* - GP name: *EnableUpdateHelpDefaultSourcePath* - GP path: *Windows Components\Windows PowerShell* - GP ADMX file name: *PowerShellExecutionPolicy.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-printing.md b/windows/client-management/mdm/policy-csp-admx-printing.md index 0781ec7432..2376b4480e 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing.md +++ b/windows/client-management/mdm/policy-csp-admx-printing.md @@ -173,7 +173,7 @@ Also, see the "Custom support URL in the Printers folder's left pane" setting in ADMX Info: -- GP English name: *Activate Internet printing* +- GP Friendly name: *Activate Internet printing* - GP name: *AllowWebPrinting* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -249,7 +249,7 @@ If you disable this policy setting, then print drivers will be loaded within all ADMX Info: -- GP English name: *Isolate print drivers from applications* +- GP Friendly name: *Isolate print drivers from applications* - GP name: *ApplicationDriverIsolation* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -325,7 +325,7 @@ Web view is affected by the "Turn on Classic Shell" and "Do not allow Folder Opt ADMX Info: -- GP English name: *Custom support URL in the Printers folder's left pane* +- GP Friendly name: *Custom support URL in the Printers folder's left pane* - GP name: *CustomizedSupportUrl* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -398,7 +398,7 @@ By default, Windows Ultimate, Professional and Home SKUs will continue to search ADMX Info: -- GP English name: *Extend Point and Print connection to search Windows Update* +- GP Friendly name: *Extend Point and Print connection to search Windows Update* - GP name: *DoNotInstallCompatibleDriverFromWindowsUpdate* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -481,7 +481,7 @@ In Windows 8 and later, Bluetooth printers are not shown so its limit does not a ADMX Info: -- GP English name: *Add Printer wizard - Network scan page (Managed network)* +- GP Friendly name: *Add Printer wizard - Network scan page (Managed network)* - GP name: *DomainPrinters* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -553,7 +553,7 @@ If you disable this setting, the network printer browse page is removed from wit ADMX Info: -- GP English name: *Browse the network to find printers* +- GP Friendly name: *Browse the network to find printers* - GP name: *DownlevelBrowse* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -633,7 +633,7 @@ If you do not enable this policy setting, the behavior is the same as disabling ADMX Info: -- GP English name: *Always render print jobs on the server* +- GP Friendly name: *Always render print jobs on the server* - GP name: *EMFDespooling* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -700,7 +700,7 @@ This setting may improve the performance of the XPS Rasterization Service or the ADMX Info: -- GP English name: *Always rasterize content to be printed using a software rasterizer* +- GP Friendly name: *Always rasterize content to be printed using a software rasterizer* - GP name: *ForceSoftwareRasterization* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -773,7 +773,7 @@ Also, see the "Custom support URL in the Printers folder's left pane" and "Activ ADMX Info: -- GP English name: *Browse a common web site to find printers* +- GP Friendly name: *Browse a common web site to find printers* - GP name: *IntranetPrintersUrl* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -847,7 +847,7 @@ If you enable this setting, installation of a printer using a kernel-mode driver ADMX Info: -- GP English name: *Disallow installation of printers using kernel-mode drivers* +- GP Friendly name: *Disallow installation of printers using kernel-mode drivers* - GP name: *KMPrintersAreBlocked* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -918,7 +918,7 @@ If you do not configure this setting, default printer management will not change ADMX Info: -- GP English name: *Turn off Windows default printer management* +- GP Friendly name: *Turn off Windows default printer management* - GP name: *LegacyDefaultPrinterMode* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -987,7 +987,7 @@ If you disable or do not configure this policy setting, the default MXDW output ADMX Info: -- GP English name: *Change Microsoft XPS Document Writer (MXDW) default output format to the legacy Microsoft XPS format (*.xps)* +- GP Friendly name: *Change Microsoft XPS Document Writer (MXDW) default output format to the legacy Microsoft XPS format (*.xps)* - GP name: *MXDWUseLegacyOutputFormatMSXPS* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1058,7 +1058,7 @@ If this policy is disabled, or not configured, users can delete printers using t ADMX Info: -- GP English name: *Prevent deletion of printers* +- GP Friendly name: *Prevent deletion of printers* - GP name: *NoDeletePrinter* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -1138,7 +1138,7 @@ In Windows 8 and later, Bluetooth printers are not shown so its limit does not a ADMX Info: -- GP English name: *Add Printer wizard - Network scan page (Unmanaged network)* +- GP Friendly name: *Add Printer wizard - Network scan page (Unmanaged network)* - GP name: *NonDomainPrinters* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1207,7 +1207,7 @@ If this setting is disabled, or not configured, users will not be restricted to ADMX Info: -- GP English name: *Only use Package Point and print* +- GP Friendly name: *Only use Package Point and print* - GP name: *PackagePointAndPrintOnly* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -1276,7 +1276,7 @@ If this setting is disabled, or not configured, users will not be restricted to ADMX Info: -- GP English name: *Only use Package Point and print* +- GP Friendly name: *Only use Package Point and print* - GP name: *PackagePointAndPrintOnly_Win7* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1349,7 +1349,7 @@ If this setting is disabled, or not configured, package point and print will not ADMX Info: -- GP English name: *Package Point and print - Approved servers* +- GP Friendly name: *Package Point and print - Approved servers* - GP name: *PackagePointAndPrintServerList* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -1422,7 +1422,7 @@ If this setting is disabled, or not configured, package point and print will not ADMX Info: -- GP English name: *Package Point and print - Approved servers* +- GP Friendly name: *Package Point and print - Approved servers* - GP name: *PackagePointAndPrintServerList_Win7* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1495,7 +1495,7 @@ If you disable this setting or do not configure it, and the user does not type a ADMX Info: -- GP English name: *Computer location* +- GP Friendly name: *Computer location* - GP name: *PhysicalLocation* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1566,7 +1566,7 @@ If you disable this setting or do not configure it, Location Tracking is disable ADMX Info: -- GP English name: *Pre-populate printer search location text* +- GP Friendly name: *Pre-populate printer search location text* - GP name: *PhysicalLocationSupport* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1640,7 +1640,7 @@ If you disable this policy setting, the print spooler will execute print drivers ADMX Info: -- GP English name: *Execute print drivers in isolated processes* +- GP Friendly name: *Execute print drivers in isolated processes* - GP name: *PrintDriverIsolationExecutionPolicy* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1714,7 +1714,7 @@ If you disable or do not configure this policy setting, the print spooler uses t ADMX Info: -- GP English name: *Override print driver execution compatibility setting reported by print driver* +- GP Friendly name: *Override print driver execution compatibility setting reported by print driver* - GP name: *PrintDriverIsolationOverrideCompat* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1785,7 +1785,7 @@ This setting only provides a starting point for Active Directory searches for pr ADMX Info: -- GP English name: *Default Active Directory path when searching for printers* +- GP Friendly name: *Default Active Directory path when searching for printers* - GP name: *PrinterDirectorySearchScope* - GP path: *Control Panel\Printers* - GP ADMX file name: *Printing.admx* @@ -1861,7 +1861,7 @@ If you do not configure this setting, shared printers are announced to browse ma ADMX Info: -- GP English name: *Printer browsing* +- GP Friendly name: *Printer browsing* - GP name: *PrinterServerThread* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -1933,7 +1933,7 @@ If you enable this policy setting, the print job name will be included in new lo ADMX Info: -- GP English name: *Allow job name in event logs* +- GP Friendly name: *Allow job name in event logs* - GP name: *ShowJobTitleInEventLogs* - GP path: *Printers* - GP ADMX file name: *Printing.admx* @@ -2004,7 +2004,7 @@ If you disable this policy setting or do not configure it, then all printer exte ADMX Info: -- GP English name: *Do not allow v4 printer drivers to show printer extensions* +- GP Friendly name: *Do not allow v4 printer drivers to show printer extensions* - GP name: *V4DriverDisallowPrinterExtension* - GP path: *Printers* - GP ADMX file name: *Printing.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-printing2.md b/windows/client-management/mdm/policy-csp-admx-printing2.md index 60ed6563a3..55aeef679a 100644 --- a/windows/client-management/mdm/policy-csp-admx-printing2.md +++ b/windows/client-management/mdm/policy-csp-admx-printing2.md @@ -119,7 +119,7 @@ The default behavior is to automatically publish shared printers in Active Direc ADMX Info: -- GP English name: *Automatically publish new printers in Active Directory* +- GP Friendly name: *Automatically publish new printers in Active Directory* - GP name: *AutoPublishing* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -193,7 +193,7 @@ If you disable this setting, the domain controller does not prune this computer' ADMX Info: -- GP English name: *Allow pruning of published printers* +- GP Friendly name: *Allow pruning of published printers* - GP name: *ImmortalPrintQueue* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -274,7 +274,7 @@ You can enable this setting to change the default behavior. To use this setting, ADMX Info: -- GP English name: *Prune printers that are not automatically republished* +- GP Friendly name: *Prune printers that are not automatically republished* - GP name: *PruneDownlevel* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -350,7 +350,7 @@ If you do not configure or disable this setting the default values will be used. ADMX Info: -- GP English name: *Directory pruning interval* +- GP Friendly name: *Directory pruning interval* - GP name: *PruningInterval* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -424,7 +424,7 @@ By default, the pruning thread runs at normal priority. However, you can adjust ADMX Info: -- GP English name: *Directory pruning priority* +- GP Friendly name: *Directory pruning priority* - GP name: *PruningPriority* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -500,7 +500,7 @@ If you do not configure or disable this setting, the default values are used. ADMX Info: -- GP English name: *Directory pruning retry* +- GP Friendly name: *Directory pruning retry* - GP name: *PruningRetries* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -576,7 +576,7 @@ Note: This setting does not affect the logging of pruning events; the actual pru ADMX Info: -- GP English name: *Log directory pruning retry events* +- GP Friendly name: *Log directory pruning retry events* - GP name: *PruningRetryLog* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -647,7 +647,7 @@ The spooler must be restarted for changes to this policy to take effect. ADMX Info: -- GP English name: *Allow Print Spooler to accept client connections* +- GP Friendly name: *Allow Print Spooler to accept client connections* - GP name: *RegisterSpoolerRemoteRpcEndPoint* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* @@ -718,7 +718,7 @@ To disable verification, disable this setting, or enable this setting and select ADMX Info: -- GP English name: *Check published state* +- GP Friendly name: *Check published state* - GP name: *VerifyPublishedState* - GP path: *Printers* - GP ADMX file name: *Printing2.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-programs.md b/windows/client-management/mdm/policy-csp-admx-programs.md index b325def568..269ccd44c0 100644 --- a/windows/client-management/mdm/policy-csp-admx-programs.md +++ b/windows/client-management/mdm/policy-csp-admx-programs.md @@ -112,7 +112,7 @@ This setting does not prevent the Default Programs icon from appearing on the St ADMX Info: -- GP English name: *Hide "Set Program Access and Computer Defaults" page* +- GP Friendly name: *Hide "Set Program Access and Computer Defaults" page* - GP name: *NoDefaultPrograms* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* @@ -188,7 +188,7 @@ If this setting is disabled or is not configured, the "Install a program from th ADMX Info: -- GP English name: *Hide "Get Programs" page* +- GP Friendly name: *Hide "Get Programs" page* - GP name: *NoGetPrograms* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* @@ -259,7 +259,7 @@ This setting does not prevent users from using other tools and methods to instal ADMX Info: -- GP English name: *Hide "Installed Updates" page* +- GP Friendly name: *Hide "Installed Updates" page* - GP name: *NoInstalledUpdates* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* @@ -328,7 +328,7 @@ This setting does not prevent users from using other tools and methods to view o ADMX Info: -- GP English name: *Hide "Programs and Features" page* +- GP Friendly name: *Hide "Programs and Features" page* - GP name: *NoProgramsAndFeatures* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* @@ -401,7 +401,7 @@ This setting does not prevent users from using other tools and methods to instal ADMX Info: -- GP English name: *Hide the Programs Control Panel* +- GP Friendly name: *Hide the Programs Control Panel* - GP name: *NoProgramsCPL* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* @@ -470,7 +470,7 @@ This setting does not prevent users from using other tools and methods to config ADMX Info: -- GP English name: *Hide "Windows Features"* +- GP Friendly name: *Hide "Windows Features"* - GP name: *NoWindowsFeatures* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* @@ -544,7 +544,7 @@ If this feature is disabled or is not configured, the "Get new programs from Win ADMX Info: -- GP English name: *Hide "Windows Marketplace"* +- GP Friendly name: *Hide "Windows Marketplace"* - GP name: *NoWindowsMarketplace* - GP path: *Control Panel\Programs* - GP ADMX file name: *Programs.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-reliability.md b/windows/client-management/mdm/policy-csp-admx-reliability.md index 794b2ccea4..917a3bcdc5 100644 --- a/windows/client-management/mdm/policy-csp-admx-reliability.md +++ b/windows/client-management/mdm/policy-csp-admx-reliability.md @@ -104,7 +104,7 @@ If you do not configure this policy setting, the Persistent System Timestamp is ADMX Info: -- GP English name: *Enable Persistent Time Stamp* +- GP Friendly name: *Enable Persistent Time Stamp* - GP name: *EE_EnablePersistentTimeStamp* - GP path: *System* - GP ADMX file name: *Reliability.admx* @@ -179,7 +179,7 @@ Also see the "Configure Error Reporting" policy setting. ADMX Info: -- GP English name: *Report unplanned shutdown events* +- GP Friendly name: *Report unplanned shutdown events* - GP name: *PCH_ReportShutdownEvents* - GP path: *Windows Components\Windows Error Reporting\Advanced Error Reporting Settings* - GP ADMX file name: *Reliability.admx* @@ -257,7 +257,7 @@ If you do not configure this policy setting, the default behavior for the System ADMX Info: -- GP English name: *Activate Shutdown Event Tracker System State Data feature* +- GP Friendly name: *Activate Shutdown Event Tracker System State Data feature* - GP name: *ShutdownEventTrackerStateFile* - GP path: *System* - GP ADMX file name: *Reliability.admx* @@ -337,7 +337,7 @@ If you do not configure this policy setting, the default behavior for the Shutdo ADMX Info: -- GP English name: *Display Shutdown Event Tracker* +- GP Friendly name: *Display Shutdown Event Tracker* - GP name: *ShutdownReason* - GP path: *System* - GP ADMX file name: *Reliability.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md index ee0e87ac83..485d680915 100644 --- a/windows/client-management/mdm/policy-csp-admx-remoteassistance.md +++ b/windows/client-management/mdm/policy-csp-admx-remoteassistance.md @@ -95,7 +95,7 @@ If you do not configure this policy setting, users can configure the setting in ADMX Info: -- GP English name: *Allow only Windows Vista or later connections* +- GP Friendly name: *Allow only Windows Vista or later connections* - GP name: *RA_EncryptedTicketOnly* - GP path: *System\Remote Assistance* - GP ADMX file name: *RemoteAssistance.admx* @@ -182,7 +182,7 @@ If you do not configure this policy setting, application-based settings are used ADMX Info: -- GP English name: *Turn on bandwidth optimization* +- GP Friendly name: *Turn on bandwidth optimization* - GP name: *RA_Optimize_Bandwidth* - GP path: *System\Remote Assistance* - GP ADMX file name: *RemoteAssistance.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-removablestorage.md b/windows/client-management/mdm/policy-csp-admx-removablestorage.md index 05f6d8b135..b839eb3de7 100644 --- a/windows/client-management/mdm/policy-csp-admx-removablestorage.md +++ b/windows/client-management/mdm/policy-csp-admx-removablestorage.md @@ -186,7 +186,7 @@ If you disable or do not configure this setting, the operating system does not f ADMX Info: -- GP English name: *Set time (in seconds) to force reboot* +- GP Friendly name: *Set time (in seconds) to force reboot* - GP name: *AccessRights_RebootTime_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -258,7 +258,7 @@ If you disable or do not configure this setting, the operating system does not f ADMX Info: -- GP English name: *Set time (in seconds) to force reboot* +- GP Friendly name: *Set time (in seconds) to force reboot* - GP name: *AccessRights_RebootTime_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -327,7 +327,7 @@ If you disable or do not configure this policy setting, execute access is allowe ADMX Info: -- GP English name: *CD and DVD: Deny execute access* +- GP Friendly name: *CD and DVD: Deny execute access* - GP name: *CDandDVD_DenyExecute_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -395,7 +395,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *CD and DVD: Deny read access* +- GP Friendly name: *CD and DVD: Deny read access* - GP name: *CDandDVD_DenyRead_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -464,7 +464,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *CD and DVD: Deny read access* +- GP Friendly name: *CD and DVD: Deny read access* - GP name: *CDandDVD_DenyRead_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -533,7 +533,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *CD and DVD: Deny write access* +- GP Friendly name: *CD and DVD: Deny write access* - GP name: *CDandDVD_DenyWrite_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -602,7 +602,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *CD and DVD: Deny write access* +- GP Friendly name: *CD and DVD: Deny write access* - GP name: *CDandDVD_DenyWrite_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -671,7 +671,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Custom Classes: Deny read access* +- GP Friendly name: *Custom Classes: Deny read access* - GP name: *CustomClasses_DenyRead_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -740,7 +740,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Custom Classes: Deny read access* +- GP Friendly name: *Custom Classes: Deny read access* - GP name: *CustomClasses_DenyRead_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -809,7 +809,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Custom Classes: Deny write access* +- GP Friendly name: *Custom Classes: Deny write access* - GP name: *CustomClasses_DenyWrite_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -877,7 +877,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Custom Classes: Deny write access* +- GP Friendly name: *Custom Classes: Deny write access* - GP name: *CustomClasses_DenyWrite_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -945,7 +945,7 @@ If you disable or do not configure this policy setting, execute access is allowe ADMX Info: -- GP English name: *Floppy Drives: Deny execute access* +- GP Friendly name: *Floppy Drives: Deny execute access* - GP name: *FloppyDrives_DenyExecute_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1013,7 +1013,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Floppy Drives: Deny read access* +- GP Friendly name: *Floppy Drives: Deny read access* - GP name: *FloppyDrives_DenyRead_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1081,7 +1081,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Floppy Drives: Deny read access* +- GP Friendly name: *Floppy Drives: Deny read access* - GP name: *FloppyDrives_DenyRead_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1148,7 +1148,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Floppy Drives: Deny write access* +- GP Friendly name: *Floppy Drives: Deny write access* - GP name: *FloppyDrives_DenyWrite_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1216,7 +1216,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Floppy Drives: Deny write access* +- GP Friendly name: *Floppy Drives: Deny write access* - GP name: *FloppyDrives_DenyWrite_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1283,7 +1283,7 @@ If you disable or do not configure this policy setting, execute access is allowe ADMX Info: -- GP English name: *Removable Disks: Deny execute access* +- GP Friendly name: *Removable Disks: Deny execute access* - GP name: *RemovableDisks_DenyExecute_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1351,7 +1351,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Removable Disks: Deny read access* +- GP Friendly name: *Removable Disks: Deny read access* - GP name: *RemovableDisks_DenyRead_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1418,7 +1418,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Removable Disks: Deny read access* +- GP Friendly name: *Removable Disks: Deny read access* - GP name: *RemovableDisks_DenyRead_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1489,7 +1489,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Removable Disks: Deny write access* +- GP Friendly name: *Removable Disks: Deny write access* - GP name: *RemovableDisks_DenyWrite_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1559,7 +1559,7 @@ If you disable or do not configure this policy setting, write and read accesses ADMX Info: -- GP English name: *All Removable Storage classes: Deny all access* +- GP Friendly name: *All Removable Storage classes: Deny all access* - GP name: *RemovableStorageClasses_DenyAll_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1629,7 +1629,7 @@ If you disable or do not configure this policy setting, write and read accesses ADMX Info: -- GP English name: *All Removable Storage classes: Deny all access* +- GP Friendly name: *All Removable Storage classes: Deny all access* - GP name: *RemovableStorageClasses_DenyAll_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1697,7 +1697,7 @@ If you disable or do not configure this policy setting, remote users cannot open ADMX Info: -- GP English name: *All Removable Storage: Allow direct access in remote sessions* +- GP Friendly name: *All Removable Storage: Allow direct access in remote sessions* - GP name: *Removable_Remote_Allow_Access* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1765,7 +1765,7 @@ If you disable or do not configure this policy setting, execute access is allowe ADMX Info: -- GP English name: *Tape Drives: Deny execute access* +- GP Friendly name: *Tape Drives: Deny execute access* - GP name: *TapeDrives_DenyExecute_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1832,7 +1832,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Tape Drives: Deny read access* +- GP Friendly name: *Tape Drives: Deny read access* - GP name: *TapeDrives_DenyRead_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1900,7 +1900,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *Tape Drives: Deny read access* +- GP Friendly name: *Tape Drives: Deny read access* - GP name: *TapeDrives_DenyRead_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -1967,7 +1967,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Tape Drives: Deny write access* +- GP Friendly name: *Tape Drives: Deny write access* - GP name: *TapeDrives_DenyWrite_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -2035,7 +2035,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *Tape Drives: Deny write access* +- GP Friendly name: *Tape Drives: Deny write access* - GP name: *TapeDrives_DenyWrite_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -2103,7 +2103,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *WPD Devices: Deny read access* +- GP Friendly name: *WPD Devices: Deny read access* - GP name: *WPDDevices_DenyRead_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -2170,7 +2170,7 @@ If you disable or do not configure this policy setting, read access is allowed t ADMX Info: -- GP English name: *WPD Devices: Deny read access* +- GP Friendly name: *WPD Devices: Deny read access* - GP name: *WPDDevices_DenyRead_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -2238,7 +2238,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *WPD Devices: Deny write access* +- GP Friendly name: *WPD Devices: Deny write access* - GP name: *WPDDevices_DenyWrite_Access_1* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* @@ -2306,7 +2306,7 @@ If you disable or do not configure this policy setting, write access is allowed ADMX Info: -- GP English name: *WPD Devices: Deny write access* +- GP Friendly name: *WPD Devices: Deny write access* - GP name: *WPDDevices_DenyWrite_Access_2* - GP path: *System\Removable Storage Access* - GP ADMX file name: *RemovableStorage.admx* From f26e7b4179e06ab999df7bc5f52edd6f73e08c46 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 16 Aug 2021 10:56:17 +0530 Subject: [PATCH 0031/1214] Update policy-csp-display.md --- windows/client-management/mdm/policy-csp-display.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index fb0f2838d1..5e2aa1a53b 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -159,7 +159,7 @@ Per Process System DPI will not work for all applications as some older desktop In some cases, you may see some unexpected behavior in some desktop applications that have Per-Process System DPI applied. If that happens, Per Process System DPI should be disabled. -Enabling this setting lets you specify the system-wide default for desktop applications as well as per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. +Enabling this setting lets you specify the system-wide default for desktop applications and per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. @@ -309,7 +309,7 @@ ADMX Info: To validate on Desktop, do the following: -1. Configure the setting for an app which has GDI DPI scaling enabled via MDM or any other supported mechanisms. +1. Configure the setting for an app, which has GDI DPI scaling enabled via MDM or any other supported mechanisms. 2. Run the app and observe blurry text. From b64e7b2bbd0a7a68723f295aa383b994ec7fcaaf Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Mon, 16 Aug 2021 11:07:54 +0530 Subject: [PATCH 0032/1214] Updated --- windows/client-management/mdm/policy-csp-display.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-display.md b/windows/client-management/mdm/policy-csp-display.md index 5e2aa1a53b..12a6952ffa 100644 --- a/windows/client-management/mdm/policy-csp-display.md +++ b/windows/client-management/mdm/policy-csp-display.md @@ -159,7 +159,7 @@ Per Process System DPI will not work for all applications as some older desktop In some cases, you may see some unexpected behavior in some desktop applications that have Per-Process System DPI applied. If that happens, Per Process System DPI should be disabled. -Enabling this setting lets you specify the system-wide default for desktop applications and per-application overrides. If you disable or do not configure this setting, Per Process System DPI will not apply to any processes on the system. +Enabling this setting lets you specify the system-wide default for desktop applications and per-application overrides. If you disable or do not configure this setting. Per Process System DPI will not apply to any processes on the system. @@ -312,7 +312,7 @@ To validate on Desktop, do the following: 1. Configure the setting for an app, which has GDI DPI scaling enabled via MDM or any other supported mechanisms. 2. Run the app and observe blurry text. - +Each cloud resource can also be paired optionally with an internal proxy server by using a trailing comma followed by the proxy address.


@@ -384,7 +384,7 @@ ADMX Info: To validate on Desktop, do the following: -1. Configure the setting for an app which uses GDI. +1. Configure the setting for an app, which uses GDI. 2. Run the app and observe crisp text. From 6fb11f9ca0d09f62be836b12d033efe28c69320b Mon Sep 17 00:00:00 2001 From: Benoit Date: Wed, 18 Aug 2021 11:13:49 +0200 Subject: [PATCH 0033/1214] Update prepare-for-windows-deployment-with-mdt.md --- ...prepare-for-windows-deployment-with-mdt.md | 31 +++++++++---------- 1 file changed, 14 insertions(+), 17 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 4250054f65..0f57970c70 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -147,21 +147,9 @@ Switch to **DC01** and perform the following procedures on **DC01**: To create the OU structure, you can use the Active Directory Users and Computers console (dsa.msc), or you can use Windows PowerShell. -To use Windows PowerShell, copy the following commands into a text file and save it as C:\Setup\Scripts\ou.ps1. Be sure that you are viewing file extensions and that you save the file with the .ps1 extension. +Copy the following list of OU names and paths into a CSV file and save it as `~\Setup\Scripts\oulist.csv`. -```powershell -$oulist = Import-csv -Path c:\oulist.txt -ForEach($entry in $oulist){ - $ouname = $entry.ouname - $oupath = $entry.oupath - New-ADOrganizationalUnit -Name $ouname -Path $oupath - Write-Host -ForegroundColor Green "OU $ouname is created in the location $oupath" -} -``` - -Next, copy the following list of OU names and paths into a text file and save it as C:\Setup\Scripts\oulist.txt - -```text +```csv OUName,OUPath Contoso,"DC=CONTOSO,DC=COM" Accounts,"OU=Contoso,DC=CONTOSO,DC=COM" @@ -175,11 +163,20 @@ Workstations,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" Security Groups,"OU=Groups,OU=Contoso,DC=CONTOSO,DC=COM" ``` -Lastly, open an elevated Windows PowerShell prompt on DC01 and run the ou.ps1 script: +Next, copy the following commands into a file and save it as `~\Setup\Scripts\ou.ps1`. Be sure that you are viewing file extensions and that you save the file with the `.ps1` extension. + +```powershell +Import-CSV -Path $home\Setup\Scripts\oulist.csv | ForEach-Object { + New-ADOrganizationalUnit -Name $_.ouname -Path $_.oupath + Write-Host -ForegroundColor Green "OU $($_.ouname) is created in the location $($_.oupath)" +} +``` + +Lastly, open an elevated Windows PowerShell prompt on DC01 and run the `ou.ps1` script: ```powershell Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force -Set-Location C:\Setup\Scripts +Set-Location $home\Setup\Scripts .\ou.ps1 ``` @@ -262,4 +259,4 @@ When you have completed all the steps in this section to prepare for deployment, The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so you can see how some tasks can be automated with Windows PowerShell. - [Gather.ps1](/samples/browse/?redirectedfrom=TechNet-Gallery). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment. - [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. -- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. \ No newline at end of file +- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. From f5d12be8ebd4963d37717eeaa14623775cee28ed Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 18 Aug 2021 08:56:40 -0700 Subject: [PATCH 0034/1214] add link for PCHealthCheck --- windows/whats-new/windows-11-plan.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/windows-11-plan.md b/windows/whats-new/windows-11-plan.md index 5af0900b7e..2aebecdb11 100644 --- a/windows/whats-new/windows-11-plan.md +++ b/windows/whats-new/windows-11-plan.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay ms.author: greglin -ms.date: 06/24/2021 +ms.date: 08/18/2021 ms.reviewer: manager: laurawi ms.localizationpriority: high @@ -39,7 +39,7 @@ If you are looking for ways to optimize your approach to deploying Windows 11, o As a first step, you will need to know which of your current devices meet the Windows 11 hardware requirements. Most devices purchased in the last 18-24 months will be compatible with Windows 11. Verify that your device meets or exceeds [Windows 11 requirements](windows-11-requirements.md) to ensure it is compatible. -Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the **PC Health Check** app to determine their eligibility for Windows 11. End-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.  +Microsoft is currently developing analysis tools to help you evaluate your devices against the Windows 11 hardware requirements. When Windows 11 reaches general availability, end-users running Windows 10 Home, Pro, and Pro for Workstations will be able to use the [PC Health Check](https://www.microsoft.com/windows/windows-11#pchealthcheck) app to determine their eligibility for Windows 11. End-users running Windows 10 Enterprise and Education editions should rely on their IT administrators to let them know when they are eligible for the upgrade.  Enterprise organizations looking to evaluate device readiness in their environments can expect this capability to be integrated into existing Microsoft tools, such as Endpoint analytics and Update Compliance. This capability will be available when Windows 11 is generally available. Microsoft is also working with software publishing partners to facilitate adding Windows 11 device support into their solutions. From 475706a412dd106f3f1d0b75cc8c7a8037ef6b96 Mon Sep 17 00:00:00 2001 From: Diana Hanson Date: Wed, 18 Aug 2021 10:29:01 -0600 Subject: [PATCH 0035/1214] Fix Acro spelling Sync PR https://github.com/MicrosoftDocs/windows-docs-pr/pull/5523 --- .../prepare-for-windows-deployment-with-mdt.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md index 0f57970c70..c1039d7404 100644 --- a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md @@ -32,7 +32,7 @@ The procedures in this guide use the following names and infrastructure. For the purposes of this topic, we will use three server computers: **DC01**, **MDT01**, and **HV01**. - All servers are running Windows Server 2019. - You can use an earlier version of Windows Server with minor modifications to some procedures. - - Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is requried to perform the procedures in this guide. + - Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is required to perform the procedures in this guide. - **DC01** is a domain controller, DHCP server, and DNS server for contoso.com, representing the fictitious Contoso Corporation. - **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server. - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. @@ -209,7 +209,7 @@ The final result of either method is shown below. The **MDT_BA** account will be When creating a reference image, you need an account for MDT. The MDT build account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. -To create an MDT build account, open an elevalted Windows PowerShell prompt on DC01 and enter the following (copy and paste the entire command, taking care to notice the scroll bar at the bottom). This command will create the MDT_BA user account and set the password to "pass@word1": +To create an MDT build account, open an elevated Windows PowerShell prompt on DC01 and enter the following (copy and paste the entire command, taking care to notice the scroll bar at the bottom). This command will create the MDT_BA user account and set the password to "pass@word1": ```powershell New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true From 157d7770c48a76c093c027148c1b5bb09cdc83e2 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Wed, 18 Aug 2021 12:08:36 -0700 Subject: [PATCH 0036/1214] Add AAD cache steps to policy information page --- .../mdm/policy-csp-mixedreality.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 9b9c05d03d..c31db7523d 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -40,6 +40,19 @@ manager: dansimp +Steps to use this policy correctly: + +1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). +1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). + 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays + 1. The value can be between min / max allowed. +1. Enroll HoloLens devices and verify both configurations get applied to the device. +1. Let Azure AD user 1 sign-in when internet is available, once user signs-in and Azure AD group membership is confirmed successfully, cache will be created. +1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. +1. Steps 4 and 5 can be repeated for any other Azure AD user N. Key point here is that any Azure AD user must sign-in to device using Internet so at least once we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. + +> [!NOTE] +> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned in “disconnected” environments.
From c9643685bb11934569968b084ae6e46b5595312c Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Wed, 18 Aug 2021 12:13:25 -0700 Subject: [PATCH 0037/1214] score 80 --- windows/client-management/mdm/policy-csp-mixedreality.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index c31db7523d..cdf909411f 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -47,12 +47,12 @@ Steps to use this policy correctly: 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays 1. The value can be between min / max allowed. 1. Enroll HoloLens devices and verify both configurations get applied to the device. -1. Let Azure AD user 1 sign-in when internet is available, once user signs-in and Azure AD group membership is confirmed successfully, cache will be created. +1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. 1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. -1. Steps 4 and 5 can be repeated for any other Azure AD user N. Key point here is that any Azure AD user must sign-in to device using Internet so at least once we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. +1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. > [!NOTE] -> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned in “disconnected” environments. +> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments.
From 39297a0a171ef534127221643a3d036aa75a377b Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Wed, 18 Aug 2021 21:19:01 -0400 Subject: [PATCH 0038/1214] rewrite of overview; moving tables to new articles --- .../apps-in-windows-10.md | 803 +----------------- .../msix-app-packaging-tool.md | 2 + .../provisioned-apps-windows-client-os.md | 475 +++++++++++ .../system-apps-windows-client-os.md | 356 ++++++++ windows/application-management/toc.yml | 9 +- 5 files changed, 885 insertions(+), 760 deletions(-) create mode 100644 windows/application-management/provisioned-apps-windows-client-os.md create mode 100644 windows/application-management/system-apps-windows-client-os.md diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 3d8a9d9f4d..ee83c505d7 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -12,13 +12,29 @@ author: greg-lindsay ms.localizationpriority: medium ms.topic: article --- -# Understand the different apps included in Windows 10 ->Applies to: Windows 10 +# Overview of apps on Windows client devices -On your Windows 10 devices, you can run the following app types: +> Applies to: +> +> - Windows 10 -- **Windows apps**: These apps are included with the Windows OS, and are also installed from the Microsoft Store app. There are two categories: +## App types + +There are different types of apps that can run on your Windows client devices. This section lists some of the common apps used on Windows devices. + +- **Microsoft 365 apps**: These apps are used for business and productivity, and include Outlook, Word, Teams, OneNote, and more. + + [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans) + +- **Power Apps**: These apps connect to business data available online and on-premises, and can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. For more information, see [What is Power Apps?](/powerapps/powerapps-overview). + +- **.NET apps**: These apps can be desktop apps that run on the device, or web apps. Some common .NET apps include: + + - **Windows Presentation Foundation (WPF)**: Using .NET, you can create a WPF desktop app that runs on the device, or create a WPF web app. This app is commonly used by organizations that create line of business (LOB) desktop apps. For more information, see [WPF Application Development](/dotnet/desktop/wpf/app-development). + - **Windows Forms (WinForm)**: Using .NET, you can create a Windows Forms desktop app that runs on the device, and doesn't require a web browser or internet access. Just like Win32 apps, WinForm apps can access the local hardware and file system of the computer where the app is running. For more information, see [Desktop Guide (Windows Forms .NET)](/dotnet/desktop/winforms/overview). + +- **Windows apps**: These apps are included with the Windows OS, and can also installed from the Microsoft Store. There are two categories: - **Apps**: All apps installed in `C:\Program Files\WindowsApps`. There are two classes of apps: @@ -28,776 +44,47 @@ On your Windows 10 devices, you can run the following app types: - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. - **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. But, not all Windows apps are UWP apps. -- **Win32 apps**: These apps are traditional Windows applications. -This article lists the provisioned Windows apps and system apps installed on a standard Windows 10 Enterprise device. If you use custom images, your specific apps might be different. + For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide). -Some of the apps show up in multiple areas. That's because their status changed between versions. Make sure to check the version column for the version you're currently running. +- **Web apps** and **Progressive web apps (PWA)**: These apps run on a server, and don't run on the end user device. To use these apps, users must use a web browser and have internet access. **Progressive web apps** are designed to work for all users, work with any browser, and work on any platform. -## Provisioned Windows apps + Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a Web App](https://azure.microsoft.com/get-started/web-app/). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview). -The first time a user signs into a Windows device, some apps are automatically provisioned. To get a list of all provisioned Windows apps, run the following Windows PowerShell command: + Use MDM to create shortcut on devices -```Powershell -Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName -``` +- **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. -The following information lists the provisioned apps on the supported Windows 10 OS versions: + For more information, see [Get started developing apps for Windows desktop](/windows/apps/get-started) and [Make your apps great on Windows 11](/windows/apps/get-started/make-apps-great-for-windows). -- [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | Package name: Microsoft.3DBuilder - - Supported versions: +> [!TIP] +> Starting with Windows 10, you can use the **Windows UI Library (WinUI 3)** to create .NET, Win32 desktop, and UWP apps. This library includes native Windows UI controls and other user interface elements familiar to Windows users. For more information, see [Windows UI Library (WinUI)](/windows/apps/winui/). - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ✔️ | ✔️ | | | | | | +## Add or deploy apps to devices - --- +When your apps are ready, you can add or deploy these apps to your Windows devices. -- [Bing Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | Package name: Microsoft.BingWeather - - Supported versions: +- **Manually install**: On your devices, users can install apps from the Microsoft Store and from the internet. These apps, and more, are listed in **Settings** > **Apps and Features**. - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ✔️ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| +- **Mobile device management (MDM)**: Use a MDM provider, such as Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy and configure apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add store apps, and more. - --- + For more information, see: -- [Desktop App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | Package name: Microsoft.DesktopAppInstaller - - Supported versions: + - [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) + - [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | Use Settings App | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| +- Settings > Apps & features: Provisioned apps, apps installed by users, and apps installed by MDM providers are listed in **Settings** > **Apps and Features**. +- Use Store +- Windows Package Manager: https://docs.microsoft.com/en-us/windows/package-manager + - Can install apps from store, or from package. It's a developer tool. + - Only for Windows - --- +- App-V: + - app-v server: might not support Win11. It's a separate download. + - app-v client: does support Win11. The OS ships with client installs. -- [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | Package name: Microsoft.GetHelp - - Supported versions: + Goal: Stop using app-v, and get on Azure Virtual desktop with msix app attach - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| - --- - -- [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | Package name: Microsoft.Getstarted - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| - - --- - -- [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.HEIFImageExtension - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| - - --- - -- [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | Package name:Microsoft.Messaging - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️| - - --- - -- [Microsoft 3D Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | Package name: Microsoft.Microsoft3DViewer - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftOfficeHub - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftSolitaireCollection - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftStickyNotes - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | Package name: Microsoft.MixedReality.Portal - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | Package name: Microsoft.MSPaint - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | Package name: Microsoft.Office.OneNote - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | Package name: Microsoft.OneConnect - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️| - - --- - -- Microsoft.Outlook.DesktopIntegrationServices - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | | ✔️ | ✔️| | ✔️| | | - - --- - -- [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | Package name: Microsoft.People - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | Package name: Microsoft.Print3D - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️| - - --- - -- [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | Package name: Microsoft.ScreenSketch - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | Package name: Microsoft.SkypeApp - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | Package name: Microsoft.StorePurchaseApp - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- Microsoft.VP9VideoExtensions - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | Package name: Microsoft.Wallet - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | Package name: Microsoft.WebMediaExtensions - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.WebpImageExtension - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | Package name: Microsoft.Windows.Photos - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | Package name: Microsoft.WindowsAlarms - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCalculator - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCamera - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | Package name: microsoft.windowscommunicationsapps - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | Package name: Microsoft.WindowsFeedbackHub - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | Package name: Microsoft.WindowsMaps - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | Package name: Microsoft.WindowsSoundRecorder - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | Package name: Microsoft.WindowsStore - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - - - The Store app shouldn't be removed. If you remove the Store app, and want to reinstall it, you can restore your system from a backup, or reset your system. Instead of removing the Store app, use group policies to hide or disable it. - -- [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | Package name: Microsoft.Xbox.TCUI - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | Package name: Microsoft.XboxApp - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGameOverlay - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGamingOverlay - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | Package name: Microsoft.XboxIdentityProvider - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- Microsoft.XboxSpeechToTextOverlay - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | Package name: Microsoft.YourPhone - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | Package name: Microsoft.ZuneMusic - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -- [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | Package name: Microsoft.ZuneVideo - - Supported versions: - - --- - | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | - | --- | --- | --- | --- | --- | --- |--- | - | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| - - --- - -## System apps - -System apps are used by the operating system. To get a list of all the system apps, run the following Windows PowerShell command: - -```Powershell -Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation -``` - -The following information lists the system apps on some Windows 10 OS versions: - -- File Picker | Package name: 1527c705-839a-4832-9118-54d4Bd6a0c89 - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- File Explorer | Package name: c5e2524a-ea46-4f67-841f-6a9465d9d515 - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- App Resolver UX | Package name: E2A4F912-2574-4A75-9BB0-0D023378592B - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Add Suggested Folders To Library | Package name: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- InputApp - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | | | ✔️ | - - --- - -- Microsoft.AAD.Broker.Plugin | Package name: Microsoft.AAD.Broker.Plugin - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.AccountsControl | Package name: Microsoft.AccountsControl - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.AsyncTextService | Package name: Microsoft.AsyncTextService - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Hello setup UI | Package name: Microsoft.BioEnrollment - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.CredDialogHost - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.ECApp - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.LockApp - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft Edge | Package name: Microsoft.MicrosoftEdge - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.MicrosoftEdgeDevToolsClient - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.PPIProjection - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | | | ✔️ | - - --- - -- Microsoft.Win32WebViewHost - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.Apprep.ChxApp - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.AssignedAccessLockApp - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.CapturePicker - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.CloudExperienceHost - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.ContentDeliveryManager - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Cortana | Package name: Microsoft.Windows.Cortana - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | | | ✔️ | - - --- - -- Microsoft.Windows.OOBENetworkCaptivePort - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.OOBENetworkConnectionFlow - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.ParentalControls - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- People Hub | Package name: Microsoft.Windows.PeopleExperienceHost - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.PinningConfirmationDialog - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.SecHealthUI - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.Windows.SecureAssessmentBrowser - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Start | Package name: Microsoft.Windows.ShellExperienceHost - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Microsoft.XboxGameCallableUI - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Windows.CBSPreview - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Settings | Package name: Windows.immersivecontrolpanel - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- - -- Print 3D | Package name: Windows.Print3D - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ✔️ | | | ✔️ | - - --- - -- Print UI | Package name: Windows.PrintDialog - - --- - | Uninstall through UI? | 21H1 | 20H2 | 1809 | - | --- | --- | --- | --- | - | ❌ | ✔️ | ✔️| ✔️ | - - --- +## Remove apps diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md index 96e4e52e60..97a832c6e9 100644 --- a/windows/application-management/msix-app-packaging-tool.md +++ b/windows/application-management/msix-app-packaging-tool.md @@ -12,6 +12,8 @@ ms.date: 12/03/2018 ms.reviewer: manager: dansimp author: greg-lindsay + +ROBOTS: NOINDEX --- # Repackage existing win32 applications to the MSIX format diff --git a/windows/application-management/provisioned-apps-windows-client-os.md b/windows/application-management/provisioned-apps-windows-client-os.md new file mode 100644 index 0000000000..c426de223d --- /dev/null +++ b/windows/application-management/provisioned-apps-windows-client-os.md @@ -0,0 +1,475 @@ +--- +title: Get the provisioned apps on Windows client operating system | Microsoft Docs +ms.reviewer: +manager: dougeby +description: Use the Windows PowerShell Get-AppxProvisionedPackage command to get a list off the provisioned apps installed in Windows OS. See a list of some common provisioned apps installed a Windows Enterprise client computer or device, including Windows 10. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: mobile +ms.author: mandia +author: MandiOhlinger +ms.localizationpriority: medium +ms.topic: article +--- + +# Provisioned apps installed with the Windows client OS + +> Applies to: +> +> - Windows 10 + +Provisioned apps are included with the OS, and automatically installed when a user signs into a Windows device the first time. They are per-user apps, and typically installed in the `C:\Program Files\WindowsApps` folder. On your Windows devices, you can use Windows PowerShell to see the provisioned apps automatically installed. + +This article lists some of the built-in provisioned apps on the different Windows client OS versions, and lists the Windows Powershell command to get a list. + +## Use Windows Powershell + +To get a list of all the provisioned apps, use Windows PowerShell: + +1. Open the Windows PowerShell app as administrator. +2. Run the following script: + + ```Powershell + Get-AppxProvisionedPackage -Online | Format-Table DisplayName, PackageName + ``` + +The output lists all the provisioned apps, and their package names. For more information on this command, see [Get-AppxProvisionedPackage](/powershell/module/dism/get-appxprovisionedpackage) (opens another Microsoft website). + +## Built-in provisioned apps list + +The following information lists some of the provisioned apps on the different Windows Enterprise client OS versions. Your specific OS version and image may have different apps. To confirm your app list, run the [PowerShell Get-AppxProvisionedPackage command](#use-windows-powershell) (in this article). + +Provisioned apps are also listed in **Settings** > **Apps and Features**. + +- [3D Builder](ms-windows-store://pdp/?PFN=Microsoft.3DBuilder_8wekyb3d8bbwe) | Package name: Microsoft.3DBuilder + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ✔️ | ✔️ | | | | | | + + --- + +- [Bing Weather](ms-windows-store://pdp/?PFN=Microsoft.BingWeather_8wekyb3d8bbwe) | Package name: Microsoft.BingWeather + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ✔️ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| + + --- + +- [Desktop App Installer](ms-windows-store://pdp/?PFN=Microsoft.DesktopAppInstaller_8wekyb3d8bbwe) | Package name: Microsoft.DesktopAppInstaller + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | Use Settings App | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| + + --- + +- [Get Help](ms-windows-store://pdp/?PFN=Microsoft.Gethelp_8wekyb3d8bbwe) | Package name: Microsoft.GetHelp + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Tips](ms-windows-store://pdp/?PFN=Microsoft.Getstarted_8wekyb3d8bbwe) | Package name: Microsoft.Getstarted + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| + + --- + +- [HEIF Image Extensions](ms-windows-store://pdp/?PFN=Microsoft.HEIFImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.HEIFImageExtension + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️|✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Messaging](ms-windows-store://pdp/?PFN=Microsoft.Messaging_8wekyb3d8bbwe) | Package name:Microsoft.Messaging + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️| + + --- + +- [Microsoft 3D Viewer](ms-windows-store://pdp/?PFN=Microsoft.Microsoft3DViewer_8wekyb3d8bbwe) | Package name: Microsoft.Microsoft3DViewer + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Office](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftOfficeHub + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Solitaire Collection](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftSolitaireCollection_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftSolitaireCollection + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Sticky Notes](ms-windows-store://pdp/?PFN=Microsoft.MicrosoftStickyNotes_8wekyb3d8bbwe) | Package name: Microsoft.MicrosoftStickyNotes + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Mixed Reality Portal](ms-windows-store://pdp/?PFN=Microsoft.MixedReality.Portal_8wekyb3d8bbwe) | Package name: Microsoft.MixedReality.Portal + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Paint 3D](ms-windows-store://pdp/?PFN=Microsoft.MSPaint_8wekyb3d8bbwe) | Package name: Microsoft.MSPaint + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [OneNote for Windows 10](ms-windows-store://pdp/?PFN=Microsoft.Office.OneNote_8wekyb3d8bbwe) | Package name: Microsoft.Office.OneNote + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ✔️ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Mobile Plans](ms-windows-store://pdp/?PFN=Microsoft.OneConnect_8wekyb3d8bbwe) | Package name: Microsoft.OneConnect + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️| + + --- + +- Microsoft.Outlook.DesktopIntegrationServices + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | | ✔️ | ✔️| | ✔️| | | + + --- + +- [Microsoft People](ms-windows-store://pdp/?PFN=Microsoft.People_8wekyb3d8bbwe) | Package name: Microsoft.People + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Print 3D](ms-windows-store://pdp/?PFN=Microsoft.Print3D_8wekyb3d8bbwe) | Package name: Microsoft.Print3D + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| | ✔️| ✔️| ✔️| + + --- + +- [Snip & Sketch](ms-windows-store://pdp/?PFN=Microsoft.ScreenSketch_8wekyb3d8bbwe) | Package name: Microsoft.ScreenSketch + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Skype](ms-windows-store://pdp/?PFN=Microsoft.SkypeApp_kzf8qxf38zg5c) | Package name: Microsoft.SkypeApp + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Store Purchase App](ms-windows-store://pdp/?PFN=Microsoft.StorePurchaseApp_8wekyb3d8bbwe) | Package name: Microsoft.StorePurchaseApp + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- Microsoft.VP9VideoExtensions + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Pay](ms-windows-store://pdp/?PFN=Microsoft.Wallet_8wekyb3d8bbwe) | Package name: Microsoft.Wallet + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Web Media Extensions](ms-windows-store://pdp/?PFN=Microsoft.WebMediaExtensions_8wekyb3d8bbwe) | Package name: Microsoft.WebMediaExtensions + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Webp Image Extension](ms-windows-store://pdp/?PFN=Microsoft.WebpImageExtension_8wekyb3d8bbwe) | Package name: Microsoft.WebpImageExtension + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Photos](ms-windows-store://pdp/?PFN=Microsoft.Windows.Photos_8wekyb3d8bbwe) | Package name: Microsoft.Windows.Photos + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Windows Alarms & Clock](ms-windows-store://pdp/?PFN=Microsoft.WindowsAlarms_8wekyb3d8bbwe) | Package name: Microsoft.WindowsAlarms + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Windows Calculator](ms-windows-store://pdp/?PFN=Microsoft.WindowsCalculator_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCalculator + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Windows Camera](ms-windows-store://pdp/?PFN=Microsoft.WindowsCamera_8wekyb3d8bbwe) | Package name: Microsoft.WindowsCamera + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Mail and Calendar](ms-windows-store://pdp/?PFN=microsoft.windowscommunicationsapps_8wekyb3d8bbwe) | Package name: microsoft.windowscommunicationsapps + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Feedback Hub](ms-windows-store://pdp/?PFN=Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe) | Package name: Microsoft.WindowsFeedbackHub + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Windows Maps](ms-windows-store://pdp/?PFN=Microsoft.WindowsMaps_8wekyb3d8bbwe) | Package name: Microsoft.WindowsMaps + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Windows Voice Recorder](ms-windows-store://pdp/?PFN=Microsoft.WindowsSoundRecorder_8wekyb3d8bbwe) | Package name: Microsoft.WindowsSoundRecorder + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Microsoft Store](ms-windows-store://pdp/?PFN=Microsoft.WindowsStore_8wekyb3d8bbwe) | Package name: Microsoft.WindowsStore + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + + - The Store app shouldn't be removed. If you remove the Store app, and want to reinstall it, you can restore your system from a backup, or reset your system. Instead of removing the Store app, use group policies to hide or disable it. + +- [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | Package name: Microsoft.Xbox.TCUI + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Xbox Console Companion](ms-windows-store://pdp/?PFN=Microsoft.XboxApp_8wekyb3d8bbwe) | Package name: Microsoft.XboxApp + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Xbox Game Bar Plugin](ms-windows-store://pdp/?PFN=Microsoft.XboxGameOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGameOverlay + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Xbox Game Bar](ms-windows-store://pdp/?PFN=Microsoft.XboxGamingOverlay_8wekyb3d8bbwe) | Package name: Microsoft.XboxGamingOverlay + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Xbox Identity Provider](ms-windows-store://pdp/?PFN=Microsoft.XboxIdentityProvider_8wekyb3d8bbwe) | Package name: Microsoft.XboxIdentityProvider + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- Microsoft.XboxSpeechToTextOverlay + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Your Phone](ms-windows-store://pdp/?PFN=Microsoft.YourPhone_8wekyb3d8bbwe) | Package name: Microsoft.YourPhone + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Groove Music](ms-windows-store://pdp/?PFN=Microsoft.ZuneMusic_8wekyb3d8bbwe) | Package name: Microsoft.ZuneMusic + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- + +- [Movies & TV](ms-windows-store://pdp/?PFN=Microsoft.ZuneVideo_8wekyb3d8bbwe) | Package name: Microsoft.ZuneVideo + - Supported versions: + + --- + | Uninstall through UI? | 21H1 | 20H2 | 2004 | 1909| 1903| 1809 | + | --- | --- | --- | --- | --- | --- |--- | + | ❌ | ✔️ | ✔️| ✔️ | ✔️| ✔️| ✔️| + + --- diff --git a/windows/application-management/system-apps-windows-client-os.md b/windows/application-management/system-apps-windows-client-os.md new file mode 100644 index 0000000000..0ac52b682f --- /dev/null +++ b/windows/application-management/system-apps-windows-client-os.md @@ -0,0 +1,356 @@ +--- +title: Get the system apps on Windows client operating system | Microsoft Docs +ms.reviewer: +manager: dougeby +description: Use the Windows PowerShell Get-AppxPackage command to get a list off the system apps installed in Windows OS. See a list of some common system apps installed a Windows Enterprise client computer or device, including Windows 10. +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: mobile +ms.author: mandia +author: MandiOhlinger +ms.localizationpriority: medium +ms.topic: article +--- + +# System apps installed with the Windows client OS + +> Applies to: +> +> - Windows 10 + +On all Windows devices, the OS automatically installs some apps. These apps are called system apps, and are typically installed in the `C:\Windows\` folder. On your Windows devices, you can use Windows PowerShell to see the system apps automatically installed. + +This article lists the built-in system apps on some Windows OS versions, and lists the Windows Powershell command to get a list. + +## Use Windows Powershell + +To get a list of all the system apps, use Windows PowerShell: + +1. Open the Windows PowerShell app as administrator. +2. Run the following script: + + ```Powershell + Get-AppxPackage -PackageTypeFilter Main | ? { $_.SignatureKind -eq "System" } | Sort Name | Format-Table Name, InstallLocation + ``` + +The output lists all the system apps, and their installation location. For more information on this command, see [Get-AppxPackage](/powershell/module/appx/get-appxpackage) (opens another Microsoft website). + +## Built-in system apps list + +The following information lists the system apps on some Windows Enterprise OS versions. Your specific OS version and image may have different apps. To confirm your app list, run the [PowerShell Get-AppxPackage command](#use-windows-powershell) (in this article). + +- File Picker | Package name: 1527c705-839a-4832-9118-54d4Bd6a0c89 + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- File Explorer | Package name: c5e2524a-ea46-4f67-841f-6a9465d9d515 + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- App Resolver UX | Package name: E2A4F912-2574-4A75-9BB0-0D023378592B + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Add Suggested Folders To Library | Package name: F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- InputApp + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | | | ✔️ | + + --- + +- Microsoft.AAD.Broker.Plugin | Package name: Microsoft.AAD.Broker.Plugin + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.AccountsControl | Package name: Microsoft.AccountsControl + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.AsyncTextService | Package name: Microsoft.AsyncTextService + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Hello setup UI | Package name: Microsoft.BioEnrollment + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.CredDialogHost + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.ECApp + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.LockApp + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft Edge | Package name: Microsoft.MicrosoftEdge + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.MicrosoftEdgeDevToolsClient + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.PPIProjection + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | | | ✔️ | + + --- + +- Microsoft.Win32WebViewHost + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.Apprep.ChxApp + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.AssignedAccessLockApp + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.CapturePicker + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.CloudExperienceHost + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.ContentDeliveryManager + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Cortana | Package name: Microsoft.Windows.Cortana + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | | | ✔️ | + + --- + +- Microsoft.Windows.OOBENetworkCaptivePort + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.OOBENetworkConnectionFlow + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.ParentalControls + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- People Hub | Package name: Microsoft.Windows.PeopleExperienceHost + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.PinningConfirmationDialog + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.SecHealthUI + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.Windows.SecureAssessmentBrowser + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Start | Package name: Microsoft.Windows.ShellExperienceHost + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Microsoft.XboxGameCallableUI + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Windows.CBSPreview + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Settings | Package name: Windows.immersivecontrolpanel + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- + +- Print 3D | Package name: Windows.Print3D + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ✔️ | | | ✔️ | + + --- + +- Print UI | Package name: Windows.PrintDialog + + --- + | Uninstall through UI? | 21H1 | 20H2 | 1809 | + | --- | --- | --- | --- | + | ❌ | ✔️ | ✔️| ✔️ | + + --- diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index 5b921380b9..8e5fd3acd8 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -3,8 +3,13 @@ items: href: index.yml - name: Application management items: - - name: Apps in Windows 10 + - name: Apps in Windows client OS href: apps-in-windows-10.md + items: + - name: Provisioned apps in Windows client OS + href: provisioned-apps-windows-client-os.md + - name: System apps in Windows client OS + href: system-apps-windows-client-os.md - name: Add apps and features in Windows 10 href: add-apps-and-features.md - name: Sideload apps @@ -13,7 +18,7 @@ items: href: enterprise-background-activity-controls.md - name: Enable or block Windows Mixed Reality apps in the enterprise href: manage-windows-mixed-reality.md - - name: Repackage win32 apps in the MSIX format + - name: Repackage win32 apps in the MSIX format - DELETE href: msix-app-packaging-tool.md - name: Application Virtualization (App-V) items: From 7055f7757e9fc125bd207f9a74469e113c331f32 Mon Sep 17 00:00:00 2001 From: ItIsJustMee <89180284+ItIsJustMee@users.noreply.github.com> Date: Thu, 19 Aug 2021 15:36:33 +1000 Subject: [PATCH 0039/1214] Making a change to Cryptomining policy Would not like to make changes until the 30th of August. Can you hold off until then please, or should I resubmit then? --- windows/security/threat-protection/intelligence/criteria.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/intelligence/criteria.md b/windows/security/threat-protection/intelligence/criteria.md index 381dc66ce4..a9ef83b56c 100644 --- a/windows/security/threat-protection/intelligence/criteria.md +++ b/windows/security/threat-protection/intelligence/criteria.md @@ -174,7 +174,7 @@ Microsoft uses specific categories and the category definitions to classify soft * **Torrent software (Enterprise only):** Software that is used to create or download torrents or other files specifically used with peer-to-peer file-sharing technologies. -* **Cryptomining software:** Software that uses your device resources to mine cryptocurrencies. +* **Cryptomining software (Enterprise only):** Software that uses your device resources to mine cryptocurrencies. * **Bundling software:** Software that offers to install other software that is not developed by the same entity or not required for the software to run. Also, software that offers to install other software that qualifies as PUA based on the criteria outlined in this document. From e24d17efea14caa4e59f0ece8ec36fa0b1614f65 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Thu, 19 Aug 2021 09:55:15 -0600 Subject: [PATCH 0040/1214] dh-editpass-demonstrate-deployment-on-vm --- .../demonstrate-deployment-on-vm.md | 144 +++++++++--------- 1 file changed, 75 insertions(+), 69 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index d132aa99a6..effa84ef83 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -32,7 +32,7 @@ In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM > [!NOTE] > Although there are [multiple platforms](/mem/autopilot/add-devices#registering-devices) available to enable Autopilot, this lab primarily uses Intune. > -> Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you are using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. +> Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you're using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. The following video provides an overview of the process: @@ -45,13 +45,13 @@ The following video provides an overview of the process: These are the things you'll need to complete this lab: - +
Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
Internet accessIf you are behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
Internet accessIf you're behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
An account with Azure AD Premium licenseThis guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.
## Procedures -A summary of the sections and procedures in the lab is provided below. Follow each section in the order it is presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. +A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version. @@ -91,11 +91,9 @@ If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [C ## Verify support for Hyper-V -If you don't already have Hyper-V, we must first enable this on a computer running Windows 10 or Windows Server (2012 R2 or later). - -> If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you are using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). - -If you are not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) below for details on verifying that Hyper-V can be successfully installed. +- If you don't already have Hyper-V enabled, enable it on a computer running Windows 10 or Windows Server (2012 R2 or later). +- If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you're using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). +- If you're not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) in this article for details on verifying that Hyper-V can be successfully installed. ## Enable Hyper-V @@ -111,7 +109,7 @@ This command works on all operating systems that support Hyper-V, but on Windows Install-WindowsFeature -Name Hyper-V -IncludeManagementTools ``` -When you are prompted to restart the computer, choose **Yes**. The computer might restart more than once. +When you're prompted to restart the computer, choose **Yes**. The computer might restart more than once. Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: @@ -119,7 +117,7 @@ Alternatively, you can install Hyper-V using the Control Panel in Windows under ![Hyper-V](images/svr_mgr2.png) -

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. +If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under **Role Administration Tools\Hyper-V Management Tools**. After installation is complete, open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt, or by typing **Hyper-V** in the Start menu search box. @@ -127,15 +125,15 @@ To read more about Hyper-V, see [Introduction to Hyper-V on Windows 10](/virtual ## Create a demo VM -Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it is simpler to use Windows PowerShell. +Now that Hyper-V is enabled, we need to create a VM running Windows 10. We can [create a VM](/virtualization/hyper-v-on-windows/quick-start/create-virtual-machine) and [virtual network](/virtualization/hyper-v-on-windows/quick-start/connect-to-network) using Hyper-V Manager, but it's simpler to use Windows PowerShell. -To use Windows PowerShell, we just need to know two things: +To use Windows PowerShell, you need to know two things: 1. The location of the Windows 10 ISO file. In the example, we assume the location is **c:\iso\win10-eval.iso**. -2. The name of the network interface that connects to the Internet. +2. The name of the network interface that connects to the internet. In the example, we use a Windows PowerShell command to determine this automatically. @@ -149,7 +147,7 @@ When asked to select a platform, choose **64 bit**. After you download this file, the name will be extremely long (ex: 19042.508.200927-1902.20h2_release_svc_refresh_CLIENTENTERPRISEEVAL_OEMRET_x64FRE_en-us.iso). -1. So that it is easier to type and remember, rename the file to **win10-eval.iso**. +1. So that it's easier to type and remember, rename the file to **win10-eval.iso**. 2. Create a directory on your computer named **c:\iso** and move the **win10-eval.iso** file there, so the path to the file is **c:\iso\win10-eval.iso**. @@ -157,13 +155,13 @@ After you download this file, the name will be extremely long (ex: 19042.508.200 ### Determine network adapter name -The Get-NetAdaper cmdlet is used below to automatically find the network adapter that is most likely to be the one you use to connect to the Internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: +The Get-NetAdaper cmdlet is used to automatically find the network adapter that's most likely to be the one you use to connect to the internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: ```powershell (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name ``` -The output of this command should be the name of the network interface you use to connect to the Internet. Verify that this is the correct interface name. If it is not the correct interface name, you'll need to edit the first command below to use your network interface name. +The output of this command should be the name of the network interface you use to connect to the internet. Verify that this is the correct interface name. If it isn't the correct interface name, you'll need to edit the first command below to use your network interface name. For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. @@ -172,7 +170,10 @@ For example, if the command above displays Ethernet but you wish to use Ethernet All VM data will be created under the current path in your PowerShell prompt. Consider navigating into a new folder before running the following commands. > [!IMPORTANT] -> **VM switch**: a VM switch is how Hyper-V connects VMs to a network.

If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal."

If you have never created an external VM switch before, then just run the commands below.

If you are not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). +> **VM switch**: a VM switch is how Hyper-V connects VMs to a network. +>- If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal." +>- If you have never created an external VM switch before, then just run the commands below. +>- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). ```powershell New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name @@ -228,22 +229,27 @@ PS C:\autopilot> ### Install Windows 10 > [!NOTE] -> The VM will be booted to gather a hardware ID, then it will be reset. The goal in the next few steps is to get to the desktop quickly so don't worry about how it is configured at this stage. The VM only needs to be connected to the Internet. +> The VM will be booted to gather a hardware ID, then it will be reset. The goal in the next few steps is to get to the desktop quickly so don't worry about how it's configured at this stage. The VM only needs to be connected to the Internet. -Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: +Ensure the VM booted from the installation ISO, select **Next** then select **Install now** and complete the Windows installation process. See the following examples: ![Windows setup example 1](images/winsetup1.png) + ![Windows setup example 2](images/winsetup2.png) + ![Windows setup example 3](images/winsetup3.png) + ![Windows setup example 4](images/winsetup4.png) + ![Windows setup example 5](images/winsetup5.png) + ![Windows setup example 6](images/winsetup6.png) After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: ![Windows setup example 7](images/winsetup7.png) -Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. +Once the installation is complete, sign in and verify that you're at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. > [!div class="mx-imgBorder"] > ![Windows setup example 8](images/winsetup8.png) @@ -254,16 +260,16 @@ To create a checkpoint, open an elevated Windows PowerShell prompt on the comput Checkpoint-VM -Name WindowsAutopilot -SnapshotName "Finished Windows install" ``` -Click on the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see **Finished Windows Install** listed in the Checkpoints pane. +Select the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see **Finished Windows Install** listed in the Checkpoints pane. ## Capture the hardware ID > [!NOTE] -> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you are acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PowerShell script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. +> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you're acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PowerShell script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. Follow these steps to run the PowerShell script: -1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you are using a VM or a physical device: +1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you're using a VM or a physical device: ```powershell md c:\HWID @@ -274,7 +280,7 @@ Follow these steps to run the PowerShell script: Get-WindowsAutopilotInfo.ps1 -OutputFile AutopilotHWID.csv ``` -1. When you are prompted to install the NuGet package, choose **Yes**. +1. When you're prompted to install the NuGet package, choose **Yes**. See the sample output below. A **dir** command is issued at the end to show the file that was created. @@ -320,11 +326,11 @@ Follow these steps to run the PowerShell script: 1. Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. > [!NOTE] - > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. + > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you're curious. The file format will be validated when it's imported into Autopilot. An example of the data in this file is shown below. ![Serial number and hardware hash](images/hwid.png) - You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). + You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you're using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. @@ -335,8 +341,8 @@ Follow these steps to run the PowerShell script: With the hardware ID captured in a file, prepare your Virtual Machine for Windows Autopilot deployment by resetting it back to OOBE. -On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. -Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**. +On the Virtual Machine, go to **Settings > Update & Security > Recovery** and select **Get started** under **Reset this PC**. +Select **Remove everything** and **Just remove my files**. If you're asked **How would you like to reinstall Windows**, select Local reinstall. Finally, select **Reset**. ![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) @@ -365,11 +371,11 @@ If you already have company branding configured in Azure Active Directory, you c > [!IMPORTANT] > Make sure to sign-in with a Global Administrator account. -Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. +Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), select **Configure** and configure any type of company branding you'd like to see during the OOBE. ![Configure company branding](images/branding.png) -When you are finished, click **Save**. +When you're finished, select **Save**. > [!NOTE] > Changes to company branding can take up to 30 minutes to apply. @@ -378,9 +384,9 @@ When you are finished, click **Save**. If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step. -Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, click **Add application** and choose **Intune**. +Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, select **Add application** and choose **Intune**. -For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. +For the purposes of this demo, select **All** under the **MDM user scope** and select **Save**. ![MDM user scope in the Mobility blade](images/ap-aad-mdm.png) @@ -403,9 +409,9 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B You should receive confirmation that the file is formatted correctly before uploading it, as shown above. -3. Click **Import** and wait until the import process completes. This can take up to 15 minutes. +3. Select **Import** and wait until the import process completes. This can take up to 15 minutes. -4. Click **Refresh** to verify your VM or device has been added. See the following example. +4. Select **Refresh** to verify your VM or device has been added. See the following example. ![Import HWID](images/enroll3.png) @@ -428,7 +434,7 @@ Select **Manage** from the top menu, then click the **Windows Autopilot Deployme ![Microsoft Store for Business](images/msfb.png) -Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. +Select the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. ![Microsoft Store for Business Devices](images/msfb-device.png) @@ -460,21 +466,21 @@ The Autopilot deployment profile wizard will ask for a device group, so we must 3. Azure AD roles can be assigned to the group: **No** 4. For **Membership type**, choose **Assigned**. -3. Click **Members** and add the Autopilot VM to the group. See the following example: +3. Select **Members** and add the Autopilot VM to the group. See the following example: > [!div class="mx-imgBorder"] > ![add members](images/group1.png) -4. Click **Create**. +4. Select **Create**. #### Create the deployment profile -To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. +To create a Windows Autopilot profile, scroll back to the left hand pane and select **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. > [!div class="mx-imgBorder"] > ![Deployment profiles](images/dp.png) -Click on **Create profile** and then select **Windows PC**. +Select **Create profile** and then select **Windows PC**. > [!div class="mx-imgBorder"] > ![Create deployment profile](images/create-profile.png) @@ -487,7 +493,7 @@ On the **Create profile** blade, use the following values: | Description | Lab | | Convert all targeted devices to Autopilot | No | -Click **Next** to continue with the **Out-of-box experience (OOBE)** settings: +Select **Next** to continue with the **Out-of-box experience (OOBE)** settings: | Setting | Value | |---|---| @@ -502,19 +508,19 @@ Click **Next** to continue with the **Out-of-box experience (OOBE)** settings: | Automatically configure keyboard | Yes | | Apply device name template | No | -Click **Next** to continue with the **Assignments** settings: +Select **Next** to continue with the **Assignments** settings: | Setting | Value | |---|---| | Assign to | Selected groups | -1. Click **Select groups to include**. -2. Click the **Autopilot Lab** group, and then click **Select**. -3. Click **Next** to continue and then click **Create**. See the following example: +1. Select **Select groups to include**. +2. Select the **Autopilot Lab** group, and then choose **Select**. +3. Select **Next** to continue, and then select **Create**. See the following example: ![Deployment profile](images/profile.png) -Click on **OK** and then click on **Create**. +Select **OK**, and then select **Create**. > [!NOTE] > If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile). @@ -527,11 +533,11 @@ A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers First, sign in to the [Microsoft Store for Business](https://businessstore.microsoft.com/manage/dashboard) using the Intune account you initially created for this lab. -Click **Manage** from the top menu, then click **Devices** from the left navigation tree. +Select **Manage** from the top menu, then select **Devices** from the left navigation tree. ![MSfB manage](images/msfb-manage.png) -Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. +Select the **Windows Autopilot Deployment Program** link in the **Devices** tile. To CREATE the profile: @@ -545,7 +551,7 @@ On the Autopilot deployment dropdown menu, select **Create new profile**: > [!div class="mx-imgBorder"] > ![MSfB create step 2](images/msfb-create2.png) -Name the profile, choose your desired settings, and then click **Create**: +Name the profile, choose your desired settings, and then select **Create**: > [!div class="mx-imgBorder"] > ![MSfB create step 3](images/msfb-create3.png) @@ -577,7 +583,7 @@ If you shut down your VM after the last reset, it's time to start it back up aga Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. > [!TIP] -> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you do not see the Autopilot OOBE experience, then reset the device again (Settings > Update & Security > Recovery and click on Get started. Under Reset this PC, select Remove everything and Just remove my files. Click on Reset). +> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you do not see the Autopilot OOBE experience, then reset the device again (**Settings** > **Update & Security** > **Recovery** and select **Get started**. Under **Reset this PC**, select **Remove everything and Just remove my files**. Select **Reset**). - Ensure your device has an internet connection. - Turn on the device @@ -603,7 +609,7 @@ To use the device (or VM) for other purposes after completion of this lab, you w ### Delete (deregister) Autopilot device -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu. +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu. > [!div class="mx-imgBorder"] > ![Delete device step 1](images/delete-device1.png) @@ -615,16 +621,16 @@ The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > [!NOTE] > A device will only appear in the All devices list once it has booted. The latter (**Windows Autopilot Deployment Program** > **Devices**) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. -To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion. +To remove the device from the Autopilot program, select the device, and then select **Delete**. You will get a popup dialog box to confirm deletion. > [!div class="mx-imgBorder"] > ![Delete device](images/delete-device2.png) -At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: +At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, select the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: -Once the device no longer appears, you are free to reuse it for other purposes. +Once the device no longer appears, you're free to reuse it for other purposes. -If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and click the delete button: +If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and then select the **Delete** button: ## Appendix A: Verify support for Hyper-V @@ -702,7 +708,7 @@ Under **App Type**, select **Windows app (Win32)**: ![Add app step 2](images/app03.png) -On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: +On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then select **OK**: > [!div class="mx-imgBorder"] > ![Add app step 3](images/app04.png) @@ -725,7 +731,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). -Click **OK** to save your input and activate the **Requirements** blade. +Select **OK** to save your input and activate the **Requirements** blade. On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: @@ -737,22 +743,22 @@ Next, configure the **Detection rules**. For our purposes, we will select manua > [!div class="mx-imgBorder"] > ![Add app step 7](images/app08.png) -Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: +Select **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: ![Add app step 8](images/app09.png) -Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. +Select **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. **Return codes**: For our purposes, leave the return codes at their default values: > [!div class="mx-imgBorder"] > ![Add app step 9](images/app10.png) -Click **OK** to exit. +Select **OK** to exit. You may skip configuring the final **Scope (Tags)** blade. -Click the **Add** button to finalize and save your app package. +Select the **Add** button to finalize and save your app package. Once the indicator message says the addition has completed. @@ -769,7 +775,7 @@ You will be able to find your app in your app list: > [!NOTE] > The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. -In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: +In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then select **Assignments** from the menu: > [!div class="mx-imgBorder"] > ![Assign app step 1](images/app13.png) @@ -788,7 +794,7 @@ Select **Included Groups** and assign the groups you previously created that wil > [!div class="mx-imgBorder"] > ![Assign app step 3](images/app15.png) -In the **Select groups** pane, click the **Select** button. +In the **Select groups** pane, choose the **Select** button. In the **Assign group** pane, select **OK**. @@ -809,7 +815,7 @@ For more information on adding apps to Intune, see [Intune Standalone - Win32 ap Log into the Azure portal and select **Intune**. -Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. +Navigate to **Intune > Clients apps > Apps**, and then select the **Add** button to create a new app package. ![Create app step 1](images/app17.png) @@ -822,29 +828,29 @@ Under the **Configure App Suite** pane, select the Office apps you want to insta > [!div class="mx-imgBorder"] > ![Create app step 3](images/app19.png) -Click **OK**. +Select **OK**. In the **App Suite Information** pane, enter a unique suite name, and a suitable description. -Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. +Enter the name of the app suite as it's displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. > [!div class="mx-imgBorder"] > ![Create app step 4](images/app20.png) -Click **OK**. +Select **OK**. In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: ![Create app step 5](images/app21.png) -Click **OK** and then click **Add**. +Select **OK** and, then select **Add**. #### Assign the app to your Intune profile > [!NOTE] > The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. -In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: +In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then select **Assignments** from the menu: > [!div class="mx-imgBorder"] > ![Create app step 6](images/app22.png) @@ -862,7 +868,7 @@ Select **Included Groups** and assign the groups you previously created that wil > [!div class="mx-imgBorder"] > ![Create app step 8](images/app24.png) -In the **Select groups** pane, click the **Select** button. +In the **Select groups** pane, choose the **Select** button. In the **Assign group** pane, select **OK**. From 5f0645961045c10b9ae45522e566a6e33d73f0f6 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 10:03:12 -0700 Subject: [PATCH 0041/1214] new landing --- windows/security/index.yml | 46 +++++++++++++++++++++++++++++--------- 1 file changed, 36 insertions(+), 10 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 83e7dcbb53..29ac6d128a 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -1,38 +1,64 @@ ### YamlMime:Hub title: Windows 10 Enterprise Security # < 60 chars -summary: Secure corporate data and manage risk. # < 160 chars +summary: Security from chip to cloud. # < 160 chars # brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin brand: windows metadata: title: Windows 10 Enterprise Security # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about enterprise-grade security features for Windows 10. # Required; article description that is displayed in search results. < 160 chars. + description: Learn about enterprise-grade security features in Windows 10 and Windows 11. # Required; article description that is displayed in search results. < 160 chars. services: windows ms.product: windows ms.topic: hub-page # Required ms.collection: M365-security-compliance # Optional; Remove if no collection is used. author: dansimp #Required; your GitHub user alias, with correct capitalization. ms.author: dansimp #Required; microsoft alias of author; optional team alias. - ms.date: 01/08/2018 #Required; mm/dd/yyyy format. + ms.date: 09/30/2021 #Required; mm/dd/yyyy format. ms.localizationpriority: high # productDirectory section (optional) productDirectory: items: # Card - - title: Identity and access management + - title: Security foundation + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: Security assurances and certifications + url: ./information-protection/index.md + + # Card + - title: Hardware security # imageSrc should be square in ratio with no whitespace imageSrc: https://docs.microsoft.com/media/common/i_identity-protection.svg - summary: Deploy secure enterprise-grade authentication and access control to protect accounts and data + summary: Hardware root of trust and silicon-assisted security url: ./identity-protection/index.md # Card - - title: Threat protection + - title: Operating system protection imageSrc: https://docs.microsoft.com/media/common/i_threat-protection.svg - summary: Stop cyberthreats and quickly identify and respond to breaches + summary: Windows security enhancements url: ./threat-protection/index.md # Card - - title: Information protection + - title: Threat protection imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: Identify and secure critical data to prevent data loss - url: ./information-protection/index.md \ No newline at end of file + summary: Protection from external attacks and threats + url: ./information-protection/index.md + # Card + - title: Application protection + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: App protections + url: ./information-protection/index.md + # Card + - title: User protection + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: Protecting your users + url: ./information-protection/index.md + # Card + - title: Privacy controls + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: Manage your privacy settings + url: ./information-protection/index.md + # Card + - title: Cloud security + imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg + summary: Additional cloud-based security and management solutions + url: ./information-protection/index.md From b1532389bd99ca9ae3fae300988bd1903f452a65 Mon Sep 17 00:00:00 2001 From: Alma Jenks Date: Thu, 19 Aug 2021 10:34:13 -0700 Subject: [PATCH 0042/1214] Fixing ms.product to ms.prod --- windows/privacy/index.yml | 2 +- windows/security/index.yml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/privacy/index.yml b/windows/privacy/index.yml index ad4c6fefef..2fd2b1fc97 100644 --- a/windows/privacy/index.yml +++ b/windows/privacy/index.yml @@ -8,7 +8,7 @@ metadata: title: Windows Privacy description: Learn about how privacy is managed in Windows. services: windows - ms.product: windows + ms.prod: windows ms.topic: hub-page # Required ms.collection: M365-security-compliance author: dansimp diff --git a/windows/security/index.yml b/windows/security/index.yml index 83e7dcbb53..4a5558a16d 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -9,7 +9,7 @@ metadata: title: Windows 10 Enterprise Security # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn about enterprise-grade security features for Windows 10. # Required; article description that is displayed in search results. < 160 chars. services: windows - ms.product: windows + ms.prod: windows ms.topic: hub-page # Required ms.collection: M365-security-compliance # Optional; Remove if no collection is used. author: dansimp #Required; your GitHub user alias, with correct capitalization. From f5cebb67e82a1893f586feaabf0f02709fa48561 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 10:35:09 -0700 Subject: [PATCH 0043/1214] more --- windows/security/security-foundation/TOC.yml | 9 +++++ .../security/security-foundation/index.yml | 39 +++++++++++++++++++ 2 files changed, 48 insertions(+) create mode 100644 windows/security/security-foundation/TOC.yml create mode 100644 windows/security/security-foundation/index.yml diff --git a/windows/security/security-foundation/TOC.yml b/windows/security/security-foundation/TOC.yml new file mode 100644 index 0000000000..70e61e303f --- /dev/null +++ b/windows/security/security-foundation/TOC.yml @@ -0,0 +1,9 @@ +- name: Security + href: index.yml + items: + - name: Identity and access management + href: identity-protection/index.md + - name: Information protection + href: information-protection/index.md + - name: Threat protection + href: threat-protection/index.md diff --git a/windows/security/security-foundation/index.yml b/windows/security/security-foundation/index.yml new file mode 100644 index 0000000000..97eae49e18 --- /dev/null +++ b/windows/security/security-foundation/index.yml @@ -0,0 +1,39 @@ +### YamlMime:Landing + +title: Windows security foundation # < 60 chars +summary: Learn about Windows security foundations. # < 160 chars + +metadata: + title: Windows security foundation # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about Windows security foundation # Required; article description that is displayed in search results. < 160 chars. + ms.topic: landing-page # Required + ms.collection: m365-security-compliance + author: dansimp #Required; your GitHub user alias, with correct capitalization. + ms.author: dansimp #Required; microsoft alias of author; optional team alias. + ms.date: 09/30/2021 #Required; mm/dd/yyyy format. + localization_priority: Priority + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new + +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Security assurance + linkLists: + - linkListType: overview + links: + - text: Microsoft Security Development Lifecycle (SDL) + url: /previous-versions/windows/desktop/cc307891(v=msdn.10) + - text: Microsoft bounty program + url: https://www.microsoft.com/msrc/bounty + # Card + - title: Certifications + linkLists: + - linkListType: overview + links: + - text: Federal Information Processing Standard (FIPS) 140 Validation + url: /windows/security/threat-protection/fips-140-validation + - text: Common Criteria Certifications + url: /windows/security/threat-protection/windows-platform-common-criteria + \ No newline at end of file From 3ee4d7320172bb61dad3da1466c84c5ad5a9160d Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 10:45:48 -0700 Subject: [PATCH 0044/1214] new toc --- windows/security/security-foundation/TOC.yml | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/security/security-foundation/TOC.yml b/windows/security/security-foundation/TOC.yml index 70e61e303f..e52bc796f3 100644 --- a/windows/security/security-foundation/TOC.yml +++ b/windows/security/security-foundation/TOC.yml @@ -1,9 +1,8 @@ -- name: Security +- name: Security foundation href: index.yml items: - - name: Identity and access management - href: identity-protection/index.md - - name: Information protection - href: information-protection/index.md - - name: Threat protection - href: threat-protection/index.md + - name: FIPS 140-2 Validation + href: /windows/security/threat-protection/fips-140-validation.md + - name: Common Criteria Certifications + href: /windows/security/threat-protection/windows-platform-common-criteria.md + From f1b722ba9b54166beaa5cd0a173513db56a42e1b Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Thu, 19 Aug 2021 23:37:08 +0530 Subject: [PATCH 0045/1214] Update policy-csp-windowsconnectionmanager.md --- .../mdm/policy-csp-windowsconnectionmanager.md | 12 ++++++------ 1 file changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index 08a46d3820..9af69e0c2b 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -1,6 +1,6 @@ --- title: Policy CSP - WindowsConnectionManager -description: The Policy CSP - WindowsConnectionManager setting prevents computers from connecting to a domain based network and a non-domain based network simultaneously. +description: The Policy CSP - WindowsConnectionManager setting prevents computers from connecting to a domain-based network and a non-domain-based network simultaneously. ms.author: dansimp ms.topic: article ms.prod: w10 @@ -74,17 +74,17 @@ manager: dansimp -This policy setting prevents computers from connecting to both a domain based network and a non-domain based network at the same time. +This policy setting prevents computers from connecting to both a domain-based network and a non-domain-based network at the same time. If this policy setting is enabled, the computer responds to automatic and manual network connection attempts based on the following circumstances: Automatic connection attempts -- When the computer is already connected to a domain based network, all automatic connection attempts to non-domain networks are blocked. -- When the computer is already connected to a non-domain based network, automatic connection attempts to domain based networks are blocked. +- When the computer is already connected to a domain-based network, all automatic connection attempts to non-domain networks are blocked. +- When the computer is already connected to a non-domain-based network, automatic connection attempts to domain-based networks are blocked. Manual connection attempts -- When the computer is already connected to either a non-domain based network or a domain based network over media other than Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing network connection is disconnected and the manual connection is allowed. -- When the computer is already connected to either a non-domain based network or a domain based network over Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing Ethernet connection is maintained and the manual connection attempt is blocked. +- When the computer is already connected to either a non-domain-based network or a domain-based network over media other than Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing network connection is disconnected and the manual connection is allowed. +- When the computer is already connected to either a non-domain-based network or a domain-based network over Ethernet, and a user attempts to create a manual connection to an additional network in violation of this policy setting, the existing Ethernet connection is maintained and the manual connection attempt is blocked. If this policy setting is not configured or is disabled, computers are allowed to connect simultaneously to both domain and non-domain networks. From de0651579c191a6482de2d5ff59c35c9b7b8a6b2 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:13:41 -0700 Subject: [PATCH 0046/1214] one big TOC --- windows/security/TOC.yml | 22 ++++++--- windows/security/index.yml | 94 +++++++++++++++----------------------- 2 files changed, 52 insertions(+), 64 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 70e61e303f..818858dece 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -1,9 +1,17 @@ -- name: Security + +- name: Windows security foundation href: index.yml + expanded: true items: - - name: Identity and access management - href: identity-protection/index.md - - name: Information protection - href: information-protection/index.md - - name: Threat protection - href: threat-protection/index.md + - name: FIPS 140-2 Validation + href: /windows/security/threat-protection/fips-140-validation.md + - name: Common Criteria Certifications + href: /windows/security/threat-protection/windows-platform-common-criteria.md +- name: Windows hardware Security + items: + - name: Trusted Platform Module (TPM) overview + href: /windows/security/information-protection/tpm/trusted-platform-module-overview.md + - name: Protect derived domain credentials with Windows Defender Credential Guard + href: /windows/security/identity-protection/credential-guard/credential-guard.md + - name: Kernel DMA Protection + href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md \ No newline at end of file diff --git a/windows/security/index.yml b/windows/security/index.yml index 29ac6d128a..0e1f888e64 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -1,64 +1,44 @@ -### YamlMime:Hub +### YamlMime:Landing -title: Windows 10 Enterprise Security # < 60 chars -summary: Security from chip to cloud. # < 160 chars -# brand: aspnet | azure | dotnet | dynamics | m365 | ms-graph | office | power-bi | power-platform | sql | sql-server | vs | visual-studio | windows | xamarin -brand: windows +title: Windows security # < 60 chars +summary: Learn about Windows security from chip to cloud. # < 160 chars metadata: - title: Windows 10 Enterprise Security # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about enterprise-grade security features in Windows 10 and Windows 11. # Required; article description that is displayed in search results. < 160 chars. - services: windows - ms.product: windows - ms.topic: hub-page # Required - ms.collection: M365-security-compliance # Optional; Remove if no collection is used. + title: Windows security # Required; page title displayed in search results. Include the brand. < 60 chars. + description: Learn about Windows security # Required; article description that is displayed in search results. < 160 chars. + ms.topic: landing-page # Required + ms.collection: m365-security-compliance author: dansimp #Required; your GitHub user alias, with correct capitalization. ms.author: dansimp #Required; microsoft alias of author; optional team alias. ms.date: 09/30/2021 #Required; mm/dd/yyyy format. - ms.localizationpriority: high + localization_priority: Priority + +# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new -# productDirectory section (optional) -productDirectory: - items: - # Card - - title: Security foundation - imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: Security assurances and certifications - url: ./information-protection/index.md - - # Card - - title: Hardware security - # imageSrc should be square in ratio with no whitespace - imageSrc: https://docs.microsoft.com/media/common/i_identity-protection.svg - summary: Hardware root of trust and silicon-assisted security - url: ./identity-protection/index.md - # Card - - title: Operating system protection - imageSrc: https://docs.microsoft.com/media/common/i_threat-protection.svg - summary: Windows security enhancements - url: ./threat-protection/index.md - # Card - - title: Threat protection - imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: Protection from external attacks and threats - url: ./information-protection/index.md - # Card - - title: Application protection - imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: App protections - url: ./information-protection/index.md - # Card - - title: User protection - imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: Protecting your users - url: ./information-protection/index.md - # Card - - title: Privacy controls - imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: Manage your privacy settings - url: ./information-protection/index.md - # Card - - title: Cloud security - imageSrc: https://docs.microsoft.com/media/common/i_information-protection.svg - summary: Additional cloud-based security and management solutions - url: ./information-protection/index.md +landingContent: +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Security foundations + linkLists: + - linkListType: overview + links: + - text: Federal Information Processing Standard (FIPS) 140 Validation + url: /windows/security/threat-protection/fips-140-validation + - text: Common Criteria Certifications + url: /windows/security/threat-protection/windows-platform-common-criteria + - text: Microsoft Security Development Lifecycle (SDL) + url: /previous-versions/windows/desktop/cc307891(v=msdn.10) + - text: Microsoft bounty program + url: https://www.microsoft.com/msrc/bounty + # Card (optional) + - title: Hardware security + linkLists: + - linkListType: overview + links: + - name: Trusted Platform Module (TPM) overview + href: /windows/security/information-protection/tpm/trusted-platform-module-overview.md + - name: Protect derived domain credentials with Windows Defender Credential Guard + href: /windows/security/identity-protection/credential-guard/credential-guard.md + - name: Kernel DMA Protection + href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.m \ No newline at end of file From 49a29668dc3cda2dde74b920317854a71110a8e2 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:19:38 -0700 Subject: [PATCH 0047/1214] fixing build issues --- windows/security/index.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 0e1f888e64..aca0718a29 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -24,9 +24,9 @@ landingContent: - linkListType: overview links: - text: Federal Information Processing Standard (FIPS) 140 Validation - url: /windows/security/threat-protection/fips-140-validation + url: /windows/security/threat-protection/fips-140-validation.md - text: Common Criteria Certifications - url: /windows/security/threat-protection/windows-platform-common-criteria + url: /windows/security/threat-protection/windows-platform-common-criteria.md - text: Microsoft Security Development Lifecycle (SDL) url: /previous-versions/windows/desktop/cc307891(v=msdn.10) - text: Microsoft bounty program @@ -41,4 +41,4 @@ landingContent: - name: Protect derived domain credentials with Windows Defender Credential Guard href: /windows/security/identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection - href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.m \ No newline at end of file + href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md \ No newline at end of file From d7b21ad9297c397a5c555bd129dc4b5ca4577b83 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:20:13 -0700 Subject: [PATCH 0048/1214] rm --- windows/security/security-foundation/TOC.yml | 8 ---- .../security/security-foundation/index.yml | 39 ------------------- 2 files changed, 47 deletions(-) delete mode 100644 windows/security/security-foundation/TOC.yml delete mode 100644 windows/security/security-foundation/index.yml diff --git a/windows/security/security-foundation/TOC.yml b/windows/security/security-foundation/TOC.yml deleted file mode 100644 index e52bc796f3..0000000000 --- a/windows/security/security-foundation/TOC.yml +++ /dev/null @@ -1,8 +0,0 @@ -- name: Security foundation - href: index.yml - items: - - name: FIPS 140-2 Validation - href: /windows/security/threat-protection/fips-140-validation.md - - name: Common Criteria Certifications - href: /windows/security/threat-protection/windows-platform-common-criteria.md - diff --git a/windows/security/security-foundation/index.yml b/windows/security/security-foundation/index.yml deleted file mode 100644 index 97eae49e18..0000000000 --- a/windows/security/security-foundation/index.yml +++ /dev/null @@ -1,39 +0,0 @@ -### YamlMime:Landing - -title: Windows security foundation # < 60 chars -summary: Learn about Windows security foundations. # < 160 chars - -metadata: - title: Windows security foundation # Required; page title displayed in search results. Include the brand. < 60 chars. - description: Learn about Windows security foundation # Required; article description that is displayed in search results. < 160 chars. - ms.topic: landing-page # Required - ms.collection: m365-security-compliance - author: dansimp #Required; your GitHub user alias, with correct capitalization. - ms.author: dansimp #Required; microsoft alias of author; optional team alias. - ms.date: 09/30/2021 #Required; mm/dd/yyyy format. - localization_priority: Priority - -# linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new - -landingContent: -# Cards and links should be based on top customer tasks or top subjects -# Start card title with a verb - # Card (optional) - - title: Security assurance - linkLists: - - linkListType: overview - links: - - text: Microsoft Security Development Lifecycle (SDL) - url: /previous-versions/windows/desktop/cc307891(v=msdn.10) - - text: Microsoft bounty program - url: https://www.microsoft.com/msrc/bounty - # Card - - title: Certifications - linkLists: - - linkListType: overview - links: - - text: Federal Information Processing Standard (FIPS) 140 Validation - url: /windows/security/threat-protection/fips-140-validation - - text: Common Criteria Certifications - url: /windows/security/threat-protection/windows-platform-common-criteria - \ No newline at end of file From fb6fc95b75a994efa5a2f8be614909bc7bd58df6 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:23:32 -0700 Subject: [PATCH 0049/1214] url --- windows/security/index.yml | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index aca0718a29..ee8986dea8 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -28,7 +28,7 @@ landingContent: - text: Common Criteria Certifications url: /windows/security/threat-protection/windows-platform-common-criteria.md - text: Microsoft Security Development Lifecycle (SDL) - url: /previous-versions/windows/desktop/cc307891(v=msdn.10) + url: /previous-versions/windows/desktop/cc307891(v=msdn.10) - text: Microsoft bounty program url: https://www.microsoft.com/msrc/bounty # Card (optional) @@ -37,8 +37,8 @@ landingContent: - linkListType: overview links: - name: Trusted Platform Module (TPM) overview - href: /windows/security/information-protection/tpm/trusted-platform-module-overview.md + url: /windows/security/information-protection/tpm/trusted-platform-module-overview.md - name: Protect derived domain credentials with Windows Defender Credential Guard - href: /windows/security/identity-protection/credential-guard/credential-guard.md + url: /windows/security/identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection - href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md \ No newline at end of file + url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md \ No newline at end of file From b8c9dd3dba72cb7002e3fb1a802ddb427e583ff0 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:28:22 -0700 Subject: [PATCH 0050/1214] t --- windows/security/index.yml | 13 +------------ 1 file changed, 1 insertion(+), 12 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index ee8986dea8..86e84caf8f 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -30,15 +30,4 @@ landingContent: - text: Microsoft Security Development Lifecycle (SDL) url: /previous-versions/windows/desktop/cc307891(v=msdn.10) - text: Microsoft bounty program - url: https://www.microsoft.com/msrc/bounty - # Card (optional) - - title: Hardware security - linkLists: - - linkListType: overview - links: - - name: Trusted Platform Module (TPM) overview - url: /windows/security/information-protection/tpm/trusted-platform-module-overview.md - - name: Protect derived domain credentials with Windows Defender Credential Guard - url: /windows/security/identity-protection/credential-guard/credential-guard.md - - name: Kernel DMA Protection - url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md \ No newline at end of file + url: https://www.microsoft.com/msrc/bounty \ No newline at end of file From 432717f38be15e67dbaa55bf9a3e97774249a0c2 Mon Sep 17 00:00:00 2001 From: John Flores Date: Thu, 19 Aug 2021 14:34:38 -0400 Subject: [PATCH 0051/1214] Fix link --- .../hello-for-business/hello-how-it-works.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md index c9844c3d80..609a2a0954 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works.md @@ -34,7 +34,7 @@ Windows Hello for Business is a distributed system that uses several components Registration is a fundamental prerequisite for Windows Hello for Business. Without registration, Windows Hello for Business provisioning cannot start. Registration is where the device **registers** its identity with the identity provider. For cloud and hybrid deployments, the identity provider is Azure Active Directory and the device registers with the Azure Device Registration Service (ADRS). For on-premises deployments, the identity provider is Active Directory Federation Services (AD FS), and the device registers with the enterprise device registration service hosted on the federation servers (AD FS). -For more information read [how device registration works](hello-how-it-works-device-registration.md). +For more information read [how device registration works](/azure/active-directory/devices/device-registration-how-it-works). ### Provisioning From 326837bfb85dfa32a838f59d9c1f508751347800 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:36:47 -0700 Subject: [PATCH 0052/1214] testing --- windows/security/index.yml | 15 +++++++++++++++ 1 file changed, 15 insertions(+) diff --git a/windows/security/index.yml b/windows/security/index.yml index 86e84caf8f..74890e02e3 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -17,6 +17,21 @@ metadata: landingContent: # Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Security foundations + linkLists: + - linkListType: overview + links: + - text: Federal Information Processing Standard (FIPS) 140 Validation + url: /windows/security/threat-protection/fips-140-validation.md + - text: Common Criteria Certifications + url: /windows/security/threat-protection/windows-platform-common-criteria.md + - text: Microsoft Security Development Lifecycle (SDL) + url: /previous-versions/windows/desktop/cc307891(v=msdn.10) + - text: Microsoft bounty program + url: https://www.microsoft.com/msrc/bounty +# Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) - title: Security foundations From c0d3a328ddc11d8d8211321be73d4e3876a237fb Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 11:53:30 -0700 Subject: [PATCH 0053/1214] adding more toc... --- windows/security/TOC.yml | 48 ++++++++++++++++++++++++++++++++++---- windows/security/index.yml | 25 +++++++++++++------- 2 files changed, 59 insertions(+), 14 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 818858dece..99d00bd691 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -1,17 +1,55 @@ -- name: Windows security foundation +- name: Windows security href: index.yml expanded: true +- name: Windows security foundations items: - name: FIPS 140-2 Validation href: /windows/security/threat-protection/fips-140-validation.md - name: Common Criteria Certifications href: /windows/security/threat-protection/windows-platform-common-criteria.md -- name: Windows hardware Security +- name: Windows hardware security items: - - name: Trusted Platform Module (TPM) overview - href: /windows/security/information-protection/tpm/trusted-platform-module-overview.md + - name: Trusted Platform Module + href: tpm/trusted-platform-module-top-node.md + items: + - name: Trusted Platform Module Overview + href: tpm/trusted-platform-module-overview.md + - name: TPM fundamentals + href: tpm/tpm-fundamentals.md + - name: How Windows 10 uses the TPM + href: tpm/how-windows-uses-the-tpm.md + - name: TPM Group Policy settings + href: tpm/trusted-platform-module-services-group-policy-settings.md + - name: Back up the TPM recovery information to AD DS + href: tpm/backup-tpm-recovery-information-to-ad-ds.md + - name: View status, clear, or troubleshoot the TPM + href: tpm/initialize-and-configure-ownership-of-the-tpm.md + - name: Understanding PCR banks on TPM 2.0 devices + href: tpm/switch-pcr-banks-on-tpm-2-0-devices.md + - name: TPM recommendations + href: tpm/tpm-recommendations.md - name: Protect derived domain credentials with Windows Defender Credential Guard href: /windows/security/identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection - href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md \ No newline at end of file + href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +- name: Windows operating system security + items: + - name: system security + items: + - name: Secure the Windows 10 boot process + href: secure-the-windows-10-boot-process.md + - name: Encryption and data protection + items: + - name: Bitlocker + href: information-protection/bitlocker/bitlocker-overview.md + - name: Network security + items: + - name: VPN + href: identity-protection/vpn/vpn-guide.md + - name: Windows Defender Firewall + href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md +- name: Windows threat protection + items: + - name: Microsoft Defender Antivirus + href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows.md \ No newline at end of file diff --git a/windows/security/index.yml b/windows/security/index.yml index 74890e02e3..4c3fe7d66c 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -34,15 +34,22 @@ landingContent: # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) - - title: Security foundations + - title: Hardware security linkLists: - linkListType: overview links: - - text: Federal Information Processing Standard (FIPS) 140 Validation - url: /windows/security/threat-protection/fips-140-validation.md - - text: Common Criteria Certifications - url: /windows/security/threat-protection/windows-platform-common-criteria.md - - text: Microsoft Security Development Lifecycle (SDL) - url: /previous-versions/windows/desktop/cc307891(v=msdn.10) - - text: Microsoft bounty program - url: https://www.microsoft.com/msrc/bounty \ No newline at end of file + - name: Trusted Platform Module + url: tpm/trusted-platform-module-top-node.md + - name: Kernel DMA Protection + href: information-protection/kernel-dma-protection-for-thunderbolt.md +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Operating system security + linkLists: + - linkListType: overview + links: + - name: Secure the Windows boot process + url: information-protection/secure-the-windows-10-boot-process.md + - name: Configure S/MIME for Windows 10 + url: identity-protection/configure-s-mime.md \ No newline at end of file From e1f59479bbcefdb167f347e225087986d6fe1deb Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 12:04:14 -0700 Subject: [PATCH 0054/1214] fixing --- windows/security/TOC.yml | 22 +++++++++++----------- windows/security/index.yml | 8 ++++---- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 99d00bd691..f3f4538b86 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -11,24 +11,24 @@ - name: Windows hardware security items: - name: Trusted Platform Module - href: tpm/trusted-platform-module-top-node.md + href: /windows/security/information-protection/tpm/trusted-platform-module-top-node.md items: - name: Trusted Platform Module Overview - href: tpm/trusted-platform-module-overview.md + href: /windows/security/information-protection/tpm/trusted-platform-module-overview.md - name: TPM fundamentals - href: tpm/tpm-fundamentals.md + href: /windows/security/information-protection/tpm/tpm-fundamentals.md - name: How Windows 10 uses the TPM - href: tpm/how-windows-uses-the-tpm.md + href: /windows/security/information-protection/tpm/how-windows-uses-the-tpm.md - name: TPM Group Policy settings - href: tpm/trusted-platform-module-services-group-policy-settings.md + href: /windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md - name: Back up the TPM recovery information to AD DS - href: tpm/backup-tpm-recovery-information-to-ad-ds.md + href: /windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md - name: View status, clear, or troubleshoot the TPM - href: tpm/initialize-and-configure-ownership-of-the-tpm.md + href: /windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md - name: Understanding PCR banks on TPM 2.0 devices - href: tpm/switch-pcr-banks-on-tpm-2-0-devices.md + href: /windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md - name: TPM recommendations - href: tpm/tpm-recommendations.md + href: /windows/security/information-protection/tpm/tpm-recommendations.md - name: Protect derived domain credentials with Windows Defender Credential Guard href: /windows/security/identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection @@ -38,11 +38,11 @@ - name: system security items: - name: Secure the Windows 10 boot process - href: secure-the-windows-10-boot-process.md + href: /windows/security/information-protection/secure-the-windows-10-boot-process.md - name: Encryption and data protection items: - name: Bitlocker - href: information-protection/bitlocker/bitlocker-overview.md + href: /windows/security/information-protection/bitlocker/bitlocker-overview.md - name: Network security items: - name: VPN diff --git a/windows/security/index.yml b/windows/security/index.yml index 4c3fe7d66c..3ebfbd536f 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -39,9 +39,9 @@ landingContent: - linkListType: overview links: - name: Trusted Platform Module - url: tpm/trusted-platform-module-top-node.md + url: /windows/security/information-protection/trusted-platform-module-top-node.md - name: Kernel DMA Protection - href: information-protection/kernel-dma-protection-for-thunderbolt.md + url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) @@ -50,6 +50,6 @@ landingContent: - linkListType: overview links: - name: Secure the Windows boot process - url: information-protection/secure-the-windows-10-boot-process.md + url: /windows/security/information-protection/secure-the-windows-10-boot-process.md - name: Configure S/MIME for Windows 10 - url: identity-protection/configure-s-mime.md \ No newline at end of file + url: /windows/security/identity-protection/configure-s-mime.md \ No newline at end of file From bf753cf37da5935e75c69155b36ca0e6066d4009 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 12:10:46 -0700 Subject: [PATCH 0055/1214] text --- windows/security/index.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 3ebfbd536f..2761ee94c4 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -38,9 +38,9 @@ landingContent: linkLists: - linkListType: overview links: - - name: Trusted Platform Module - url: /windows/security/information-protection/trusted-platform-module-top-node.md - - name: Kernel DMA Protection + - text: Trusted Platform Module + url: /windows/security/information-protection/tpm/trusted-platform-module-top-node.md + - text: Kernel DMA Protection url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb @@ -49,7 +49,7 @@ landingContent: linkLists: - linkListType: overview links: - - name: Secure the Windows boot process + - text: Secure the Windows boot process url: /windows/security/information-protection/secure-the-windows-10-boot-process.md - - name: Configure S/MIME for Windows 10 + - text: Configure S/MIME for Windows 10 url: /windows/security/identity-protection/configure-s-mime.md \ No newline at end of file From 9cb21a66d89d04a468a7f8e9b1d807a57b806e87 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Thu, 19 Aug 2021 13:15:58 -0600 Subject: [PATCH 0056/1214] dh-make-bulleted-list --- .../demonstrate-deployment-on-vm.md | 77 ++++++++++--------- 1 file changed, 40 insertions(+), 37 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index effa84ef83..f41d64d23e 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -44,10 +44,13 @@ The following video provides an overview of the process: ## Prerequisites These are the things you'll need to complete this lab: - - - -
Windows 10 installation mediaWindows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.
Internet accessIf you're behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.
Hyper-V or a physical device running Windows 10The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.
An account with Azure AD Premium licenseThis guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.
+ +| | Description | +|:---|:---| +|**Windows 10 installation media**|Windows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.| +|**Internet access**|If you're behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.| +|**Hyper-V or a physical device running Windows 10**|The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.| +|**An account with Azure AD Premium license**|This guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| ## Procedures @@ -55,39 +58,39 @@ A summary of the sections and procedures in the lab is provided below. Follow ea If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version. -[Verify support for Hyper-V](#verify-support-for-hyper-v) -
[Enable Hyper-V](#enable-hyper-v) -
[Create a demo VM](#create-a-demo-vm) -
    [Set ISO file location](#set-iso-file-location) -
    [Determine network adapter name](#determine-network-adapter-name) -
    [Use Windows PowerShell to create the demo VM](#use-windows-powershell-to-create-the-demo-vm) -
    [Install Windows 10](#install-windows-10) -
[Capture the hardware ID](#capture-the-hardware-id) -
[Reset the VM back to Out-Of-Box-Experience (OOBE)](#reset-the-vm-back-to-out-of-box-experience-oobe) -
[Verify subscription level](#verify-subscription-level) -
[Configure company branding](#configure-company-branding) -
[Configure Microsoft Intune auto-enrollment](#configure-microsoft-intune-auto-enrollment) -
[Register your VM](#register-your-vm) -
    [Autopilot registration using Intune](#autopilot-registration-using-intune) -
    [Autopilot registration using MSfB](#autopilot-registration-using-msfb) -
[Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile) -
    [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) -
       [Create a device group](#create-a-device-group) -
       [Create the deployment profile](#create-the-deployment-profile) -
    [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) -
[See Windows Autopilot in action](#see-windows-autopilot-in-action) -
[Remove devices from Autopilot](#remove-devices-from-autopilot) -
    [Delete (deregister) Autopilot device](#delete-deregister-autopilot-device) -
[Appendix A: Verify support for Hyper-V](#appendix-a-verify-support-for-hyper-v) -
[Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile) -
    [Add a Win32 app](#add-a-win32-app) -
       [Prepare the app for Intune](#prepare-the-app-for-intune) -
       [Create app in Intune](#create-app-in-intune) -
       [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) -
    [Add Office 365](#add-office-365) -
       [Create app in Intune](#create-app-in-intune) -
       [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) -
[Glossary](#glossary) +- [Verify support for Hyper-V](#verify-support-for-hyper-v) +- [Enable Hyper-V](#enable-hyper-v) +- [Create a demo VM](#create-a-demo-vm) + - [Set ISO file location](#set-iso-file-location) + - [Determine network adapter name](#determine-network-adapter-name) + - [Use Windows PowerShell to create the demo VM](#use-windows-powershell-to-create-the-demo-vm) + - [Install Windows 10](#install-windows-10) +- [Capture the hardware ID](#capture-the-hardware-id) +- [Reset the VM back to Out-Of-Box-Experience (OOBE)](#reset-the-vm-back-to-out-of-box-experience-oobe) +- [Verify subscription level](#verify-subscription-level) +- [Configure company branding](#configure-company-branding) +- [Configure Microsoft Intune auto-enrollment](#configure-microsoft-intune-auto-enrollment) +- [Register your VM](#register-your-vm) + - [Autopilot registration using Intune](#autopilot-registration-using-intune) + - [Autopilot registration using MSfB](#autopilot-registration-using-msfb) +- [Create and assign a Windows Autopilot deployment profile](#create-and-assign-a-windows-autopilot-deployment-profile) + - [Create a Windows Autopilot deployment profile using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) + - [Create a device group](#create-a-device-group) + - [Create the deployment profile](#create-the-deployment-profile) + - [Create a Windows Autopilot deployment profile using MSfB](#create-a-windows-autopilot-deployment-profile-using-msfb) +- [See Windows Autopilot in action](#see-windows-autopilot-in-action) +- [Remove devices from Autopilot](#remove-devices-from-autopilot) + - [Delete (deregister) Autopilot device](#delete-deregister-autopilot-device) +- [Appendix A: Verify support for Hyper-V](#appendix-a-verify-support-for-hyper-v) +- [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile) + - [Add a Win32 app](#add-a-win32-app) + - [Prepare the app for Intune](#prepare-the-app-for-intune) + - [Create app in Intune](#create-app-in-intune) + - [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) + - [Add Office 365](#add-office-365) + - [Create app in Intune](#create-app-in-intune) + - [Assign the app to your Intune profile](#assign-the-app-to-your-intune-profile) +- [Glossary](#glossary) ## Verify support for Hyper-V From 78d73dc75dd270b75b37b012226b13cef5fe73da Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 12:30:47 -0700 Subject: [PATCH 0057/1214] oops all broken --- windows/security/TOC.yml | 30 +++++++++++++++--------------- 1 file changed, 15 insertions(+), 15 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index f3f4538b86..237dfd3ad2 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -5,44 +5,44 @@ - name: Windows security foundations items: - name: FIPS 140-2 Validation - href: /windows/security/threat-protection/fips-140-validation.md + href: threat-protection/fips-140-validation.md - name: Common Criteria Certifications - href: /windows/security/threat-protection/windows-platform-common-criteria.md + href: threat-protection/windows-platform-common-criteria.md - name: Windows hardware security items: - name: Trusted Platform Module - href: /windows/security/information-protection/tpm/trusted-platform-module-top-node.md + href: information-protection/tpm/trusted-platform-module-top-node.md items: - name: Trusted Platform Module Overview - href: /windows/security/information-protection/tpm/trusted-platform-module-overview.md + href: information-protection/tpm/trusted-platform-module-overview.md - name: TPM fundamentals - href: /windows/security/information-protection/tpm/tpm-fundamentals.md + href: information-protection/tpm/tpm-fundamentals.md - name: How Windows 10 uses the TPM - href: /windows/security/information-protection/tpm/how-windows-uses-the-tpm.md + href: information-protection/tpm/how-windows-uses-the-tpm.md - name: TPM Group Policy settings - href: /windows/security/information-protection/tpm/trusted-platform-module-services-group-policy-settings.md + href: information-protection/tpm/trusted-platform-module-services-group-policy-settings.md - name: Back up the TPM recovery information to AD DS - href: /windows/security/information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md + href: information-protection/tpm/backup-tpm-recovery-information-to-ad-ds.md - name: View status, clear, or troubleshoot the TPM - href: /windows/security/information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md + href: information-protection/tpm/initialize-and-configure-ownership-of-the-tpm.md - name: Understanding PCR banks on TPM 2.0 devices - href: /windows/security/information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md + href: information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md - name: TPM recommendations - href: /windows/security/information-protection/tpm/tpm-recommendations.md + href: information-protection/tpm/tpm-recommendations.md - name: Protect derived domain credentials with Windows Defender Credential Guard - href: /windows/security/identity-protection/credential-guard/credential-guard.md + href: identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection - href: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md + href: information-protection/kernel-dma-protection-for-thunderbolt.md - name: Windows operating system security items: - name: system security items: - name: Secure the Windows 10 boot process - href: /windows/security/information-protection/secure-the-windows-10-boot-process.md + href: information-protection/secure-the-windows-10-boot-process.md - name: Encryption and data protection items: - name: Bitlocker - href: /windows/security/information-protection/bitlocker/bitlocker-overview.md + href: information-protection/bitlocker/bitlocker-overview.md - name: Network security items: - name: VPN From f5909d966ce0745152e4c1702151f99d2d58a82a Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 12:39:26 -0700 Subject: [PATCH 0058/1214] add --- windows/security/TOC.yml | 20 ++++++++++++++------ 1 file changed, 14 insertions(+), 6 deletions(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 237dfd3ad2..743bbc0044 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -2,13 +2,13 @@ - name: Windows security href: index.yml expanded: true -- name: Windows security foundations +- name: Security foundations items: - name: FIPS 140-2 Validation href: threat-protection/fips-140-validation.md - name: Common Criteria Certifications href: threat-protection/windows-platform-common-criteria.md -- name: Windows hardware security +- name: Hardware security items: - name: Trusted Platform Module href: information-protection/tpm/trusted-platform-module-top-node.md @@ -33,9 +33,9 @@ href: identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection href: information-protection/kernel-dma-protection-for-thunderbolt.md -- name: Windows operating system security +- name: Operating system security items: - - name: system security + - name: System security items: - name: Secure the Windows 10 boot process href: information-protection/secure-the-windows-10-boot-process.md @@ -49,7 +49,15 @@ href: identity-protection/vpn/vpn-guide.md - name: Windows Defender Firewall href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md -- name: Windows threat protection +- name: Threat protection items: - name: Microsoft Defender Antivirus - href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows.md \ No newline at end of file + href: /microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows.md +- name: Application protection + items: +- name: User protection + items: +- name: Privacy controls + items: + - name: Windows Privacy controls + href: https://docs.microsoft.com/windows/privacy/windows-10-and-privacy-compliance \ No newline at end of file From 721dacf61282f609e33e65a5786f3233b27a4338 Mon Sep 17 00:00:00 2001 From: Jordan Geurten Date: Thu, 19 Aug 2021 12:49:28 -0700 Subject: [PATCH 0059/1214] Added latest security researcher to recommended block rules and sorted them. --- .../microsoft-recommended-block-rules.md | 13 +++++++------ 1 file changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 663757d649..64ac22bc1a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -78,17 +78,18 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you |Name|Twitter| |---|---| +|Alex Ionescu | @aionescu| +|Brock Mammen| | |Casey Smith |@subTee| +|Jimmy Bayne | @bohops | +|Lasse Trolle Borup | Langkjaer Cyber Defence | +|Lee Christensen|@tifkin_| |Matt Graeber | @mattifestation| |Matt Nelson | @enigma0x3| |Oddvar Moe |@Oddvarmoe| -|Alex Ionescu | @aionescu| -|Lee Christensen|@tifkin_| -|Vladas Bulavas | Kaspersky Lab | -|Lasse Trolle Borup | Langkjaer Cyber Defence | -|Jimmy Bayne | @bohops | |Philip Tsukerman | @PhilipTsukerman | -|Brock Mammen| | +|Vladas Bulavas | Kaspersky Lab | +|William Easton | @Strawgate |
From 7c596eaee5dc82515be9f2d6536ef0d2384e7ebe Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 12:56:00 -0700 Subject: [PATCH 0060/1214] adding in bitlocker --- windows/security/TOC.yml | 74 ++++++++++++++++++++++++++++++++++++++++ 1 file changed, 74 insertions(+) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 743bbc0044..91ff61ce6f 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -41,8 +41,82 @@ href: information-protection/secure-the-windows-10-boot-process.md - name: Encryption and data protection items: + - name: Encrypted Hard Drive + href: encrypted-hard-drive.md - name: Bitlocker href: information-protection/bitlocker/bitlocker-overview.md + items: + - name: Overview of BitLocker Device Encryption in Windows 10 + href: information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md + - name: BitLocker frequently asked questions (FAQ) + href: information-protection/bitlocker/bitlocker-frequently-asked-questions.yml + items: + - name: Overview and requirements + href: information-protection/bitlocker/bitlocker-overview-and-requirements-faq.yml + - name: Upgrading + href: information-protection/bitlocker/bitlocker-upgrading-faq.yml + - name: Deployment and administration + href: information-protection/bitlocker/bitlocker-deployment-and-administration-faq.yml + - name: Key management + href: information-protection/bitlocker/bitlocker-key-management-faq.yml + - name: BitLocker To Go + href: information-protection/bitlocker/bitlocker-to-go-faq.yml + - name: Active Directory Domain Services + href: information-protection/bitlocker/bitlocker-and-adds-faq.yml + - name: Security + href: information-protection/bitlocker/bitlocker-security-faq.yml + - name: BitLocker Network Unlock + href: information-protection/bitlocker/bitlocker-network-unlock-faq.yml + - name: General + href: information-protection/bitlocker/bitlocker-using-with-other-programs-faq.yml + - name: "Prepare your organization for BitLocker: Planning and policies" + href: information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md + - name: BitLocker deployment comparison + href: information-protection/bitlocker/bitlocker-deployment-comparison.md + - name: BitLocker basic deployment + href: information-protection/bitlocker/bitlocker-basic-deployment.md + - name: Deploy BitLocker on Windows Server 2012 and later + href: information-protection/bitlocker/bitlocker-how-to-deploy-on-windows-server.md + - name: BitLocker management for enterprises + href: information-protection/bitlocker/bitlocker-management-for-enterprises.md + - name: Enable Network Unlock with BitLocker + href: information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md + - name: Use BitLocker Drive Encryption Tools to manage BitLocker + href: information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md + - name: Use BitLocker Recovery Password Viewer + href: information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md + - name: BitLocker Group Policy settings + href: information-protection/bitlocker/bitlocker-group-policy-settings.md + - name: BCD settings and BitLocker + href: information-protection/bitlocker/bcd-settings-and-bitlocker.md + - name: BitLocker Recovery Guide + href: information-protection/bitlocker/bitlocker-recovery-guide-plan.md + - name: BitLocker Countermeasures + href: information-protection/bitlocker/bitlocker-countermeasures.md + - name: Protecting cluster shared volumes and storage area networks with BitLocker + href: information-protection/bitlocker/protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md + - name: Troubleshoot BitLocker + items: + - name: Troubleshoot BitLocker + href: information-protection/bitlocker/troubleshoot-bitlocker.md + - name: "BitLocker cannot encrypt a drive: known issues" + href: information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md + - name: "Enforcing BitLocker policies by using Intune: known issues" + href: information-protection/bitlocker/ts-bitlocker-intune-issues.md + - name: "BitLocker Network Unlock: known issues" + href: information-protection/bitlocker/ts-bitlocker-network-unlock-issues.md + - name: "BitLocker recovery: known issues" + href: information-protection/bitlocker/ts-bitlocker-recovery-issues.md + - name: "BitLocker configuration: known issues" + href: information-protection/bitlocker/ts-bitlocker-config-issues.md + - name: Troubleshoot BitLocker and TPM issues + items: + - name: "BitLocker cannot encrypt a drive: known TPM issues" + href: information-protection/bitlocker/ts-bitlocker-cannot-encrypt-tpm-issues.md + - name: "BitLocker and TPM: other known issues" + href: information-protection/bitlocker/ts-bitlocker-tpm-issues.md + - name: Decode Measured Boot logs to track PCR changes + href: information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md - name: Network security items: - name: VPN From 5d9ce6746c4edbc594141d686bb734992c89bb34 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 13:00:01 -0700 Subject: [PATCH 0061/1214] attempting to redirect TOC --- windows/security/information-protection/{TOC.yml => TOC-BAK.yml} | 0 1 file changed, 0 insertions(+), 0 deletions(-) rename windows/security/information-protection/{TOC.yml => TOC-BAK.yml} (100%) diff --git a/windows/security/information-protection/TOC.yml b/windows/security/information-protection/TOC-BAK.yml similarity index 100% rename from windows/security/information-protection/TOC.yml rename to windows/security/information-protection/TOC-BAK.yml From e47977ed23df6f18a968ec290c7860028090fac8 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 13:04:05 -0700 Subject: [PATCH 0062/1214] build fail --- .../information-protection/TOC-BAK.yml | 149 ------------------ 1 file changed, 149 deletions(-) delete mode 100644 windows/security/information-protection/TOC-BAK.yml diff --git a/windows/security/information-protection/TOC-BAK.yml b/windows/security/information-protection/TOC-BAK.yml deleted file mode 100644 index bcaa9d74d7..0000000000 --- a/windows/security/information-protection/TOC-BAK.yml +++ /dev/null @@ -1,149 +0,0 @@ -- name: Information protection - href: index.md - items: - - name: BitLocker - href: bitlocker\bitlocker-overview.md - items: - - name: Overview of BitLocker Device Encryption in Windows 10 - href: bitlocker\bitlocker-device-encryption-overview-windows-10.md - - name: BitLocker frequently asked questions (FAQ) - href: bitlocker\bitlocker-frequently-asked-questions.yml - items: - - name: Overview and requirements - href: bitlocker\bitlocker-overview-and-requirements-faq.yml - - name: Upgrading - href: bitlocker\bitlocker-upgrading-faq.yml - - name: Deployment and administration - href: bitlocker\bitlocker-deployment-and-administration-faq.yml - - name: Key management - href: bitlocker\bitlocker-key-management-faq.yml - - name: BitLocker To Go - href: bitlocker\bitlocker-to-go-faq.yml - - name: Active Directory Domain Services - href: bitlocker\bitlocker-and-adds-faq.yml - - name: Security - href: bitlocker\bitlocker-security-faq.yml - - name: BitLocker Network Unlock - href: bitlocker\bitlocker-network-unlock-faq.yml - - name: General - href: bitlocker\bitlocker-using-with-other-programs-faq.yml - - name: "Prepare your organization for BitLocker: Planning and policies" - href: bitlocker\prepare-your-organization-for-bitlocker-planning-and-policies.md - - name: BitLocker deployment comparison - href: bitlocker\bitlocker-deployment-comparison.md - - name: BitLocker basic deployment - href: bitlocker\bitlocker-basic-deployment.md - - name: "BitLocker: How to deploy on Windows Server 2012 and later" - href: bitlocker\bitlocker-how-to-deploy-on-windows-server.md - - name: "BitLocker: Management for enterprises" - href: bitlocker\bitlocker-management-for-enterprises.md - - name: "BitLocker: How to enable Network Unlock" - href: bitlocker\bitlocker-how-to-enable-network-unlock.md - - name: "BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker" - href: bitlocker\bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md - - name: "BitLocker: Use BitLocker Recovery Password Viewer" - href: bitlocker\bitlocker-use-bitlocker-recovery-password-viewer.md - - name: BitLocker Group Policy settings - href: bitlocker\bitlocker-group-policy-settings.md - - name: BCD settings and BitLocker - href: bitlocker\bcd-settings-and-bitlocker.md - - name: BitLocker Recovery Guide - href: bitlocker\bitlocker-recovery-guide-plan.md - - name: BitLocker Countermeasures - href: bitlocker\bitlocker-countermeasures.md - - name: Protecting cluster shared volumes and storage area networks with BitLocker - href: bitlocker\protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md - - name: Troubleshoot BitLocker - items: - - name: Troubleshoot BitLocker - href: bitlocker\troubleshoot-bitlocker.md - - name: "BitLocker cannot encrypt a drive: known issues" - href: bitlocker\ts-bitlocker-cannot-encrypt-issues.md - - name: "Enforcing BitLocker policies by using Intune: known issues" - href: bitlocker\ts-bitlocker-intune-issues.md - - name: "BitLocker Network Unlock: known issues" - href: bitlocker\ts-bitlocker-network-unlock-issues.md - - name: "BitLocker recovery: known issues" - href: bitlocker\ts-bitlocker-recovery-issues.md - - name: "BitLocker configuration: known issues" - href: bitlocker\ts-bitlocker-config-issues.md - - name: Troubleshoot BitLocker and TPM issues - items: - - name: "BitLocker cannot encrypt a drive: known TPM issues" - href: bitlocker\ts-bitlocker-cannot-encrypt-tpm-issues.md - - name: "BitLocker and TPM: other known issues" - href: bitlocker\ts-bitlocker-tpm-issues.md - - name: Decode Measured Boot logs to track PCR changes - href: bitlocker\ts-bitlocker-decode-measured-boot-logs.md - - name: Encrypted Hard Drive - href: encrypted-hard-drive.md - - name: Kernel DMA Protection - href: kernel-dma-protection-for-thunderbolt.md - - name: Protect your enterprise data using Windows Information Protection (WIP) - href: windows-information-protection\protect-enterprise-data-using-wip.md - items: - - name: Create a WIP policy using Microsoft Intune - href: windows-information-protection\overview-create-wip-policy.md - items: - - name: Create a WIP policy with MDM using the Azure portal for Microsoft Intune - href: windows-information-protection\create-wip-policy-using-intune-azure.md - items: - - name: Deploy your WIP policy using the Azure portal for Microsoft Intune - href: windows-information-protection\deploy-wip-policy-using-intune-azure.md - - name: Associate and deploy a VPN policy for WIP using the Azure portal for Microsoft Intune - href: windows-information-protection\create-vpn-and-wip-policy-using-intune-azure.md - - name: Create and verify an EFS Data Recovery Agent (DRA) certificate - href: windows-information-protection\create-and-verify-an-efs-dra-certificate.md - - name: Determine the Enterprise Context of an app running in WIP - href: windows-information-protection\wip-app-enterprise-context.md - - name: Create a WIP policy using Microsoft Endpoint Configuration Manager - href: windows-information-protection\overview-create-wip-policy-configmgr.md - items: - - name: Create and deploy a WIP policy using Microsoft Endpoint Configuration Manager - href: windows-information-protection\create-wip-policy-using-configmgr.md - - name: Create and verify an EFS Data Recovery Agent (DRA) certificate - href: windows-information-protection\create-and-verify-an-efs-dra-certificate.md - - name: Determine the Enterprise Context of an app running in WIP - href: windows-information-protection\wip-app-enterprise-context.md - - name: Mandatory tasks and settings required to turn on WIP - href: windows-information-protection\mandatory-settings-for-wip.md - - name: Testing scenarios for WIP - href: windows-information-protection\testing-scenarios-for-wip.md - - name: Limitations while using WIP - href: windows-information-protection\limitations-with-wip.md - - name: How to collect WIP audit event logs - href: windows-information-protection\collect-wip-audit-event-logs.md - - name: General guidance and best practices for WIP - href: windows-information-protection\guidance-and-best-practices-wip.md - items: - - name: Enlightened apps for use with WIP - href: windows-information-protection\enlightened-microsoft-apps-and-wip.md - - name: Unenlightened and enlightened app behavior while using WIP - href: windows-information-protection\app-behavior-with-wip.md - - name: Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP - href: windows-information-protection\recommended-network-definitions-for-wip.md - - name: Using Outlook Web Access with WIP - href: windows-information-protection\using-owa-with-wip.md - - name: Fine-tune WIP Learning - href: windows-information-protection\wip-learning.md - - name: Secure the Windows 10 boot process - href: secure-the-windows-10-boot-process.md - - name: Trusted Platform Module - href: tpm/trusted-platform-module-top-node.md - items: - - name: Trusted Platform Module Overview - href: tpm/trusted-platform-module-overview.md - - name: TPM fundamentals - href: tpm/tpm-fundamentals.md - - name: How Windows 10 uses the TPM - href: tpm/how-windows-uses-the-tpm.md - - name: TPM Group Policy settings - href: tpm/trusted-platform-module-services-group-policy-settings.md - - name: Back up the TPM recovery information to AD DS - href: tpm/backup-tpm-recovery-information-to-ad-ds.md - - name: View status, clear, or troubleshoot the TPM - href: tpm/initialize-and-configure-ownership-of-the-tpm.md - - name: Understanding PCR banks on TPM 2.0 devices - href: tpm/switch-pcr-banks-on-tpm-2-0-devices.md - - name: TPM recommendations - href: tpm/tpm-recommendations.md From 9caab07acfd421dc1f240e5c97105ee4a107dcb5 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 13:17:47 -0700 Subject: [PATCH 0063/1214] adding wip --- windows/security/TOC.yml | 49 +++++++++++++++++++++++++++++++++++++++- 1 file changed, 48 insertions(+), 1 deletion(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 91ff61ce6f..2370e36f4e 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -42,7 +42,7 @@ - name: Encryption and data protection items: - name: Encrypted Hard Drive - href: encrypted-hard-drive.md + href: information-protection/encrypted-hard-drive.md - name: Bitlocker href: information-protection/bitlocker/bitlocker-overview.md items: @@ -117,6 +117,53 @@ href: information-protection/bitlocker/ts-bitlocker-tpm-issues.md - name: Decode Measured Boot logs to track PCR changes href: information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md + - name: Windows Information Protection (WIP) + href: information-protection/windows-information-protection/protect-enterprise-data-using-wip.md + items: + - name: Create a WIP policy using Microsoft Intune + href: information-protection/windows-information-protection/overview-create-wip-policy.md + items: + - name: Create a WIP policy with MDM using the Azure portal for Microsoft Intune + href: information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md + items: + - name: Deploy your WIP policy using the Azure portal for Microsoft Intune + href: information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md + - name: Associate and deploy a VPN policy for WIP using the Azure portal for Microsoft Intune + href: information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md + - name: Create and verify an EFS Data Recovery Agent (DRA) certificate + href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md + - name: Determine the Enterprise Context of an app running in WIP + href: information-protection/windows-information-protection/wip-app-enterprise-context.md + - name: Create a WIP policy using Microsoft Endpoint Configuration Manager + href: information-protection/windows-information-protection/overview-create-wip-policy-configmgr.md + items: + - name: Create and deploy a WIP policy using Microsoft Endpoint Configuration Manager + href: information-protection/windows-information-protection/create-wip-policy-using-configmgr.md + - name: Create and verify an EFS Data Recovery Agent (DRA) certificate + href: information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md + - name: Determine the Enterprise Context of an app running in WIP + href: information-protection/windows-information-protection/wip-app-enterprise-context.md + - name: Mandatory tasks and settings required to turn on WIP + href: information-protection/windows-information-protection/mandatory-settings-for-wip.md + - name: Testing scenarios for WIP + href: information-protection/windows-information-protection/testing-scenarios-for-wip.md + - name: Limitations while using WIP + href: information-protection/windows-information-protection/limitations-with-wip.md + - name: How to collect WIP audit event logs + href: information-protection/windows-information-protection/collect-wip-audit-event-logs.md + - name: General guidance and best practices for WIP + href: information-protection/windows-information-protection/guidance-and-best-practices-wip.md + items: + - name: Enlightened apps for use with WIP + href: information-protection/windows-information-protection/enlightened-microsoft-apps-and-wip.md + - name: Unenlightened and enlightened app behavior while using WIP + href: information-protection/windows-information-protection/app-behavior-with-wip.md + - name: Recommended Enterprise Cloud Resources and Neutral Resources network settings with WIP + href: information-protection/windows-information-protection/recommended-network-definitions-for-wip.md + - name: Using Outlook Web Access with WIP + href: information-protection/windows-information-protection/using-owa-with-wip.md + - name: Fine-tune WIP Learning + href: information-protection/windows-information-protection/wip-learning.md - name: Network security items: - name: VPN From e794bc48fc50b76664029c2cce9571e35116adba Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 15:11:13 -0700 Subject: [PATCH 0064/1214] adding identity --- windows/security/TOC.yml | 129 ++++++++++++++++++++++++++++++++++++++- 1 file changed, 128 insertions(+), 1 deletion(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 2370e36f4e..51021a5be7 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -117,6 +117,8 @@ href: information-protection/bitlocker/ts-bitlocker-tpm-issues.md - name: Decode Measured Boot logs to track PCR changes href: information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md + - name: Configure S/MIME for Windows 10 + href: configure-s-mime.md - name: Windows Information Protection (WIP) href: information-protection/windows-information-protection/protect-enterprise-data-using-wip.md items: @@ -166,8 +168,31 @@ href: information-protection/windows-information-protection/wip-learning.md - name: Network security items: - - name: VPN + - name: VPN technical guide href: identity-protection/vpn/vpn-guide.md + items: + - name: VPN connection types + href: identity-protection/vpn/vpn-connection-type.md + - name: VPN routing decisions + href: identity-protection/vpn/vpn-routing.md + - name: VPN authentication options + href: identity-protection/vpn/vpn-authentication.md + - name: VPN and conditional access + href: identity-protection/vpn/vpn-conditional-access.md + - name: VPN name resolution + href: identity-protection/vpn/vpn-name-resolution.md + - name: VPN auto-triggered profile options + href: identity-protection/vpn/vpn-auto-trigger-profile.md + - name: VPN security features + href: identity-protection/vpn/vpn-security-features.md + - name: VPN profile options + href: identity-protection/vpn/vpn-profile-options.md + - name: How to configure Diffie Hellman protocol over IKEv2 VPN connections + href: identity-protection/vpn/how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md + - name: How to use single sign-on (SSO) over VPN and Wi-Fi connections + href: identity-protection/vpn/how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md + - name: Optimizing Office 365 traffic with the Windows 10 VPN client + href: identity-protection/vpn/vpn-office-365-optimization.md - name: Windows Defender Firewall href: threat-protection/windows-firewall/windows-firewall-with-advanced-security.md - name: Threat protection @@ -178,6 +203,108 @@ items: - name: User protection items: + - name: Technical support policy for lost or forgotten passwords + href: identity-protection/password-support-policy.md + - name: Access Control Overview + href: identity-protection/access-control/access-control.md + items: + - name: Dynamic Access Control Overview + href: identity-protection/access-control/dynamic-access-control.md + - name: Security identifiers + href: identity-protection/access-control/security-identifiers.md + - name: Security Principals + href: identity-protection/access-control/security-principals.md + - name: Local Accounts + href: identity-protection/access-control/local-accounts.md + - name: Active Directory Accounts + href: identity-protection/access-control/active-directory-accounts.md + - name: Microsoft Accounts + href: identity-protection/access-control/microsoft-accounts.md + - name: Service Accounts + href: identity-protection/access-control/service-accounts.md + - name: Active Directory Security Groups + href: identity-protection/access-control/active-directory-security-groups.md + - name: Special Identities + href: identity-protection/access-control/special-identities.md + - name: User Account Control + href: identity-protection/user-account-control/user-account-control-overview.md + items: + - name: How User Account Control works + href: identity-protection/user-account-control/how-user-account-control-works.md + - name: User Account Control security policy settings + href: identity-protection/user-account-control/user-account-control-security-policy-settings.md + - name: User Account Control Group Policy and registry key settings + href: identity-protection/user-account-control/user-account-control-group-policy-and-registry-key-settings.md + - name: Windows Hello for Business + href: identity-protection/hello-for-business/index.yml + - name: Windows credential theft mitigation guide + href: identity-protection/windows-credential-theft-mitigation-guide-abstract.md + - name: Enterprise Certificate Pinning + href: identity-protection/enterprise-certificate-pinning.md + - name: Protect derived domain credentials with Credential Guard + href: identity-protection/credential-guard/credential-guard.md + items: + - name: How Credential Guard works + href: identity-protection/credential-guard/credential-guard-how-it-works.md + - name: Credential Guard Requirements + href: identity-protection/credential-guard/credential-guard-requirements.md + - name: Manage Credential Guard + href: identity-protection/credential-guard/credential-guard-manage.md + - name: Hardware readiness tool + href: identity-protection/credential-guard/dg-readiness-tool.md + - name: Credential Guard protection limits + href: identity-protection/credential-guard/credential-guard-protection-limits.md + - name: Considerations when using Credential Guard + href: identity-protection/credential-guard/credential-guard-considerations.md + - name: "Credential Guard: Additional mitigations" + href: identity-protection/credential-guard/additional-mitigations.md + - name: "Credential Guard: Known issues" + href: identity-protection/credential-guard/credential-guard-known-issues.md + - name: Protect Remote Desktop credentials with Remote Credential Guard + href: identity-protection/remote-credential-guard.md + - name: Smart Cards + href: identity-protection/smart-cards/smart-card-windows-smart-card-technical-reference.md + items: + - name: How Smart Card Sign-in Works in Windows + href: identity-protection/smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md + items: + - name: Smart Card Architecture + href: identity-protection/smart-cards/smart-card-architecture.md + - name: Certificate Requirements and Enumeration + href: identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md + - name: Smart Card and Remote Desktop Services + href: identity-protection/smart-cards/smart-card-and-remote-desktop-services.md + - name: Smart Cards for Windows Service + href: identity-protection/smart-cards/smart-card-smart-cards-for-windows-service.md + - name: Certificate Propagation Service + href: identity-protection/smart-cards/smart-card-certificate-propagation-service.md + - name: Smart Card Removal Policy Service + href: identity-protection/smart-cards/smart-card-removal-policy-service.md + - name: Smart Card Tools and Settings + href: identity-protection/smart-cards/smart-card-tools-and-settings.md + items: + - name: Smart Cards Debugging Information + href: identity-protection/smart-cards/smart-card-debugging-information.md + - name: Smart Card Group Policy and Registry Settings + href: identity-protection/smart-cards/smart-card-group-policy-and-registry-settings.md + - name: Smart Card Events + href: identity-protection/smart-cards/smart-card-events.md + - name: Virtual Smart Cards + href: identity-protection/virtual-smart-cards/virtual-smart-card-overview.md + items: + - name: Understanding and Evaluating Virtual Smart Cards + href: identity-protection/virtual-smart-cards/virtual-smart-card-understanding-and-evaluating.md + items: + - name: "Get Started with Virtual Smart Cards: Walkthrough Guide" + href: identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md + - name: Use Virtual Smart Cards + href: identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md + - name: Deploy Virtual Smart Cards + href: identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md + - name: Evaluate Virtual Smart Card Security + href: identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md + - name: Tpmvscmgr + href: identity-protection/virtual-smart-cards/virtual-smart-card-tpmvscmgr.md - name: Privacy controls items: - name: Windows Privacy controls From ef521bf2852e395d97a501d4ec210b69d110f162 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 19 Aug 2021 15:19:28 -0700 Subject: [PATCH 0065/1214] rm identity-protection toc --- windows/security/identity-protection/TOC.yml | 132 ------------------- 1 file changed, 132 deletions(-) delete mode 100644 windows/security/identity-protection/TOC.yml diff --git a/windows/security/identity-protection/TOC.yml b/windows/security/identity-protection/TOC.yml deleted file mode 100644 index 5e4680879e..0000000000 --- a/windows/security/identity-protection/TOC.yml +++ /dev/null @@ -1,132 +0,0 @@ -- name: Identity and access management - href: index.md - items: - - name: Technical support policy for lost or forgotten passwords - href: password-support-policy.md - - name: Access Control Overview - href: access-control/access-control.md - items: - - name: Dynamic Access Control Overview - href: access-control/dynamic-access-control.md - - name: Security identifiers - href: access-control/security-identifiers.md - - name: Security Principals - href: access-control/security-principals.md - - name: Local Accounts - href: access-control/local-accounts.md - - name: Active Directory Accounts - href: access-control/active-directory-accounts.md - - name: Microsoft Accounts - href: access-control/microsoft-accounts.md - - name: Service Accounts - href: access-control/service-accounts.md - - name: Active Directory Security Groups - href: access-control/active-directory-security-groups.md - - name: Special Identities - href: access-control/special-identities.md - - name: User Account Control - href: user-account-control\user-account-control-overview.md - items: - - name: How User Account Control works - href: user-account-control\how-user-account-control-works.md - - name: User Account Control security policy settings - href: user-account-control\user-account-control-security-policy-settings.md - - name: User Account Control Group Policy and registry key settings - href: user-account-control\user-account-control-group-policy-and-registry-key-settings.md - - name: Windows Hello for Business - href: hello-for-business/index.yml - - name: Protect derived domain credentials with Credential Guard - href: credential-guard/credential-guard.md - items: - - name: How Credential Guard works - href: credential-guard/credential-guard-how-it-works.md - - name: Credential Guard Requirements - href: credential-guard/credential-guard-requirements.md - - name: Manage Credential Guard - href: credential-guard/credential-guard-manage.md - - name: Hardware readiness tool - href: credential-guard/dg-readiness-tool.md - - name: Credential Guard protection limits - href: credential-guard/credential-guard-protection-limits.md - - name: Considerations when using Credential Guard - href: credential-guard/credential-guard-considerations.md - - name: "Credential Guard: Additional mitigations" - href: credential-guard/additional-mitigations.md - - name: "Credential Guard: Known issues" - href: credential-guard/credential-guard-known-issues.md - - name: Protect Remote Desktop credentials with Remote Credential Guard - href: remote-credential-guard.md - - name: Smart Cards - href: smart-cards/smart-card-windows-smart-card-technical-reference.md - items: - - name: How Smart Card Sign-in Works in Windows - href: smart-cards/smart-card-how-smart-card-sign-in-works-in-windows.md - items: - - name: Smart Card Architecture - href: smart-cards/smart-card-architecture.md - - name: Certificate Requirements and Enumeration - href: smart-cards/smart-card-certificate-requirements-and-enumeration.md - - name: Smart Card and Remote Desktop Services - href: smart-cards/smart-card-and-remote-desktop-services.md - - name: Smart Cards for Windows Service - href: smart-cards/smart-card-smart-cards-for-windows-service.md - - name: Certificate Propagation Service - href: smart-cards/smart-card-certificate-propagation-service.md - - name: Smart Card Removal Policy Service - href: smart-cards/smart-card-removal-policy-service.md - - name: Smart Card Tools and Settings - href: smart-cards/smart-card-tools-and-settings.md - items: - - name: Smart Cards Debugging Information - href: smart-cards/smart-card-debugging-information.md - - name: Smart Card Group Policy and Registry Settings - href: smart-cards/smart-card-group-policy-and-registry-settings.md - - name: Smart Card Events - href: smart-cards/smart-card-events.md - - name: Virtual Smart Cards - href: virtual-smart-cards\virtual-smart-card-overview.md - items: - - name: Understanding and Evaluating Virtual Smart Cards - href: virtual-smart-cards\virtual-smart-card-understanding-and-evaluating.md - items: - - name: "Get Started with Virtual Smart Cards: Walkthrough Guide" - href: virtual-smart-cards\virtual-smart-card-get-started.md - - name: Use Virtual Smart Cards - href: virtual-smart-cards\virtual-smart-card-use-virtual-smart-cards.md - - name: Deploy Virtual Smart Cards - href: virtual-smart-cards\virtual-smart-card-deploy-virtual-smart-cards.md - - name: Evaluate Virtual Smart Card Security - href: virtual-smart-cards\virtual-smart-card-evaluate-security.md - - name: Tpmvscmgr - href: virtual-smart-cards\virtual-smart-card-tpmvscmgr.md - - name: Enterprise Certificate Pinning - href: enterprise-certificate-pinning.md - - name: Windows 10 credential theft mitigation guide abstract - href: windows-credential-theft-mitigation-guide-abstract.md - - name: Configure S/MIME for Windows 10 - href: configure-s-mime.md - - name: VPN technical guide - href: vpn\vpn-guide.md - items: - - name: VPN connection types - href: vpn\vpn-connection-type.md - - name: VPN routing decisions - href: vpn\vpn-routing.md - - name: VPN authentication options - href: vpn\vpn-authentication.md - - name: VPN and conditional access - href: vpn\vpn-conditional-access.md - - name: VPN name resolution - href: vpn\vpn-name-resolution.md - - name: VPN auto-triggered profile options - href: vpn\vpn-auto-trigger-profile.md - - name: VPN security features - href: vpn\vpn-security-features.md - - name: VPN profile options - href: vpn\vpn-profile-options.md - - name: How to configure Diffie Hellman protocol over IKEv2 VPN connections - href: vpn\how-to-configure-diffie-hellman-protocol-over-ikev2-vpn-connections.md - - name: How to use single sign-on (SSO) over VPN and Wi-Fi connections - href: vpn\how-to-use-single-sign-on-sso-over-vpn-and-wi-fi-connections.md - - name: Optimizing Office 365 traffic with the Windows 10 VPN client - href: vpn\vpn-office-365-optimization.md From 713b3a0ef9a3836c76569fa4ca671ab1c51d2660 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Thu, 19 Aug 2021 21:19:28 -0400 Subject: [PATCH 0066/1214] adding deploy section --- .../apps-in-windows-10.md | 79 ++++++++++++++++--- 1 file changed, 67 insertions(+), 12 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index ee83c505d7..0b8ebbf7c7 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -19,6 +19,16 @@ ms.topic: article > > - Windows 10 +## Before you begin + +As organizations become more global, and to support employees working from anywhere, it's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. For Microsoft, that includes using Microsoft Endpoint Manager. Endpoint Manager includes Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. + +In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: + +- [Microsoft Endpoint Manager overview](mem/endpoint-manager-overview) +- [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) +- [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) + ## App types There are different types of apps that can run on your Windows client devices. This section lists some of the common apps used on Windows devices. @@ -34,7 +44,7 @@ There are different types of apps that can run on your Windows client devices. T - **Windows Presentation Foundation (WPF)**: Using .NET, you can create a WPF desktop app that runs on the device, or create a WPF web app. This app is commonly used by organizations that create line of business (LOB) desktop apps. For more information, see [WPF Application Development](/dotnet/desktop/wpf/app-development). - **Windows Forms (WinForm)**: Using .NET, you can create a Windows Forms desktop app that runs on the device, and doesn't require a web browser or internet access. Just like Win32 apps, WinForm apps can access the local hardware and file system of the computer where the app is running. For more information, see [Desktop Guide (Windows Forms .NET)](/dotnet/desktop/winforms/overview). -- **Windows apps**: These apps are included with the Windows OS, and can also installed from the Microsoft Store. There are two categories: +- **Windows apps**: These apps are included with the Windows OS, and can also be installed from the Microsoft Store. There are two categories: - **Apps**: All apps installed in `C:\Program Files\WindowsApps`. There are two classes of apps: @@ -62,29 +72,74 @@ There are different types of apps that can run on your Windows client devices. T ## Add or deploy apps to devices -When your apps are ready, you can add or deploy these apps to your Windows devices. +When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. - **Manually install**: On your devices, users can install apps from the Microsoft Store and from the internet. These apps, and more, are listed in **Settings** > **Apps and Features**. -- **Mobile device management (MDM)**: Use a MDM provider, such as Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy and configure apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add store apps, and more. + If you want to prevent users from downloading apps on organization owned devices, you can use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10). + + For an overview of the different types of device policies you can create, see [Apply features and settings on your devices using device profiles in Microsoft Intune](/mem/intune/configuration/device-profiles). + +- **Mobile device management (MDM)**: Use a MDM provider, like Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add Store apps, and more. For more information, see: - [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) - [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) -- Settings > Apps & features: Provisioned apps, apps installed by users, and apps installed by MDM providers are listed in **Settings** > **Apps and Features**. -- Use Store -- Windows Package Manager: https://docs.microsoft.com/en-us/windows/package-manager - - Can install apps from store, or from package. It's a developer tool. - - Only for Windows +- **Microsoft Store**: Using the Microsoft Store app, Windows users can download apps from the public store, and download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **Windows Package Manager** to add apps to the private store. -- App-V: - - app-v server: might not support Win11. It's a separate download. - - app-v client: does support Win11. The OS ships with client installs. + To help manage the Microsoft Store on your devices, you can use policies: - Goal: Stop using app-v, and get on Azure Virtual desktop with msix app attach + - On premises, you can use Administrative Templates in group policy to control access to the Microsoft Store app (`User Configuration\Administrative Templates\Windows Components\Store`). + - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to control access to the Microsoft Store app. + For more information, see: + + - [Microsoft Store for Business and Education](/microsoft-store/) + - [Evolving the Microsoft Store for Business and Education](https://techcommunity.microsoft.com/t5/windows-it-pro-blog/evolving-the-microsoft-store-for-business-and-education/ba-p/2569423) + +- **MSIX for desktop apps**: MSIX packages your UWP, Win32, WPF, and WinForm desktop application files. MSIX reliably installs apps, helps optimize disk storage space, and reduces duplicate files. If your organization typically uses `.EXE` or `.MSI` files to install desktop apps, then you should look into MSIX. + + To deploy MSIX packages and their apps, you can: + + - Use an MDM provider, like Microsoft Intune and Configuration Manager. + - Use an App Installer so users double-click an installer file, or select a link on a web page. + - And more. + + For more information, see: + + - [What is MSIX?](/windows/msix/overview) + - [MSIX app distribution for enterprises](/windows/msix/desktop/managing-your-msix-deployment-enterprise) + +- **Windows Package Manager**: Windows Package Manager is a command line tool commonly used by developers to install Windows apps. Using the command line, you can can get apps from the Microsoft Store or from GitHub (and more), and install these apps on Windows devices. It's helpful if you want to bypass user interfaces for getting apps from organizations and from developers. + + If your organization uses `.EXE`, `.MSIX`, or `.MSI` files, then Windows Package Manager might be the right deployment option for your organization. + + For more information, see [Windows Package Manager](/windows/package-manager). + +- **Azure Virtual desktop with MSIX app attach**: With Azure virtual desktop, you can virtualize the Windows client OS desktop, and use virtual apps on this desktop. With MSIX app attach, you dynamically deliver MSIX packaged apps to users and user groups. + + The benefit is to use the cloud to deliver virtual apps in real time, and as-needed. Users use the apps as if they were installed locally. + + If you currently use App-V, and want to decrease your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the right deployment for your organization. + + For more information, see: + + - [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) + - [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal) + +- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps. On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they were installed locally. + + The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md). + + To help manage App-V on your devices, you can use policies: + + - On premises, you can use Administrative Templates in group policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`). + - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to deploy App-V policies. + + > [!TIP] + > If you want to decrease your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the better deployment for your organization. ## Remove apps From a5a51da7347c43c8909195e81759c2c0c8440c81 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 20 Aug 2021 12:18:50 +0530 Subject: [PATCH 0067/1214] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 08b3a83674..72d89725ad 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18952,7 +18952,7 @@ }, { "source_path": "windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md", - "redirect_url": "windows/deployment/upgrade/windows-10-edition-upgrades", + "redirect_url": "/windows/deployment/upgrade/windows-10-edition-upgrades", "redirect_document_id": false } From bbda459c7d802b16827c3b48560752a49a846289 Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 20 Aug 2021 12:20:34 +0530 Subject: [PATCH 0068/1214] Update submit-errors.md --- windows/deployment/upgrade/submit-errors.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 5fd55b947c..580a08b67c 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -32,7 +32,7 @@ This topic describes how to submit problems with a Windows 10 upgrade to Microso The Feedback Hub app lets you tell Microsoft about any problems you run in to while using Windows 10 and send suggestions to help us improve your Windows experience. Previously, you could only use the Feedback Hub if you were in the Windows Insider Program. Now anyone can use this tool. You can download the Feedback Hub app from the Microsoft Store [here](https://www.microsoft.com/store/p/feedback-hub/9nblggh4r32n?SilentAuth=1&wa=wsignin1.0). -The Feedback Hub requires Windows 10. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous verion of Windows 10, the Feedback Hub will collect log files automatically. +The Feedback Hub requires Windows 10. If you are having problems upgrading from an older version of Windows to Windows 10, you can use the Feedback Hub to submit this information, but you must collect the log files from the legacy operating system and then attach these files to your feedback using a device that is running Windows 10. If you are upgrading to Windows 10 from a previous version of Windows 10, the Feedback Hub will collect log files automatically. ## Submit feedback From 763d18503169e7b902e943b740e9d2e610375e9c Mon Sep 17 00:00:00 2001 From: Siddarth Mandalika Date: Fri, 20 Aug 2021 12:25:20 +0530 Subject: [PATCH 0069/1214] Update .openpublishing.redirection.json --- .openpublishing.redirection.json | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 72d89725ad..baa458ee02 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -18950,12 +18950,7 @@ "redirect_url": "/windows/privacy/windows-10-and-privacy-compliance", "redirect_document_id": false }, - { - "source_path": "windows/deployment/upgrade/upgrade-windows-phone-8-1-to-10.md", - "redirect_url": "/windows/deployment/upgrade/windows-10-edition-upgrades", - "redirect_document_id": false - } - + ] } From 5ee4bf7891b3ddd8162fd6fb4f8fbd5d0ad49926 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Fri, 20 Aug 2021 13:49:21 +0530 Subject: [PATCH 0070/1214] Windows 11 Inclusion I've included and updated the files under (windows-docs-pr\windows\configuration\cortana-at-work) with Windows 11 wherever necessary. --- .../cortana-at-work/cortana-at-work-crm.md | 2 +- .../cortana-at-work/cortana-at-work-overview.md | 13 ++++++++----- .../cortana-at-work-policy-settings.md | 16 ++++++++-------- .../cortana-at-work/cortana-at-work-powerbi.md | 10 +++++----- .../cortana-at-work-scenario-2.md | 2 +- .../cortana-at-work-scenario-3.md | 2 +- .../cortana-at-work-scenario-4.md | 2 +- .../cortana-at-work-scenario-5.md | 2 +- .../cortana-at-work-scenario-6.md | 2 +- .../cortana-at-work-scenario-7.md | 2 +- .../cortana-at-work-voice-commands.md | 2 +- .../set-up-and-test-cortana-in-windows-10.md | 2 +- .../cortana-at-work/test-scenario-4.md | 2 +- .../cortana-at-work/test-scenario-5.md | 2 +- 14 files changed, 32 insertions(+), 29 deletions(-) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index e8a0cdee55..45deb89f54 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -1,5 +1,5 @@ --- -title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows 10) +title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows) description: How to set up Cortana to give salespeople insights on important CRM activities, including sales leads, accounts, and opportunities. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index 5d25f337c9..140f54edf4 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -1,5 +1,5 @@ --- -title: Configure Cortana in Windows 10 +title: Configure Cortana in Windows 10 and Windows 11 ms.reviewer: manager: dansimp description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. @@ -11,11 +11,11 @@ ms.localizationpriority: medium ms.author: greglin --- -# Configure Cortana in Windows 10 +# Configure Cortana in Windows 10 and Windows 11 ## Who is Cortana? -Cortana is a personal productivity assistant in Microsoft 365, helping your users achieve more with less effort and focus on what matters. The Cortana app in Windows 10 helps users quickly get information across Microsoft 365, using typed or spoken queries to connect with people, check calendars, set reminders, add tasks, and more. +Cortana is a personal productivity assistant in Microsoft 365, helping your users achieve more with less effort and focus on what matters. The Cortana app in Windows 10 and Windows 11 helps users quickly get information across Microsoft 365, using typed or spoken queries to connect with people, check calendars, set reminders, add tasks, and more. :::image type="content" source="../screenshot1.png" alt-text="Screenshot: Cortana home page example"::: @@ -38,6 +38,9 @@ Cortana requires a PC running Windows 10, version 1703 or later, as well as the |Azure Active Directory (Azure AD) | While all employees signing into Cortana need an Azure AD account, an Azure AD premium tenant isn't required. | |Additional policies (Group Policy and Mobile Device Management (MDM)) |There is a rich set of policies that can be used to manage various aspects of Cortana. Most of these policies will limit the abilities of Cortana but won't turn Cortana off. For example, if you turn **Speech** off, your employees won't be able to use the wake word ("Cortana") for hands-free activation or voice commands to easily ask for help. | +>[!NOTE] +>For Windows 11, Cortana is no longer pinned to the taskbar by default. You can still pin the Cortana app to the taskbar as you would any other app. In addition, the keyboard shortcut that launched Cortana (Win+C) no longer opens Cortana. + ## Signing in using Azure AD Your organization must have an Azure AD tenant and your employees' devices must all be Azure AD-joined for the best Cortana experience. (Users may also sign into Cortana with a Microsoft account, but will not be able to use their enterprise email or calendar.) For info about what an Azure AD tenant is, how to get your devices joined, and other Azure AD maintenance info, see [Azure Active Directory documentation.](/azure/active-directory/) @@ -46,9 +49,9 @@ Your organization must have an Azure AD tenant and your employees' devices m Cortana's approach to integration with Microsoft 365 has changed with Windows 10, version 2004 and later. -### Cortana in Windows 10, version 2004 and later +### Cortana in Windows 10, version 2004 and later, or Windows 11 -Cortana enterprise services that can be accessed using Azure AD through Cortana in Windows 10, version 2004 and later, meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365). +Cortana enterprise services that can be accessed using Azure AD through Cortana in Windows 10, version 2004 and later, or Windows 11, meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365). #### How does Microsoft store, retain, process, and use Customer Data in Cortana? diff --git a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md index 2d82042faa..a43fafd84b 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-policy-settings.md @@ -1,5 +1,5 @@ --- -title: Configure Cortana with Group Policy and MDM settings (Windows 10) +title: Configure Cortana with Group Policy and MDM settings (Windows) description: The list of Group Policy and mobile device management (MDM) policy settings that apply to Cortana at work. ms.prod: w10 ms.mktglfcycl: manage @@ -25,10 +25,10 @@ manager: dansimp > Cortana won’t work if this setting is turned off (disabled). However, on Windows 10, version 1809 and below, employees can still perform local searches even with Cortana turned off. | |Computer Configuration\Administrative Templates\Windows Components\Search\AllowCortanaAboveLock |AboveLock/AllowCortanaAboveLock |Specifies whether an employee can interact with Cortana using voice commands when the system is locked.
> [!NOTE] -> Cortana in Windows 10, versions 2004 and later do not currently support Above Lock. | +> Cortana in Windows 10, versions 2004 and later, or Windows 11 do not currently support Above Lock. | |Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsActivateWithVoice |[Privacy/LetAppsActivateWithVoice](/windows/client-management/mdm/policy-csp-privacy#privacy-letappsactivatewithvoice) |Specifies whether apps (such as Cortana or other voice assistants) can activate using a wake word (e.g. “Hey Cortana”).
> [!NOTE] -> This setting only applies to Windows 10 versions 2004 and later. To disable wake word activation on Windows 10 versions 1909 and earlier, you will need to disable voice commands using Privacy/AllowInputPersonalization. | +> This setting only applies to Windows 10 versions 2004 and later, or Windows 11. To disable wake word activation on Windows 10 versions 1909 and earlier, you will need to disable voice commands using Privacy/AllowInputPersonalization. | |Computer Configuration\Administrative Templates\Windows Components\App Privacy\LetAppsAccessMicrophone |[Privacy/LetAppsAccessMicrophone_ForceDenyTheseApps](/windows/client-management/mdm/policy-csp-privacy#privacy-letappsaccessmicrophone-forcedenytheseapps) | Use this to disable Cortana’s access to the microphone. To do so, specify Cortana’s Package Family Name: Microsoft.549981C3F5F10_8wekyb3d8bbwe
Users will still be able to type queries to Cortana. | |Computer Configuration\Administrative Templates\Control Panel\Regional and Language Options\Allow users to enable online speech recognition services |Privacy/AllowInputPersonalization |Specifies whether an employee can use voice commands with Cortana in your organization.
@@ -38,15 +38,15 @@ Users will still be able to type queries to Cortana. | **In Windows 10, version 1607 and later**
Cortana still works if this setting is turned off (disabled).
**In Windows 10, version 2004 and later**
-Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later do not currently use the Location service. | +Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, or Windows 11 do not currently use the Location service. | |None |Accounts/AllowMicrosoftAccountConnection |Specifies whether to allow employees to sign in using a Microsoft account (MSA) from Windows apps.
Disable this setting if you only want to allow users to sign in with their Azure AD account. | |Computer Configuration\Administrative Templates\Windows Components\Search\Allow search and Cortana to use location |Search/AllowSearchToUseLocation |Specifies whether Cortana can use your current location during searches and for location reminders.
-**In Windows 10, version 2004 and later**
Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, do not currently use the Location service. | +**In Windows 10, version 2004 and later**
Cortana still works if this setting is turned off (disabled). Cortana in Windows 10, versions 2004 and later, or Windows 11, do not currently use the Location service. | |Computer Configuration\Administrative Templates\Windows Components\Search\Don't search the web or display web results |Search/DoNotUseWebResults |Specifies whether search can perform queries on the web and if the web results are displayed in search.
-**In Windows 10 Pro edition**
This setting can’t be managed. -**In Windows 10 Enterprise edition**
Cortana won't work if this setting is turned off (disabled). -**In Windows 10, version 2004 and later**
This setting no longer affects Cortana. | +**In Windows 10 Pro edition**
This setting can’t be managed.
+**In Windows 10 Enterprise edition**
Cortana won't work if this setting is turned off (disabled).
+**In Windows 10, version 2004 and later**
This setting no longer affects Cortana.
| |Computer Configuration\Administrative Templates\Windows Components\Search\Set the SafeSearch setting for Search |Search/SafeSearchPermissions |Specifies what level of safe search (filtering adult content) is required.
> [!NOTE] > This setting only applies to Windows 10 Mobile. Other versions of Windows should use Don't search the web or display web results. | \ No newline at end of file diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 65919eb8e8..1ddfd0c705 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -1,5 +1,5 @@ --- -title: Set up and test Cortana for Power BI in your organization (Windows 10) +title: Set up and test Cortana for Power BI in your organization (Windows) description: How to integrate Cortana with Power BI to help your employees get answers directly from your key business data. ms.prod: w10 ms.mktglfcycl: manage @@ -25,7 +25,7 @@ Integration between Cortana and Power BI shows how Cortana can work with custom ## Before you begin To use this walkthrough, you’ll need: -- **Windows 10**. You’ll need to be running at least Windows 10, version 1703. +- **Windows 10 or Windows 11**. You’ll need your PC to be running at least Windows 10, version 1703 or later, or Windows 11. - **Cortana**. You need to have Cortana turned on and be logged into your account. @@ -79,7 +79,7 @@ Before you can start this testing scenario, you must first set up your test envi ![Cortana at work, showing where to find the dataset options](../images/cortana-powerbi-retail-analysis-dataset.png) >[!NOTE] - >It can take up to 30 minutes for a new dataset to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately.

If you enable a dataset for Cortana, and that dataset is part of a content pack you own, you’ll need to re-publish for your colleagues to also use it with Cortana. + >It can take up to 30 minutes for a new dataset to appear for Power BI and Cortana. Logging in and out of Windows, or otherwise restarting Cortana, causes the new content to appear immediately.

If you enable a dataset for Cortana, and that dataset is part of a content pack you own, you’ll need to re-publish for your colleagues to also use it with Cortana. ## Create a custom Answer Page for Cortana You must create special reports, known as _Answer Pages_, to display the most commonly asked answers in Cortana. For example, if you want Cortana to quickly show sales data to your employees, you can create a 2016 sales data Answer Page that shows sales data, with various pivots, in Cortana. @@ -87,7 +87,7 @@ You must create special reports, known as _Answer Pages_, to display the most co After you’ve finished creating your Answer Page, you can continue to the included testing scenarios. >[!NOTE] ->It can take up to 30 minutes for a custom Answer Page to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately. +>It can take up to 30 minutes for a custom Answer Page to appear for Power BI and Cortana. Logging in and out of Windows, or otherwise restarting Cortana, causes the new content to appear immediately. **To create a custom sales data Answer Page for Cortana** 1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. @@ -116,7 +116,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu 6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. - Because this is part of the Retail Analysis Sample, it will automatically be included as part of the dataset you included for Cortana. However, you will still need to log in and out of Windows 10, or otherwise restart Cortana, before the new content appears. + Because this is part of the Retail Analysis Sample, it will automatically be included as part of the dataset you included for Cortana. However, you will still need to log in and out of Windows, or otherwise restart Cortana, before the new content appears. ## Test Scenario: Use Cortana to show info from Power BI in your organization Now that you’ve set up your device, you can use Cortana to show your info from within Power BI. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index 33ac963a8e..dab5bf883a 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -1,5 +1,5 @@ --- -title: Perform a quick search with Cortana at work (Windows 10) +title: Perform a quick search with Cortana at work (Windows) description: A test scenario about how to perform a quick search with Cortana at work. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md index b3c72fad56..23981c8033 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-3.md @@ -1,5 +1,5 @@ --- -title: Set a reminder for a location with Cortana at work (Windows 10) +title: Set a reminder for a location with Cortana at work (Windows) description: A test scenario about how to set a location-based reminder using Cortana at work. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index f5377cf7c3..b5784100ce 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -1,5 +1,5 @@ --- -title: Use Cortana at work to find your upcoming meetings (Windows 10) +title: Use Cortana at work to find your upcoming meetings (Windows) description: A test scenario about how to use Cortana at work to find your upcoming meetings. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index a434e14f90..a2cefc5ce3 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -1,5 +1,5 @@ --- -title: Use Cortana to send email to a co-worker (Windows 10) +title: Use Cortana to send email to a co-worker (Windows) description: A test scenario about how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index 9abb865b58..003caaecc7 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -1,5 +1,5 @@ --- -title: Review a reminder suggested by Cortana (Windows 10) +title: Review a reminder suggested by Cortana (Windows) description: A test scenario about how to use Cortana with the Suggested reminders feature. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md index 5b6970f37b..b69ff5bdc1 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-7.md @@ -1,5 +1,5 @@ --- -title: Help protect data with Cortana and WIP (Windows 10) +title: Help protect data with Cortana and WIP (Windows) description: An optional test scenario about how to use Cortana at work with Windows Information Protection (WIP). ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index 478aeb7938..89d7c3aa0b 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -1,5 +1,5 @@ --- -title: Set up and test custom voice commands in Cortana for your organization (Windows 10) +title: Set up and test custom voice commands in Cortana for your organization (Windows) description: How to create voice commands that use Cortana to perform voice-enabled actions in your line-of-business (LOB) Universal Windows Platform (UWP) apps. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md index addf307b70..06ff6a75f4 100644 --- a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -15,7 +15,7 @@ ms.author: greglin ## Before you begin -- If your enterprise had previously disabled Cortana for your employees using the **Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana** Group Policy or the **Experience\AllowCortana** MDM setting but want to enable it now that Cortana is part of Microsoft 365, you will need to re-enable it at least for Windows 10, version 2004 and later. +- If your enterprise had previously disabled Cortana for your employees using the **Computer Configuration\Administrative Templates\Windows Components\Search\Allow Cortana** Group Policy or the **Experience\AllowCortana** MDM setting but want to enable it now that Cortana is part of Microsoft 365, you will need to re-enable it at least for Windows 10, version 2004 and later, or Windows 11. - **Cortana is regularly updated through the Microsoft Store.** Beginning with Windows 10, version 2004, Cortana is an appx preinstalled with Windows and is regularly updated through the Microsoft Store. To receive the latest updates to Cortana, you will need to [enable updates through the Microsoft Store](../stop-employees-from-using-microsoft-store.md). ## Set up and configure the Bing Answers feature diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md index b15cd265db..74ca02298f 100644 --- a/windows/configuration/cortana-at-work/test-scenario-4.md +++ b/windows/configuration/cortana-at-work/test-scenario-4.md @@ -1,5 +1,5 @@ --- -title: Use Cortana at work to find your upcoming meetings (Windows 10) +title: Use Cortana at work to find your upcoming meetings (Windows) description: A test scenario about how to use Cortana at work to find your upcoming meetings. ms.prod: w10 ms.mktglfcycl: manage diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md index 3dabe7811b..e798d2260a 100644 --- a/windows/configuration/cortana-at-work/test-scenario-5.md +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -1,5 +1,5 @@ --- -title: Use Cortana to send email to a co-worker (Windows 10) +title: Use Cortana to send email to a co-worker (Windows) description: A test scenario about how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage From f8d10fdcd5a4c3984b0ef6e46029d83089ab9828 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Fri, 20 Aug 2021 10:09:27 -0600 Subject: [PATCH 0071/1214] dh-word-choice --- .../demonstrate-deployment-on-vm.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index f41d64d23e..3f1ace4736 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -2,7 +2,7 @@ title: Demonstrate Autopilot deployment ms.reviewer: manager: laurawi -description: In this article, find step-by-step instructions on how to set-up a Virtual Machine with a Windows Autopilot deployment. +description: In this article, find step-by-step instructions on how to set up a Virtual Machine with a Windows Autopilot deployment. keywords: mdm, setup, windows, windows 10, oobe, manage, deploy, autopilot, ztd, zero-touch, partner, msfb, intune, upgrade ms.prod: w10 ms.mktglfcycl: deploy @@ -27,7 +27,7 @@ ms.custom: To get started with Windows Autopilot, you should try it out with a virtual machine (VM) or you can use a physical device that will be wiped and then have a fresh install of Windows 10. -In this topic you'll learn how to set-up a Windows Autopilot deployment for a VM using Hyper-V. +In this topic, you'll learn how to set up a Windows Autopilot deployment for a VM using Hyper-V. > [!NOTE] > Although there are [multiple platforms](/mem/autopilot/add-devices#registering-devices) available to enable Autopilot, this lab primarily uses Intune. @@ -248,7 +248,7 @@ Ensure the VM booted from the installation ISO, select **Next** then select **In ![Windows setup example 6](images/winsetup6.png) -After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: +After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This offers the fastest way to the desktop. For example: ![Windows setup example 7](images/winsetup7.png) @@ -363,7 +363,7 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. -To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. +To convert your Intune trial account to a free Premium trial account, go to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. ![License conversion option](images/aad-lic1.png) @@ -374,7 +374,7 @@ If you already have company branding configured in Azure Active Directory, you c > [!IMPORTANT] > Make sure to sign-in with a Global Administrator account. -Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), select **Configure** and configure any type of company branding you'd like to see during the OOBE. +Go to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), select **Configure**, and then configure any type of company branding you'd like to see during the OOBE. ![Configure company branding](images/branding.png) @@ -478,7 +478,7 @@ The Autopilot deployment profile wizard will ask for a device group, so we must #### Create the deployment profile -To create a Windows Autopilot profile, scroll back to the left hand pane and select **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. +To create a Windows Autopilot profile, scroll back to the left-side pane and select **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. > [!div class="mx-imgBorder"] > ![Deployment profiles](images/dp.png) @@ -612,7 +612,7 @@ To use the device (or VM) for other purposes after completion of this lab, you w ### Delete (deregister) Autopilot device -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu. +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then go to **Intune > Devices > All Devices**. Select the device you want to delete, then select the **Delete** button along the top menu. > [!div class="mx-imgBorder"] > ![Delete device step 1](images/delete-device1.png) @@ -633,7 +633,7 @@ At this point, your device has been unenrolled from Intune and also deregistered Once the device no longer appears, you're free to reuse it for other purposes. -If you also (optionally) want to remove your device from AAD, navigate to **Azure Active Directory > Devices > All Devices**, select your device, and then select the **Delete** button: +If you also (optionally) want to remove your device from AAD, go to **Azure Active Directory > Devices > All Devices**, select your device, and then select the **Delete** button: ## Appendix A: Verify support for Hyper-V @@ -703,7 +703,7 @@ After the tool finishes running, you should have an .intunewin file in the Outpu Log into the Azure portal and select **Intune**. -Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. +Go to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. ![Add app step 1](images/app02.png) @@ -732,7 +732,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q ![Add app step 5](images/app06.png) -Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). +Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have a .msi version of their program, but we got a .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). Select **OK** to save your input and activate the **Requirements** blade. @@ -818,7 +818,7 @@ For more information on adding apps to Intune, see [Intune Standalone - Win32 ap Log into the Azure portal and select **Intune**. -Navigate to **Intune > Clients apps > Apps**, and then select the **Add** button to create a new app package. +Go to **Intune > Clients apps > Apps**, and then select the **Add** button to create a new app package. ![Create app step 1](images/app17.png) @@ -826,7 +826,7 @@ Under **App Type**, select **Office 365 Suite > Windows 10**: ![Create app step 2](images/app18.png) -Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: +Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this lab we have only selected Excel: > [!div class="mx-imgBorder"] > ![Create app step 3](images/app19.png) From 75db81999f8d478c61fc1040c0e89f86f0b557a4 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 12:39:57 -0700 Subject: [PATCH 0072/1214] wds info --- windows/deployment/TOC.yml | 18 ++- .../deployment/planning/features-lifecycle.md | 16 ++- .../windows-11-deprecated-features.md | 29 +++++ .../planning/windows-11-removed-features.md | 30 +++++ windows/deployment/wds-boot-support.md | 111 ++++++++++++++++++ 5 files changed, 194 insertions(+), 10 deletions(-) create mode 100644 windows/deployment/planning/windows-11-deprecated-features.md create mode 100644 windows/deployment/planning/windows-11-removed-features.md create mode 100644 windows/deployment/wds-boot-support.md diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 048a630323..ac5cfe9aac 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -62,12 +62,20 @@ href: volume-activation/plan-for-volume-activation-client.md - name: Features removed or planned for replacement items: - - name: Windows 10 features lifecycle + - name: Windows client features lifecycle href: planning/features-lifecycle.md - name: Features we're no longer developing - href: planning/windows-10-deprecated-features.md + items: + - name: Windows 10 deprecated features + href: planning/windows-10-deprecated-features.md + - name: Windows 11 deprecated features + href: planning/windows-11-deprecated-features.md - name: Features we removed - href: planning/windows-10-removed-features.md + items: + - name: Windows 10 features removed + href: planning/windows-10-removed-features.md + - name: Windows 11 features removed + href: planning/windows-11-removed-features.md - name: Prepare items: @@ -287,8 +295,10 @@ href: windows-10-pro-in-s-mode.md - name: Windows 10 deployment tools items: - - name: Windows 10 deployment scenarios and tools + - name: Windows client deployment scenarios and tools items: + - name: Windows Deployment Services (WDS) image deployment + href: wds-boot-support.md - name: Convert MBR partition to GPT href: mbr-to-gpt.md - name: Configure a PXE server to load Windows PE diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/deployment/planning/features-lifecycle.md index 333be6284a..50c8adb217 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/deployment/planning/features-lifecycle.md @@ -1,5 +1,5 @@ --- -title: Windows 10 features lifecycle +title: Windows client features lifecycle description: Learn about the lifecycle of Windows 10 features, as well as features that are no longer developed, removed features, and terminology assigned to a feature. ms.prod: w10 ms.mktglfcycl: plan @@ -14,21 +14,25 @@ ms.custom: seo-marvel-apr2020 --- # Windows 10 features lifecycle -- Applies to: Windows 10 +Applies to: +- Windows 10 +- Windows 11 -Each release of Windows 10 contains many new and improved features. Occasionally we also remove features and functionality, usually because there is a better option. +Each release of Windows 10 and Windows 11 contains many new and improved features. Occasionally we also remove features and functionality, usually because there is a better option. ## Features no longer being developed The following topic lists features that are no longer being developed. These features might be removed in a future release. -[Windows 10 features we're no longer developing](windows-10-deprecated-features.md) +[Windows 10 features we're no longer developing](windows-10-deprecated-features.md)
+[Windows 11 features we're no longer developing](windows-11-deprecated-features.md) ## Features removed -The following topic has details about features that have been removed from Windows 10. +The following topic has details about features that have been removed from Windows 10 or Windows 11. This includes features that are present in Windows 10, but are removed in Windows 11. -[Windows 10 features we removed](windows-10-removed-features.md) +[Windows 10 features we removed](windows-10-removed-features.md)
+[Windows 11 features we removed](windows-11-removed-features.md) ## Terminology diff --git a/windows/deployment/planning/windows-11-deprecated-features.md b/windows/deployment/planning/windows-11-deprecated-features.md new file mode 100644 index 0000000000..ab1098d47a --- /dev/null +++ b/windows/deployment/planning/windows-11-deprecated-features.md @@ -0,0 +1,29 @@ +--- +title: Windows 11 features we’re no longer developing +description: Review the list of features that are no longer being developed in Windows 11 +ms.prod: w11 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.topic: article +--- +# Windows 10 features we’re no longer developing + +> Applies to: Windows 11 + +Each version of Windows 10 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that are no longer being developed in Windows 10. For information about features that have been removed, see [Features we removed](windows-10-removed-features.md). + +The features described below are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. + +**The following list is subject to change and might not include every affected feature or functionality.** + +> [!NOTE] +> If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). + +|Feature | Details and mitigation | Announced in version | +| ----------- | --------------------- | ---- | +| Internet Explorer (IE) 11 | The IE11 desktop application will end support for certain operating systems starting June 15, 2022. For more information, see [Internet Explorer 11](/lifecycle/products/internet-explorer-11). | 21H1 | \ No newline at end of file diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md new file mode 100644 index 0000000000..34cd47b43c --- /dev/null +++ b/windows/deployment/planning/windows-11-removed-features.md @@ -0,0 +1,30 @@ +--- +title: Windows 11 - Features that have been removed +description: In this article, learn about the features and functionality that has been removed or replaced in Windows 10. +ms.prod: w11 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Features and functionality removed in Windows 11 + +> Applies to: Windows 11 + +Windows 11 adds new features and functionality; however some features are removed. Below is a summary of features and functionalities that are present in earlier versions of Windows 10/11, but are removed in the specified versions of Windows 11. **The list below is subject to change and might not include every affected feature or functionality.** + +> [!NOTE] +> Join the [Windows Insider program](https://insider.windows.com) to get early access to new Windows 11 builds and test these changes yourself. + +The following features and functionalities have been removed from the installed product image for Windows 11. Applications or code that depend on these features won't function in the release when it was removed, or in later releases. + +|Feature | Details and mitigation | Removed in version | +| ----------- | --------------------- | ------ | +| WDS image deployment | End to end WDS deployment workflows that use boot.wim from installation media are affected. For more information, see [WDS boot image support](wds-boot-support.md) | Windows 11 | + diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md new file mode 100644 index 0000000000..644071fbfa --- /dev/null +++ b/windows/deployment/wds-boot-support.md @@ -0,0 +1,111 @@ +--- +title: Windows Deployment Services (WDS) boot.wim support +description: This article provides details on the support capabilities of WDS for end to end operating system deployment. +ms.prod: w11 +ms.mktglfcycl: plan +ms.localizationpriority: medium +ms.sitesec: library +audience: itpro +author: greg-lindsay +ms.author: greglin +manager: laurawi +ms.topic: article +ms.custom: seo-marvel-apr2020 +--- + +# Windows Deployment Services (WDS) boot.wim support + +Applies to: +- Windows 10 +- Windows 11 + +The operating system deployment functionality of [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831764(v=ws.11)) (WDS) is being partically deprecated. Starting with Windows 11, workflows that rely on boot.wim from installation media and/or on running Setup.exe in WDS mode will no longer be supported. + +When you PXE-boot from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. The following message will be displayed in this scenario: + +![WDS deprecation notice](images/wds-deprecation.png) + +## Deployment scenarios impacted + +See the following table for a summary of the impacted deployment scenarios. + + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
       Windows 10Windows Server 2016Windows Server 2019Windows Server 2022Windows Windows 11
Boot image version
Windows 10Supported, using a boot image from matching or newer version.Supported, using a boot image from Windows 10, version 1607 or later.Supported, using a boot image from Windows 10, version 1809 or later.Not supported.Not supported.
Windows Server 2016Supported, using a boot image from Windows 10, version 1607 or later.Supported.Not supported.Not supported.Not supported.
Windows Server 2019Supported, using a boot image from Windows 10, version 1809 or later.Supported.Supported.Not supported.Not supported.
Windows Server 2022Deprecated, with a warning message.Deprecated, with a warning message.Deprecated, with a warning message.Deprecated, with a warning message.Not supported.
Windows 11Not supported, blocked.Not supported, blocked.Not supported, blocked.Not supported, blocked.Not supported, blocked.
+ +## What is not impacted + +WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with a custom boot images, but you will no longer be able to use boot.wim as the boot image and run Windows Setup in WDS mode. + +You can still run Windows Setup from a network share. Workflows that leverage a custom boot.wim, such as MDT or Configuration Manager are also not affected by this change. + +## Reason for the change + +Alternatives to WDS, such as Configuration Manager and MDT provide a better, more flexible, and feature-rich experince for deploying Windows images. + +## Summary + +- Windows 11 workflows that rely on boot.wim from installation media will be blocked. You cannot perform an end to end deployment of Windows 11 using only WDS. +- Windows 10, Windows Server 2019, and previous operating system versions are not affected by this change. +- Windows Server 2022 workflows that rely on boot.wim from installation media will show a non-blocking deprecation notice that can be dismissed, but the workflow is not blocked. +- Windows Server workflows after Windows Server 2022 that rely on boot.wim from installation media will be blocked. + +If you currently use WDS with boot.wim from installation media for end-to-end operating system deployment, and your OS version is not supported, deprecated, or blocked, you can use other deployment tools, such as Microsoft Deployment Toolkit (MDT), Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. + +## Also see + +[Create a custom Windows PE boot image with Configuration Manager](deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
+[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) \ No newline at end of file From fee1a223340b6bbb231df6ff58b2c76028640a89 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 13:05:53 -0700 Subject: [PATCH 0073/1214] draft --- windows/deployment/TOC.yml | 2 +- windows/deployment/images/wds-deprecation.png | Bin 0 -> 66966 bytes .../planning/windows-11-deprecated-features.md | 7 ++++--- .../planning/windows-11-removed-features.md | 6 +++--- 4 files changed, 8 insertions(+), 7 deletions(-) create mode 100644 windows/deployment/images/wds-deprecation.png diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index b62f364080..1923bd541b 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -297,7 +297,7 @@ items: - name: Windows client deployment scenarios and tools items: - - name: Windows Deployment Services (WDS) image deployment + - name: WWindows Deployment Services (WDS) boot.wim support href: wds-boot-support.md - name: Convert MBR partition to GPT href: mbr-to-gpt.md diff --git a/windows/deployment/images/wds-deprecation.png b/windows/deployment/images/wds-deprecation.png new file mode 100644 index 0000000000000000000000000000000000000000..2c6b02022ef5de54fedd422e3846fc1cb5f09447 GIT binary patch literal 66966 zcmdqI1#DbhuqNol%*<@J*@@j|rZ%*hF=lqmF*7q`%#5*PcFfGo%*^bVVeUI8^_a9hHpCmx%6kTuE+eg_NDgEvhwvGHm3iB*Z-1@<$uBJ zf6eB<66s%Q{xh4UtIwIf>hh&f&bAwVXM`M^fr|N)O6stvXF6;o&^h))hx5cCG{gbC zXa0h*u=32PV@FuWM(CYqBAq87+P)Q0q*CL^H2xvSk9K_`;KDUT1T!2jyb|Icm4P;_7?w)kYWh%l|M>PYft{=Mn;@(2@X z?p)_`CITEljsp1j83;p>B10~Og60gFw8i{O?X>VGsSdA;gr*z!kK-TJUJGi=fXQNI z2}h*8u9Iu>{cn^*v>3Bj@GL=CGvAS}G%$31;GhflTwTWb0AQhZyEXMHH)Ue#j#i|K zM^=}j5gu5yum$pz0}vm6;R{N79QZR3W1X-&_6{tL_%B8H5Nd+~ly+1`hs)JO3^=0$ zFD_=AY0{s?=kADA9_SuQBKYkR7!{fl*xMS6m&z4~MC5h7V#sEkb{V6Q!=rHy$4J#3Lj6vJcIzWdhj0gOI zAiY+C6_?q33q7=~?6(K?hUQj-#y0z2+VTjBFuZ~p-9}Ng>4MJ|Q?UK})8E9y4ZlWF zI%KzbPk%nS&#tevf48)6Fg4qG+lXjk=Ow&<*IoU&wAA>1zil&i&Wi6spz8uRWQ-;( zFK}nG67l0_(&0uE=l0wf9DwgqtTc1ybK{OpqY+Zkb0FfCE5YwDK(g(6^cGDkLJxSNBkXYf+TZToqX%uJClb^b} ztE>K{hkKz5DmHE=A^LNP0e_KlU1n72buZlSS?(-p&KDwZ@DECo`3Y<8#9R9SU0nG{ z%vYQT1nH_;y5KOxJ=l6&^17~l+K@SP;3+74c1&0}+vp`ts>%LxvExV7B)RehP*JeLa?!dws# zNelN4m*C7ORGHq)7PMSw20NU0UaL;N@P8Zh{-@9WKM8vO(`Wxv?EIf>{;L4`|K9aO ze$AZtpeEJFG%p0m1wm`DAAm+vnLiwm@FF;^aO9?VcFT9?$i{6WTA==}U5PTLh}549 z(#Rk|;5Ag1Mq*;p4KK54f-cT?gTr~m+J$n7sm?C0_mPF1Z+ehnFm7G_s=ShTX_9z#-J5<4nW*Yg&)9Xg ztioG{qe*Hwo{VZ!j{wUCH8h397IH51Yf2@4;lvM0|{3?e$c*KyV$;@jP7qoPQQF=yCSPN@neqpK167$?($F6)kF|E##|ftGx>9-%ux6f$D_1aqg> z&`F5gRd2CZQOCPDsK13|Fz5gmz|sS!|j{p2bWShnrsK3sBWx9u5xKT)9jqGGp>XNP>-3p>`*sLgesN-fqYdEg!6*9G|vYTZhS zY*;8QG^Kv3JL0oEjM*2VPWx-wZvj#PR1 ze>a7R6cV+ZsuO?apD~9#@H2DYWd#9saaXUUpA$Lq3cwk+QvK!Sv>fPkZPE7As*{k+ zDvDt&8LKk_Z+mmt2es?c+~Y9xdN)EHseE`TT!08AySu2t>@W#8CAmGZm{uzAXUx<+~>>S8px48KderBNS>lTR2MZtAFSH3Hlq;uNzRxV zT+ia;bzO35dr(n${Mw#txe(R!fd~r2YNb2o50)nA7V3^8N3uVDFnvHjp2i$;xe!}0 ziXPb0dxoLEQ&o~sV6xU$jdO-3C@BIX71W6$mE3BJHytGf3e?V~qZ}|ya_p{Y2mPrm z7bX8BtCuoVQ7-`ygr_9x3;b}BanVPi0_HHV0PBfd7qJ}0Wbfr@9mAmr;sxUMO`Oa; z*%&j4I(kxv0HH4^#8zB8;>poUNfsfc~57iYNb%4%PK*|1xfeR&{KzxJ-ona}hr(4u5o)Fu%-wJW@ z6?y-&zXDvC24$bV2^C$!z>+b6yes-3lPJgm+jE_31b|$*F>nbKu)JrqfD|(TrZ8(I ze}(7lzPRrhshQ3t{ZVWVK(b{P(rh&kqn+3-0B8#&SAZ%GN3g2XcSHNSg7fNjz+$L6c}fxifrYbg^(#-!4P z#f85b9+E*07Vx;#OIGog(2Y$%qvm6#M0B_6f*11h-32IPxA!K~cI{i4G%Sat73&$> z*OlE)a^yPBrYS2O8~29^ylO@|kxxycLr(FGk>-ri{@r}N>?=&a4J167Os!Kw!uzFW z=jU@gLdKEOMY(Xq?Cm9b^ML?m*-KXhjR$XfXY|Yh#b)?@i7OgSF5MprF=~+h1(E{s zp*)-zrEu|Gcptk^gjNwnCHYD+FtbD&6X2mVE+xnI+sc{yG38^|B>g-zr-tA(vk~J; zz7MAzx#pMHMw4~q1U^c2T_9FNK|0d>HVkrWgI_*jRf{Lbm6YHCV^GEmDN)a-7`pqB z-H100!s%EM0fUkE_bB5428Q78D*+0+B!;6NfZ+CQ)&;(Ej9gRa?8z^-Muj zqt~kLJoT)757S@m%9S!P?uMGH`Uxz{tM_ME)8ME}PH#lKPdC2!S%2Z&KFp66vIc!} z!ov1uhI1irE!TvRO3Y#r`vb9#&omipWLjPs`O+{C!M7F= zsxvNLCK?0t&bOyb0FDmYH+$2p@O)}TTQy{a9RS{_B^R17BZ(;45h$0zzi}X-j4SjxiHFbC*7xvlZii!C5l^YjAC@>24QsbSr!ThPEvaO)4fEz6R<_i zg;xtO2{ocm@IR69-~`%@UUpsDDU~e15nXY+pFB{vu^a?WBn0DhmGW^*7NQi4PX%&) z?e~$>Wv`?89nzenek5_kNDTZLR<7%3De{vUUXCcg)%_--%KQwbeB&3aUi%w$qRW|Z zn~LrFC1E!NM)2%Agn>fQb{2EIZl*`3C|{-!MW@WK8-vwev&+SZn9Zu4=>9@nUH?K- z#{T}Mva8<_?cu)HobkO5sy(QtV^0KZikVHP{9`MU*Ex@JNrq4u=4}aZX z+-hYtH2hNwI+#6&M=K^lo)?=Kvd{dhg?K)1m&iTk;PlmiMkwP_$wZWfEdP4;)#qq| zBnzj>ufhmdRUDy3u`*|%xIrN!f?Q8E0AfWooqygoMV;vF57^KFNVtb#O+Nq@fWkr^ zvHOY|3pY9MN8Sf{{@*OWE>`_(KXaiTWV=vMd_o5IuEISbqRXFM&6hRCqhc;rXITD{-yC^GjnI0pW1N!)LNwYgdkdFSqfIGSqgXEw3>!U1 z5}E!OF2HRk^oLcg<9oxALzqeomvk#DYhb9AmRxo!`07ah^Ulv0=5h^$j8 znjsN#f(T<7V=hPQm}>|TiVKra@{-j{0lwx$=lxiSpP_s-(djvC`X;>ZSUvY(H@Xc% z?t>Tlwq@%jLTexQlRv?^jl_iqp+%pG(K7k!=RnQXKX2u4k2BGWIs{^)k4S`cLl9Ux z$72Dry-_8_5lPzb6%)U^NKAZq9o!|b?>_80)KCldSMVrE5Ds1o5Sk2 zfCQDlV2FO<1M8E1{LrRJ3-AleZLLFkKC#?FsYcP%*|K9bF@eae4+Q=*x`Gq{=ppmOr{19J_>ZR>ZI~+@q@ z0MMpCeT{_yBG1cgZdly0a;cP!BAPoSdY1U01OMP-S3-IA^rJvI%XMeZ?vs%Pi%}@8c{p)_`x$1yae~_ z&qU+I4hYew8|YC()Z>eYliJnUtiJ)j)YS8o7iJ-YLdG;3zdf$#bU*?m(VH6V!;ZWeyt5qX3TrI{%ywe%e+TPnd7h>ta<*tc?L>rkRAG9V)d(_pdhOwo9o4rEln zPtf5c1thld>V!7`V7ogv7vlOj8w+=O#g^l!fs5sQ64=&aImOBb;e`N0-pU))?}e_S zlzUQF7Qby6n7%_h%GB2{`$a)rFUCga+3>2Sp4L(?c;60h%^j(??&xBx2Jv%e?|0q) zQ)q|DvI&TnH!~OgvnS*fHX{nt_6EHC7`y;~U)=kb-{g@#P8dJ#RdSn6N&B;WcVgyJ!-q$Xw^`{IOwQHafie<&_ z&)25%Jy36w!oJF9haC5N`j@I=)F-_&qu2cd3Ox+iS+cf&+Omg zVY?<$$NRcDp-;7)maz6*LCI#^XWY$v>My&S4$8L=bW6I9Db_I+)Ioe57FFUY2z$d9 zkXp-m$ehVr10ehky&^{&mGC!+x5r5FooK~*ue3y{{ShnIvvU=@2B>mUhu*K$h~bvz zG&s({PT_E&Q?p+3^Pi43kL;bAgezZdMD(~DsPdM^zB{!PnR|0*<2Ys&Hwl48kI2<~ zKd)Pfkv+MmAaUAi1VV1zdt6PmI_;~shKFCH#Z;r^tE833+C`vBkh*>B?_kS1Wh5nB zP&a&QZ7L}(?P8VZ4;f*4j}PM<4^L$?pl)_13O>;D!sqllff>!HMk)+iQ_$25TWeuZ z)a*L)rblG}t8o0>2qht2F`D_6X}9OnIU~;>jwsJN&iFdp=PRyu9Ao=N5KYL9HPHsd zmlt?vp+K&8-481sdkeD3gwgM6E#$Jgv?JnlNAkXGBi-4>oXF9RN(@?J&$js}VEX|- zhp-wP{&?aqLF)B!fYgH`nNc@-f4}O{S$*$RXhVbRUX$=|4T7U>YC>C~>IZysLKWC#$neW`>-8mGAMkDzEHKHm97Q zU(h#Wi~Q~3LVn~zz8y}1o~Ja5YG6wd{Z;+rGeuM#4JeN#rltyHEQXE|k;TuO-)=x^ z_FOjgQ=0SkR3|WbUu!gzn=}CSj@%7R@=EvsJFw@Ix%x7Ek3^)gpV(xRGN+0J$@cs7guSsu#71bVT$5S{(G8_(;7 zYa!<+rcd2XbVCPd}~0wp$uJp#`7j7plHZ zd5&hiqf?ZZe_rFs^{5oda9HO~%tc%>Oks>QiFHhu7v34-(##=!gg%p5_iBegKturE z6(ne)e0DsY9a0DYGj_uiitLjr@8-dySa4}T;`~GJ#09yPi>+)=Uu6+HmoYYx7FA}_ zkY-ZkccOBo`_0(|&3z^hRUPhh5jwT;H~gybT`-wuCV>d!$x!$Qnk-AXN`WjYJTlsk%{8aYs?AZz}881Xq%%6?0eCSIcv42P58%9cBMA+Eajnej_C zOznQTgt8MALQ1ytUg6V`otXfWPX`FE$KmDC`Pct%M zweb)JTRmHBTt9k*c-3WoOqIcoGoxlR-eb@s?I#9S+mdg&>gZqDl7Sk3=;huZ(bbfq z81gqtx8kiPo{LeP+~x!4@(j`;Y!7K;T4SBdSeP=<&D_kHiUe-Iw=&{aUEw$Cn{VR+ zuj=>A#_D)~z*C+9p0KqjgHx;Ud}tL%es}UMX^M>Xki-@eS>z~i@J*GQEM#-?Z3ySF zus6LQ25HG)+u?jYq}ejib(P$eUs6{&G}v!Ojvrl&YFQM+Z(^s5u2|v2!E?3s3^mls zBT(PY=X9e97c%%()Z*T-T%(Dkty%dfh9sO{HOck3i3ZFJCPTOe-d<7yj~CxG+F$rv zZ%?sKS5!j?JM8g!oKVOF6JzQb?zd-I<%AY=Ey}-izz4t}4aAc3U+$;dZnndc2=kB( zu&ZaqT;GZ9w?bvIUfrEk8m%_cR2!~wWH@xCa#^1O4;9p+7j%7)F{#@nMS!F|sHA~h z@YB04x-=gK2jGq5IwSFwfhNZ*MM$u*qESRVSU09VzG=Z)tuIdzhpTObpIcs(9#WzO z=Im3GbG;Dd80?or-(KXe{yF1`c-Iq=;v&8OO=dQyDb|y~m%vP^bt4s6RfySFkqDF;o+?#G z-NmH5GNQlZ&7>F=kd3L%=E zW}-*;P7$r4`Y?w=$a)#^U%v_$P{0FjbV6fGb{n8J5#1)Y7tAvILODeh%hic(nmxcU zw3d0?{)vJRKDtm_$pi&?nS-;Qo)uzzIO5*Auyu8=TgXM5h#a|8qs;IE9!4t5(4nFq z?ZmnV5doVBy$TBoQNDtx0`d6;0@*U|XoJ!hg!o%o7I@X`AZ*De!TYjfsqYaUB zo;73FMZM|d$$PkL_5>(&PS`#I+b{RZn5}N(z(3->EJU@^(2VDfK7HrS%#o}?KV(f~ zOu!QUo2f6l%?+X_qHSi61~j>r)z3|LowE+hu|KR0>hOG7VC0N#xssLk60d~S8TFIv zN3{rGL>i05CLOJ{=d;`6TOoQeHfBD5hn$oGW$^}z&`-*V5tkN#gme%<%gCY)t~9;# zK~pO;#F+}wDyl^FE0$Z243-Q<c#+7q*_vBCr0%K!YrW(hh0ZDBp)6bjLlq%dkPF2>Z>dALo-=( z7b~*RZn9W7&XfytKvXdG z@D3F$60@NFQ;ZmzajLnK@Sf%IGMhMi;P^4hsIoEB>>w!+^RtI-DD0TuM*L)$Jhfa8`P)q; zfK54h>e#>HDFcuU&Z*$GiEehJBA6=e4MM|qtTSaA28q#vvB|KI$<#Cv)pd|DoRSXL z+OWvS=U1@ZC+k@y#Z;vDEwGBf!jZdOq?6H#K)QHe(OE0!*&z*g^{!^rKpajF`IJhtrlUuhoaPJP>LtE%EY@vqQ(yd`g*E{EDUm;j#H%^)%Y+8rsXx~lXem}*L+ z>$pj@yiFHu=8+$tTLgcf{&dgjSMcR_LQ{DBVMM#W4|qazve9^Q=PO%bfVU3zB6|1) zepum+#)MT+cY&4zQ=ACius}rrKj0a<}do)mz2aHEK(=>0f`ZuHF{1mPPM7|C2 zDbG!MhCfl2-4;O9N+}?Go>mFzKSt;!EJL?mjREUm|LL~DVgzWV8>o6L;dpDt*L(n+ z*5j1@yR(&aRt&7~p`mJ@jRSuj%I3$?fpD?`AAizq_yjY;g~U^GMrpgr@B~}!E_yMt zD0}Qz6c+Ynm`$a%{*~aJ{_P~4q!6NTbFCFsf&$#sYUhzEko|jDi12k+!pz9Bo(vBu z?EvnTK2rV;_!=E37d|T~&dh-5o=NsD)k81;PuYkV;e+f`+kI&vg231EBbNU}%LCzd zChNl)E?5E$EU^{V(3xQF$B7@zJKy_k+DmZPLu@OK&K-2Byyb4bkuw;yt-Kn}O1JrVg{A)a$Ma%-;D>xzYTt`gX)g zJNOoPPP~H#eZ#QXdi>J;KCOoI_r@lWMKMGP>coU5+o-pB);p^L<-Mum4Gu8?dd?@lEE)Ni@-Kh+{Ql%?E+it!S{rT5rlu*O)eu3h6)02BEHb)6+ASrB_%2 z$9U_vJq4*e$)EWM^$byRKjUG@4yKKA=7NN$ufn1fCeci9j&K1W{5Lnxv`X2(S`ZMN z{NcY8EJV4TqnuLDE-Wr+ma|hVcqb*IM*|fQM9XyI|MKE{gNdPaz99eQC{qM614MLtmf2IidbG?w3D)CU;jdFt4H313B#Hmx=;xy89 zKFeB~0I@uiil%$8LxZcOZa?h5*7(OuI$)*o{=*7T;QzN?g78iaCjV{?&O02e8lEVD_Fbg;zt(~n zp=RgH9Li8|rWEj3NHGTHz^>1X|5Ubr=!J4oHs(M68xr{6cNph?^CdabyEKi+$?OnT zJbuF4iZbmO{ybZ$d`kIiu}NTz4wYy;br!Hyeq`M5DjsGG-=9mX;x_h^v zJWP}2^kDa?F&3s422Ju%^{i;yk7a}K$vs}7zO|XCHt(=6P+6jE+v@z5pOvAO#4MIH zmYElLo`BzZd0kPdeRL2?XL}ti&>(3xebM?yS)O-)bZJie9`pX7k_=mC%3`Ms=Q4bT zwC#1J0o~&yh~GhV~fhEsUE|l+dHkMyY^y_GDZ~u zB-0>&a{P;pfDB_5zdRbv{qK1{Wmp`XA}J-*?oQh%3FF55w_gL}y!vT72V&7bg9zTl zRgB`0vl;$Ed1mPEg^GM-%{A2Og~Y8ycEkP?(G%rLw|M!_0VDg?&);RQHY@?(d5wtv zB*Vm_o9}@%2SZIHNZBnEvFxN06&C^OG@|o+`it@eyzjtvEn$u% z9|(0h?Ft{P?|%~p4_mlTc&z`>k2>uH=!<%yi?C~{ovG{ADOF|bSMqVD}RKCi85M9YD{765Os zyvYo%&eqx$aKR;~nm(Gw_y%Z`Ml-^iI7Vi%&We)=q>5S&M%_Zx;P}YP6`6+m>lplt zd6n-d6ZO^Zl9g$H%MOYZ{}xB)N`YS!>y^z^v-vP3wt~xtM8CtX{$sc9Ae;5&prjhB zGWvR!{r)Y%*(M%Gr~cQLc;o_JCA_XA5v{VbhuB@3Vrl^lTSk+Ic^ys94UijUy~RJ-aoPLq&R9FFT~KwrhMfXxAbSd z#=5`+K*N6vGtMx;l0igm4c8ki*u&XVwPBgHuVE#;-NP|TyZ*jJ5*tnPNM!IM5u`qV zNpno`Q8L)!R2xY@`OPg`rZ+Ndpqtu{ZB1ziPBtKcvA{UK71&5 zlVvc|sy^t-=nrv9r2pcp z#Z9J}V-8lD2h7M76Vn^jWI+yD{~O(x`in*JYJQ9Zl^CBQH}-$w5sGF zZ10mc^>s&2%f!ykF3jdNc?K7dq$bO+V8pszHnuS)u-)LW z_ay-gl(guIs;!@GF#H>9lRM2~7Az}X#V`z6LDD#U9kGy~<%8r*v1Ml)KVD&;f-8;VAI61k;?*WgL( zjRTuGi1PiDqw_GFAGuiXf=U;UW502-w43tS?O#MI*o$x7QE~Iy_zCKrKz;(?$<`SG zbiK%hP2{`LA}ovKsE7uQGz60vlbH5^1)Z1$N+xNa6zN5ln_dCfSlYW(M^yIkii%IA zGWZ`PqasB6N%L}A&({^BNZ&4TUCoZ!mSIy!Os?aZ8}nzkWN%4>SF&^XMj=fkbC(_@ z3(ae?wZicgmZS}&#T7&Nu~jwdOesf1E3M22YQV8FqK9TH^HOY_f%t+W%7BpQT^Uaf z=>8HR%>`k@#&^ONm*arQTah?4$aen}aTPcNh$LaAS926oNH7GQp z1dys;DLBaJ5u4|^B+n@(BT7W{jh6BYY%<^9^s@Ch-eA+DnvUdT9;2v`;r7c?J=k}n z5||xp`aO>2K|R>ptl#Z&7_T(7F7jto#83gEpD$t*vi+*p0#_^000r9(YK6n5Kcndc zXuFPqbUK5X$&01rrYM=Jj+t?#MAX131bs3OmByXhZRV-&&#Sv+sWN0- znBJ|@o>fmxA-CD$0+ktMIG@U`<9al;(ezl7vI4fNm25AUMMYzLx$PD+ALGvWm1Qhh z0|61Y!VphTDjeh}pU;iapJNa(S#1Qn%vwo8$|pd&=QNec>V#vW%>Yp+ubf(JK5c_K z1hEHKa$3(rW-?Ke$2fd{Vk zk2Zk^S|31v&F`bRI5kq4+e9W4H3mrlSmTco60)ke~P3CdBSQ9Bqt{)qWgMC z`LEy|Zq=a2XVM-mq#2v&-+hy z#fFVLS;f_rzs5_5WUqC)_pU+~hFM&Y;?t)@nmB!ejI9&ofbUwVLpfEANN2n*1EWhL%r0A|`Q<~vNvvoVQgSH7 za9W}faO!nDEiJ;nWCRjWHy!U{Kir+~^%(2aIy^UM{ps!`>|)iG*!}k*lC_ya28F^8 z;1#l0PwqPj2JBLh|FYB(naI+%`y@T&iHZlMu?+vo4-X%9O?CTBc}LPz50fbu01yl%AwzJ5#Zd% zisJn7#37|gA9J|*x9|Z9xhIz`C3Sl(#21&@t*rswPRN+nNE?0+L;d@^5`)!=j#~k> zipt&-%#EIi9U6mCNg6{vS;+GyTfQvMebv_cE~Q(1W~jYFVQfg8ip8LfRcAq6cWVUd ziIfmw5R9RZ4uatO7^SOqcZ=&?QUkO8A+sy!!|*lVK9fd3J>i|fNHk2M^KoEEe_KV8 z&+Yj#{@Cn~2|i9lm(^G1^>;hEq*r<(;8(72FYnPW?a-LTOkK^gs*MS~<}ZY`Q*B>3 zZ_jkY9TV#$7|+oGDVihxi4+>L1rZbKO0}(ZahcY7+J@*SAcTxu7~;DEX)L zbM-5qKa;w_Ohjcz>Uf+mABT2nv{^HqH=f{^FEtV~%%A0G0{{S^yx5&SlHjRKol~Pq_uYfQY#=HF6TM z=kB)gW+QIoK;Q*)H=uJbBXnQ`-MB}HOTK*;*08P{ zi5WxaTS)q;zb&RUa6JHK>zF}aykWcz__nlk$lgdO#f!C_T5M+U6zO9Bd(LbtekNMX zI)drD;DxO^D@A4qVsJTOV|4d6p6pnN&!Ae zf*1j>K+c!1MDb&{TxQzpglUp~9;o22$MaJ0QDLX9wi2U?CRoSL^%q%v>x@`zH9+*f zezjyiZp;T7o%1k$X@EY6RS18pWjR0+bWXBXw3`GaRmqvAdR}-1_}!cVfM> zdHr;CM#$7P*#pxfKd(ITknQo?OZ%;_*1oUMs5-6Ja;`awYk#oo5?HzK1PX_W#jPEh zuEW=WIBvC8M!x@%0s?%N4R|J{!~)26h^#aS!H0tzWlt6 z=WR@y@g8Jkr*UD^xc#DdsIiDn`f17L4&q@|H^XZl$aN8jjyGA!tM+Nh*Tk}{s)H(e zX@tW-&xoJne9^Dal4CQ|Wq*4%p?|x^A*OTFyUp%*p%HVA1YI=g68_nWN7ZIPpO6t= zgu1PSlLG=}i;I}9fdCK6*O)9FX~k`4awb7v5&Ctnmh@`pM*?lPv!KJd4%}#Rzoxs0 z1H-Lj`tprT5q$VLg8=ufVFr2TZ(gs%hzg17;m9p_smM{wIHl^86iA_kThT?6z}>!u z4tEZLmrF=SvM{?xf5v%~!Fyc8=R2uU&01(q?-K%~;}y(&nEU=d_3Q{}2AAAi0ddV6 zG)7vXY;yjo+Vaq=C$t-!?w#KTQ`_|=))4Kt^&`MWAJRyEXTZ4N4iv^uszuGUP-G7m zqoM0RV0LN$Fm}3Pb;nRFRBcJD6a~&y+ycITEP1HKcU(IBzo3%9%mZr7w$dwG>c|HW zKoW0zi1t=9H;3uNs_8+S_dHJ!n8oUaV@72`H5YUs!WKdq+Iw$w@+&i?!;YWc`K-IN z*in2yiPQhw)A4u}zruH++(Ka>&!bqWKaPX-wp9V{Y#DoI9-U$pteO#RaI^d=rNxn$ zfZzvkKd=X^;JH|z|Dgxgh2^XK#qavr3P@C44@({rpBLG3jb9%bzW?Nqnmln)_B+Ou z^ZL2DOC`CNN;WgKrBLrt_Q>hqgL2~Q6)Ek(JS_cU3TfiiCYK7%F?u$HdX2{eATq+L z6Ge?hiK8+wHGj1hKcMfW1O{3F-N8&5Zp(OlZ;M|RmC4=r#3_pi-5w9u8Za>} zIkqAqUM{Px(vJzzt<8nJy#Qm1x^4jSHCWHnr*d1{QW5kz!-U1Z15j7!<=z3NIJeBS*T@-8(5%I#6fY`ln6_9 zaz8Yg`e28NVD$wF1m+t^B`{l<@AXLt+TfmnOOS$cGNaQJM!mBmf*-fqI0$vU_ENzE zJ+3EFF6h^NbReiRsqi?f$Uk#OTGYw5$Mpt2P&O<4)z)+s3Nz#>-_{;~Sz`9<$(tXYRH$ z!#huhpObrznC8Ega@MAK<2#-x*0=b_cPSFn%k2@8E z`wIHjr$3MD-F0HEUKUyc>m+E1So27gK7DvOx|cT?IB!d-HHFnpzm5xA4uME!TJh!F z$cPE&_WPll)RS?b9C5+DH@l zUJYTE#Z81sBiFl4wNh<%pevKkLb}p$A%35=r}8Gds9jB3DeDQlGG7UjHbMy6^L8zD zVrZ}$cuV798^8pMf0>-dkXShH0jRajWG)f1Y=rbx43;8dzZF z(Rw|4v)JZ^%3-|}Vqx1JLJ8vnk{HHkq!n%~f>}|!5V3YZgqJ6p^SF;S7yC1bKv{q2 zZ{_gE`N-7zz)~ddO$@@nE92A&5b3~` zontSF5uYrR_o+j4M@OcqGC5EqlKVDW=m4wymFHP0gjrSnjHXFyE0i)M;kf#C(6iZ@ z7U%&Li)3_~lCPkJ(H$p&(wB9%ay6SDqklE6iU<5gThVbxgn`N#E`6=AvKUC0V46dQ zC33Oerl?tsDS>NU;i2*ZoCjbV)gY(54CM^@i_~ z)%~bKt2fRx3zR4vLUCl}r!Z~Z3sz#Z9*I;wYAW%puU4pp{-~SH{Vr4qUuU4?{OEQI zW>XaU)Ds~OAFuxA86G={K2GjM|Ko+Ax?bgC+FR@f-jEhMSNk)Y8|3B8r(V9kRMMfX z80L-00c^WF7{KoqWI6kQa=qO2Qn&c4JKxi$5(62M^tZg8TxCafVz(tMjKofbkK!d8 zg>Y5+Gsf&B#D5;j^0zN!IslDC!u9_Xyfj`e@=8nLzckp0#bO$CQ3Z+XqRV)Ng=)oJTSjIYK zW(<_qeqr{P&&0*Ot}I7;k7Le4`8|Bo;c4&@&$Ks;kZu071;3asX~xPT_&O#=_kX|X zKI4ioR`SI|50M+@m^>IRD<5=A_>eD$F@_3;D(?bONV2CZoHk4_kCJ@je*q7kxBo*$M{)r~6QDK}uRr>U41_m%0Wf zA7y$AH*zN@{8@FWsJ`t{&|OXI28s|0IWcwTI*O_JlOzkyIMiBcSKzfiMIjEK2b$?h z7I{9U1$9Tr45}S4xzheg)(6lc{n_ZVcw3uZ^Z%g`#G}r4vI6=PQ8gE^FhL&$twjhy zC=1wLI!v;Ql+Asd(TmlSg8)-(-Z=5;iiR|dN!RUz+53l`ft`GWi2BYl`~n$GWOQ#i#*BqTdHuyVQ%BI{^Y&dP{&XQ?(FrhaCUzR7R}gvgxN{)>DZz`sw$ z>4f(KpS~-K!f5uzvq$?okg*qBe5|3DG^iO?3TD*?5g9*}mp0W|E5QoTu`i$Gg;j;o zh~}%pt{tFZwT**=@RG%H#*m&Ytb*7jr*z+pFXk1c$LjI};yIa~s47ENg?fFd3o(&R zR5ApN9J>un%|4E8bd!t6bERLb)(r3Zi4##dNay=B?h5su zl_n4wAM|#~#O-n^9;Vt8PUkyeVoUT#yRr2bd~$(L2KLKW{5^kb6(%@W_RWuG;fcyo znhIcxk5uHt5L2gLbYwQF+mQ>GmC``qYLSc0d<_r2l;cV5CAVpBC7YWx3syRQ>h`@# zYj_D?pjBLw-U4QX28V$y{#ZR;X0c{N@+MUb7ND{}OV^~(BX}mSBa)~N5ft&FiSM)x ziWHY1;||w=zp|y4e4Xn!CGdSq$z%3OEwke3|NJa}pGxmQLS#fX@$E)|S^|dV;}F?& zry0nZNOR1EwkR^A#(uqu>y6kW7|1fzF&y1*oYjymvx2^wBG1G9@a69q>;z7MLFA9e z+Z@0bX<&YNBt?Q@e4O6WUYeCFotBy6>Wh8LX1<8yFGY-H?hygyt(p6m24OxaZ z&wfI+CldZNm7v^Hwv75cg{gZy5meCkOZ1;cMq9?(+J7i~ zqqa^vZ4Sk(KR-;klbR1KM#c4aG;5+od*}5|qG`IyHac6K(c|c#ZrzDRcI-UdHeRux z)f-~8jfSPcNg&)2bEBNvZtKS1;A!pJ0sr(&(MS~LF)?BB(E>Kbz~;^p!~aJ^^?)UD z<oFwvCQ$+fK*aNyoNr+Z}h3j&1JPcCusJ zxH<1R_m2Aqob{>JSYK+^8ly1h^ZY6rZkPc(Yv1L+=9{l4N|Bfq@E=9o*C;=|)&%$d z*8=oaWsUz|ZGM&E39l^vqbV@Dj3w7Ke-{@1pH65P8c6?VyP&0oj|vSF^nOkA zKVQ0`zbgJ&F#q%B_x)Aozx(&U-NFAa+ONL8T_s2J-~6ZY^CgJESpL7thA7cpFrykl z0ki*!><7?-KlJm_{S)Pb z!*!)0^`M&;=%?WeohN~tXM^2m=;!_STnVN4nJQy11*$ywgLone;YUdX>By@EX#lyg zqsuqSxwkwC-OX@k(gEDUcGxtbz%LtcIhTqYBk3c$Pm%E*kZXVF zDw;3?9TeAi#T=2mYx=|{Pd-?dq4DeEh@WAqt&pIQ>L`wLR7BTrQZzwGmh>dJ! zm@Zc)mr1Ejmh~?Zm=J~x2e{a$jH89bp+bTb*tX4u4OJF9&^AJcW`sRp&xj_&0Zhu1 z;02(>%;k20q*IO9RR20^=CbVK-f0blZSA~?~)l2AeB+Qn-62!K%*LJbtInIDKKB|SItGxA6g7NZS_i@2Y)9qNpf zmJ||#m5)qSS(X!2LnCa)F><2k@ZmFzSxMh&a58Y2hG?#%vp5r=1V>j>-f#YqXw z!!b8m%|8^G29rlqX38Ry^=i5{oZ0Lf2@8CtajDfLJHc&Gak!{6gAW<^#eOgV%qN|MFG)R`7g zB}T^?C3en}xF@Z0#qlcnpiMS?(NlOmz}tw2 zvq{OipCVUNb(C>mSj#KjI@cg&X9I-AV2$!f|o zN*p#`)p4={o--=*hL{iC?Gge2q43F(NB-b<8&68bcSmV3+P`W=Bf)CG7%@_Oot5L` zWDb57yy<~V>42Qz3~44i$H1`(r2c^PNU3+Za@=PYqkHSU!eXeJA!X@=YJny57zrR$5M@M}~53Nfk6cxEr#}_E!$h5Pc{# zjHy(o)a6_tnig(q*05;#9hQjUbgv;{$n@Q#)jp{#OALT10~RPkQk(HF<6^)`3gjPW z6K0Bo9%=@%FqIVVJEPr6;w+??RpUfjA=*e~R{0Pm-HgCVQh=+`&BgaAe@g;)OqAcd zThyv%D>9eEJgT`gs$p`RLx8z(Ehq+BM9pY7T9jW=!-Ie9EAr9@)D&Xf<~Wj{nLwzp ztOe`zc+E+%eKi|@M5Eu9+xB?=a{^4G<9?| zBWE*7Ap4RP4Y!Oj*+iHaqPj?stq|03BCTlAAodRoOKe#Fg)6krS=|1vS(ct4e>V~l zUOdGDpdmxCWHX6%_ouPiq-%s(6V*CPLm3g6bT?reEgd3Peqe&lO|Dx{N&QV%Ma0YE zAjJ_Y-NAD`ny7d%3fLT#kApUZQ`^sfNT(t2RKiU#Z$fT5WCPj)k>78$lj6BvlN~`U z&yHCmvT`N@{l_ap%7EEf@%!pK!8k4EA2hV!&u+cQago{(X+TKEbMK7B9z7eX?%DjnRn2nCeR=w!pdaaQymMY;*a$W00n9NQmdn2y|k+n zHLsLE!06Pz6BB}Zs6H7`!C2>Ed~vmZTbL7TJEel)J56GE3R0eURtDdAJV z0C}?#4wKPdVahQaDXk2AY~ZB}8<8~Ho}_Ix~EB13`(WJ)B* z^9Oml9SwGM)Oqqf=(;V3r!bmkv2-}&Z9pnn?+j0+awv9mqzr%JU-^2c0OK0{m|}!g zk9li_+n%y~Mia1Q$6V0l*K>m`i}x&$r6|y~p5NRF&vs@M_7(oLPqNT+MEqf7PbTIO zG>Jo<7kQmunES!;_**%HOG}@DgOZ4KN^M0^d#I9#@zpNU=U1D8X#k|yv)W^adN+Cj zGCGUxgKR9jz{shxeh!-%67^5%2}gBDXo}bG0tp7<$rBL~A;_b=R=s>->K|v90(mc( z8(LVTi*Qaq6tWMh-=@2>&Lx8<zD{O z#aX`A35|2Hi(fmAtuz#;)R<;jCSG%Rhd)+@9iF5U#Ky11RKomp<7C2=B|sHafl2slxU0Ea>ZKSCS=YnIY?bb?wbJrjQ|;u_7jbVT;^ zok|ZS=m#Z+au)BljB#C*)HvIXjw#E4|6ay)U2HhBNHEP6%WSA5AfK5vJXY_th-a_m zD(6b5ctcvp<(f4kz#+OV71o=}1;a=VeK<%>4Z0p4p+*^GbfMsKx#LuVWc`#VW{rlz z?Nph0N}QMbbzc~e^qqeD-YK+yMN5VbO2OKkvN)Awmtq>39RZrI36a)jU;H{s?e`B2 z1vSQBMpBj$?7TswYC|uF>ww=voNO8JpVT4?jp$jKZ2LFg(<{x7E0?JE4Oh~&&L@mrmc~osq?_>2LjuwJtA!@@pF~q3%+;)v$)z_k#k(E(X!6K?< zePZ85D%5AoDUH#ZQ3jX~`g9ZHEqwoSnNk%Ocm0Tx(8`tzvl;F{QvShus>v5f*7$pz zrl30v0^EHp)oNAr;MuOnea|-VDwF&efX#@ul-L;-BV0Fz1Ul_S`LloS6gKuh%^wJX>EWW?&p8WJ*9O;01nLz+X8;uu0eNr-1h|qAgLxkM8 z(nR9o9!iUW6urSL&-ojmK#bkdn^b+yZZEafoB-K9kzj+`IUB7D28bf~nsgjD9(7zO z$1CxzKst3b=S1wM?ugeB=g76T2U4vZ8)dofxK)bA)ivs~cP|@WRFg17yt%YKlC>}+ zFDBr-K1Y5&E zqYe8rH5dSsN}vKPSC_nGsi?-WDZK1drhVP;gwXMAh#b(>NdpruB)Sj9<90SEIUhYV zY;+-m#&nm-@3@5gDV{BoFKb#@s@Q`|hZEHyS?SB*?_Dwh&W9Hf(0353S@nbHR+Q;m z0>?yMHjZD9`#qBnW20|;eOb{kB8D{ak6o});nC#Z9JULJ<|+QqY+5% zQP+v^b^O0;C}vDwrR&bat7*H3uyF{uG1{T}Ak1vOYw9G;MkIR! zdU*@~TVjZ1V}{pYM#Q5Xu^=tvzO?-t^=F%Ud&1uYqPbN|qnB>;joJ|)hJTl~B^OSdl9ZNOAbYXWFKBPB|;PnW}8%c>iDrn zX?IU6UQL^`)Qq1dB{fk;L*d%~&H593wZc}LAzEQoxdigJpO8*~ z-FxZ!>pdqs!=Z-bPy`FG$2!*En5AYMbN{$S<$k9Q4>g+{a`4?ugUbGu8IzwRMAEE% zEHLE=FXCV>Z*yO9`Ka3}^e>oXvkWeC7lYly{VD#3mlXJ>cWECG91d zfpawaX+Axh*U&}}X?7S1Bo9hkRPMNXgHOM`-~%u*jZ)Y`VJl;?j#@;-PT|vVZ9buZ zf;f;!7REmg&tjCM07DF-!y@RL2wIZ}i_~5dVk}dkB-80;KCaFvgcC3g;L^`-_4I&A zZ=xk#r=JYnZ?yD!wWIS9u%ldJx^kQ3q%o$GMY#^~;16nN1DAI1KOZj2IU~mhvn{s* zG9pKq2wEuM8(E>50r{vb`%ltbGb+xLzqqh%HrgPj1o^>Z5anAwC)=5`pa<2^ zs$r3&RC;kQaH_Qjw|!)ur|VTc2O%o~l#)4P*NQkYCWon2E!RVKpz=fgnMjV)t`%z3 z`gPk;%^?!$*gpw-lW+kb;d-s}ex~9nhunF_TrpYl(AP^(R65McLh9cT42SBOG_epT zVGofhwb#EN2GiMCVaFgok8)nWMl>MDi}vbZ;Mm=D-F>J~69A4LKRw#MgE0dGd_c!2 z%+n+Gx0g*0=Jd~)D+Nut2@3h$m66H}W^~ol+jyd$)21;F(lK^K`=Hn~6?VHv6&Y{M zRS;t$H0mc`hj@eYT^*UYgYKm#i*#5B%S1-1y0ya;MJ`yJ(dwCfzjRuQ8RK&jkSP%X z&khcue?P1j=fys>QX_^aJMOlVmb>Z`_ebuiqeW<<=YX)G3zeEX2m!`|?mH2H8tcJd zp#JcxJ`-=6)Y1_~GVYp4ViPgrjruBHmGXf)x8Q5))#Ao+IiUrb*KR4<9;`hkGy0Wt zX?Lk6RJk}|^mvDKUGBPc5#nVqyov|VAQjMP?7(Msuo5~I9LU}%A_%OGsE!5RFX@I^ z{cHQyym5_JZ@ILP-BS_Q<$r&=l;xt(C2)YJs{W-(;x(S4_ zPyB-cg92Hll8)FY!wO9couR1ZXKQ$}@~2A4X$ejQwSFrnTE6|EF3+ph`vLmtoaiIG zQ$7a&sZfi_is6BC9@JtITIlx)u5eo507d0Q%E?SNc%9^|#ymL$+K`7UjXu=;*>i07dPH0*y-5fDpS{UC zopwiVLccwuY^R46uFpSFHSNZXyxwS{vE%qN)NJS|K(CxYa90H0_~q5=Vb$uUqU&7_Y~R{`#rT zp6iVmGz9@1z4p6xV`6+5rPLV-OUXXr93=BbBpA3S)k%y<8gir~brd zGX;wkFegXNKK^_G2oA*(wExK0>~x(*ZIsGf&9xLhfskvr+uG#19zc_8&0>?H^d65( z3RGRp`chU@RCgL{AVtfT`RivWBA)yPW=kI&?k5coF?-%oBjE831an;D6bee1@i2L~ zpcky#E@l;)dr(#N*Ck1kg?*dt4r4i-8M;HXR9`66AhT4i^??7lYu_SK7(AUA>#typ z1OCg=Io7$ZrC_e4-1xO39e#YHeT@TR1o0Jozf{Z%WVc#MPk|+i&(P%xp47ThmRC%a zW=JA>aF8cV#^OF|446$IszQx?vockMS7wtI7lOpU+anwJpz4B%m7d#lhnNz04TL?E z^Pca2E4d$@{5rKlyh4w?KVuDLEeWG4U%qch4;>>rydfArRA#``=ID9PJZp72vghJF zlFkZq>ifL2TW>YN3rl=42#-7B$32b^~ij0lRialTw=6m zqAei)g(q3Ue;*tjq#_j5yz)NOX^pD9WiiKu&9AcD!kjr{V09l*}4#rqf#O3y^Rkg53J1M%uwv5Ct zrRHX+l$6(zTust${~REmDcQX-7C^5;qe{eQLV(_&4*W3JkMJhyw#IVfcO~&_)jmR@ zlQ!(hqh@}jDQRA0vBQ>v8fPd9HMLN~Kir+n-{jmqjK8|p5qi$y;J1-$L~AD#6C~sg z4Sn9-?0ThvaYM|K1mc7Dq_JE#QqCu{7_W~PL%YQlN_v`cljpqo1$A%=EB<cl-1pV!*H!&#fIKcBBUHI)Xe2j%E28R6WvRntV<5{xPXd;RQ0 zAyVyDqoGEZ3MvusIPC`Y9zRm{F@>rL`KSLCEnA1{bXwDx`!KvpU+W}#@J;#8YFf>IT@R)mf z7|x|SpZ&sOifA7Uc5AuY{Z9Om67#(@^x8w!!6c?C?XK@u&6T2ji^1w+ zn%fbQ1|oS~ozulSfTlu~y(E8kQHHZM&4?7)MdKy?MUOC+CoSIvcJ{KWiorJasM@$k zihaFpg(4-rRtP$cpJoClN-ApRrapjKv1oyJwY&2L=n(ox`HEDK?IHjgwe-hWDng){ zRN#;UVCjR0jgzw=+-1ke4{jf;pe8>UPSD>cJAqNF2|*o^o%$zSMocha>SNRWTFn>j z7J<(gtf_J<`j7Xs+q#?GTBQ2eVtg`ZeuFIc7ePe{pW2ilq_+Dv-$@|}wVG~}r zByuS3pml>ZTnHi=Q8j7HSG5VJ7C@eVYmI0aufJ=3UKQxGS@9UV?nrs=Pvicnsnt`;i{$NyN@2rmPlgauZ=h)u&Y9lM?m>S+ zeZlznkC}ySIq+=7$$l2+FyAT66-O`ePb#b`vlr9r`wExqvO~*Wg@H&oxyj4gC1`wZ zs#on{zdw#JCZLm>L%q)Lr%u4=Do?W8NhD^h6P_l+(BgUfib5bY1GSimEX2OPTw*OO zB>t_4H5ISh#Xwz3h0@$~_yfTzS%D&D29UpbV4AKl5@63G0QV9a>tEpB;=P-rTbf2P2RY7SE@^6odVR9cLIg;phPs;+5X zVy~@@M`09y)eMHz2)17k97UI%uXfCAEVag=iIr|ahuaATUAla)kX$Vg`Ea~n-Jk=# z`Qrpx?ZO47$oL5fif(s` z#h=+R25-Bi>5nt0ZOKrz5fC%4@SNK%WT89dub<%&Nr0Wbxv3t>`Vyn-KXEmV z@2=}UQ$cDfV`W@n`3(*8OxI!!IA~OI0|~%5@wC`;ZY`)<+kVOucw`JCLc*3;#wWv% zZ(n{5f>`cd3%RT-KHpyL>CB()*DtJ~+IDl^p=@Wk5{1lIaJ`p&**M4bhqX1PkC+H8 zHZRJ*Znh?ew7@(fPbhvUWU*$~5O~gw^AsU8YeCSq?4skC@^s}eIZA((vfd=aCLV9q;-$79z8aAoK=%O#=Xt5U0 z7^AV}nwQgP=O26e^Q2l4R|}!TnZ?4qD89(h?PG~}BcPP#u;Bk#OxJ8`%8`V&ID8ZETB zv^A{lk~k{t2^(Jpu6BEgJXyG zVC{Abx$EuwMoNt?)?1&(2#~jTZzubwe4ofVxOUXXKkYdv`5#$$9xsFRJ6{clg5AF0 zbQ=LH_&*vI&3o75nCxa8*)%jwp2ESO=Fa0t8LPh!4ibLh6}o$~(5OJ2maJve71|0w zkXv^t)OkfacKB04KZxsOIKln&K8-2W)bi^T zZL&JXTH`h)A@{lsF@Wl8z0#KCFy5aaNf^ooz0G^!@qMAP-y{^-4DBJS$>~rJWIyTv z-0AhY=o_$9t+fGiERHeJ#<IaW4}F5Lf5zqA|=l8t>5KjUC-Q9S#MPv^|rIx&#nNHzO!#H3BIy#=CXjx zYSIs~Dt5=HD)OQ|lN?8&b0mWK-H&k^owuo{^O(>cjO#=)7b=QnlOMKX7{kLqB|=^HsH(hxl)? zH*?y-4zs=MaBR@7F{8cijMjZG`^#2a@pLq+2NFuNWgOSQ72ofTP(eJQ2^n z&`yinhn!o1_g{{Rg$O&tnG$Uq89Vr z@^Yzn$oHOsgnb}IzKG(AMdK$F$#^C<<8@UK6X>1$%R+$m690qmeVTt+c@5@!6my+{ z8{gwRD4pxxXZ-Do{|=A^SESqW&e^1CCY;$Py!{2|cd_ ztT)?Yl1f0e<`WWc_tkC*)@=@38*w}7Cb0wXAfVCu9H`cFf(M`3@jI2q87uj7MH>B( zNFwm$FD(L&0K!JQt2lY_lu+Z9@nRSf>23ZP@J!I;$tzfxzUNPsR4EsoYVW?u9(Pq;f^hA&S#<|%Zh1p&ydd@nOzLvj zt_E_Y=;-b8TMoenRKnpCYwCo=!)wm!1Up~DFv5Y( z{JBQQY;=O&@x02q+-{lSak%u)%Z>iPu%84;eT{SHFQaZ?Neg_+3|PvDQ_JxSBj~)D za<^&gGt?BsJvpB01Xc;$D+L;%0B-cS+W%Gj9eTZ-5Q&Cs*NG!^-?^5&+PL(FukLz7 z?RpwyG(O8X+-b&tV`#r4y&cg^WF44QAh2g#@uLB3ba$L1b=>yqTK{TCRpk3X=lL?; z)$O8oJgioftr`?cgZuiPUS403Db{pglC7Zj(<1#13PS|e7?DkIBbA$y<$AxtqJLjA zx!D_Wk7jYcTtHOhf1qEqU5{kQ;WZp zBB${rY~K3tQVj!SI|u+~JP!1_GUFZ$o;n@qf3aXG3UU)}v^xu<09fq0-f3|&aZzs4 zlqU^#TT6)se^1sxA#>wv8u&2Vz8oxFCtd2=NsywvRoFdoOyYaN`Ci}Vsd^BGmXvtb z&odr*xgO4~HfY;mbG+GiTpx&u!X2uToR@9Jg@iI!f$eRH+wWsqm2dFvOTh5Xn0OKHUH3}*<0r-k4 za}o8^#nyALt_!4uHoag?)ulrlL17oI(50~iLEYT-ilsnsFED0wyKp z%@cS_JFAR-u*|my{UPrWw1U^Z_70Wqfo**)ozB4TBo3%i3Z94h( zUabjp{wEll(|C$@yC=JX;Jw^2Pj~fVG7#lfQ%0JxhcUYbVUv4ym%(&!3AmAQ- zLJV!t9aK=-3K#Hs$*00A6;M3eEQUD2#hVdZn;M^mcSif< z{qvx<+(HbP?V`TnG@4o0zG}o1#p;gJ^E$C#A35AD$+God${D)n^o1V7WMIir z|KSjyI?K7`*@?Z=(`~uo>3qBli-NTM&RuanS5KwD3$n=eeyI(wW6gHBi8#{zHICzj za);=xF3KLs)gqCVS$>`udQiF)KhA}x&xs= z2yCM)U6h=k;(T?7DfLwh>91^B)j*H%JNMe9g~r041kAHTIpZUve)(rJr6mj}ig*9qHtBc=N)O|X}LUP2H2+yxs;t9S_tU?c|d zGGPc^O;G&WlpF2$Jx3r((9JDFieh4%QF1qWZ{Ig`Ow7Wz5+uaR3T(5vHQn369Erc~ ztgs>oJgP!4rd@bxUk#B8sh4PqJQ>fuVY28v1$-&cyhMuEV-}(f#49pOQ0{1B#y!db zz4m^^<1P=etigtuG*?^QS@7dx@zvH`db19_X`y4@Z zDXM5Wb-U}i!t6Jsj!dJHnQ;#EB_z&U%K{BHlS({B1-@(daUCYCq*6JNC0qWPRv%tk zmqxJ8_6K5Vmc=SfH*Zkb)}YEmz~$#2rgdedv1KiR(l*n`><+o8Bm$B6N4!M!WbqdU z8w+(@GLEowI>l&;@6tNkb-uiWv1Qml>-1!%N(T#p$2!;@*7HUmz|Iy=j6eBN*5LJc z9`lv2Bo(ZVmp9l)VG6GH>lWsESOy&dZB{+`PzS@RyMiLn3?!EbbEJikC7DkZpsid^ zCO^h#f0tJ;G~tMq4HpaPNO|%LAS>W`k)AwW4hBcq{Rav@*k#BuUz`4`&*AQj7wmjR zGIFKlmB^JVF&je?#||)=?N#@g>v>b&vfCj$PHv2T+WH!=PoIeHosDn7n#XZ^f3}rZ z$8yg9I^AW0b$2!gPnF}%*5&*xzTEA?J64KUp=e-8E!h*L$S?7SDFn3o1HqJ6fq8PZ)}LF5N9} zT84u9{V<-&$Ldnr(G}H7*hP>1o3P+$6dbe5iLJKFIUp37WZ)lnAEw@)=@+e8-#oT$Q!vpvYwVO`oam>D8yWW$>Tp19arLpG;#A{1C zG%7wk9e~fSuf*09*K$jZ#~kH6=e$*7Pn&&~Cgd%k3o!b7aCAWpOpp8No_(MauyxV0 zofu`mr%bkUAe8S2quL8q)}lz@MSIcpN{IAbI@|e9N=@@zR8Jo9=62199Dt%)+8tvi zn`UwtOK=chCg9`ccyI|^0pyJIUVp21GZ~&P$acV&4}_@HYv)$ovqVY_l6JninvG&K zzCDmv6XL<;7H`EHUnUjb-|=4wAs_7rzb`9{9fJJ2>VgC!w5DseOf$nnPc6`)e&Da! z)t|So_4qhVB+h^~^owbw zDsYlqiT`To6s^W~%$#k$QOV&jLp=hqLgNcKO3v(%kl!*LGHTi%>Y~-;UF^Zw>2;}p zSBP5ix6&-vnJ4!cM@?&j9{8(LuND=M=SA3dcQ&NWza}(mqmYlV4?W?v#newucz z{d*X3)vwlXb6;e!YB!F5TSBuQ2r0j*j`Ay26?iZXb36pTkjtS2?XF~)3W@Wr%Sh6{ z8l{tcz8t+V+OU?Izk+ElM_H}#R@%Cx^j5>yQ0<-$iY@SV-ecc-G(WtOoP<| zYI)s!{X%R=9nQ(tdZnr>duUp3c45s?Dh%8}!ZSNf^0C#+JD<+3%%AV5~ z+)I_?FR_R}3iLS48@c9}pd8h|Aj9vZ10wlOb83 zY8X!M6x!cJP#Ir$#9f`K#yLr-hvvRZ7|&1lOF_jB7U8HeU9=vKc*9?V@;-*Gw{Ko= zYF%C#ysyU$L_8c|517x60l7h&ktKa(5ngFe$15rK}rN*ZB z37Fgmn1Uny1e)m7wlF;9dB)9sd zkb3sdMOxk&AGar(Df0{3U`0p0@;A{$KUHHzGuGln7B?~*Pno>urBX-igQY2(tkeu6|rNgbe48|!w7p5A-`&@)~azCUiU7zUcV z+*qORPlNQ<=#)1Ll35#b%PRj$IMMsVPx0a2tMgtHo0a`THaUX@Y}W+%)OZhmyCdRH z3?2wmF<_46F@nLEQs{VFm2*B_!6OSrF6hfcZWaudWo%bDq_0(^khaiK5=BLgc%DgP zy%*egu^AfAl3EAgy_Kr0;)D9vM`Awwi`z2>Ppj#BBU8t=|n9$M?a+ zT@~f=xO-MVC8AxvsYx}njQy2wWmR5N3OF?IjxfE1cNPSvcn)!YKW}Eb@7Er`P2lnw zhqd^(6=G_{9ZJBAO2B3NmGgw1Qusnr`@E89Xhwk-N;r8R1)pr_)C3j1)LC@}8ZRme z-MW7ur>5E;5PqqFK5-`SMP+zhdlRVg!kNjCCAIUxx;t-OJ6?uP%K&+nX_~?8PMEdl zw*7djTSJ;%4iHF0OfWhcc0#_=IA&Z3{4b9}4aKmJ8_!^`Z((II;`aL(SR~3iL4q6a z)Ft#<0VI+{5h(mT+r`(6pw8B@>E=(RYz}jDp48{-#l6Q`QymQ3jx+0IrKUC8PxwvW zS46cXjop)quISN7TE3@Y2y*1-qxE7si9BZ{%Fg%L6$|g>Z4&z=7}=_`RgHkybDo0F z=}lZM?J0as?#h2_O*rqNNI)E_?C^Ilj-A}si~g)jxd1A)=sAhFzSAkeQQs#4CdqH|eQZe_kQ>euLc{Xf*zoqvojDq=SD;l(uPfX>m zdie<(#KvGbv3KUVg{zUd=3nyC`vhPuZaQT|IFcEQWZGXd$C`NrniRuKZ&xpuU{n)1 zN|ZbMR3aOeytCuvG&z8l$3%9bgBzqu058p&0g# zzslr2^v9@b8lWkhM7DSGOc{s%t7S)#;oOiXnlE;xbZr4u{y0au#e>&79}xCEV#kF` zgE$E=g!L!s#&&N+O%-1C))DheGY6m#JIJm1KOnlhM5! zRm*To4vm+>eWJN_$gHl=oi0eU+we7sm7qcJ^GJmb=&P3>At9)d|Fn-{LN(&~`{EOw zXVX`q&OrO`JLtj6Cwo#_BN~%_oWwX%HnAns!@zoXp{`Ej$B$CpwY)mInFTp{e>Jjq zbf#qJi<*-h$74gt#bEH)Xxf61z#}KA+iw(uPa6Va%Lgt;$ycv}Z_%v%wb-l&2pD17 z1WwIoL7ZBBfT2M)y~;f7kbCB9=U)JY8vn#-p%9?#e18IcCgt-2Rbt&dDvRoTA|&I4 zGqQ?8Tw8Wps=&imFkY@ZJfPpUNS8+=M*$~;axy*q_0kuSk&hRNVo+Mc>Z>~cuZPk1 z8H?|2xs#f43UFRqnL`PD39oH3R(s00PBKf&H*}#7bZjfqMs8#vikwf&Kn8^zSkkV1 zr-Dv1xTR1+n2Xi5L{9Wfq0nv^QCQf0{1fq0xI06|`bL3DUyZ7|^M+O+lMm0Y^^zf9 z$tMyd%m!x{i4wf*x?;|zz>U}!gb5{6Cx|XWrv^@*wP8W-AXn3w3S15q2{}N3x=kJH zAdMhChR>+igyZ@s+c|cVFH&0`ljryH4hgS~eJgQLf?CK}#SA)yc_kks>r0Klq-B}N zG)`w>`6@rR;!_#_HZS3%)AUt!sZ~Q4|BW801i1^qTWkR``R1IZ{v1ZATPR4-D6VAI zq1vhgXa3ow+UW?|lRA`15AA)U*x+%_K96e#`f`Q5ruvREAn;{xbDA!+z8{7&>6>N-JJB6qHv;vZ++M4$vPrLKl6$M83IEz9ZvRrhMJ$& zt~kjo0u|UHr(RVGQrlB;ObqGz1};Y3Y<>~gfmulA;|Qklg^Zs*=5I?9sHoHm(&@To zw_Z&d@F*pSA{8fCzx8h-|qH;@msqT>cmK>^>9>%VAZ+FH(7 zwecdQ24<4NVwhb1HOWkM=h0yJA^M67X9LY-EdmeHkIZt0B=j6a-fl1Sj&q$u-#38NQ`kEFcZk9}VY zHlF4Dh{B}rS>oos|32o>S4&0G^YSp56O^(3p>m*Dq)W8tpk)3T&oW!Uzj{_GHao5v z>=0>vj1US&w$OgS2Akr`D(;dF=UDbgP7Q%kgA(V5%{TE-T_q7oHYh;V*J5?+y8Z$( z*sd^WM-u$px3hm<05}cN_i95~&+#0Rom2o;$_b#fG}Lrg*8#Xeu@ow@lyclsf7oQy z(|C{rO$*eTa9lMzo8bi8_JQf$rW6WCaHNVZ7+q$1;1@#Knl zaK%Mp0}H>MCxz9W&`u?ODvofn9x{;6mp)nhMv;y&XubSN4sq7xZng-r&dqZrpSMnv zMin~uV>a!50vz!1*oguxOSl+j0z8yg68dIy(TG{UewV!Xfiot=+#Wp*MWO4UyR%wX znn^x4p0Gob_|ajdvwM0{y5~QE?&!Htlf2C8zG5rx&A(N(y5n4!=6tJsmEq48qxzh< zJ_{!3ag~jp3aAw=>^u3olr4Xwj7S~M#}ci7D=R!l!k1ePuH>qQQD64 zTkT0-Ar2v)Y4Si%jR|F`+pK_Jd{C3Gq`xiUq!^CG24m4?NnR$qK7Vpj6QvFAWK&Tv zyA%&qy2o^vj~4jNAnJLB7XGD^{WG)IXk{ z#8J_DEy{_#b(OanbIOV!o3h~~wf&RsXa;dengq5iIcB0&-J-m=1&09?6oR20Dq(o5 z5^J{Zw>s;xj)`i}6L-i|ZNW)x$#(sP8BxqFAvI3dbMH!BUi6FK34@;^0-_B`f@v2iJit<*@=A%cR zh7p$0rggNhG>ZU3$B_svRVoffu);C|1{CvMnbFaFIbBN47Cmal0`Y@9oP!d>!CJ?O z8DaKivMG7<8Gg6)1OK@h*X>z7v&A&nZ6(RT@ueU9V5wsq&;#g;j&SUT#HLZCH0khq zl^~ffTKZ5a+r;}IpW=}Cth$-qR4t{}JexTAR4_Y(%qMMBl4OL+Qas`H;qrnVGqXzS z3n%$aHsqKR+yt4V*NE3x(AA31sI^UcS4T=DMR3N1KsaY!EJ~SLpwy>c?#^(vdKFJL z9EoQ|MbM*UDTcO@ZG@Ja^tJdz@%vCVNDdwaqAwaisfi?)A?v$RP7%3B+l}Nitq;i_ zoZMx>QqgFgG9EXJP#@#2O^He~csDGp2$LZ+Ru|czeq6 z$Z0uZx&=!RB~ZK#N~)dhyLXb29E9x z0wNY*`GIUN%fph~G3l|S%E#MDkjk$Y$Pf8htw-cDqm<9exuVIv#r6Y&Bhq9 z_!;E}$op4$P5!hsnYh46No{7IhOqsbfFmG$!?JPb&_&!lh^S|d?7^j~wKL7Rmm0_v z?+oMJO`R;Q%L50UocWa5!z4DGJkLfJqXRLtTuj4TDwH~Ll12rqW=cK+FhM0uX7_Jv z+KV<9hWO%kvrHB%rqM>0l(1Ylhf2^qraBDf&@V49J}>kIk#od${p z-4NMO@*o<Y9mRBeZlb@Zi{)~O&Ovo zFzt<$!`-oroY|Tc6OLvTKkVfgO~IWJPmBL!eWq|rxFq$?Y-)u6?&h|-0R`mAH8PPt zEP8k%(+)OCKo&q&?EA5sbvbsg`?*T%6?#sRVF>+LjY+F`HS*{JI|bx$d{jbZ)DyQQ z|FFxsjZtc170u$Ym;T)$wy`0Re!!E;jDS>>^NA4I!4JOtNz+43e?=s&_XIyp#A|^^ zkxdqKvzoXlR>$p}L}c>98LdyF2E_xFLx91^;b~e=rVm7bC|oKHp90?E7a+?`D9>KH zb&&N&p*MQn^fC17u%!=;fP-YfuIan7W5H^;9%*U(4nIy#8woBllKm6$^Gi3yX+rE! zvdvhS1XzorZ2P=Dt}31I9p22O_`Zu!4)Hi?^at;Xm3iwOoTLUhhnIY5QkCDIuiBR; zP*;)6=YtudMw-dZTSST04gTrfs=MjN16Da1#Afo>PY{b$Ht{&<5t2pSDgFI2c$26$ zCZT(q1LL{bUh|b&6r}oAKReJBd_M;VLoeg{Ig$1F|GKKe;xg(@Jx-}(%}Gi1gMmS2 zktUUFp3%f)s6|C8x)Ea!o=P#RcpAydv?vBnLpv&bi6)^>hyhc53Nn9Ftq>8^@Cfhni19kQ1k@PH7yP zlTu@_bhyArO@?H=<(E>w@R`Clb@_o~XDzI_CK>v;-)*FUv_R0)v9gExQEwTy8j5D% z>2(e)U-$`OC0VHR<`AGjk)$28qrhME=X{eqa#+3;0{7rXXJHfuWKWyP534UrXrPR5 z$z~-waOH4B0+Z94I>d~V*pSdjieIU@^sB5uwf4uicid)lHjqj)8?%>cp_U~RnL8O9 zZlJ;59AP4c#6((O?UVqtuDWJK&N7L%@GluU!1Ne8#4g*gN?=28&L95GffkIBDi@%p z(^*BOg7Un@0u5z&*Q|Kc8W~~;ttY3N$-72}1KQQnet>4bX}THlqqy08s+m#5$7wADo!m$>B8$B=~8%colGhV8IR2@6Ia!cLs^SiDt zTZXw=nM;0I8Nu=TV;jepxss56p?axdF&r6ZlTy)p$>htU?3ckoMPL5XDp>Ycyc}d} zTx`5CQj}Ey&WveE=A{3RFXi=CtZ%zRi;a!QPZZw$v&HJwUXXamt)(8}m+9>^qJk3^ zn@g01x#k}ha^zrvGc?AFZlNPO3 zO#(B&>C4srF1L4>O1bZ{nh}ikQ1@iokY)aF?8a!RThAXRF2ye?3siM;i^<;_bchZv z(#@4jQshR~eRj>;?$=o;4#dXJ${+3)DuAA!7G^5(JR2&3N)vq1OP`WAL-}8!O~yTl zm?`B3KR>%y-8SN1p&t#Zc5{#kKfG&{)zMM!8FIFG`1&J;n(AfIgz}o&cQ4 zs7$Uft&!{uZQk2O!-wlr6oZ9m?E)`#!GfR472{t8ZR_OS3B>8so2Yw7t@rwyxm+|8 z?2gC>jJiDsB)>>mU%vSfDSa4M+38+{t@4<&08`yQ7v0pS#a>#OMA-;)8v4GU9xgVx z)6e{FFZfO7hpNCxZa{6dUX^HV!*7bi4c?Gg?{-<}`YmFWnFtBH6vcFk$mn2&E(PO& z$>i@8%ZQL+E+uG&qh%`TCn?!!R$NXUvHjNi7KE}#=RB7zJ>oLp_#pNB8Eipbb}w#Nb06F7UN$Peu-bY-0Rt&y_hCx;9mBDor?ivv?(Y;24i zKX@pbVg)W#54=9zcTaAOf0UEr1kq7bGj60Di&@=_m`4asJ^ye=%n*IPVw%xMl0H_6 zI%1Fox}wUnC+5Q_xqSXEb}=vW$F`U0`w!pIv4Na!Eq)zV-z6@uLreCpK|bv&<9u27 zoe$OKyfF7?5p&0C>HAAWK7NKVy!}?H+*d(pmj_K^7rl;hn^iiYTSKAQLO7z>Y(c3<=5_;djuRZ`OnH8M%#v^WJnX&hCsK^tkxsClH zYZ6?NK)(2#6GS7?J?UK;&et*F^kEXVa=kaMCaFXsiVDB$5yzgJYxg%zJ6|v=T3;Z3 zJLl!8ZlOm-YZA`W9(_ppO=hp0L1GF8JB?XAmE-fdq!Kb0MVSy1yD!CA>DAc8JHVa^ zb=t^)fsnlNQ*NFC`qL-ufFxPg{7E#SEdHPYB47M(?A9#nB7&nwA9EKjz)bc(ALlAT zi)aH?i)#g$+~1gc2k2hDkrVd~-r1@S7s239Co%sty)GB?V2x3x@c>ZH<$Ck&Sz;lN z=h;z&zVRe^c9kU@5;P!7&!EH_8#w9BSF9BkSM=$gd-|!NIuBDr0Mzjdwe9#iJYJFd z$4w395NDu>?d?o11Aaj9zy+sZhIhCVrw=;0h;&^*x+f^I z-a5-m)(#tG)w*1v{jsOf=(F$%4078`HLdb`bTHg+Lw)kJvoFvV@+E5-4XxHs=`ko5 zNE5qLcuh%U_GNz|jc=O)3ro8ZKzR$I+h65wWZV0=`j>+#!c`C`d%SQ>rps6u#*IE+ zT|rRMv8{w2#*juvh#JQFSZ2D$&SUd92wDpwEc$WZ@PQUS#k_dnxBK-twFb4?w><~9n|J1g9ozdva&C)@3 zo0m|FkeSu!wB+#fA-HmTM7Ie7PqnhkP>weo2@f;f@!r>GL?-3&t<~*hN^I;A?tH>4 zhPi%YON{@4SeExzndf@KgS6pmZ- z2#V&N|GlxgY7pJe`}P3h$a%OJ{zeaKsr14C=MrKR$h`~jW~uu1DCe+YwYeZYMLIo-RF{xpu@T$#UYv z@Z3bXXR~|v3;%TM4(7OT8)2~RaHN{O>Lbei(YSuFSj*qyLdQP9d2R^)xAhiljel_69m68duo4BGp~JX-AHbvMjpFsR-1BQVXI`@%Bm*4np)z%;`L z#^?H&zv?G%3a>4p&s!e|9W_O#Uq{1WBvvS>Vou0g4 zqfWQRekOpvR%gC;l%-%ox1$GN$Z=l7bTh`cY3=i5d4|2u^|y^)wT>%mFY%rlA0X~e z$J5)Uhixg2QXjQB84gla7X1G2{4XEJdH0=o?zbbuERLk}H~u_4v3EvBR<=Qbvb+&M z+4!NZ`{OuVUg*_gdcN==!2^s}sqi&`&m_7`U-96DM?5=dmTVgn#~o=Ji8);v-;Sz zMw?t~e?7)8qM`y;w<-N(a}~h?w&6k(UM&B;y1z*VIpH9?!Kqioh$my!p3y~xg|TO*)*$b_TFSWNy{fXqC}Kpv%5v*)5QT=25nt$wfBHYL#%CH zK?Mx!7MzaPF4FbU6+M3|h6DkEXz;1w^CW_RP$+k`g~$bd&wk%*IGSB|YVuazHC^9! z44;7prTv1g`g~z_^rwl=4@6+i0*C#rTv(#~jLre_6UXGAE*Pq|>!Da#9_XL2zV}S{ zTz-=FwI%M~c>JJ~`GU)Kx*nqIb!_^ubEs-eR)0Ld<=WYf z;oW-M{fRzmpcyMOhEy!7e~jH5js1O74F9X_0LBTAZqp0G$x0)N9RDpM_o8`IV(qLe zg$yv_&o>6ceimd^!{QIw4E({~gs{IxIDf$%vs?8fjcJY97bvcJx}5hv-5%TZe&K3h z6WMiu8Rvh;cRErJNgn8orZUys{X?F@WsQJIuMt-Hay73v$YEU5DQL4Q$-V zve}+)oY%BhZ?p-F-94h$4ks0j>az8{#rkRANB*$xTG`jjUTAoKrzxHCKr(|LLP_Mi zn1M>&!*bkyKb2*_?kLKn#W4j-eCz!n93$q-!e6CA% z4W@&J7HjLL+f*kd`(E$)qH;q~x*+kf@kqzi+sw$r<*;6E{h#d~$+5QM9O?S7D&HWE zGf0(5BA6$5i6{vj$-sOjBpEDEc04~w)Kyf1VTpXOO|zU32%F9;7n6%9?bQSF zp5l#d&Pxv&;=>iTv%=4@)|17c)c&Nz-o6#13EF-UYP&)WS0IbnP}1<)T|U0pghYvV zs~8A!T^HTW;#IFTAg62J`E)STn5_WE>)}M2%MCkI*d7DGWBDZocp5Dc{NW9mIBq?- zZ&lmT3=b`cl* z-4ycc_lA+m>n`Y-+=GETaKH)^&HY^R#I74xO8to>fEx(Vc)=U@Hq)OKvfs}iShC1R ztJQ$o?s*5Cdjdpyo*A#KhB=ON!amo%

ZBOTgVt}c4_x{gz+^jt+`{ibU zc7>bKY*3F!Oo+$#jAzyJUe|t3MQv*fmWagMvR{nsc_g{KE1RPtAvwv>$_*pg=h6b- zT^+>>lyt6tQv?JyggkO#tvO#m~>s{+>&PA)L{xT<6LStEy zcO$!Ik^}bpx^Dqb%bFQ(M>vZb)eA2vtNR$>#Orv5?9%2zw;!i=Ls)d(TY;W>JCnI^ zVAcd}cN`4e&+Q)f!i99+ZrPza?Jc=wWr#8W0R9a<_{k;)u!1>lEE)0;c1|SWM9b||e4~!9<-0v$3 zr|(jm{Njy_=TEHtiQ%xEeX{!AE+Hv_gfQmo*?o_U@3d_!0&18WDgi9IJ*HNWmTfC6 z|7$nE?KE7h+U*Q10*?tg8+ePV^nKQRx$SGLjPgeT6qGRsqlft$Mh9Zf) z^Lg8i2Pfw^4$v*uy3)5e9Yq+%=)d0OWzZqn@CoDgL^ZN^IA1qT7U~k+oUUO7!lLwi z0U{5G$JKezbgVt!rRC?-bDVqK;7r0&W;&ESR#O1tAfImfG)yylQlo(@nQ+*C-%O8m_~in@sqbX4kN7!ScOvp&jTQ{BnARIC(NP;-Lo@Jmxaef9 zFHs#mZC4tK$=28c#P&6I@p#kW|6t2WMGc$Sz#u^Ap*yCuX8Cdyh*28Zv=0^)P z8F2Ictilf*$Osn5gSN!15D0Aj0E{6DG_V~W?FvOX3d|QH9PdRfvMd@Hsq6?q;ZF%~ z={LFNYZc%J{ZtMh{sCKiCNxgznC9*Xqob@Ic7;r^7$O#nJqm;+8fVreIe=YMwy9P} z{}F=7*vaY8{fL!ooBeh&^28h4zF6&8s3BsuO{>VSd#119^_XU9KYQ^J+w+QA`4{=3 zcJ0aw+fZ>~c8}9=wXH2ugUy<4m^8^;m;eE?w|8(05#%8g@9_PJ>_+jGwD?RCY zP8KYF+i^8qnsS?~YB5W(ZPLc|xD#)G!$@jB9d0O}kQ^Fun=U^8vnhhiUcPgkBdlq!KdD`)RUSN%yBiH3A7>Ae$+|y8!Dd z;3GJ&*Zm?e`ztrlj!i;~=q^)+jFSW&OV{hm6A~{3W!woX8>KudLQa|X=QWQz0pfx2 zyf%_~f2?XFs8A$A|9EhQeIdRp)3W2}s#^1e7u;t=D9*i)yY3M+w(vPNtb1M|Eq z)jRo*R@wEFFgFw5_&PbCQHZ%Gd-JWjM71FpuL&1o%$S1r3SMvW*{d_OMSD(m#*slU zZC^|QmghVlZmEvy-`mF~JMF_?#DIDz`%xK>Vy9gAqF#ToArqN1+@bnmzVUt(2ndp07Sgk>mUh4c2Z zA9@k$d1ey6uT^nVfhDQp7E0&>hjz(iWlZe}t-D>Uq}vOm?aLAoS(C3EkEe;n#PT-z z4POwXV*-e;K&@5|-t(4^xwsy0N7#6;Ja1N9-Wi(Er$}_0@Cjsy`a^0Wb)m#F=XC7f z$#)~>bi7Wq=IJ7)F&NW&{=f^-!7v=C{Tay&U21G~D8p~napM)cV}L;zg0p`_a-Z$8 z3Q}RdzDMTrr`p27DstX1O0`q7{xz3!!sC>(n%DwU*-};N{fRw}uB9U>uI5gKpx<6j zOCEb3%kSHF8`TYvG&{yA#F-!2N^Vbq(wBzm~Ms39mF`-`?cFcH!M}hnPB!8;AAhy zrxNQdF@A>)Z;tbT>&xTT^E~|$0h)L*4qW@wr6FYqMucQ>vaoO9@ETp)PGr+_)-%KH zF8it)2h(Vp0T&L)UJKn<19#N9$e5y3v&!Jy!dcqNFuckC{+B(8wDmTx=e=l-^`|U% z9|V}0ixX}OxV^SpRFXAMCYg}Q24|&eTlk?r7`o7-8Vp#r<0;_0{nz+(hdmkF#p^7Y@tS2T>7T0R30LZ%ct(83+1LvH z9`F0NFJkyE96c;v$MYC7O|<$oY0$5hEA1FUJ#75p@qs=+*@|{EUd1j+2KD zpPJBdc2)g*{64L}CD@+TbRK_yA(Y5x@Mf~VkZdOzHeWQlH)BbvTCdvy-~I#}_lO14 z>sQwzqv!Qfonn-c`Hkn*B3Vr{=DK0TpDRjvmGWc$u&w;io^&~qL_Mfy;JB@~0BUp* zzc3Vt`a@y+3k3AMD!%tkwb`=bK9?JcK^AIxNl-yW%>H!PE{jb8pYJRd5m-6;*^{c1 zfX4`KUSYO=wh=Q^9qveRCD^`w-P%^)+;;>VMlpRBg4`@-4ha~T)|qfGtu1eC~NPOJkIB9 zUVCUM=UCaGLL@XqUs#XFpRRhge&m%jMzesdB7lr_Znr>?sNLrdkFj0aU>P9a^J!@7 z`7?pf^NLpHuui=NMu*#F-@{chU3Yh=w9xxU?~BOv&QLIbH2|I~GN0d(#m93YlLg9E z@9m{ec?Gt*ZYmfDg2D673Y>%$Wub$n^=GQQAvE3YD8q5QKgRZj_?lQ}L(7g}w!?X? zk-_PK;ip3%>*Dlc6z-FKzp0$V7zJ+%PNjA&CjU#f>(pvPc&bEDs>xJX>nPdDu2gO^ z)9*JCufCM#waaf_kJBSxB3bn>a=I65>c9LDi{4_y^{>H(&A(g5%kqL~Z?!z($SF|s z1q*b;0-tD$U@UxjYle3&PVB_uO(*K z>FN;kc0OGxQ=VJZoqQogQxo{v)h)ccno2eZM@9tz4I{#R-5YY+l-5ZVz{W*w_U5SL zxS(rRQ9oCR+o*R5cz&8rdm0SU^?aH&qG@^8?VCz7}3oY$kw)CUxx z1hkm`8}`B(7RIfr1fNrIY@*Wk5jtAm{B=8Wyzffnx_V)e@nNX317NC?5wZ1r9!T_Z z(P=+KuIrGklsMBxHMOgrhXTclEDi^LX6T&&voKV=ccb87@=JjqZ@$Yw4oEvMuA_l- z>q0?6Gck^@Up<`g{2=dELtT?i;IOgK_520U>+8SN_2EXceu$dWO!^&qdw!bc!V*5U z$OvL^y`#mi+Q_1_smYRm{tS!~GC9I+S8%izPVJZDeMRSadO)Ksf0ozKiX1+o`RTqp z=jJ)jgZnWHh}sxcA)FpHom|<3@A|gKhKSGbIS|HjPsUq9DW{2V6u#RqhC9h%+va}B zi7B&J11nojp$d6`$PxU4bx)g=mMz8#ebZXI0hB1z^;@xR#h@hcgrEuVibnjwq~V29 z(R8HP#(Hgx?>NfH0lIO#T;0&=b?tnX0fT>(7o;yUk2^!HhR;oaFT-kd-M0(AE18A3 zLAgI*LH&5PJDyLbd+^Bym)m_T1!ABm=J8(L_b0@e{ztdH!$SL>p@A*%Tayq@aA84R z66*}ZO}y@8#7A;L}q#P6OEs zIs>n9#tT{!(cR0j`5b&{HQEr88OCf1KC0PXmO%meJoSOYC=4E>W?=r7=z#cuVDn<% zdmHgSP3q;;M)}_+kF>XRrOXu+*dxZQIcP(@_9x+{dR=}#99z9;cH=nvdYHjG8m7MM zYv&S_89}x_p!ACV3eWrXs82+Sv}N$OBjHa}5vkEI$avA`I_}?1q;>twtpAAWh4QNi z@DLda{(`282>r0}+XGV>nd?N4#kw3A?nTkr_PQ|Ycst~btoHK}gXf|*pCfJJ-ch&d zL*C^xv^VugPWq8zwQ|nG(t{8q4qv73VgS4uD>Vs;TX0ty+BQ7{>BHUQ>fenlSyZQ*6 zO!}_3`$CS*?FP4u%Wn9Xrc!h|w@`e_5ZqUics*rnhh?Ipk6H2KV7e9|TpeM|*?!h( z?zg5!nJ$_uj)s!e_xZB*06OiKTBzg!smiwC5xRCLL4K*vmmCgLHqsR3W=m}u}=8k@DXs4+XeXbk=UB16EK zC3~Kf@%I1){^@cYTHSX1@?5aWCT?g1qLjrU6dQYmXh#WNN$OV8Zo7KD0l~bD&cw9a zhiAY>Is{Yb*fE|wW`!QiPk$(>{gUQM_SbZFwwjxnbO^EI<6rrg$`d!Md)Nj`=p|40 zP83#`qpk{O5(a}=qzY5*xXmq?EbLdQH>c3LVX0KvYtQH3h09pO&6*HN2X0))^wPk2 z9B}%#%dF@@kqp0j=+MhVP?9)U{bxeI&F57AiCvI0T%A-H?DxNCuNdfh^Pb|B?+W-c z@+(|9$5IC6rldkJg4~y0s;JuxW8P|2NKgsDI>IL$*dxTa7_-efqNof_R+NIHwAt3_ z01vRmHN0Q{gkj8TW@D}2k(J|ju$MN=R`}sTmhQRdU^O>A2I}m zAmnV0Hg|7E`rg@0W|~3XY)qE{3oLNb-h$k9@ufZ16fClX{^Y&8*z#w{nc{S*6ou)K z0p{+T*l(Vgu}^8$Rx=cJjNkD2-M$h&EyesQA`F1!ccf}b7MXNaR;#;ut1WFmK&=pJ ziVF_CVo;^k4MD;?c0-~E^Z7>cwR`Fv#w9K`*+YsbvBIDnM5^aOe^V>VX$sGg%YJjJ z%+0j~wz(5Ay%Pkzy*?WPLy&AjG;n;HZ_n27A~C-k_$UliAq%LJM4boo7wv_r>Qwp} zOU>sN|AF^@x^;R@*3@h_vy?UH%Ap%|O`EE!#_^^eX4O2(gD#yE0xjq3V(k$dpS90W z_CgmV3$cYg?O|`I>><@F+*2ECNkwlR^&FE`nQJq9+?~h}9{`h(Eaeq2{QIBPtBf$t zNdbgB6%8f0{>q$5<+{=86-b^;V`gVDP8?BHl)*^fFt6S3eu%gu9jR3cehW5pEr6VO z@|acXQbRtAtjE)uVjfoXY9rLr1cf2uhErV^N7y0U1Wj=C^~^c!8EQmfa|fOK&|4XF z)S7KM2$Slc@SF39kj|{Ph<4C_QFa9|oJT9=>`c{rA_I`ptGq-L87E13It+#g08aB1tO4f z=&y8q^1L)-@VWKBk2H!S*9dQ$?N*4kC`$4iCNQ?8XDuL;)0uqMLi>$!-fgIAKQqTb zR6Z(T#}9GbL#tmQR()6+z3_~^tWFRC5={%R@rc!*Mxc5-L|8#U6N09MIf;Ip4lwpp z=1eR_FsdS&(q#tFKTKU-)l+8+JM*3JnVycOp*ZCPg{mBmyUu{-(p+h51rqK6@MnC7!omj_0j zio6J=83TkYY&JO&BTJK3A2%jDy+_{pnn(#XD+I2{9xEoZ5C1TFweb`R5K|uGu0rh=sCBX~WDqYhQ&W zQEqwwxQF|R7;H$mqV&u-Ner*Mr#cK{JJd9*z&-eq>PxH{cd0z2M7nmbAR5}$-R3h{ zwMpjFY`QC)VwXj4@}+Pq(fn|lGcUvy7xQ@YW&y~3_}M0z#AfI0jrJWcC!A`cnH81O zGx)l%(R42ZDmyHxctkaF+3)qB0HJDhWeCec0mgjSBHp?cc_Qdryf3JJGzzW-*KgJb z5N#6>Goto+tuYnx1ziq@u>(bW!j9oZ)S|4aX}Ig;ZR3|cAR|~7QwchdznnL`c-o<$ zx2{tamvpOOP0$r4($~DNyDYMyXRVG8DZ{m^F0!MI4;`Lu3cph@0}wvx!lBfnF+b>LZKntHm^1sI!w$VuBONaZkkf*-dWQ|Y68wmce zeP&^YMQdEw+g&Tc5E3NKbI{JOq9I(#mmSl^^(7{ZX~ymN92_Fm=moE$bZwu4H$pM^ z?vkM6G_peUc-~7V<}v#dwZ-0B$Apyk3}L+!wV6WN03q&j{=oesg`G@x9@au-?08cN z4*43+s5(X^r^!n_IH-P42z1Mu@K(vO?Zc=au4DaK!lY84NfY{MvS|0gz)W3*@4IkO z$F+nB!YIQ-iGm%2!i;#)E7Jg?czxh-2kV)yC>lC72Q|vZ0!thM^TgDH*SZ%Tv!hNt zgnT|d*Hm|umf?iuSFE+P=Z5rsBkCyhf;I}f+|E9KJ(j9ZYi>~%f4san+uixkQ}s>V znpWB)Z5#+p5YC{J{P#Kxg3x_~bPNEh8bSUJMILjz3`C?Se1S7Me?%l0d-&6|`1?-V z@0KIU-H~j|MwMU$=ZY1guo(juE}5cl+KliMzBxe&$x(E9QrR4PIy6d2WFF9b?2or} zJm(03HA94sS+-n`L8G(bGRAFzHV)|Pu5_YXaQ1q(B*S7Sq4K>I(~WF>k!)Nz+e55Q z>)I)>?)S$FD|8d)?z22#7W8J;>FqkG@T(L1LsA7m27u>udp2a zx4r7Bsup&-y=GLFmG2-?9lll#)W+_Yu0P?(d@U~fpw$QDl}mfyW&1*A+RSN4vJiRiP-!^YXf4Aqz5T?XhGb9-*{HWWQUR3_s>4}5i~aT zwXa)-cNtsU$SysMbL&WLa^z0?dH;`nD^uN8=l|}RF!Mw zW3F-}2_$(4hwvltBFNRosH%xJrOuLxt`Z2F^edgCBrC6W^Rs0ZmnYbSc)Gj7gQc5Ep4eCIzIUiWen} z49E6bGHNeJfy3 z%&nW#YLYr59f-?8Ha;C|;i(dMIAOXuvKK3B9IKbY8qHlf8jr22#w*z!Kh!L(keZeL zF2qXSR_8IqyhsD(KqN)zBu$~jqpA{-MjNtVp_14ntju`*^4{GbolaFdUz9vN$qf~d z7JXxG0gHPy-y2ZfO7-V}_gwskhc0)eRG9^Be6-U;bzGyqmn1djMAVv4;;%I4nqN|e z$4PT$Hdf9dv(7>Z-9}lt@af9!l}PMs-woY{p3lMLU9HHs;U+c~Tvpl4Ru*qcw>d8f z3geFu7qG)kJxFu-MKaMa8bte#=I5y8!&OuyJQ^md=uj;=a?C5mxPVkG)mPM6RUG_*H?_9FINJ0Q$9P~tc9!rk}sgf8DdsuAtK5RRj zy|(rR3u>oHfBfc!s1Oy3n?m>TE-!V0^GremA`G;IIw&`kT$~CjKwsEx%#3RA7}kvC zki2r2tJIwZM+SPfO=oa2tiS*rnUE0pYN3;}rDp996R7B!nMPvM`KrqEx-hWJEI~LB zPdZhFEJ71s&}xCF%zNwzInKhuGF8bSA~K9)ho$g7;$*blq9a!Dz58p1-?n3{+b{KB zW|NnFRXC#N2_bbrdzYQ#q*wrtOzBKK9q&)!VEfX-d8^ zI`oQ5dp{bl`s}YgY_2VUBj5DOb1trE#YH4-KDS(Lyq*+C>Q}y3Z=I7(kb(D$z`nhW zw)tB&uGi>qyzfuVQ6YhNEE?bg}6ng;y% z!nOb-v|v%TaC5|osK=4D$u6HKE~5iI+6-1SDbvw`Pphu)Gjh3Fm4XK=wIS^CUFSCM ztZy%i@#+(H0DMkV{Rscg3(d5T=eePTJ&{U<+d%hgg)hau2i1lb(^B-??46I_P1?bn zR~dF+XGF1;3V1>{Uf=Hf1dG^MKveA0+T=*ijLgpFBBwePq=*>OV$0_5k75cG<%&6J z#7?}dKg7R^ql?p;bxMXUH@+HRw+i(L7zmh41}Gg$96z0kYjK%8-x!&XJk(Xy%El;u z>_6*y$@w*w+g5`Q-dz15(x@3xYSG4gtFiiY%&o9gOSIfDzh%n*!pLT}!=lz>TA+y8 z?Rh@dGmQ~xu3Tz=JYm}tf^^J~8u9?<^bvgbfvhqa<7#8_PCFJXvvt56&yMWmdnF4& zCKURy0UQ1k^?ucxf1Yk()Iy)<>894rv7d)!o^^Xzif&+q+0;O9fv)L(eC2X0gf->u zP0WgZ=8i(nh!Wk zcS4#zJa9WqyjE=-eBszjh_@RQM622a9AfjDp!?hazS*zccbvn_YBbxlw-9k$U2-6u z3H)^KOMIAT?*zd#OfgJ+!W0jk_om?#=06^gLkc?k{E5KIH$(p<;uKn7|0dr%DJkk*n0D@+ps7Jx&1yV9 zmvwLXMx*%CCIz*2eZiFD ze`o~&x@sT7nG*U}2`f!acWik0ls#wHKP z#XC+VF5&mXlKIYvkaXGfI=^yp!Yl`RUeJa0)+}lME-VTXd{FMWYI(ew`$?RT-C~cl zyhQiTiU?$Q8>`|2?_u;Qius$cM5Z#E=slg>PyQ)@@%Fgyj-Qa}Z&N8{^d44rI-JKS z%y{HfLn5Nxk#BV2J!{&(S8sIww(fKMomRIVRqf{+hO&z4))Hk_PYbJMwb`yBd){)G z&+97Xuj7UCe`vVky2Izj1!ooXW!!HJ)Gg==J6qS|ZM@q~ykd-~(G5)ZeM^-@C@SD^-+X(< z>7PrvypyKYsYBk+yoYYP8df%{v3EM022ckd_TB31k)g8)$a*d_Zs}o%T+)w?KQW}} zJ#bHTi9I>!ZBFLe(1oVa)pJ}mp-q*Fv6rd04UXYmCRX~)%|Y#$Kd^e&l?-?~oree* zO^4j7yi zT^=lyV$E0R0x7qFze%IJ6haB1CicLDjoes)_Zw)p06^14z$b>^6CY@O&Iwpp2IS{! z@$xX{nxY{7FyVKt!=5AQ(t)0&qgH(RGd$+^V@LMnweb4ZJ8Y_&* z=kU0KX8%OiL*zVZ7}avQ+WzFhbQRk=X*ao!KVd(m9c9b$B(2Z)>{398sKD%}pHZ#NN%lfw<`!RYkbWmf&vamB=&SZx1PvG%@?jwa8Lhb_+R1J1hPbF1mRmIR* z<=pd0K_@9ibtAJBa(XW~mHE6DH56P|4>I2w&Ih41(>xB&gnlEc9nCM(ZYVqynQ~3t zDax@43#OTAuXL$mG(*Qzi5t_qSrrER#I znufDUR>r?qm?=_a?iT=l#Yb`Zu3pw{KjC(ROn~w7TOSdBnc&Rk;{G1W{J}1Bei6(6 z0!rkFrMG#)e~XJwpNfS>fUV$kK8&8M?gMf4(Ac^KZ;OV4*qq8RrPxFCvES)VYC^gn zf+l}Skx`-E9%n2kTYt;M$}?;f@u0lF%O)W>yHZ}*EZOmE6@4B$OVfNIe4xUNcxxc) zf@GC(6adPO$WRWadh%ZtHvM^mF2}fcu*d83wwbZUsw_}>Jymzq;>t0+_WdfBY59-s ztssZ%XonnxWN_W!?}}j`Ke(@f43Y)`-Txe;;!^bfIU?qhQDFab1X6{=!~8E_vJDl8 zbYb>S$^8|Js=&R;cxNW!2ePF5L>riyd2IymsB%n=v5`b{k6{}m{sDRmWL>y zq9OjPrM*yrfA1w{>;^A*`q-ip(hUFWmr!D__9|&w4T}A%c)z)SyEo1{pqnC_=^tAS zO*y*tzJK{!+X;eY-2a8^|4T>gDE(W}rTYI?^a@m<44?7e9vZg`=+-3pS3h9Pll`^y zf6v1Ie?NiU`Xv|XAHx?hRxGfs8YKVag#Q2J`v~ZNoey^QVELyd|7XMQzqCEw7CG-!>}v;!L&^O z+b@Q&>PY`LL+yX+2>XC;7`MM3HB_@I)&GzA_V4}N0RJDY+JXwK7ydi2tG|^=^!#n= zf9pc4ie@#tz7|ZZ~IYLc6{$I<%|Jj`TuN)!6^QSMw>tD|J4?izaU|U^L z|Er5a&=BWQ{|C zll_;pnVr>}@C{!>SsHo52Bxuj+^}gzM*Q25ho&;W5fUxP=>Ajjdq~qGO4Ck_-$p3w zw|RrxJrARRk3kUsPi=1*6j%54i3WG~hT!fHTp9=-+yVr53l5>t#vwQ%!QCZ52oS7s z_h2Exy^#RjxHJ7c|EZ~WX5J6CZr$78cJ-;=r_SlU_F8NI#5__;HeGFMJE~ za&*aWpo9)$tt8SQ>XM23XX21$ASncK^jM4(_jr(kUbfx09+xmoGsOxS z3O=DGr~QV*aw)?vBtIn;2W)^YPAwuvJ{jLE8Bj22n;h4*yn2I;{+~b%to^yhs7Rz; zXmvS9`Fyyh{4=mS0w$+NO>81k$hi<{gsF1#8q=N;6DkPv*Hy_-ZYX1kUOK}DrHSv% zIqg82Vt@pLF$A}kFa8AKhg73m^eXqJybfdR)hc$Ew)61)`w{^=tdz0d>6ur8HuICGu&IWsDki&^g91T$=OpLs-;@XzW7MvdeS zI(g{bGIIvm-Tdh!unO@8q;4X7BGyXyzpliHxZ|s`Q6gjRdTH_t&GE=v5h70Dv{2|u zc`oiAN%2Tggnp~?7HNl4SYj1~7v~}u^{}K(6#;-k72A&Gsiy|!(R+8Oi5{3A3x|dE z^lkO~wPjbdNXB8ew$8Ul0P5D_cW78>j|=%zM-p#_Yeb4tt{IdWK402#&_jGG<}u6t zeWU9eLaXT92C{iB_uKb0R<07&i0~d!gmM2(h7z=dg+NhX-y4(Df(iW|Hu*p<2TJNv z2(xLx3^fWwXho=<18{9gjwxxAE6=+Vws@rYT|BAUF;Kup5;} zFry9Em4g6VTVKHmX7h)}x~bp`QoT!gp^|JIvfL{6n4nbhFtb6kEJPP;YKlBJh5e@< zdPgg7+XgQq1&{M*7(ec^2nXPWOg}wCDgpVl)^O;-k>Jhv&M4*l4?(M!37K9K6P;*-QKB2#=Cl*3a^B_kvltXQXrmr2lhi)1~(qXlk7s?)qO+t3(Am zPO+unRQuF13dKX$-oqC&6sHR0aIu;|j+Hh2j_2hYM}Xe;yUUwBzpfH)RhlZUOM;g_U!}&cdAG_8ZsG6e}@o zNK5&9^!&q07wpm2!&t58f79n}z2phoC1?@Sl`is&$tUD3GGJ5Gqho1otRBsPlVjSk zTEdp>vcDEmQ8>Zv4`%E?xh_TP?ap{>AUIjVOHq8A=)|6SZ~)0$KC`56GO>pqq;_5O zW8n-pPFCwV0yyqnFbT&a9RpfLSqqucMp&6{>`lKEZ(QXP|0k!LB}vU_lnXXM6dTGN zRqtUG4!ow|L3FEDHJ{|QtVNLRS)D5LNnh6MaJAVC*|8jjxMBuPB!=tq*J0O&J-=Qf zyUx6b!Xz7K`%gLyrweO;abqg;0t=JC>#n8&dq-AaW71>PzNi6kcFT=@n{Y%xI2O36 zVRw5J!FQxMPci`OitvO}bSE6ucjD^+ZiUqhnYOU3&Z{po@2>(gFZa|Jujw&m0^a%z zk13AB)+YRZzN3(5rrSXNYW^Mh)mjiv4LPqOSyY$=cYqf#F5yomeC)_^bqV(!7(t;G zF%LRH;|75lw(xi`ZLvq#zN<8|uv?y)lJ4PRo2ICB4EBGkVX_BiDD%sv7VlB|oethV zGvCxbjWvsEAM*Fjx6MT0GJP#C$9dgrsq^W8U_lkWy`UAs@J||W)BW0hLb>D3cy!@n zM9X?!{G`c0PJSv0)pd&3Kg3>VaX%Ongj3Ol3w4D6%*l7mx-r0<1lg7dbcb~?3T@z_ zs*wFBBMEl_PRG9lGEYWAq9WUMCZ|0(eCmUer&9yp8v19xRgv*M9}7?1dZ0g@-Pky~ z!ZuPKuZut+y!G2BE!a}d9BgTxV_$cfEFv0j_>n*+%3?j}mAxhyrO}>GHhB#NKD$k@ zkw-vbX%kF*e=H98lFAP$s-({3NO{AQ3upXX#y?_DSY(dr%*>9BP7tM7NjP}7Cq>R{ z8f|_+o-5@9zJY{Lut_rIX_iz~VTFLXcQd`neev^w|4rXPrALz)wF_A+c}ynZXmVm-PM7$|XfeGtJ$ z8%SE;b;gL0_)pfRj~%8BL_GjuujwN#THND3>SFd6CCg2#O&b^jeXeT6X?((2Ux3e;ogCfKu|ASB_0lzgOg#%Nt3 zj98g7{WXN=qgX$U!_5*gwjb_CAM7g9{)xaj%(TPoO})j0tz$6be=50W@g~F1E*qt| z8K_>dyWeA>Z7|XF@e-Z_d9Dod(o|g@dDf4nB8l7?KCFsFGjVI30UPC#?t^F)K}ge5 zkEkN=-zD1$CRN8_UmPru^ef>GGbq!9+j1s(+6-C3Hjpa6a>|PV2FJdPbLd)A3i|L% zg%F@$9QV&cC=k}Z3iQOU?d-$}FKnheuU?x-CH?rtikJJsz)r^! zJt+%I(7EH@tghv69ICpCnTc;Lf)iNnHH|i!D6h%5aDYVr*`A(hmhkNJ`{W|n>)Uai`$vgd6E8H6x)f{ z>q><#;!-p8SK>Faxgl%Dlub|%Au?hRcr*wi4HhY%&Wegw$CZw`QnovNr@k#t$88Zw z;Q&FmP{fqKrs;LDgR>^zTb{g^5BJC1Wke4OpcZxeB2}~LJne+`rQE5iQW558%MJ6>+uM5zm&D;04fxAiui$D0#mP1EC*qa8)czIn*oi-Szhdh(Lb zAWA>DQMLXclXPLkmagPZohw?>b)TrFeC8SP!@?78eX1u^QmYvT)`TydY)#pLNM+7+ zN8ikp_9~Nd`mwct5TJiB{3_y8ArSP2xIJIe$ef)P1i?Ys?gClDE0~_X>+jOmC+Pt= zh78QDK7renx3+p~_w^s=8aV@YUTfnfnZ)^R8^o?Uv>hg4dDxI=ij=j&>k`HUU!dS zi;9Gw>1ix|wmFbeme=wghop!yOQuBZZ}xy(JFa7DMk~! zY?}M#*{}4l*%b(Dffj7Tspj8)kk<>wG0%S@w(pe0Kv;KUDJ9b;bVUSg*6UgHlO#W7 zh1_{Qu~;ZH{U8rU$M2={fAUVV=rJc@-PqqwmN%G>xZax@#+gIB5Ua{+UgaffS#Bbm zx=#^&8ZOWwBkh8CWI^6_tFGyZGQtFF0~Z|fTJyL!1D+FdBt(uaRFXCh!IV$QYz5BX z@a2v6fDeM_QGBx}ZxxF4%Hv*>n*)Cqvh4%K)uMED; zL8cQ#Ha4`|#)>2yo87Q`MXGG&Ky7E?g-G3O36ZLWs1mqIQgGGMhgA`ZF!2UiqMZ{k zqf6j|Uwwcql2%qnQVRH1s9s|bI>Tk%;0aDZvd|L%1jL z+dAbtV%jB0NhzZ@$~M<*s=UHAiJj&i8K|~W!BIyIdois_Hrav9>AA7pS-QK0!yn*J zm(Wl6Sn~PTA0Z?C>RzE@%#tW9zA?Q=+99&X>H89?#o=}C=QD`wz*9Cd)>wLES_^7ZM;_n=R>jR}^T1?U1RxY(zON}_2>MysF7 zUPuk<3>9XCQGC4J-BYBxCKF7^xWY2osuEEM3i_DE>%+Gel!As2BR-rC7*V^@7t*;kjuWc)Q!^Ga}U|$ATx7DkQvz+$03SnXu?#apssb2 zLWEV(P2_lB(0A7fx*)(<)@_hTjzgEia$m6Vl0bpXj#B(Z^_+F6KlV9I0XEGco+tKI`=uKE zk-96Q;|Yebii~VUH;b#64XsA4%YH!xLq6SH?Cv7VF#jOl6})yS~|L5c^@PZh2<5yls(EDcbmY1&(=+8x!Nqa+Dyt-7Q;E6*ybH z72(wGXZ@rq{h{$Sea9RkE@_H^&VfF`0v5aSE zE`IKv$I(aFQ-%bNYf*`E1VOzU13cX%$VV>op^c%}V@iKUiQ z450Xbb9S+vLBTZ%4QCmuOx+*tz>R2N?*>&S-=7nUsk_h;pt1Xn@S#(9mrwWUO-n(S zv{&ydyjw>cY5~!3t>VYk;vv2ej$WzSp8$EZb*Es?EITq${`H+tMJgk6JhD+l zmcU&HIksYCn)8t#LrU-8H4tmm{3^0K4tQ_eiSF7Y03>g{Y_pBz^QHoiUtER{nT{|M z**P(ODzN~J>fAbgx)nGt5ZuE+B1d>5zEATvp{Ip-PEFc-Jj& zk5}mdw4c9jwH-ZKc`{38*5RvY7R+RxcO{{eOck{h$64xxN(#6n?!4II(@VYOKY*#m zDlze%gHIVj83;#D30?Sr%uF){ae` zn2;jeAv1DLFT&A=qfya0pK0HxC%C4(nNwqWEiQY_pFtRM9$#Sn=T0KmX9Wu(gV>RI z`4mGb8q&m7^=62jF*_$4{&@OGFi{{ACRYi53c0E+1|5wBp%McGuHQ5?TIptSVh7*OHb!uy=N~LJ0&}m&&)0V9{k!=|{7Fv5TMOi@Esomrr;P<6qDpQmWkH-~ZppH7m zNEQ@<5(Ew&;ZIf*bWc8y()>4gu3Xn`969`~^89<3I{_sld z@P>px=~kP>6)&Ftq9Ej(Y+uVutPSL$0E!Q+tw;(*&U_Th3ucJaE=>(1hJ$G0; zXb?XOhRc-+P>o$XXgc^nbSW9(+FZAvae84(`fov@bq7-cWt zNJ65bh0V=)CL#+nJwA%^!P4ox#?fzCOC7}&n226;ruKb8(B#V8aKd-VDhuz^@h**i zSko?9yCP~v6b;|Y)=TJfB1)13)-a7HYJTf8!-R1wCd%~+wb}gkg0L?Lp0f-dzrWbR zkhwv+TJ^K|+jt7xUu&i=7W#Xu4v0_Z9@v}A(SB=wkS_-*!!i+RDRlFeHgJ2Tn~-y7 z1mH^NDSk6m__dlm)$&CxFufS;4pzpM`WSOU7Wjm>t;&0PPyOO6J8 zf;VCt8*D2(l18Y{26c&7!@|1^_SDJ%VZK~@8>`n2)&u*V3ENUi2`ea8faR9;019cB z0IQAA6OiA@dv%Eu=Fb@Ym;%RS-#yD#d5)%;&(WHf;>5EstGYMsG=8) znnR>d1!CWjK#Tj9{5F2y5 zt6Ac$A2*M3Z;>q+74TYeCI5NTpragNW=h~@@~ph_G#o-M0dUk>Ix`n~l~!pJJ=3Fj z{c{YWYoYO8gSEl&67VjNJS5Yd&huw}-M2Qbr%N=HXI1_n*vT?x405LUk+kXkZNZaWVT%lgNV2%G15gLAF7r^tlEgM}VE+ zvkfSj_vWOfewg-N!6!`<&cPjR}NP5=G!S_q#g+N+h!ZIpbt@eC`>PH{)U~X zOZ9rEH<$mM&+f_5k_jV7=e4!Q-RS8YDwYEHHe-V!*T7uQAu38C+iyqPg$QqN|A7Um z2l!f`$J}I#<=AJ6Z=eHgbt#xErIXPV+>+ zP0JM&6{>FRQHR9JNQ1hM*c*jO28!+z`%y%nUdTMI<{7nqU>d?(LYW3$(&q>48AC44 zB=_ga=$?v!5?haemxB9MS(ZR z^Y-eIQi6l`sMK$laefCrQ2HF{sG(Hg=W%D94|?0#Vwd>Ycf}><{MuHt=pqLDUx@$p z>v^iIi{1F+P*JF?;eK(T_mQHaGn`3N5~Z2cvZ=vH?AXrqths)3(3sBJNCS~+Zgx<9 zKV5T7bbwvfgE6M1AKC4@&+(r`{8=@n?;Ixrj{PCs&LsIkA)NV-+h&x4&SI=uIbj*k zB2+n|ZhbHvX@T9_49_Fi?!mxD3d{Q7p~AoxOdJZLujY+N&|H72as*m5;Ii&@bsJfC z`>hB>>e!%*eUh^0;_AHM85it-L-f_Ci-rV0Gq#N`D3j;t0yxaJL0F-R)wN$( zOTi}2L6^H34O^XmC?!KI;*z~qo;ud8ZezS>N`3&Iea~w%&t~<%LcPU2R`Nlo$D;5B zceD8G^}IykbMlfO?(Q^R6ApxKU>#;ked?mc=}zAQSo15~l2_Gs zB|V8h2^AkLy7v9jFfmry_-@Db%XKx}*Y~crpOYNl(ABvwdWiCuXtVV~y3*HL_g?3x zI`{V_fz)psWLtu4UZ&S=`{UIbH8xkZ&Nn}QFkjDFzPk6@`SBPMt!4E#%x`W_;;TEs zeKe2Bw~&7HwQ+lg8)1zhV2KjrIP6q3fW5e=nD951Bnj?V@{<;O$V-@v&KFoY;wUV6 zc%}ku;p0%%om(biAg9o`d3BYs)#l9S=45y97uHW`qZ&k%h>(JIC~{Z_?*HkOM4kfO z8sE8Fvi|MO1K%+*&UmQ@Z=%`n`xUAs=R3NoTRyZt!jG2ShjH{+OG5O>`80!(y6+!( zG9UiB7@ci;P2`D^ROESL=Y#%w{+%X1uWeb4LJG#PI{Qq4$hN@L1WyMTx-TXlp9$(EHu+#9xQT5DksF8zWz4y3#(x%nz!vBPh zPRqndhFk}#BYNj9zkYR887n9KMiG5{V51ZXAjHq(C$bsB9e(h~AxwO`J)U6}m!@^k z9r9rtukz#Pj)sYIe*(9=U01Qcu}q-Es()2B=JlrO8;Y=8gXFHt*aJ7C9DY{#5kQ`n zT!gxGh6FWUqSd@(nSc8!p}9C|_@r?f^d z6`^N*k6ZV6x47!lgizS(b*b-~5)vfKS#%#F0Q)e7_#V~k=$M7&xOZhOj@u0U4u(%9 zWZk4N3MiC?3?XR!w+;o0p?${@e)dJY8N<=#O1S}tRINwDGK1-p)Eq&q)`MHSnU{Ce zptDqE&s{RZjUo)%Vt%SfBknyRe~fp>zdw5*fMx}u=B(tiLENM@1oFN^@zJ+xDdx>c zIl#=AGWX6zJNM~c3@N5T1UTj0{Wfd;_w|slKYX1@ zEU(u4i>VqL&N}_wjGsE4DFN7+MXy@?e3~ zn_U{1dW~klUxpFIg{-rTicDEK;W7!mMW*WBPK3e({q zO}O-UZp<#v5<;ASzXTnu|19cnOYhy&$obiFDl38Le(uxbuG=sJ0Ph@y z_y+HUT@Ys4K^UjC@1hkrqc;0}k}x9B@$H@3=l}qdls8A-G|hrDj;wl+4C|bxcHO=2 zRQmHDytk|n%zmFQwdah4_+m$eA(+AUSBl2|RIiKphZ0{Ray`bGr8q0dTVG#HfjbT+ z&=y>|4MQ|?sJyoJ%a~WZBs!@)3I@SYtMql>I~Ky~fnKTd+$V_erRxK{E6|B~{AY)j zMO->RHiV#CLTQ%IUF@)Wp5!C5qB`v(x*+XH$o=UsF~}Vuuaw336@yhXSC#?2eW5jV z&p>GzG5DXhm0cj0$eQ~?I_GVfS z6Sh4r4~Dm0DqhC8Xi6fl1LLFOUM2M`RM14$2VYqRolh`%Y*Wa@)0uiO^2)e@gC3jY zTX+l$q()!fC%(e(7uAFo|Cd#;4jxLqSvpYe;J5Hh4@tKAojhpR8U$}Df$uhI4n$SZ zMKBE!^oQ~i(Rkm0^bP!)XdfOQ3b3M&Q+q#)i(77488yAf8sp+LdcBHqf6_sxJBl0P zImgHEl`KtoR?`9&@LssSyhD~NILy2GqX!@9CulGK?9qzdaHZ)iXEz`edY9m7*&TA@ zF=Z;csVpy#l1MYXn7fFXfKE#gZfwPkYuBM5nq1|AMLw$+4=&T52jsS zWNSg&8rYRQpn~h!ZVNix{pFW9$3W$O+WqpOr+9w`5;6P6k2E0JmMO zS4(^|+E7IO6Z)Dx63=DP#>IwY7NW$MrI5i(R>@x9vvR#Q{Ht9;>inWHp#nDm|8L9> zqZ;Y}ecM^V?{e2)wVp?20q$oA#oxeDyoO^$ORx+F;gfFKCq{;GB93)FuGMpA0}e!wkkt{n|N zJaoAGs9TvxD@|_EeF(rF@D{L?1!E)Hf{5q28F3BeH+x^Y`~v%1QR^N8fLcQ@!Df_grXX!Mb95(zp2{y3DWW^oM19IYt*|q`ZG^&K>{I`>tT%VG6C|0( zL}c^Q&|=8GyhfilCVG$jx~<}lr*cmf{%L&AG#3G=CMc$ObNh{}=tYS#Za;_e%doU$ zG0b7QpchG5O$14M#p^b0x%{3oxg+6YSR_N+tyqCxR#wM_ot|Sw_nZ5V!yA>4O52$z zLtBk8$6D8Lv5+lux0ySvw78?^<#A7vYkQ;Nj@`_wU9srL(vSCB^Qssdtti*MqZo9t zB=`l9CBRo$7&PCfWo$2>?NH@YAzW4k{!`Gbk8Xo$TGCMz=Af{$AGY`^G(6&THMHI= z@MV-Djk0=XEEiuVp*a}eA^#Cg>b?c)F}e$7nwRb?%W!F&`W7qpRQS=TJAlQl?Ut3< z_!A!~WD0ho42O3<-vQm)51^zB(2Wj+J}NdOxs%{G0Rfo+WY^2 zIBD2m)i047yq9Ivv>_jK?2^H#OCo1bK#O^9HwTSGcs?jh=Sw5h{N6nr{_4=tD#?-u zjH<`iSa-v=_%=(^GzY3Gg2|x;_h{~kLVXlzKdRK%8|$(q|Thq`vrly2}jQ9 zHyDMC`%&H8adE)l8#fG(r#}u1IqDmb^Dcxf2%oGmm7-iv@)MI%aq;(+;H;k&&z2V_ zGZ@Ww41a~)2p)DEM7PM|D(If}m2aNF!HMDA$xO*ov1M1tv*LL0>_MZodi#>|yJ}b` zwOh|NqJ*?bl0m1i@DYd_J!;)oquBms0#2MMQL<)E?hG4#IR4|{ap92E*9Nsn_;cDF zqngHA1UA6Cs4A^j*21L{KrR6hFx_86U)p&NUUx_Ea2akq*d+BrfqwXFfnbq31ZRlf z{|tweFhh6ahCSiBfA6lg^>)v~dNX{G`;m0TTboCvfp3P58y|ss##_wFe8(^@n5P8d z7SSZ9SlH&E=KS@^IT>5Ylb184a-=Na0o+@*fg6F-0*vwVS2XusGLDu)A(tzxJ5znK zsq4Gn+2Z-N6hgexqp?rf`mqcS`dc98p{JZ_O5~-yA3BA!i00qQaeXvF-nirbP@-r%~HOQs4r0P+YxS{yG}Fj=LYtW71-I+Vq+lW48=)xKTo2|Mh}oV7F|n*sDph8sT=`qM$&E+m>O zP4-PQRv5eV;=_?RNKnYSh}|oSw66;{85*z_PpQ`1`)!EK5_t-aHXh)(?`*cxmP*+v z4scHVW-Lp!{bn5>I?Dq?e{{6D2{w-YGL1|H6dkgtsmJ|78YU-Ajs2>izE3*P6DsYu zb-B2=l^S?j3dL&T2O2bL%lFqeY&JsZ+=u#oW`-QNi^`!ymO*E?XS9#Nwbs5tQ+XSM z(mB#XDPF?LBKA?nGEZL6vpJANw76n6d-^nc>{G*Mm+vYwJd+N@m#@rV{!yIHR0IH& z@OqwUxJwGBwCLsBhPTF2{UWMnnO8ap>FOAHzVd6nt2xO#s%RSA3gG%>64J`q<;`sh~aM&$Y zEgB&!vd5Mc3cOoX&dhGmy{v|C(U!2<;vF^B1agXd%ypwr_+*V%1KwVrpwn5a&MPxz zmg#7BzreFE^~56$2rf5zTjYsFg(hVChdYrZnT!7|G6NsPinap4?oMkb6woF{#-w&@ zXZNM9v~KNzSpM#{0uKc(tzjWQrgC51p;Sf%+|n7l(ltk^FxR>_t;9>MN#ar8SVv=% zSSg*V8$F>o$}72u^EEgE7)2;N!``nZ^IDD#^%M8ZcxB``V;zY@lT`5r6H)R^0S%)R zaKt8_AX+OnTIkd|Vwl-WNJ1!SS4V+S$CeWFwyd10EY-1eLRii*h2Rghw!RbSI5v5+ zWad}vi&T~7`}v>2Y@>nml(u95vrpC)vfJehIleM)Y*YFB5%>XG&XRf?sUQ)6c4T_) zX1PE`15VR*>!f5Gxg5J`FO<;cx1i?2oWiWOo{x$VN1@c$4XhrL1l?HvDVE=q$_b8( z5YoMK4<4}~;9;iN^{OB2oZ7wAs2v>~u+KmP-qNYVLMe)^8Cxt8n#1Ml@4G0f&ybhzJizZBi{~}cevxJ07@ni@2bT6Du`I9>H&d_x4VT2 z8kXKr%t}cSVfENW0x~I%@CDoP-E1XFg;sc|Q+bNktHhhsawA#Zk7p``3+gq%RVH`d ziEmu*oxvU&gmG*#iWG{4UF}oM92+dMAn?lwe=0=(Q-}9(Te6I1VLV}^L@ram^QX>2 zPk2&Ixb|B5c3`%hTmHhx2h-{C&fo*1|1?wmU^KJ`jBvj!UYN01h zm=mdwu*3Y>CcKG`_>w>DB2OVtQRr^O6ZAOTiMm3t4_OC-p%bACbv3iy;e|wZLR-Zv zK>+=TA*G0eCi_geS45~;=K)TbXQTj6b3>{Y>QTOWcUH%Ms`l(gEPyNk<*rII?o4@o z3aZ~J&rJBK3i67wy)s)?$hlBI9r$v-M-CvT-Aw4V?- z5p6H&kc=)+GI<&#;qc=#23U$tqnvV3+B#)kGYHi>i;;dnw|J)z!FJ0L5S{S5Us%WS zLfN-|zDM&85qKlinX**uwQ22(3v-4@4ZUN~ac23;+Z}@24;L;;MR5bekkv}?Ss|+F zxg4aeGR0|5e}zRO5)4w1Ig#RowaA}n@L14{^Ecn-Ht9-L2~DvLdYpv_3e_0{sbx<4 z$1MPpL(!S9`d%mZ;V}=kjM*Edp*^9BDuU1H1G&Z*pCFZoyYny-U zPnN{D5PKA2b0&s3lugo~4j0%;>2Q+?MRGKfi8~>>8y2(oX%;Xme?_HmMoOmcMIy zfjF3=!7KT^+mYw+R2U?Gn&}+uB)7WJ4EQBI9Mr$NJC&CdG#!7{41!4h+8w5QbUS4Y zT=aiFX%A-X{$e38!I9xUL))5=CrOD=QA~8&)0r^HguZg$c2D=G@m72~+Q(|Oc{9aQ zbmh?gJL(jI!V;;}1#};ycD?^C>;q>G~Q(Q;q_$*+;U% zESj(p?=?Tpyi)CwZ$;07UPyFksVBsWqFEeGV zwbkT#zG>+Bd3Cu0va(;b*oLr#cJLczlF+&$=X=71rXe4`8oo??Hy*c%4dU zapni7=;+mY0Ex6kIf}IMHTTU|A(EJZ@C^p3n2;KwVh8nxB6~sKH}k22spuAm|iWg%}IwyremHj=3&GP}n_4|KW zB~I7PL}&aFy($IhW3@$Dl&3VWEyh?|#GiO3`4}OBS?S1~sdeTS-#P%m=V|J_~S-+L%|Me^7$|6HrW`@(VM z%YMB=qQ~-GS(MLHYvPCDD+4(!9bCiv@nTKWpveepi>NLcIC zy))I85Lt1;HXOcP?zQpBWLGk|SDoslbU#@<=6E8%_U4cv7ri~Yf)lVH8&Y~75BtR8 zQ5Z^?Pl|haaCU>N1tK4YHS+fGy@y+0(rs!o=dB`;yd5(&r3yeL^A|7B0#p^`^xvTu zEvlYc49AxRzf{9`S#K)Pt;1`mFznd5ZRqoXB=7pPE@vMCR(2~s4?x-?25&`*d*)R+A0C z?39<_EjbE)$i7ex5r1BKe6Orbmi*U8$}rwwv^sc$Z256{GdRUstl7Qeaq3{(O=4EH zRrBPf%SraK$P)PD+xVP8n2*>#h;Fs1_3=zkDSwk=s6aB}+2?en9;X8(zQ}{Iq<^%? zoAkb#XQtkJ=_C_BuI`R&-4yqIJVvjt0iG`R{`Z#|Ct@Kc+7dJ?O3?F`h^dpSAIEMM zo^FGe){aZ3E&cUZ{SqOoMaM_W)^#=o%Uk|SzYbPTcd8_ZA3c>@`)?hVt@^}26oXn3 zY$5u9M2WLD>-+_HImNonF3VW0M0zq*RHC@m=j-VNVo&Wj`tkVmvdy*I0!;RHp}YF& zj~&^dnVZ>t(;vBE>0sSl3tcWZPs3OLvJY>>@&*wA00a$b2><^T)AGM#ef?MZo5!}D z--O%0Gepl|{V$s3|G!+w|1T+cYp;t+rLmAO$1KXYG;v?Cw!T<)6!<;RlST?;n-PFxpI~urTU}k5(X?+9OV3 zro2ayVT)XF?a#Qt?v_dti3N%OdAx^N3_vK$O`oCVU}OGZOw;PyzNF6@VE|N> zO2HU&reLCp$lq6>(E7{Ne<*ngT1>>4y_SSo>gc1k#9^{MZ5Z;v9l?2|aSAt1)bUTT zEG8*@q#M_Y+Uz%NbIp3NpQMnGW|#jEiW0QAsx?v^Js!z!j;`-hH7kg)=boVFu!#^C z)uQSe3UMv$toP`0;LmKgrt49m5)#_{HxIONSOkl;#{aS$fr*vW;p7Yam8!3gs`Rmo z3h5FrCt=6ZTO-uyc(maj^l?6d@hLLMe1l;Dif6E`NPSlFfBv%DdKwHCq0=U$*te!@ z2QPv#Q`OM;?K@s>IWbSJb9i2Vf44FH z6W~wUKTaV|^#1pN-*NQMIQ5^vH_^fqzAOh9@HGbLl z&m@cgeE;80`v2%A{>!BQ-qe2?{}Ubmn@JBUw!Pm36Uj9YVx!H>uOy(I)(@V7FKM3W Y-fF(s5=3uAeS!F>Drzd!y|xVhA9>m_UH||9 literal 0 HcmV?d00001 diff --git a/windows/deployment/planning/windows-11-deprecated-features.md b/windows/deployment/planning/windows-11-deprecated-features.md index ab1098d47a..7688a3ec96 100644 --- a/windows/deployment/planning/windows-11-deprecated-features.md +++ b/windows/deployment/planning/windows-11-deprecated-features.md @@ -11,11 +11,12 @@ ms.author: greglin manager: laurawi ms.topic: article --- -# Windows 10 features we’re no longer developing + +# Windows 11 features we’re no longer developing > Applies to: Windows 11 -Each version of Windows 10 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that are no longer being developed in Windows 10. For information about features that have been removed, see [Features we removed](windows-10-removed-features.md). +Each version of Windows 11 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that are no longer being developed in Windows 11. For information about features that have been removed, see [Features we removed](windows-11-removed-features.md). The features described below are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. @@ -26,4 +27,4 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| Internet Explorer (IE) 11 | The IE11 desktop application will end support for certain operating systems starting June 15, 2022. For more information, see [Internet Explorer 11](/lifecycle/products/internet-explorer-11). | 21H1 | \ No newline at end of file +| Feature | Description | Version | \ No newline at end of file diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md index 34cd47b43c..4c06d90db1 100644 --- a/windows/deployment/planning/windows-11-removed-features.md +++ b/windows/deployment/planning/windows-11-removed-features.md @@ -1,6 +1,6 @@ --- title: Windows 11 - Features that have been removed -description: In this article, learn about the features and functionality that has been removed or replaced in Windows 10. +description: In this article, learn about the features and functionality that has been removed or replaced in Windows 11. ms.prod: w11 ms.mktglfcycl: plan ms.localizationpriority: medium @@ -17,7 +17,7 @@ ms.custom: seo-marvel-apr2020 > Applies to: Windows 11 -Windows 11 adds new features and functionality; however some features are removed. Below is a summary of features and functionalities that are present in earlier versions of Windows 10/11, but are removed in the specified versions of Windows 11. **The list below is subject to change and might not include every affected feature or functionality.** +Windows 11 adds new features and functionality; however some features are removed. Below is a summary of features and functionalities that are present in earlier versions of Windows 10 or Windows 11, but are removed in the specified version of Windows 11. **The list below is subject to change and might not include every affected feature or functionality.** > [!NOTE] > Join the [Windows Insider program](https://insider.windows.com) to get early access to new Windows 11 builds and test these changes yourself. @@ -26,5 +26,5 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | -| WDS image deployment | End to end WDS deployment workflows that use boot.wim from installation media are affected. For more information, see [WDS boot image support](wds-boot-support.md) | Windows 11 | +| WDS image deployment | End to end WDS deployment workflows that use boot.wim from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](..\wds-boot-support.md) | Windows 11 | From 714385cf3680030f1eb2231d9a7c3c6864b9788d Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 13:10:54 -0700 Subject: [PATCH 0074/1214] link? --- windows/deployment/planning/windows-11-removed-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md index 4c06d90db1..e4cbcdea4b 100644 --- a/windows/deployment/planning/windows-11-removed-features.md +++ b/windows/deployment/planning/windows-11-removed-features.md @@ -26,5 +26,5 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | -| WDS image deployment | End to end WDS deployment workflows that use boot.wim from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](..\wds-boot-support.md) | Windows 11 | +| WDS image deployment | End to end WDS deployment workflows that use boot.wim from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | From d99ce40cd68160a8b8e9098d5dbd6d422face5ae Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 13:36:42 -0700 Subject: [PATCH 0075/1214] draft --- windows/deployment/TOC.yml | 2 - .../windows-11-deprecated-features.md | 30 -------------- .../planning/windows-11-removed-features.md | 2 +- windows/deployment/wds-boot-support.md | 39 ++++++++++--------- 4 files changed, 21 insertions(+), 52 deletions(-) delete mode 100644 windows/deployment/planning/windows-11-deprecated-features.md diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 1923bd541b..fef24107a3 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -68,8 +68,6 @@ items: - name: Windows 10 deprecated features href: planning/windows-10-deprecated-features.md - - name: Windows 11 deprecated features - href: planning/windows-11-deprecated-features.md - name: Features we removed items: - name: Windows 10 features removed diff --git a/windows/deployment/planning/windows-11-deprecated-features.md b/windows/deployment/planning/windows-11-deprecated-features.md deleted file mode 100644 index 7688a3ec96..0000000000 --- a/windows/deployment/planning/windows-11-deprecated-features.md +++ /dev/null @@ -1,30 +0,0 @@ ---- -title: Windows 11 features we’re no longer developing -description: Review the list of features that are no longer being developed in Windows 11 -ms.prod: w11 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.author: greglin -manager: laurawi -ms.topic: article ---- - -# Windows 11 features we’re no longer developing - -> Applies to: Windows 11 - -Each version of Windows 11 adds new features and functionality; occasionally we also remove features and functionality, often because we've added a better option. Below are the details about the features and functionalities that are no longer being developed in Windows 11. For information about features that have been removed, see [Features we removed](windows-11-removed-features.md). - -The features described below are no longer being actively developed, and might be removed in a future update. Some features have been replaced with other features or functionality and some are now available from other sources. - -**The following list is subject to change and might not include every affected feature or functionality.** - -> [!NOTE] -> If you have feedback about the proposed replacement of any of these features, you can use the [Feedback Hub app](https://support.microsoft.com/help/4021566/windows-10-send-feedback-to-microsoft-with-feedback-hub-app). - -|Feature | Details and mitigation | Announced in version | -| ----------- | --------------------- | ---- | -| Feature | Description | Version | \ No newline at end of file diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md index e4cbcdea4b..da5a28c992 100644 --- a/windows/deployment/planning/windows-11-removed-features.md +++ b/windows/deployment/planning/windows-11-removed-features.md @@ -26,5 +26,5 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | -| WDS image deployment | End to end WDS deployment workflows that use boot.wim from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | +| WDS image deployment | End to end WDS deployment workflows that use **boot.wim** from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 644071fbfa..49e0b790d2 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -19,15 +19,15 @@ Applies to: - Windows 10 - Windows 11 -The operating system deployment functionality of [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831764(v=ws.11)) (WDS) is being partically deprecated. Starting with Windows 11, workflows that rely on boot.wim from installation media and/or on running Setup.exe in WDS mode will no longer be supported. +The operating system deployment functionality of [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831764(v=ws.11)) (WDS) is being partially deprecated. Starting with Windows 11, workflows that rely on **boot.wim** from installation media or on running Windows Setup in WDS mode will no longer be supported. -When you PXE-boot from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. The following message will be displayed in this scenario: +When you PXE-boot from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. In this scenario, the following message is displayed: -![WDS deprecation notice](images/wds-deprecation.png) + ![WDS deprecation notice](images/wds-deprecation.png) ## Deployment scenarios impacted -See the following table for a summary of the impacted deployment scenarios. +The following table provides support details for possible deployment scenarios:
@@ -42,10 +42,10 @@ See the following table for a summary of the impacted deployment scenarios. Windows Windows 11 - Boot image version + Boot image version - Windows 10 + Windows 10 Supported, using a boot image from matching or newer version. Supported, using a boot image from Windows 10, version 1607 or later. Supported, using a boot image from Windows 10, version 1809 or later. @@ -53,7 +53,7 @@ See the following table for a summary of the impacted deployment scenarios. Not supported. - Windows Server 2016 + Windows Server 2016 Supported, using a boot image from Windows 10, version 1607 or later. Supported. Not supported. @@ -61,7 +61,7 @@ See the following table for a summary of the impacted deployment scenarios. Not supported. - Windows Server 2019 + Windows Server 2019 Supported, using a boot image from Windows 10, version 1809 or later. Supported. Supported. @@ -69,7 +69,7 @@ See the following table for a summary of the impacted deployment scenarios. Not supported. - Windows Server 2022 + Windows Server 2022 Deprecated, with a warning message. Deprecated, with a warning message. Deprecated, with a warning message. @@ -77,7 +77,7 @@ See the following table for a summary of the impacted deployment scenarios. Not supported. - Windows 11 + Windows 11 Not supported, blocked. Not supported, blocked. Not supported, blocked. @@ -86,15 +86,15 @@ See the following table for a summary of the impacted deployment scenarios. -## What is not impacted - -WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with a custom boot images, but you will no longer be able to use boot.wim as the boot image and run Windows Setup in WDS mode. - -You can still run Windows Setup from a network share. Workflows that leverage a custom boot.wim, such as MDT or Configuration Manager are also not affected by this change. - ## Reason for the change -Alternatives to WDS, such as Configuration Manager and MDT provide a better, more flexible, and feature-rich experince for deploying Windows images. +Alternatives to WDS, such as [Microsoft Endpoint Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experince for deploying Windows images. + +## What is not impacted + +WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with a custom boot images, but you will no longer be able to use **boot.wim** as the boot image and run Windows Setup in WDS mode. + +You can still run Windows Setup from a network share. Workflows that leverage a custom boot.wim, such as MDT or Configuration Manager are also not affected by this change. ## Summary @@ -103,9 +103,10 @@ Alternatives to WDS, such as Configuration Manager and MDT provide a better, mor - Windows Server 2022 workflows that rely on boot.wim from installation media will show a non-blocking deprecation notice that can be dismissed, but the workflow is not blocked. - Windows Server workflows after Windows Server 2022 that rely on boot.wim from installation media will be blocked. -If you currently use WDS with boot.wim from installation media for end-to-end operating system deployment, and your OS version is not supported, deprecated, or blocked, you can use other deployment tools, such as Microsoft Deployment Toolkit (MDT), Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. +If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version is not supported, deprecated, or blocked, you can use other deployment tools, such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. ## Also see [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
-[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md) \ No newline at end of file +[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md)
+[Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022) \ No newline at end of file From c4c5ebeb89eb50e0ece480f66cb9dca4ba4a3cd2 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 13:43:30 -0700 Subject: [PATCH 0076/1214] Update features-lifecycle.md --- windows/deployment/planning/features-lifecycle.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/deployment/planning/features-lifecycle.md index 50c8adb217..af22f20db2 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/deployment/planning/features-lifecycle.md @@ -24,12 +24,11 @@ Each release of Windows 10 and Windows 11 contains many new and improved feature The following topic lists features that are no longer being developed. These features might be removed in a future release. -[Windows 10 features we're no longer developing](windows-10-deprecated-features.md)
-[Windows 11 features we're no longer developing](windows-11-deprecated-features.md) +[Windows 10 features we're no longer developing](windows-10-deprecated-features.md) ## Features removed -The following topic has details about features that have been removed from Windows 10 or Windows 11. This includes features that are present in Windows 10, but are removed in Windows 11. +The following topics have details about features that have been removed from Windows 10 or Windows 11. This includes features that are present in Windows 10, but are removed in Windows 11. [Windows 10 features we removed](windows-10-removed-features.md)
[Windows 11 features we removed](windows-11-removed-features.md) From 72060dff51ee58fb2c716347323879299309fa94 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 14:02:45 -0700 Subject: [PATCH 0077/1214] draft --- windows/deployment/wds-boot-support.md | 25 ++++++++++++------------- 1 file changed, 12 insertions(+), 13 deletions(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 49e0b790d2..cf45e04e2e 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -21,17 +21,16 @@ Applies to: The operating system deployment functionality of [Windows Deployment Services](/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/hh831764(v=ws.11)) (WDS) is being partially deprecated. Starting with Windows 11, workflows that rely on **boot.wim** from installation media or on running Windows Setup in WDS mode will no longer be supported. -When you PXE-boot from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. In this scenario, the following message is displayed: +When you PXE-boot from a WDS server that uses the **boot.wim** file from installation media as its boot image, Windows Setup automatically launches in WDS mode. This workflow is deprecated for Windows 11 and newer boot images. The following deprecation message is displayed: ![WDS deprecation notice](images/wds-deprecation.png) ## Deployment scenarios impacted -The following table provides support details for possible deployment scenarios: - +The table below provides support details for specific deployment scenarios.
- +
@@ -42,7 +41,7 @@ The following table provides support details for possible deployment scenarios: - + @@ -88,22 +87,22 @@ The following table provides support details for possible deployment scenarios: ## Reason for the change -Alternatives to WDS, such as [Microsoft Endpoint Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experince for deploying Windows images. +Alternatives to WDS, such as [Microsoft Endpoint Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experience for deploying Windows images. -## What is not impacted +## Not impacted -WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with a custom boot images, but you will no longer be able to use **boot.wim** as the boot image and run Windows Setup in WDS mode. +WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with a custom boot images, but you will no longer be able to use **boot.wim** as the boot image, and run Windows Setup in WDS mode. -You can still run Windows Setup from a network share. Workflows that leverage a custom boot.wim, such as MDT or Configuration Manager are also not affected by this change. +You can still run Windows Setup from a network share. Workflows that leverage a custom boot.wim, such as MDT or Configuration Manager are not affected by this change. ## Summary -- Windows 11 workflows that rely on boot.wim from installation media will be blocked. You cannot perform an end to end deployment of Windows 11 using only WDS. +- Windows 11 workflows that rely on **boot.wim** from installation media will be blocked. You cannot perform an end to end deployment of Windows 11 using only WDS. - Windows 10, Windows Server 2019, and previous operating system versions are not affected by this change. -- Windows Server 2022 workflows that rely on boot.wim from installation media will show a non-blocking deprecation notice that can be dismissed, but the workflow is not blocked. -- Windows Server workflows after Windows Server 2022 that rely on boot.wim from installation media will be blocked. +- Windows Server 2022 workflows that rely on **boot.wim** from installation media will show a non-blocking deprecation notice that can be dismissed, but the workflow is not blocked. +- Windows Server workflows after Windows Server 2022 that rely on **boot.wim** from installation media are blocked. -If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version is not supported, deprecated, or blocked, you can use other deployment tools, such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. +If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version is not supported, deprecated, or blocked, it is recommended that you use deployment tools such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. ## Also see From a1294a0538f65738cc57ae52834351bdd77983ef Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 14:09:45 -0700 Subject: [PATCH 0078/1214] typos and grammar --- .../planning/windows-11-removed-features.md | 2 +- windows/deployment/wds-boot-support.md | 12 ++++++------ 2 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md index da5a28c992..447473ea86 100644 --- a/windows/deployment/planning/windows-11-removed-features.md +++ b/windows/deployment/planning/windows-11-removed-features.md @@ -26,5 +26,5 @@ The following features and functionalities have been removed from the installed |Feature | Details and mitigation | Removed in version | | ----------- | --------------------- | ------ | -| WDS image deployment | End to end WDS deployment workflows that use **boot.wim** from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | +| Windows Deployment Services (WDS) image deployment | End to end WDS deployment workflows that use **boot.wim** from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index cf45e04e2e..37ede74a28 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -25,7 +25,7 @@ When you PXE-boot from a WDS server that uses the **boot.wim** file from install ![WDS deprecation notice](images/wds-deprecation.png) -## Deployment scenarios impacted +## Deployment scenarios affected The table below provides support details for specific deployment scenarios. @@ -38,7 +38,7 @@ The table below provides support details for specific deployment scenarios. - + @@ -89,17 +89,17 @@ The table below provides support details for specific deployment scenarios. Alternatives to WDS, such as [Microsoft Endpoint Configuration Manager](/mem/configmgr/) and [Microsoft Deployment Toolkit](/mem/configmgr/mdt/) (MDT) provide a better, more flexible, and feature-rich experience for deploying Windows images. -## Not impacted +## Not affected -WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with a custom boot images, but you will no longer be able to use **boot.wim** as the boot image, and run Windows Setup in WDS mode. +WDS PXE boot is not affected by this change. You can still use WDS to PXE boot devices with custom boot images, but you cannot use **boot.wim** as the boot image and run Windows Setup in WDS mode. -You can still run Windows Setup from a network share. Workflows that leverage a custom boot.wim, such as MDT or Configuration Manager are not affected by this change. +You can still run Windows Setup from a network share. Workflows that use a custom boot.wim, such as MDT or Configuration Manager are not affected by this change. ## Summary - Windows 11 workflows that rely on **boot.wim** from installation media will be blocked. You cannot perform an end to end deployment of Windows 11 using only WDS. - Windows 10, Windows Server 2019, and previous operating system versions are not affected by this change. -- Windows Server 2022 workflows that rely on **boot.wim** from installation media will show a non-blocking deprecation notice that can be dismissed, but the workflow is not blocked. +- Windows Server 2022 workflows that rely on **boot.wim** from installation media will show a non-blocking deprecation notice. The notice can be dismissed, and currently the workflow is not blocked. - Windows Server workflows after Windows Server 2022 that rely on **boot.wim** from installation media are blocked. If you currently use WDS with **boot.wim** from installation media for end-to-end operating system deployment, and your OS version is not supported, deprecated, or blocked, it is recommended that you use deployment tools such as MDT, Configuration Manager, or a non-Microsoft solution with a custom boot.wim image. From 47f544489a88546a3a7094de151b7dea5eac423b Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 14:19:40 -0700 Subject: [PATCH 0079/1214] table --- windows/deployment/TOC.yml | 2 +- windows/deployment/wds-boot-support.md | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index fef24107a3..d604286b18 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -295,7 +295,7 @@ items: - name: Windows client deployment scenarios and tools items: - - name: WWindows Deployment Services (WDS) boot.wim support + - name: Windows Deployment Services (WDS) boot.wim support href: wds-boot-support.md - name: Convert MBR partition to GPT href: mbr-to-gpt.md diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 37ede74a28..0d7de399b5 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -33,7 +33,7 @@ The table below provides support details for specific deployment scenarios.
        Windows Windows 11
Boot image versionBoot image version
Windows 10Windows Server 2016 Windows Server 2019 Windows Server 2022Windows Windows 11Windows 11
Boot image version
- + @@ -41,7 +41,8 @@ The table below provides support details for specific deployment scenarios. - + From 35e7570e47702114b51cc54135e46b1f1e9f9b89 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 20 Aug 2021 14:23:56 -0700 Subject: [PATCH 0080/1214] table --- windows/deployment/wds-boot-support.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 0d7de399b5..82ad38d20c 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -33,7 +33,7 @@ The table below provides support details for specific deployment scenarios.
       OS deployed Windows 10 Windows Server 2016 Windows Server 2019Windows 11
Boot image version +
 
 
 
 
 
 
 
 
 
 
Boot image version
Windows 10
- + @@ -41,8 +41,8 @@ The table below provides support details for specific deployment scenarios. - + From 17262985e69fb1a1f623b0794c6258b34b1076b5 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Sat, 21 Aug 2021 13:08:01 -0700 Subject: [PATCH 0081/1214] Add periods to alt text No other changes --- CONTRIBUTING.md | 10 +- ...ct-data-using-enterprise-site-discovery.md | 14 +- ...rprise-mode-logging-and-data-collection.md | 18 +- ...-on-enterprise-mode-and-use-a-site-list.md | 4 +- ...control-and-logging-for-enterprise-mode.md | 4 +- ...ct-data-using-enterprise-site-discovery.md | 14 +- .../deprecated-document-modes.md | 2 +- ...doc-modes-and-enterprise-mode-site-list.md | 6 +- .../out-of-date-activex-control-blocking.md | 6 +- ...-the-default-browser-using-group-policy.md | 2 +- ...rprise-mode-logging-and-data-collection.md | 18 +- ...s-and-tricks-to-manage-ie-compatibility.md | 4 +- ...-on-enterprise-mode-and-use-a-site-list.md | 4 +- ...control-and-logging-for-enterprise-mode.md | 4 +- .../licensing-version-and-features-ieak11.md | 52 ++--- .../educator-tib-get-started.md | 62 +++--- education/trial-in-a-box/index.md | 4 +- .../trial-in-a-box/itadmin-tib-get-started.md | 46 ++--- education/trial-in-a-box/support-options.md | 12 +- education/windows/autopilot-reset.md | 8 +- education/windows/change-to-pro-education.md | 20 +- .../windows/chromebook-migration-guide.md | 4 +- .../configure-windows-for-education.md | 10 +- .../deploy-windows-10-in-a-school-district.md | 16 +- .../windows/deploy-windows-10-in-a-school.md | 14 +- .../windows/edu-deployment-recommendations.md | 12 +- .../education-scenarios-store-for-business.md | 4 +- .../windows/get-minecraft-for-education.md | 6 +- education/windows/index.md | 10 +- education/windows/school-get-minecraft.md | 46 ++--- .../set-up-school-pcs-azure-ad-join.md | 2 +- .../set-up-students-pcs-to-join-domain.md | 2 +- .../windows/set-up-students-pcs-with-apps.md | 26 +-- education/windows/set-up-windows-10.md | 2 +- education/windows/take-a-test-multiple-pcs.md | 14 +- education/windows/take-a-test-single-pc.md | 4 +- education/windows/take-tests-in-windows-10.md | 2 +- education/windows/teacher-get-minecraft.md | 22 +- .../windows/use-set-up-school-pcs-app.md | 2 +- smb/cloud-mode-business-setup.md | 92 ++++----- smb/index.md | 6 +- ...quire-apps-microsoft-store-for-business.md | 2 +- .../billing-understand-your-invoice-msfb.md | 6 +- ...or-business-education-powershell-module.md | 2 +- ...oubleshoot-microsoft-store-for-business.md | 10 +- ...-new-microsoft-store-business-education.md | 4 +- .../working-with-line-of-business-apps.md | 2 +- ...ation-publishing-and-client-interaction.md | 6 +- .../app-v/appv-deployment-checklist.md | 6 +- .../app-v/appv-install-the-sequencer.md | 2 +- .../app-v/appv-planning-checklist.md | 12 +- ...enterprise-background-activity-controls.md | 6 +- .../per-user-services-in-windows.md | 14 +- .../svchost-service-refactoring.md | 8 +- .../administrative-tools-in-windows-10.md | 4 +- ...nced-troubleshooting-802-authentication.md | 20 +- .../advanced-troubleshooting-boot-problems.md | 2 +- ...eshooting-wireless-network-connectivity.md | 4 +- ...t-removal-policy-external-storage-media.md | 2 +- .../connect-to-remote-aadj-pc.md | 4 +- .../client-management/img-boot-sequence.md | 2 +- .../introduction-page-file.md | 6 +- ...e-device-installation-with-group-policy.md | 38 ++-- .../manage-settings-app-with-group-policy.md | 2 +- ...-in-your-organization-modern-management.md | 2 +- .../mandatory-user-profile.md | 16 +- .../mdm/accountmanagement-csp.md | 2 +- ...ure-ad-tenant-and-azure-ad-subscription.md | 32 +-- .../client-management/mdm/applocker-csp.md | 6 +- .../mdm/appv-deploy-and-config.md | 2 +- ...e-active-directory-integration-with-mdm.md | 6 +- ...omatic-mdm-enrollment-in-the-new-portal.md | 4 +- .../client-management/mdm/bootstrap-csp.md | 2 +- .../mdm/browserfavorite-csp.md | 2 +- ...ollment-using-windows-provisioning-tool.md | 16 +- .../mdm/cellularsettings-csp.md | 2 +- .../mdm/cm-cellularentries-csp.md | 2 +- ...onfiguration-service-provider-reference.md | 60 +++--- .../mdm/device-update-management.md | 14 +- .../mdm/deviceinstanceservice-csp.md | 2 +- .../client-management/mdm/devicelock-csp.md | 2 +- .../diagnose-mdm-failures-in-windows-10.md | 20 +- .../disconnecting-from-mdm-unenrollment.md | 2 +- .../mdm/eap-configuration.md | 22 +- .../mdm/enable-admx-backed-policies-in-mdm.md | 12 +- ...dded-8-1-handheld-devices-to-windows-10.md | 44 ++-- ...device-automatically-using-group-policy.md | 44 ++-- .../mdm/enterprise-app-management.md | 2 +- .../mdm/enterpriseappmanagement-csp.md | 2 +- .../client-management/mdm/filesystem-csp.md | 2 +- .../mdm/healthattestation-csp.md | 2 +- windows/client-management/mdm/hotspot-csp.md | 2 +- ...rver-side-mobile-application-management.md | 2 +- ...ent-tool-for-windows-store-for-business.md | 6 +- .../mdm/mdm-enrollment-of-windows-devices.md | 76 +++---- .../client-management/mdm/messaging-csp.md | 2 +- .../mdm/mobile-device-enrollment.md | 2 +- windows/client-management/mdm/napdef-csp.md | 4 +- ...ew-in-windows-mdm-enrollment-management.md | 10 +- .../mdm/passportforwork-csp.md | 4 +- .../policy-configuration-service-provider.md | 2 +- .../mdm/policy-csp-deviceinstallation.md | 8 +- .../mdm/push-notification-windows-mdm.md | 16 +- .../client-management/mdm/pxlogical-csp.md | 4 +- ...ree-azure-active-directory-subscription.md | 6 +- .../mdm/securitypolicy-csp.md | 2 +- .../mdm/understanding-admx-backed-policies.md | 4 +- .../mdm/unifiedwritefilter-csp.md | 2 +- windows/client-management/mdm/vpn-csp.md | 2 +- .../mdm/w4-application-csp.md | 2 +- .../mdm/w7-application-csp.md | 2 +- windows/client-management/mdm/wifi-csp.md | 2 +- .../mdm/windows-mdm-enterprise-settings.md | 2 +- .../windowsadvancedthreatprotection-csp.md | 2 +- .../mdm/wmi-providers-supported-in-windows.md | 60 +++--- windows/client-management/quick-assist.md | 2 +- .../troubleshoot-inaccessible-boot-device.md | 16 +- .../troubleshoot-stop-errors.md | 4 +- .../troubleshoot-tcpip-connectivity.md | 16 +- .../troubleshoot-tcpip-netmon.md | 8 +- .../troubleshoot-tcpip-port-exhaust.md | 18 +- .../troubleshoot-tcpip-rpc-errors.md | 10 +- .../windows-version-search.md | 10 +- .../configure-windows-10-taskbar.md | 16 +- .../cortana-at-work/cortana-at-work-crm.md | 4 +- .../cortana-at-work-powerbi.md | 26 +-- .../cortana-at-work-voice-commands.md | 2 +- .../customize-and-export-start-layout.md | 2 +- ...-10-start-screens-by-using-group-policy.md | 4 +- ...-by-using-provisioning-packages-and-icd.md | 2 +- ...ation-user-model-id-of-an-installed-app.md | 2 +- windows/configuration/kiosk-methods.md | 12 +- windows/configuration/kiosk-prepare.md | 4 +- windows/configuration/kiosk-shelllauncher.md | 2 +- windows/configuration/kiosk-single-app.md | 10 +- windows/configuration/kiosk-troubleshoot.md | 2 +- .../lock-down-windows-10-applocker.md | 8 +- .../lock-down-windows-10-to-specific-apps.md | 14 +- .../manage-wifi-sense-in-enterprise.md | 6 +- .../mobile-devices/lockdown-xml.md | 30 +-- .../mobile-lockdown-designer.md | 28 +-- .../provisioning-configure-mobile.md | 6 +- .../mobile-devices/provisioning-nfc.md | 2 +- ...kiosk-for-windows-10-for-mobile-edition.md | 12 +- .../mobile-devices/start-layout-xml-mobile.md | 2 +- windows/configuration/provisioning-apn.md | 4 +- ...can-use-configuration-service-providers.md | 10 +- .../provision-pcs-for-initial-deployment.md | 6 +- ...rovision-pcs-with-apps-and-certificates.md | 8 +- .../provision-pcs-with-apps.md | 10 +- .../provisioning-apply-package.md | 14 +- .../provisioning-create-package.md | 10 +- .../provisioning-install-icd.md | 2 +- .../provisioning-multivariant.md | 2 +- .../provisioning-packages.md | 2 +- .../provisioning-script-to-install-app.md | 4 +- .../set-up-shared-or-guest-pc.md | 8 +- .../start-layout-troubleshoot.md | 14 +- .../configuration/start-secondary-tiles.md | 8 +- .../uev-deploy-uev-for-custom-applications.md | 2 +- windows/configuration/ue-v/uev-for-windows.md | 4 +- .../ue-v/uev-prepare-for-deployment.md | 16 +- .../uev-upgrade-uev-from-previous-releases.md | 2 +- .../configuration/wcd/wcd-admxingestion.md | 4 +- ...ws-10-start-layout-options-and-policies.md | 4 +- windows/configuration/windows-spotlight.md | 8 +- .../deployment/deploy-enterprise-licenses.md | 6 +- windows/deployment/deploy-m365.md | 4 +- windows/deployment/deploy-whats-new.md | 2 +- ...ystem-image-using-configuration-manager.md | 4 +- ...-windows-pe-using-configuration-manager.md | 16 +- ...e-boot-image-with-configuration-manager.md | 10 +- ...ence-with-configuration-manager-and-mdt.md | 4 +- ...-windows-10-using-configuration-manager.md | 4 +- ...-10-using-pxe-and-configuration-manager.md | 30 +-- ...0-deployment-with-configuration-manager.md | 12 +- ...f-windows-10-with-configuration-manager.md | 22 +- ...-windows-10-using-configuration-manager.md | 22 +- ...-windows-10-using-configuration-manager.md | 24 +-- ...to-windows-10-with-configuraton-manager.md | 16 +- .../assign-applications-using-roles-in-mdt.md | 6 +- ...d-environment-for-windows-10-deployment.md | 10 +- .../configure-mdt-settings.md | 2 +- .../create-a-windows-10-reference-image.md | 28 +-- .../deploy-a-windows-10-image-using-mdt.md | 38 ++-- ...d-with-the-microsoft-deployment-toolkit.md | 8 +- ...prepare-for-windows-deployment-with-mdt.md | 10 +- ...sh-a-windows-7-computer-with-windows-10.md | 6 +- ...s-7-computer-with-a-windows-10-computer.md | 12 +- .../set-up-mdt-for-bitlocker.md | 6 +- ...ows-10-deployment-in-a-test-environment.md | 4 +- ...0-with-the-microsoft-deployment-toolkit.md | 8 +- .../use-orchestrator-runbooks-with-mdt.md | 20 +- ...stage-windows-10-deployment-information.md | 8 +- .../use-web-services-in-mdt.md | 16 +- windows/deployment/mbr-to-gpt.md | 2 +- ...compatibility-administrator-users-guide.md | 2 +- ...oyment-considerations-for-windows-to-go.md | 12 +- ...rstanding-and-using-compatibility-fixes.md | 4 +- .../deployment/planning/using-the-sua-tool.md | 2 +- .../planning/using-the-sua-wizard.md | 2 +- .../windows-10-infrastructure-requirements.md | 2 +- windows/deployment/s-mode.md | 4 +- windows/deployment/update/PSFxWhitepaper.md | 8 +- windows/deployment/update/WIP4Biz-intro.md | 2 +- .../deployment/update/check-release-health.md | 12 +- .../update/deployment-service-overview.md | 4 +- .../get-started-updates-channels-tools.md | 12 +- .../update/how-windows-update-works.md | 14 +- .../deployment/update/media-dynamic-update.md | 2 +- .../olympia/olympia-enrollment-guidelines.md | 14 +- .../deployment/update/plan-define-strategy.md | 4 +- windows/deployment/update/safeguard-holds.md | 2 +- ...update-compliance-delivery-optimization.md | 2 +- ...update-compliance-feature-update-status.md | 2 +- .../update-compliance-need-attention.md | 2 +- ...pdate-compliance-security-update-status.md | 2 +- .../update/update-compliance-using.md | 8 +- .../deployment/update/waas-configure-wufb.md | 2 +- .../waas-delivery-optimization-setup.md | 2 +- .../update/waas-delivery-optimization.md | 2 +- ...aas-deployment-rings-windows-10-updates.md | 12 +- .../deployment/update/waas-integrate-wufb.md | 2 +- .../update/waas-manage-updates-wsus.md | 48 ++--- .../update/waas-manage-updates-wufb.md | 14 +- .../waas-optimize-windows-10-updates.md | 16 +- windows/deployment/update/waas-overview.md | 14 +- windows/deployment/update/waas-restart.md | 18 +- ...s-servicing-channels-windows-10-updates.md | 24 +-- .../update/waas-servicing-differences.md | 6 +- ...s-servicing-strategy-windows-10-updates.md | 14 +- .../deployment/update/waas-wufb-csp-mdm.md | 18 +- .../update/waas-wufb-group-policy.md | 18 +- windows/deployment/update/waas-wufb-intune.md | 20 +- .../deployment/update/windows-update-logs.md | 10 +- .../update/windows-update-overview.md | 2 +- .../update/wufb-compliancedeadlines.md | 12 +- .../deployment/update/wufb-manageupdate.md | 2 +- windows/deployment/upgrade/quick-fixes.md | 8 +- windows/deployment/upgrade/setupdiag.md | 4 +- windows/deployment/upgrade/submit-errors.md | 4 +- .../upgrade/troubleshoot-upgrade-errors.md | 14 +- .../upgrade/windows-10-edition-upgrades.md | 42 ++-- .../upgrade/windows-error-reporting.md | 2 +- .../usmt/migration-store-types-overview.md | 2 +- .../usmt/usmt-common-migration-scenarios.md | 4 +- ...ctive-directory-based-activation-client.md | 12 +- ...ivate-using-key-management-service-vamt.md | 12 +- .../activate-windows-10-clients-vamt.md | 4 +- .../add-remove-computers-vamt.md | 2 +- .../configure-client-computers-vamt.md | 2 +- .../volume-activation/install-vamt.md | 4 +- .../volume-activation/introduction-vamt.md | 4 +- .../plan-for-volume-activation-client.md | 6 +- .../scenario-online-activation-vamt.md | 2 +- .../scenario-proxy-activation-vamt.md | 2 +- ...olume-activation-management-tool-client.md | 4 +- .../volume-activation/vamt-known-issues.md | 2 +- .../windows-10-deployment-posters.md | 4 +- windows/deployment/windows-10-media.md | 4 +- windows/deployment/windows-10-poc-mdt.md | 4 +- .../windows-10-poc-sc-config-mgr.md | 18 +- windows/deployment/windows-10-poc.md | 16 +- .../windows-10-subscription-activation.md | 14 +- .../demonstrate-deployment-on-vm.md | 128 ++++++------ .../windows-deployment-scenarios-and-tools.md | 28 +-- .../privacy/Microsoft-DiagnosticDataViewer.md | 4 +- .../diagnostic-data-viewer-overview.md | 16 +- ...system-components-to-microsoft-services.md | 192 +++++++++--------- .../active-directory-accounts.md | 30 +-- .../access-control/local-accounts.md | 16 +- .../access-control/security-identifiers.md | 2 +- .../access-control/security-principals.md | 2 +- .../identity-protection/configure-s-mime.md | 8 +- .../credential-guard-how-it-works.md | 2 +- .../credential-guard-manage.md | 4 +- .../enterprise-certificate-pinning.md | 12 +- .../feature-multifactor-unlock.md | 4 +- .../hello-adequate-domain-controllers.md | 10 +- .../hello-cert-trust-adfs.md | 20 +- .../hello-cert-trust-validate-ad-prereq.md | 2 +- .../hello-deployment-rdp-certs.md | 6 +- .../hello-errors-during-pin-creation.md | 2 +- .../hello-feature-pin-reset.md | 8 +- .../hello-feature-remote-desktop.md | 2 +- .../hello-how-it-works-authentication.md | 10 +- .../hello-how-it-works-provisioning.md | 12 +- .../hello-hybrid-aadj-sso-base.md | 52 ++--- .../hello-hybrid-aadj-sso-cert.md | 94 ++++----- .../hello-hybrid-cert-trust-devreg.md | 18 +- .../hello-hybrid-cert-whfb-provision.md | 8 +- .../hello-hybrid-key-whfb-provision.md | 8 +- .../hello-key-trust-adfs.md | 20 +- .../hello-for-business/hello-overview.md | 2 +- .../hello-prepare-people-to-use.md | 6 +- .../passwordless-strategy.md | 20 +- .../retired/hello-how-it-works.md | 2 +- .../remote-credential-guard.md | 6 +- .../smart-card-and-remote-desktop-services.md | 2 +- .../smart-cards/smart-card-architecture.md | 8 +- ...rt-card-certificate-propagation-service.md | 2 +- ...ertificate-requirements-and-enumeration.md | 12 +- .../smart-card-removal-policy-service.md | 2 +- .../how-user-account-control-works.md | 10 +- ...l-smart-card-deploy-virtual-smart-cards.md | 2 +- .../virtual-smart-card-evaluate-security.md | 2 +- .../virtual-smart-card-get-started.md | 22 +- ...tual-smart-card-use-virtual-smart-cards.md | 2 +- .../vpn/vpn-authentication.md | 2 +- .../vpn/vpn-auto-trigger-profile.md | 4 +- .../vpn/vpn-conditional-access.md | 2 +- .../vpn/vpn-connection-type.md | 6 +- .../vpn/vpn-name-resolution.md | 2 +- .../vpn/vpn-profile-options.md | 2 +- .../identity-protection/vpn/vpn-routing.md | 4 +- .../vpn/vpn-security-features.md | 2 +- ...dential-theft-mitigation-guide-abstract.md | 2 +- .../bitlocker/bitlocker-countermeasures.md | 4 +- .../bitlocker-deployment-comparison.md | 48 ++--- .../bitlocker-recovery-guide-plan.md | 16 +- ...ve-encryption-tools-to-manage-bitlocker.md | 2 +- .../bitlocker/troubleshoot-bitlocker.md | 4 +- .../ts-bitlocker-cannot-encrypt-issues.md | 4 +- .../ts-bitlocker-decode-measured-boot-logs.md | 16 +- .../bitlocker/ts-bitlocker-intune-issues.md | 38 ++-- .../kernel-dma-protection-for-thunderbolt.md | 10 +- .../secure-the-windows-10-boot-process.md | 4 +- .../tpm/how-windows-uses-the-tpm.md | 4 +- ...reate-and-verify-an-efs-dra-certificate.md | 2 +- ...e-vpn-and-wip-policy-using-intune-azure.md | 8 +- .../create-wip-policy-using-configmgr.md | 40 ++-- .../create-wip-policy-using-intune-azure.md | 56 ++--- .../deploy-wip-policy-using-intune-azure.md | 2 +- .../wip-app-enterprise-context.md | 4 +- .../wip-learning.md | 8 +- ...tion-based-protection-of-code-integrity.md | 4 +- .../coordinated-malware-eradication.md | 2 +- .../intelligence/fileless-threats.md | 4 +- .../intelligence/malware-naming.md | 2 +- .../intelligence/phishing.md | 2 +- .../portal-submission-troubleshooting.md | 14 +- .../intelligence/worms-malware.md | 2 +- .../mbsa-removal-and-guidance.md | 4 +- .../install-md-app-guard.md | 6 +- .../md-app-guard-overview.md | 2 +- .../test-scenarios-md-app-guard.md | 34 ++-- ...microsoft-defender-smartscreen-overview.md | 2 +- ...ender-smartscreen-set-individual-device.md | 2 +- ...tions-for-app-related-security-policies.md | 6 +- ...iew-of-threat-mitigations-in-windows-10.md | 4 +- ...-the-health-of-windows-10-based-devices.md | 26 +-- ...-information-when-the-session-is-locked.md | 2 +- .../security-policy-settings.md | 8 +- ...arding-to-assist-in-intrusion-detection.md | 8 +- .../windows-10-mobile-security-guide.md | 2 +- .../LOB-win32-apps-on-s.md | 6 +- .../plan-for-applocker-policy-management.md | 2 +- ...ent-setting-inheritance-in-group-policy.md | 2 +- ...the-applocker-policy-deployment-process.md | 2 +- ...s-defender-application-control-policies.md | 2 +- ...s-defender-application-control-policies.md | 2 +- ...or-windows-defender-application-control.md | 8 +- ...rt-windows-defender-application-control.md | 20 +- ...ion-control-policies-using-group-policy.md | 6 +- ...plication-control-policies-using-intune.md | 2 +- ...defender-application-control-management.md | 2 +- .../wdac-wizard-create-base-policy.md | 10 +- .../wdac-wizard-create-supplemental-policy.md | 12 +- .../wdac-wizard-editing-policy.md | 4 +- .../wdac-wizard-merging-policies.md | 2 +- .../wdsc-account-protection.md | 2 +- .../wdsc-app-browser-control.md | 2 +- .../wdsc-customize-contact-information.md | 4 +- .../wdsc-device-performance-health.md | 2 +- .../wdsc-device-security.md | 2 +- .../wdsc-family-options.md | 2 +- .../wdsc-firewall-network-protection.md | 2 +- .../wdsc-virus-threat-protection.md | 2 +- .../wdsc-windows-10-in-s-mode.md | 2 +- .../windows-defender-security-center.md | 10 +- ...sed-root-of-trust-helps-protect-windows.md | 4 +- ...-guard-secure-launch-and-smm-protection.md | 8 +- .../best-practices-configuring.md | 14 +- .../windows-firewall/boundary-zone.md | 2 +- ...create-windows-firewall-rules-in-intune.md | 2 +- .../domain-isolation-policy-design-example.md | 2 +- .../domain-isolation-policy-design.md | 2 +- .../filter-origin-documentation.md | 10 +- .../firewall-policy-design-example.md | 2 +- ...wall-with-advanced-security-design-plan.md | 2 +- .../windows-firewall/quarantine.md | 4 +- ...n-accessing-sensitive-network-resources.md | 2 +- ...cess-to-only-specified-users-or-devices.md | 2 +- ...restrict-access-to-only-trusted-devices.md | 2 +- ...to-end-ipsec-connections-by-using-ikev2.md | 6 +- .../server-isolation-policy-design-example.md | 2 +- .../server-isolation-policy-design.md | 2 +- ...-administration-with-windows-powershell.md | 4 +- .../windows-security-baselines.md | 6 +- .../windows-security-baselines.md | 6 +- windows/whats-new/contribute-to-a-topic.md | 10 +- .../ltsc/whats-new-windows-10-2019.md | 20 +- .../whats-new-windows-10-version-1703.md | 8 +- .../whats-new-windows-10-version-1809.md | 36 ++-- .../whats-new-windows-10-version-1903.md | 2 +- .../whats-new-windows-10-version-2004.md | 2 +- 406 files changed, 2100 insertions(+), 2100 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 75cb7255c8..ef3a69ff52 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,7 +20,7 @@ We've tried to make editing an existing, public file as simple as possible. 1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. - ![GitHub Web, showing the Edit link](images/contribute-link.png) + ![GitHub Web, showing the Edit link.](images/contribute-link.png) 2. Log into (or sign up for) a GitHub account. @@ -28,7 +28,7 @@ We've tried to make editing an existing, public file as simple as possible. 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) @@ -37,11 +37,11 @@ We've tried to make editing an existing, public file as simple as possible. 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. - ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png) The **Comparing changes** screen appears to see what the changes are between your fork and the original content. @@ -49,7 +49,7 @@ We've tried to make editing an existing, public file as simple as possible. If there are no problems, you’ll see the message, **Able to merge**. - ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index 4fc4fb1ecc..d4f9600d8b 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -34,11 +34,11 @@ Before you start, you need to make sure you have the following: 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. - ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) + ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - ![affected software section](images/affectedsoftware.png) + ![affected software section.](images/affectedsoftware.png) 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. @@ -280,13 +280,13 @@ You can collect your hardware inventory using the MOF Editor, while you’re con 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) + ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) 2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. 3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) 4. Select the check boxes next to the following classes, and then click **OK**: @@ -393,12 +393,12 @@ The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sam ### SCCM Report Sample – ActiveX.rdl Gives you a list of all of the ActiveX-related sites visited by the client computer. -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) ### SCCM Report Sample – Site Discovery.rdl Gives you a list of all of the sites visited by the client computer. -![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) +![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) ## View the collected XML data After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: @@ -436,7 +436,7 @@ You can import this XML data into the correct version of the Enterprise Mode Sit 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) + ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) 2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md index 47322f0c03..923d4dfe04 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md @@ -27,11 +27,11 @@ ms.date: 07/27/2017 Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. -![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) +![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. -![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) +![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. @@ -47,11 +47,11 @@ This lets you create an ASP form that accepts the incoming POST messages. 3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) + ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) 4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - ![IIS Manager, setting logging options](images/ie-emie-logging.png) + ![IIS Manager, setting logging options.](images/ie-emie-logging.png) 5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. @@ -72,7 +72,7 @@ This code logs your POST fields to your IIS log file, where you can review all o ### IIS log file information This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. -![Enterprise Mode log file](images/ie-emie-logfile.png) +![Enterprise Mode log file.](images/ie-emie-logfile.png) ## Using the GitHub sample to collect your data @@ -99,14 +99,14 @@ The required packages are automatically downloaded and included in the solution. 1. Right-click on the name, PhoneHomeSample, and click **Publish**. - ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) + ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) 2. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. **Important**
Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) + ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) After you finish the publishing process, you need to test to make sure the app deployed successfully. @@ -131,7 +131,7 @@ The required packages are automatically downloaded and included in the solution. - Go to `https:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. - ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) + ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) ### Troubleshooting publishing errors @@ -141,7 +141,7 @@ If you have errors while you’re publishing your project, you should try to upd 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) + ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) 2. Click **Updates** on the left side of the tool, and click the **Update All** button.

You may need to do some additional package cleanup to remove older package versions. diff --git a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md index 4651adf5cf..4573423115 100644 --- a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md @@ -9,7 +9,7 @@ centralized control, you can create one global list of websites that render usin 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Configure the Enterprise Mode Site List** setting.

Turning this setting on also requires you to create and store a site list. 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. @@ -24,7 +24,7 @@ All of your managed devices must have access to this location if you want them t 2. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file.

For example: + ![Enterprise mode with site list in the registry.](../edge/images/enterprise-mode-value-data.png) --> - **HTTPS location:** `"SiteList"="https://localhost:8080/sites.xml"` diff --git a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md index b34f9be63f..c8ef3d030c 100644 --- a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -33,7 +33,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - ![group policy editor with emie setting](images/ie-emie-editpolicy.png) + ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. @@ -45,7 +45,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 3. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) + ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) Your **Value data** location can be any of the following types: diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index 1acd936993..65fbb8eaaf 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -38,11 +38,11 @@ Before you start, you need to make sure you have the following: 1. Go to the [Microsoft Security Bulletin](/security-updates/) page, and change the filter to **Windows Internet Explorer 11**. - ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) + ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - ![affected software section](images/affectedsoftware.png) + ![affected software section.](images/affectedsoftware.png) 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. @@ -284,13 +284,13 @@ You can collect your hardware inventory using the MOF Editor, while you’re con 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) + ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) 2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. 3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) 4. Select the check boxes next to the following classes, and then click **OK**: @@ -397,12 +397,12 @@ The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sam ### SCCM Report Sample – ActiveX.rdl Gives you a list of all of the ActiveX-related sites visited by the client computer. -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) ### SCCM Report Sample – Site Discovery.rdl Gives you a list of all of the sites visited by the client computer. -![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) +![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) ## View the collected XML data After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: @@ -440,7 +440,7 @@ You can import this XML data into the correct version of the Enterprise Mode Sit 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) + ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) 2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index e8d1ec3d7d..5cfa201d18 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -48,7 +48,7 @@ The compatibility improvements made in IE11 lets older websites just work in the ## Document mode selection flowchart This flowchart shows how IE11 works when document modes are used. -![Flowchart detailing how document modes are chosen in IE11](images/docmode-decisions-sm.png)
+![Flowchart detailing how document modes are chosen in IE11.](images/docmode-decisions-sm.png)
[Click this link to enlarge image](img-ie11-docmode-lg.md) ## Known Issues with Internet Explorer 8 document mode in Enterprise Mode diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md index 333686dc07..9ec7ddf862 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md @@ -45,7 +45,7 @@ To see if this fix might help you, run through this process one step at a time, 1. Go to a site having compatibility problems, press **F12** to open the **F12 Developer Tools**, and go to the **Emulation** tool. - ![Emulation tool showing document mode selection](images/docmode-f12.png) + ![Emulation tool showing document mode selection.](images/docmode-f12.png) 2. Starting with the **11 (Default)** option, test your broken scenario.
If that doesn’t work, continue down to the next lowest document mode, stopping as soon as you find a document mode that fixes your problems. For more information about the Emulation tool, see [Emulate browsers, screen sizes, and GPS locations](/previous-versions/windows/internet-explorer/ie-developer/samples/dn255001(v=vs.85)). @@ -62,7 +62,7 @@ There are two versions of the Enterprise Mode site list schema and the Enterpris 1. Open the Enterprise Mode Site List Manager, and click **Add**. - ![Enterprise Mode Site List Manager, showing the available modes](images/emie-listmgr.png) + ![Enterprise Mode Site List Manager, showing the available modes.](images/emie-listmgr.png) 2. Add the **URL** and pick the document mode from the **Launch in** box. This should be the same document mode you found fixed your problems while testing the site.
Similar to Enterprise Mode, you can specify a document mode for a particular web path—such as contoso.com/ERP—or at a domain level. In the above, the entire contoso.com domain loads in Enterprise Mode, while microsoft.com is forced to load into IE8 Document Mode and bing.com loads in IE11. @@ -74,7 +74,7 @@ For more information about Enterprise Mode, see [What is Enterprise Mode?](what- ### Review your Enterprise Mode site list Take a look at your Enterprise Mode site list and make sure everything is the way you want it. The next step will be to turn the list on and start to use it in your company. The Enterprise Mode Site List Manager will look something like: -![Enterprise Mode Site List Manager, showing the different modes](images/emie-sitelistmgr.png) +![Enterprise Mode Site List Manager, showing the different modes.](images/emie-sitelistmgr.png) And the underlying XML code will look something like: diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 75283c1f64..4eed39657f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -62,15 +62,15 @@ When IE blocks an outdated ActiveX control, you’ll see a notification bar simi **Internet Explorer 9 through Internet Explorer 11** -![Warning about outdated activex controls (ie9+)](images/outdatedcontrolwarning.png) +![Warning about outdated activex controls (ie9+).](images/outdatedcontrolwarning.png) **Windows Internet Explorer 8** -![Warning about outdated activex controls (ie8)](images/ieoutdatedcontrolwarning.png) +![Warning about outdated activex controls (ie8).](images/ieoutdatedcontrolwarning.png) Out-of-date ActiveX control blocking also gives you a security warning that tells you if a webpage tries to launch specific outdated apps, outside of IE: -![Warning about outdated activex controls outside ie](images/ieoutdatedcontroloutsideofie.png) +![Warning about outdated activex controls outside ie.](images/ieoutdatedcontroloutsideofie.png) ## How do I fix an outdated ActiveX control or app? diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 6edccdda73..9424e5e32f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -27,7 +27,7 @@ You can use the Group Policy setting, **Set a default associations configuration 1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). - ![set default associations group policy setting](images/setdefaultbrowsergp.png) + ![set default associations group policy setting.](images/setdefaultbrowsergp.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your default associations configuration file.

If this setting is turned on and your employee's device is domain-joined, this file is processed and default associations are applied at logon. If this setting isn't configured or is turned off, or if your employee's device isn't domain-joined, no default associations are applied at logon. diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md index dd26f8e369..b42426f1d7 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md @@ -31,11 +31,11 @@ ms.date: 07/27/2017 Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. -![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) +![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. -![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) +![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. @@ -51,11 +51,11 @@ When you turn logging on, you need a valid URL that points to a server that can 3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) + ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) 4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - ![IIS Manager, setting logging options](images/ie-emie-logging.png) + ![IIS Manager, setting logging options.](images/ie-emie-logging.png) 5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. @@ -76,7 +76,7 @@ When you turn logging on, you need a valid URL that points to a server that can ### IIS log file information This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. -![Enterprise Mode log file](images/ie-emie-logfile.png) +![Enterprise Mode log file.](images/ie-emie-logfile.png) ## Using the GitHub sample to collect your data @@ -103,14 +103,14 @@ For logging, you’re going to need a valid URL that points to a server that can 5. Right-click on the name, PhoneHomeSample, and click **Publish**. - ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) + ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) 6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. **Important**
Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) + ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) After you finish the publishing process, you need to test to make sure the app deployed successfully. @@ -135,7 +135,7 @@ For logging, you’re going to need a valid URL that points to a server that can - Go to `https:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. - ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) + ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) ### Troubleshooting publishing errors @@ -145,7 +145,7 @@ If you have errors while you’re publishing your project, you should try to upd 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) + ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) 2. Click **Updates** on the left side of the tool, and click the **Update All** button.

You may need to do some additional package cleanup to remove older package versions. diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md index 14bd40e745..ec77071c73 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md @@ -28,7 +28,7 @@ Jump to: [Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) can be very effective in providing backward compatibility for older web apps. The Enterprise Mode Site List includes the ability to put any web app in any document mode, include IE8 and IE7 Enterprise Modes, without changing a single line of code on the website. -![Internet Explorer Enterprise Modes and document modes](images/img-enterprise-mode-site-list-xml.jpg) +![Internet Explorer Enterprise Modes and document modes.](images/img-enterprise-mode-site-list-xml.jpg) Sites in the \ section can be rendered in any document mode, as shown in blue above. Some sites designed for older versions of Internet Explorer may require better backward compatibility, and these can leverage the \ section of the Enterprise Mode Site List. IE8 Enterprise Mode provides higher-fidelity emulation for Internet Explorer 8 by using, among other improvements, the original Internet Explorer 8 user agent string. IE7 Enterprise Mode further improves emulation by adding Compatibility View. @@ -84,7 +84,7 @@ To see if the site works in the Internet Explorer 5, Internet Explorer 7, Intern - Open the site in Internet Explorer 11, load the F12 tools by pressing the **F12** key or by selecting **F12 Developer Tools** from the **Tools** menu, and select the **Emulation** tab. - ![F12 Developer Tools Emulation tab](images/img-f12-developer-tools-emulation.jpg) + ![F12 Developer Tools Emulation tab.](images/img-f12-developer-tools-emulation.jpg) - Run the site in each document mode until you find the mode in which the site works. diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md index 8c84054dc3..1b32fa64ad 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md @@ -39,7 +39,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi 1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png) + ![local group policy editor for using a site list.](images/ie-emie-grouppolicysitelist.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. @@ -51,7 +51,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi 4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example: - ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png) + ![enterprise mode with site list in the registry.](images/ie-emie-registrysitelist.png) - **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"` diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md index b4db0fb7a4..897b27ceed 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -37,7 +37,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - ![group policy editor with emie setting](images/ie-emie-editpolicy.png) + ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. @@ -49,7 +49,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) + ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) Your **Value data** location can be any of the following types: diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index fd6904f4a8..54ae269373 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -33,32 +33,32 @@ During installation, you must pick a version of IEAK 11, either **External** or | Feature | Internal | External | |-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:| -| Welcome screen | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| File locations | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Platform selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Language selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Package type selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Feature selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic Version Synchronization (AVS) | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Custom components | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Internal install | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| User experience | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Browser user interface | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Search providers | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Important URLs – Home page and support | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Accelerators | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Favorites, Favorites bar, and feeds | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Browsing options | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| First Run wizard and Welcome page options | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection manager | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic configuration | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Proxy settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Security and privacy settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Add a root certificate | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Programs | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Additional settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Wizard complete | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Welcome screen | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| File locations | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Platform selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Language selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Package type selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Feature selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Automatic Version Synchronization (AVS) | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Custom components | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Internal install | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| User experience | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Browser user interface | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Search providers | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Important URLs – Home page and support | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Accelerators | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Favorites, Favorites bar, and feeds | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Browsing options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| First Run wizard and Welcome page options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Connection manager | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Connection settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Automatic configuration | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Proxy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Security and privacy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Add a root certificate | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Programs | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Additional settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Wizard complete | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | --- diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index d0251e80ba..bbf1be6015 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -24,13 +24,13 @@ manager: dansimp | Tool | Description | | :---: |:--- | -| [![Connect the device to Wi-Fi](images/edu-TIB-setp-1-v3.png)](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. | -| [![Try Learning Tools Immersive Reader](images/edu-TIB-setp-2-v3.png)](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)**
Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. | -| [![Launch Microsoft Teams](images/edu-TIB-setp-3-v3.png)](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?**
Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. | -| [![Open OneNote](images/edu-TIB-setp-4-v3.png)](#edu-task4) | **Trying to expand classroom creativity and interaction between students?**
Open [OneNote](#edu-task4) and create an example group project for your class. | -| [![Try Photos app](images/edu-tib-setp-5-v4.png)](#edu-task5) | **Curious about telling stories through video?**
Try the [Photos app](#edu-task5) to make your own example video. | -| [![Play with Minecraft: Education Edition](images/edu-tib-setp-6-v4.png)](#edu-task6) | **Want to teach kids to further collaborate and problem solve?**
Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. | -| [![Do Math with Windows Ink](images/edu-tib-setp-7-v1.png)](#edu-task7) | **Want to provide a personal math tutor for your students?**
Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. | +| [![Connect the device to Wi-Fi.](images/edu-TIB-setp-1-v3.png)](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. | +| [![Try Learning Tools Immersive Reader.](images/edu-TIB-setp-2-v3.png)](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)**
Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. | +| [![Launch Microsoft Teams.](images/edu-TIB-setp-3-v3.png)](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?**
Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. | +| [![Open OneNote.](images/edu-TIB-setp-4-v3.png)](#edu-task4) | **Trying to expand classroom creativity and interaction between students?**
Open [OneNote](#edu-task4) and create an example group project for your class. | +| [![Try Photos app.](images/edu-tib-setp-5-v4.png)](#edu-task5) | **Curious about telling stories through video?**
Try the [Photos app](#edu-task5) to make your own example video. | +| [![Play with Minecraft: Education Edition.](images/edu-tib-setp-6-v4.png)](#edu-task6) | **Want to teach kids to further collaborate and problem solve?**
Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. | +| [![Do Math with Windows Ink.](images/edu-tib-setp-7-v1.png)](#edu-task7) | **Want to provide a personal math tutor for your students?**
Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. |
@@ -41,7 +41,7 @@ manager: dansimp
-![Log in to Device A and connect to the school network](images/edu-TIB-setp-1-jump.png) +![Log in to Device A and connect to the school network.](images/edu-TIB-setp-1-jump.png) ## 1. Log in and connect to the school network To try out the educator tasks, start by logging in as a teacher. @@ -55,7 +55,7 @@ To try out the educator tasks, start by logging in as a teacher.

-![Improve student reading speed and comprehension](images/edu-TIB-setp-2-jump.png) +![Improve student reading speed and comprehension.](images/edu-TIB-setp-2-jump.png) ## 2. Significantly improve student reading speed and comprehension > [!VIDEO https://www.youtube.com/embed/GCzSAslq_2Y] @@ -78,7 +78,7 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse 4. Select the **Immersive Reader** button. - ![Word's Immersive Reader](images/word_online_immersive_reader.png) + ![Word's Immersive Reader.](images/word_online_immersive_reader.png) 5. Press the **Play** button to hear text read aloud. @@ -86,14 +86,14 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse | Text to Speech | Text Preferences | Grammar Options | Line Focus | | :------------: | :--------------: | :-------------: | :--------: | - | ![Word Text to Speech](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) | + | ![Word Text to Speech.](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) |

-![Spark communication, critical thinking, and creativity with Microsoft Teams](images/edu-TIB-setp-3-jump.png) +![Spark communication, critical thinking, and creativity with Microsoft Teams.](images/edu-TIB-setp-3-jump.png) ## 3. Spark communication, critical thinking, and creativity in the classroom > [!VIDEO https://www.youtube.com/embed/riQr4Dqb8B8] @@ -114,7 +114,7 @@ Take a guided tour of Microsoft Teams and test drive this digital hub.

-![Expand classroom collaboration and interaction with OneNote](images/edu-TIB-setp-4-jump.png) +![Expand classroom collaboration and interaction with OneNote.](images/edu-TIB-setp-4-jump.png) ## 4. Expand classroom collaboration and interaction between students > [!VIDEO https://www.youtube.com/embed/dzDSWMb_fIE] @@ -135,16 +135,16 @@ When you're not using the pen, just use the magnet to stick it to the left side 3. Follow the instructions for the project. Look for the **Try this!** callouts to experiment with these engaging activities. - Discover the power of digital ink by selecting the Draw tab. Choose your pen and get scribbling. - ![OneNote Draw tab](images/onenote_draw.png) + ![OneNote Draw tab.](images/onenote_draw.png) - Type anywhere on the page! Just click your cursor where you want to place text. - Use the checkmark in the **Home** tab to keep track of completed tasks. - ![OneNote To Do Tag](images/onenote_checkmark.png) + ![OneNote To Do Tag.](images/onenote_checkmark.png) - To find information without leaving OneNote, use the Researcher tool found under the Insert tab. - ![OneNote Researcher](images/onenote_researcher.png) + ![OneNote Researcher.](images/onenote_researcher.png)

@@ -178,7 +178,7 @@ Use video to create a project summary. 8. Drag the videos to the Storyboard, one by one. Your project should look roughly like this: - ![Photos app layout showing videos added in previous steps](images/photo_app_1.png) + ![Photos app layout showing videos added in previous steps.](images/photo_app_1.png) 9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**. @@ -191,7 +191,7 @@ Use video to create a project summary. 4. Play back your effect. 5. Select **Done** when you have it where you want it. - ![Lighting bolt effect being added to a video clip](images/photo_app_2.png) + ![Lighting bolt effect being added to a video clip.](images/photo_app_2.png) 12. Select **Music** and select a track from the **Recommended** music collection. 1. The music will update automatically to match the length of your video project, even as you make changes. @@ -208,7 +208,7 @@ Check out this use case video of the Photos team partnering with the Bureau Of F

-![Further collaborate and problem solve with Minecraft: Education Edition](images/edu-TIB-setp-5-jump.png) +![Further collaborate and problem solve with Minecraft: Education Edition.](images/edu-TIB-setp-5-jump.png) ## 6. Get kids to further collaborate and problem solve > [!VIDEO https://www.youtube.com/embed/QI_bRNUugog] @@ -226,7 +226,7 @@ Today, we'll explore a Minecraft world through the eyes of a student. 3. Scroll down to the **Details** section and select **Download World**. - ![Select the download world link](images/mcee_downloadworld.png) + ![Select the download world link.](images/mcee_downloadworld.png) 4. When prompted, save the world. @@ -250,7 +250,7 @@ Today, we'll explore a Minecraft world through the eyes of a student. To try more advanced movements or building within Minecraft, use the Minecraft Controls Diagram. - ![Minecraft mouse and keyboard controls](images/mcee_keyboard_mouse_controls.png) + ![Minecraft mouse and keyboard controls.](images/mcee_keyboard_mouse_controls.png) 12. Access and adapt over 300 lesson plans, spanning all grades and subjects, to meet your needs. Enjoy exploring new worlds and happy crafting. @@ -260,13 +260,13 @@ Today, we'll explore a Minecraft world through the eyes of a student. 2. Click **Class Resources**. 3. Click **Find a Lesson**. - ![Access and adapt over 300 Minecraft lesson plans](images/minecraft_lesson_plans.png) + ![Access and adapt over 300 Minecraft lesson plans.](images/minecraft_lesson_plans.png)


-![Help students understand new math concepts with the Math Assistant in OneNote](images/Inking.png) +![Help students understand new math concepts with the Math Assistant in OneNote.](images/Inking.png) ## 7. Use Windows Ink to provide a personal math tutor for your students The **Math Assistant** and **Ink Replay** features available in the OneNote app give your students step-by-step instructions on how to solve their math problems and help them visualize math functions on an interactive 2D graph. @@ -275,15 +275,15 @@ The **Math Assistant** and **Ink Replay** features available in the OneNote app To get started: 1. Open the OneNote app for Windows 10 (not OneNote 2016). - ![OneNote icon](images/OneNote_logo.png) + ![OneNote icon.](images/OneNote_logo.png) 2. In the top left corner, click on the **<** arrow to access your notebooks and pages. - ![OneNote back arrow navigation button](images/left_arrow.png) + ![OneNote back arrow navigation button.](images/left_arrow.png) 3. Click **Add Page** to launch a blank work space. - ![Select add page button](images/plus-page.png) + ![Select add page button.](images/plus-page.png) 4. Make sure your pen is paired to the device. To pair, see Connect to Bluetooth devices. @@ -292,26 +292,26 @@ To solve the equation 3x+4=7, follow these instructions: 2. If you wrote the equation using digital ink, use the **Lasso tool** to circle the equation. If you typed the equation, highlight it using your mouse. - ![Lasso button](images/lasso.png) + ![Lasso button.](images/lasso.png) 3. On the **Draw** tab, click the **Math** button. - ![Math button](images/math-button.png) + ![Math button.](images/math-button.png) 4. From the drop-down menu in the **Math** pane, select the option to **Solve for x**. You can now see the final solution of the equation. - ![Solve for x menu](images/solve-for-x.png) + ![Solve for x menu.](images/solve-for-x.png) 5. From the second drop-down below, choose **Steps for Solving Linear Formula**, which shows you the step-by-step solution of this equation. 6. On the **View** tab, click the **Replay** button. Use your mouse to select the written equation and watch your text in replay. Replay is great for students to review how the teacher solved the equation and for teachers to review how students approached a problem. - ![Replay button](images/replay.png) + ![Replay button.](images/replay.png) To graph the equation 3x+4=7, follow these instructions: 1. From the drop-down menu in the **Math** pane, select the option to **Graph Both Sides in 2D**. You can play with the interactive graph of your equation - use a single finger to move the graph position or two fingers to change the **zoom** level. - ![Graph both sides in 2D](images/graph-for-x.png) + ![Graph both sides in 2D.](images/graph-for-x.png) 2. Click the **Insert on Page** button below the graph to add a screenshot of the graph to your page.
diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index f21a0ddcf4..5f1c865bce 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -16,7 +16,7 @@ ms.date: 12/11/2017 # Microsoft Education Trial in a Box -![Microsoft Education Trial in a Box - Unlock Limitless Learning](images/Unlock-Limitless-Learning.png) +![Microsoft Education Trial in a Box - Unlock Limitless Learning.](images/Unlock-Limitless-Learning.png)
@@ -28,7 +28,7 @@ Welcome to Microsoft Education Trial in a Box. We built this trial to make it ea
-| [![Get started for Educators](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | +| [![Get started for Educators.](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | | :---: | :---: | | **Educator**
Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills.
[Get started](educator-tib-get-started.md) | **IT Admin**
Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage.
[Get started](itadmin-tib-get-started.md) | diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index be9a131941..d0ba6a05b3 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -24,11 +24,11 @@ manager: dansimp |  |  | | :---: |:--- | -| [![Log in to Device A](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | -| [![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | -| [![Configure Intune for Education](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | -| [![Find and deploy apps](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | -| [![Create custom folders](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. | +| [![Log in to Device A.](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | +| [![Configure Device B with Set up School PCs.](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | +| [![Configure Intune for Education.](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | +| [![Find and deploy apps.](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | +| [![Create custom folders.](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. |
@@ -42,7 +42,7 @@ If you run into any problems while following the steps in this guide, or you hav
-![Log in to Device A](images/admin-TIB-setp-1-jump.png) +![Log in to Device A.](images/admin-TIB-setp-1-jump.png) ## 1. Log in to Device A with your IT Admin credentials and connect to the school network To try out the IT admin tasks, start by logging in as an IT admin. @@ -56,7 +56,7 @@ To try out the IT admin tasks, start by logging in as an IT admin.
-![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-jump.png) +![Configure Device B with Set up School PCs.](images/admin-TIB-setp-2-jump.png) ## 2. Configure Device B with Set up School PCs Now you're ready to learn how to configure a brand new device. You will start on **Device A** by downloading and running the Set up School PCs app. Then, you will configure **Device B**. @@ -66,11 +66,11 @@ If you've previously used Set up School PCs to provision student devices, you ca 1. From the **Start** menu, find and then click **Microsoft Store** to launch the Store. - ![Microsoft Store from the Start menu](images/start_microsoft_store.png) + ![Microsoft Store from the Start menu.](images/start_microsoft_store.png) 2. Search for the **Set up School PCs** app. - ![Set up School PCs on Microsoft Store](images/microsoft_store_suspc_install.png) + ![Set up School PCs on Microsoft Store.](images/microsoft_store_suspc_install.png) 3. Click **Install**. @@ -78,7 +78,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 1. On **Device A**, launch the Set up School PCs app. - ![Launch the Set up School PCs app](images/suspc_start.png) + ![Launch the Set up School PCs app.](images/suspc_start.png) 2. Click **Get started**. 3. Select **Sign-in**. @@ -95,7 +95,7 @@ If you've previously used Set up School PCs to provision student devices, you ca We recommend checking the highlighted settings below: - ![Configure student PC settings](images/suspc_configure_pcsettings_selected.png) + ![Configure student PC settings.](images/suspc_configure_pcsettings_selected.png) - **Remove apps pre-installed by the device manufacturer** - If you select this option, this will reset the machine and the provisioning process will take longer (about 30 minutes). - **Allow local storage (not recommended for shared devices)** lets students save files to the **Desktop** and **Documents** folder on the student PC. @@ -108,7 +108,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 7. **Set up the Take a Test app** configures the device for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. Windows will lock down the student PC so that students can't access anything else while taking the test. - ![Configure the Take a Test app](images/suspc_takeatest.png) + ![Configure the Take a Test app.](images/suspc_takeatest.png) 1. Specify if you want to create a Take a Test button on the students' sign-in screens. 2. Select **Advanced settings** to allow keyboard text suggestions to appear and to allow teachers to monitor online tests. @@ -120,7 +120,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 8. **Add recommended apps** lets you choose from a set of recommended Microsoft Store apps to provision. - ![Recommended apps in Set up School PCs package configuration](images/suspc_configure_recommendedapps_v2.png) + ![Recommended apps in Set up School PCs package configuration.](images/suspc_configure_recommendedapps_v2.png) The recommended apps include the following: * **Office 365 for Windows 10 S (Education Preview)** - Optional. This works well for the Trial in a Box PCs running Windows 10 S. However, if you try to install this app on other editions of Windows 10, setup will fail. Also note that if you select **Office 365 for Windows 10 S (Education Preview)**, it will take about 30-45 minutes longer for Set up School PCs to create the provisioning package as the app downloads Office 365 for Windows 10 S (Education Preview) from the Microsoft Store. @@ -131,7 +131,7 @@ If you've previously used Set up School PCs to provision student devices, you ca To change any of the settings, select the page or section (such as **Sign-in** or **Settings**) to go back to that page and make your changes. - ![Select the section or page name to make a change](images/suspc_review_summary.png) + ![Select the section or page name to make a change.](images/suspc_review_summary.png) 10. Accept the summary and then insert a USB drive in **Device A**. Use the USB drive that came in the Trial in a Box accessories box to save the provisioning package. 11. Select the drive and then **Save** to create the provisioning package. @@ -153,7 +153,7 @@ A provisioning package is a method for applying settings to Windows 10 without n 1. Start with **Device B** turned off or with the PC on the first-run setup screen. In Windows 10 S Fall Creators Update, the first-run setup screen says **Let's start with region. Is this right?**. - ![The first screen to set up a new PC in Windows 10 Fall Creators Update](images/win10_oobe_firstscreen.png) + ![The first screen to set up a new PC in Windows 10 Fall Creators Update.](images/win10_oobe_firstscreen.png) If you go past the region selection screen, select **Ctrl + Shift + F3** which will prompt the "System Preparation Tool." Select **Okay** in the tool to return to the region selection screen. If this doesn't work, reset the PC by going to **Settings > Update & Security > Recovery > Reset this PC.** @@ -166,20 +166,20 @@ You can complete the rest of the IT admin tasks using **Device A**.
-![Express configure Intune for Education](images/admin-TIB-setp-3-jump.png) +![Express configure Intune for Education.](images/admin-TIB-setp-3-jump.png) ## 3. Express configure Intune for Education to manage devices, users, and policies Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here. 1. Log into the Intune for Education console. 2. On the Intune for Education dashboard, click **Launch Express Configuration** or select the **Express configuration**. - ![Intune for Education dashboard](images/i4e_dashboard_expressconfig.png) + ![Intune for Education dashboard.](images/i4e_dashboard_expressconfig.png) 3. In the **Welcome to Intune for Education** screen, click **Get started** and follow the prompts until you get to the **Choose group** screen. 4. In the **Choose group** screen, select **All Users** so that all apps and settings that we select during express setup will apply to this group. 5. In the **Choose apps** screen, you will see a selection of desktop (Win32) apps, Web apps, and Microsoft Store apps. - ![Choose apps you want to provision to the group](images/i4e_expressconfig_chooseapps.png) + ![Choose apps you want to provision to the group.](images/i4e_expressconfig_chooseapps.png) 6. Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in step 5. @@ -197,7 +197,7 @@ Intune for Education provides an **Express configuration** option so you can get
-![Find apps from the Microsoft Store for Education](images/admin-TIB-setp-4-jump.png) +![Find apps from the Microsoft Store for Education.](images/admin-TIB-setp-4-jump.png) ## 4. Find apps from the Microsoft Store for Education and deploy them to managed devices in your tenant The Microsoft Store for Education is where you can shop for more apps for your school. @@ -205,7 +205,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s 2. In the **Store apps** section, select **+ New app** to go to the Microsoft Store for Education. 3. Select **Sign in** and start shopping for apps for your school. - ![Microsoft Store for Education site](images/msfe_portal.png) + ![Microsoft Store for Education site.](images/msfe_portal.png) 4. Check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express configuration for Intune for Education. For example, these apps are free: - Duolingo - Learn Languages for Free @@ -222,7 +222,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s The apps will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant. - ![List of apps bought for the school](images/msfe_boughtapps.png) + ![List of apps bought for the school.](images/msfe_boughtapps.png) In the **Private store** column of the **Products & services** page, the status for some apps will indicate that it's "In private store" while others will say "Adding to private store" or "Not applicable". Learn more about this in Distribute apps using your private store. @@ -231,7 +231,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s
-![Create custom folders that appear on managed devices](images/admin-TIB-setp-5-jump.png) +![Create custom folders that appear on managed devices.](images/admin-TIB-setp-5-jump.png) ## 5. Create custom folders that will appear on each managed device's Start menu Update settings for all devices in your tenant by adding the **Documents** and **Downloads** folders to all devices managed in Intune for Education. @@ -239,7 +239,7 @@ Update settings for all devices in your tenant by adding the **Documents** and * 2. Select **Group > All Devices > Settings** and expand **Windows interface settings**. 3. In **Choose folders that appear in the Start menu**, select **Documents** and **Downloads**. - ![Choose folders that appear in the Start menu](images/screenshot-bug.png) + ![Choose folders that appear in the Start menu.](images/screenshot-bug.png) 4. **Save** your changes. diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md index 9cb32351de..627a78c9ef 100644 --- a/education/trial-in-a-box/support-options.md +++ b/education/trial-in-a-box/support-options.md @@ -38,7 +38,7 @@ For more information about checking for updates, and how to optionally turn on a > [!NOTE] > For the alternate email address, make sure you use a different address from your Office 365 email address. - ![Complete your contact details](images/o365_adminaccountinfo.png) + ![Complete your contact details.](images/o365_adminaccountinfo.png) 4. Click **Save**. @@ -46,17 +46,17 @@ For more information about checking for updates, and how to optionally turn on a 1. Click the **Need help?** button in the lower right-hand corner of the Office 365 console. - ![Select Need help to get support](images/o365_needhelp.png) + ![Select Need help to get support.](images/o365_needhelp.png) You will see a sidebar window open up on the right-hand side of the screen. - ![Option to have a support representative call you](images/o365_needhelp_callingoption.png) + ![Option to have a support representative call you.](images/o365_needhelp_callingoption.png) If you chose to have a support representative call you, a new support ticket will be opened and you can track these in **Support tickets**. - ![Track your support tickets](images/o365_needhelp_supporttickets.png) + ![Track your support tickets.](images/o365_needhelp_supporttickets.png) -2. Click the **question button** ![Question button](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window. +2. Click the **question button** ![Question button.](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window. 3. In the field below **Need help?**, enter a description of your help request. 4. Click the **Get help button**. 5. In the **Let us call you** section, enter a phone number where you can be reached. @@ -69,7 +69,7 @@ Forget your password? Follow these steps to recover it. 1. Go to https://portal.office.com 2. Select **Can't access your account** and follow the prompts to get back into your account. - ![Recover your account](images/officeportal_cantaccessaccount.png) + ![Recover your account.](images/officeportal_cantaccessaccount.png) diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 00b99a4c75..c0ac95e03e 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -61,7 +61,7 @@ You can set the policy using one of these methods: - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example: - ![Configure student PC settings in Set up School PCs](images/suspc_configure_pc2.jpg) + ![Configure student PC settings in Set up School PCs.](images/suspc_configure_pc2.jpg) ## Trigger Autopilot Reset Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. @@ -70,7 +70,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo 1. From the Windows device lock screen, enter the keystroke: **CTRL + Windows key + R**. - ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png) + ![Enter CTRL+Windows key+R on the Windows lockscreen.](images/autopilot-reset-lockscreen.png) This will open up a custom login screen for Autopilot Reset. The screen serves two purposes: @@ -78,7 +78,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo 2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. - ![Custom login screen for Autopilot Reset](images/autopilot-reset-customlogin.png) + ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) 2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. @@ -97,7 +97,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo - Is returned to a known good managed state, connected to Azure AD and MDM. - ![Notification that provisioning is complete](images/autopilot-reset-provisioningcomplete.png) + ![Notification that provisioning is complete.](images/autopilot-reset-provisioningcomplete.png) Once provisioning is complete, the device is again ready for use. diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md index b104042dbc..ea30225b3e 100644 --- a/education/windows/change-to-pro-education.md +++ b/education/windows/change-to-pro-education.md @@ -65,7 +65,7 @@ See [change using Microsoft Store for Education](#change-using-microsoft-store-f **Figure 1** - Enter the details for the Windows edition change - ![Enter the details for the Windows edition change](images/i4e_editionupgrade.png) + ![Enter the details for the Windows edition change.](images/i4e_editionupgrade.png) 3. The change will automatically be applied to the group you selected. @@ -78,7 +78,7 @@ You can use Windows Configuration Designer to create a provisioning package that **Figure 2** - Enter the license key - ![Enter the license key to change to Windows 10 Pro Education](images/wcd_productkey.png) + ![Enter the license key to change to Windows 10 Pro Education.](images/wcd_productkey.png) 3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to change to Windows 10 Pro Education. @@ -123,7 +123,7 @@ Once you enable the setting to change to Windows 10 Pro Education, the change wi **Figure 3** - Check the box to confirm - ![Check the box to confirm](images/msfe_manage_benefits_checktoconfirm.png) + ![Check the box to confirm.](images/msfe_manage_benefits_checktoconfirm.png) 5. Click **Change all my devices**. @@ -169,13 +169,13 @@ If the Windows device is running Windows 10, version 1703, follow these steps. **Figure 4** - Select how you'd like to set up the device - ![Select how you'd like to set up the device](images/1_howtosetup.png) + ![Select how you'd like to set up the device.](images/1_howtosetup.png) 2. On the **Sign in with Microsoft** page, enter the username and password to use with Office 365 or other services from Microsoft, and then click **Next**. **Figure 5** - Enter the account details - ![Enter the account details you use with Office 365 or other Microsoft services](images/2_signinwithms.png) + ![Enter the account details you use with Office 365 or other Microsoft services.](images/2_signinwithms.png) 3. Go through the rest of Windows device setup. Once you're done, the device will be Azure AD joined to your school's subscription. @@ -188,21 +188,21 @@ If the Windows device is running Windows 10, version 1703, follow these steps. **Figure 6** - Go to **Access work or school** in Settings - ![Go to Access work or school in Settings](images/settings_workorschool_1.png) + ![Go to Access work or school in Settings.](images/settings_workorschool_1.png) 2. In **Access work or school**, click **Connect**. 3. In the **Set up a work or school account** window, click the **Join this device to Azure Active Directory** option at the bottom. **Figure 7** - Select the option to join the device to Azure Active Directory - ![Select the option to join the device to Azure Active Directory](images/settings_setupworkorschoolaccount_2.png) + ![Select the option to join the device to Azure Active Directory.](images/settings_setupworkorschoolaccount_2.png) 4. On the **Let's get you signed in** window, enter the Azure AD credentials (username and password) and sign in. This will join the device to the school's Azure AD. 5. To verify that the device was successfully joined to Azure AD, go back to **Settings > Accounts > Access work or school**. You should now see a connection under the **Connect to work or school** section that indicates the device is connected to Azure AD. **Figure 8** - Verify the device connected to Azure AD - ![Verify the device is connected to Azure AD](images/settings_connectedtoazuread_3.png) + ![Verify the device is connected to Azure AD.](images/settings_connectedtoazuread_3.png) #### Step 2: Sign in using Azure AD account @@ -286,7 +286,7 @@ Once the automatic change to Windows 10 Pro Education is turned off, the change **Figure 12** - Revert to Windows 10 Pro - ![Revert to Windows 10 Pro](images/msfe_manage_reverttowin10pro.png) + ![Revert to Windows 10 Pro.](images/msfe_manage_reverttowin10pro.png) 4. You will be asked if you're sure that you want to turn off automatic changes to Windows 10 Pro Education. Click **Yes**. 5. Click **Close** in the **Success** page. @@ -304,7 +304,7 @@ You need to synchronize these identities so that users will have a *single ident **Figure 13** - On-premises AD DS integrated with Azure AD -![Illustration of Azure Active Directory Connect](images/windows-ad-connect.png) +![Illustration of Azure Active Directory Connect.](images/windows-ad-connect.png) For more information about integrating on-premises AD DS domains with Azure AD, see these resources: - [Integrating your on-premises identities with Azure Active Directory](/azure/active-directory/hybrid/whatis-hybrid-identity) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index 59da859362..d927aef072 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -118,7 +118,7 @@ At the end of this section, you should have a list of Chromebook user and device You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. -![figure 1](images/chromebook-fig1-googleadmin.png) +![figure 1.](images/chromebook-fig1-googleadmin.png) Figure 1. Google Admin Console @@ -221,7 +221,7 @@ Table 3. Settings in the Security node in the Google Admin Console In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). -![figure 2](images/fig2-locallyconfig.png) +![figure 2.](images/fig2-locallyconfig.png) Figure 2. Locally-configured settings on Chromebook diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index f662b8ac78..27b3806af5 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -94,19 +94,19 @@ Use one of these methods to set this policy. - Data type: Integer - Value: 0 - ![Create an OMA URI for AllowCortana](images/allowcortana_omauri.png) + ![Create an OMA URI for AllowCortana.](images/allowcortana_omauri.png) ### Group Policy Set **Computer Configuration > Administrative Templates > Windows Components > Search > AllowCortana** to **Disabled**. -![Set AllowCortana to disabled through Group Policy](images/allowcortana_gp.png) +![Set AllowCortana to disabled through Group Policy.](images/allowcortana_gp.png) ### Provisioning tools - [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. - [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Under **Runtime settings**, click the **Policies** settings group, set **Experience > Cortana** to **No**. - ![Set AllowCortana to No in Windows Configuration Designer](images/allowcortana_wcd.png) + ![Set AllowCortana to No in Windows Configuration Designer.](images/allowcortana_wcd.png) ## SetEduPolicies **SetEduPolicies** is a policy that applies a set of configuration behaviors to Windows. It is a policy node in the [SharedPC configuration service provider](/windows/client-management/mdm/sharedpc-csp). @@ -123,7 +123,7 @@ Use one of these methods to set this policy. - Data type: Boolean - Value: true - ![Create an OMA URI for SetEduPolices](images/setedupolicies_omauri.png) + ![Create an OMA URI for SetEduPolices.](images/setedupolicies_omauri.png) ### Group Policy **SetEduPolicies** is not natively supported in Group Policy. Instead, use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to set the policy in [MDM SharedPC](/windows/win32/dmwmibridgeprov/mdm-sharedpc). @@ -147,7 +147,7 @@ For example: - [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Under **Runtime settings**, click the **SharedPC** settings group, set **PolicyCustomization > SetEduPolicies** to **True**. - ![Set SetEduPolicies to True in Windows Configuration Designer](images/setedupolicies_wcd.png) + ![Set SetEduPolicies to True in Windows Configuration Designer.](images/setedupolicies_wcd.png) ## Ad-free search with Bing Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 5ca4cb7ea0..9dcdd7ca81 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -34,21 +34,21 @@ Proper preparation is essential for a successful district deployment. To avoid c As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. > [!div class="mx-imgBorder"] -> ![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") +> ![Typical district configuration for this guide.](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") *Figure 1. Typical district configuration for this guide* A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses. > [!div class="mx-imgBorder"] -> ![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") +> ![Typical school configuration for this guide.](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") *Figure 2. Typical school configuration for this guide* Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses. > [!div class="mx-imgBorder"] -> ![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") +> ![Typical classroom configuration in a school.](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") *Figure 3. Typical classroom configuration in a school* @@ -181,7 +181,7 @@ The high-level process for deploying and configuring devices within individual c 9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Azure AD integration. > [!div class="mx-imgBorder"] -> ![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") +> ![How district configuration works.](images/edu-districtdeploy-fig4.png "How district configuration works") *Figure 4. How district configuration works* @@ -768,7 +768,7 @@ In this method, you have an on-premises AD DS domain. As shown in Figure 5, the > Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)). > [!div class="mx-imgBorder"] -> ![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") +> ![Automatic synchronization between AD DS and Azure AD.](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") *Figure 5. Automatic synchronization between AD DS and Azure AD* @@ -779,7 +779,7 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. > [!div class="mx-imgBorder"] -> ![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") +> ![Bulk import into Azure AD from other sources.](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") *Figure 6. Bulk import into Azure AD from other sources* @@ -812,14 +812,14 @@ You can deploy the Azure AD Connect tool: - **On premises.** As shown in Figure 7, Azure AD Connect runs on premises, which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server. > [!div class="mx-imgBorder"] - > ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") + > ![Azure AD Connect on premises.](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") *Figure 7. Azure AD Connect on premises* - **In Azure.** As shown in Figure 8, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. > [!div class="mx-imgBorder"] - > ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") + > ![Azure AD Connect in Azure.](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") *Figure 8. Azure AD Connect in Azure* diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index 3b464f9fa6..318b892188 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -30,13 +30,13 @@ Proper preparation is essential for a successful school deployment. To avoid com As part of preparing for your school deployment, you need to plan your configuration—the focus of this guide. Figure 1 illustrates a typical finished school configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. -![fig 1](images/deploy-win-10-school-figure1.png) +![fig 1.](images/deploy-win-10-school-figure1.png) *Figure 1. Typical school configuration for this guide* Figure 2 shows the classroom configuration this guide uses. -![fig 2](images/deploy-win-10-school-figure2.png) +![fig 2.](images/deploy-win-10-school-figure2.png) *Figure 2. Typical classroom configuration in a school* @@ -112,7 +112,7 @@ The high-level process for deploying and configuring devices within individual c 6. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. 7. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS and Azure AD integration. -![fig 3](images/deploy-win-10-school-figure3.png) +![fig 3.](images/deploy-win-10-school-figure3.png) *Figure 3. How school configuration works* @@ -346,7 +346,7 @@ In this method, you have an on-premises AD DS domain. As shown in Figure 4, the **Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)?f=255&MSPPError=-2147217396). -![fig 4](images/deploy-win-10-school-figure4.png) +![fig 4.](images/deploy-win-10-school-figure4.png) *Figure 4. Automatic synchronization between AD DS and Azure AD* @@ -356,7 +356,7 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 5, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. -![fig 5](images/deploy-win-10-school-figure5.png) +![fig 5.](images/deploy-win-10-school-figure5.png) *Figure 5. Bulk import into Azure AD from other sources* @@ -383,13 +383,13 @@ You can deploy the Azure AD Connect tool by using one of the following methods: - **On premises.** As shown in Figure 6, Azure AD Connect runs on premises, which has the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server. - ![fig 6](images/deploy-win-10-school-figure6.png) + ![fig 6.](images/deploy-win-10-school-figure6.png) *Figure 6. Azure AD Connect on premises* - **In Azure**. As shown in Figure 7, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - ![fig 7](images/deploy-win-10-school-figure7.png) + ![fig 7.](images/deploy-win-10-school-figure7.png) *Figure 7. Azure AD Connect in Azure* diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index eaa2f7c35b..03a761c858 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -55,11 +55,11 @@ To turn off access to contacts for all apps on individual Windows devices: 1. On the computer, go to **Settings** and select **Privacy**. - ![Privacy settings](images/win10_settings_privacy.png) + ![Privacy settings.](images/win10_settings_privacy.png) 2. Under the list of **Privacy** areas, select **Contacts**. - ![Contacts privacy settings](images/win10_settings_privacy_contacts.png) + ![Contacts privacy settings.](images/win10_settings_privacy_contacts.png) 3. Turn off **Let apps access my contacts**. @@ -73,7 +73,7 @@ For IT-managed Windows devices, you can use a Group Policy to turn off the setti If you want to allow only certain apps to have access to contacts, you can use the switch for each app to specify which ones you want on or off. -![Choose apps with access to contacts](images/win10_settings_privacy_contacts_apps.png) +![Choose apps with access to contacts.](images/win10_settings_privacy_contacts_apps.png) The list of apps on the Windows-based device may vary from the above example. The list depends on what apps you have installed and which of these apps access contacts. @@ -83,7 +83,7 @@ To allow only certain apps to have access to contacts, you can: * Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** and then specify the default for each app by adding the app's Package Family Name under the default behavior you want to enforce. - ![App privacy Group Policy](images/gp_letwinappsaccesscontacts.png) + ![App privacy Group Policy.](images/gp_letwinappsaccesscontacts.png) ## Skype and Xbox settings @@ -109,7 +109,7 @@ Skype uses the user’s contact details to deliver important information about t To manage and edit your profile in the Skype UWP app, follow these steps: -1. In the Skype UWP app, select the user profile icon ![Skype profile icon](images/skype_uwp_userprofile_icon.png) to go to the user’s profile page. +1. In the Skype UWP app, select the user profile icon ![Skype profile icon.](images/skype_uwp_userprofile_icon.png) to go to the user’s profile page. 2. In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal. @@ -127,7 +127,7 @@ To manage and edit your profile in the Skype UWP app, follow these steps: 6. To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up. - ![Skype profile icon](images/skype_uwp_manageprofilepic.png) + ![Skype profile icon.](images/skype_uwp_manageprofilepic.png) * To take a new picture, click the camera icon in the pop up window. To upload a new picture, click the three dots (**...**). diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 586d6ea6b8..f4ea0cf4ef 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -39,7 +39,7 @@ Admins can control whether or not teachers are automatically assigned the **Basi 2. Click **Manage**, and then click **Settings**. 3. On **Shop**, select or clear **Make everyone a Basic Purchaser**. -![manage settings to control Basic Purchaser role assignment](images/sfe-make-everyone-bp.png) +![manage settings to control Basic Purchaser role assignment.](images/sfe-make-everyone-bp.png) > [!NOTE] > **Make everyone a Basic Purchaser** is on by default. @@ -52,7 +52,7 @@ When **Make everyone a Basic Purchaser** is turned off, admins can manually assi 2. Click **Manage**, and then choose **Permissions**. 3. On **Roles**, click **Assign roles**, type and select a name, choose the role you want to assign, and then click **Save**. - ![Permission page for Microsoft Store for Business](images/sfe-roles.png) + ![Permission page for Microsoft Store for Business.](images/sfe-roles.png) **Blocked Basic Purchasers** diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 78f1759c45..a89e29de02 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -29,7 +29,7 @@ ms.topic: conceptual Teachers and IT administrators can now get early access to **Minecraft: Education Edition** and add it their Microsoft Store for Business for distribution. - + ## Prerequisites @@ -39,11 +39,11 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio - Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan) - If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](/windows/client-management/mdm/register-your-free-azure-active-directory-subscription) - + [Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher-get-minecraft.md) - + [Learn how IT administrators can get and distribute **Minecraft: Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index 81e3f97634..cf961bfe83 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -14,15 +14,15 @@ ms.date: 10/13/2017 # Windows 10 for Education -![Windows 10 Education and Windows 10 Pro Education](images/windows-10-for-education-banner.png) +![Windows 10 Education and Windows 10 Pro Education.](images/windows-10-for-education-banner.png) -## ![Learn more about Windows](images/education.png) Learn +## ![Learn more about Windows.](images/education.png) Learn

Windows 10 editions for education customers
Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.

Compare each Windows edition
Find out more about the features and functionality we support in each edition of Windows.

Get Windows 10 Education or Windows 10 Pro Education
When you've made your decision, find out how to buy Windows for your school.

-## ![Plan for Windows 10 in your school](images/clipboard.png) Plan +## ![Plan for Windows 10 in your school.](images/clipboard.png) Plan

Windows 10 configuration recommendations for education customers
Provides guidance on ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school.

Deployment recommendations for school IT administrators
Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.

@@ -30,14 +30,14 @@ ms.date: 10/13/2017

Take tests in Windows 10
Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up.

Chromebook migration guide
Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment.

-## ![Deploy Windows 10 for Education](images/PCicon.png) Deploy +## ![Deploy Windows 10 for Education.](images/PCicon.png) Deploy

Set up Windows devices for education
Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs.

Deploy Windows 10 in a school
Get step-by-step guidance to help you deploy Windows 10 in a school environment.

Deploy Windows 10 in a school district
Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.

Test Windows 10 S on existing Windows 10 education devices
Test Windows 10 S on a variety of Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us.

-## ![Switch to Windows 10 for Education](images/windows.png) Switch +## ![Switch to Windows 10 for Education.](images/windows.png) Switch

Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S
If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education.

diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index e3900603b6..a728b75a41 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -50,15 +50,15 @@ If you’ve been approved and are part of the Enrollment for Education Solutions 1. Go to [https://education.minecraft.net/](https://education.minecraft.net/) and select **GET STARTED**. - + 2. Enter your email address, and select Educator, Administrator, or Student.
If your email address isn't associated to an Azure AD or Office 365 Education tenant, you'll be asked to create one. - + 3. Select **Get the app**. This will take you to the Microsoft Store for Education to download the app. You will also receive an email with instructions and a link to the Store. - + 4. Sign in to Microsoft Store for Education with your email address. @@ -66,7 +66,7 @@ If you’ve been approved and are part of the Enrollment for Education Solutions 6. **Minecraft: Education Edition** opens in the Microsoft Store for Education. Select **Get the app**. This places **Minecraft: Education Edition** in your Store inventory. - + Now that the app is in your Microsoft Store for Education inventory, you can choose how to distribute Minecraft. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft). @@ -113,11 +113,11 @@ After you've finished the purchase, you can find your invoice by checking **Mine 2. Click **Minecraft: Education Edition** in the list of apps. 3. On **Minecraft: Education Edition**, click **View Bills**. - ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-view-bills.png) + ![Minecraft: Education Edition app details page with view bills link highlighted.](images/mcee-view-bills.png) 4. On **Invoice Bills**, click the invoice number to view and download your invoice. It downloads as a .pdf. - ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-invoice-bills.png) + ![Minecraft: Education Edition app details page with view bills link highlighted.](images/mcee-invoice-bills.png) The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check. @@ -133,11 +133,11 @@ Admins can also add Minecraft: Education Edition to the private store. This allo ### Configure automatic subscription assignment @@ -168,7 +168,7 @@ You can install the app on your PC. This gives you a chance to test the app and 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. - + 3. Click **Install**. @@ -180,33 +180,33 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. - ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) + ![Minecraft Education Edition product page.](images/mc-install-for-me-teacher.png) 3. Click **Invite people**. 4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. You can only assign the app to students with work or school accounts. If you don't find the student, you might need to add a work or school account for the student. - ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) + ![Assign to people showing student name.](images/minecraft-assign-to-people-name.png) **To finish Minecraft install (for students)** 1. Students will receive an email with a link that will install the app on their PC.
- ![Email with Get the app link](images/minecraft-student-install-email.png) + ![Email with Get the app link.](images/minecraft-student-install-email.png) 2. Click **Get the app** to start the app install in Microsoft Store app. 3. In Microsoft Store app, click **Install**. - ![Microsoft Store app with Minecraft page](images/minecraft-in-windows-store-app.png) + ![Microsoft Store app with Minecraft page.](images/minecraft-in-windows-store-app.png) After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**. Microsoft Store app is preinstalled with Windows 10. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) When students click **My Library** they'll find apps assigned to them. - ![My Library for example student](images/minecraft-my-library.png) + ![My Library for example student.](images/minecraft-my-library.png) ### Download for others Download for others allows teachers or IT admins to download an app that they can install on PCs. This will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when: @@ -225,11 +225,11 @@ Minecraft: Education Edition will not install if there are updates pending for o 1. Start Microsoft Store app on the PC (click **Start**, and type **Store**). 2. Click the account button, and then click **Downloads and updates**. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) 3. Click **Check for updates**, and install all available updates. - ![Microsoft Store app showing access to My Library](images/mc-check-for-updates.png) + ![Microsoft Store app showing access to My Library.](images/mc-check-for-updates.png) 4. Restart the computer before installing Minecraft: Education Edition. @@ -238,7 +238,7 @@ You'll download a .zip file, extract the files, and then use one of the files to 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**. - ![Microsoft Store app showing access to My Library](images/mc-dnld-others-teacher.png) + ![Microsoft Store app showing access to My Library.](images/mc-dnld-others-teacher.png) 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. @@ -257,7 +257,7 @@ However, tenant admins can control whether or not teachers automatically sign up To prevent educators from automatically signing up for Microsoft Store for Business 1. In Microsoft Store for Business, click **Settings**, and then click **Permissions**. - ![Permission page for Microsoft Store for Business](images/minecraft-admin-permissions.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-admin-permissions.png) 2. Click **Allow educators in my organization to sign up for the Microsoft Store for Business.** @@ -269,7 +269,7 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. - Acquire and manage the app - Info on Support page (including links to documentation and access to support through customer service) - ![assign roles to manage Minecraft permissions](images/minecraft-perms.png) + ![assign roles to manage Minecraft permissions.](images/minecraft-perms.png) **To assign Basic Purchaser role** @@ -280,15 +280,15 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. 2. Click **Settings**, and then choose **Permissions**. - ![Permission page for Microsoft Store for Business](images/minecraft-admin-permissions.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-admin-permissions.png) 3. Click **Add people**, type a name, select the correct person, choose the role you want to assign, and click **Save**. - ![Permission page for Microsoft Store for Business](images/minecraft-assign-roles.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-assign-roles.png) Microsoft Store for Business updates the list of people and permissions. - ![Permission page for Microsoft Store for Business](images/minecraft-assign-roles-2.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-assign-roles-2.png) --> diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md index 6d62b6bb55..02198518ca 100644 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ b/education/windows/set-up-school-pcs-azure-ad-join.md @@ -48,7 +48,7 @@ Active Directory** \> **Devices** \> **Device settings**. for Azure AD by selecting **All** or **Selected**. If you choose the latter option, select the teachers and IT staff to allow them to connect to Azure AD. -![Select the users you want to let join devices to Azure AD](images/suspc-enable-shared-pc-1807.png) +![Select the users you want to let join devices to Azure AD.](images/suspc-enable-shared-pc-1807.png) You can also create an account that holds the exclusive rights to join devices. When a student PC needs to be set up, provide the account credentials to the appropriate teachers or staff. diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 22d45b09fc..328b2f80a1 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -43,7 +43,7 @@ Follow the steps in [Provision PCs with common settings for initial deployment ( **Figure 7** - Add the account to use for test-taking - ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png) + ![Add the account to use for test-taking.](images/wcd_settings_assignedaccess.png) The account can be in one of the following formats: - username diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index 7d803777e5..f0bb65fa78 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -35,7 +35,7 @@ You can apply a provisioning package on a USB drive to off-the-shelf devices dur 2. 2. On the **Finish** page, select **Switch to advanced editor**. - ![Switch to advanced editor](images/icd-school-adv-edit.png) + ![Switch to advanced editor.](images/icd-school-adv-edit.png) **Next steps** - [Add a desktop app to your package](#add-a-desktop-app-to-your-package) @@ -52,7 +52,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options](images/icdstart-option.png) + ![ICD start options.](images/icdstart-option.png) 3. Name your project and click **Next**. @@ -89,17 +89,17 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package](images/uwp-family.png) + ![details for offline app package.](images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package](images/uwp-dependencies.png) + ![required frameworks for offline app package.](images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. In Microsoft Store for Business, you generate the license for the app on the app's download page. - ![generate license for offline app](images/uwp-license.png) + ![generate license for offline app.](images/uwp-license.png) [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) @@ -168,7 +168,7 @@ If your build is successful, the name of the provisioning package, output direct **During initial setup, from a USB drive** 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](images/oobe.jpg) + ![The first screen to set up a new PC.](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -176,11 +176,11 @@ If your build is successful, the name of the provisioning package, output direct 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](images/prov.jpg) + ![Provision this device.](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](images/choose-package.png) + ![Choose a package.](images/choose-package.png) 5. Select **Yes, add it**. @@ -188,11 +188,11 @@ If your build is successful, the name of the provisioning package, output direct 6. Read and accept the Microsoft Software License Terms. - ![Sign in](images/license-terms.png) + ![Sign in.](images/license-terms.png) 7. Select **Use Express settings**. - ![Get going fast](images/express-settings.png) + ![Get going fast.](images/express-settings.png) 8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**. @@ -200,18 +200,18 @@ If your build is successful, the name of the provisioning package, output direct 9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**. - ![Connect to Azure AD](images/connect-aad.png) + ![Connect to Azure AD.](images/connect-aad.png) 10. Sign in with your domain, Azure AD, or Office 365 account and password. When you see the progress ring, you can remove the USB drive. - ![Sign in](images/sign-in-prov.png) + ![Sign in.](images/sign-in-prov.png) **After setup, from a USB drive, network folder, or SharePoint site** On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and select the package to install. -![add a package option](images/package.png) +![add a package option.](images/package.png) --> diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index b401df97ef..e1acdf9f1d 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -27,7 +27,7 @@ Choose the tool that is appropriate for how your students will sign in (Active D You can use the following diagram to compare the tools. -![Which tool to use to set up Windows 10](images/suspc_wcd_featureslist.png) +![Which tool to use to set up Windows 10.](images/suspc_wcd_featureslist.png) ## In this section diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 3044c770e5..10e2d2f7e0 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -39,7 +39,7 @@ If you set up Take a Test, this adds a **Take a Test** button on the student PC' **Figure 1** - Configure Take a Test in the Set up School PCs app -![Configure Take a Test in the Set up School PCs app](images/suspc_choosesettings_setuptakeatest.png) +![Configure Take a Test in the Set up School PCs app.](images/suspc_choosesettings_setuptakeatest.png) ### Set up a test account in Intune for Education You can set up a test-taking account in Intune for Education. To do this, follow these steps: @@ -49,7 +49,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 2** - Add a test profile in Intune for Education - ![Add a test profile in Intune for Education](images/i4e_takeatestprofile_addnewprofile.png) + ![Add a test profile in Intune for Education.](images/i4e_takeatestprofile_addnewprofile.png) 3. In the new profile page: 1. Enter a name for the profile. @@ -60,7 +60,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 3** - Add information about the test profile - ![Add information about the test profile](images/i4e_takeatestprofile_newtestaccount.png) + ![Add information about the test profile.](images/i4e_takeatestprofile_newtestaccount.png) After you save the test profile, you will see a summary of the settings that you configured for Take a Test. Next, you'll need to assign the test profile to a group that will be using the test account. @@ -68,13 +68,13 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 4** - Assign the test account to a group - ![Assign the test account to a group](images/i4e_takeatestprofile_accountsummary.png) + ![Assign the test account to a group.](images/i4e_takeatestprofile_accountsummary.png) 5. In the **Groups** page, click **Change group assignments**. **Figure 5** - Change group assignments - ![Change group assignments](images/i4e_takeatestprofile_groups_changegroupassignments.png) + ![Change group assignments.](images/i4e_takeatestprofile_groups_changegroupassignments.png) 6. In the **Change group assignments** page: 1. Select a group from the right column and click **Add Members** to select the group and assign the test-taking account to that group. You can select more than one group. @@ -82,7 +82,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 6** - Select the group(s) that will use the test account - ![Select the groups that will use the test account](images/i4e_takeatestprofile_groupassignment_selected.png) + ![Select the groups that will use the test account.](images/i4e_takeatestprofile_groupassignment_selected.png) And that's it! When the students from the selected group sign in to the student PCs using the Take a Test user name that you selected, the PC will be locked down and Take a Test will open the assessment URL and students can start taking tests. @@ -136,7 +136,7 @@ To set up a test account through Windows Configuration Designer, follow these st **Figure 7** - Add the account to use for test-taking - ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png) + ![Add the account to use for test-taking.](images/wcd_settings_assignedaccess.png) The account can be in one of the following formats: - username diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 1286a5aec8..9d26301975 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -30,13 +30,13 @@ To configure the assessment URL and a dedicated testing account on a single PC, **Figure 1** - Use the Settings app to set up a test-taking account - ![Use the Settings app to set up a test-taking account](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png) + ![Use the Settings app to set up a test-taking account.](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png) 4. In the **Set up an account for taking tests** window, choose an existing account to use as the dedicated testing account. **Figure 2** - Choose the test-taking account - ![Choose the test-taking account](images/tat_settingsapp_setuptesttakingaccount_1703.png) + ![Choose the test-taking account.](images/tat_settingsapp_setuptesttakingaccount_1703.png) > [!NOTE] > If you don't have an account on the device, you can create a new account. To do this, go to **Settings > Accounts > Other people > Add someone else to this PC > I don’t have this person’s sign-in information > Add a user without a Microsoft account**. diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 7e016c22c0..f9ba6a9479 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -32,7 +32,7 @@ Many schools use online testing for formative and summative assessments. It's cr ## How to use Take a Test -![Set up and user flow for the Take a Test app](images/take_a_test_flow_dark.png) +![Set up and user flow for the Take a Test app.](images/take_a_test_flow_dark.png) There are several ways to configure devices for assessments, depending on your use case: diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 136499ee4c..6f0d1d4341 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -65,7 +65,7 @@ After Minecraft: Education Edition licenses have been purchased, either directly - You can assign the app to others. - You can download the app to distribute. - + ### Install for me You can install the app on your PC. This gives you a chance to work with the app before using it with your students. @@ -73,7 +73,7 @@ You can install the app on your PC. This gives you a chance to work with the app 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. - + 3. Click **Install**. @@ -84,13 +84,13 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. - + 3. Click **Invite people**. 4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. - ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) + ![Assign to people showing student name.](images/minecraft-assign-to-people-name.png) You can assign the app to students with work or school accounts.
If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Microsoft 365 admin center where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. @@ -100,20 +100,20 @@ Enter email addresses for your students, and each student will get an email with Students will receive an email with a link that will install the app on their PC. -![Email with Get the app link](images/minecraft-student-install-email.png) +![Email with Get the app link.](images/minecraft-student-install-email.png) 1. Click **Get the app** to start the app install in Microsoft Store app. 2. In Microsoft Store app, click **Install**. - ![Microsoft Store app with Minecraft page](images/minecraft-in-windows-store-app.png) + ![Microsoft Store app with Minecraft page.](images/minecraft-in-windows-store-app.png) After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) When students click **My Library** they'll find apps assigned to them. - ![My Library for example student](images/minecraft-my-library.png) + ![My Library for example student.](images/minecraft-my-library.png) ### Download for others Download for others allows teachers or IT admins to download a packages that they can install on student PCs. This will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when: @@ -132,11 +132,11 @@ Minecraft: Education Edition will not install if there are updates pending for o 1. Start Microsoft Store app on the PC (click **Start**, and type **Store**). 2. Click the account button, and then click **Downloads and updates**. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) 3. Click **Check for updates**, and install all available updates. - ![Microsoft Store app showing access to My Library](images/mc-check-for-updates.png) + ![Microsoft Store app showing access to My Library.](images/mc-check-for-updates.png) 4. Restart the computer before installing Minecraft: Education Edition. @@ -145,7 +145,7 @@ You'll download a .zip file, extract the files, and then use one of the files to 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**. - ![Microsoft Store app showing access to My Library](images/mc-dnld-others-teacher.png) + ![Microsoft Store app showing access to My Library.](images/mc-dnld-others-teacher.png) 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 3f31119391..ca36e12e5a 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -103,7 +103,7 @@ We strongly recommend that you avoid changing preset policies. Changes can slow The **Set up School PCs** app guides you through the configuration choices for the student PCs. To begin, open the app on your PC and click **Get started**. - ![Launch the Set up School PCs app](images/suspc_getstarted_050817.png) + ![Launch the Set up School PCs app.](images/suspc_getstarted_050817.png) ### Package name Type a unique name to help distinguish your school's provisioning packages. The name appears: diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 4294d7199e..3b6a109ef3 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -18,7 +18,7 @@ ms.topic: conceptual # Get started: Deploy and manage a full cloud IT solution for your business -![Learn how to set up a full cloud infrastructure for your business](images/business-cloud-mode.png) +![Learn how to set up a full cloud infrastructure for your business.](images/business-cloud-mode.png) **Applies to:** @@ -61,7 +61,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 1** - Try or buy Office 365 - ![Office 365 for business sign up](images/office365_tryorbuy_now.png) + ![Office 365 for business sign up.](images/office365_tryorbuy_now.png) 2. Fill out the sign up form and provide information about you and your company. 3. Create a user ID and password to use to sign into your account. @@ -76,7 +76,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 2** - Microsoft 365 admin center - ![Microsoft 365 admin center](images/office365_portal.png) + ![Microsoft 365 admin center.](images/office365_portal.png) 6. Select the **Admin** tile to go to the admin center. @@ -86,7 +86,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 3** - Admin center - ![Microsoft 365 admin center](images/office365_admin_portal.png) + ![Microsoft 365 admin center.](images/office365_admin_portal.png) 8. Go back to the admin center to add or buy a domain. @@ -94,14 +94,14 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 4** - Option to add or buy a domain - ![Add or buy a domain in admin center](images/office365_buy_domain.png) + ![Add or buy a domain in admin center.](images/office365_buy_domain.png) 2. In the **Home > Domains** page, you will see the Microsoft-provided domain, such as *fabrikamdesign.onmicrosoft.com*. **Figure 5** - Microsoft-provided domain - ![Microsoft-provided domain](images/office365_ms_provided_domain.png) + ![Microsoft-provided domain.](images/office365_ms_provided_domain.png) - If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain. - If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order. @@ -110,7 +110,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 6** - Domains - ![Verify your domains in the admin center](images/office365_additional_domain.png) + ![Verify your domains in the admin center.](images/office365_additional_domain.png) ### 1.2 Add users and assign product licenses Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Microsoft 365 admin center. @@ -123,7 +123,7 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 7** - Add users - ![Add Office 365 users](images/office365_users.png) + ![Add Office 365 users.](images/office365_users.png) 2. In the **Home > Active users** page, add users individually or in bulk. - To add users one at a time, select **+ Add a user**. @@ -132,7 +132,7 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 8** - Add an individual user - ![Add an individual user](images/office365_add_individual_user.png) + ![Add an individual user.](images/office365_add_individual_user.png) - To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users. @@ -140,13 +140,13 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 9** - Import multiple users - ![Import multiple users](images/office365_import_multiple_users.png) + ![Import multiple users.](images/office365_import_multiple_users.png) 3. Verify that all the users you added appear in the list of **Active users**. The **Status** should indicate the product licenses that were assigned to them. **Figure 10** - List of active users - ![Verify users and assigned product licenses](images/o365_active_users.png) + ![Verify users and assigned product licenses.](images/o365_active_users.png) ### 1.3 Add Microsoft Intune Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see What is Intune? @@ -160,14 +160,14 @@ Microsoft Intune provides mobile device management, app management, and PC manag **Figure 11** - Assign Intune licenses - ![Assign Microsoft Intune licenses to users](images/o365_assign_intune_license.png) + ![Assign Microsoft Intune licenses to users.](images/o365_assign_intune_license.png) 5. In the admin center, confirm that **Intune** shows up in the list under **Admin centers**. If it doesn't, sign out and then sign back in and then check again. 6. Select **Intune**. This will take you to the Intune management portal. **Figure 12** - Microsoft Intune management portal - ![Microsoft Intune management portal](images/intune_portal_home.png) + ![Microsoft Intune management portal.](images/intune_portal_home.png) Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution). @@ -185,21 +185,21 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick **Figure 13** - Access to Azure AD is not available - ![Access to Azure AD not available](images/azure_ad_access_not_available.png) + ![Access to Azure AD not available.](images/azure_ad_access_not_available.png) 3. From the error message, select the country/region for your business. This should match with the location you specified when you signed up for Office 365. 4. Click **Azure subscription**. This will take you to a free trial sign up screen. **Figure 14** - Sign up for Microsoft Azure - ![Sign up for Microsoft Azure](images/azure_ad_sign_up_screen.png) + ![Sign up for Microsoft Azure.](images/azure_ad_sign_up_screen.png) 5. In the **Free trial sign up** screen, fill in the required information and then click **Sign up**. 6. After you sign up, you should see the message that your subscription is ready. Click **Start managing my service**. **Figure 15** - Start managing your Azure subscription - ![Start managing your Azure subscription](images/azure_ad_successful_signup.png) + ![Start managing your Azure subscription.](images/azure_ad_successful_signup.png) This will take you to the Microsoft Azure portal. @@ -216,26 +216,26 @@ To add Azure AD group(s), we will use the Microsoft Store for Business using the same tenant account that you used to sign into Intune. 4. Accept the EULA. @@ -312,20 +312,20 @@ In this part of the walkthrough, we'll be working on the Intune management portal, select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**. 8. In the **Microsoft Store for Business** page, select **Configure Sync** to sync your Store for Business volume-purchased apps with Intune. **Figure 26** - Configure Store for Business sync in Intune - ![Configure Store for Business sync in Intune](images/intune_admin_mdm_store_sync.png) + ![Configure Store for Business sync in Intune.](images/intune_admin_mdm_store_sync.png) 9. In the **Configure Microsoft Store for Business app sync** dialog box, check **Enable Microsoft Store for Business sync**. In the **Language** dropdown list, choose the language in which you want apps from the Store to be displayed in the Intune console and then click **OK**. **Figure 27** - Enable Microsoft Store for Business sync in Intune - ![Enable Store for Business sync in Intune](images/intune_configure_store_app_sync_dialog.png) + ![Enable Store for Business sync in Intune.](images/intune_configure_store_app_sync_dialog.png) The **Microsoft Store for Business** page will refresh and it will show the details from the sync. @@ -348,7 +348,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 28** - Shop for Store apps - ![Shop for Store apps](images/wsfb_shop_microsoft_apps.png) + ![Shop for Store apps.](images/wsfb_shop_microsoft_apps.png) 2. Click to select an app, such as **Reader**. This opens the app page. 3. In the app's Store page, click **Get the app**. You should see a dialog that confirms your order. Click **Close**. This will refresh the app's Store page. @@ -358,7 +358,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 29** - App inventory shows the purchased apps - ![Confirm that your inventory shows purchased apps](images/wsfb_manage_inventory_newapps.png) + ![Confirm that your inventory shows purchased apps.](images/wsfb_manage_inventory_newapps.png) > [!NOTE] > Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync). @@ -372,7 +372,7 @@ If you need to sync your most recently purchased apps and have it appear in your **Figure 30** - Force a sync in Intune - ![Force a sync in Intune](images/intune_admin_mdm_forcesync.png) + ![Force a sync in Intune.](images/intune_admin_mdm_forcesync.png) **To view purchased apps** - In the Intune management portal, select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly. @@ -393,7 +393,7 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 31** - First screen in Windows device setup - ![First screen in Windows device setup](images/win10_hithere.png) + ![First screen in Windows device setup.](images/win10_hithere.png) > [!NOTE] > During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection. @@ -403,13 +403,13 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 32** - Choose how you'll connect your Windows device - ![Choose how you'll connect the Windows device](images/win10_choosehowtoconnect.png) + ![Choose how you'll connect the Windows device.](images/win10_choosehowtoconnect.png) 4. In the **Let's get you signed in** screen, sign in using one of the user accounts you added in section [1.2 Add users and assign product licenses](#12-add-users-and-assign-product-licenses). We suggest signing in as one of the global administrators. Later, sign in on another device using one of the non-admin accounts. **Figure 33** - Sign in using one of the accounts you added - ![Sign in using one of the accounts you added](images/win10_signin_admin_account.png) + ![Sign in using one of the accounts you added.](images/win10_signin_admin_account.png) 5. If this is the first time you're signing in, you will be asked to update your password. Update the password and continue with sign-in and setup. @@ -430,7 +430,7 @@ In the Intune management **Figure 34** - Check the PC name on your device - ![Check the PC name on your device](images/win10_settings_pcname.png) + ![Check the PC name on your device.](images/win10_settings_pcname.png) 2. Log in to the Intune management portal. 3. Select **Groups** and then go to **Devices**. @@ -441,7 +441,7 @@ In the Intune management **Figure 35** - Check that the device appears in Intune - ![Check that the device appears in Intune](images/intune_groups_devices_list.png) + ![Check that the device appears in Intune.](images/intune_groups_devices_list.png) ## 3. Manage device settings and features You can use Microsoft Intune admin settings and policies to manage features on your organization's mobile devices and computers. For more info, see [Manage settings and features on your devices with Microsoft Intune policies](/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies). @@ -460,7 +460,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 36** - Reconfigure an app's deployment setting in Intune - ![Reconfigure app deployment settings in Intune](images/intune_apps_deploymentaction.png) + ![Reconfigure app deployment settings in Intune.](images/intune_apps_deploymentaction.png) 6. Click **Finish**. 7. Repeat steps 2-6 for other apps that you want to deploy to the device(s) as soon as possible. @@ -470,7 +470,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 37** - Confirm that additional apps were deployed to the device - ![Confirm that additional apps were deployed to the device](images/win10_deploy_apps_immediately.png) + ![Confirm that additional apps were deployed to the device.](images/win10_deploy_apps_immediately.png) ### 3.2 Configure other settings in Intune @@ -486,7 +486,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 38** - Add a configuration policy - ![Add a configuration policy](images/intune_policy_disablecamera.png) + ![Add a configuration policy.](images/intune_policy_disablecamera.png) 7. Click **Save Policy**. A confirmation window will pop up. 8. On the **Deploy Policy** confirmation window, select **Yes** to deploy the policy now. @@ -495,7 +495,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 39** - The new policy should appear in the **Policies** list. - ![New policy appears on the list](images/intune_policies_newpolicy_deployed.png) + ![New policy appears on the list.](images/intune_policies_newpolicy_deployed.png) **To turn off Windows Hello and PINs during device setup** 1. In the Intune management portal, select **Admin**. @@ -504,7 +504,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 40** - Policy to disable Windows Hello for Business - ![Disable Windows Hello for Business](images/intune_policy_disable_windowshello.png) + ![Disable Windows Hello for Business.](images/intune_policy_disable_windowshello.png) 4. Click **Save**. @@ -531,32 +531,32 @@ For other devices, such as those personally-owned by employees who need to conne **Figure 41** - Add an Azure AD account to the device - ![Add an Azure AD account to the device](images/win10_add_new_user_join_aad.png) + ![Add an Azure AD account to the device.](images/win10_add_new_user_join_aad.png) 4. In the **Let's get you signed in** window, enter the work credentials for the account and then click **Sign in** to authenticate the user. **Figure 42** - Enter the account details - ![Enter the account details](images/win10_add_new_user_account_aadwork.png) + ![Enter the account details.](images/win10_add_new_user_account_aadwork.png) 5. You will be asked to update the password so enter a new password. 6. Verify the details to make sure you're connecting to the right organization and then click **Join**. **Figure 43** - Make sure this is your organization - ![Make sure this is your organization](images/win10_confirm_organization_details.png) + ![Make sure this is your organization.](images/win10_confirm_organization_details.png) 7. You will see a confirmation window that says the device is now connected to your organization. Click **Done**. **Figure 44** - Confirmation that the device is now connected - ![Confirmation that the device is now connected](images/win10_confirm_device_connected_to_org.png) + ![Confirmation that the device is now connected.](images/win10_confirm_device_connected_to_org.png) 8. The **Connect to work or school** window will refresh and will now include an entry that shows you're connected to your organization's Azure AD. This means the device is now registered in Azure AD and enrolled in MDM and the account should have access to the organization's resources. **Figure 45** - Device is now enrolled in Azure AD - ![Device is enrolled in Azure AD](images/win10_device_enrolled_in_aad.png) + ![Device is enrolled in Azure AD.](images/win10_device_enrolled_in_aad.png) 9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. diff --git a/smb/index.md b/smb/index.md index cc4c596a1c..a6ae7f1200 100644 --- a/smb/index.md +++ b/smb/index.md @@ -17,16 +17,16 @@ audience: itpro # Windows 10 for SMB -![Windows 10 for SMB](images/smb_portal_banner.png) +![Windows 10 for SMB.](images/smb_portal_banner.png) -## ![Learn more about Windows and other resources for SMBs](images/learn.png) Learn +## ![Learn more about Windows and other resources for SMBs.](images/learn.png) Learn

Windows 10 for business
Learn how Windows 10 and Windows devices can help your business.

SMB blog
Read about the latest stories, technology insights, and business strategies for SMBs.

How to buy
Go here when you're ready to buy or want to learn more about Microsoft products you can use to help transform your business.

-## ![Deploy a Microsoft solution for your business](images/deploy.png) Deploy +## ![Deploy a Microsoft solution for your business.](images/deploy.png) Deploy

Get started: Deploy and manage a full cloud IT solution for your business
Find out how easy it is to deploy and manage a full cloud IT solution for your small to midsize business using Microsoft cloud services and tools.

diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index 73c2ce1f3d..882b7e57ba 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -55,7 +55,7 @@ There are a couple of things we need to know when you pay for apps. You can add 2. Select **Manage**, and then select **Settings**. 3. On **Shop**, , under **Shopping behavior**, turn on or turn off **Allow users to shop**. -![manage settings to control Basic Purchaser role assignment](images/sfb-allow-shop-setting.png) +![manage settings to control Basic Purchaser role assignment.](images/sfb-allow-shop-setting.png) ## Allow app requests diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md index 26bb2598f8..bee1e82435 100644 --- a/store-for-business/billing-understand-your-invoice-msfb.md +++ b/store-for-business/billing-understand-your-invoice-msfb.md @@ -51,7 +51,7 @@ invoice and descriptions for each term. The **Invoice Summary** is on the top of the first page and shows information about your billing profile and how you pay. -![Invoice summary section](images/invoicesummary.png) +![Invoice summary section.](images/invoicesummary.png) | Term | Description | @@ -68,7 +68,7 @@ The **Invoice Summary** is on the top of the first page and shows information ab The **Billing Summary** shows the charges against the billing profile since the previous billing period, any credits that were applied, tax, and the total amount due. -![Billing summary section](images/billingsummary.png) +![Billing summary section.](images/billingsummary.png) | Term | Description | | --- | --- | @@ -91,7 +91,7 @@ The total amount due for each service family is calculated by subtracting Azure `Total = Charges/Credits - Azure Credit + Tax` -![Details by invoice section](images/invoicesectiondetails.png) +![Details by invoice section.](images/invoicesectiondetails.png) | Term |Description | | --- | --- | diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index bb29be21a9..3bdd7d61bc 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -91,7 +91,7 @@ Get-MSStoreInventory >1. Sign in to [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) or [Microsoft Store for Education](https://businessstore.microsoft.com/). >2. Click **Manage** and then choose **Apps & software**. >3. Click the line-of-business app. The URL of the page will contain the product ID and SKU as part of the URL. For example: ->![Url after apps/ is product id and next is SKU](images/lob-sku.png) +>![Url after apps/ is product id and next is SKU.](images/lob-sku.png) ## View people assigned to a product Most items in **Products and Services** in **Microsoft Store for Business and Education** need to be assigned to people in your org. You can view the people in your org assigned to a specific product by using these commands: diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md index 784e422a8a..0a66d2a739 100644 --- a/store-for-business/troubleshoot-microsoft-store-for-business.md +++ b/store-for-business/troubleshoot-microsoft-store-for-business.md @@ -36,23 +36,23 @@ The private store for your organization is a page in Microsoft Store app that co 1. Click the people icon in Microsoft Store app, and click **Sign in**. - ![Sign in to Store app with a different account](images/wsfb-wsappsignin.png) + ![Sign in to Store app with a different account.](images/wsfb-wsappsignin.png) 2. Click **Add account**, and then click **Work or school account**. - ![Choose an account to use](images/wsfb-wsappaddacct.png) + ![Choose an account to use.](images/wsfb-wsappaddacct.png) 3. Type the email account and password, and click **Sign in**. - ![Sign in for work or school account](images/wsfb-wsappworkacct.png) + ![Sign in for work or school account.](images/wsfb-wsappworkacct.png) 4. You should see the private store for your organization. In our example, the page is named **Contoso publishing**. - ![Private store with name highlighted](images/wsfb-wsappprivatestore.png) + ![Private store with name highlighted.](images/wsfb-wsappprivatestore.png) Click the private store to see apps in your private store. - ![Private store for Contoso publishing](images/wsfb-privatestoreapps.png) + ![Private store for Contoso publishing.](images/wsfb-privatestoreapps.png) ## Troubleshooting Microsoft Store for Business integration with Microsoft Endpoint Configuration Manager diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index 66f34fdabe..4b0cd1e47d 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -26,7 +26,7 @@ Microsoft Store for Business and Education regularly releases new and improved f :::row::: :::column span="1"::: - ![Security groups](images/security-groups-icon.png) + ![Security groups.](images/security-groups-icon.png) :::column-end::: :::column span="1"::: **Use security groups with Private store apps**

On the details page for apps in your private store, you can set **Private store availability**. This allows you to choose which security groups can see an app in the private store.

[Get more info](./app-inventory-management-microsoft-store-for-business.md#private-store-availability)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education @@ -38,7 +38,7 @@ Microsoft Store for Business and Education regularly releases new and improved f We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features! | | | |-----------------------|---------------------------------| -| ![Private store performance icon](images/perf-improvement-icon.png) |**Performance improvements in private store**

We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them.

[Get more info](./manage-private-store-settings.md#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | +| ![Private store performance icon.](images/perf-improvement-icon.png) |**Performance improvements in private store**

We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them.

[Get more info](./manage-private-store-settings.md#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | | | **Manage Windows device deployment with Windows Autopilot Deployment**

In Microsoft Store for Business, you can manage devices for your organization and apply an Autopilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the Autopilot deployment profile you applied to the device.

[Get more info](add-profile-to-devices.md)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | | ![Microsoft Store for Business Settings page, Distribute tab showing app requests setting.](images/msfb-wn-1709-app-request.png) |**Request an app**

People in your organization can request additional licenses for apps in your private store, and then Admins or Purchasers can make the purchases.

[Get more info](./acquire-apps-microsoft-store-for-business.md#request-apps)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | || ![Image showing Add a Collection.](images/msfb-add-collection.png) |**Private store collections**

You can groups of apps in your private store with **Collections**. This can help you organize apps and help people find apps for their job or classroom.

[Get more info](https://review.docs.microsoft.com/microsoft-store/manage-private-store-settings?branch=msfb-14856406#add-a-collection)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | diff --git a/store-for-business/working-with-line-of-business-apps.md b/store-for-business/working-with-line-of-business-apps.md index 2150c9e7c3..8efc8effad 100644 --- a/store-for-business/working-with-line-of-business-apps.md +++ b/store-for-business/working-with-line-of-business-apps.md @@ -46,7 +46,7 @@ You'll need to set up: - LOB publishers need to have an app in Microsoft Store, or have an app ready to submit to the Store. The process and timing look like this: -![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer](images/lob-workflow.png) +![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer.](images/lob-workflow.png) ## Add an LOB publisher (Admin) Admins need to invite developer or ISVs to become an LOB publisher. diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index b0bdee5283..130ad633ee 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -423,7 +423,7 @@ The process then configures the client for package or connection group additions This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). -![Package add file and registry data](images/packageaddfileandregistrydata.png) +![Package add file and registry data.](images/packageaddfileandregistrydata.png) **Package add file and registry data** @@ -454,7 +454,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. -![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) +![package add file and registry data - global.](images/packageaddfileandregistrydata-global.png) **Package add file and registry data—global** @@ -481,7 +481,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as-needed basis. - ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) + ![package add file and registry data - stream.](images/packageaddfileandregistrydata-stream.png) **Package add file and registry data—stream** diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index 501a6eae9f..4183212c31 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -20,9 +20,9 @@ This checklist outlines the recommended steps and items to consider when deployi |Status|Task|References|Notes| |---|---|---|---| -|![Checklist box](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| >[!NOTE] >Keep track of server names and associated URLs you create during installation. You'll need this information throughout the installation process. diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index e8785b3d7f..9bde5d0531 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -28,7 +28,7 @@ The App-V Sequencer is included in the Windows 10 Assessment and Deployment Kit 1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). 2. Select the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation. - ![Selecting APP-V features in ADK](images/app-v-in-adk.png) + ![Selecting APP-V features in ADK.](images/app-v-in-adk.png) 3. To open the Sequencer, go to the **Start** menu and select **Microsoft Application Virtualization (App-V) Sequencer**. See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index e838f04c45..50887ca724 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -23,12 +23,12 @@ This checklist can be used to help you plan for preparing your organization for |Status|Task|References|Notes| |---|---|---|---| -|![Checklist box](../app-v/images/checklistbox.gif)|Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning.|[Getting started with App-V](appv-getting-started.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Plan for App-V deployment prerequisites and prepare your computing environment.|[App-V prerequisites](appv-prerequisites.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|If you plan to use the App-V management server, plan for the required roles.|[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Plan for the App-V sequencer and client to create and run virtualized applications.|[Planning for the App-V Sequencer and client deployment](appv-planning-for-sequencer-and-client-deployment.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|If applicable, review the options and steps for migrating from a previous version of App-V.|[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Decide whether to configure App-V clients in Shared Content Store mode.|[Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning.|[Getting started with App-V](appv-getting-started.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Plan for App-V deployment prerequisites and prepare your computing environment.|[App-V prerequisites](appv-prerequisites.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|If you plan to use the App-V management server, plan for the required roles.|[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Plan for the App-V sequencer and client to create and run virtualized applications.|[Planning for the App-V Sequencer and client deployment](appv-planning-for-sequencer-and-client-deployment.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|If applicable, review the options and steps for migrating from a previous version of App-V.|[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Decide whether to configure App-V clients in Shared Content Store mode.|[Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)|| diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index d123957cd1..0a72c19e87 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -23,15 +23,15 @@ Enterprise users want the same ability to enable or limit background activity. I Users have the ability to control background activity for their device through two interfaces in the **Settings** app: the **Background apps** page and the **Battery usage by app** page. The **Background apps** page has a master switch to turn background activity on or off for all apps, and provides individual switches to control each app's ability to run in the background.  -![Background apps settings page](images/backgroundapps-setting.png) +![Background apps settings page.](images/backgroundapps-setting.png) The **Battery usage by app** page allows fine-grained tuning of background activity. Users have the ability to set background activity to by **Managed By Windows**, as well as turning it on or off for each app. Only devices with a battery have this page available in the **Settings** app. Here is the set of available controls on desktop:  -![Battery usage by app on desktop](images/battery-usage-by-app-desktop.png) +![Battery usage by app on desktop.](images/battery-usage-by-app-desktop.png) Here is the set of available controls for mobile devices:  -![Battery usage by app on mobile](images/battery-usage-by-app-mobile.png) +![Battery usage by app on mobile.](images/battery-usage-by-app-mobile.png) Although the user interface differs across editions of the operating system, the policy and developer interface is consistent across Windows 10. For more information about these controls, see [Optimize background activity](/windows/uwp/debug-test-perf/optimize-background-activity). diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 0cda2dc8c9..4483687ba8 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -102,19 +102,19 @@ If a per-user service can't be disabled using a the security template, you can d 5. Right-click **Registry** > **New** > **Registry Item**. - ![Group Policy preferences disabling per-user services](media/gpp-per-user-services.png) + ![Group Policy preferences disabling per-user services.](media/gpp-per-user-services.png) 6. Make sure that HKEY_Local_Machine is selected for Hive and then click ... (the ellipses) next to Key Path. - ![Choose HKLM](media/gpp-hklm.png) + ![Choose HKLM.](media/gpp-hklm.png) 7. Browse to **System\CurrentControlSet\Services\PimIndexMaintenanceSvc**. In the list of values, highlight **Start** and click **Select**. - ![Select Start](media/gpp-svc-start.png) + ![Select Start.](media/gpp-svc-start.png) 8. Change **Value data** from **00000003** to **00000004** and click **OK**. Note setting the Value data to **4** = **Disabled**. - ![Startup Type is Disabled](media/gpp-svc-disabled.png) + ![Startup Type is Disabled.](media/gpp-svc-disabled.png) 9. To add the other services that cannot be managed with a Group Policy templates, edit the policy and repeat steps 5-8. @@ -140,14 +140,14 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t RE If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled): -![Using Regedit to change servive Starup Type](media/regedit-change-service-startup-type.png) +![Using Regedit to change servive Starup Type.](media/regedit-change-service-startup-type.png) > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: -![Create per-user services in disabled state](media/user-service-flag.png) +![Create per-user services in disabled state.](media/user-service-flag.png) ### Manage template services by modifying the Windows image @@ -186,4 +186,4 @@ For example, you might see the following per-user services listed in the Service You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. -![Use sc.exe to view service type](media/cmd-type.png) \ No newline at end of file +![Use sc.exe to view service type.](media/cmd-type.png) \ No newline at end of file diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index 4130fde7e5..8482a3497c 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -48,11 +48,11 @@ Refactoring also makes it easier to view running processes in Task Manager. You For example, here are the running processes displayed in Task Manager in Windows 10 version 1607: -![Running processes in Task Manager, version 1607](media/svchost-grouped-processes.png) +![Running processes in Task Manager, version 1607.](media/svchost-grouped-processes.png) Compare that to the same view of running processes in Windows 10 version 1703: -![Running processes in Task Manager, version 1703](media/svchost-separated-processes.png) +![Running processes in Task Manager, version 1703.](media/svchost-separated-processes.png) @@ -66,7 +66,7 @@ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The default value of **1** prevents the service from being split. For example, this is the registry key configuration for BFE: -![Example of a service that cannot be separated](media/svchost-separation-disabled.png) +![Example of a service that cannot be separated.](media/svchost-separation-disabled.png) ## Memory footprint @@ -77,7 +77,7 @@ Consider the following: |Grouped Services (< 3.5GB) | Split Services (3.5GB+) |--------------------------------------- | ------------------------------------------ | -|![Memory utilization for grouped services](media/svchost-grouped-utilization.png) |![Memory utilization for separated services](media/svchost-separated-utilization.png) | +|![Memory utilization for grouped services.](media/svchost-grouped-utilization.png) |![Memory utilization for separated services](media/svchost-separated-utilization.png) | > [!NOTE] > The above represents the peak observed values. diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 260944a53c..6da0fdfdb9 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -23,11 +23,11 @@ ms.topic: article Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. -![Screenshot of Control Panel](images/admin-tools.png) +![Screenshot of Control Panel.](images/admin-tools.png) The tools in the folder might vary depending on which edition of Windows you are using. -![Screenshot of folder of admin tools](images/admin-tools-folder.png) +![Screenshot of folder of admin tools.](images/admin-tools-folder.png) These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index ac96c101cf..c2a8ea0c57 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -41,53 +41,53 @@ Check Windows Security Event log on the NPS Server for NPS events that correspon In the event message, scroll to the very bottom, and then check the [Reason Code](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it. - ![example of an audit failure](images/auditfailure.png) + ![example of an audit failure.](images/auditfailure.png) *Example: event ID 6273 (Audit Failure)*

‎ - ![example of an audit success](images/auditsuccess.png) + ![example of an audit success.](images/auditsuccess.png) *Example: event ID 6272 (Audit Success)*
‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one. On the client side, go to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, go to **..\Wired-AutoConfig/Operational**. See the following example: -![event viewer screenshot showing wired-autoconfig and WLAN autoconfig](images/eventviewer.png) +![event viewer screenshot showing wired-autoconfig and WLAN autoconfig.](images/eventviewer.png) Most 802.1X authentication issues are because of problems with the certificate that's used for client or server authentication. Examples include invalid certificate, expiration, chain verification failure, and revocation check failure. First, validate the type of EAP method that's used: -![eap authentication type comparison](images/comparisontable.png) +![eap authentication type comparison.](images/comparisontable.png) If a certificate is used for its authentication method, check whether the certificate is valid. For the server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In **NPS snap-in**, go to **Policies** > **Network Policies**. Select and hold (or right-click) the policy, and then select **Properties**. In the pop-up window, go to the **Constraints** tab, and then select the **Authentication Methods** section. -![Constraints tab of the secure wireless connections properties](images/eappropertymenu.png) +![Constraints tab of the secure wireless connections properties.](images/eappropertymenu.png) The CAPI2 event log is useful for troubleshooting certificate-related issues. By default, this log isn't enabled. To enable this log, expand **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, select and hold (or right-click) **Operational**, and then select **Enable Log**. -![screenshot of event viewer](images/capi.png) +![screenshot of event viewer.](images/capi.png) For information about how to analyze CAPI2 event logs, see [Troubleshooting PKI Problems on Windows Vista](/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). When troubleshooting complex 802.1X authentication issues, it's important to understand the 802.1X authentication process. Here's an example of wireless connection process with 802.1X authentication: -![authenticator flow chart](images/authenticator_flow_chart.png) +![authenticator flow chart.](images/authenticator_flow_chart.png) If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter for a client-side capture, and **EAP** for an NPS-side capture. See the following examples: -![client-side packet capture data](images/clientsidepacket_cap_data.png) +![client-side packet capture data.](images/clientsidepacket_cap_data.png) *Client-side packet capture data*

-![NPS-side packet capture data](images/NPS_sidepacket_capture_data.png) +![NPS-side packet capture data.](images/NPS_sidepacket_capture_data.png) *NPS-side packet capture data*
‎ > [!NOTE] > If you have a wireless trace, you can also [view ETL files with network monitor](/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. If you need to load the required [parser](/archive/blogs/netmon/parser-profiles-in-network-monitor-3-4), see the instructions under the **Help** menu in Network Monitor. Here's an example: -![ETL parse](images/etl.png) +![ETL parse.](images/etl.png) ## Audit policy diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 646585085e..d039c10c17 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -50,7 +50,7 @@ The kernel passes control to the session manager process (Smss.exe) which initia Here is a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before starting troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement. -![thumbnail of boot sequence flowchart](images/boot-sequence-thumb.png)
+![thumbnail of boot sequence flowchart.](images/boot-sequence-thumb.png)
[Click to enlarge](img-boot-sequence.md)
diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index ce4154396e..57d2cc10a8 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -152,7 +152,7 @@ The important components of the MSM include: - Security Manager (SecMgr) - handles all pre and post-connection security operations. - Authentication Engine (AuthMgr) – Manages 802.1x auth requests - ![MSM details](images/msmdetails.png) + ![MSM details.](images/msmdetails.png) Each of these components has their own individual state machines which follow specific transitions. Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** filters in TextAnalysisTool for more detail. @@ -327,4 +327,4 @@ Copy and paste all the lines below and save them into a text file named "wifi.ta In the following example, the **View** settings are configured to **Show Only Filtered Lines**. -![TAT filter example](images/tat.png) \ No newline at end of file +![TAT filter example.](images/tat.png) \ No newline at end of file diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md index 69fa51d4e4..d59710d70b 100644 --- a/windows/client-management/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -54,4 +54,4 @@ To change the policy for an external storage device: 7. Select the policy that you want to use. - ![Policy options for disk management](./images/change-def-rem-policy-2.png) + ![Policy options for disk management.](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 275869bf99..4d8f35673e 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -24,7 +24,7 @@ ms.topic: article From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). -![Remote Desktop Connection client](images/rdp.png) +![Remote Desktop Connection client.](images/rdp.png) ## Set up @@ -40,7 +40,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. - ![Allow remote connections to this computer](images/allow-rdp.png) + ![Allow remote connections to this computer.](images/allow-rdp.png) 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies: diff --git a/windows/client-management/img-boot-sequence.md b/windows/client-management/img-boot-sequence.md index b1077e5be6..6ce343dade 100644 --- a/windows/client-management/img-boot-sequence.md +++ b/windows/client-management/img-boot-sequence.md @@ -14,4 +14,4 @@ ms.prod: w10 Return to: [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
-![Full-sized boot sequence flowchart](images/boot-sequence.png) +![Full-sized boot sequence flowchart.](images/boot-sequence.png) diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md index 376916c1d3..9354d9c8c9 100644 --- a/windows/client-management/introduction-page-file.md +++ b/windows/client-management/introduction-page-file.md @@ -56,13 +56,13 @@ Page files extend how much "committed memory" (also known as "virtual memory") i The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support. -![Task manager](images/task-manager.png) +![Task manager.](images/task-manager.png) The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage. -![Out of memory](images/out-of-memory.png) +![Out of memory.](images/out-of-memory.png) -![Task Manager](images/task-manager-commit.png) +![Task Manager.](images/task-manager-commit.png) The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values. diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index 263dd24430..db00986ab0 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -212,7 +212,7 @@ This policy setting will change the evaluation order in which Allow and Prevent Some of these policies take precedence over other policies. The flowchart shown below illustrates how Windows processes them to determine whether a user can install a device or not, as shown in Figure below. -![Device Installation policies flow chart](images/device-installation-flowchart.png)
_Device Installation policies flow chart_ +![Device Installation policies flow chart.](images/device-installation-flowchart.png)
_Device Installation policies flow chart_ @@ -261,17 +261,17 @@ To find device identification strings using Device Manager 4. Find the “Printers” section and find the target printer - ![Selecting the printer in Device Manager](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ + ![Selecting the printer in Device Manager.](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ 5. Double-click the printer and move to the ‘Details’ tab. - ![‘Details’ tab](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ + ![‘Details’ tab.](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ 6. From the ‘Value’ window, copy the most detailed Hardware ID – we will use this in the policies. - ![HWID](images/device-installation-dm-printer-hardware-ids.png) + ![HWID.](images/device-installation-dm-printer-hardware-ids.png) - ![Compatible ID](images/device-installation-dm-printer-compatible-ids.png)
_HWID and Compatible ID_ + ![Compatible ID.](images/device-installation-dm-printer-compatible-ids.png)
_HWID and Compatible ID_ > [!TIP] > You can also determine your device identification strings by using the PnPUtil command-line utility. For more information, see [PnPUtil - Windows drivers](/windows-hardware/drivers/devtest/pnputil) in Microsoft Docs. @@ -360,7 +360,7 @@ Creating the policy to prevent all printers from being installed: 6. Enter the printer class GUID you found above with the curly braces (this is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} - ![List of prevent Class GUIDs](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ + ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ 7. Click ‘OK’. @@ -399,7 +399,7 @@ Getting the right device identifier to prevent it from being installed: 1. Get your printer’s Hardware ID – in this example we will use the identifier we found previously - ![Printer Hardware ID identifier](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ + ![Printer Hardware ID identifier.](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ 2. Write down the device ID (in this case Hardware ID) – WSDPRINT\CanonMX920_seriesC1A0; Take the more specific identifier to make sure you block a specific printer and not a family of printers @@ -417,7 +417,7 @@ Creating the policy to prevent a single printer from being installed: 5. Enter the printer device ID you found above – WSDPRINT\CanonMX920_seriesC1A0 - ![Prevent Device ID list](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ + ![Prevent Device ID list.](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ 6. Click ‘OK’. @@ -477,7 +477,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 6. Enter the printer class GUID you found above with the curly braces (this is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} - ![List of prevent Class GUIDs](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ + ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ 7. Click ‘OK’. @@ -489,7 +489,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one ![Image of Local Group Policy Editor that shows the policies under "Device Installation Restrictions" and the policy named in this step.](images/device-installation-apply-layered_policy-1.png) - ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria."](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ + ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.".](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ 9. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. @@ -497,7 +497,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 11. Enter the printer device ID you found above: WSDPRINT\CanonMX920_seriesC1A0. - ![Allow Printer Hardware ID](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ + ![Allow Printer Hardware ID.](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ 12. Click ‘OK’. @@ -532,22 +532,22 @@ Getting the right device identifier to prevent it from being installed and its l 3. Find the USB thumb-drive and select it. - ![Selecting the usb thumb-drive in Device Manager](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ + ![Selecting the usb thumb-drive in Device Manager.](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ 4. Change View (in the top menu) to ‘Devices by connections’. This view represents the way devices are installed in the PnP tree. - ![Changing view in Device Manager to see the PnP connection tree](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ + ![Changing view in Device Manager to see the PnP connection tree.](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ > [!NOTE] > When blocking\Preventing a device that sits higher in the PnP tree, all the devices that sit under it will be blocked. For example: Preventing a “Generic USB Hub” from being installed, all the devices that lay below a “Generic USB Hub” will be blocked. - ![Blocking nested devices from the root](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ + ![Blocking nested devices from the root.](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ 5. Double-click the USB thumb-drive and move to the ‘Details’ tab. 6. From the ‘Value’ window, copy the most detailed Hardware ID—we will use this in the policies. In this case Device ID = USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![USB device hardware IDs](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ + ![USB device hardware IDs.](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ Creating the policy to prevent a single USB thumb-drive from being installed: @@ -563,7 +563,7 @@ Creating the policy to prevent a single USB thumb-drive from being installed: 5. Enter the USB thumb-drive device ID you found above – USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![Prevent Device IDs list](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ + ![Prevent Device IDs list.](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ 6. Click ‘OK’. @@ -620,7 +620,7 @@ As mentioned in scenario #4, it is not enough to enable only a single hardware I - “USB Root Hub (USB 3.0)” -> USB\ROOT_HUB30 - “Generic USB Hub” -> USB\USB20_HUB -![USB devices nested in the PnP tree](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ +![USB devices nested in the PnP tree.](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ These devices are internal devices on the machine that define the USB port connection to the outside world. Enabling them should not enable any external/peripheral device from being installed on the machine. @@ -663,7 +663,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 9. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it – this policy will enable you to override the wide coverage of the ‘Prevent’ policy with a specific device. - ![Apply layered order of evaluation policy](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ + ![Apply layered order of evaluation policy.](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ 10. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. @@ -671,7 +671,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 12. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation – USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs."](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ + ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs.".](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ 13. Click ‘OK’. diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index a177277d07..f64ee0de0c 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -35,7 +35,7 @@ Policy paths: **User Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. -![Settings page visibility policy](images/settings-page-visibility-gp.png) +![Settings page visibility policy.](images/settings-page-visibility-gp.png) ## Configuring the Group Policy diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 22ba2d74a8..0e9dd8a789 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -92,7 +92,7 @@ For more information about how Windows 10 and Azure AD optimize access to work r As you review the roles in your organization, you can use the following generalized decision tree to begin to identify users or devices that require domain join. Consider switching the remaining users to Azure AD. -![Decision tree for device authentication options](images/windows-10-management-cyod-byod-flow.png) +![Decision tree for device authentication options.](images/windows-10-management-cyod-byod-flow.png) ## Settings and Configuration diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index b5b30659d6..7b77f47742 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -75,7 +75,7 @@ First, you create a default user profile with the customizations that you want, > [!TIP] > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\\System32\\Sysprep\\Panther\\setupact.log and look for an entry like the following: > - > ![Microsoft Bing Translator package error](images/sysprep-error.png) + > ![Microsoft Bing Translator package error.](images/sysprep-error.png) > > Use the [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true) and [Remove-AppxPackage -AllUsers](/powershell/module/appx/remove-appxpackage?view=win10-ps&preserve-view=true) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. @@ -86,11 +86,11 @@ First, you create a default user profile with the customizations that you want, 1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. - ![Example of User Profiles UI](images/copy-to.png) + ![Example of User Profiles UI.](images/copy-to.png) 1. In **Copy To**, under **Permitted to use**, click **Change**. - ![Example of Copy To UI](images/copy-to-change.png) + ![Example of Copy To UI.](images/copy-to-change.png) 1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. @@ -98,11 +98,11 @@ First, you create a default user profile with the customizations that you want, - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - ![Example of Copy profile to](images/copy-to-path.png) + ![Example of Copy profile to.](images/copy-to-path.png) - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of Copy To UI with UNC path](images/copy-to-path.png) + ![Example of Copy To UI with UNC path.](images/copy-to-path.png) 1. Click **OK** to copy the default user profile. @@ -139,9 +139,9 @@ When a user is configured with a mandatory profile, Windows 10 starts as though | Group Policy setting | Windows 10 | Windows Server 2016 | Windows 8.1 | Windows Server 2012 | | --- | --- | --- | --- | --- | -| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported.](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | > [!NOTE] > The Group Policy settings above can be applied in Windows 10 Professional edition. diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 930343209f..42722f7bd7 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -22,7 +22,7 @@ AccountManagement CSP is used to configure setting in the Account Manager servic The following diagram shows the AccountManagement configuration service provider in tree format. -![accountmanagement csp](images/provisioning-csp-accountmanagement.png) +![accountmanagement csp.](images/provisioning-csp-accountmanagement.png) **./Vendor/MSFT/AccountManagement** Root node for the AccountManagement configuration service provider. diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 34f60116f4..64394a6989 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -21,45 +21,45 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a 1. Sign up for Azure AD tenant from [this website](https://account.windowsazure.com/organization) by creating an administrator account for your organization. - ![sign up for azure ad tenant](images/azure-ad-add-tenant1.png) + ![sign up for azure ad tenant.](images/azure-ad-add-tenant1.png) 2. Enter the information for your organization. Select **check availability** to verify that domain name that you selected is available. - ![sign up for azure ad](images/azure-ad-add-tenant2.png) + ![sign up for azure ad.](images/azure-ad-add-tenant2.png) 3. Complete the login and country information. Enter a valid phone number, then select **Send text message** or **Call me**. - ![create azure account](images/azure-ad-add-tenant3.png) + ![create azure account.](images/azure-ad-add-tenant3.png) 4. Enter the code that you receive and then select **Verify code**. After the code is verified and the continue button turns green, select **continue**. - ![add aad tenant](images/azure-ad-add-tenant3-b.png) + ![add aad tenant.](images/azure-ad-add-tenant3-b.png) 5. After you finish creating your Azure account, you can add an Azure AD subscription. If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to the Office 356 portal at https://portal.office.com/, and then sign in using the admin account that you created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). - ![login to office 365](images/azure-ad-add-tenant4.png) + ![login to office 365.](images/azure-ad-add-tenant4.png) 6. Select **Install software**. - ![login to office 365](images/azure-ad-add-tenant5.png) + ![login to office 365.](images/azure-ad-add-tenant5.png) 7. In the Microsoft 365 admin center, select **Purchase Services** from the left navigation. - ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) + ![purchase service option in admin center menu.](images/azure-ad-add-tenant6.png) 8. On the **Purchase services** page, scroll down until you see **Azure Active Directory Premium**, then select to purchase. - ![azure active directory option in purchase services page](images/azure-ad-add-tenant7.png) + ![azure active directory option in purchase services page.](images/azure-ad-add-tenant7.png) 9. Continue with your purchase. - ![azure active directory premium payment page](images/azure-ad-add-tenant8.png) + ![azure active directory premium payment page.](images/azure-ad-add-tenant8.png) 10. After the purchase is completed, you can log in to your Office 365 Admin Portal and you will see the **Azure AD** option from the Admin drop-down menu along with other services (SharePoint, Exchange, etc....). - ![admin center left navigation menu](images/azure-ad-add-tenant9.png) + ![admin center left navigation menu.](images/azure-ad-add-tenant9.png) When you choose Azure AD, it will take you to the Azure AD portal where you can manage your Azure AD applications. @@ -69,27 +69,27 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread](images/azure-ad-add-tenant10.png) + ![register azuread.](images/azure-ad-add-tenant10.png) 2. On the **Home** page, select on the Admin tools icon. - ![register azuread](images/azure-ad-add-tenant11.png) + ![register azuread.](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. - ![register azuread](images/azure-ad-add-tenant12.png) + ![register azuread.](images/azure-ad-add-tenant12.png) 4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread](images/azure-ad-add-tenant13.png) + ![register azuread.](images/azure-ad-add-tenant13.png) 5. It may take a few minutes to process the request. - ![register azuread](images/azure-ad-add-tenant14.png) + ![register azuread.](images/azure-ad-add-tenant14.png) 6. You will see a welcome page when the process completes. - ![register azuread](images/azure-ad-add-tenant15.png) + ![register azuread.](images/azure-ad-add-tenant15.png) diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 3df830bda7..5669fcf0f8 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -263,16 +263,16 @@ Supported operations are Get, Add, Delete, and Replace. The **Device Portal** page opens on your browser. - ![device portal screenshot](images/applocker-screenshot1.png) + ![device portal screenshot.](images/applocker-screenshot1.png) 8. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**. 9. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps. - ![device portal app manager](images/applocker-screenshot3.png) + ![device portal app manager.](images/applocker-screenshot3.png) 10. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed. - ![app manager](images/applocker-screenshot2.png) + ![app manager.](images/applocker-screenshot2.png) The following table shows the mapping of information to the AppLocker publisher rule field. diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index 157bf6f4d0..4c8f6eaecd 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -23,7 +23,7 @@ manager: dansimp [EnterpriseAppVManagement CSP reference](./enterpriseappvmanagement-csp.md) -![enterpriseappvmanagement csp](images/provisioning-csp-enterpriseappvmanagement.png) +![enterpriseappvmanagement csp.](images/provisioning-csp-enterpriseappvmanagement.png)

(./User/Vendor/MSFT/EnterpriseAppVManagement) contains the following sub-nodes.

diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 82a11f3eb6..97f22aae88 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -90,7 +90,7 @@ After the users accepts the Terms of Use, the device is registered in Azure AD a The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Subsequently, the device is enrolled for management with the MDM. This is done by calling the enrollment endpoint and requesting enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is made available to the MDM in the form of claims within an access token presented at the enrollment endpoint. -![azure ad enrollment flow](images/azure-ad-enrollment-flow.png) +![azure ad enrollment flow.](images/azure-ad-enrollment-flow.png) The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Azure AD Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this topic. @@ -173,7 +173,7 @@ IT administrators use the Azure AD app gallery to add an MDM for their organizat The following image illustrates how MDM applications will show up in the Azure app gallery in a category dedicated to MDM software. -![azure ad add an app for mdm](images/azure-ad-app-gallery.png) +![azure ad add an app for mdm.](images/azure-ad-app-gallery.png) ### Add cloud-based MDM to the app gallery @@ -732,7 +732,7 @@ Response: When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenrollment](images/azure-ad-unenrollment.png) +![aadj unenrollment.](images/azure-ad-unenrollment.png) ## Error codes diff --git a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index 21499425a9..ce25592491 100644 --- a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -20,10 +20,10 @@ manager: dansimp 2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. 3. Select **Microsoft Intune** and configure the blade. -![How to get to the Blade](images/azure-mdm-intune.png) +![How to get to the Blade.](images/azure-mdm-intune.png) Configure the blade -![Configure the Blade](images/azure-intune-configure-scope.png) +![Configure the Blade.](images/azure-intune-configure-scope.png) You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index 0bb9326924..e07354fa81 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -27,7 +27,7 @@ The BOOTSTRAP configuration service provider sets the Trusted Provisioning Serve The following image shows the BOOTSTRAP configuration service provider in tree format as used by Open Mobile Alliance (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. -![bootstrap csp (cp)](images/provisioning-csp-bootstrap-cp.png) +![bootstrap csp (cp).](images/provisioning-csp-bootstrap-cp.png) **CONTEXT-ALLOW** Optional. Specifies a context for the TPS. Only one context is supported, so this parameter is ignored and "0" is assumed for its value. diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index 46ee3a5e98..15a939f7eb 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -30,7 +30,7 @@ This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID The following diagram shows the BrowserFavorite configuration service provider in tree format as used by Open Mobile Alliance Device (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. -![browserfavorite csp (cp)](images/provisioning-csp-browserfavorite-cp.png) +![browserfavorite csp (cp).](images/provisioning-csp-browserfavorite-cp.png) ***favorite name*** Required. Specifies the user-friendly name of the favorite URL that is displayed in the Favorites list of Internet Explorer. diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index 4fabdbc971..d1db6d514e 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -57,7 +57,7 @@ Using the WCD, create a provisioning package using the enrollment information re 1. Open the WCD tool. 2. Click **Advanced Provisioning**. - ![icd start page](images/bulk-enrollment7.png) + ![icd start page.](images/bulk-enrollment7.png) 3. Enter a project name and click **Next**. 4. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then click **Next**. 5. Skip **Import a provisioning package (optional)** and click **Finish**. @@ -74,20 +74,20 @@ Using the WCD, create a provisioning package using the enrollment information re For detailed descriptions of these settings, see [Provisioning CSP](provisioning-csp.md). Here is the screenshot of the WCD at this point. - ![bulk enrollment screenshot](images/bulk-enrollment.png) + ![bulk enrollment screenshot.](images/bulk-enrollment.png) 9. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (e.g., **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). 10. When you are done adding all the settings, on the **File** menu, click **Save**. 11. On the main menu click **Export** > **Provisioning package**. - ![icd menu for export](images/bulk-enrollment2.png) + ![icd menu for export.](images/bulk-enrollment2.png) 12. Enter the values for your package and specify the package output location. - ![enter package information](images/bulk-enrollment3.png) - ![enter additional information for package information](images/bulk-enrollment4.png) - ![specify file location](images/bulk-enrollment6.png) + ![enter package information.](images/bulk-enrollment3.png) + ![enter additional information for package information.](images/bulk-enrollment4.png) + ![specify file location.](images/bulk-enrollment6.png) 13. Click **Build**. - ![icb build window](images/bulk-enrollment5.png) + ![icb build window.](images/bulk-enrollment5.png) 14. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). 15. Apply the package to your devices. @@ -108,7 +108,7 @@ Using the WCD, create a provisioning package using the enrollment information re 5. Set **ExportCertificate** to False. 6. For **KeyLocation**, select **Software only**. - ![icd certificates section](images/bulk-enrollment8.png) + ![icd certificates section.](images/bulk-enrollment8.png) 7. Specify the workplace settings. 1. Got to **Workplace** > **Enrollments**. 2. Enter the **UPN** for the enrollment and then click **Add**. diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index 64372f26a8..ab4cb97c8f 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -21,7 +21,7 @@ The CellularSettings configuration service provider is used to configure cellula The following image shows the CellularSettings CSP in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. -![provisioning for cellular settings](images/provisioning-csp-cellularsettings.png) +![provisioning for cellular settings.](images/provisioning-csp-cellularsettings.png) **DataRoam**

Optional. Integer. Specifies the default roaming value. Valid values are:

diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 5063181c3f..1d42413872 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -20,7 +20,7 @@ This configuration service provider requires the ID\_CAP\_NETWORKING\_ADMIN capa The following diagram shows the CM\_CellularEntries configuration service provider management object in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. -![cm\-cellularentries csp](images/provisioning-csp-cm-cellularentries.png) +![cm\-cellularentries csp.](images/provisioning-csp-cm-cellularentries.png) ***entryname***

Defines the name of the connection.

diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index cce8060fe3..d4793c91e6 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2555,36 +2555,36 @@ The following list shows the CSPs supported in HoloLens devices: | Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | |------|--------|--------|--------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) -| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | -| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | -| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | -| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| -| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | -| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) +| [Accounts CSP](accounts-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [AppLocker CSP](applocker-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [CertificateStore CSP](certificatestore-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevDetail CSP](devdetail-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevInfo CSP](devinfo-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMAcc CSP](dmacc-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMClient CSP](dmclient-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| +| [NodeCache CSP](nodecache-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +[PassportForWork CSP](passportforwork-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | +| [Update CSP](update-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WiFi CSP](wifi-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | ## CSPs supported in Microsoft Surface Hub diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 8e886f3661..cc589f1f13 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -42,7 +42,7 @@ For more information about the CSPs, see [Update CSP](update-csp.md) and the upd The following diagram provides a conceptual overview of how this works: -![mobile device update management](images/mdm-update-sync.png) +![mobile device update management.](images/mdm-update-sync.png) The diagram can be roughly divided into three areas: @@ -56,7 +56,7 @@ The Microsoft Update Catalog is huge and contains many updates that are not need This section describes how this is done. The following diagram shows the server-server sync protocol process. -![mdm server-server sync](images/deviceupdateprocess2.png) +![mdm server-server sync.](images/deviceupdateprocess2.png) MSDN provides much information about the Server-Server sync protocol. In particular: @@ -140,7 +140,7 @@ The enterprise IT can configure auto-update polices via OMA DM using the [Policy The following diagram shows the Update policies in a tree format. -![update policies](images/update-policies.png) +![update policies.](images/update-policies.png) **Update/ActiveHoursEnd** > [!NOTE] @@ -676,7 +676,7 @@ Example The enterprise IT can configure the set of approved updates and get compliance status via OMA DM using the [Update CSP](update-csp.md). The following diagram shows the Update CSP in tree format.. -![provisioning csp update](images/provisioning-csp-update.png) +![provisioning csp update.](images/provisioning-csp-update.png) **Update** The root node. @@ -889,9 +889,9 @@ Here is the list of older policies that are still supported for backward compati The following screenshots of the administrator console show the list of update titles, approval status, and additional metadata fields. -![mdm update management screenshot](images/deviceupdatescreenshot1.png) +![mdm update management screenshot.](images/deviceupdatescreenshot1.png) -![mdm update management metadata screenshot](images/deviceupdatescreenshot2.png) +![mdm update management metadata screenshot.](images/deviceupdatescreenshot2.png) ## SyncML example @@ -945,5 +945,5 @@ Set auto update to notify and defer. The following diagram and screenshots show the process flow of the device update process using Windows Server Update Services and Microsoft Update Catalog. -![mdm device update management screenshot3](images/deviceupdatescreenshot3.png)![mdm device update management screenshot4](images/deviceupdatescreenshot4.png)![mdm device update management screenshot5](images/deviceupdatescreenshot5.png)![mdm device update management screenshot6](images/deviceupdatescreenshot6.png)![mdm device update management screenshot7](images/deviceupdatescreenshot7.png)![mdm device update management screenshot8](images/deviceupdatescreenshot8.png)![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) +![mdm device update management screenshot3.](images/deviceupdatescreenshot3.png)![mdm device update management screenshot4](images/deviceupdatescreenshot4.png)![mdm device update management screenshot5](images/deviceupdatescreenshot5.png)![mdm device update management screenshot6](images/deviceupdatescreenshot6.png)![mdm device update management screenshot7](images/deviceupdatescreenshot7.png)![mdm device update management screenshot8](images/deviceupdatescreenshot8.png)![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index f24564545c..0db22bf159 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -26,7 +26,7 @@ The DeviceInstance CSP is only supported in Windows 10 Mobile. The following diagram shows the DeviceInstanceService configuration service provider in tree format. -![provisioning\-csp\-deviceinstanceservice](images/provisioning-csp-deviceinstanceservice.png) +![provisioning\-csp\-deviceinstanceservice.](images/provisioning-csp-deviceinstanceservice.png) **Roaming** A boolean value that specifies the roaming status of the device. In dual SIM mode when the device supports two different phone numbers, querying SIM 1 explicitly with ./Vendor/MSFT/DeviceInstanceService/Identify1/Roaming is functionally equivalent to using ./Vendor/MSFT/DeviceInstanceService/Roaming. diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index cef65071ec..9933e58a23 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -32,7 +32,7 @@ The DevicePasswordEnabled setting must be set to 0 (device password is enabled) The following image shows the DeviceLock configuration service provider in tree format. -![devicelock csp](images/provisioning-csp-devicelock.png) +![devicelock csp.](images/provisioning-csp-devicelock.png) **Provider** Required. An interior node to group all policy providers. Scope is permanent. Supported operation is Get. diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 6043b61d8c..92ed52968c 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -20,13 +20,13 @@ To help diagnose enrollment or device management issues in Windows 10 devices m 1. On your managed device go to **Settings** > **Accounts** > **Access work or school**. 1. Click your work or school account, then click **Info.** - ![Access work or school page in Settings](images/diagnose-mdm-failures15.png) + ![Access work or school page in Settings.](images/diagnose-mdm-failures15.png) 1. At the bottom of the **Settings** page, click **Create report**. - ![Access work or school page and then Create report](images/diagnose-mdm-failures16.png) + ![Access work or school page and then Create report.](images/diagnose-mdm-failures16.png) 1. A window opens that shows the path to the log files. Click **Export**. - ![Access work or school log files](images/diagnose-mdm-failures17.png) + ![Access work or school log files.](images/diagnose-mdm-failures17.png) 1. In File Explorer, navigate to c:\Users\Public\Documents\MDMDiagnostics to see the report. @@ -59,7 +59,7 @@ Starting with the Windows 10, version 1511, MDM logs are captured in the Event Here's a screenshot: -![mdm event viewer](images/diagnose-mdm-failures1.png) +![mdm event viewer.](images/diagnose-mdm-failures1.png) In this location, the **Admin** channel logs events by default. However, if you need more details logs you can enable **Debug** logs by choosing **Show Analytic and Debug** logs option in **View** menu in Event Viewer. @@ -238,26 +238,26 @@ For best results, ensure that the PC or VM on which you are viewing logs matches 1. Open eventvwr.msc. 2. Right-click on **Event Viewer(Local)** and select **Open Saved Log**. - ![event viewer screenshot](images/diagnose-mdm-failures9.png) + ![event viewer screenshot.](images/diagnose-mdm-failures9.png) 3. Navigate to the etl file that you got from the device and then open the file. 4. Click **Yes** when prompted to save it to the new log format. - ![event viewer prompt](images/diagnose-mdm-failures10.png) + ![event viewer prompt.](images/diagnose-mdm-failures10.png) - ![diagnose mdm failures](images/diagnose-mdm-failures11.png) + ![diagnose mdm failures.](images/diagnose-mdm-failures11.png) 5. The new view contains traces from the channel. Click on **Filter Current Log** from the **Actions** menu. - ![event viewer actions](images/diagnose-mdm-failures12.png) + ![event viewer actions.](images/diagnose-mdm-failures12.png) 6. Add a filter to Event sources by selecting **DeviceManagement-EnterpriseDiagnostics-Provider** and click **OK**. - ![event filter for Device Management](images/diagnose-mdm-failures13.png) + ![event filter for Device Management.](images/diagnose-mdm-failures13.png) 7. Now you are ready to start reviewing the logs. - ![event viewer review logs](images/diagnose-mdm-failures14.png) + ![event viewer review logs.](images/diagnose-mdm-failures14.png) ## Collect device state data diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 35fe6568b0..5f48d033a0 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -137,7 +137,7 @@ You can only use the Work Access page to unenroll under the following conditions When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenerollment](images/azure-ad-unenrollment.png) +![aadj unenerollment.](images/azure-ad-unenrollment.png) When a device is enrolled into MDM through Azure Active Directory Join and then remotely unenrolled, the device may get into a state where it must be re-imaged. When devices are remotely unenrolled from MDM, the AAD association is also removed. This safeguard is in place to avoid leaving the corporated devices in unmanaged state. diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 43882781ec..2ef69ad6c3 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -24,35 +24,35 @@ To get the EAP configuration from your desktop using the rasphone tool that is s 1. Run rasphone.exe. - ![vpnv2 rasphone](images/vpnv2-csp-rasphone.png) + ![vpnv2 rasphone.](images/vpnv2-csp-rasphone.png) 1. If you don't currently have a VPN connection and you see the following message, select **OK**. - ![vpnv2 csp network connections](images/vpnv2-csp-networkconnections.png) + ![vpnv2 csp network connections.](images/vpnv2-csp-networkconnections.png) 1. In the wizard, select **Workplace network**. - ![vpnv2 csp set up connection](images/vpnv2-csp-setupnewconnection.png) + ![vpnv2 csp set up connection.](images/vpnv2-csp-setupnewconnection.png) 1. Enter an Internet address and connection name. These can be fake since it does not impact the authentication parameters. - ![vpnv2 csp set up connection 2](images/vpnv2-csp-setupnewconnection2.png) + ![vpnv2 csp set up connection 2.](images/vpnv2-csp-setupnewconnection2.png) 1. Create a fake VPN connection. In the UI shown here, select **Properties**. - ![vpnv2 csp choose nw connection](images/vpnv2-csp-choosenetworkconnection.png) + ![vpnv2 csp choose nw connection.](images/vpnv2-csp-choosenetworkconnection.png) 1. In the **Test Properties** dialog, select the **Security** tab. - ![vpnv2 csp test props](images/vpnv2-csp-testproperties.png) + ![vpnv2 csp test props.](images/vpnv2-csp-testproperties.png) 1. On the **Security** tab, select **Use Extensible Authentication Protocol (EAP)**. - ![vpnv2 csp test props2](images/vpnv2-csp-testproperties2.png) + ![vpnv2 csp test props2.](images/vpnv2-csp-testproperties2.png) 1. From the drop-down menu, select the EAP method that you want to configure, and then select **Properties** to configure as needed. - ![vpnv2 csp test props3](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) + ![vpnv2 csp test props3.](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) 1. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. @@ -267,7 +267,7 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Follow steps 1 through 7 in the EAP configuration article. 1. In the **Microsoft VPN SelfHost Properties** dialog box, select **Microsoft: Smart Card or other Certificate** from the drop-down menu (this selects EAP TLS). - ![vpn self host properties window](images/certfiltering1.png) + ![vpn self host properties window.](images/certfiltering1.png) > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. @@ -277,11 +277,11 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Select the **Properties** button underneath the drop-down menu. 1. On the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - ![smart card or other certificate properties window](images/certfiltering2.png) + ![smart card or other certificate properties window.](images/certfiltering2.png) 1. On the **Configure Certificate Selection** menu, adjust the filters as needed. - ![configure certificate window](images/certfiltering3.png) + ![configure certificate window.](images/certfiltering3.png) 1. Select **OK** to close the windows and get back to the main rasphone.exe dialog box. 1. Close the rasphone dialog box. diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index d6a0127bab..cfc9928a0b 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -47,19 +47,19 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( 2. Under **Best match**, click **Edit group policy** to launch it. - ![GPEdit search](images/admx-gpedit-search.png) + ![GPEdit search.](images/admx-gpedit-search.png) 3. In **Local Computer Policy** navigate to the policy you want to configure. In this example, navigate to **Administrative Templates > System > App-V**. - ![App-V policies](images/admx-appv.png) + ![App-V policies.](images/admx-appv.png) 4. Double-click **Enable App-V Client**. The **Options** section is empty, which means there are no parameters necessary to enable the policy. If the **Options** section is not empty, follow the procedure in [Enable a policy that requires parameters](#enable-a-policy-that-requires-parameters) - ![Enable App-V client](images/admx-appv-enableapp-vclient.png) + ![Enable App-V client.](images/admx-appv-enableapp-vclient.png) 3. Create the SyncML to enable the policy that does not require any parameter. @@ -99,15 +99,15 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. - ![Enable publishing server 2 policy](images/admx-appv-publishingserver2.png) + ![Enable publishing server 2 policy.](images/admx-appv-publishingserver2.png) - ![Enable publishing server 2 settings](images/admx-app-v-enablepublishingserver2settings.png) + ![Enable publishing server 2 settings.](images/admx-app-v-enablepublishingserver2settings.png) 2. Find the variable names of the parameters in the ADMX file. You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). - ![Publishing server 2 policy description](images/admx-appv-policy-description.png) + ![Publishing server 2 policy description.](images/admx-appv-policy-description.png) 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index f4c951af17..bab52cb7fd 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -84,7 +84,7 @@ After the upgrade to Windows 10 is complete, if you decide to push down a new we The following diagram shows a high-level overview of the process. -![update process for windows embedded 8.1 devices](images/windowsembedded-update.png) +![update process for windows embedded 8.1 devices.](images/windowsembedded-update.png) ## Step 1: Prepare a test device to download updates from Microsoft Update @@ -107,15 +107,15 @@ Trigger the device to check for updates either manually or using Microsoft Endpo 1. Remotely trigger a scan of the test device by deploying a Trigger Scan configuration baseline. - ![device scan using Configuration Manager](images/windowsembedded-update2.png) + ![device scan using Configuration Manager.](images/windowsembedded-update2.png) 2. Set the value of this OMA-URI by going to **Configuration Item**, and then selecting the newly created Trigger Scan settings from the previous step. - ![device scan using Configuration Manager](images/windowsembedded-update3.png) + ![device scan using Configuration Manager.](images/windowsembedded-update3.png) 3. Ensure that the value that is specified for this URI is greater than the value on the device(s), and that the **Remediate noncompliant rules when supported** option is selected. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. - ![device scan using Configuration Manager](images/windowsembedded-update4.png) + ![device scan using Configuration Manager.](images/windowsembedded-update4.png) 4. Create a configuration baseline for Trigger Scan and Deploy. We recommend that this configuration baseline be deployed after the Controlled Updates baseline has been applied to the device. (The corresponding files are deployed on the device through a device sync session.) 5. Follow the prompts for downloading the updates, but do not install the updates on the device. @@ -216,11 +216,11 @@ The deployment process has three parts: 1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then select **Select**. - ![embedded device update](images/windowsembedded-update18.png) + ![embedded device update.](images/windowsembedded-update18.png) 2. Browse to the DUControlledUpdates.xml that was created from the test device, and then specify the file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. - ![embedded device update](images/windowsembedded-update19.png) + ![embedded device update.](images/windowsembedded-update19.png) 3. Select **Remediate noncompliant settings**, and then select **OK**. @@ -231,7 +231,7 @@ The deployment process has three parts: 1. Create a configuration item and specify the file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` 2. Select **Remediate noncompliant settings**. - ![embedded device update](images/windowsembedded-update21.png) + ![embedded device update.](images/windowsembedded-update21.png) 3. Select **OK**. @@ -242,11 +242,11 @@ The deployment process has three parts: 1. Create a configuration baseline item and give it a name (such as ControlledUpdates). 2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then select **OK**. - ![embedded device update](images/windowsembedded-update22.png) + ![embedded device update.](images/windowsembedded-update22.png) 3. Deploy the configuration baseline to the appropriate device or device collection. - ![embedded device update](images/windowsembedded-update23.png) + ![embedded device update.](images/windowsembedded-update23.png) 4. Select **OK**. @@ -472,57 +472,57 @@ Use this procedure for pre-GDR1 devices: 2. In Microsoft Endpoint Configuration Manager, under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Items**. 3. Select **Create Configuration Item**. - ![device update using Configuration Manager](images/windowsembedded-update5.png) + ![device update using Configuration Manager.](images/windowsembedded-update5.png) 4. Enter a filename (such as GetDUReport), and then select **Mobile Device**. 5. On the **Mobile Device Settings** page, select **Configure Additional Settings that are not in the default settings group**, and then select **Next**. - ![device update using Configuration Manager](images/windowsembedded-update6.png) + ![device update using Configuration Manager.](images/windowsembedded-update6.png) 6. On the **Additional Settings** page, select **Add**. - ![device update using Configuration Manager](images/windowsembedded-update7.png) + ![device update using Configuration Manager.](images/windowsembedded-update7.png) 7. On the **Browse Settings** page, select **Create Setting**. - ![device update](images/windowsembedded-update8.png) + ![device update.](images/windowsembedded-update8.png) 8. Enter a unique **Name**. For **Setting type**, select **OMA-URI**, and for **Data type**, select **String**. 9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, and then select **OK**. - ![handheld device update](images/windowsembedded-update9.png) + ![handheld device update.](images/windowsembedded-update9.png) 10. On the **Browse Settings** page, select **Close**. 11. On the **Create Configuration Item Wizard** page, select **All Windows Embedded 8.1 Handheld** as the supported platform, and then select **Next**. - ![embedded device update](images/windowsembedded-update10.png) + ![embedded device update.](images/windowsembedded-update10.png) 12. Close the **Create Configuration Item Wizard** page. 13. Right-click on the newly create configuration item, and then select the **Compliance Rules** tab. 14. Select the new created mobile device setting (such as DUReport), and then select **Select**. 15. Enter a dummy value (such as zzz) that is different from the one on the device. - ![embedded device update](images/windowsembedded-update11.png) + ![embedded device update.](images/windowsembedded-update11.png) 16. Disable remediation by deselecting the **Remediate noncompliant rules when supported** option. 17. Select **OK** to close the **Edit Rule** page. 18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Baselines**. 19. Select **Create Configuration Item**. - ![embedded device update](images/windowsembedded-update12.png) + ![embedded device update.](images/windowsembedded-update12.png) 20. Enter a baseline name (such as RetrieveDUReport). 21. Add the configuration item that you just created. Select **Add**, and then select the configuration item that you just created (such as DUReport). - ![embedded device update](images/windowsembedded-update13.png) + ![embedded device update.](images/windowsembedded-update13.png) 22. Select **OK**, and then select **OK** again to complete the configuration baseline. 23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created, and then select **Deploy**. - ![embedded device update](images/windowsembedded-update14.png) + ![embedded device update.](images/windowsembedded-update14.png) 24. Select **Remediate noncompliant rules when supported**. 25. Select the appropriate device collection and define the schedule. - ![device update](images/windowsembedded-update15.png) + ![device update.](images/windowsembedded-update15.png) 26. To view the DUReport content, select the appropriate deployment for the configuration baseline that you created. Right-click on the deployment, and then select **View Status**. 27. Select **Run Summarization**, and then select **Refresh**. The test device(s) should be listed on the **Non-Compliant** tab. 28. Under **Asset Details**, right-click on the test device, and then select **Mode Details**. - ![device update](images/windowsembedded-update16.png) + ![device update.](images/windowsembedded-update16.png) 29. On the **Non-compliant** tab, you can see the DUReport, but you cannot retrieve the content from here. - ![device update](images/windowsembedded-update17.png) + ![device update.](images/windowsembedded-update17.png) 30. To retrieve the DUReport, open C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. 31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz," where zzz is the dummy value. Just above this, copy the information for UpdateData and use this information to create the DUControlledUpdates.xml. diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 322e4dbc40..c9f13235e0 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -46,11 +46,11 @@ To ensure that the auto-enrollment feature is working as expected, you must veri The following steps demonstrate required settings using the Intune service: 1. Verify that the user who is going to enroll the device has a valid Intune license. - ![Intune license verification](images/auto-enrollment-intune-license-verification.png) + ![Intune license verification.](images/auto-enrollment-intune-license-verification.png) 2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). - ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) + ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) > [!IMPORTANT] > For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. @@ -62,23 +62,23 @@ The following steps demonstrate required settings using the Intune service: You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. - ![Auto-enrollment device status result](images/auto-enrollment-device-status-result.png) + ![Auto-enrollment device status result.](images/auto-enrollment-device-status-result.png) Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. - ![Auto-enrollment Azure AD prt verification](images/auto-enrollment-azureadprt-verification.png) + ![Auto-enrollment Azure AD prt verification.](images/auto-enrollment-azureadprt-verification.png) This information can also be found on the Azure AD device list. - ![Azure AD device list](images/azure-ad-device-list.png) + ![Azure AD device list.](images/azure-ad-device-list.png) 5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc - ![MDM discovery URL](images/auto-enrollment-mdm-discovery-url.png) + ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) 6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. - ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) + ![Mobility setting MDM intune.](images/auto-enrollment-microsoft-intune-setting.png) 7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. @@ -87,7 +87,7 @@ You may contact your domain administrators to verify if the group policy has bee 9. Verify that Microsoft Intune should allow enrollment of Windows devices. - ![Enrollment of Windows devices](images/auto-enrollment-enrollment-of-windows-devices.png) + ![Enrollment of Windows devices.](images/auto-enrollment-enrollment-of-windows-devices.png) ## Configure the auto-enrollment Group Policy for a single PC @@ -102,18 +102,18 @@ Requirements: Click Start, then in the text box type gpedit. - ![GPEdit desktop app search result](images/autoenrollment-gpedit.png) + ![GPEdit desktop app search result.](images/autoenrollment-gpedit.png) 2. Under **Best match**, click **Edit group policy** to launch it. 3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. > [!div class="mx-imgBorder"] - > ![MDM policies](images/autoenrollment-mdm-policies.png) + > ![MDM policies.](images/autoenrollment-mdm-policies.png) 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - ![MDM autoenrollment policy](images/autoenrollment-policy.png) + ![MDM autoenrollment policy.](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. @@ -129,7 +129,7 @@ Requirements: If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. - ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + ![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) > [!Tip] > You can avoid this behavior by using Conditional Access Policies in Azure AD. @@ -139,7 +139,7 @@ Requirements: 7. Click **Info** to see the MDM enrollment information. - ![Work School Settings](images/autoenrollment-settings-work-school.png) + ![Work School Settings.](images/autoenrollment-settings-work-school.png) If you do not see the **Info** button or the enrollment information, it is possible that the enrollment failed. Check the status in [Task Scheduler app](#task-scheduler-app). @@ -148,13 +148,13 @@ Requirements: 1. Click **Start**, then in the text box type **task scheduler**. - ![Task Scheduler search result](images/autoenrollment-task-schedulerapp.png) + ![Task Scheduler search result.](images/autoenrollment-task-schedulerapp.png) 2. Under **Best match**, click **Task Scheduler** to launch it. 3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. - ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) + ![Auto-enrollment scheduled task.](images/autoenrollment-scheduled-task.png) To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. @@ -239,13 +239,13 @@ To collect Event Viewer logs: 3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully: - ![Event ID 75](images/auto-enrollment-troubleshooting-event-id-75.png) + ![Event ID 75.](images/auto-enrollment-troubleshooting-event-id-75.png) If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons: - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed: - ![Event ID 76](images/auto-enrollment-troubleshooting-event-id-76.png) + ![Event ID 76.](images/auto-enrollment-troubleshooting-event-id-76.png) To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. @@ -253,7 +253,7 @@ To collect Event Viewer logs: The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot: - ![Task scheduler](images/auto-enrollment-task-scheduler.png) + ![Task scheduler.](images/auto-enrollment-task-scheduler.png) > [!Note] > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. @@ -262,24 +262,24 @@ To collect Event Viewer logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. - ![Event ID 107](images/auto-enrollment-event-id-107.png) + ![Event ID 107.](images/auto-enrollment-event-id-107.png) When the task is completed, a new event ID 102 is logged. - ![Event ID 102](images/auto-enrollment-event-id-102.png) + ![Event ID 102.](images/auto-enrollment-event-id-102.png) Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - ![Outdated enrollment entries](images/auto-enrollment-outdated-enrollment-entries.png) + ![Outdated enrollment entries.](images/auto-enrollment-outdated-enrollment-entries.png) By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016. A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - ![Manually deleted entries](images/auto-enrollment-activation-verification-less-entries.png) + ![Manually deleted entries.](images/auto-enrollment-activation-verification-less-entries.png) ### Related topics diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index b809041a65..c29e2047ad 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -41,7 +41,7 @@ These classifications are represented as nodes in the EnterpriseModernAppManagem The following diagram shows the EnterpriseModernAppManagement CSP in a tree format. -![enterprisemodernappmanagement csp diagram](images/provisioning-csp-enterprisemodernappmanagement.png) +![enterprisemodernappmanagement csp diagram.](images/provisioning-csp-enterprisemodernappmanagement.png) Each app displays one package family name and 1-n package full names for installed apps. The apps are categorized based on their origin (Store, nonStore, System). diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index 51c1a6581f..98249aad50 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -23,7 +23,7 @@ The EnterpriseAppManagement enterprise configuration service provider is used to The following diagram shows the EnterpriseAppManagement configuration service provider in tree format. -![enterpriseappmanagement csp](images/provisioning-csp-enterpriseappmanagement.png) +![enterpriseappmanagement csp.](images/provisioning-csp-enterpriseappmanagement.png) ***EnterpriseID*** Optional. A dynamic node that represents the EnterpriseID as a GUID. It is used to enroll or unenroll enterprise applications. diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 12547591ba..3df7b51be2 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -24,7 +24,7 @@ The FileSystem configuration service provider is used to query, add, modify, and The following diagram shows the FileSystem configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider. -![filesystem csp (dm)](images/provisioning-csp-filesystem-dm.png) +![filesystem csp (dm).](images/provisioning-csp-filesystem-dm.png) **FileSystem** Required. Defines the root of the file system management object. It functions as the root directory for file system queries. diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 9f691cab8c..03fb5b432d 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -104,7 +104,7 @@ The following is a list of functions performed by the Device HealthAttestation C - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device - Receives attestation requests (DHA-Requests) from a DHA-Enabled-MDM, and replies with a device health report (DHA-Report) -![healthattestation service diagram](images/healthattestation_2.png) +![healthattestation service diagram.](images/healthattestation_2.png)
      OS deployed  Windows 10 Windows Server 2016 Windows Server 2019Windows 11
-
 
 
 
 
 
 
 
 
 
 
Boot image version
+
 
 
 
 
 
 
 
 
 
Boot image version
Windows 10
diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index 36a979715e..af7934b674 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -27,7 +27,7 @@ The HotSpot configuration service provider is used to configure and enable Inter The following diagram shows the HotSpot configuration service provider management object in tree format as used by OMA Client Provisioning. The OMA DM protocol is not supported by this configuration service provider. -![hotspot csp (cp)](images/provisioning-csp-hotspot-cp.png) +![hotspot csp (cp).](images/provisioning-csp-hotspot-cp.png) **Enabled** Required. Specifies whether to enable Internet sharing on the device. The default is false. diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index 08a455f462..68633b48af 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -44,7 +44,7 @@ To make applications WIP-aware, app developers need to include the following dat MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.  -![Mobile application management app](images/implement-server-side-mobile-application-management.png) +![Mobile application management app.](images/implement-server-side-mobile-application-management.png) MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.  diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 12e50c7af7..875c7d0ded 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -59,13 +59,13 @@ The Store for Business provides services that enable a management tool to synchr The following diagram provides an overview of app distribution from acquisition of an offline-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. -![business store offline app distribution](images/businessstoreportalservices2.png) +![business store offline app distribution.](images/businessstoreportalservices2.png) ### Online-licensed application distribution The following diagram provides an overview of app distribution from acquisition of an online-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. For online-licensed applications, the management tool calls back into the Store for Business management services to assign an application prior to issuing the policy to install the application. -![business store online app distribution](images/businessstoreportalservices3.png) +![business store online app distribution.](images/businessstoreportalservices3.png) ## Integrate with Azure Active Directory @@ -105,7 +105,7 @@ After registering your management tool with Azure AD, the management tool can ca The diagram below shows the call patterns for acquiring a new or updated application. -![business store portal service flow diagram](images/businessstoreportalservicesflow.png) +![business store portal service flow diagram.](images/businessstoreportalservicesflow.png) **Here is the list of available operations**: diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index d1e7b033f2..6dbe747d92 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -25,7 +25,7 @@ In today’s cloud-first world, enterprise IT departments increasingly want to l You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. -![active directory azure ad signin](images/unifiedenrollment-rs1-1.png) +![active directory azure ad signin.](images/unifiedenrollment-rs1-1.png) ### Connect your device to an Active Directory domain (join a domain) @@ -40,15 +40,15 @@ Joining your device to an Active Directory domain during the out-of-box-experien 1. On the **Who Owns this PC?** page, select **My work or school owns it**. - ![oobe local account creation](images/unifiedenrollment-rs1-2.png) + ![oobe local account creation.](images/unifiedenrollment-rs1-2.png) 2. Next, select **Join a domain**. - ![select domain or azure ad](images/unifiedenrollment-rs1-3.png) + ![select domain or azure ad.](images/unifiedenrollment-rs1-3.png) 3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. - ![create pc account](images/unifiedenrollment-rs1-4.png) + ![create pc account.](images/unifiedenrollment-rs1-4.png) ### Use the Settings app @@ -56,27 +56,27 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-5.png) + ![windows settings page.](images/unifiedenrollment-rs1-5.png) 2. Next, select **Accounts**. - ![windows settings accounts select](images/unifiedenrollment-rs1-6.png) + ![windows settings accounts select.](images/unifiedenrollment-rs1-6.png) 3. Navigate to **Access work or school**. - ![select access work or school](images/unifiedenrollment-rs1-7.png) + ![select access work or school.](images/unifiedenrollment-rs1-7.png) 4. Select **Connect**. - ![connect to work or school](images/unifiedenrollment-rs1-8.png) + ![connect to work or school.](images/unifiedenrollment-rs1-8.png) 5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. - ![join account to active directory domain](images/unifiedenrollment-rs1-9.png) + ![join account to active directory domain.](images/unifiedenrollment-rs1-9.png) 6. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. - ![type in domain name](images/unifiedenrollment-rs1-10.png) + ![type in domain name.](images/unifiedenrollment-rs1-10.png) ### Help with connecting to an Active Directory domain @@ -101,11 +101,11 @@ To join a domain: 1. Select **My work or school owns it**, then select **Next.** - ![oobe local account creation](images/unifiedenrollment-rs1-11.png) + ![oobe local account creation.](images/unifiedenrollment-rs1-11.png) 2. Select **Join Azure AD**, and then select **Next.** - ![select domain or azure ad](images/unifiedenrollment-rs1-12.png) + ![select domain or azure ad.](images/unifiedenrollment-rs1-12.png) 3. Type in your Azure AD username. This is the email address you use to log into Microsoft Office 365 and similar services. @@ -113,7 +113,7 @@ To join a domain: Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant is not configured for auto-enrollment, you will have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization’s Azure AD domain. - ![azure ad signin](images/unifiedenrollment-rs1-13.png) + ![azure ad signin.](images/unifiedenrollment-rs1-13.png) ### Use the Settings app @@ -121,27 +121,27 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-14.png) + ![windows settings page.](images/unifiedenrollment-rs1-14.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts select](images/unifiedenrollment-rs1-15.png) + ![windows settings accounts select.](images/unifiedenrollment-rs1-15.png) 3. Navigate to **Access work or school**. - ![select access work or school](images/unifiedenrollment-rs1-16.png) + ![select access work or school.](images/unifiedenrollment-rs1-16.png) 4. Select **Connect**. - ![connect to work or school](images/unifiedenrollment-rs1-17.png) + ![connect to work or school.](images/unifiedenrollment-rs1-17.png) 5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**. - ![join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) + ![join work or school account to azure ad.](images/unifiedenrollment-rs1-18.png) 6. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![azure ad sign in](images/unifiedenrollment-rs1-19.png) + ![azure ad sign in.](images/unifiedenrollment-rs1-19.png) 7. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -151,7 +151,7 @@ To create a local account and connect the device: After you reach the end of the flow, your device should be connected to your organization’s Azure AD domain. You may now log out of your current account and sign in using your Azure AD username. - ![corporate sign in](images/unifiedenrollment-rs1-20.png) + ![corporate sign in.](images/unifiedenrollment-rs1-20.png) ### Help with connecting to an Azure AD domain @@ -183,19 +183,19 @@ To create a local account and connect the device: 1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. - ![windows settings page](images/unifiedenrollment-rs1-21-b.png) + ![windows settings page.](images/unifiedenrollment-rs1-21-b.png) 2. Navigate to **Access work or school**. - ![select access work or school](images/unifiedenrollment-rs1-23-b.png) + ![select access work or school.](images/unifiedenrollment-rs1-23-b.png) 3. Select **Connect**. - ![connect to work or school](images/unifiedenrollment-rs1-24-b.png) + ![connect to work or school.](images/unifiedenrollment-rs1-24-b.png) 4. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![join work or school account to azure ad](images/unifiedenrollment-rs1-25-b.png) + ![join work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) 5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -205,11 +205,11 @@ To create a local account and connect the device: Starting in Windows 10, version 1709, you will see the status page that shows the progress of your device being set up. - ![corporate sign in](images/unifiedenrollment-rs1-26.png) + ![corporate sign in.](images/unifiedenrollment-rs1-26.png) 6. After you complete the flow, your Microsoft account will be connected to your work or school account. - ![account successfully added](images/unifiedenrollment-rs1-27.png) + ![account successfully added.](images/unifiedenrollment-rs1-27.png) ### Connect to MDM on a desktop (enrolling in device management) @@ -221,29 +221,29 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-28.png) + ![windows settings page.](images/unifiedenrollment-rs1-28.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts page](images/unifiedenrollment-rs1-29.png) + ![windows settings accounts page.](images/unifiedenrollment-rs1-29.png) 3. Navigate to **Access work or school**. - ![access work or school](images/unifiedenrollment-rs1-30.png) + ![access work or school.](images/unifiedenrollment-rs1-30.png) 4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). - ![connect to work or school](images/unifiedenrollment-rs1-31.png) + ![connect to work or school.](images/unifiedenrollment-rs1-31.png) 5. Type in your work email address. - ![set up work or school account](images/unifiedenrollment-rs1-32.png) + ![set up work or school account.](images/unifiedenrollment-rs1-32.png) 6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen. - ![corporate sign in](images/unifiedenrollment-rs1-33-b.png) + ![corporate sign in.](images/unifiedenrollment-rs1-33-b.png) After you complete the flow, your device will be connected to your organization’s MDM. @@ -300,7 +300,7 @@ To connect your devices to MDM using deep links: - IT admins can add this link to a welcome email that users can select to enroll into MDM. - ![using enrollment deeplink in email](images/deeplinkenrollment1.png) + ![using enrollment deeplink in email.](images/deeplinkenrollment1.png) - IT admins can also add this link to an internal web page that users refer to enrollment instructions. @@ -308,20 +308,20 @@ To connect your devices to MDM using deep links: Type in your work email address. - ![set up work or school account](images/deeplinkenrollment3.png) + ![set up work or school account.](images/deeplinkenrollment3.png) 3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. After you complete the flow, your device will be connected to your organization's MDM. - ![corporate sign in](images/deeplinkenrollment4.png) + ![corporate sign in.](images/deeplinkenrollment4.png) ## Manage connections To manage your work or school connections, select **Settings** > **Accounts** > **Access work or school**. Your connections will show on this page and selecting one will expand options for that connection. -![managing work or school account](images/unifiedenrollment-rs1-34-b.png) +![managing work or school account.](images/unifiedenrollment-rs1-34-b.png) ### Info @@ -335,7 +335,7 @@ Selecting the **Info** button will open a new page in the Settings app that prov Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. -![work or school info](images/unifiedenrollment-rs1-35-b.png) +![work or school info.](images/unifiedenrollment-rs1-35-b.png) > [!NOTE] > Starting in Windows 10, version 1709, the **Manage** button is no longer available. @@ -357,7 +357,7 @@ You can collect diagnostic logs around your work connections by going to **Setti Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you will see the button to create a report, as shown here. -![collecting enrollment management log files](images/unifiedenrollment-rs1-37-c.png) +![collecting enrollment management log files.](images/unifiedenrollment-rs1-37-c.png) diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index e9383e871f..ad2d4edddc 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -17,7 +17,7 @@ The Messaging configuration service provider is used to configure the ability to The following diagram shows the Messaging configuration service provider in tree format. -![messaging csp](images/provisioning-csp-messaging.png) +![messaging csp.](images/provisioning-csp-messaging.png) **./User/Vendor/MSFT/Messaging** diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 32f9b5ee66..6c898afe02 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -68,7 +68,7 @@ Devices that are joined to an on-premises Active Directory can enroll into MDM v Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. -![Disable MDM enrollment policy in GP Editor](images/mdm-enrollment-disable-policy.png) +![Disable MDM enrollment policy in GP Editor.](images/mdm-enrollment-disable-policy.png) Here is the corresponding registry key: diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 1b5f5ecdd4..0b715c1a53 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -27,11 +27,11 @@ The NAPDEF configuration service provider is used to add, modify, or delete WAP The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. -![napdef csp (cp) (initial bootstrapping)](images/provisioning-csp-napdef-cp.png) +![napdef csp (cp) (initial bootstrapping).](images/provisioning-csp-napdef-cp.png) The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **updating the bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. -![napdef csp (cp) (update bootstrapping)](images/provisioning-csp-napdef-cp-2.png) +![napdef csp (cp) (update bootstrapping).](images/provisioning-csp-napdef-cp-2.png) **NAPAUTHINFO** Defines a group of authentication settings. diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index ce79fdb702..272489e4a8 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -240,7 +240,7 @@ Passing CDATA in data in SyncML to ConfigManager and CSPs does not work in Windo The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10. In Windows Phone 8.1, when you set the client certificate to "Accept," it works fine. -![ssl settings](images/ssl-settings.png) +![ssl settings.](images/ssl-settings.png) ### MDM enrollment fails on the mobile device when traffic is going through proxy @@ -439,7 +439,7 @@ Alternatively you can use the following procedure to create an EAP Configuration 1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) article. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) - ![vpn selfhost properties window](images/certfiltering1.png) + ![vpn selfhost properties window.](images/certfiltering1.png) > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. @@ -447,10 +447,10 @@ Alternatively you can use the following procedure to create an EAP Configuration 3. Click the **Properties** button underneath the drop down menu. 4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - ![smart card or other certificate properties window](images/certfiltering2.png) + ![smart card or other certificate properties window.](images/certfiltering2.png) 5. In the **Configure Certificate Selection** menu, adjust the filters as needed. - ![configure certificate selection window](images/certfiltering3.png) + ![configure certificate selection window.](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. 8. Continue following the procedure in the [EAP configuration](eap-configuration.md) article from Step 9 to get an EAP TLS profile with appropriate filtering. @@ -492,7 +492,7 @@ No. Only one MDM is allowed. 4. Click **Configure**. 5. Set quota to unlimited. - ![aad maximum joined devices](images/faq-max-devices.png) + ![aad maximum joined devices.](images/faq-max-devices.png) ### **What is dmwappushsvc?** diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index c73d5fdc8d..84ff8f5e34 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -23,13 +23,13 @@ The PassportForWork configuration service provider is used to provision Windows The following diagram shows the PassportForWork configuration service provider in tree format. -![passportforwork csp](images/provisioning-csp-passportforwork.png) +![passportforwork csp.](images/provisioning-csp-passportforwork.png) ### Device configuration diagram The following diagram shows the PassportForWork configuration service provider in tree format. -![passportforwork diagram](images/provisioning-csp-passportforwork2.png) +![passportforwork diagram.](images/provisioning-csp-passportforwork2.png) **PassportForWork** Root node for PassportForWork configuration service provider. diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index ddeb61f84a..da0f0543dc 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -44,7 +44,7 @@ The Policy configuration service provider has the following sub-categories: The following diagram shows the Policy configuration service provider in tree format as used by both Open Mobile Alliance Device Management (OMA DM) and OMA Client Provisioning. -![policy csp diagram](images/provisioning-csp-policy.png) +![policy csp diagram.](images/provisioning-csp-policy.png) **./Vendor/MSFT/Policy** diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 9d7aa06011..013edacaec 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -549,7 +549,7 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and ``` You can also change the evaluation order of device installation policy settings by using a custom profile in Intune. -:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image"::: +:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image."::: @@ -743,7 +743,7 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i You can also block installation by using a custom profile in Intune. -![Custom profile prevent devices](images/custom-profile-prevent-other-devices.png) +![Custom profile prevent devices.](images/custom-profile-prevent-other-devices.png) @@ -863,7 +863,7 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile blocks installation and usage of USB devices with hardware IDs "USB\Composite" and "USB\Class_FF", and applies to USB devices with matching hardware IDs that are already installed. -![Custom profile prevent device ids](images/custom-profile-prevent-device-ids.png) +![Custom profile prevent device ids.](images/custom-profile-prevent-device-ids.png) @@ -977,7 +977,7 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile prevents installation of devices with matching device instance IDs. -![Custom profile](images/custom-profile-prevent-device-instance-ids.png) +![Custom profile.](images/custom-profile-prevent-device-instance-ids.png) To prevent installation of devices with matching device instance IDs by using custom profile in Intune: 1. Locate the device instance ID. diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index a0a34ee244..92df20eba2 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -52,34 +52,34 @@ To get a PFN and WNS credentials, you must create an Microsoft Store app. 1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. - ![mdm push notification1](images/push-notification1.png) + ![mdm push notification1.](images/push-notification1.png) 2. Create a new app. - ![mdm push notification2](images/push-notification2.png) + ![mdm push notification2.](images/push-notification2.png) 3. Reserve an app name. - ![mdm push notification3](images/push-notification3.png) + ![mdm push notification3.](images/push-notification3.png) 4. Click **Services**. - ![mdm push notification4](images/push-notification4.png) + ![mdm push notification4.](images/push-notification4.png) 5. Click **Push notifications**. - ![mdm push notification5](images/push-notification5.png) + ![mdm push notification5.](images/push-notification5.png) 6. Click **Live Services site**. A new window opens for the **Application Registration Portal** page. - ![mdm push notification6](images/push-notification6.png) + ![mdm push notification6.](images/push-notification6.png) 7. In the **Application Registration Portal** page, you will see the properties for the app that you created, such as: - Application Id - Application Secrets - Microsoft Store Package SID, Application Identity, and Publisher. - ![mdm push notification7](images/push-notification7.png) + ![mdm push notification7.](images/push-notification7.png) 8. Click **Save**. 9. Close the **Application Registration Portal** window and go back to the Windows Dev Center Dashboard. 10. Select your app from the list on the left. 11. From the left nav, expand **App management** and then click **App identity**. - ![mdm push notification10](images/push-notification10.png) + ![mdm push notification10.](images/push-notification10.png) 12. In the **App identity** page, you will see the **Package Family Name (PFN)** of your app.   diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 48baff3fe8..e2d40a822a 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -23,11 +23,11 @@ The PXLOGICAL configuration service provider is used to add, remove, or modify W The following diagram shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for initial bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. -![pxlogical csp (cp) (initial bootstrapping)](images/provisioning-csp-pxlogical-cp.png) +![pxlogical csp (cp) (initial bootstrapping).](images/provisioning-csp-pxlogical-cp.png) The following diagram shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for updating the bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. -![pxlogical csp (cp) (update bootstrapping)](images/provisioning-csp-pxlogical-cp-2.png) +![pxlogical csp (cp) (update bootstrapping).](images/provisioning-csp-pxlogical-cp-2.png) **PXPHYSICAL** Defines a group of logical proxy settings. diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index be9c8a5339..28e198aa1f 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -23,15 +23,15 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread](images/azure-ad-add-tenant10.png) + ![register azuread.](images/azure-ad-add-tenant10.png) 2. On the **Home** page, click on the Admin tools icon. - ![register azuread](images/azure-ad-add-tenant11.png) + ![register azuread.](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. - ![Azure-AD-updated](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) + ![Azure-AD-updated.](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 9e203d4d39..4ffdbad557 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -25,7 +25,7 @@ For the SecurityPolicy CSP, you cannot use the Replace command unless the node a The following diagram shows the SecurityPolicy configuration service provider management object in tree format as used by both OMA DM and OMA Client Provisioning. -![securitypolicy csp (dm,cp)](images/provisioning-csp-securitypolicy-dmandcp.png) +![securitypolicy csp (dm,cp).](images/provisioning-csp-securitypolicy-dmandcp.png) ***PolicyID*** Defines the security policy identifier as a decimal value. diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 5b211a0f55..21f39c4389 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -56,11 +56,11 @@ Group Policy option button setting: The following diagram shows the main display for the Group Policy Editor. -![Group Policy editor](images/group-policy-editor.png) +![Group Policy editor.](images/group-policy-editor.png) The following diagram shows the settings for the "Publishing Server 2 Settings" Group Policy in the Group Policy Editor. -![Group Policy publisher server 2 settings](images/group-policy-publisher-server-2-settings.png) +![Group Policy publisher server 2 settings.](images/group-policy-publisher-server-2-settings.png) Note that most Group Policies are a simple Boolean type. For a Boolean Group Policy, if you select **Enabled**, the options panel contains no data input fields and the payload of the SyncML is simply ``. However, if there are data input fields in the options panel, the MDM server must supply this data. The following *Enabling a Group Policy* example illustrates this complexity. In this example, 10 name-value pairs are described by `` tags in the payload, which correspond to the 10 data input fields in the Group Policy Editor options panel for the "Publishing Server 2 Settings" Group Policy. The ADMX file, which defines the Group Policies, is consumed by the MDM server, similarly to how the Group Policy Editor consumes it. The Group Policy Editor displays a UI to receive the complete Group Policy instance data, which the MDM server's IT administrator console must also do. For every `` element and id attribute in the ADMX policy definition, there must be a corresponding `` element and id attribute in the payload. The ADMX file drives the policy definition and is required by the MDM server via the SyncML protocol. diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index 7916778bec..00d2b86cd5 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -119,7 +119,7 @@ Currently SwapfileSize should not be relied for determining or controlling the o **CurrentSession/MaximumOverlaySize** or **NextSession/MaximumOverlaySize** should be used for that purpose. -:::image type="content" source="images/overlaysetting.png" alt-text="This is the overlay setting"::: +:::image type="content" source="images/overlaysetting.png" alt-text="This is the overlay setting."::: > [!NOTE] > Only single swapfile is supported in current implementation and creating swapfile on specific volume will disable any other swapfile created on other volumes. diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 3f6badf192..42a6882673 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -33,7 +33,7 @@ Important considerations: The following diagram shows the VPN configuration service provider in tree format. -![provisioning\-csp\-vpnimg](images/provisioning-csp-vpn.png) +![provisioning\-csp\-vpnimg.](images/provisioning-csp-vpn.png) ***ProfileName*** Unique alpha numeric Identifier for the profile. The profile name must not include a forward slash (/). diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index d6b9110b32..e7321b1888 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -25,7 +25,7 @@ The default security roles are defined in the root characteristic, and map to ea The following diagram shows the configuration service provider in tree format as used by OMA Client Provisioning. -![w4 application csp (cp)](images/provisioning-csp-w4-application-cp.png) +![w4 application csp (cp).](images/provisioning-csp-w4-application-cp.png) **APPID** Required. This parameter takes a string value. The only supported value for configuring MMS is "w4". diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 20f21f79bc..7aaa801796 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -23,7 +23,7 @@ The APPLICATION configuration service provider that has an APPID of w7 is used f The following image shows the configuration service provider in tree format as used by OMA Client Provisioning. -![w7 application csp (dm)](images/provisioning-csp-w7-application-dm.png) +![w7 application csp (dm).](images/provisioning-csp-w7-application-dm.png) > **Note**   All parm names and characteristic types are case sensitive and must use all uppercase. Both APPSRV and CLIENT credentials must be provided in provisioning XML. diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 125bbfb687..e867ae66ef 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -31,7 +31,7 @@ Programming considerations: The following image shows the WiFi configuration service provider in tree format. -![wi-fi csp diagram](images/provisioning-csp-wifi.png) +![wi-fi csp diagram.](images/provisioning-csp-wifi.png) The following list shows the characteristics and parameters. diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index a8be6bba9c..e5e7511669 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -25,7 +25,7 @@ The DM client is configured during the enrollment process to be invoked by the t The following diagram shows the work flow between server and client. -![windows client and server mdm diagram](images/enterprise-workflow.png) +![windows client and server mdm diagram.](images/enterprise-workflow.png) ## Management workflow diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index c68424cd04..fc13fd3034 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -19,7 +19,7 @@ The Windows Defender Advanced Threat Protection (WDATP) configuration service pr The following diagram shows the WDATP configuration service provider in tree format as used by the Open Mobile Alliance (OMA) Device Management (DM). -![windowsadvancedthreatprotection csp diagram](images/provisioning-csp-watp.png) +![windowsadvancedthreatprotection csp diagram.](images/provisioning-csp-watp.png) The following list describes the characteristics and parameters. diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 2f3cdf7fc7..2fe71b5e76 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -213,16 +213,16 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw | Class | Test completed in Windows 10 for desktop | |--------------------------------------------------------------------------|------------------------------------------| -| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | | [**wpcRatingsDescriptor**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | | -| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | @@ -232,17 +232,17 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw |--------------------------------------------------------------------------|------------------------------------------| [**Win32\_1394Controller**](/windows/win32/cimwin32prov/win32-1394controller) | [**Win32\_BaseBoard**](/windows/win32/cimwin32prov/win32-baseboard) | -[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | ![cross mark](images/checkmark.png) -[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | ![cross mark](images/checkmark.png) +[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | ![cross mark.](images/checkmark.png) +[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | ![cross mark.](images/checkmark.png) [**Win32\_CDROMDrive**](/windows/win32/cimwin32prov/win32-cdromdrive) | -[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | ![cross mark](images/checkmark.png) -[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | ![cross mark](images/checkmark.png) -[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | ![cross mark](images/checkmark.png) +[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | ![cross mark.](images/checkmark.png) +[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | ![cross mark.](images/checkmark.png) +[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | ![cross mark.](images/checkmark.png) [**Win32\_Desktop**](/windows/win32/cimwin32prov/win32-desktop) | -[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |![cross mark](images/checkmark.png) -[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | ![cross mark](images/checkmark.png) +[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |![cross mark.](images/checkmark.png) +[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | ![cross mark.](images/checkmark.png) [**Win32\_DiskPartition**](/windows/win32/cimwin32prov/win32-diskpartition) | -[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | ![cross mark](images/checkmark.png) +[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | ![cross mark.](images/checkmark.png) [**Win32\_DMAChannel**](/windows/win32/cimwin32prov/win32-dmachannel) | [**Win32\_DriverVXD**](/previous-versions//aa394141(v=vs.85)) | [**Win32\_EncryptableVolume**](/windows/win32/secprov/win32-encryptablevolume) | @@ -252,23 +252,23 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_IRQResource**](/windows/win32/cimwin32prov/win32-irqresource) | [**Win32\_Keyboard**](/windows/win32/cimwin32prov/win32-keyboard) | [**Win32\_LoadOrderGroup**](/windows/win32/cimwin32prov/win32-loadordergroup) | -[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | ![cross mark](images/checkmark.png) +[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | ![cross mark.](images/checkmark.png) [**Win32\_LoggedOnUser**](/windows/win32/cimwin32prov/win32-loggedonuser) | -[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | ![cross mark](images/checkmark.png) +[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | ![cross mark.](images/checkmark.png) [**Win32\_MotherboardDevice**](/windows/win32/cimwin32prov/win32-motherboarddevice) | -[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | ![cross mark](images/checkmark.png) +[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | ![cross mark.](images/checkmark.png) [**Win32\_NetworkAdapterConfiguration**](/windows/win32/cimwin32prov/win32-networkadapterconfiguration) | [**Win32\_NetworkClient**](/windows/win32/cimwin32prov/win32-networkclient) | [**Win32\_NetworkLoginProfile**](/windows/win32/cimwin32prov/win32-networkloginprofile) | [**Win32\_NetworkProtocol**](/windows/win32/cimwin32prov/win32-networkprotocol) | [**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) | -[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | ![cross mark](images/checkmark.png) +[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | ![cross mark.](images/checkmark.png) [**Win32\_OSRecoveryConfiguration**](/windows/win32/cimwin32prov/win32-osrecoveryconfiguration) | [**Win32\_PageFileSetting**](/windows/win32/cimwin32prov/win32-pagefilesetting) | [**Win32\_ParallelPort**](/windows/win32/cimwin32prov/win32-parallelport) | [**Win32\_PCMCIAController**](/windows/win32/cimwin32prov/win32-pcmciacontroller) | [**Win32\_PhysicalMedia**](/previous-versions/windows/desktop/cimwin32a/win32-physicalmedia) | -[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | ![cross mark](images/checkmark.png) +[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | ![cross mark.](images/checkmark.png) [**Win32\_PnPDevice**](/windows/win32/cimwin32prov/win32-pnpdevice) | [**Win32\_PnPEntity**](/windows/win32/cimwin32prov/win32-pnpentity) | [**Win32\_PointingDevice**](/windows/win32/cimwin32prov/win32-pointingdevice) | @@ -277,25 +277,25 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_POTSModem**](/windows/win32/cimwin32prov/win32-potsmodem) | [**Win32\_Printer**](/windows/win32/cimwin32prov/win32-printer) | [**Win32\_PrinterConfiguration**](/windows/win32/cimwin32prov/win32-printerconfiguration) | -[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | ![cross mark](images/checkmark.png) -[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | ![cross mark](images/checkmark.png) +[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | ![cross mark.](images/checkmark.png) +[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | ![cross mark.](images/checkmark.png) [**Win32\_Registry**](/windows/win32/cimwin32prov/win32-registry) | [**Win32\_SCSIController**](/windows/win32/cimwin32prov/win32-scsicontroller) | [**Win32\_SerialPort**](/windows/win32/cimwin32prov/win32-serialport) | [**Win32\_SerialPortConfiguration**](/windows/win32/cimwin32prov/win32-serialportconfiguration) | [**Win32\_ServerFeature**](/windows/win32/wmisdk/win32-serverfeature) | -[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | ![cross mark](images/checkmark.png) -[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | ![cross mark](images/checkmark.png) +[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | ![cross mark.](images/checkmark.png) +[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | ![cross mark.](images/checkmark.png) [**Win32\_SoundDevice**](/windows/win32/cimwin32prov/win32-sounddevice) | [**Win32\_SystemAccount**](/windows/win32/cimwin32prov/win32-systemaccount) | -[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | ![cross mark](images/checkmark.png) +[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | ![cross mark.](images/checkmark.png) [**Win32\_SystemDriver**](/windows/win32/cimwin32prov/win32-systemdriver) | -[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | ![cross mark](images/checkmark.png) +[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | ![cross mark.](images/checkmark.png) [**Win32\_TapeDrive**](/windows/win32/cimwin32prov/win32-tapedrive) | -[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | ![cross mark](images/checkmark.png) +[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | ![cross mark.](images/checkmark.png) [**Win32\_UninterruptiblePowerSupply**](/previous-versions//aa394503(v=vs.85)) | [**Win32\_USBController**](/windows/win32/cimwin32prov/win32-usbcontroller) | -[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | ![cross mark](images/checkmark.png) +[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | ![cross mark.](images/checkmark.png) [**Win32\_VideoController**](/windows/win32/cimwin32prov/win32-videocontroller) | **Win32\_WindowsUpdateAgentVersion** | diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md index 6a50151342..acdcd2d268 100644 --- a/windows/client-management/quick-assist.md +++ b/windows/client-management/quick-assist.md @@ -57,7 +57,7 @@ Both the helper and sharer must be able to reach these endpoints over port 443: 7. RDP shares the video to the helper over https (port 443) through the RDP relay service to the helper's RDP control. Input is shared from the helper to the sharer through the RDP relay service. -:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established"::: +:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established."::: ### Data and privacy diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index e0afd3d480..490b24075a 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -119,7 +119,7 @@ To verify the BCD entries: > [!NOTE] > If the computer is UEFI-based, the file path value that's specified in the **path** parameter of **{bootmgr}** and **{default}** contains an **.efi** extension. - ![bcdedit](images/screenshot1.png) + ![bcdedit.](images/screenshot1.png) If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that's named **bcdbackup**. To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup**. @@ -179,11 +179,11 @@ Dism /Image:: /Get-packages After you run this command, you'll see the **Install pending** and **Uninstall Pending** packages: -![Dism output pending update](images/pendingupdate.png) +![Dism output pending update.](images/pendingupdate.png) 1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. - ![Dism output revert pending](images/revertpending.png) + ![Dism output revert pending.](images/revertpending.png) 2. Navigate to ***OSdriveLetter*:\Windows\WinSxS**, and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. @@ -193,14 +193,14 @@ After you run this command, you'll see the **Install pending** and **Uninstall P 5. Navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **COMPONENT** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineComponentHive** for the new hive. - ![Load Hive](images/loadhive.png) + ![Load Hive.](images/loadhive.png) 6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. 7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. > [!div class="mx-imgBorder"] - > ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) + > ![Unload Hive.](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) 8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **SYSTEM** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineSystemHive** for the new hive. @@ -256,7 +256,7 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the \Control\Class\\{71A27CDD-812A-11D0-BEC7-08002BE2092F} > [!div class="mx-imgBorder"] - > ![Registry](images/controlset.png) + > ![Registry.](images/controlset.png) If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it's not a Windows default filter driver, such as PartMgr), remove the entry. To remove it, double-click it in the right pane, and then delete only that value. @@ -274,8 +274,8 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the * `chkdsk /f /r OsDrive:` - ![Check disk](images/check-disk.png) + ![Check disk.](images/check-disk.png) * `sfc /scannow /offbootdir=OsDrive:\ /offwindir=OsDrive:\Windows` - ![SFC scannow](images/sfc-scannow.png) + ![SFC scannow.](images/sfc-scannow.png) diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 454101462a..390add3169 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -165,13 +165,13 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below. - ![WinDbg img](images/windbg.png) + ![WinDbg img.](images/windbg.png) 7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page. 8. A detailed bugcheck analysis will appear. See the example below. - ![Bugcheck analysis](images/bugcheck-analysis.png) + ![Bugcheck analysis.](images/bugcheck-analysis.png) 9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL. diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md index 77e524634d..10ae554304 100644 --- a/windows/client-management/troubleshoot-tcpip-connectivity.md +++ b/windows/client-management/troubleshoot-tcpip-connectivity.md @@ -44,17 +44,17 @@ If the initial TCP handshake is failing because of packet drops, then you would Source side connecting on port 445: -![Screenshot of frame summary in Network Monitor](images/tcp-ts-6.png) +![Screenshot of frame summary in Network Monitor.](images/tcp-ts-6.png) Destination side: applying the same filter, you do not see any packets. -![Screenshot of frame summary with filter in Network Monitor](images/tcp-ts-7.png) +![Screenshot of frame summary with filter in Network Monitor.](images/tcp-ts-7.png) For the rest of the data, TCP will retransmit the packets five times. **Source 192.168.1.62 side trace:** -![Screenshot showing packet side trace](images/tcp-ts-8.png) +![Screenshot showing packet side trace.](images/tcp-ts-8.png) **Destination 192.168.1.2 side trace:** @@ -79,15 +79,15 @@ In the below screenshots, you see that the packets seen on the source and the de **Source Side** -![Screenshot of packets on source side in Network Monitor](images/tcp-ts-9.png) +![Screenshot of packets on source side in Network Monitor.](images/tcp-ts-9.png) **On the destination-side trace** -![Screenshot of packets on destination side in Network Monitor](images/tcp-ts-10.png) +![Screenshot of packets on destination side in Network Monitor.](images/tcp-ts-10.png) You also see an ACK+RST flag packet in a case when the TCP establishment packet SYN is sent out. The TCP SYN packet is sent when the client wants to connect on a particular port, but if the destination/server for some reason does not want to accept the packet, it would send an ACK+RST packet. -![Screenshot of packet flag](images/tcp-ts-11.png) +![Screenshot of packet flag.](images/tcp-ts-11.png) The application that's causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. @@ -110,8 +110,8 @@ auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /fai You can then review the Security event logs to see for a packet drop on a particular port-IP and a filter ID associated with it. -![Screenshot of Event Properties](images/tcp-ts-12.png) +![Screenshot of Event Properties.](images/tcp-ts-12.png) Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. After you open this file and filter for the ID that you find in the above event (2944008), you'll be able to see a firewall rule name that's associated with this ID that's blocking the connection. -![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) +![Screenshot of wfpstate.xml file.](images/tcp-ts-13.png) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index b432191920..daa23de8b1 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -21,7 +21,7 @@ In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image: -![Adapters](images/nm-adapters.png) +![Adapters.](images/nm-adapters.png) When the driver gets hooked to the network interface card (NIC) during installation, the NIC is reinitialized, which might cause a brief network glitch. @@ -29,15 +29,15 @@ When the driver gets hooked to the network interface card (NIC) during installat 1. Run netmon in an elevated status by choosing Run as Administrator. - ![Image of Start search results for Netmon](images/nm-start.png) + ![Image of Start search results for Netmon.](images/nm-start.png) 2. Network Monitor opens with all network adapters displayed. Select the network adapters where you want to capture traffic, click **New Capture**, and then click **Start**. - ![Image of the New Capture option on menu](images/tcp-ts-4.png) + ![Image of the New Capture option on menu.](images/tcp-ts-4.png) 3. Reproduce the issue, and you will see that Network Monitor grabs the packets on the wire. - ![Frame summary of network packets](images/tcp-ts-5.png) + ![Frame summary of network packets.](images/tcp-ts-5.png) 4. Select **Stop**, and go to **File > Save as** to save the results. By default, the file will be saved as a ".cap" file. diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index ca8551b1dd..4c1e8b1b7f 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -58,19 +58,19 @@ Since outbound connections start to fail, you will see a lot of the below behavi - Unable to sign in to the machine with domain credentials, however sign-in with local account works. Domain sign-in will require you to contact the DC for authentication which is again an outbound connection. If you have cache credentials set, then domain sign-in might still work. - ![Screenshot of error for NETLOGON in Event Viewer](images/tcp-ts-14.png) + ![Screenshot of error for NETLOGON in Event Viewer.](images/tcp-ts-14.png) - Group Policy update failures: - ![Screenshot of event properties for Group Policy failure](images/tcp-ts-15.png) + ![Screenshot of event properties for Group Policy failure.](images/tcp-ts-15.png) - File shares are inaccessible: - ![Screenshot of error message "Windows cannot access"](images/tcp-ts-16.png) + ![Screenshot of error message "Windows cannot access."](images/tcp-ts-16.png) - RDP from the affected server fails: - ![Screenshot of error when Remote Desktop is unable to connect](images/tcp-ts-17.png) + ![Screenshot of error when Remote Desktop is unable to connect.](images/tcp-ts-17.png) - Any other application running on the machine will start to give out errors @@ -84,15 +84,15 @@ If you suspect that the machine is in a state of port exhaustion: a. **Event ID 4227** - ![Screenshot of event id 4227 in Event Viewer](images/tcp-ts-18.png) + ![Screenshot of event id 4227 in Event Viewer.](images/tcp-ts-18.png) b. **Event ID 4231** - ![Screenshot of event id 4231 in Event Viewer](images/tcp-ts-19.png) + ![Screenshot of event id 4231 in Event Viewer.](images/tcp-ts-19.png) 3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. - ![Screenshot of netstate command output](images/tcp-ts-20.png) + ![Screenshot of netstate command output.](images/tcp-ts-20.png) After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state. @@ -136,7 +136,7 @@ If method 1 does not help you identify the process (prior to Windows 10 and Wind 1. Add a column called “handles” under details/processes. 2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. - ![Screenshot of handles column in Windows Task Maner](images/tcp-ts-21.png) + ![Screenshot of handles column in Windows Task Maner.](images/tcp-ts-21.png) 3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. @@ -157,7 +157,7 @@ Steps to use Process explorer: File \Device\AFD - ![Screenshot of Process Explorer](images/tcp-ts-22.png) + ![Screenshot of Process Explorer.](images/tcp-ts-22.png) 10. Some are normal, but large numbers of them are not (hundreds to thousands). Close the process in question. If that restores outbound connectivity, then you have further proven that the app is the cause. Contact the vendor of that app. diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index 37b4dfa002..ba02501c81 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -16,7 +16,7 @@ manager: dansimp You might encounter an **RPC server unavailable** error when connecting to Windows Management Instrumentation (WMI), SQL Server, during a remote connection, or for some Microsoft Management Console (MMC) snap-ins. The following image is an example of an RPC error. -![The following error has occurred: the RPC server is unavailable](images/rpc-error.png) +![The following error has occurred: the RPC server is unavailable.](images/rpc-error.png) This is a commonly encountered error message in the networking world and one can lose hope very fast without trying to understand much, as to what is happening ‘under the hood’. @@ -37,7 +37,7 @@ Before getting in to troubleshooting the *RPC server unavailable- error Client A wants to execute some functions or wants to make use of a service running on the remote server, will first establish the connection with the Remote Server by doing a three-way handshake. -![Diagram illustrating connection to remote server](images/rpc-flow.png) +![Diagram illustrating connection to remote server.](images/rpc-flow.png) RPC ports can be given from a specific range as well. ### Configure RPC dynamic port allocation @@ -162,13 +162,13 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) - Now check if you are getting a response from the server. If you get a response, note the dynamic port number that you have been allocated to use. - ![Screenshot of Network Monitor with dynamic port highlighted](images/tcp-ts-23.png) + ![Screenshot of Network Monitor with dynamic port highlighted.](images/tcp-ts-23.png) - Check if we are connecting successfully to this Dynamic port successfully. - The filter should be something like this: `tcp.port==` and `ipv4.address==` - ![Screenshot of Network Monitor with filter applied](images/tcp-ts-24.png) + ![Screenshot of Network Monitor with filter applied.](images/tcp-ts-24.png) This should help you verify the connectivity and isolate if any network issues are seen. @@ -177,7 +177,7 @@ This should help you verify the connectivity and isolate if any network issues a The most common reason why we would see the RPC server unavailable is when the dynamic port that the client tries to connect is not reachable. The client side trace would then show TCP SYN retransmits for the dynamic port. -![Screenshot of Network Monitor with TCP SYN retransmits](images/tcp-ts-25.png) +![Screenshot of Network Monitor with TCP SYN retransmits.](images/tcp-ts-25.png) The port cannot be reachable due to one of the following reasons: diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/windows-version-search.md index 29a781be98..16c416a9cd 100644 --- a/windows/client-management/windows-version-search.md +++ b/windows/client-management/windows-version-search.md @@ -22,27 +22,27 @@ Click **Start** > **Settings** > **System** > click **About** from the bottom of You'll now see **Edition**, **Version**, and **OS Build** information. Something like this: -![screenshot of the system properties window for a device running Windows 10](images/systemcollage.png) +![screenshot of the system properties window for a device running Windows 10.](images/systemcollage.png) ## Using Keyword Search You can simply type the following in the search bar and press **ENTER** to see version details for your device. **“winver”** -![screenshot of the About Windows display text](images/winver.png) +![screenshot of the About Windows display text.](images/winver.png) **“msinfo”** or **"msinfo32"** to open **System Information**: -![screenshot of the System Information display text](images/msinfo32.png) +![screenshot of the System Information display text.](images/msinfo32.png) ## Using Command Prompt or PowerShell At the Command Prompt or PowerShell interface, type **"systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"** and then press **ENTER** -![screenshot of system information display text](images/refcmd.png) +![screenshot of system information display text.](images/refcmd.png) At the Command Prompt or PowerShell, type **"slmgr /dlv"**, and then press ENTER. The /dlv command displays the detailed licensing information. Notice the output displays "EnterpriseS" as seen in the image below: -![screenshot of software licensing manager](images/slmgr_dlv.png) +![screenshot of software licensing manager.](images/slmgr_dlv.png) ## What does it all mean? diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 15407ebc50..5f433844ac 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -31,7 +31,7 @@ The order of apps in the XML file dictates the order of pinned apps on the taskb The following example shows how apps will be pinned: Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using the XML file to the right (green square). -![Windows left, user center, enterprise to the right](images/taskbar-generic.png) +![Windows left, user center, enterprise to the right.](images/taskbar-generic.png) ## Configure taskbar (general) @@ -142,11 +142,11 @@ The `` section will append listed apps to the tas ``` **Before:** -![default apps pinned to taskbar](images/taskbar-default.png) +![default apps pinned to taskbar.](images/taskbar-default.png) **After:** - ![additional apps pinned to taskbar](images/taskbar-default-plus.png) + ![additional apps pinned to taskbar.](images/taskbar-default-plus.png) ## Remove default apps and add your own @@ -175,11 +175,11 @@ If you only want to remove some of the default pinned apps, you would use this m ``` **Before:** -![Taskbar with default apps](images/taskbar-default.png) +![Taskbar with default apps.](images/taskbar-default.png) **After:** -![Taskbar with default apps removed](images/taskbar-default-removed.png) +![Taskbar with default apps removed.](images/taskbar-default-removed.png) ## Remove default apps @@ -250,15 +250,15 @@ The following example shows you how to configure taskbars by country or region. When the preceding example XML file is applied, the resulting taskbar for computers in the US or UK: -![taskbar for US and UK locale](images/taskbar-region-usuk.png) +![taskbar for US and UK locale.](images/taskbar-region-usuk.png) The resulting taskbar for computers in Germany or France: -![taskbar for DE and FR locale](images/taskbar-region-defr.png) +![taskbar for DE and FR locale.](images/taskbar-region-defr.png) The resulting taskbar for computers in any other country region: -![taskbar for all other regions](images/taskbar-region-other.png) +![taskbar for all other regions.](images/taskbar-region-other.png) > [!NOTE] diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index e8a0cdee55..1190119050 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -19,7 +19,7 @@ Cortana integration is a Preview feature that's available for your test or dev e >[!NOTE] >For more info about Dynamics CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](https://go.microsoft.com/fwlink/p/?LinkId=746819). -![Cortana at work, showing the sales data pulled from Dynamics CRM](../images/cortana-crm-screen.png) +![Cortana at work, showing the sales data pulled from Dynamics CRM.](../images/cortana-crm-screen.png) ## Turn on Cortana with Dynamics CRM in your organization You must be a CRM administrator to turn on and use Preview features. For more info about what Preview features are and how to use them, see [What are Preview features and how do I enable them](https://go.microsoft.com/fwlink/p/?LinkId=746817)? @@ -43,7 +43,7 @@ You must tell your employees to turn on Cortana, before they’ll be able to use 2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. - ![Cotana at work, showing how to turn on the connected services for Dynamics CRM](../images/cortana-connect-crm.png) + ![Cotana at work, showing how to turn on the connected services for Dynamics CRM.](../images/cortana-connect-crm.png) The employee can also disconnect by clicking **Disconnect** from the **Dynamics CRM** screen. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 65919eb8e8..481cb27659 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -48,35 +48,35 @@ Before you can start this testing scenario, you must first set up your test envi 2. Expand the left rail by clicking the **Show the navigation pane** icon. - ![Cortana at work, showing the navigation expand icon in Power BI](../images/cortana-powerbi-expand-nav.png) + ![Cortana at work, showing the navigation expand icon in Power BI.](../images/cortana-powerbi-expand-nav.png) 3. Click **Get Data** from the left-hand navigation in Power BI. - ![Cortana at work, showing the Get Data link](../images/cortana-powerbi-getdata.png) + ![Cortana at work, showing the Get Data link.](../images/cortana-powerbi-getdata.png) 4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. - ![Cortana at work, showing the Samples link](../images/cortana-powerbi-getdata-samples.png) + ![Cortana at work, showing the Samples link.](../images/cortana-powerbi-getdata-samples.png) 5. Click **Retail Analysis Sample**, and then click **Connect**. - ![Cortana at work, showing the Samples link](../images/cortana-powerbi-retail-analysis-sample.png) + ![Cortana at work, showing the Samples link.](../images/cortana-powerbi-retail-analysis-sample.png) The sample data is imported and you’re returned to the **Power BI** screen. 6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. - ![Cortana at work, showing a dashboard view of the sample data](../images/cortana-powerbi-retail-analysis-dashboard.png) + ![Cortana at work, showing a dashboard view of the sample data.](../images/cortana-powerbi-retail-analysis-dashboard.png) 7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. - ![Cortana at work, showing where to find the Settings option](../images/cortana-powerbi-settings.png) + ![Cortana at work, showing where to find the Settings option.](../images/cortana-powerbi-settings.png) 8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. 9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. - ![Cortana at work, showing where to find the dataset options](../images/cortana-powerbi-retail-analysis-dataset.png) + ![Cortana at work, showing where to find the dataset options.](../images/cortana-powerbi-retail-analysis-dataset.png) >[!NOTE] >It can take up to 30 minutes for a new dataset to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately.

If you enable a dataset for Cortana, and that dataset is part of a content pack you own, you’ll need to re-publish for your colleagues to also use it with Cortana. @@ -92,7 +92,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu **To create a custom sales data Answer Page for Cortana** 1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. - ![Cortana at work, showing where to create the new report](../images/cortana-powerbi-create-report.png) + ![Cortana at work, showing where to create the new report.](../images/cortana-powerbi-create-report.png) 2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. @@ -100,11 +100,11 @@ After you’ve finished creating your Answer Page, you can continue to the inclu 3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. - ![Cortana at work, showing the Visualizations options](../images/cortana-powerbi-pagesize.png) + ![Cortana at work, showing the Visualizations options.](../images/cortana-powerbi-pagesize.png) 4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. - ![Cortana at work, showing the Field options](../images/cortana-powerbi-field-selection.png) + ![Cortana at work, showing the Field options.](../images/cortana-powerbi-field-selection.png) The automatically generated graph is added to your blank report. You have the option to change colors, add borders, add additional visualizations, and modify this page so that it answers the question about sales data as precisely, and in as custom a way, as you want. You just need to make sure that it all stays within the page borders. @@ -112,7 +112,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu The alternate names help Cortana to know what questions to look for and when to show this report. To also improve your results, you should avoid using the names of your report columns. - ![Cortana at work, showing the page info for your specific report](../images/cortana-powerbi-report-qna.png) + ![Cortana at work, showing the page info for your specific report.](../images/cortana-powerbi-report-qna.png) 6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. @@ -128,13 +128,13 @@ Now that you’ve set up your device, you can use Cortana to show your info from Cortana shows you the available results. - ![Cortana at work, showing the best matches based on the Power BI data](../images/cortana-powerbi-search.png) + ![Cortana at work, showing the best matches based on the Power BI data.](../images/cortana-powerbi-search.png) 3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. Cortana returns your custom report. - ![Cortana at work, showing your custom report from Power BI](../images/cortana-powerbi-myreport.png) + ![Cortana at work, showing your custom report from Power BI.](../images/cortana-powerbi-myreport.png) >[!NOTE] >For more info about how to connect your own data, build your own custom Power BI cards and Answer Pages for Cortana, and how to share the cards with everyone in your organization, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/documentation/powerbi-service-cortana-desktop-entity-cards/). diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index 478aeb7938..c701623a88 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -49,7 +49,7 @@ While these aren't line-of-business apps, we've worked to make sure to implement 2. Click on **Connected Services**, click **Uber**, and then click **Connect**. - ![Cortana at work, showing where to connect the Uber service to Cortana](../images/cortana-connect-uber.png) + ![Cortana at work, showing where to connect the Uber service to Cortana.](../images/cortana-connect-uber.png) **To use the voice-enabled commands with Cortana** 1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index 601ad70810..f50e213ce8 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -161,7 +161,7 @@ When you have the Start layout that you want your users to see, use the [Export- A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users cannot change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. -![locked tile group](images/start-pinned-app.png) +![locked tile group.](images/start-pinned-app.png) When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 12f62c8444..7b7dcaed64 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -92,13 +92,13 @@ This procedure adds the customized Start and taskbar layout to the user configur 2. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. - ![start screen layout policy settings](images/starttemplate.jpg) + ![start screen layout policy settings.](images/starttemplate.jpg) 3. Right-click **Start Layout** in the right pane, and click **Edit**. This opens the **Start Layout** policy settings. - ![policy settings for start screen layout](images/startlayoutpolicy.jpg) + ![policy settings for start screen layout.](images/startlayoutpolicy.jpg) 4. Enter the following settings, and then click **OK**: diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index ea856b24cd..42b70e6248 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -87,7 +87,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) + ![Customizations file with the placeholder text to replace highlighted.](images/customization-start.png) 7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md index aa195fb89f..f5540c6ddd 100644 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md @@ -50,7 +50,7 @@ To get the names and AUMIDs for all apps installed for the current user, perform 3. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to change the **View** setting from **Tiles** to **Details**.) -![Image of the Choose Details options](images/aumid-file-explorer.png) +![Image of the Choose Details options.](images/aumid-file-explorer.png) ## To find the AUMID of an installed app for the current user by using the registry diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md index bd502511d7..9efa2b652d 100644 --- a/windows/configuration/kiosk-methods.md +++ b/windows/configuration/kiosk-methods.md @@ -24,13 +24,13 @@ Some desktop devices in an enterprise serve a special purpose, such as a PC in t A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk does not run above the lockscreen. - ![Illustration of a full-screen kiosk experience](images/kiosk-fullscreen.png) + ![Illustration of a full-screen kiosk experience.](images/kiosk-fullscreen.png) - **A multi-app kiosk**, which runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device. - ![Illustration of a kiosk Start screen](images/kiosk-desktop.png) + ![Illustration of a kiosk Start screen.](images/kiosk-desktop.png) Kiosk configurations are based on **Assigned Access**, a feature in Windows 10 that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. @@ -38,25 +38,25 @@ There are several kiosk configuration methods that you can choose from, dependin - **Which type of app will your kiosk run?** - ![icon that represents apps](images/office-logo.png) + ![icon that represents apps.](images/office-logo.png) Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](setup-digital-signage.md), simply select a digital sign player as your kiosk app. [Check out the guidelines for kiosk apps.](guidelines-for-assigned-access-app.md) - **Which type of kiosk do you need?** - ![icon that represents a kiosk](images/kiosk.png) + ![icon that represents a kiosk.](images/kiosk.png) If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a [Universal Windows Platform (UWP) app](#uwp) or a [Windows desktop application](#classic). For a kiosk that people can sign in to with their accounts or that runs more than one app, choose [a multi-app kiosk](#desktop). - **Which edition of Windows 10 will the kiosk run?** - ![icon that represents Windows](images/windows.png) + ![icon that represents Windows.](images/windows.png) All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home. - **Which type of user account will be the kiosk account?** - ![icon that represents a user account](images/user.png) + ![icon that represents a user account.](images/user.png) The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index 154b35c3d0..ba1aaa2b58 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -54,7 +54,7 @@ Disable removable media. | Go to **Group Policy Editor** > **Computer Con Logs can help you [troubleshoot issues](./kiosk-troubleshoot.md) kiosk issues. Logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. -![Event Viewer, right-click Operational, select enable log](images/enable-assigned-access-log.png) +![Event Viewer, right-click Operational, select enable log.](images/enable-assigned-access-log.png) ## Automatic logon @@ -257,7 +257,7 @@ A single-app kiosk configuration runs an app above the lock screen. It doesn't w When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** is not selected in the **View** menu; that means it's a basic session. -![VM windows, View menu, Extended session is not selected](images/vm-kiosk.png) +![VM windows, View menu, Extended session is not selected.](images/vm-kiosk.png) To connect to a VM in a basic session, do not select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog. diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index f510b637bd..73e724bd75 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -137,7 +137,7 @@ The OMA-URI path is `./Device/Vendor/MSFT/AssignedAccess/ShellLauncher`. For the value, you can select data type `String` and paste the desired configuration file content into the value box. If you wish to upload the xml instead of pasting the content, choose data type `String (XML file)`. -![Screenshot of custom OMA-URI settings](images/slv2-oma-uri.png) +![Screenshot of custom OMA-URI settings.](images/slv2-oma-uri.png) After you configure the profile containing the custom Shell Launcher setting, select **All Devices** or selected groups of devices to apply the profile to. Don't assign the profile to users or user groups. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index 8baee6a466..eac49be093 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -24,7 +24,7 @@ ms.topic: article A single-app kiosk uses the Assigned Access feature to run a single app above the lockscreen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. -![Illustration of a single-app kiosk experience](images/kiosk-fullscreen-sm.png) +![Illustration of a single-app kiosk experience.](images/kiosk-fullscreen-sm.png) >[!IMPORTANT] >[User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. @@ -66,7 +66,7 @@ When your kiosk is a local device that is not managed by Active Directory or Azu - If you do not want the kiosk account signed in automatically when the device restarts, you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account, go to **Settings** > **Accounts** > **Sign-in options**, and toggle the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device. -![Screenshot of automatic sign-in setting](images/auto-signin.png) +![Screenshot of automatic sign-in setting.](images/auto-signin.png) ### Instructions for Windows 10, version 1809 @@ -98,7 +98,7 @@ To remove assigned access, select the account tile on the **Set up a kiosk** pag When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows 10, version 1803 and earlier, you must select an existing local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) -![The Set up assigned access page in Settings](images/kiosk-settings.png) +![The Set up assigned access page in Settings.](images/kiosk-settings.png) **To set up assigned access in PC settings** @@ -131,7 +131,7 @@ To remove assigned access, choose **Turn off assigned access and sign out of the > >Account type: Local standard user -![PowerShell windows displaying Set-AssignedAccess cmdlet](images/set-assignedaccess.png) +![PowerShell windows displaying Set-AssignedAccess cmdlet.](images/set-assignedaccess.png) You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. @@ -191,7 +191,7 @@ Clear-AssignedAccess > >Account type: Local standard user, Active Directory -![Kiosk wizard option in Windows Configuration Designer](images/kiosk-wizard.png) +![Kiosk wizard option in Windows Configuration Designer.](images/kiosk-wizard.png) >[!IMPORTANT] diff --git a/windows/configuration/kiosk-troubleshoot.md b/windows/configuration/kiosk-troubleshoot.md index 75781737fb..e34bee8204 100644 --- a/windows/configuration/kiosk-troubleshoot.md +++ b/windows/configuration/kiosk-troubleshoot.md @@ -53,7 +53,7 @@ For example: 3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. 4. Additional logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. -![Event Viewer, right-click Operational, select enable log](images/enable-assigned-access-log.png) +![Event Viewer, right-click Operational, select enable log.](images/enable-assigned-access-log.png) ### Automatic logon issues diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index c2221b549a..5c2cfa795b 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -34,7 +34,7 @@ AppLocker rules are organized into collections based on file format. If no AppLo This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. -![install create lockdown customize](images/lockdownapps.png) +![install create lockdown customize.](images/lockdownapps.png) ## Install apps @@ -50,13 +50,13 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - ![configure rule enforcement](images/apprule.png) + ![configure rule enforcement.](images/apprule.png) 3. Check **Configured** under **Executable rules**, and then click **OK**. 4. Right-click **Executable Rules** and then click **Automatically generate rules**. - ![automatically generate rules](images/genrule.png) + ![automatically generate rules.](images/genrule.png) 5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. @@ -68,7 +68,7 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 9. Read the message and click **Yes**. - ![default rules warning](images/appwarning.png) + ![default rules warning.](images/appwarning.png) 10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 702221c085..2bbcd7f1a3 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -81,7 +81,7 @@ Let's start by looking at the basic structure of the XML file. - A profile has no effect if it’s not associated to a config section. - ![profile = app and config = account](images/profile-config.png) + ![profile = app and config = account.](images/profile-config.png) You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md) @@ -271,7 +271,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, >[!NOTE] >If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. -![What the Start screen looks like when the XML sample is applied](images/sample-start.png) +![What the Start screen looks like when the XML sample is applied.](images/sample-start.png) ##### Taskbar @@ -494,7 +494,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. In the center pane, click **Browse** to locate and select the assigned access configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer.](images/multiappassignedaccesssettings.png) 8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. @@ -544,7 +544,7 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](images/oobe.jpg) + ![The first screen to set up a new PC.](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -552,11 +552,11 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](images/prov.jpg) + ![Provision this device.](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](images/choose-package.png) + ![Choose a package.](images/choose-package.png) 5. Select **Yes, add it**. @@ -570,7 +570,7 @@ Provisioning packages can be applied to a device during the first-run experience >[!NOTE] >if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. -![add a package option](images/package.png) +![add a package option.](images/package.png) ### Use MDM to deploy the multi-app configuration diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md index d577b69cff..6dc4c73ddb 100644 --- a/windows/configuration/manage-wifi-sense-in-enterprise.md +++ b/windows/configuration/manage-wifi-sense-in-enterprise.md @@ -46,7 +46,7 @@ You can manage your Wi-Fi Sense settings by using Group Policy and your Group Po 1. Open your Group Policy editor and go to the `Computer Configuration\Administrative Templates\Network\WLAN Service\WLAN Settings\Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services` setting. - ![Group Policy Editor, showing the Wi-Fi Sense setting](images/wifisense-grouppolicy.png) + ![Group Policy Editor, showing the Wi-Fi Sense setting.](images/wifisense-grouppolicy.png) 2. Turn Wi-Fi Sense on (enabled) or off (disabled), based on your company's environment. @@ -60,7 +60,7 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry 2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**.

Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see How to configure Wi-Fi Sense on Windows 10 in an enterprise. - ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) + ![Registry Editor, showing the creation of a new DWORD value.](images/wifisense-registry.png) ### Using the Windows Provisioning settings You can manage your Wi-Fi Sense settings by changing the Windows provisioning setting, **WiFISenseAllowed**. @@ -81,7 +81,7 @@ If your company still uses Unattend, you can manage your Wi-Fi Sense settings by ### How employees can change their own Wi-Fi Sense settings If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. -![Wi-Fi Sense options shown to employees if it's not turned off](images/wifisense-settingscreens.png) +![Wi-Fi Sense options shown to employees if it's not turned off.](images/wifisense-settingscreens.png) **Important**
The service that was used to share networks with Facebook friends, Outlook.com contacts, or Skype contacts is no longer available. This means: diff --git a/windows/configuration/mobile-devices/lockdown-xml.md b/windows/configuration/mobile-devices/lockdown-xml.md index ecf485cb1d..87f2b7b7cf 100644 --- a/windows/configuration/mobile-devices/lockdown-xml.md +++ b/windows/configuration/mobile-devices/lockdown-xml.md @@ -62,7 +62,7 @@ The settings for the Default role and other roles must be listed in your XML fil ## Action Center -![XML for Action Center](../images/ActionCenterXML.jpg) +![XML for Action Center.](../images/ActionCenterXML.jpg) The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. @@ -92,7 +92,7 @@ The following example is a complete lockdown XML file that disables Action Cente ## Apps -![XML for Apps](../images/AppsXML.png) +![XML for Apps.](../images/AppsXML.png) The Apps setting serves as an allow list and specifies the applications that will be available in the All apps list. Apps that are not included in this setting are hidden from the user and blocked from running. @@ -110,7 +110,7 @@ The following example makes Outlook Calendar available on the device. When you list an app, you can also set the app to be pinned to the Start screen by specifying the tile size and location. Tip: draw a grid and mark your app tiles on it to make sure you get the result you want. The width (X axis) in the following example is the limit for Windows 10 Mobile, but the length (Y axis) is unlimited. The number of columns available to you depends on the value for [StartScreenSize](#start-screen-size). -![Grid to lay out tiles for Start](../images/StartGrid.jpg) +![Grid to lay out tiles for Start.](../images/StartGrid.jpg) Tile sizes are: * Small: 1x1 @@ -152,7 +152,7 @@ In the following example, Outlook Calendar and Outlook Mail are pinned to the St That layout would appear on a device like this: -![Example of the layout on a Start screen](../images/StartGridPinnedApps.jpg) +![Example of the layout on a Start screen.](../images/StartGridPinnedApps.jpg) You can create and pin folders to Start by using the Apps setting. Each folder requires a **folderId**, which must be a consecutive positive integer starting with `1`. You can also specify a **folderName** (optional) which will be displayed on Start. @@ -203,7 +203,7 @@ When an app is contained in a folder, its **PinToStart** configuration (tile siz ## Buttons -![XML for buttons](../images/ButtonsXML.jpg) +![XML for buttons.](../images/ButtonsXML.jpg) In the Buttons setting, you use ButtonLockdownList to disable hardware buttons and ButtonRemapList to change button events to open an app that you specify. @@ -213,11 +213,11 @@ When a user taps a button that is in the lockdown list, nothing will happen. The Button | Press | PressAndHold | All ---|:---:|:---:|:--:|- -Start | ![no](../images/crossmark.png) | ![yes](../images/checkmark.png) | ![no](../images/crossmark.png) -Back | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Search | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Camera | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Custom 1, 2, and 3 | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Start | ![no.](../images/crossmark.png) | ![yes](../images/checkmark.png) | ![no](../images/crossmark.png) +Back | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Search | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Camera | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Custom 1, 2, and 3 | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) > [!NOTE] > Custom buttons are hardware buttons that can be added to devices by OEMs. @@ -270,7 +270,7 @@ In the following example, when a user presses the Search button, the phone diale ## CSPRunner -![XML for CSP Runner](../images/CSPRunnerXML.jpg) +![XML for CSP Runner.](../images/CSPRunnerXML.jpg) You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) or [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). @@ -317,7 +317,7 @@ SyncML entry | Description ## Menu items -![XML for menu items](../images/MenuItemsXML.png) +![XML for menu items.](../images/MenuItemsXML.png) Use DisableMenuItems to prevent use of the context menu, which is displayed when a user presses and holds an application in the All Apps list. You can include this entry in the default profile and in any additional user role profiles that you create. @@ -329,7 +329,7 @@ Use DisableMenuItems to prevent use of the context menu, which is displayed when ## Settings -![XML for settings](../images/SettingsXML.png) +![XML for settings.](../images/SettingsXML.png) The **Settings** section contains an `allow` list of pages in the Settings app and quick actions. The following example allows all settings. @@ -363,7 +363,7 @@ For a list of the settings and quick actions that you can allow or block, see [S ## Tiles - ![XML for tiles](../images/TilesXML.png) + ![XML for tiles.](../images/TilesXML.png) By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile. @@ -446,7 +446,7 @@ Use the Windows ICD tool included in the Windows Assessment and Deployment Kit ( 3. In the center pane, click **Browse** to locate and select the lockdown XML file that you created. - ![browse button](../images/icdbrowse.png) + ![browse button.](../images/icdbrowse.png) 4. On the **File** menu, select **Save.** diff --git a/windows/configuration/mobile-devices/mobile-lockdown-designer.md b/windows/configuration/mobile-devices/mobile-lockdown-designer.md index 68774e0da5..a7d82f6088 100644 --- a/windows/configuration/mobile-devices/mobile-lockdown-designer.md +++ b/windows/configuration/mobile-devices/mobile-lockdown-designer.md @@ -16,7 +16,7 @@ manager: dansimp # Use the Lockdown Designer app to create a Lockdown XML file -![Lockdown Designer in the Store](../images/ldstore.png) +![Lockdown Designer in the Store.](../images/ldstore.png) Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. For example, the enterprise can lock down a device so that only applications and settings in an allow list are available. This is accomplished using Lockdown XML, an XML file that contains settings for Windows 10 Mobile. @@ -55,7 +55,7 @@ Perform these steps on the device running Windows 10 Mobile that you will use to >[!IMPORTANT] >Check **Settings > Personalization > Start > Show more tiles** on the test mobile device. If **Show more tiles** is **On**, you must select **Large** on the [**Start screen** page](#start) in Lockdown Designer. If you want to apply a **Small** layout, set **Show more tiles** on the test mobile device to **Off**. > ->![turn off show more tiles for small start screen size](../images/show-more-tiles.png) +>![turn off show more tiles for small start screen size.](../images/show-more-tiles.png) ## Prepare the PC @@ -89,7 +89,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 3. Click **Pair**. - ![Pair](../images/ld-pair.png) + ![Pair.](../images/ld-pair.png) **Connect to remote device** appears. @@ -99,7 +99,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 6. Next, click **Sync** to pull information from the device in to Lockdown Designer. - ![Sync](../images/ld-sync.png) + ![Sync.](../images/ld-sync.png) 7. Click the **Save** icon and enter a name for your project. @@ -113,7 +113,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 3. On the **Project setting** > **General settings** page, click **Pair**. - ![Pair](../images/ld-pair.png) + ![Pair.](../images/ld-pair.png) **Connect to remote device** appears. @@ -123,7 +123,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 6. Next, click **Sync** to pull information from the device in to Lockdown Designer. - ![Sync](../images/ld-sync.png) + ![Sync.](../images/ld-sync.png) 7. Click the **Save** icon and enter a name for your project. @@ -134,13 +134,13 @@ The apps and settings available in the pages of Lockdown Designer should now be | Page | Description | | --- | --- | -| ![Applications](../images/ld-apps.png) | Each app from the test mobile device is listed. Select the apps that you want visible to users.

You can select an app to run automatically when a user signs in to the device. The **Select Auto-Run** menu is populated by the apps that you select to allow on the device. | -| ![CSP Runner](../images/ld-csp.png) | CSPRunner enables you to include settings and policies that are not defined in other sections of the app. To make use of CSPRunner, you must create the SyncML block that contains the settings, and then import the SyncML in Lockdown Designer. [Learn how to use CSPRunner and author SyncML.](lockdown-xml.md#csprunner) | -| ![Settings](../images/ld-settings.png) | On this page, you select the settings that you want visible to users. See the [ms settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to see which Settings page maps to a URI. | -| ![Quick actions](../images/ld-quick.png) | On this page, you select the settings that you want visible to users. | -| ![Buttons](../images/ld-buttons.png) | Each hardware button on a mobile device has different actions that can be disabled. In addition, the behavior for **Search** button can be changed to open an app other than **Search**.

Some devices may have additional hardware buttons provided by the OEM. These are listed as Custom1, Custom2, and Custom3. If your device has custom hardware buttons, contact your equipment provider to identify how their custom buttons are defined. | -| ![Other settings](../images/ld-other.png) | This page contains several settings that you can configure:

- The context menu is displayed when a user presses and holds an application in the All Apps list. You can enable or disable the context menu.

- Tile manipulation allows users to pin, unpin, move, and resize tiles on the Start screen. You can enable or disable tile manipulation.

- The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. | -| ![Start screen](../images/ld-start.png) | On this page, you can start a remote simulation session with the test mobile device. Click **Start remote simulation**. You will see a **Start screen remote simulation in progress** message on the PC. (If the **Start remote simulation** button is not active, [pair the mobile device with the PC again](#pair).)

On the test mobile device, tiles for the apps that you allowed on the **Applications** page are displayed on the screen. You can move, resize, or unpin these tiles to achieve the desired layout.

When you are done changing the layout on the test mobile device, click **Accept** on the PC. | +| ![Applications.](../images/ld-apps.png) | Each app from the test mobile device is listed. Select the apps that you want visible to users.

You can select an app to run automatically when a user signs in to the device. The **Select Auto-Run** menu is populated by the apps that you select to allow on the device. | +| ![CSP Runner.](../images/ld-csp.png) | CSPRunner enables you to include settings and policies that are not defined in other sections of the app. To make use of CSPRunner, you must create the SyncML block that contains the settings, and then import the SyncML in Lockdown Designer. [Learn how to use CSPRunner and author SyncML.](lockdown-xml.md#csprunner) | +| ![Settings.](../images/ld-settings.png) | On this page, you select the settings that you want visible to users. See the [ms settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to see which Settings page maps to a URI. | +| ![Quick actions.](../images/ld-quick.png) | On this page, you select the settings that you want visible to users. | +| ![Buttons.](../images/ld-buttons.png) | Each hardware button on a mobile device has different actions that can be disabled. In addition, the behavior for **Search** button can be changed to open an app other than **Search**.

Some devices may have additional hardware buttons provided by the OEM. These are listed as Custom1, Custom2, and Custom3. If your device has custom hardware buttons, contact your equipment provider to identify how their custom buttons are defined. | +| ![Other settings.](../images/ld-other.png) | This page contains several settings that you can configure:

- The context menu is displayed when a user presses and holds an application in the All Apps list. You can enable or disable the context menu.

- Tile manipulation allows users to pin, unpin, move, and resize tiles on the Start screen. You can enable or disable tile manipulation.

- The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. | +| ![Start screen.](../images/ld-start.png) | On this page, you can start a remote simulation session with the test mobile device. Click **Start remote simulation**. You will see a **Start screen remote simulation in progress** message on the PC. (If the **Start remote simulation** button is not active, [pair the mobile device with the PC again](#pair).)

On the test mobile device, tiles for the apps that you allowed on the **Applications** page are displayed on the screen. You can move, resize, or unpin these tiles to achieve the desired layout.

When you are done changing the layout on the test mobile device, click **Accept** on the PC. | ## Validate and export @@ -169,4 +169,4 @@ You can create additional roles for the device and have unique configurations fo 4. Configure the settings for the role as above, but make sure on each page that you select the correct role. - ![Current role selection box](../images/ld-role.png) \ No newline at end of file + ![Current role selection box.](../images/ld-role.png) \ No newline at end of file diff --git a/windows/configuration/mobile-devices/provisioning-configure-mobile.md b/windows/configuration/mobile-devices/provisioning-configure-mobile.md index 1d321fd9cb..ebd4218503 100644 --- a/windows/configuration/mobile-devices/provisioning-configure-mobile.md +++ b/windows/configuration/mobile-devices/provisioning-configure-mobile.md @@ -66,13 +66,13 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us 1. Insert an SD card containing the provisioning package into the device. 2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. - ![add a package option](../images/packages-mobile.png) + ![add a package option.](../images/packages-mobile.png) 3. Click **Add**. 4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) ### Copying the provisioning package to the device @@ -82,7 +82,7 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us 3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) ## Related topics diff --git a/windows/configuration/mobile-devices/provisioning-nfc.md b/windows/configuration/mobile-devices/provisioning-nfc.md index 571a1488af..42ff3ff229 100644 --- a/windows/configuration/mobile-devices/provisioning-nfc.md +++ b/windows/configuration/mobile-devices/provisioning-nfc.md @@ -31,7 +31,7 @@ All Windows 10 Mobile Enterprise and Windows 10 Mobile images have the NFC provi On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key, which shows the **Provision this device** screen. In the **Provision this device** screen, select **NFC** for NFC-based provisioning. -![Example of Provision this device screen](../images/nfc.png) +![Example of Provision this device screen.](../images/nfc.png) If there is an error during NFC provisioning, the device will show a message if any of the following errors occur: diff --git a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index 711f3cfc4e..a265a544e3 100644 --- a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -168,28 +168,28 @@ Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or **To set up Apps Corner** -1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner**. +1. On Start ![start.](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner**. -2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon](images/doneicon.png). +2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon.](images/doneicon.png). -3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back](../images/backicon.png) to the Apps Corner settings. +3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back.](../images/backicon.png) to the Apps Corner settings. 4. Turn **Action center** on or off, depending on whether you want people to be able to use these features when using the device in kiosk mode. 5. Tap **advanced**, and then turn features on or off, depending on whether you want people to be able to use them. -6. Press **Back** ![back](../images/backicon.png) when you're done. +6. Press **Back** ![back.](../images/backicon.png) when you're done. **To use Apps Corner** -1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). +1. On Start ![start.](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). >[!TIP] >Want to get to Apps Corner with one tap? In **Settings**, tap **Apps Corner** > **pin** to pin the Apps Corner tile to your Start screen. 2. Give the device to someone else, so they can use the device and only the one app you chose. -3. When they're done and you get the device back, press and hold Power ![power](../images/powericon.png), and then swipe right to exit Apps Corner. +3. When they're done and you get the device back, press and hold Power ![power.](../images/powericon.png), and then swipe right to exit Apps Corner. ## Related topics diff --git a/windows/configuration/mobile-devices/start-layout-xml-mobile.md b/windows/configuration/mobile-devices/start-layout-xml-mobile.md index 41fc17fe04..858de39174 100644 --- a/windows/configuration/mobile-devices/start-layout-xml-mobile.md +++ b/windows/configuration/mobile-devices/start-layout-xml-mobile.md @@ -36,7 +36,7 @@ On Windows 10 Mobile, the customized Start works by: The following diagrams show the default Windows 10, version 1607 Start layouts for single SIM and dual SIM devices with Cortana support, and single SIM and dual SIM devices with no Cortana support. -![Start layout for Windows 10 Mobile](../images/mobile-start-layout.png) +![Start layout for Windows 10 Mobile.](../images/mobile-start-layout.png) The diagrams show: diff --git a/windows/configuration/provisioning-apn.md b/windows/configuration/provisioning-apn.md index 326ea5b8b8..a8d47b38e2 100644 --- a/windows/configuration/provisioning-apn.md +++ b/windows/configuration/provisioning-apn.md @@ -53,11 +53,11 @@ For users who work in different locations, you can configure one APN to connect 5. Enter a name for the connection, and then click **Add**. - ![Example of APN connection name](images/apn-add.png) + ![Example of APN connection name.](images/apn-add.png) 6. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection. - ![settings for new connection](images/apn-add-details.png) + ![settings for new connection.](images/apn-add-details.png) 7. The following table describes the settings available for the connection. diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index 67c28a8b90..38d6791423 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -38,7 +38,7 @@ Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/win CSPs are behind many of the management tasks and policies for Windows 10, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). -![how intune maps to csp](../images/policytocsp.png) +![how intune maps to csp.](../images/policytocsp.png) CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. @@ -66,7 +66,7 @@ You can use Windows Configuration Designer to create [provisioning packages](./p Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. -![how help content appears in icd](../images/cspinicd.png) +![how help content appears in icd.](../images/cspinicd.png) [Provisioning packages in Windows 10](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package. @@ -86,7 +86,7 @@ All CSPs in Windows 10 are documented in the [Configuration service provider ref The [main CSP topic](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. -![csp per windows edition](../images/csptable.png) +![csp per windows edition.](../images/csptable.png) The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format. @@ -94,7 +94,7 @@ The full path to a specific configuration setting is represented by its Open Mob The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. -![assigned access csp tree](../images/provisioning-csp-assignedaccess.png) +![assigned access csp tree.](../images/provisioning-csp-assignedaccess.png) The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). @@ -104,7 +104,7 @@ The element in the tree diagram after the root node tells you the name of the CS When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. -![placeholder in csp tree](../images/csp-placeholder.png) +![placeholder in csp tree.](../images/csp-placeholder.png) After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 38b7e01c09..818a935488 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -58,7 +58,7 @@ Provisioning packages can include management instructions and policies, installa > [!TIP] > Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. > ->![open advanced editor](../images/icd-simple-edit.png) +>![open advanced editor.](../images/icd-simple-edit.png) ## Create the provisioning package @@ -68,11 +68,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 2. Click **Provision desktop devices**. - ![ICD start options](../images/icd-create-options-1703.png) + ![ICD start options.](../images/icd-create-options-1703.png) 3. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. - ![ICD desktop provisioning](../images/icd-desktop-1703.png) + ![ICD desktop provisioning.](../images/icd-desktop-1703.png) > [!IMPORTANT] > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md index a71916bfab..68cfcc37af 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md @@ -46,7 +46,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options](../images/icdstart-option.png) + ![ICD start options.](../images/icdstart-option.png) 3. Name your project and click **Next**. @@ -73,19 +73,19 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package](../images/uwp-family.png) + ![details for offline app package.](../images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package](../images/uwp-dependencies.png) + ![required frameworks for offline app package.](../images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page, and change the extension of the license file from **.xml** to **.ms-windows-store-license**. - ![generate license for offline app](../images/uwp-license.png) + ![generate license for offline app.](../images/uwp-license.png) - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**. diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index cca8b46be8..f6f7f9876b 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -74,11 +74,11 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate 2. Enter a name for the first app, and then click **Add**. - ![enter name for first app](../images/wcd-app-name.png) + ![enter name for first app.](../images/wcd-app-name.png) 3. Configure the settings for the appropriate installer type. - ![enter settings for first app](../images/wcd-app-commands.png) + ![enter settings for first app.](../images/wcd-app-commands.png) ## Add a universal app to your package @@ -88,19 +88,19 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package](../images/uwp-family.png) + ![details for offline app package.](../images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package](../images/uwp-dependencies.png) + ![required frameworks for offline app package.](../images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - ![generate license for offline app](../images/uwp-license.png) + ![generate license for offline app.](../images/uwp-license.png) - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**. diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index 4a1bb159ac..4a9381ab1c 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -35,7 +35,7 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](../images/oobe.jpg) + ![The first screen to set up a new PC.](../images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -43,11 +43,11 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](../images/prov.jpg) + ![Provision this device.](../images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](../images/choose-package.png) + ![Choose a package.](../images/choose-package.png) 5. Select **Yes, add it**. @@ -59,7 +59,7 @@ Provisioning packages can be applied to a device during the first-run experience Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation. -![add a package option](../images/package.png) +![add a package option.](../images/package.png) ## Mobile editions @@ -68,13 +68,13 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account 1. Insert an SD card containing the provisioning package into the device. 2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. - ![add a package option](../images/packages-mobile.png) + ![add a package option.](../images/packages-mobile.png) 3. Click **Add**. 4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) ### Copying the provisioning package to the device @@ -84,7 +84,7 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account 3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index b67e28b34d..0aa10c16b5 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -39,7 +39,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: - ![Configuration Designer wizards](../images/icd-create-options-1703.png) + ![Configuration Designer wizards.](../images/icd-create-options-1703.png) - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: @@ -56,7 +56,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > - > ![Switch to advanced editor](../images/icd-switch.png) + > ![Switch to advanced editor.](../images/icd-switch.png) 3. Enter a name for your project, and then select **Next**. @@ -87,7 +87,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings. -![What the ICD interface looks like](../images/icd-runtime.png) +![What the ICD interface looks like.](../images/icd-runtime.png) The settings in Windows Configuration Designer are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md). @@ -103,14 +103,14 @@ The process for configuring settings is similar for all settings. The following For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference topic for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image. -![Windows Configuration Designer opens the reference topic when you select a setting](../images/icd-setting-help.png) +![Windows Configuration Designer opens the reference topic when you select a setting.](../images/icd-setting-help.png) ## Build package 1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. - ![Export on top bar](../images/icd-export-menu.png) + ![Export on top bar.](../images/icd-export-menu.png) 2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 8a7b9c464d..1a467d4e6d 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -66,7 +66,7 @@ On devices running Windows 10, you can install [the Windows Configuration Design 6. On the **Select the features you want to install** page, clear all selections except **Configuration Designer**, and then click **Install**. - ![Only Configuration Designer selected for installation](../images/icd-install.png) + ![Only Configuration Designer selected for installation.](../images/icd-install.png) ## Current Windows Configuration Designer limitations diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index e5d60aba7f..6e54b39009 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -35,7 +35,7 @@ In the XML file, you provide an **Id**, or friendly name, for each **Target**. E A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**. -![Target with multiple target states and conditions](../images/multi-target.png) +![Target with multiple target states and conditions.](../images/multi-target.png) The following table describes the logic for the target definition. diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 2313b0e929..a3b4e25f84 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -124,7 +124,7 @@ For details about the settings you can customize in provisioning packages, see [ Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios. -![Configuration Designer options](../images/icd.png) +![Configuration Designer options.](../images/icd.png) Windows ICD in Windows 10, version 1607, supported the following scenarios for IT administrators: diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index a616731808..6e01640c44 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -189,13 +189,13 @@ cmd /c InstallMyApp.bat In Windows Configuration Designer, this looks like: -![Command line in Selected customizations](../images/icd-script1.png) +![Command line in Selected customizations.](../images/icd-script1.png) You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files. In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting. -![Command files in Selected customizations](../images/icd-script2.png) +![Command files in Selected customizations.](../images/icd-script2.png) When you are done, [build the package](provisioning-create-package.md#build-package). diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index e4327a7b35..ed5c4ee3a3 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -108,13 +108,13 @@ You can configure Windows to be in shared PC mode in a couple different ways: 8. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. > [!div class="mx-imgBorder"] - > ![Shared PC mode in the Configuration settings page](images/shared_pc_3.png) + > ![Shared PC mode in the Configuration settings page.](images/shared_pc_3.png) 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. - A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. - ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) + ![Shared PC settings in ICD.](images/icd-adv-shared-pc.png) - WMI bridge: Environments that use Group Policy can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the [MDM_SharedPC class](/windows/win32/dmwmibridgeprov/mdm-sharedpc). For all device settings, the WMI Bridge client must be executed under local system user; for more information, see [Using PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). For example, open PowerShell as an administrator and enter the following: @@ -189,7 +189,7 @@ You can apply the provisioning package to a PC during initial setup or to a PC t 1. Start with a PC on the setup screen. - ![The first screen to set up a new PC](images/oobe.jpg) + ![The first screen to set up a new PC.](images/oobe.jpg) 2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. @@ -206,7 +206,7 @@ You can apply the provisioning package to a PC during initial setup or to a PC t On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and selects the package to install. -![add a package option](images/package.png) +![add a package option.](images/package.png) > [!NOTE] > If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index 24dbcd1b32..5a39031455 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -42,7 +42,7 @@ When troubleshooting basic Start issues (and for the most part, all other Window - `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost` - `get-AppXPackage -Name Microsoft.Windows.Cortana` - ![Example of output from cmdlets](images/start-ts-1.png) + ![Example of output from cmdlets.](images/start-ts-1.png) Failure messages will appear if they aren't installed @@ -188,7 +188,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded ### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted -![Screenshots that show download icons on app tiles and missing app tiles](images/start-ts-2.png) +![Screenshots that show download icons on app tiles and missing app tiles.](images/start-ts-2.png) **Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps. @@ -236,11 +236,11 @@ Specifically, behaviors include - If a new roaming user is created, the first sign-in appears normal, but on subsequent sign-ins, tiles are missing. -![Example of a working layout](images/start-ts-3.png) +![Example of a working layout.](images/start-ts-3.png) *Working layout on first sign-in of a new roaming user profile* -![Example of a failing layout](images/start-ts-4.png) +![Example of a failing layout.](images/start-ts-4.png) *Failing layout on subsequent sign-ins* @@ -256,15 +256,15 @@ Specifically, behaviors include Before the upgrade: - ![Example of Start screen with customizations applied](images/start-ts-5.jpg) + ![Example of Start screen with customizations applied.](images/start-ts-5.jpg) After the upgrade the user pinned tiles are missing: - ![Example of Start screen with previously pinned tiles missing](images/start-ts-6.png) + ![Example of Start screen with previously pinned tiles missing.](images/start-ts-6.png) Additionally, users may see blank tiles if sign-in was attempted without network connectivity. - ![Example of blank tiles](images/start-ts-7.png) + ![Example of blank tiles.](images/start-ts-7.png) **Resolution**: This issue was fixed in the [October 2017 update](https://support.microsoft.com/en-us/help/4041676). diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index d988f11531..351f09ce8e 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -31,15 +31,15 @@ In a Start layout for Windows 10, version 1703, you can include secondary tiles Suppose that the [Start layout that you export](customize-and-export-start-layout.md) had two secondary tiles, such as in the following image: -![tile for MSN and for a SharePoint site](images/edge-with-logo.png) +![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) In prior versions of Windows 10, when you applied the Start layout to a device, the tiles would display as shown in the following image: -![tile for MSN and for a SharePoint site with no logos](images/edge-without-logo.png) +![tile for MSN and for a SharePoint site with no logos.](images/edge-without-logo.png) In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles will now display the same as they did on the device from which you exported the Start layout. -![tile for MSN and for a SharePoint site](images/edge-with-logo.png) +![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) **Example of secondary tiles in XML generated by Export-StartLayout** @@ -156,7 +156,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 12. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted](images/customization-start-edge.png) + ![Customizations file with the placeholder text to replace highlighted.](images/customization-start-edge.png) 13. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md index 83744db2ca..75fcbcdad0 100644 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md @@ -121,7 +121,7 @@ UE-V for Windows 10, version 1607 includes a new template generator. If you are --> -![Selecting UE-V features in ADK](images/uev-adk-select-uev-feature.png) +![Selecting UE-V features in ADK.](images/uev-adk-select-uev-feature.png) 3. To open the generator, select **Microsoft Application Virtualization Generator** from the **Start** menu. diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md index bb6d70d870..0d091fe1bb 100644 --- a/windows/configuration/ue-v/uev-for-windows.md +++ b/windows/configuration/ue-v/uev-for-windows.md @@ -41,7 +41,7 @@ The diagram below illustrates how UE-V components work together to synchronize u UE-V architecture, with server share, desktop, and UE-V service | **Component** | **Function** | @@ -65,7 +65,7 @@ Use these UE-V components to create and manage custom templates for your third-p --> -![UE-V template generator process](images/uev-generator-process.png) +![UE-V template generator process.](images/uev-generator-process.png) ## Settings synchronized by default diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index bfc7cfa6f3..08853f5b22 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -44,7 +44,7 @@ If you want to use UE-V to synchronize user-defined settings for custom applicat The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make. -![UE-V deployment preparation](images/uev-deployment-preparation.png) +![UE-V deployment preparation.](images/uev-deployment-preparation.png) Update & Security --> Windows Update**. - **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index f822925011..e56e7a3b5b 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -93,11 +93,11 @@ Once the device is in the pending restart state, it will attempt to restart the Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) +![The notification users get for an impending quality update deadline.](images/wufb-quality-notification.png) Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) +![The notification users get for an impending feature update deadline.](images/wufb-feature-notification.png) ### Deadline with user engagement @@ -130,17 +130,17 @@ Before the deadline the device will be in two states: auto-restart period and en Notification users get for quality update engaged deadline: -![The notification users get for an impending engaged quality update deadline example](images/wufb-quality-engaged-notification.png) +![The notification users get for an impending engaged quality update deadline example.](images/wufb-quality-engaged-notification.png) Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline example](images/wufb-quality-notification.png) +![The notification users get for an impending quality update deadline example.](images/wufb-quality-notification.png) Notification users get for a feature update engaged deadline: -![The notification users get for an impending feature update engaged deadline example](images/wufb-feature-update-engaged-notification.png) +![The notification users get for an impending feature update engaged deadline example.](images/wufb-feature-update-engaged-notification.png) Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline example](images/wufb-feature-update-deadline-notification.png) +![The notification users get for an impending feature update deadline example.](images/wufb-feature-update-deadline-notification.png) diff --git a/windows/deployment/update/wufb-manageupdate.md b/windows/deployment/update/wufb-manageupdate.md index 93a5ab27b7..8589495141 100644 --- a/windows/deployment/update/wufb-manageupdate.md +++ b/windows/deployment/update/wufb-manageupdate.md @@ -40,7 +40,7 @@ If you don't need a wave deployment and have a small set of devices to manage, w |Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled| ## Suggested configuration for a wave deployment -![Graphic showing a deployment divided into rings for a wave deployment](images/wufb-wave-deployment.png) +![Graphic showing a deployment divided into rings for a wave deployment.](images/wufb-wave-deployment.png) ## Early validation and testing Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings). diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index e044463423..8aafc8f67d 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -174,7 +174,7 @@ To check your system for unsigned drivers: 5. Type **sigverif** and press ENTER. 6. The File Signature Verification tool will open. Click **Start**. - ![File Signature Verification](../images/sigverif.png) + ![File Signature Verification.](../images/sigverif.png) 7. After the scanning process is complete, if you see **Your files have been scanned and verified as digitally signed** then you have no unsigned drivers. Otherwise, you will see **The following files have not been digitally signed** and a list will be provided with name, location, and version of all unsigned drivers. 8. To view and save a log file, click **Advanced**, and then click **View Log**. Save the log file if desired. @@ -268,7 +268,7 @@ To obtain the proper firmware drivers, search for the most updated driver versio When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example: -![Get important updates](../images/update.jpg) +![Get important updates.](../images/update.jpg) ### Verify disk space @@ -280,13 +280,13 @@ In File Explorer, click on **Computer** or **This PC** on the left, then look un The amount of space available on the system drive will be displayed under the drive. See the following example: -![System drive](../images/drive.png) +![System drive.](../images/drive.png) In the previous example, there is 703 GB of available free space on the system drive (C:). To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example: -![Disk cleanup](../images/cleanup.png) +![Disk cleanup.](../images/cleanup.png) For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space). diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 9e7a29631c..4dcb8fe787 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -25,7 +25,7 @@ ms.topic: article >This is a 300 level topic (moderate advanced).
>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
- [![Download SetupDiag](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) + [![Download SetupDiag.](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) ## About SetupDiag @@ -563,7 +563,7 @@ Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" f ## Sample registry key -![Example of Addreg](./../images/addreg.png) +![Example of Addreg.](./../images/addreg.png) ## Related topics diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 5839bb088a..7ea7080113 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -61,7 +61,7 @@ Click **Submit** to send your feedback. See the following example: -![feedback example](../images/feedback.png) +![feedback example.](../images/feedback.png) After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. @@ -69,7 +69,7 @@ After you click Submit, that's all you need to do. Microsoft will receive your f After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. -![share](../images/share.jpg) +![share.](../images/share.jpg) ## Related topics diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index 842e478dcf..bdb7e4814a 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -59,31 +59,31 @@ When performing an operating system upgrade, Windows Setup uses phases described 1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. - ![downlevel phase](../images/downlevel.png) + ![downlevel phase.](../images/downlevel.png) 2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. - ![safeOS phase](../images/safeos.png) + ![safeOS phase.](../images/safeos.png) 3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. - ![first boot phase](../images/firstboot.png) + ![first boot phase.](../images/firstboot.png) 4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. - ![second boot phase](../images/secondboot.png) + ![second boot phase.](../images/secondboot.png) - ![second boot phase](../images/secondboot2.png) + ![second boot phase.](../images/secondboot2.png) - ![second boot phase](../images/secondboot3.png) + ![second boot phase.](../images/secondboot3.png) 5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. **Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): -![Upgrade process](../images/upgrade-process.png) +![Upgrade process.](../images/upgrade-process.png) DU = Driver/device updates.
OOBE = Out of box experience.
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 1454fe92ed..72fb2c3d26 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -34,9 +34,9 @@ The following table shows the methods and paths available to change the edition > [!TIP] > Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. -![not supported](../images/x_blk.png) (X) = not supported
-![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
-![supported, no reboot](../images/check_blu.png) (blue checkmark) = supported, no reboot required
+![not supported.](../images/x_blk.png) (X) = not supported
+![supported, reboot required.](../images/check_grn.png) (green checkmark) = supported, reboot required
+![supported, no reboot.](../images/check_blu.png) (blue checkmark) = supported, no reboot required
| Edition upgrade | Using mobile device management (MDM) | Using a provisioning package | Using a command-line tool | Using Microsoft Store for Business or PC | Entering a product key manually | Purchasing a license from the Microsoft Store | |-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- | -| **Home > Pro** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro for Workstations** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Home > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | -| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Pro** | ![not supported.](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro for Workstations** | ![not supported.](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Pro for Workstations** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | +| **Pro > Pro Education** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Enterprise** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Pro Education** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Enterprise** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro Education > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Enterprise > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | > [!NOTE] > - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md) diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 08c4982f9c..50aad1782d 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -63,7 +63,7 @@ Ten parameters are listed in the event: The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. -![Windows Error Reporting](../images/event.png) +![Windows Error Reporting.](../images/event.png) ## Related topics diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index 84a87a0aac..52b489720f 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -49,7 +49,7 @@ You use a command-line option,**/hardlink** , to create a hard-link migration st The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. -![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) +![migration store comparison.](images/dep-win8-l-usmt-migrationcomparemigstores.gif) ## Local Store vs. Remote Store diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index 30930ac481..b94bc3041b 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -49,7 +49,7 @@ The following diagram shows a PC-refresh migration, also known as a computer ref   -![usmt pc refresh scenario](images/dep-win8-l-usmt-pcrefresh.jpg) +![usmt pc refresh scenario.](images/dep-win8-l-usmt-pcrefresh.jpg)   @@ -100,7 +100,7 @@ The following diagram shows a PC-replacement migration. First, the administrator   -![usmt pc replace scenario](images/dep-win8-l-usmt-pcreplace.jpg) +![usmt pc replace scenario.](images/dep-win8-l-usmt-pcreplace.jpg)   diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index f32ee0d61e..10e7c2e418 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -55,7 +55,7 @@ The process proceeds as follows: 3. Client computers are activated by receiving the activation object from a domain controller during startup. > [!div class="mx-imgBorder"] - > ![Active Directory-based activation flow](../images/volumeactivationforwindows81-10.jpg) + > ![Active Directory-based activation flow.](../images/volumeactivationforwindows81-10.jpg) **Figure 10**. The Active Directory-based activation flow @@ -80,31 +80,31 @@ When a reactivation event occurs, the client queries AD DS for the activation o 3. Add the Volume Activation Services role, as shown in Figure 11. - ![Adding the Volume Activation Services role](../images/volumeactivationforwindows81-11.jpg) + ![Adding the Volume Activation Services role.](../images/volumeactivationforwindows81-11.jpg) **Figure 11**. Adding the Volume Activation Services role 4. Click the link to launch the Volume Activation Tools (Figure 12). - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-12.jpg) + ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-12.jpg) **Figure 12**. Launching the Volume Activation Tools 5. Select the **Active Directory-Based Activation** option (Figure 13). - ![Selecting Active Directory-Based Activation](../images/volumeactivationforwindows81-13.jpg) + ![Selecting Active Directory-Based Activation.](../images/volumeactivationforwindows81-13.jpg) **Figure 13**. Selecting Active Directory-Based Activation 6. Enter your KMS host key and (optionally) a display name (Figure 14). - ![Choosing how to activate your product](../images/volumeactivationforwindows81-15.jpg) + ![Choosing how to activate your product.](../images/volumeactivationforwindows81-15.jpg) **Figure 14**. Entering your KMS host key 7. Activate your KMS host key by phone or online (Figure 15). - ![Entering your KMS host key](../images/volumeactivationforwindows81-14.jpg) + ![Entering your KMS host key.](../images/volumeactivationforwindows81-14.jpg) **Figure 15**. Choosing how to activate your product diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index f9cfcf33ac..5fa4723874 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -80,39 +80,39 @@ This scenario is commonly used in larger organizations that do not find the over 2. Launch Server Manager. 3. Add the Volume Activation Services role, as shown in Figure 4. - ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) + ![Adding the Volume Activation Services role in Server Manager.](../images/volumeactivationforwindows81-04.jpg) **Figure 4**. Adding the Volume Activation Services role in Server Manager 4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) + ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-05.jpg) **Figure 5**. Launching the Volume Activation Tools 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) + ![Configuring the computer as a KMS host.](../images/volumeactivationforwindows81-06.jpg) **Figure 6**. Configuring the computer as a KMS host 6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). - ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) + ![Installing your KMS host key.](../images/volumeactivationforwindows81-07.jpg) **Figure 7**. Installing your KMS host key 7. If asked to confirm replacement of an existing key, click **Yes**. 8. After the product key is installed, you must activate it. Click **Next** (Figure 8). - ![Activating the software](../images/volumeactivationforwindows81-08.jpg) + ![Activating the software.](../images/volumeactivationforwindows81-08.jpg) **Figure 8**. Activating the software The KMS key can be activated online or by phone. See Figure 9. - ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) + ![Choosing to activate online.](../images/volumeactivationforwindows81-09.jpg) **Figure 9**. Choosing to activate online diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index b88d65def4..728b60519b 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -99,12 +99,12 @@ A MAK is used for one-time activation with Microsoft’s hosted activation servi You can activate computers by using a MAK in two ways: - **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. - ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) + ![MAK independent activation.](../images/volumeactivationforwindows81-16.jpg) **Figure 16**. MAK independent activation - **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. - ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) + ![MAK proxy activation with the VAMT.](../images/volumeactivationforwindows81-17.jpg) **Figure 17**. MAK proxy activation with the VAMT diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 4e2248db96..e671e92d02 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -34,7 +34,7 @@ Before adding computers, ensure that the Windows Management Instrumentation (WMI 5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. - ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) + ![VAMT, Finding computers dialog box.](images/dep-win8-l-vamt-findingcomputerdialog.gif) **Important**   This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 87cb8d7b0f..5cbd41f410 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -45,7 +45,7 @@ Enable the VAMT to access client computers using the **Windows Firewall** Contro Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel: -![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) +![VAMT Firewall configuration for multiple subnets.](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) 1. Open the Control Panel and double-click **Administrative Tools**. 2. Click **Windows Firewall with Advanced Security**. diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index f462f8655f..0b67293d6a 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -49,7 +49,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. - ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) + ![In this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) ### Install VAMT using the ADK @@ -73,7 +73,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. - ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) + ![Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) For remote SQL Server, use `servername.yourdomain.com`. diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index 45619726e9..91d2d8540b 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -45,7 +45,7 @@ VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type prod VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. -![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) +![VAMT in the enterprise.](images/dep-win8-l-vamt-image001-enterprise.jpg) In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. @@ -54,7 +54,7 @@ The Isolated Lab environment is a workgroup that is physically separate from the The following screenshot shows the VAMT graphical user interface. -![VAMT user interface](images/vamtuserinterfaceupdated.jpg) +![VAMT user interface.](images/vamtuserinterfaceupdated.jpg) VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 443e1e417b..71d990f500 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -120,7 +120,7 @@ In the core network, a centralized KMS solution is recommended. You can also use A typical core network that includes a KMS host is shown in Figure 1. -![Typical core network](../images/volumeactivationforwindows81-01.jpg) +![Typical core network.](../images/volumeactivationforwindows81-01.jpg) **Figure 1**. Typical core network @@ -140,7 +140,7 @@ If the isolated network cannot communicate with the core network’s KMS server, If the network is fully isolated, MAK-independent activation would be the recommended choice, perhaps using the telephone option. But VAMT proxy activation may also be possible. You can also use MAKs to activate new computers during setup, before they are placed in the isolated network. -![New KMS host in an isolated network](../images/volumeactivationforwindows81-02.jpg) +![New KMS host in an isolated network.](../images/volumeactivationforwindows81-02.jpg) **Figure 2**. New KMS host in an isolated network @@ -222,7 +222,7 @@ The flow of KMS activation is shown in Figure 3, and it follows this sequence: 7. If the KMS host has a KMS host key that matches the products in the GVLK, the KMS host sends a single packet back to the client. This packet contains a count of the number of computers that have requested activation from this KMS host. 8. If the count exceeds the activation threshold for the product that is being activated, the client is activated. If the activation threshold has not yet been met, the client will try again. -![KMS activation flow](../images/volumeactivationforwindows81-03.jpg) +![KMS activation flow.](../images/volumeactivationforwindows81-03.jpg) **Figure 3**. KMS activation flow diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 2716a475b8..118a656e49 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -25,7 +25,7 @@ In this scenario, the Volume Activation Management Tool (VAMT) is deployed in th - Retail The Secure Zone represents higher-security Core Network computers that have additional firewall protection. -![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) +![VAMT firewall configuration for multiple subnets.](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) ## In This Topic - [Install and start VAMT on a networked host computer](#bkmk-partone) diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index 84e0a8ea19..d3b906680d 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -19,7 +19,7 @@ ms.topic: article In this scenario, the Volume Activation Management Tool (VAMT) is used to activate products that are installed on workgroup computers in an isolated lab environment. For workgroups which are isolated from the larger network, you can perform proxy activation of Multiple Activation Keys (MAKs), KMS Host keys (CSVLKs), Generic Volume License Keys (GVLKs) (or KMS client keys), or retail keys. Proxy activation is performed by installing a second instance of VAMT on a computer in the isolated workgroup. You can then use removable media to transfer VAMT Computer Information Lists (CILXs) between the instance of VAMT in the isolated workgroup and another VAMT host that has Internet access. The following diagram shows a Multiple Activation Key (MAK) proxy activation scenario: -![VAMT MAK proxy activation scenario](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) +![VAMT MAK proxy activation scenario.](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) ## Step 1: Install VAMT on a Workgroup Computer in the Isolated Lab diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index c8e7913ed2..562251c0a9 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -51,7 +51,7 @@ You can use the VAMT to complete the activation process in products by using MAK The VAMT provides an overview of the activation and licensing status of computers across your network, as shown in Figure 18. Several prebuilt reports are also available to help you proactively manage licensing. -![VAMT showing the licensing status of multiple computers](../images/volumeactivationforwindows81-18.jpg) +![VAMT showing the licensing status of multiple computers.](../images/volumeactivationforwindows81-18.jpg) **Figure 18**. The VAMT showing the licensing status of multiple computers @@ -59,7 +59,7 @@ The VAMT provides an overview of the activation and licensing status of computer The VAMT makes it easier to track the various keys that are issued to your organization. You can enter each key into VAMT, and then the VAMT can use those keys for online or proxy activation of clients. The tool can also describe what type of key it is and to which product group it belongs. The VAMT is the most convenient way to quickly determine how many activations remain on a MAK. Figure 19 shows an example of key types and usage. -![VAMT showing key types and usage](../images/volumeactivationforwindows81-19.jpg) +![VAMT showing key types and usage.](../images/volumeactivationforwindows81-19.jpg) **Figure 19**. The VAMT showing key types and usage diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 844c46ba14..55fd4c1684 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -30,7 +30,7 @@ The current known issues with the Volume Activation Management Tool (VAMT), vers Another known issue is that when you try to add a Windows 10 Key Management Service (KMS) Host key (CSVLK) or a Windows Server 2012 R2 for Windows 10 CSVLK into VAMT 3.1 (version 10.0.10240.0), you receive the error message shown here. -![VAMT error message](./images/vamt-known-issue-message.png) +![VAMT error message.](./images/vamt-known-issue-message.png) This issue occurs because VAMT 3.1 does not contain the correct Pkconfig files to recognize this kind of key. To work around this issue, use one of the following methods. diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md index 3bda096ca5..2a0f0da2a9 100644 --- a/windows/deployment/windows-10-deployment-posters.md +++ b/windows/deployment/windows-10-deployment-posters.md @@ -26,13 +26,13 @@ The following posters step through various options for deploying Windows 10 with The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format. -[![Deploy Windows 10 with Autopilot](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) +[![Deploy Windows 10 with Autopilot.](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) ## Deploy Windows 10 with Microsoft Endpoint Configuration Manager The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format. -[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) +[![Deploy Windows 10 with Configuration Manager.](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) ## See also diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index a90baefd20..0e160f2943 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -42,7 +42,7 @@ Windows 10, version 1709 is available starting on 10/17/2017 in all relevant dis For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: -![Images](images/table01.png) +![Images.](images/table01.png) When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. @@ -69,7 +69,7 @@ This Semi-Annual Channel release of Windows 10 continues the Windows as a servic See the following example for Windows 10, version 1709: -![Windows 10, version 1709 lang pack](images/lang-pack-1709.png) +![Windows 10, version 1709 lang pack.](images/lang-pack-1709.png) ### Features on demand diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index 7e6d238721..9d18e1af46 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -284,7 +284,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 10. In the **Operating Systems** > **Windows 10** node, double-click the operating system that was added to view its properties. Change the operating system name to **Windows 10 Enterprise x64 Custom Image** and then click **OK**. See the following example: - ![custom image](images/image.png) + ![custom image.](images/image.png) ### Create the deployment task sequence @@ -459,7 +459,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed. 8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes. When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator. - ![finish](images/deploy-finish.png) + ![finish.](images/deploy-finish.png) This completes the demonstration of how to deploy a reference image to the network. To conserve resources, turn off the PC2 VM before starting the next section. diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 603113f920..d69cc3b5db 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -331,7 +331,7 @@ WDSUTIL /Set-Server /AnswerClients:None - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. See the following example: - ![Config Mgr PXE](images/configmgr-pxe.png) + ![Config Mgr PXE.](images/configmgr-pxe.png) 5. Click **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: @@ -803,7 +803,7 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce >Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. -![contoso.com\Computers](images/poc-computers.png) +![contoso.com\Computers.](images/poc-computers.png) In the replace procedure, PC1 will not be migrated to a new operating system. It is simplest to perform this procedure before performing the refresh procedure. After refreshing PC1, the operating system will be new. The next (replace) procedure does not install a new operating system on PC1 but rather performs a side-by-side migration of PC1 and another computer (PC4), to copy users and settings from PC1 to the new computer. @@ -907,7 +907,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 14. Click the **Site** tab, click **Configure Settings**, and click **Find Site**. The client will report that it has found the PS1 site. See the following example: - ![site](images/configmgr-site.png) + ![site.](images/configmgr-site.png) If the client is not able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the site code is not located is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode** this must be deleted or updated. @@ -915,7 +915,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 16. Click **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: - ![client](images/configmgr-client.png) + ![client.](images/configmgr-client.png) >It might take several minutes for the client to fully register with the site and complete a client check. When it is complete you will see a green check mark over the client icon as shown above. To refresh the client, click it and then press **F5** or right-click the client and click **Refresh**. @@ -976,7 +976,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 11. Click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. Verify that **PC4** is displayed in the collection. You might have to update and refresh the collection, or wait a few minutes, but do not proceed until PC4 is available. See the following example: - ![collection](images/configmgr-collection.png) + ![collection.](images/configmgr-collection.png) ### Create a device collection for PC1 @@ -1026,7 +1026,7 @@ In the Configuration Manager console, in the Software Library workspace under Op 4. In the Software Center , click **Available Software** and then select the **Replace Task Sequence** checkbox. See the following example: - ![software](images/configmgr-software-cntr.png) + ![software.](images/configmgr-software-cntr.png) >If you do not see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. @@ -1064,17 +1064,17 @@ In the Configuration Manager console, in the Software Library workspace under Op 3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. 4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: - ![installOS](images/configmgr-install-os.png) + ![installOS.](images/configmgr-install-os.png) The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: - ![asset](images/configmgr-asset.png) + ![asset.](images/configmgr-asset.png) You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. - ![post-refresh](images/configmgr-post-refresh.png) + ![post-refresh.](images/configmgr-post-refresh.png) ## Related Topics diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 319121950d..d4a667a65b 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -150,7 +150,7 @@ Hardware requirements are displayed below: The lab architecture is summarized in the following diagram: -![PoC diagram](images/poc.png) +![PoC diagram.](images/poc.png) - Computer 1 is configured to host four VMs on a private, PoC network. - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. @@ -224,9 +224,9 @@ Starting with Windows 8, the host computer’s microprocessor must support secon >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![hyper-v features](images/hyper-v-feature.png) + ![hyper-v features.](images/hyper-v-feature.png) - ![hyper-v](images/svr_mgr2.png) + ![hyper-v.](images/svr_mgr2.png)

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -449,7 +449,7 @@ Notes:
3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd 1](images/disk2vhd.png) + ![disk2vhd 1.](images/disk2vhd.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -482,7 +482,7 @@ Notes:
5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd 2](images/disk2vhd-gen2.png) + ![disk2vhd 2.](images/disk2vhd-gen2.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -506,7 +506,7 @@ Notes:
3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. 4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: - ![disk2vhd 3](images/disk2vhd4.png) + ![disk2vhd 3.](images/disk2vhd4.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -821,7 +821,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. - ![PoC 1](images/installing-drivers.png) + ![PoC 1.](images/installing-drivers.png) >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. @@ -879,7 +879,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to See the following example: - ![ISE 1](images/ISE.png) + ![ISE 1.](images/ISE.png) 19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. 20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1: diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 447ea81cfb..16e8c70c2a 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -65,7 +65,7 @@ To support Inherited Activation, both the host computer and the VM must be runni The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. -![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) +![Illustration of how Windows 10 deployment has evolved.](images/sa-evolution.png) - **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
@@ -117,11 +117,11 @@ If the device is running Windows 10, version 1809 or later: - When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: - ![Subscription Activation with MFA example 1](images/sa-mfa1.png)
+ ![Subscription Activation with MFA example 1.](images/sa-mfa1.png)
- ![Subscription Activation with MFA example 2](images/sa-mfa2.png)
+ ![Subscription Activation with MFA example 2.](images/sa-mfa2.png)
- ![Subscription Activation with MFA example 3](images/sa-mfa3.png) + ![Subscription Activation with MFA example 3.](images/sa-mfa3.png) ### Windows 10 Education requirements @@ -162,7 +162,7 @@ The device is AAD joined from **Settings > Accounts > Access work or school**. The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. -![Windows 10 Enterprise](images/ent.png) +![Windows 10 Enterprise.](images/ent.png) When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. @@ -171,10 +171,10 @@ Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, versio The following figures summarize how the Subscription Activation model works: Before Windows 10, version 1903:
-![1703](images/before.png) +![1703.](images/before.png) After Windows 10, version 1903:
-![1903](images/after.png) +![1903.](images/after.png) > [!NOTE] > diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index d132aa99a6..74e099fc82 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -115,9 +115,9 @@ When you are prompted to restart the computer, choose **Yes**. The computer migh Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![Hyper-V feature](images/hyper-v-feature.png) + ![Hyper-V feature.](images/hyper-v-feature.png) - ![Hyper-V](images/svr_mgr2.png) + ![Hyper-V.](images/svr_mgr2.png)

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -232,21 +232,21 @@ PS C:\autopilot> Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: - ![Windows setup example 1](images/winsetup1.png) - ![Windows setup example 2](images/winsetup2.png) - ![Windows setup example 3](images/winsetup3.png) - ![Windows setup example 4](images/winsetup4.png) - ![Windows setup example 5](images/winsetup5.png) - ![Windows setup example 6](images/winsetup6.png) + ![Windows setup example 1.](images/winsetup1.png) + ![Windows setup example 2.](images/winsetup2.png) + ![Windows setup example 3.](images/winsetup3.png) + ![Windows setup example 4.](images/winsetup4.png) + ![Windows setup example 5.](images/winsetup5.png) + ![Windows setup example 6.](images/winsetup6.png) After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: - ![Windows setup example 7](images/winsetup7.png) + ![Windows setup example 7.](images/winsetup7.png) Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. > [!div class="mx-imgBorder"] - > ![Windows setup example 8](images/winsetup8.png) + > ![Windows setup example 8.](images/winsetup8.png) To create a checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: @@ -322,7 +322,7 @@ Follow these steps to run the PowerShell script: > [!NOTE] > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. - ![Serial number and hardware hash](images/hwid.png) + ![Serial number and hardware hash.](images/hwid.png) You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). @@ -338,11 +338,11 @@ With the hardware ID captured in a file, prepare your Virtual Machine for Window On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**. -![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) +![Reset this PC final prompt.](images/autopilot-reset-prompt.jpg) Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process. -![Reset this PC screen capture](images/autopilot-reset-progress.jpg) +![Reset this PC screen capture.](images/autopilot-reset-progress.jpg) ## Verify subscription level @@ -350,13 +350,13 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** -![MDM and Intune](images/mdm-intune2.png) +![MDM and Intune.](images/mdm-intune2.png) If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. -![License conversion option](images/aad-lic1.png) +![License conversion option.](images/aad-lic1.png) ## Configure company branding @@ -367,7 +367,7 @@ If you already have company branding configured in Azure Active Directory, you c Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. -![Configure company branding](images/branding.png) +![Configure company branding.](images/branding.png) When you are finished, click **Save**. @@ -382,7 +382,7 @@ Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. -![MDM user scope in the Mobility blade](images/ap-aad-mdm.png) +![MDM user scope in the Mobility blade.](images/ap-aad-mdm.png) ## Register your VM @@ -392,14 +392,14 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B 1. In the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), choose **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices** and then on the **Windows Autopilot devices** page, choose **Import**. - ![Intune device import](images/enroll1.png) + ![Intune device import.](images/enroll1.png) > [!NOTE] > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. 2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. - ![HWID CSV](images/enroll2.png) + ![HWID CSV.](images/enroll2.png) You should receive confirmation that the file is formatted correctly before uploading it, as shown above. @@ -407,7 +407,7 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B 4. Click **Refresh** to verify your VM or device has been added. See the following example. - ![Import HWID](images/enroll3.png) + ![Import HWID.](images/enroll3.png) ### Autopilot registration using MSfB @@ -426,11 +426,11 @@ Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft. Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: -![Microsoft Store for Business](images/msfb.png) +![Microsoft Store for Business.](images/msfb.png) Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. -![Microsoft Store for Business Devices](images/msfb-device.png) +![Microsoft Store for Business Devices.](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile @@ -446,7 +446,7 @@ Pick one: > [!NOTE] > Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list. -![Devices](images/enroll4.png) +![Devices.](images/enroll4.png) #### Create a device group @@ -463,7 +463,7 @@ The Autopilot deployment profile wizard will ask for a device group, so we must 3. Click **Members** and add the Autopilot VM to the group. See the following example: > [!div class="mx-imgBorder"] - > ![add members](images/group1.png) + > ![add members.](images/group1.png) 4. Click **Create**. @@ -472,12 +472,12 @@ The Autopilot deployment profile wizard will ask for a device group, so we must To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. > [!div class="mx-imgBorder"] -> ![Deployment profiles](images/dp.png) +> ![Deployment profiles.](images/dp.png) Click on **Create profile** and then select **Windows PC**. > [!div class="mx-imgBorder"] -> ![Create deployment profile](images/create-profile.png) +> ![Create deployment profile.](images/create-profile.png) On the **Create profile** blade, use the following values: @@ -512,7 +512,7 @@ Click **Next** to continue with the **Assignments** settings: 2. Click the **Autopilot Lab** group, and then click **Select**. 3. Click **Next** to continue and then click **Create**. See the following example: -![Deployment profile](images/profile.png) +![Deployment profile.](images/profile.png) Click on **OK** and then click on **Create**. @@ -529,7 +529,7 @@ First, sign in to the [Microsoft Store for Business](https://businessstore.micro Click **Manage** from the top menu, then click **Devices** from the left navigation tree. -![MSfB manage](images/msfb-manage.png) +![MSfB manage.](images/msfb-manage.png) Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. @@ -538,17 +538,17 @@ To CREATE the profile: Select your device from the **Devices** list: > [!div class="mx-imgBorder"] -> ![MSfB create step 1](images/msfb-create1.png) +> ![MSfB create step 1.](images/msfb-create1.png) On the Autopilot deployment dropdown menu, select **Create new profile**: > [!div class="mx-imgBorder"] -> ![MSfB create step 2](images/msfb-create2.png) +> ![MSfB create step 2.](images/msfb-create2.png) Name the profile, choose your desired settings, and then click **Create**: > [!div class="mx-imgBorder"] -> ![MSfB create step 3](images/msfb-create3.png) +> ![MSfB create step 3.](images/msfb-create3.png) The new profile is added to the Autopilot deployment list. @@ -557,12 +557,12 @@ To ASSIGN the profile: To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: > [!div class="mx-imgBorder"] -> ![MSfB assign step 1](images/msfb-assign1.png) +> ![MSfB assign step 1.](images/msfb-assign1.png) Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: > [!div class="mx-imgBorder"] -> ![MSfB assign step 2](images/msfb-assign2.png) +> ![MSfB assign step 2.](images/msfb-assign2.png) > [!IMPORTANT] > The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. @@ -572,7 +572,7 @@ Confirm the profile was successfully assigned to the intended device by checking If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: > [!div class="mx-imgBorder"] -> ![Device status](images/device-status.png) +> ![Device status.](images/device-status.png) Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. @@ -583,12 +583,12 @@ Also, make sure to wait at least 30 minutes from the time you've [configured com - Turn on the device - Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). -![OOBE sign-in page](images/autopilot-oobe.png) +![OOBE sign-in page.](images/autopilot-oobe.png) Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. > [!div class="mx-imgBorder"] -> ![Device enabled](images/devices1.png) +> ![Device enabled.](images/devices1.png) Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. @@ -606,7 +606,7 @@ To use the device (or VM) for other purposes after completion of this lab, you w You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu. > [!div class="mx-imgBorder"] -> ![Delete device step 1](images/delete-device1.png) +> ![Delete device step 1.](images/delete-device1.png) This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. @@ -618,7 +618,7 @@ The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion. > [!div class="mx-imgBorder"] -> ![Delete device](images/delete-device2.png) +> ![Delete device.](images/delete-device2.png) At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: @@ -686,7 +686,7 @@ Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-ms Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: > [!div class="mx-imgBorder"] -> ![Add app example](images/app01.png) +> ![Add app example.](images/app01.png) After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. @@ -696,20 +696,20 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app step 1](images/app02.png) +![Add app step 1.](images/app02.png) Under **App Type**, select **Windows app (Win32)**: -![Add app step 2](images/app03.png) +![Add app step 2.](images/app03.png) On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: > [!div class="mx-imgBorder"] -> ![Add app step 3](images/app04.png) +> ![Add app step 3.](images/app04.png) On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: -![Add app step 4](images/app05.png) +![Add app step 4.](images/app05.png) On the **Program Configuration** blade, supply the install and uninstall commands: @@ -721,7 +721,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q > [!NOTE] > Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file. -![Add app step 5](images/app06.png) +![Add app step 5.](images/app06.png) Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). @@ -730,23 +730,23 @@ Click **OK** to save your input and activate the **Requirements** blade. On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: > [!div class="mx-imgBorder"] -> ![Add app step 6](images/app07.png) +> ![Add app step 6.](images/app07.png) Next, configure the **Detection rules**. For our purposes, we will select manual format: > [!div class="mx-imgBorder"] -> ![Add app step 7](images/app08.png) +> ![Add app step 7.](images/app08.png) Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: -![Add app step 8](images/app09.png) +![Add app step 8.](images/app09.png) Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. **Return codes**: For our purposes, leave the return codes at their default values: > [!div class="mx-imgBorder"] -> ![Add app step 9](images/app10.png) +> ![Add app step 9.](images/app10.png) Click **OK** to exit. @@ -757,12 +757,12 @@ Click the **Add** button to finalize and save your app package. Once the indicator message says the addition has completed. > [!div class="mx-imgBorder"] -> ![Add app step 10](images/app11.png) +> ![Add app step 10.](images/app11.png) You will be able to find your app in your app list: > [!div class="mx-imgBorder"] -> ![Add app step 11](images/app12.png) +> ![Add app step 11.](images/app12.png) #### Assign the app to your Intune profile @@ -772,7 +772,7 @@ You will be able to find your app in your app list: In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: > [!div class="mx-imgBorder"] -> ![Assign app step 1](images/app13.png) +> ![Assign app step 1.](images/app13.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -783,10 +783,10 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Assign app step 2](images/app14.png) +![Assign app step 2.](images/app14.png) > [!div class="mx-imgBorder"] -> ![Assign app step 3](images/app15.png) +> ![Assign app step 3.](images/app15.png) In the **Select groups** pane, click the **Select** button. @@ -797,7 +797,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. > [!div class="mx-imgBorder"] -> ![Assign app step 4](images/app16.png) +> ![Assign app step 4.](images/app16.png) At this point, you have completed steps to add a Win32 app to Intune. @@ -811,16 +811,16 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Create app step 1](images/app17.png) +![Create app step 1.](images/app17.png) Under **App Type**, select **Office 365 Suite > Windows 10**: -![Create app step 2](images/app18.png) +![Create app step 2.](images/app18.png) Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: > [!div class="mx-imgBorder"] -> ![Create app step 3](images/app19.png) +> ![Create app step 3.](images/app19.png) Click **OK**. @@ -829,13 +829,13 @@ In the **App Suite Information** pane, enter a unique suite name, and a s Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. > [!div class="mx-imgBorder"] -> ![Create app step 4](images/app20.png) +> ![Create app step 4.](images/app20.png) Click **OK**. In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: -![Create app step 5](images/app21.png) +![Create app step 5.](images/app21.png) Click **OK** and then click **Add**. @@ -847,7 +847,7 @@ Click **OK** and then click **Add**. In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: > [!div class="mx-imgBorder"] -> ![Create app step 6](images/app22.png) +> ![Create app step 6.](images/app22.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -857,10 +857,10 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Create app step 7](images/app23.png) +![Create app step 7.](images/app23.png) > [!div class="mx-imgBorder"] -> ![Create app step 8](images/app24.png) +> ![Create app step 8.](images/app24.png) In the **Select groups** pane, click the **Select** button. @@ -870,7 +870,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Create app step 9](images/app25.png) +![Create app step 9.](images/app25.png) At this point, you have completed steps to add Office to Intune. @@ -878,7 +878,7 @@ For more information on adding Office apps to Intune, see [Assign Office 365 app If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: -![Create app step 10](images/app26.png) +![Create app step 10.](images/app26.png) ## Glossary diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 0d04abd1e0..04f798b127 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -29,7 +29,7 @@ In this topic, you also learn about different types of reference images that you Windows ADK contains core assessment and deployment tools and technologies, including Deployment Image Servicing and Management (DISM), Windows Imaging and Configuration Designer (Windows ICD), Windows System Image Manager (Windows SIM), User State Migration Tool (USMT), Volume Activation Management Tool (VAMT), Windows Preinstallation Environment (Windows PE), Windows Assessment Services, Windows Performance Toolkit (WPT), Application Compatibility Toolkit (ACT), and Microsoft SQL Server 2012 Express. For more details, see [Windows ADK for Windows 10](/windows-hardware/get-started/adk-install) or [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). -![figure 1](images/win-10-adk-select.png) +![figure 1.](images/win-10-adk-select.png) The Windows 10 ADK feature selection page. @@ -50,7 +50,7 @@ Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source D:\Sources\SxS -LimitAccess ``` -![figure 2](images/mdt-11-fig05.png) +![figure 2.](images/mdt-11-fig05.png) Using DISM functions in PowerShell. @@ -77,7 +77,7 @@ In addition to these tools, there are also XML templates that manage which data - **Custom templates.** Custom templates that you create. - **Config template.** An optional template, called Config.xml, which you can use to exclude or include components in a migration without modifying the other standard XML templates. -![figure 3](images/mdt-11-fig06.png) +![figure 3.](images/mdt-11-fig06.png) A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. @@ -100,7 +100,7 @@ These are the settings migrated by the default MigUser.xml and MigApp.xml templa Windows Imaging and Configuration Designer (Windows ICD) is a tool designed to assist with the creation of provisioning packages that can be used to dynamically configure a Windows device (PCs, tablets, and phones). This is particularly useful for setting up new devices, without the need for re-imaging the device with a custom image. -![figure 4](images/windows-icd.png) +![figure 4.](images/windows-icd.png) Windows Imaging and Configuration Designer. @@ -110,7 +110,7 @@ For more information, see [Windows Imaging and Configuration Designer](/windows/ Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or Configuration Manager, you don’t need Windows SIM very often because those systems automatically update the Unattend.xml file during the deployment, greatly simplifying the process overall. -![figure 7](images/mdt-11-fig07.png) +![figure 7.](images/mdt-11-fig07.png) Windows answer file opened in Windows SIM. @@ -120,7 +120,7 @@ For more information, see [Windows System Image Manager Technical Reference]( ht If you don’t use KMS, you can still manage your MAKs centrally with the Volume Activation Management Tool (VAMT). With this tool, you can install and manage product keys throughout the organization. VAMT also can activate on behalf of clients without Internet access, acting as a MAK proxy. -![figure 6](images/mdt-11-fig08.png) +![figure 6.](images/mdt-11-fig08.png) The updated Volume Activation Management Tool. @@ -138,7 +138,7 @@ Windows PE is a “Lite” version of Windows 10 and was created to act as a dep The key thing to know about Windows PE is that, like the operating system, it needs drivers for at least network and storage devices in each PC. Luckily Windows PE includes the same drivers as the full Windows 10 operating system, which means much of your hardware will work out of the box. -![figure 7](images/mdt-11-fig09.png) +![figure 7.](images/mdt-11-fig09.png) A machine booted with the Windows ADK default Windows PE boot image. @@ -149,7 +149,7 @@ For more details on Windows PE, see [Windows PE (WinPE)](/windows-hardware/manuf Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you will see an automatic failover into Windows RE. -![figure 8](images/mdt-11-fig10.png) +![figure 8.](images/mdt-11-fig10.png) A Windows 10 client booted into Windows RE, showing Advanced options. @@ -160,7 +160,7 @@ For more information on Windows RE, see [Windows Recovery Environment](/windows- Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you will use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker. -![figure 9](images/mdt-11-fig11.png) +![figure 9.](images/mdt-11-fig11.png) Windows Deployment Services using multicast to deploy three machines. @@ -176,7 +176,7 @@ Also, there are a few new features related to TFTP performance: - **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. - **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. -![figure 10](images/mdt-11-fig12.png) +![figure 10.](images/mdt-11-fig12.png) TFTP changes are now easy to perform. @@ -192,7 +192,7 @@ Lite Touch and Zero Touch are marketing names for the two solutions that MDT sup -![figure 11](images/mdt-11-fig13.png) +![figure 11.](images/mdt-11-fig13.png) The Deployment Workbench in, showing a task sequence. @@ -203,7 +203,7 @@ For more information on MDT, see the [Microsoft Deployment Toolkit](/mem/configm [Microsoft SCM](https://go.microsoft.com/fwlink/p/?LinkId=619246) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer. -![figure 12](images/mdt-11-fig14.png) +![figure 12.](images/mdt-11-fig14.png) The SCM console showing a baseline configuration for a fictional client's computer security compliance. @@ -228,7 +228,7 @@ For more information on the benefits of an MDOP subscription, see [Microsoft Des There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file. -![figure 13](images/mdt-11-fig15.png) +![figure 13.](images/mdt-11-fig15.png) The User Experience selection screen in IEAK 11. @@ -239,7 +239,7 @@ To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Inform WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. -![figure 14](images/mdt-11-fig16.png) +![figure 14.](images/mdt-11-fig16.png) The Windows Server Update Services console. diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index 930819c367..5852e85928 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -64,7 +64,7 @@ Note that this setting does not control whether your device sends diagnostic dat 2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn on data viewing](images/ddv-data-viewing.png) + ![Location to turn on data viewing.](images/ddv-data-viewing.png) **To turn on data viewing through PowerShell** @@ -134,7 +134,7 @@ When you're done reviewing your diagnostic data, we recommend turning off data v 2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn off data viewing](images/ddv-settings-off.png) + ![Location to turn off data viewing.](images/ddv-settings-off.png) **To turn off data viewing through PowerShell** diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 3b40651ee2..dc9a127179 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -38,7 +38,7 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn 2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn on data viewing](images/ddv-data-viewing.png) + ![Location to turn on data viewing.](images/ddv-data-viewing.png) ### Download the Diagnostic Data Viewer Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. @@ -54,7 +54,7 @@ You can start this app from the **Settings** panel. 2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button. - ![Location to turn on the Diagnostic Data Viewer](images/ddv-settings-launch.png)

-OR-

+ ![Location to turn on the Diagnostic Data Viewer.](images/ddv-settings-launch.png)

-OR-

Go to **Start** and search for _Diagnostic Data Viewer_. @@ -73,7 +73,7 @@ The Diagnostic Data Viewer provides you with the following features to view and >[!Important] >Seeing an event does not necessarily mean it has been uploaded yet. It’s possible that some events are still queued and will be uploaded at a later time. - ![View your diagnostic events](images/ddv-event-view.jpg) + ![View your diagnostic events.](images/ddv-event-view.jpg) - **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text. @@ -83,7 +83,7 @@ The Diagnostic Data Viewer provides you with the following features to view and - **Help to make your Windows experience better.** Microsoft only needs diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others. - To signify your contribution, you’ll see this icon (![Icon to review the device-level sampling](images/ddv-device-sample.png)) if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon (![Icon to review the event-level sampling](images/ddv-event-sample.png)). + To signify your contribution, you’ll see this icon (![Icon to review the device-level sampling.](images/ddv-device-sample.png)) if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon (![Icon to review the event-level sampling](images/ddv-event-sample.png)). - **Provide diagnostic event feedback.** The **Feedback** icon in the upper right corner of the window opens the Feedback Hub app, letting you provide feedback about the Diagnostic Data Viewer and the diagnostic events. @@ -99,7 +99,7 @@ The Diagnostic Data Viewer provides you with the following features to view and >[!Important] >This content is a reflection of the history of Windows data the app has stored. If you'd like to have extended analyses, please modify the storage capacity of Diagnostic Data Viewer. - ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer](images/ddv-analytics.png) + ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer.](images/ddv-analytics.png) ## View Office Diagnostic Data By default, Diagnostic Data Viewer shows you Windows data. You can also view Office diagnostic data by enabling the feature in the app settings page. To learn more about how to view Office diagnostic data, please visit this [page](https://go.microsoft.com/fwlink/?linkid=2023830). @@ -112,7 +112,7 @@ When you're done reviewing your diagnostic data, you should turn of data viewing 2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn off data viewing](images/ddv-settings-off.png) + ![Location to turn off data viewing.](images/ddv-settings-off.png) ## Modifying the size of your data history By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first. @@ -139,7 +139,7 @@ You can also use the Windows Error Reporting tool available in the Control Panel Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer. -![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer](images/ddv-problem-reports.png) +![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer.](images/ddv-problem-reports.png) **To view your Windows Error Reporting diagnostic data using the Control Panel** @@ -147,7 +147,7 @@ Go to **Start**, select **Control Panel** > **All Control Panel Items** > **Secu Go to **Start** and search for _Problem Reports_. The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft. -![View problem reports tool with report statuses](images/control-panel-problem-reports-screen.png) +![View problem reports tool with report statuses.](images/control-panel-problem-reports-screen.png) ## Known Issues with Diagnostic Data Viewer diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index aad2616468..f1f0d9469a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -57,60 +57,60 @@ The following table lists management options for each setting, beginning with Wi | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [9. License Manager](#bkmk-licmgr) | | | ![Check mark](images/checkmark.png) | -| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [5. Find My Device](#find-my-device) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [6. Font streaming](#font-streaming) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [9. License Manager](#bkmk-licmgr) | | | ![Check mark.](images/checkmark.png) | +| [10. Live Tiles](#live-tiles) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark.](images/checkmark.png) | | ![Check mark.](images/checkmark.png) | +| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark.](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [16. OneDrive](#bkmk-onedrive) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.1 General](#bkmk-general) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.22 Activity History](#bkmk-act-history) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [20. Storage Health](#bkmk-storage-health) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Teredo](#bkmk-teredo) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [29. Windows Update](#bkmk-wu) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | -| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ### Settings for Windows Server 2016 with Desktop Experience @@ -119,20 +119,20 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [6. Font streaming](#font-streaming) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [10. Live Tiles](#live-tiles) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [16. OneDrive](#bkmk-onedrive) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Teredo](#bkmk-teredo) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -172,54 +172,54 @@ See the following table for a summary of the management settings for Windows Ser | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [5. Find My Device](#find-my-device) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.1 General](#bkmk-general) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.22 Activity History](#bkmk-act-history) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | | [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 8ac3729427..69dba47679 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -592,7 +592,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s > **Note**  You might have to delegate permissions to join computers to the domain if the account that joins the workstations to the domain does not already have them. For more information, see [Delegation of Administration in Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx). - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample1.gif) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample1.gif) 3. Close Active Directory Users and Computers. @@ -600,13 +600,13 @@ In this procedure, the workstations are dedicated to domain administrators. By s 5. Right-click the new OU, and > **Create a GPO in this domain, and Link it here**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample2.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample2.png) 6. Name the GPO, and > **OK**. 7. Expand the GPO, right-click the new GPO, and > **Edit**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample3.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample3.png) 8. Configure which members of accounts can log on locally to these administrative workstations as follows: @@ -625,7 +625,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s 5. Click **Add User or Group**, type **Administrators**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample4.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample4.png) 9. Configure the proxy configuration: @@ -633,7 +633,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s 2. Double-click **Proxy Settings**, select the **Enable proxy settings** check box, type **127.0.0.1** (the network Loopback IP address) as the proxy address, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample5.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample5.png) 10. Configure the loopback processing mode to enable the user Group Policy proxy setting to apply to all users on the computer as follows: @@ -696,11 +696,11 @@ In this procedure, the workstations are dedicated to domain administrators. By s 1. Right-click **Windows Firewall with Advanced Security LDAP://path**, and > **Properties**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample6.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample6.png) 2. On each profile, ensure that the firewall is enabled and that inbound connections are set to **Block all connections**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample7.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample7.png) 3. Click **OK** to complete the configuration. @@ -738,11 +738,11 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Right-click **Group Policy Objects**, and > **New**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample1.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample1.png) 4. In the **New GPO** dialog box, name the GPO that restricts administrators from signing in to workstations, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample2.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample2.png) 5. Right-click **New GPO**, and > **Edit**. @@ -756,7 +756,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Click **Add User or Group**, click **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample3.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample3.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -778,7 +778,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample4.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample4.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -791,7 +791,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 6. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample5.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample5.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -804,11 +804,11 @@ For this procedure, do not link accounts to the OU that contain workstations for 1. Right-click the workstation OU, and then > **Link an Existing GPO**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample6.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample6.png) 2. Select the GPO that you just created, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample7.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample7.png) 10. Test the functionality of enterprise applications on workstations in the first OU and resolve any issues caused by the new policy. @@ -831,7 +831,7 @@ It is a best practice to configure the user objects for all sensitive accounts i As with any configuration change, test this enabled setting fully to ensure that it performs correctly before you implement it. -![Active Directory local accounts](images/adlocalaccounts-proc3-sample1.png) +![Active Directory local accounts.](images/adlocalaccounts-proc3-sample1.png) ## Secure and manage domain controllers diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index d67808e585..6ad17afded 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -367,15 +367,15 @@ The following table shows the Group Policy and registry settings that are used t 3. In the console tree, right-click **Group Policy Objects**, and > **New**. - ![local accounts 1](images/localaccounts-proc1-sample1.png) + ![local accounts 1.](images/localaccounts-proc1-sample1.png) 4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. - ![local accounts 2](images/localaccounts-proc1-sample2.png) + ![local accounts 2.](images/localaccounts-proc1-sample2.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 3](images/localaccounts-proc1-sample3.png) + ![local accounts 3.](images/localaccounts-proc1-sample3.png) 6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by doing the following: @@ -391,7 +391,7 @@ The following table shows the Group Policy and registry settings that are used t 2. Right-click **Registry**, and > **New** > **Registry Item**. - ![local accounts 4](images/localaccounts-proc1-sample4.png) + ![local accounts 4.](images/localaccounts-proc1-sample4.png) 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. @@ -407,7 +407,7 @@ The following table shows the Group Policy and registry settings that are used t 9. Verify this configuration, and > **OK**. - ![local accounts 5](images/localaccounts-proc1-sample5.png) + ![local accounts 5.](images/localaccounts-proc1-sample5.png) 8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: @@ -415,7 +415,7 @@ The following table shows the Group Policy and registry settings that are used t 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - ![local accounts 6](images/localaccounts-proc1-sample6.png) + ![local accounts 6.](images/localaccounts-proc1-sample6.png) 3. Select the GPO that you just created, and > **OK**. @@ -495,11 +495,11 @@ The following table shows the Group Policy settings that are used to deny networ 4. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it is being used to restrict the local administrative accounts from interactively signing in to the computer. - ![local accounts 7](images/localaccounts-proc2-sample1.png) + ![local accounts 7.](images/localaccounts-proc2-sample1.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 8](images/localaccounts-proc2-sample2.png) + ![local accounts 8.](images/localaccounts-proc2-sample2.png) 6. Configure the user rights to deny network logons for administrative local accounts as follows: diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index e770d29de4..be0a573f71 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -52,7 +52,7 @@ SIDs always remain unique. Security authorities never issue the same SID twice, A security identifier is a data structure in binary format that contains a variable number of values. The first values in the structure contain information about the SID structure. The remaining values are arranged in a hierarchy (similar to a telephone number), and they identify the SID-issuing authority (for example, “NT Authority”), the SID-issuing domain, and a particular security principal or group. The following image illustrates the structure of a SID. -![Security identifier architecture](images/security-identifider-architecture.jpg) +![Security identifier architecture.](images/security-identifider-architecture.jpg) The individual values of a SID are described in the following table. diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index 26564af45a..293acd13c9 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -42,7 +42,7 @@ The following diagram illustrates the Windows authorization and access control **Authorization and access control process** -![authorization and access control process](images/authorizationandaccesscontrolprocess.gif) +![authorization and access control process.](images/authorizationandaccesscontrolprocess.gif) Security principals are closely related to the following components and technologies: diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index f055141697..9423de2923 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -52,11 +52,11 @@ On the device, perform the following steps: (add select certificate) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. - :::image type="content" alt-text="settings icon in mail app" source="images/mailsettings.png"::: + :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: 3. Tap **Email security**. - :::image type="content" alt-text="email security settings" source="images/emailsecurity.png"::: + :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: 4. In **Select an account**, select the account for which you want to configure S/MIME options. @@ -77,7 +77,7 @@ On the device, perform the following steps: (add select certificate) 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. - :::image type="content" alt-text="sign or encrypt message" source="images/signencrypt.png"::: + :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: ## Read signed or encrypted messages @@ -93,5 +93,5 @@ When you receive a signed email, the app provide feature to install correspondin 3. Tap **Install.** - :::image type="content" alt-text="message security information" source="images/installcert.png"::: + :::image type="content" alt-text="message security information." source="images/installcert.png":::   \ No newline at end of file diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 8d0219c5dd..b122158529 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -33,7 +33,7 @@ When Windows Defender Credential Guard is enabled, Kerberos does not allow uncon Here's a high-level overview on how the LSA is isolated by using virtualization-based security: -![Windows Defender Credential Guard overview](images/credguard.png) +![Windows Defender Credential Guard overview.](images/credguard.png) ## See also diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index c737034fd5..936172770d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -45,7 +45,7 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will 5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](../../threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) for more details. - ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp-2.png) + ![Windows Defender Credential Guard Group Policy setting.](images/credguard-gp-2.png) 6. Close the Group Policy Management Console. @@ -168,7 +168,7 @@ You can view System Information to check that Windows Defender Credential Guard Here's an example: > [!div class="mx-imgBorder"] - > ![System Information](images/credguard-msinfo32.png) + > ![System Information.](images/credguard-msinfo32.png) You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index 8a678b6ff4..fea29a3fc3 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -176,7 +176,7 @@ Certutil writes the binary information to the following registration location: | Value | Binary contents from the certificate pin rules certificate trust list file | | Data type | REG_BINARY | -![Registry binary information](images/enterprise-pinning-registry-binary-information.png) +![Registry binary information.](images/enterprise-pinning-registry-binary-information.png) ### Deploying Enterprise Pin Rule Settings using Group Policy @@ -203,7 +203,7 @@ Sign-in to the reference computer using domain administrator equivalent credenti 11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box. - ![PinRules Properties](images/enterprise-certificate-pinning-pinrules-properties.png) + ![PinRules Properties.](images/enterprise-certificate-pinning-pinrules-properties.png) 12. Close the **Group Policy Management Editor** to save your settings. 13. Link the **Enterprise Certificate Pinning Rules** Group Policy object to apply to computers that run Windows 10, version 1703 in your enterprise. When these domain-joined computers apply Group Policy, the registry information configured in the Group Policy object is applied to the computer. @@ -258,7 +258,7 @@ These dates must be properly formatted and represented in UTC. You can use Windows PowerShell to format these dates. You can then copy and paste the output of the cmdlet into the XML file. -![Representing a date](images/enterprise-certificate-pinning-representing-a-date.png) +![Representing a date.](images/enterprise-certificate-pinning-representing-a-date.png) For simplicity, you can truncate decimal point (.) and the numbers after it. However, be certain to append the uppercase “Z” to the end of the XML date string. @@ -272,7 +272,7 @@ However, be certain to append the uppercase “Z” to the end of the XML date s You can also use Windows PowerShell to validate convert an XML date into a human readable date to validate it’s the correct date. -![Converting an XML date](images/enterprise-certificate-pinning-converting-an-xml-date.png) +![Converting an XML date.](images/enterprise-certificate-pinning-converting-an-xml-date.png) ## Representing a Duration in XML @@ -280,13 +280,13 @@ Some elements may be configured to use a duration rather than a date. You must represent the duration as an XML timespan data type. You can use Windows PowerShell to properly format and validate durations (timespans) and copy and paste them into your XML file. -![Representing a duration](images/enterprise-certificate-pinning-representing-a-duration.png) +![Representing a duration.](images/enterprise-certificate-pinning-representing-a-duration.png) ## Converting an XML Duration You can convert a XML formatted timespan into a timespan variable that you can read. -![Converting an XML duration](images/enterprise-certificate-pinning-converting-a-duration.png) +![Converting an XML duration.](images/enterprise-certificate-pinning-converting-a-duration.png) ## Certificate Trust List XML Schema Definition (XSD) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index b7018e4477..f80ffec25c 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -372,11 +372,11 @@ The Group Policy object contains the policy settings needed to trigger Windows H 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. - ![Group Policy Editor](images/multifactorUnlock/gpme.png) + ![Group Policy Editor.](images/multifactorUnlock/gpme.png) 8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values. - ![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) + ![Multifactor Policy Setting.](images/multifactorUnlock/gp-setting.png) 9. Configure first and second unlock factors using the information in [Configure Unlock Factors](#configuring-unlock-factors). diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index 16be1aa6bc..25d27e28d3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -38,23 +38,23 @@ Determining an adequate number of Windows Server domain controllers is important Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: -![dc-chart1](images/plan/dc-chart1.png) +![dc-chart1.](images/plan/dc-chart1.png) The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following: -![dc-chart2](images/plan/dc-chart2.png) +![dc-chart2.](images/plan/dc-chart2.png) The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients? -![dc-chart3](images/plan/dc-chart3.png) +![dc-chart3.](images/plan/dc-chart3.png) Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same. -![dc-chart4](images/plan/dc-chart4.png) +![dc-chart4.](images/plan/dc-chart4.png) Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. -![dc-chart5](images/plan/dc-chart5.png) +![dc-chart5.](images/plan/dc-chart5.png) You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index ab73eab4f9..f354ae19d4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -91,7 +91,7 @@ Sign-in the federation server with domain administrator equivalent credentials. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Repeat the same to add device registration service name (*enterpriseregistration.contoso.com*) as another alternative name. Click **OK** when finished. 10. Click **Enroll**. @@ -184,7 +184,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. -![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) +![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. 5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as *fs.corp.contoso.com* or *fs.contoso.com*. @@ -204,7 +204,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. -![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) +![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. 5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as fs.corp.mstepdemo.net or fs.mstepdemo.net. @@ -456,7 +456,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. 8. Click **Install** to start the feature installation. - ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) + ![Feature selection screen with NLB selected.](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -465,25 +465,25 @@ Before you can load balance all the nodes in the AD FS farm, you must first crea Sign-in a node of the federation farm with _Admin_ equivalent credentials. 1. Open **Network Load Balancing Manager** from **Administrative Tools**. - ![NLB Manager user interface](images/hello-nlb-manager.png) + ![NLB Manager user interface.](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. 3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. - ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) + ![NLB Manager - Connect to new Cluster screen.](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. 6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. - ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) + ![NLB Manager - Add IP to New Cluster screen.](images/hello-nlb-add-ip.png) 7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. - ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) + ![NLB Manager - Cluster IP Configuration screen.](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. 9. In Port Rules, click Edit to modify the default port rules to use port 443. - ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) + ![NLB Manager - Add\Edit Port Rule screen.](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. 2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. - ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) + ![NLB Manager - Cluster with nodes.](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 0686de8a9a..57f12a0692 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -34,7 +34,7 @@ To locate the schema master role holder, open and command prompt and type: ```Netdom query fsmo | findstr -i “schema”``` -![Netdom example output](images/hello-cmd-netdom.png) +![Netdom example output.](images/hello-cmd-netdom.png) The command should return the name of the domain controller where you need to adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index bafde6afc2..0bbce98b00 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -51,7 +51,7 @@ Three approaches are documented here: 1. Right-click the **Smartcard Logon** template and click **Duplicate Template** - ![Duplicating Smartcard Template](images/rdpcert/duplicatetemplate.png) + ![Duplicating Smartcard Template.](images/rdpcert/duplicatetemplate.png) 1. On the **Compatibility** tab: 1. Clear the **Show resulting changes** check box @@ -109,7 +109,7 @@ Three approaches are documented here: 1. In the Certificate Authority console, right-click **Certificate Templates**, select **New**, and select **Certificate Template to Issue** - ![Selecting Certificate Template to Issue](images/rdpcert/certificatetemplatetoissue.png) + ![Selecting Certificate Template to Issue.](images/rdpcert/certificatetemplatetoissue.png) 1. From the list of templates, select the template you previously created (**WHFB Certificate Authentication**) and click **OK**. It can take some time for the template to replicate to all servers and become available in this list. @@ -123,7 +123,7 @@ Three approaches are documented here: 1. In the left pane of the MMC, right-click **Personal**, click **All Tasks**, and then click **Request New Certificate…** - ![Request a new certificate](images/rdpcert/requestnewcertificate.png) + ![Request a new certificate.](images/rdpcert/requestnewcertificate.png) 1. On the Certificate Enrollment screen, click **Next**. diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 476aed7683..48a0d130df 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -29,7 +29,7 @@ When you set up Windows Hello in Windows 10, you may get an error during the ** The following image shows an example of an error during **Create a PIN**. -![PIN error](images/pinerror.png) +![PIN error.](images/pinerror.png) ## Error mitigations diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 0ecc622ba4..2fbed0b012 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -97,20 +97,20 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 1. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. - ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) + ![PIN reset service application in Azure.](images/pinreset/pin-reset-service-prompt.png) 1. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 1. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. - ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) + ![PIN reset client application in Azure.](images/pinreset/pin-reset-client-prompt.png) > [!NOTE] > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. 1. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. - :::image type="content" alt-text="PIN reset service permissions page" source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: + :::image type="content" alt-text="PIN reset service permissions page." source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: ### Configure Windows devices to use PIN reset using Group Policy @@ -210,7 +210,7 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - **Data type:** String - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be _signin.contoso.com;portal.contoso.com_ (without quotation marks) - :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy" source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: + :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy." source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: 1. Click the Save button to save the custom configuration. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 30dc6c78e6..b5361a656c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -55,7 +55,7 @@ Windows Hello for Business emulates a smart card for application compatibility. Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. > [!div class="mx-imgBorder"] -> ![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) +> ![WHFB Certificate GP Setting.](images/rdpbio/rdpbiopolicysetting.png) > [!IMPORTANT] > The remote desktop with biometric feature does not work with [Dual Enrollment](hello-feature-dual-enrollment.md) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index a90f1587c2..1efcc90b24 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -31,7 +31,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Azure AD join authentication to Azure Active Directory -![Azure AD join authentication to Azure Active Directory](images/howitworks/auth-aadj-cloud.png) +![Azure AD join authentication to Azure Active Directory.](images/howitworks/auth-aadj-cloud.png) | Phase | Description | | :----: | :----------- | @@ -42,7 +42,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |E | The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT, and informs winlogon of the success authentication. Winlogon creates a logon session, loads the user's profile, and starts explorer.exe.| ## Azure AD join authentication to Active Directory using a Key -![Azure AD join authentication to Active Directory using a Key](images/howitworks/auth-aadj-keytrust-kerb.png) +![Azure AD join authentication to Active Directory using a Key.](images/howitworks/auth-aadj-keytrust-kerb.png) | Phase | Description | @@ -56,7 +56,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Azure AD join authentication to Active Directory using a Certificate -![Azure AD join authentication to Active Directory using a Certificate](images/howitworks/auth-aadj-certtrust-kerb.png) +![Azure AD join authentication to Active Directory using a Certificate.](images/howitworks/auth-aadj-certtrust-kerb.png) | Phase | Description | | :----: | :----------- | @@ -69,7 +69,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Hybrid Azure AD join authentication using a Key -![Hybrid Azure AD join authentication using a Key](images/howitworks/auth-haadj-keytrust.png) +![Hybrid Azure AD join authentication using a Key.](images/howitworks/auth-haadj-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -85,7 +85,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c > In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business until (a) Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory and (b) device has line of sight to the domain controller for the first time. ## Hybrid Azure AD join authentication using a Certificate -![Hybrid Azure AD join authentication using a Certificate](images/howitworks/auth-haadj-certtrust.png) +![Hybrid Azure AD join authentication using a Certificate.](images/howitworks/auth-haadj-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 0fb161ccb5..20008e7565 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -37,7 +37,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, ## Azure AD joined provisioning in a Managed environment -![Azure AD joined provisioning in a Managed environment](images/howitworks/prov-aadj-managed.png) +![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-managed.png) | Phase | Description | | :----: | :----------- | @@ -48,7 +48,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Azure AD joined provisioning in a Federated environment -![Azure AD joined provisioning in a Managed environment](images/howitworks/prov-aadj-federated.png) +![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-federated.png) | Phase | Description | | :----: | :----------- | @@ -58,7 +58,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](images/howitworks/prov-haadj-keytrust-managed.png) +![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment.](images/howitworks/prov-haadj-keytrust-managed.png) | Phase | Description | @@ -76,7 +76,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment -![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](images/howitworks/prov-haadj-instant-certtrust-federated.png) +![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment.](images/howitworks/prov-haadj-instant-certtrust-federated.png) | Phase | Description | @@ -94,7 +94,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Key Trust deployment -![Domain joined provisioning in an On-premises Key Trust deployment](images/howitworks/prov-onprem-keytrust.png) +![Domain joined provisioning in an On-premises Key Trust deployment.](images/howitworks/prov-onprem-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -105,7 +105,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Certificate Trust deployment -![Domain joined provisioning in an On-premises Certificate Trust deployment](images/howitworks/prov-onprem-certtrust.png) +![Domain joined provisioning in an On-premises Certificate Trust deployment.](images/howitworks/prov-onprem-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 8e0a208a86..13246cec6f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -40,19 +40,19 @@ Before adding Azure Active Directory (Azure AD) joined devices to your existing Azure AD join, as well as hybrid Azure AD join devices register the user's Windows Hello for Business credential with Azure. To enable on-premises authentication, the credential must be synchronized to the on-premises Active Directory, regardless whether you are using a key or a certificate. Ensure you have Azure AD Connect installed and functioning properly. To learn more about Azure AD Connect, read [Integrate your on-premises directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect). If you upgraded your Active Directory schema to the Windows Server 2016 schema after installing Azure AD Connect, run Azure AD Connect and run **Refresh directory schema** from the list of tasks. -![Azure AD Connect Schema Refresh](images/aadj/aadconnectschema.png) +![Azure AD Connect Schema Refresh.](images/aadj/aadconnectschema.png) ### Azure Active Directory Device Registration A fundamental prerequisite of all cloud and hybrid Windows Hello for Business deployments is device registration. A user cannot provision Windows Hello for Business unless the device from which they are trying to provision has registered with Azure Active Directory. For more information about device registration, read [Introduction to device management in Azure Active Directory](/azure/active-directory/devices/overview). You can use the **dsregcmd.exe** command to determine if your device is registered to Azure Active Directory. -![dsregcmd output](images/aadj/dsregcmd.png) +![dsregcmd output.](images/aadj/dsregcmd.png) ### CRL Distribution Point (CDP) Certificates issued by a certificate authority can be revoked. When a certificate authority revokes as certificate, it writes information about the certificate into a revocation list. During certificate validation, Windows 10 consults the CRL distribution point within the certificate to get a list of revoked certificates. Validation compares the current certificate with information in the certificate revocation list to determine if the certificate remains valid. -![Domain Controller Certificate with LDAP CDP](images/aadj/Certificate-CDP.png) +![Domain Controller Certificate with LDAP CDP.](images/aadj/Certificate-CDP.png) The preceding domain controller certificate shows a CRL distribution path (CDP) using Active Directory. You can determine this because the value in the URL begins with **ldap**. Using Active Directory for domain joined devices provides a highly available CRL distribution point. However, Azure Active Directory joined devices and users on Azure Active Directory joined devices cannot read data from Active Directory, and certificate validation does not provide an opportunity to authenticate prior to reading the certificate revocation list. This becomes a circular problem as the user is attempting to authenticate, but must read Active Directory to complete the authentication, but the user cannot read Active Directory because they have not authenticated. @@ -122,16 +122,16 @@ You need to host your new certificate revocation list of a web server so Azure A 1. From **Windows Administrative Tools**, Open **Internet Information Services (IIS) Manager**. 2. Expand the navigation pane to show **Default Web Site**. Select and then right-click **Default Web site** and click **Add Virtual Directory...**. 3. In the **Add Virtual Directory** dialog box, type **cdp** in **alias**. For physical path, type or browse for the physical file location where you will host the certificate revocation list. For this example, the path **c:\cdp** is used. Click **OK**. - ![Add Virtual Directory](images/aadj/iis-add-virtual-directory.png) + ![Add Virtual Directory.](images/aadj/iis-add-virtual-directory.png) > [!NOTE] > Make note of this path as you will use it later to configure share and file permissions. 4. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Directory Browsing** in the content pane. Click **Enable** in the details pane. 5. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Configuration Editor**. 6. In the **Section** list, navigate to **system.webServer/security/requestFiltering**. - ![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) + ![IIS Configuration Editor requestFiltering.](images/aadj/iis-config-editor-requestFiltering.png) In the list of named value-pairs in the content pane, configure **allowDoubleEscaping** to **True**. Click **Apply** in the actions pane. - ![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) + ![IIS Configuration Editor double escaping.](images/aadj/iis-config-editor-allowDoubleEscaping.png) 7. Close **Internet Information Services (IIS) Manager**. #### Create a DNS resource record for the CRL distribution point URL @@ -139,7 +139,7 @@ You need to host your new certificate revocation list of a web server so Azure A 1. On your DNS server or from an administrative workstation, open **DNS Manager** from **Administrative Tools**. 2. Expand **Forward Lookup Zones** to show the DNS zone for your domain. Right-click your domain name in the navigation pane and click **New Host (A or AAAA)...**. 3. In the **New Host** dialog box, type **crl** in **Name**. Type the IP address of the web server you configured in **IP Address**. Click **Add Host**. Click **OK** to close the **DNS** dialog box. Click **Done**. -![Create DNS host record](images/aadj/dns-new-host-dialog.png) +![Create DNS host record.](images/aadj/dns-new-host-dialog.png) 4. Close the **DNS Manager**. ### Prepare a file share to host the certificate revocation list @@ -151,12 +151,12 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. 3. Select **Share this folder**. Type **cdp$** in **Share name**. Click **Permissions**. -![cdp sharing](images/aadj/cdp-sharing.png) +![cdp sharing.](images/aadj/cdp-sharing.png) 4. In the **Permissions for cdp$** dialog box, click **Add**. 5. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**, and then click **OK**. 7. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, in **Enter the object names to select**, type the name of the server running the certificate authority issuing the certificate revocation list, and then click **Check Names**. Click **OK**. 8. In the **Permissions for cdp$** dialog box, select the certificate authority from the **Group or user names list**. In the **Permissions for** section, select **Allow** for **Full control**. Click **OK**. -![CDP Share Permissions](images/aadj/cdp-share-permissions.png) +![CDP Share Permissions.](images/aadj/cdp-share-permissions.png) 9. In the **Advanced Sharing** dialog box, click **OK**. > [!Tip] @@ -166,7 +166,7 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. 3. Click **Caching**. Select **No files or programs from the shared folder are available offline**. -![CDP disable caching](images/aadj/cdp-disable-caching.png) +![CDP disable caching.](images/aadj/cdp-disable-caching.png) 4. Click **OK**. #### Configure NTFS permission for the CDP folder @@ -175,7 +175,7 @@ These procedures configure NTFS and share permissions on the web server to allow 2. Right-click the **cdp** folder and click **Properties**. Click the **Security** tab. 3. On the **Security** tab, click Edit. 5. In the **Permissions for cdp** dialog box, click **Add**. -![CDP NTFS Permissions](images/aadj/cdp-ntfs-permissions.png) +![CDP NTFS Permissions.](images/aadj/cdp-ntfs-permissions.png) 6. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**. Click **OK**. 7. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, in **Enter the object names to select**, type the name of the certificate authority, and then click **Check Names**. Click **OK**. 8. In the **Permissions for cdp** dialog box, select the name of the certificate authority from the **Group or user names** list. In the **Permissions for** section, select **Allow** for **Full control**. Click **OK**. @@ -192,11 +192,11 @@ The web server is ready to host the CRL distribution point. Now, configure the 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. 4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). - ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) + ![CDP New Location dialog box.](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. - ![CDP complete http](images/aadj/cdp-extension-complete-http.png) + ![CDP complete http.](images/aadj/cdp-extension-complete-http.png) 8. Select **Include in CRLs. Clients use this to find Delta CRL locations**. 9. Select **Include in the CDP extension of issued certificates**. 10. Click **Apply** save your selections. Click **No** when ask to restart the service. @@ -213,7 +213,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. - ![CDP publishing location](images/aadj/cdp-extension-complete-unc.png) + ![CDP publishing location.](images/aadj/cdp-extension-complete-unc.png) 8. Select **Publish CRLs to this location**. 9. Select **Publish Delta CRLs to this location**. 10. Click **Apply** save your selections. Click **Yes** when ask to restart the service. Click **OK** to close the properties dialog box. @@ -222,7 +222,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click **Revoked Certificates**, hover over **All Tasks**, and click **Publish** -![Publish a New CRL](images/aadj/publish-new-crl.png) +![Publish a New CRL.](images/aadj/publish-new-crl.png) 3. In the **Publish CRL** dialog box, select **New CRL** and click **OK**. #### Validate CDP Publishing @@ -230,7 +230,7 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. 1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. - ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) + ![Validate the new CRL.](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates @@ -239,9 +239,9 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 1. Sign-in a domain controller using administrative credentials. 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, select the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. -![Certificate Manager Personal store](images/aadj/certlm-personal-store.png) +![Certificate Manager Personal store.](images/aadj/certlm-personal-store.png) 4. Right-click the selected certificate. Hover over **All Tasks** and then select **Renew Certificate with New Key...**. In the **Certificate Enrollment** wizard, click **Next**. -![Renew with New key](images/aadj/certlm-renew-with-new-key.png) +![Renew with New key.](images/aadj/certlm-renew-with-new-key.png) 5. In the **Request Certificates** page of the wizard, verify the selected certificate has the correct certificate template and ensure the status is available. Click **Enroll**. 6. After the enrollment completes, click **Finish** to close the wizard. 7. Repeat this procedure on all your domain controllers. @@ -259,7 +259,7 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. 4. Click the **Details** tab. Scroll down the list until **CRL Distribution Points** is visible in the **Field** column of the list. Select **CRL Distribution Point**. 5. Review the information below the list of fields to confirm the new URL for the CRL distribution point is present in the certificate. Click **OK**.
-![New Certificate with updated CDP](images/aadj/dc-cert-with-new-cdp.png) +![New Certificate with updated CDP.](images/aadj/dc-cert-with-new-cdp.png) ## Configure and Assign a Trusted Certificate Device Configuration Profile @@ -276,13 +276,13 @@ Steps you will perform include: 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. 4. Click the **Certification Path** tab. In the **Certification path** view, select the top most node and click **View Certificate**. -![Certificate Path](images/aadj/certlm-cert-path-tab.png) +![Certificate Path.](images/aadj/certlm-cert-path-tab.png) 5. In the new **Certificate** dialog box, click the **Details** tab. Click **Copy to File**. -![Details tab and copy to file](images/aadj/certlm-root-cert-details-tab.png) +![Details tab and copy to file.](images/aadj/certlm-root-cert-details-tab.png) 6. In the **Certificate Export Wizard**, click **Next**. 7. On the **Export File Format** page of the wizard, click **Next**. 8. On the **File to Export** page in the wizard, type the name and location of the root certificate and click **Next**. Click **Finish** and then click **OK** to close the success dialog box. -![Export root certificate](images/aadj/certlm-export-root-certificate.png) +![Export root certificate.](images/aadj/certlm-export-root-certificate.png) 9. Click **OK** two times to return to the **Certificate Manager** for the local computer. Close the **Certificate Manager**. ### Create and Assign a Trust Certificate Device Configuration Profile @@ -291,12 +291,12 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted 1. Sign-in to the [Microsoft Azure Portal](https://portal.azure.com) and select **Microsoft Intune**. 2. Click **Device configuration**. In the **Device Configuration** blade, click **Create profile**. -![Intune Create Profile](images/aadj/intune-create-device-config-profile.png) +![Intune Create Profile.](images/aadj/intune-create-device-config-profile.png) 3. In the **Create profile** blade, type **Enterprise Root Certificate** in **Name**. Provide a description. Select **Windows 10 and later** from the **Platform** list. Select **Trusted certificate** from the **Profile type** list. Click **Configure**. 4. In the **Trusted Certificate** blade, use the folder icon to browse for the location of the enterprise root certificate file you created in step 8 of [Export Enterprise Root certificate](#export-enterprise-root-certificate). Click **OK**. Click **Create**. -![Intune Trusted Certificate Profile](images/aadj/intune-create-trusted-certificate-profile.png) +![Intune Trusted Certificate Profile.](images/aadj/intune-create-trusted-certificate-profile.png) 5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. -![Intune Profile assignment](images/aadj/intune-device-config-enterprise-root-assignment.png) +![Intune Profile assignment.](images/aadj/intune-device-config-enterprise-root-assignment.png) 6. Sign out of the Microsoft Azure Portal. > [!NOTE] > After the creation, the **supported platform** parameter of the profile will contain the value "Windows 8.1 and later", as the certificate configuration for Windows 8.1 and Windows 10 is the same. @@ -310,7 +310,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Choose **Enroll devices**. 4. Select **Windows enrollment**. 5. Under **Windows enrollment**, select **Windows Hello for Business**. - ![Create Windows Hello for Business Policy](images/aadj/MEM.png) + ![Create Windows Hello for Business Policy.](images/aadj/MEM.png) 6. Select **Enabled** from the **Configure Windows Hello for Business** list. 7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys. 8. Enter the desired **Minimum PIN length** and **Maximum PIN length**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index b8ce7af3da..e4ada9da90 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -82,7 +82,7 @@ The easiest way to verify the onPremisesDistingushedNamne attribute is synchroni 2. Click **Login** and provide Azure credentials 3. In the Azure AD Graph Explorer URL, type https://graph.windows.net/myorganization/users/[userid], where **[userid]** is the user principal name of user in Azure Active Directory. Click **Go** 4. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and the value is accurate for the given user. - ![Azure AD Connect On-Prem DN Attribute](images/aadjcert/aadconnectonpremdn.png) + ![Azure AD Connect On-Prem DN Attribute.](images/aadjcert/aadconnectonpremdn.png) ## Prepare the Network Device Enrollment Services (NDES) Service Account @@ -259,15 +259,15 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 1. Open **Server Manager** on the NDES server. 2. Click **Manage**. Click **Add Roles and Features**. 3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, click **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Click **Next**. Click **Select a server from the server pool**. Select the local server from the **Server Pool** list. Click **Next**. - ![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) + ![Server Manager destination server.](images/aadjCert/servermanager-destination-server-ndes.png) 4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. - ![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) + ![Server Manager AD CS Role.](images/aadjCert/servermanager-adcs-role.png) Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. - ![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) + ![Server Manager Add Features.](images/aadjcert/serverManager-adcs-add-features.png) 5. On the **Features** page, expand **.NET Framework 3.5 Features**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Expand **.NET Framework 4.5 Features**. Expand **WCF Services**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. - ![Server Manager Feature HTTP Activation](images/aadjcert/servermanager-adcs-http-activation.png) + ![Server Manager Feature HTTP Activation.](images/aadjcert/servermanager-adcs-http-activation.png) 6. On the **Select role services** page, clear the **Certificate Authority** check box. Select the **Network Device Enrollment Service**. Click **Add Features** on the **Add Roles and Features Wizard** dialog box. Click **Next**. - ![Server Manager ADCS NDES Role](images/aadjcert/servermanager-adcs-ndes-role-checked.png) + ![Server Manager ADCS NDES Role.](images/aadjcert/servermanager-adcs-ndes-role-checked.png) 7. Click **Next** on the **Web Server Role (IIS)** page. 8. On the **Select role services** page for the Web Serve role, Select the following additional services if they are not already selected and then click **Next**. * **Web Server > Security > Request Filtering** @@ -275,11 +275,11 @@ Sign-in to the certificate authority or management workstations with an _Enterpr * **Web Server > Application Development > ASP.NET 4.5**. . * **Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility** * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** - ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) + ![Server Manager Web Server Role.](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. > [!IMPORTANT] > .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ - ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) + ![.NET Side by Side.](images/aadjcert/dotNet35sidebyside.png) ### Configure the NDES service account This task adds the NDES service account to the local IIS_USRS group. The task also configures the NDES service account for Kerberos authentication and delegation @@ -308,7 +308,7 @@ Sign-in the NDES server with access equivalent to _Domain Admins_. > [!NOTE] > If you use the same service account for multiple NDES Servers, repeat the following task for each NDES server under which the NDES service runs. -![Set SPN command prompt](images/aadjcert/setspn-commandprompt.png) +![Set SPN command prompt.](images/aadjcert/setspn-commandprompt.png) #### Configure the NDES Service account for delegation The NDES service enrolls certificates on behalf of users. Therefore, you want to limit the actions it can perform on behalf of the user. You do this through delegation. @@ -317,16 +317,16 @@ Sign-in a domain controller with a minimum access equivalent to _Domain Admins_. 1. Open **Active Directory Users and Computers** 2. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Click the **Delegation** tab. - ![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) + ![NDES Delegation Tab.](images/aadjcert/ndessvcdelegationtab.png) 3. Select **Trust this user for delegation to specified services only**. 4. Select **Use any authentication protocol**. 5. Click **Add**. 6. Click **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Avaiable services** list, select **HOST**. Click **OK**. - ![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) + ![NDES Service delegation to NDES host.](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) 7. Repeat steps 5 and 6 for each NDES server using this service account. Click **Add**. 8. Click **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Click **OK**. 9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates. - ![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) + ![NDES Service delegation complete.](images/aadjcert/ndessvcdelegation-host-ca-spn.png) 10. Click **OK**. Close **Active Directory Users and Computers**. ### Configure the NDES Role and Certificate Templates @@ -338,21 +338,21 @@ Sign-in to the certificate authority or management workstations with an _Enterpr > [!NOTE] > If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. -![Server Manager Post-Install Yellow flag](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) +![Server Manager Post-Install Yellow flag.](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) 1. Click the **Configure Active Directory Certificate Services on the destination server** link. 2. On the **Credentials** page, click **Next**. - ![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) + ![NDES Installation Credentials.](images/aadjcert/ndesconfig01.png) 3. On the **Role Services** page, select **Network Device Enrollment Service** and then click **Next** - ![NDES Role Services](images/aadjcert/ndesconfig02.png) + ![NDES Role Services.](images/aadjcert/ndesconfig02.png) 4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. - ![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) + ![NDES Service Account for NDES.](images/aadjcert/ndesconfig03b.png) 5. On the **CA for NDES** page, select **CA name**. Click **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Click **Next**. - ![NDES CA selection](images/aadjcert/ndesconfig04.png) + ![NDES CA selection.](images/aadjcert/ndesconfig04.png) 6. On the **RA Information**, click **Next**. 7. On the **Cryptography for NDES** page, click **Next**. 8. Review the **Confirmation** page. Click **Configure**. - ![NDES Confirmation](images/aadjcert/ndesconfig05.png) + ![NDES Confirmation.](images/aadjcert/ndesconfig05.png) 8. Click **Close** after the configuration completes. #### Configure Certificate Templates on NDES @@ -407,18 +407,18 @@ Sign-in a workstation with access equivalent to a _domain user_. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Download connector service**. Click **Accept terms & Download**. Save the file (AADApplicationProxyConnectorInstaller.exe) in a location accessible by others on the domain. - ![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) + ![Azure Application Proxy Connectors.](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) 5. Sign-in the computer that will run the connector with access equivalent to a _domain user_. > [!IMPORTANT] > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategically locate Azure AD application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. 6. Start **AADApplicationProxyConnectorInstaller.exe**. 7. Read the license terms and then select **I agree to the license terms and conditions**. Click **Install**. - ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-01.png) + ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-01.png) 8. Sign-in to Microsoft Azure with access equivalent to **Global Administrator**. - ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-02.png) + ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-02.png) 9. When the installation completes. Read the information regarding outbound proxy servers. Click **Close**. - ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-03.png) + ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-03.png) 10. Repeat steps 5 - 10 for each device that will run the Azure AD Application Proxy connector for Windows Hello for Business certificate deployments. #### Create a Connector Group @@ -427,9 +427,9 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/) with access equivalent to **Global Administrator**. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. - ![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) + ![Azure Application Proxy Connector groups.](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) 4. Click **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**. - ![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) + ![Azure Application New Connector Group.](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) 5. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests. 6. Click **Save**. @@ -443,7 +443,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL. 6. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. 7. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). - ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) + ![Azure NDES Application Proxy Configuration.](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. 10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. @@ -465,7 +465,7 @@ Sign-in the NDES server with access equivalent to _local administrators_. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Click **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Click **Add**. Click **OK** when finished. 9. Click **Enroll** @@ -478,12 +478,12 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. - ![NDES IIS Console](images/aadjcert/ndes-iis-console.png) + ![NDES IIS Console.](images/aadjcert/ndes-iis-console.png) 3. Click **Bindings...*** under **Actions**. Click **Add**. - ![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) + ![NDES IIS Console.](images/aadjcert/ndes-iis-bindings.png) 4. Select **https** from **Type**. Confirm the value for **Port** is **443**. 5. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**. - ![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) + ![NDES IIS Console.](images/aadjcert/ndes-iis-bindings-add-443.png) 6. Select **http** from the **Site Bindings** list. Click **Remove**. 7. Click **Close** on the **Site Bindings** dialog box. 8. Close **Internet Information Services (IIS) Manager**. @@ -509,10 +509,10 @@ Sign-in the NDES server with access equivalent to _local administrator_. A web page similar to the following should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. -![NDES IIS Console](images/aadjcert/ndes-https-website-test-01.png) +![NDES IIS Console.](images/aadjcert/ndes-https-website-test-01.png) Confirm the web site uses the server authentication certificate. -![NDES IIS Console](images/aadjcert/ndes-https-website-test-01-show-cert.png) +![NDES IIS Console.](images/aadjcert/ndes-https-website-test-01-show-cert.png) ## Configure Network Device Enrollment Services to work with Microsoft Intune @@ -527,7 +527,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. 3. In the content pane, double-click **Request Filtering**. Click **Edit Feature Settings...** in the action pane. - ![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) + ![Intune NDES Request filtering.](images/aadjcert/NDES-IIS-RequestFiltering.png) 4. Select **Allow unlisted file name extensions**. 5. Select **Allow unlisted verbs**. 6. Select **Allow high-bit characters**. @@ -554,7 +554,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. 3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. - ![Intune Certificate Authority](images/aadjcert/profile01.png) + ![Intune Certificate Authority.](images/aadjcert/profile01.png) 4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. 5. Sign-out of the Microsoft Endpoint Manager admin center. @@ -564,26 +564,26 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server. 2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server. 3. On the **Microsoft Intune** page, click **Next**. - ![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) + ![Intune Connector Install 01.](images/aadjcert/intunecertconnectorinstall-01.png) 4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation. 5. On the **Destination Folder** page, click **Next**. 6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**. - ![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) + ![Intune Connector Install 03.](images/aadjcert/intunecertconnectorinstall-03.png) 7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. - ![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) + ![Intune Connector Install 05.](images/aadjcert/intunecertconnectorinstall-05.png) > [!NOTE] > The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. 8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**. 9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**. - ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) + ![Intune Connector Install 06.](images/aadjcert/intunecertconnectorinstall-06.png) > [!NOTE] > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder. 10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. - ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) + ![Intune Connector install 07.](images/aadjcert/intunecertconnectorinstall-07.png) ### Configure the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. @@ -594,10 +594,10 @@ Sign-in the NDES server with access equivalent to _domain administrator_. > If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. 2. If your organization uses a proxy server and the proxy is needed for the NDES server to access the Internet, select **Use proxy server**, and then enter the proxy server name, port, and credentials to connect. Click **Apply** - ![Intune Certificate Connector Configuration 01](images/aadjcert/intunecertconnectorconfig-01.png) + ![Intune Certificate Connector Configuration 01.](images/aadjcert/intunecertconnectorconfig-01.png) 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. - ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) + ![Intune Certificate Connector Configuration 02.](images/aadjcert/intunecertconnectorconfig-02.png) > [!IMPORTANT] > The user account must have a valid Intune license assigned. If the user account does not have a valid Intune license, the sign-in fails. @@ -614,7 +614,7 @@ Sign-in the certificate authority used by the NDES Connector with access equival 1. Start the **Certification Authority** management console. 2. In the navigation pane, right-click the name of the certificate authority and select **Properties**. 3. Click the **Security** tab. Click **Add**. In **Enter the object names to select** box, type **NDESSvc** (or the name you gave the NDES Service account). Click *Check Names*. Click **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Click **OK**. - ![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) + ![Configure Intune certificate revocation 02.](images/aadjcert/intuneconfigcertrevocation-02.png) 4. Close the **Certification Authority** #### Enable the NDES Connector for certificate revocation @@ -622,7 +622,7 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Open the **NDES Connector** user interface (**\\NDESConnectorUI\NDESConnectorUI.exe**). 2. Click the **Advanced** tab. Select **Specify a different account username and password**. Type the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. - ![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) + ![Intune Connector cert revocation configuration 04.](images/aadjcert/intunecertconnectorconfig-04.png) 3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**. ### Test the NDES Connector @@ -641,7 +641,7 @@ Sign-in the NDES server with access equivalent to _domain admin_. ``` where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. - ![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) + ![NDES web site test after Intune Certificate Connector.](images/aadjcert/ndes-https-website-test-after-intune-connector.png) 6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**. ## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile @@ -656,7 +656,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Group Name**, type the name of the group. For example, **AADJ WHFB Certificate Users**. 6. Provide a **Group description**, if applicable. 7. Select **Assigned** from the **Membership type** list. - ![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) + ![Azure AD new group creation.](images/aadjcert/azureadcreatewhfbcertgroup.png) 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. @@ -666,7 +666,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Devices**, and then click **Configuration Profiles**. 3. Select **Create Profile**. - ![Intune Device Configuration Create Profile](images/aadjcert/profile02.png) + ![Intune Device Configuration Create Profile.](images/aadjcert/profile02.png) 4. Select **Windows 10 and later** from the **Platform** list. 5. Choose **SCEP certificate** from the **Profile** list, and select **Create**. 6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. @@ -689,7 +689,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. 15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. 16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. - ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) + ![WHFB SCEP certificate Profile EKUs.](images/aadjcert/profile03.png) 17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. 18. Click **Next**. 19. Click **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and click **Create**. @@ -702,7 +702,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Click **WHFB Certificate Enrollment**. 4. Select **Properties**, and then click **Edit** next to the **Assignments** section. 5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. - ![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) + ![WHFB SCEP Profile Assignment.](images/aadjcert/profile04.png) 6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. 7. Click **Review + Save**, and then **Save**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index e80dc75f72..9e100bc146 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -70,7 +70,7 @@ To locate the schema master role holder, open and command prompt and type: ```Netdom query fsmo | findstr -i schema``` -![Netdom example output](images/hello-cmd-netdom.png) +![Netdom example output.](images/hello-cmd-netdom.png) The command should return the name of the domain controller where you need to run adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. @@ -114,14 +114,14 @@ When you are ready to install, follow the **Configuring federation with AD FS** ### Create AD objects for AD FS Device Authentication If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration. -![Device Registration](images/hybridct/device1.png) +![Device Registration.](images/hybridct/device1.png) > [!NOTE] > The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1. 1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**. -![Device Registration](images/hybridct/device2.png) +![Device Registration.](images/hybridct/device2.png) 2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: @@ -132,7 +132,7 @@ If your AD FS farm is not already configured for Device Authentication (you can > [!NOTE] > If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$" -![Device Registration](images/hybridct/device3.png) +![Device Registration.](images/hybridct/device3.png) The above PSH creates the following objects: @@ -140,11 +140,11 @@ The above PSH creates the following objects: - Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration - Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration -![Device Registration](images/hybridct/device4.png) +![Device Registration.](images/hybridct/device4.png) 4. Once this is done, you will see a successful completion message. -![Device Registration](images/hybridct/device5.png) +![Device Registration.](images/hybridct/device5.png) ### Create Service Connection Point (SCP) in Active Directory If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS @@ -155,13 +155,13 @@ If you plan to use Windows 10 domain join (with automatic registration to Azure > [!NOTE] > If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep -![Device Registration](images/hybridct/device6.png) +![Device Registration.](images/hybridct/device6.png) 2. Provide your Azure AD global administrator credentials `PS C:>$aadAdminCred = Get-Credential` -![Device Registration](images/hybridct/device7.png) +![Device Registration.](images/hybridct/device7.png) 3. Run the following PowerShell command @@ -517,7 +517,7 @@ For your reference, below is a comprehensive list of the AD DS devices, containe - Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - Container Device Registration Service DKM under the above container -![Device Registration](images/hybridct/device8.png) +![Device Registration.](images/hybridct/device8.png) - object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - read/write access to the specified AD connector account name on the new object diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index cfaf049efd..35bd16ed3e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -27,22 +27,22 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358 from User Device Registration log showing Windows Hello for Business prerequisite check result](images/Event358.png) +![Event358 from User Device Registration log showing Windows Hello for Business prerequisite check result.](images/Event358.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. -![Setup a PIN Provisioning](images/setupapin.png) +![Setup a PIN Provisioning.](images/setupapin.png) The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. -![MFA prompt during provisioning](images/mfa.png) +![MFA prompt during provisioning.](images/mfa.png) After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. -![Create a PIN during provisioning](images/createPin.png) +![Create a PIN during provisioning.](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 9caf362da6..e60e0b15f0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -27,22 +27,22 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358](images/Event358-2.png) +![Event358.](images/Event358-2.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. -![Setup a PIN Provisioning](images/setupapin.png) +![Setup a PIN Provisioning.](images/setupapin.png) The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. -![MFA prompt during provisioning](images/mfa.png) +![MFA prompt during provisioning.](images/mfa.png) After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. -![Create a PIN during provisioning](images/createPin.png) +![Create a PIN during provisioning.](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 99491fb5c3..4e83f31ec3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -73,7 +73,7 @@ Sign-in the federation server with domain administrator equivalent credentials. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. 9. Click **Enroll**. @@ -155,7 +155,7 @@ Use the following procedures to configure AD FS when your environment uses **Win Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) + ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. @@ -175,7 +175,7 @@ Use the following procedures to configure AD FS when your environment uses **Win Sign-in the federation server with _Domain Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) + ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. @@ -262,7 +262,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. 8. Click **Install** to start the feature installation - ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) + ![Feature selection screen with NLB selected.](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -270,25 +270,25 @@ Before you can load balance all the nodes in the AD FS farm, you must first crea Sign-in a node of the federation farm with _Admin_ equivalent credentials. 1. Open **Network Load Balancing Manager** from **Administrative Tools**. - ![NLB Manager user interface](images/hello-nlb-manager.png) + ![NLB Manager user interface.](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. 3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. - ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) + ![NLB Manager - Connect to new Cluster screen.](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. 6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. - ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) + ![NLB Manager - Add IP to New Cluster screen.](images/hello-nlb-add-ip.png) 7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. - ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) + ![NLB Manager - Cluster IP Configuration screen.](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. 9. In Port Rules, click Edit to modify the default port rules to use port 443. - ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) + ![NLB Manager - Add\Edit Port Rule screen.](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. 2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. - ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) + ![NLB Manager - Cluster with nodes.](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 00fa16c254..1a2b17c308 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -69,7 +69,7 @@ In Windows 10, Windows Hello replaces passwords. When the identity provider sup >[!NOTE] >Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password. -![How authentication works in Windows Hello](images/authflow.png) +![How authentication works in Windows Hello.](images/authflow.png) Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 3ff85f511f..e7d6a0cea8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -35,11 +35,11 @@ People who are currently using virtual or physical smart cards for authenticatio When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. -![who owns this pc](images/corpown.png) +![who owns this pc.](images/corpown.png) Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. -![choose how you'll connect](images/connect.png) +![choose how you'll connect.](images/connect.png) They sign in, and are then asked to verify their identity. People have options to choose from a text message, phone call, or the authentication application. After verification, they create their PIN. The **Create a PIN** screen displays any complexity requirements that you have set, such as minimum length. @@ -55,7 +55,7 @@ People can go to **Settings** > **Accounts** > **Work or school**, select If your policy allows it, people can use biometrics (fingerprint, iris, and facial recognition) with Windows Hello for Business, if the hardware supports it. -![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) +![sign in to windows, apps, and services using fingerprint or face.](images/hellosettings.png) diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 87e71bc747..2b1c101fc0 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -21,7 +21,7 @@ ms.reviewer: ## Four steps to password freedom Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password freedom. -![Passwordless approach](images/four-steps-passwordless.png) +![Passwordless approach.](images/four-steps-passwordless.png) ### 1. Develop a password replacement offering @@ -203,24 +203,24 @@ Windows provides two ways to prevent your users from using passwords. You can us ##### Security Policy You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. -![securityPolicyLocation](images/passwordless/00-securityPolicy.png) +![securityPolicyLocation.](images/passwordless/00-securityPolicy.png) **Windows Server 2016 and earlier** The policy name for these operating systems is **Interactive logon: Require smart card**. -![securityPolicyBefore2016](images/passwordless/00-securitypolicy-2016.png) +![securityPolicyBefore2016.](images/passwordless/00-securitypolicy-2016.png) **Windows 10, version 1703 or later using Remote Server Administrator Tools** The policy name for these operating systems is **Interactive logon: Require Windows Hello for Business or smart card**. -![securityPolicyRSAT](images/passwordless/00-updatedsecuritypolicytext.png) +![securityPolicyRSAT.](images/passwordless/00-updatedsecuritypolicytext.png) When you enable this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. #### Excluding the password credential provider You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > System > Logon** -![HideCredProvPolicy](images/passwordless/00-hidecredprov.png) +![HideCredProvPolicy.](images/passwordless/00-hidecredprov.png) The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. -![HideCredProvPolicy2](images/passwordless/01-hidecredprov.png) +![HideCredProvPolicy2.](images/passwordless/01-hidecredprov.png) Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. @@ -261,7 +261,7 @@ The account options on a user account includes an option -- **Smart card is requ > [!NOTE] > Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. -![SCRIL setting on AD Users and Computers](images/passwordless/00-scril-dsa.png) +![SCRIL setting on AD Users and Computers.](images/passwordless/00-scril-dsa.png) **SCRIL setting for a user on Active Directory Users and Computers.** When you configure a user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users are effectively passwordless because: @@ -270,13 +270,13 @@ When you configure a user account for SCRIL, Active Directory changes the affect - the user is not asked to change their password - domain controllers do not allow passwords for interactive authentication -![SCRIL setting from ADAC on Windows Server 2012](images/passwordless/01-scril-adac-2012.png) +![SCRIL setting from ADAC on Windows Server 2012.](images/passwordless/01-scril-adac-2012.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2012.** > [!NOTE] > Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. -![SCRIL setting from ADAC on Windows Server 2016](images/passwordless/01-scril-adac-2016.png) +![SCRIL setting from ADAC on Windows Server 2016.](images/passwordless/01-scril-adac-2016.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2016.** > [!NOTE] @@ -286,7 +286,7 @@ When you configure a user account for SCRIL, Active Directory changes the affect Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for SCRIL-enabled users by configuring the domain to automatically change the password for SCRIL users. In this configuration, passwords for SCRIL-configured users expire based on Active Directory password policy settings. When the SCRIL user authenticates from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or any authentication outages. -![Rotate Password 2016](images/passwordless/02-rotate-scril-2016.png) +![Rotate Password 2016.](images/passwordless/02-rotate-scril-2016.png) > [!NOTE] > Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability by reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 5e24e71b64..2ad3bb1f3b 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -54,7 +54,7 @@ It’s important to keep in mind that there are no physical containers on disk, The container actually contains a set of keys, some of which are used to protect other keys. The following image shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. -![Each logical container holds one or more sets of keys](../images/passport-fig3-logicalcontainer.png) +![Each logical container holds one or more sets of keys.](../images/passport-fig3-logicalcontainer.png) Containers can contain several types of key material: diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 57bbf194fc..65fa656745 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -34,13 +34,13 @@ Administrator credentials are highly privileged and must be protected. By using The following diagram helps you to understand how a standard Remote Desktop session to a server without Windows Defender Remote Credential Guard works: -![RDP connection to a server without Windows Defender Remote Credential Guard.png](images/rdp-to-a-server-without-windows-defender-remote-credential-guard.png) +![RDP connection to a server without Windows Defender Remote Credential Guard.png.](images/rdp-to-a-server-without-windows-defender-remote-credential-guard.png)
The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) option: -![Windows Defender Remote Credential Guard](images/windows-defender-remote-credential-guard-with-remote-admin-mode.png) +![Windows Defender Remote Credential Guard.](images/windows-defender-remote-credential-guard-with-remote-admin-mode.png)
As illustrated, Windows Defender Remote Credential Guard blocks NTLM (allowing only Kerberos), prevents Pass-the-Hash (PtH) attacks, and also prevents use of credentials after disconnection. @@ -152,7 +152,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C 2. Double-click **Restrict delegation of credentials to remote servers**. - ![Windows Defender Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) + ![Windows Defender Remote Credential Guard Group Policy.](images/remote-credential-guard-gp.png) 3. Under **Use the following restricted mode**: diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 635a9631d6..d5c9651f0f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -34,7 +34,7 @@ Smart card support is required to enable many Remote Desktop Services scenarios. In a Remote Desktop scenario, a user is using a remote server for running services, and the smart card is local to the computer that the user is using. In a smart card sign-in scenario, the smart card service on the remote server redirects to the smart card reader that is connected to the local computer where the user is trying to sign in. -![Smart card service redirects to smart card reader](images/sc-image101.png) +![Smart card service redirects to smart card reader.](images/sc-image101.png) **Remote Desktop redirection** diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 0663f9a479..63cbad9b26 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -52,7 +52,7 @@ Interactive sign-in in Windows begins when the user presses CTRL+ALT+DEL. The CT After receiving the SAS, the UI then generates the sign-in tile from the information received from the registered credential providers. The following graphic shows the architecture for credential providers in the Windows operating system. -![Credential provider architecture](images/sc-image201.gif) +![Credential provider architecture.](images/sc-image201.gif) **Figure 1**  **Credential provider architecture** @@ -88,7 +88,7 @@ Vendors provide smart cards and smart card readers, and in many cases the vendor Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Card Base Cryptographic Service Provider (Base CSP), and smart card minidrivers. -![Base CSP and smart card minidriver architecture](images/sc-image203.gif) +![Base CSP and smart card minidriver architecture.](images/sc-image203.gif) **Figure 2**  **Base CSP and smart card minidriver architecture** @@ -236,7 +236,7 @@ Applications can call the Base CSP with CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL, set In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or click **Cancel**. If the user cancels the operation, the operation fails. The flow chart in Figure 3 shows the selection steps performed by the Windows operating system. -![Smart card selection process](images/sc-image205.png) +![Smart card selection process.](images/sc-image205.png) **Figure 3**  **Smart card selection behavior** @@ -314,7 +314,7 @@ For other operations, the caller may be able to acquire a "verify" context again Figure 4 shows the Cryptography architecture that is used by the Windows operating system. -![Cryptography architecture](images/sc-image206.gif) +![Cryptography architecture.](images/sc-image206.gif) **Figure 4**  **Cryptography architecture** diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index ae671b4ace..dbcf86ee67 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -38,7 +38,7 @@ The following figure shows the flow of the certificate propagation service. The **Certificate propagation service** -![Certificate propagation service](images/sc-image302.gif) +![Certificate propagation service.](images/sc-image302.gif) 1. A signed-in user inserts a smart card. diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index ef209588b9..a220e7e658 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -89,7 +89,7 @@ If you enable the **Allow signature keys valid for Logon** credential provider p The following diagram illustrates how smart card sign-in works in the supported versions of Windows. -![Smart card sign-in flow](images/sc-image402.png) +![Smart card sign-in flow.](images/sc-image402.png) **Smart card sign-in flow** @@ -206,21 +206,21 @@ SSL/TLS can map certificates that do not have SAN, and the mapping is done by us **Certificate revocation list distribution points** -![Certificate revocation list distribution points](images/sc-image403.png) +![Certificate revocation list distribution points.](images/sc-image403.png) **UPN in Subject Alternative Name field** -![UPN in Subject Alternative Name field](images/sc-image404.png) +![UPN in Subject Alternative Name field.](images/sc-image404.png) **Subject and Issuer fields** -![Subject and Issuer fields](images/sc-image405.png) +![Subject and Issuer fields.](images/sc-image405.png) This account mapping is supported by the KDC in addition to six other mapping methods. The following figure demonstrates a flow of user account mapping logic that is used by the KDC. **High-level flow of certificate processing for sign-in** -![High-level flow of certificate processing for sign-in](images/sc-image406.png) +![High-level flow of certificate processing for sign-in.](images/sc-image406.png) The certificate object is parsed to look for content to perform user account mapping. @@ -236,7 +236,7 @@ The following figure illustrates the process of mapping user accounts for sign-i **Certificate processing logic** -![Certificate processing logic](images/sc-image407.png) +![Certificate processing logic.](images/sc-image407.png) NT\_AUTH policy is best described in the CERT\_CHAIN\_POLICY\_NT\_AUTH parameter section of the CertVerifyCertificateChainPolicy function. For more information, see [CertVerifyCertificateChainPolicy](/windows/win32/api/wincrypt/nf-wincrypt-certverifycertificatechainpolicy). diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index fa36cf563f..3f72307e25 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -26,7 +26,7 @@ The smart card removal policy service is applicable when a user has signed in wi **Smart card removal policy service** -![Smart card removal policy service](images/sc-image501.gif) +![Smart card removal policy service.](images/sc-image501.gif) The numbers in the previous figure represent the following actions: diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 10ffd31a84..76159c664d 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -34,7 +34,7 @@ In order to better understand how this process happens, let's look at the Window The following shows how the logon process for an administrator differs from the logon process for a standard user. -![uac windows logon process](images/uacwindowslogonprocess.gif) +![uac windows logon process.](images/uacwindowslogonprocess.gif) By default, standard users and administrators access resources and run apps in the security context of standard users. When a user logs on to a computer, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. @@ -56,7 +56,7 @@ With UAC enabled, Windows 10 prompts for consent or prompts for credentials of The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. -![uac consent prompt](images/uacconsentprompt.gif) +![uac consent prompt.](images/uacconsentprompt.gif) **The credential prompt** @@ -64,7 +64,7 @@ The credential prompt is presented when a standard user attempts to perform a ta The following is an example of the UAC credential prompt. -![uac credential prompt](images/uaccredentialprompt.gif) +![uac credential prompt.](images/uaccredentialprompt.gif) **UAC elevation prompts** @@ -81,7 +81,7 @@ The elevation prompt color-coding is as follows: Some Control Panel items, such as **Date and Time Properties**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screen shot of the **Date and Time Properties** Control Panel item. -![uac shield icon](images/uacshieldicon.png) +![uac shield icon.](images/uacshieldicon.png) The shield icon on the **Change date and time** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. @@ -99,7 +99,7 @@ While malware could present an imitation of the secure desktop, this issue canno The following diagram details the UAC architecture. -![uac architecture](images/uacarchitecture.gif) +![uac architecture.](images/uacarchitecture.gif) To better understand each component, review the table below: diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index badf574468..4468785ff0 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -24,7 +24,7 @@ This topic for the IT professional discusses the factors to consider when you de Traditional identity devices, such as physical smart cards, follow a predictable lifecycle in any deployment, as shown in the following diagram. -![Diagram of physical smart card lifecycle](images/vsc-physical-smart-card-lifecycle.png) +![Diagram of physical smart card lifecycle.](images/vsc-physical-smart-card-lifecycle.png) Physical devices are created by a dedicated manufacturer and then purchased by the corporation that will ultimately deploy it. The device passes through the personalization stage, where its unique properties are set. In smart cards, these properties are the administrator key, Personal Identification Number (PIN), PIN Unlock Key (PUK), and its physical appearance. To provision the device, it is loaded with the required certificates, such as a sign-in certificate. After you provision the device, it is ready for use. The device must simply be maintained. For example, you must replace cards when they are lost or stolen and reset PINs when users forget them. Finally, you’ll retire devices when they exceed their intended lifetime or when employees leave the company. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index 6fb462eb81..044f7c1fe1 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -28,7 +28,7 @@ A crucial aspect of TPM virtual smart cards is their ability to securely store a The following diagram illustrates the secure key hierarchy and the process of accessing the user key. -![Diagram of the process of accessing the user key](images/vsc-process-of-accessing-user-key.png) +![Diagram of the process of accessing the user key.](images/vsc-process-of-accessing-user-key.png) The following keys are stored on the hard disk: diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index 6810a79d95..c6ad4e0710 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -62,21 +62,21 @@ On your domain server, you need to create a template for the certificate that yo 2. Click **File**, and then click **Add/Remove Snap-in**. - ![Add or remove snap-in](images/vsc-02-mmc-add-snap-in.png) + ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) 3. In the available snap-ins list, click **Certificate Templates**, and then click **Add**. - ![Add Certificate Templates snap-in](images/vsc-03-add-certificate-templates-snap-in.png) + ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) 4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. 5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. - ![Duplicating the Smartcard Logon template](images/vsc-04-right-click-smartcard-logon-template.png) + ![Duplicating the Smartcard Logon template.](images/vsc-04-right-click-smartcard-logon-template.png) 6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. - ![Compatibility tab, certification authority setting](images/vsc-05-certificate-template-compatibility.png) + ![Compatibility tab, certification authority setting.](images/vsc-05-certificate-template-compatibility.png) 7. On the **General** tab: @@ -102,23 +102,23 @@ On your domain server, you need to create a template for the certificate that yo 12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. - ![Add Certification Authority snap-in](images/vsc-06-add-certification-authority-snap-in.png) + ![Add Certification Authority snap-in.](images/vsc-06-add-certification-authority-snap-in.png) 13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. 14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. - ![Right-click menu for Certificate Templates](images/vsc-07-right-click-certificate-templates.png) + ![Right-click menu for Certificate Templates.](images/vsc-07-right-click-certificate-templates.png) 15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. > **Note**  It can take some time for your template to replicate to all servers and become available in this list. - ![Selecting a certificate template](images/vsc-08-enable-certificate-template.png) + ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) 16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. - ![Stopping and starting the service](images/vsc-09-stop-service-start-service.png) + ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) ## Step 2: Create the TPM virtual smart card @@ -128,7 +128,7 @@ In this step, you will create the virtual smart card on the client computer by u 1. On a domain-joined computer, open a Command Prompt window with Administrative credentials. - ![Cmd prompt, Run as administrator](images/vsc-10-cmd-run-as-administrator.png) + ![Cmd prompt, Run as administrator.](images/vsc-10-cmd-run-as-administrator.png) 2. At the command prompt, type the following, and then press ENTER: @@ -150,11 +150,11 @@ The virtual smart card must be provisioned with a sign-in certificate for it to 2. Right-click **Personal**, click **All Tasks**, and then click **Request New Certificate**. - ![Request New Certificate](images/vsc-11-certificates-request-new-certificate.png) + ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) 3. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1). - ![Certificate enrollment, select certificate](images/vsc-12-certificate-enrollment-select-certificate.png) + ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) 4. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)**. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 789da743aa..4d3f59ff0a 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -74,7 +74,7 @@ For more information about these Windows APIs, see: To help users visually distinguish a Trusted Platform Module (TPM)-based virtual smart card from physical smart cards, the virtual smart card has a different icon. The following icon is displayed during sign in, and on other screens that require the user to enter the PIN for a virtual smart card. -![Icon for a virtual smart card](images/vsc-virtual-smart-card-icon.png) +![Icon for a virtual smart card.](images/vsc-virtual-smart-card-icon.png) A TPM-based virtual smart card is labeled **Security Device** in the user interface. diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 9665848076..2c0a581e8d 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -51,7 +51,7 @@ See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EA The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). -![EAP XML configuration in Intune profile](images/vpn-eap-xml.png) +![EAP XML configuration in Intune profile.](images/vpn-eap-xml.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 2c1405d9e0..44b05da541 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -89,11 +89,11 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune. -![Add an app for the VPN connection](images/vpn-app-trigger.png) +![Add an app for the VPN connection.](images/vpn-app-trigger.png) After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. -![Configure rules for the app](images/vpn-app-rules.png) +![Configure rules for the app.](images/vpn-app-rules.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 393bf3b90b..66baa88e46 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -87,7 +87,7 @@ Two client-side configuration service providers are leveraged for VPN device com The VPN client side connection flow works as follows: > [!div class="mx-imgBorder"] -> ![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) +> ![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index e65b9b6d8b..465f79924f 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -23,7 +23,7 @@ Virtual private networks (VPNs) are point-to-point connections across a private There are many options for VPN clients. In Windows 10, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. -![VPN connection types](images/vpn-connection.png) +![VPN connection types.](images/vpn-connection.png) ## Built-in VPN client @@ -67,12 +67,12 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune: > [!div class="mx-imgBorder"] -> ![Available connection types](images/vpn-connection-intune.png) +> ![Available connection types.](images/vpn-connection-intune.png) In Intune, you can also include custom XML for third-party plug-in profiles: > [!div class="mx-imgBorder"] -> ![Custom XML](images/vpn-custom-xml-intune.png) +> ![Custom XML.](images/vpn-custom-xml-intune.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index fcc360257b..70cec8d554 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -64,7 +64,7 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune. -![Add DNS rule](images/vpn-name-intune.png) +![Add DNS rule.](images/vpn-name-intune.png) The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table. diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 69940276c8..96eae8c6ac 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -312,7 +312,7 @@ After you configure the settings that you want using ProfileXML, you can apply i 10. Set Data type to **String (XML file)**. 11. Upload the profile XML file. 12. Click **OK**. - ![Custom VPN profile](images/custom-vpn-profile.png) + ![Custom VPN profile.](images/custom-vpn-profile.png) 13. Click **OK**, then **Create**. 14. Assign the profile. diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index a33e2b0f3f..ea0cb1c3ae 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -53,11 +53,11 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration. -![split tunnel](images/vpn-split.png) +![split tunnel.](images/vpn-split.png) Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection. -![add route for split tunnel](images/vpn-split-route.png) +![add route for split tunnel.](images/vpn-split-route.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index bd1a32dde4..c84ab32cb0 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -59,7 +59,7 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune. -![Add a traffic rule](images/vpn-traffic-rules.png) +![Add a traffic rule.](images/vpn-traffic-rules.png) ## LockDown VPN diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 2c1a02b8db..62a4cf6cf0 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -31,7 +31,7 @@ This guide explains how credential theft attacks occur and the strategies and co - Respond to suspicious activity - Recover from a breach -![Security stages](images/security-stages.png) +![Security stages.](images/security-stages.png) ## Attacks that steal credentials diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index fc9b15fdef..23b9d93073 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -89,7 +89,7 @@ On computers with a compatible TPM, operating system drives that are BitLocker-p In the following Group Policy example, TPM + PIN is required to unlock an operating system drive: -![Pre-boot authentication setting in Group Policy](images/pre-boot-authentication-group-policy.png) +![Pre-boot authentication setting in Group Policy.](images/pre-boot-authentication-group-policy.png) Pre-boot authentication with a PIN can mitigate an attack vector for devices that use a bootable eDrive because an exposed eDrive bus can allow an attacker to capture the BitLocker encryption key during startup. Pre-boot authentication with a PIN can also mitigate DMA port attacks during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port-related policies that have been configured. @@ -110,7 +110,7 @@ This Kernel DMA Protection is available only for new systems beginning with Wind You can use the System Information desktop app (MSINFO32) to check if a device has kernel DMA protection enabled: -![Kernel DMA protection](images/kernel-dma-protection.png) +![Kernel DMA protection.](images/kernel-dma-protection.png) If kernel DMA protection *not* enabled, follow these steps to protect Thunderbolt™ 3 enabled ports: diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index 4864bdf4d4..cd0b6543e6 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -34,31 +34,31 @@ This article depicts the BitLocker deployment comparison chart. |Supported domain-joined status | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory joined, hybrid Azure AD joined | Active Directory joined | |Permissions required to manage policies | Endpoint security manager or custom | Full administrator or custom | Domain Admin or Delegated GPO access | |Cloud or on premises | Cloud | On premises | On premises | -|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | |Additional agent required? | No (device enrollment only) | Configuration Manager client | MBAM client | |Administrative plane | Microsoft Endpoint Manager admin center | Configuration Manager console | Group Policy Management Console and MBAM sites | -|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | -|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | +|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | |Standard recovery password storage location | Azure AD or Active Directory | Configuration Manager site database | MBAM database | |Store recovery password for operating system and fixed drives to Azure AD or Active Directory | Yes (Active Directory and Azure AD) | Yes (Active Directory only) | Yes (Active Directory only) | -|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | -|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | | -|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | +|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | | +|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index eaccfb9c9f..a72324edf4 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -298,18 +298,18 @@ This policy can be configured using GPO under **Computer Configuration** > **Adm It can also be configured using Intune mobile device management (MDM) in the BitLocker CSP: *\./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage\* -![Custom URL](./images/bl-intune-custom-url.png) +![Custom URL.](./images/bl-intune-custom-url.png) Example of customized recovery screen: -![Customized BitLocker Recovery Screen](./images/bl-password-hint1.png) +![Customized BitLocker Recovery Screen.](./images/bl-password-hint1.png) ### BitLocker recovery key hints BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. -![Customized BitLocker recovery screen](./images/bl-password-hint2.png) +![Customized BitLocker recovery screen.](./images/bl-password-hint2.png) > [!IMPORTANT] > We don't recommend printing recovery keys or saving them to a file. Instead, use Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and Microsoft Account. @@ -339,7 +339,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** The hint for the Microsoft Account and the custom URL are displayed. -![Example 1 of Customized BitLocker recovery screen](./images/rp-example1.png) +![Example 1 of Customized BitLocker recovery screen.](./images/rp-example1.png) #### Example 2 (single recovery key with single backup) @@ -354,7 +354,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the custom URL is displayed. -![Example 2 of customized BitLocker recovery screen](./images/rp-example2.png) +![Example 2 of customized BitLocker recovery screen.](./images/rp-example2.png) #### Example 3 (single recovery key with multiple backups) @@ -369,7 +369,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the Microsoft Account hint is displayed. -![Example 3 of customized BitLocker recovery screen](./images/rp-example3.png) +![Example 3 of customized BitLocker recovery screen.](./images/rp-example3.png) #### Example 4 (multiple recovery passwords) @@ -399,7 +399,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the hint for a successfully backed up key is displayed, even if it isn't the most recent key. -![Example 4 of customized BitLocker recovery screen](./images/rp-example4.png) +![Example 4 of customized BitLocker recovery screen.](./images/rp-example4.png) #### Example 5 (multiple recovery passwords) @@ -429,7 +429,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** The hint for the most recent key is displayed. -![Example 5 of customized BitLocker recovery screen](./images/rp-example5.png) +![Example 5 of customized BitLocker recovery screen.](./images/rp-example5.png) ## Using additional recovery information diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index c6483a8057..e8045e225c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -52,7 +52,7 @@ manage-bde -status ``` This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume: -![Using manage-bde to check encryption status](images/manage-bde-status.png) +![Using manage-bde to check encryption status.](images/manage-bde-status.png) The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md index 2a08e910d0..664fb40db0 100644 --- a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -58,7 +58,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in The output of such a command resembles the following. - ![Display of events that is produced by using Get-WinEvent and a BitLocker filter](./images/psget-winevent-1.png) + ![Display of events that is produced by using Get-WinEvent and a BitLocker filter.](./images/psget-winevent-1.png) - To export BitLocker-related information: ```ps @@ -77,7 +77,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in The output of such a command resembles the following. - ![Display of events that is produced by using Get-WinEvent and a TPM filter](./images/psget-winevent-2.png) + ![Display of events that is produced by using Get-WinEvent and a TPM filter.](./images/psget-winevent-2.png) > [!NOTE] > If you intend to contact Microsoft Support, we recommend that you export the logs listed in this section. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index d41b2c7bf1..6268e09343 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -82,11 +82,11 @@ To verify that this issue has occurred, follow these steps: 1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring?view=powershell-6) command in the PowerShell window, as follows. - ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE](./images/ts-bitlocker-usb-sddl.png) + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE.](./images/ts-bitlocker-usb-sddl.png) If you see NT AUTHORITY\INTERACTIVE (as highlighted), in the output of this command, this is the cause of the issue. Under typical conditions, the output should resemble the following: - ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users](./images/ts-bitlocker-usb-default-sddl.png) + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users.](./images/ts-bitlocker-usb-default-sddl.png) > [!NOTE] > GPOs that change the security descriptors of services have been known to cause this issue. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index bab9c21e3e..1def746b1f 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -45,11 +45,11 @@ To install the tool, follow these steps: 1. Accept the default installation path. - ![Specify Location page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-1.png) + ![Specify Location page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-1.png) 1. Under **Select the features you want to install**, select **Windows Hardware Lab Kit—Controller + Studio**. - ![Select features page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-2.png) + ![Select features page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-2.png) 1. Finish the installation. @@ -60,7 +60,7 @@ To use TBSLogGenerator, follow these steps: This folder contains the TBSLogGenerator.exe file. - ![Properties and location of the TBSLogGenerator.exe file](./images/ts-tpm-3.png) + ![Properties and location of the TBSLogGenerator.exe file.](./images/ts-tpm-3.png) 1. Run the following command: ```cmd @@ -78,19 +78,19 @@ To use TBSLogGenerator, follow these steps: TBSLogGenerator.exe -LF C:\MeasuredBoot\0000000005-0000000000.log > C:\MeasuredBoot\0000000005-0000000000.txt ``` - ![Command Prompt window that shows an example of how to use TBSLogGenerator](./images/ts-tpm-4.png) + ![Command Prompt window that shows an example of how to use TBSLogGenerator.](./images/ts-tpm-4.png) The command produces a text file that uses the specified name. In the case of the example, the file is **0000000005-0000000000.txt**. The file is located in the same folder as the original .log file. - ![Windows Explorer window that shows the text file that TBSLogGenerator produces](./images/ts-tpm-5.png) + ![Windows Explorer window that shows the text file that TBSLogGenerator produces.](./images/ts-tpm-5.png) The content of this text file resembles the following. -![Contents of the text file, as shown in NotePad](./images/ts-tpm-6.png) +![Contents of the text file, as shown in NotePad.](./images/ts-tpm-6.png) To find the PCR information, go to the end of the file. - ![View of NotePad that shows the PCR information at the end of the text file](./images/ts-tpm-7.png) + ![View of NotePad that shows the PCR information at the end of the text file.](./images/ts-tpm-7.png) ## Use PCPTool to decode Measured Boot logs @@ -114,4 +114,4 @@ where the variables represent the following values: The content of the XML file resembles the following. -![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) +![Command Prompt window that shows an example of how to use PCPTool.](./images/pcptool-output.jpg) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 60c34a7bb6..611dc64098 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -20,7 +20,7 @@ ms.custom: bitlocker This article helps you troubleshoot issues that you may experience if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. The Intune portal indicates whether BitLocker has failed to encrypt one or more managed devices. -![The BitLocker status indictors on the Intune portal](./images/4509189-en-1.png) +![The BitLocker status indictors on the Intune portal.](./images/4509189-en-1.png) To start narrowing down the cause of the problem, review the event logs as described in [Troubleshoot BitLocker](troubleshoot-bitlocker.md). Concentrate on the Management and Operations logs in the **Applications and Services logs\\Microsoft\\Windows\\BitLocker-API** folder. The following sections provide more information about how to resolve the indicated events and error messages: @@ -43,7 +43,7 @@ For information about how to verify that Intune policies are enforcing BitLocker Event ID 853 can carry different error messages, depending on the context. In this case, the Event ID 853 error message indicates that the device does not appear to have a TPM. The event information resembles the following: -![Details of event ID 853 (TPM is not available, cannot find TPM)](./images/4509190-en-1.png) +![Details of event ID 853 (TPM is not available, cannot find TPM).](./images/4509190-en-1.png) ### Cause @@ -64,7 +64,7 @@ For more information, see [Troubleshoot the TPM](../tpm/initialize-and-configure In this case, you see event ID 853, and the error message in the event indicates that bootable media is available to the device. The event information resembles the following. -![Details of event ID 853 (TPM is not available, bootable media found)](./images/4509191-en-1.png) +![Details of event ID 853 (TPM is not available, bootable media found).](./images/4509191-en-1.png) ### Cause @@ -100,7 +100,7 @@ You can resolve this issue by verifying the configuration of the disk partitions The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 10 automatically creates a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. -![Default disk partitions, including the recovery partition](./images/4509194-en-1.png) +![Default disk partitions, including the recovery partition.](./images/4509194-en-1.png) To verify the configuration of the disk partitions, open an elevated Command Prompt window, and run the following commands: @@ -108,11 +108,11 @@ To verify the configuration of the disk partitions, open an elevated Command Pro diskpart list volume ``` -![Output of the list volume command in the Diskpart app](./images/4509195-en-1.png) +![Output of the list volume command in the Diskpart app.](./images/4509195-en-1.png) If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Endpoint Configuration Manager). -![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/configmgr-imageconfig.jpg) +![Windows image configuration in Microsoft Endpoint Configuration Manager.](./images/configmgr-imageconfig.jpg) #### Step 2: Verify the status of WinRE @@ -123,7 +123,7 @@ reagentc /info ``` The output of this command resembles the following. -![Output of the reagentc /info command](./images/4509193-en-1.png) +![Output of the reagentc /info command.](./images/4509193-en-1.png) If the **Windows RE status** is not **Enabled**, run the following command to enable it: @@ -141,7 +141,7 @@ bcdedit /enum all The output of this command resembles the following. -![Output of the bcdedit /enum all command](./images/4509196-en-1.png) +![Output of the bcdedit /enum all command.](./images/4509196-en-1.png) In the output, locate the **Windows Boot Loader** section that includes the line **identifier={current}**. In that section, locate the **recoverysequence** attribute. The value of this attribute should be a GUID value, not a string of zeros. @@ -163,7 +163,7 @@ To verify the BIOS mode, use the System Information app. To do this, follow thes 1. Select **Start**, and enter **msinfo32** in the **Search** box. 1. Verify that the **BIOS Mode** setting is **UEFI** and not **Legacy**. - ![System Information app, showing the BIOS Mode setting](./images/4509198-en-1.png) + ![System Information app, showing the BIOS Mode setting.](./images/4509198-en-1.png) 1. If the **BIOS Mode** setting is **Legacy**, you have to switch the BIOS into **UEFI** or **EFI** mode. The steps for doing this are specific to the device. > [!NOTE] > If the device supports only Legacy mode, you cannot use Intune to manage BitLocker Device Encryption on the device. @@ -192,11 +192,11 @@ Manage-bde -protectors -get %systemdrive% In the TPM section of the output of this command, verify that the **PCR Validation Profile** setting includes **7**, as follows. -![Output of the manage-bde command](./images/4509199-en-1.png) +![Output of the manage-bde command.](./images/4509199-en-1.png) If **PCR Validation Profile** doesn't include **7** (for example, the values include **0**, **2**, **4**, and **11**, but not **7**), then Secure Boot is not turned on. -![Output of the manage-bde command when PCR 7 is not present](./images/4509200-en-1.png) +![Output of the manage-bde command when PCR 7 is not present.](./images/4509200-en-1.png) #### 2. Verify the Secure Boot state @@ -204,9 +204,9 @@ To verify the Secure Boot state, use the System Information app. To do this, fol 1. Select **Start**, and enter **msinfo32** in the **Search** box. 1. Verify that the **Secure Boot State** setting is **On**, as follows: - ![System Information app, showing a supported Secure Boot State](./images/4509201-en-1.png) + ![System Information app, showing a supported Secure Boot State.](./images/4509201-en-1.png) 1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device. - ![System Information app, showing a unsupported Secure Boot State](./images/4509202-en-1.png) + ![System Information app, showing a unsupported Secure Boot State.](./images/4509202-en-1.png) > [!NOTE] > You can also use the [Confirm-SecureBootUEFI](/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: @@ -290,7 +290,7 @@ If your device runs Windows 10 version 1703 or later, supports Modern Standby (a If your device is HSTI-compliant but does not support Modern Standby, you have to configure an endpoint protection policy to enforce silent BitLocker Drive Encryption. The settings for this policy should resemble the following: -![Intune policy settings](./images/4509186-en-1.png) +![Intune policy settings.](./images/4509186-en-1.png) The OMA-URI references for these settings are as follows: @@ -316,7 +316,7 @@ The Intune 1901 release provides settings that you can use to configure automati - Support Modern Standby - Use Windows 10 version 1803 or later -![Intune policy setting](./images/4509188-en-1.png) +![Intune policy setting.](./images/4509188-en-1.png) The OMA-URI references for these settings are as follows: @@ -331,17 +331,17 @@ The OMA-URI references for these settings are as follows: During regular operations, BitLocker Drive Encryption generates events such as Event ID 796 and Event ID 845. -![Event ID 796, as shown in Event Viewer](./images/4509203-en-1.png) +![Event ID 796, as shown in Event Viewer.](./images/4509203-en-1.png) -![Event ID 845, as shown in Event Viewer](./images/4509204-en-1.png) +![Event ID 845, as shown in Event Viewer.](./images/4509204-en-1.png) You can also determine whether the BitLocker recovery password has been uploaded to Azure AD by checking the device details in the Azure AD Devices section. -![BitLocker recovery information as viewed in Azure AD](./images/4509205-en-1.png) +![BitLocker recovery information as viewed in Azure AD.](./images/4509205-en-1.png) On the device, check the Registry Editor to verify the policy settings on the device. Verify the entries under the following subkeys: - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\BitLocker** - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device** -![Registry subkeys that relate to Intune policy](./images/4509206-en-1.png) \ No newline at end of file +![Registry subkeys that relate to Intune policy.](./images/4509206-en-1.png) \ No newline at end of file diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 31fc1097a4..768d8cdd75 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -53,7 +53,7 @@ By default, peripherals with DMA Remapping incompatible drivers will be blocked ## User experience -![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) +![Kernel DMA protection user experience.](images/kernel-dma-protection-user-experience.png) By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or logs out of the system. @@ -77,7 +77,7 @@ Systems running Windows 10 version 1803 that do support Kernel DMA Protection do Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. -![Kernel DMA protection in Security Center](bitlocker/images/kernel-dma-protection-security-center.png) +![Kernel DMA protection in Security Center.](bitlocker/images/kernel-dma-protection-security-center.png) ### Using System information @@ -85,7 +85,7 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if 2. Check the value of **Kernel DMA Protection**. - ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png) + ![Kernel DMA protection in System Information.](bitlocker/images/kernel-dma-protection.png) 3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: @@ -113,11 +113,11 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). -![Kernel DMA protection user experience](images/device_details_tab_1903.png) +![Kernel DMA protection user experience.](images/device_details_tab_1903.png) *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. -![Kernel DMA protection user experience](images/device-details-tab.png) +![Kernel DMA protection user experience.](images/device-details-tab.png) ### What should I do if the drivers for my PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 721ae1e1e3..3d8754473d 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -55,7 +55,7 @@ Windows 10 supports four features to help prevent rootkits and bootkits from lo Figure 1 shows the Windows 10 startup process. -![Windows 10 startup process](./images/dn168167.boot_process(en-us,MSDN.10).png) +![Windows 10 startup process.](./images/dn168167.boot_process(en-us,MSDN.10).png) **Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage** @@ -115,7 +115,7 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. -![Measured Boot and remote attestation process](./images/dn168167.measure_boot(en-us,MSDN.10).png) +![Measured Boot and remote attestation process.](./images/dn168167.measure_boot(en-us,MSDN.10).png) **Figure 2. Measured Boot proves the PC’s health to a remote server** diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index 06d8c54066..dd9e12558e 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -84,7 +84,7 @@ Identity providers have flexibility in how they provision credentials on client • **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios. -![TPM Capabilities](images/tpm-capabilities.png) +![TPM Capabilities.](images/tpm-capabilities.png) *Figure 1: TPM Cryptographic Key Management* @@ -126,7 +126,7 @@ The TPM provides the following way for scenarios to use the measurements recorde When new security features are added to Windows, Measured Boot adds security-relevant configuration information to the measurements recorded in the TPM. Measured Boot enables remote attestation scenarios that reflect the system firmware and the Windows initialization state. -![Process to Create Evidence of Boot Software and Configuration Using TPM](images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png) +![Process to Create Evidence of Boot Software and Configuration Using TPM.](images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png) *Figure 2: Process used to create evidence of boot software and configuration using a TPM* diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 4a5ddd2df2..5a5e12feb9 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -91,7 +91,7 @@ It's possible that you might revoke data from an unenrolled device only to later To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. - ![Robocopy in S mode](images/robocopy-s-mode.png) + ![Robocopy in S mode.](images/robocopy-s-mode.png) If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index a605d96688..909073181d 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -34,11 +34,11 @@ Follow these steps to associate your WIP policy with your organization's existin 2. Open the Microsoft Intune mobile application management console, click **Device configuration**, and then click **Create Profile**. - ![Microsoft Intune, Create a new policy using the portal](images/wip-azure-vpn-device-policy.png) + ![Microsoft Intune, Create a new policy using the portal.](images/wip-azure-vpn-device-policy.png) 3. In the **Create Profile** blade, type a name for your profile, such as *Contoso_VPN_Win10*, into the **Name** box, add an optional description for your policy into the **Description** box, select **Windows 10 and later** from the **Platform** dropdown box, select **Custom** from the **Profile type** dropdown box, and then click **Configure**. - ![Microsoft Intune, Create a new policy using the Create Profile blade](images/wip-azure-vpn-configure-policy.png) + ![Microsoft Intune, Create a new policy using the Create Profile blade.](images/wip-azure-vpn-configure-policy.png) 4. In the **Custom OMA-URI Settings** blade, click **Add**. @@ -54,7 +54,7 @@ Follow these steps to associate your WIP policy with your organization's existin - **Value.** Type your fully-qualified domain that should be used by the OMA-URI setting. For example, _corp.contoso.com_. - ![Microsoft Intune, Add your OMA-URI settings](images/wip-azure-vpn-custom-omauri.png) + ![Microsoft Intune, Add your OMA-URI settings.](images/wip-azure-vpn-custom-omauri.png) 6. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy. @@ -73,7 +73,7 @@ After you’ve created your VPN policy, you'll need to deploy it to the same gro The policy is deployed to the selected users' devices. - ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) + ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed.](images/wip-azure-add-user-groups.png) >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md index f13e30a044..32511b9cd5 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -36,12 +36,12 @@ After you've installed and set up Configuration Manager for your organization, y 1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - ![Configuration Manager, Configuration Items screen](images/wip-configmgr-addpolicy.png) + ![Configuration Manager, Configuration Items screen.](images/wip-configmgr-addpolicy.png) 2. Click the **Create Configuration Item** button.

The **Create Configuration Item Wizard** starts. - ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-configmgr-generalscreen.png) + ![Create Configuration Item wizard, define the configuration item and choose the configuration type.](images/wip-configmgr-generalscreen.png) 3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. @@ -55,11 +55,11 @@ The **Create Configuration Item Wizard** starts. 5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**. - ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-configmgr-supportedplat.png) + ![Create Configuration Item wizard, choose the supported platforms for the policy.](images/wip-configmgr-supportedplat.png) 6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. - ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-configmgr-devicesettings.png) + ![Create Configuration Item wizard, choose the Windows Information Protection settings.](images/wip-configmgr-devicesettings.png) The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. @@ -81,7 +81,7 @@ For this example, we're going to add Microsoft OneNote, a store app, to the **Ap The **Add app rule** box appears. - ![Create Configuration Item wizard, add a universal store app](images/wip-configmgr-adduniversalapp.png) + ![Create Configuration Item wizard, add a universal store app.](images/wip-configmgr-adduniversalapp.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Microsoft OneNote*. @@ -141,7 +141,7 @@ For this example, we're going to add Internet Explorer, a desktop app, to the ** The **Add app rule** box appears. - ![Create Configuration Item wizard, add a classic desktop app](images/wip-configmgr-adddesktopapp.png) + ![Create Configuration Item wizard, add a classic desktop app.](images/wip-configmgr-adddesktopapp.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Internet Explorer*. @@ -218,7 +218,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** 2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) + ![Local security snap-in, showing the Packaged app Rules.](images/intune-local-security-snapin.png) 3. Right-click in the right-hand pane, and then click **Create New Rule**. @@ -226,33 +226,33 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** 4. On the **Before You Begin** page, click **Next**. - ![Create a Packaged app Rules wizard and showing the Before You Begin page](images/intune-applocker-before-begin.png) + ![Create a Packaged app Rules wizard and showing the Before You Begin page.](images/intune-applocker-before-begin.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. - ![Create Packaged app Rules wizard, set action to Allow](images/intune-applocker-permissions.png) + ![Create Packaged app Rules wizard, set action to Allow.](images/intune-applocker-permissions.png) 6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. - ![Create Packaged app Rules wizard, select use an installed packaged app](images/intune-applocker-publisher.png) + ![Create Packaged app Rules wizard, select use an installed packaged app.](images/intune-applocker-publisher.png) 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we're using Microsoft Photos. - ![Create Packaged app Rules wizard, select application and click ok](images/intune-applocker-select-apps.png) + ![Create Packaged app Rules wizard, select application and click ok.](images/intune-applocker-select-apps.png) 8. On the updated **Publisher** page, click **Create**. - ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page.](images/intune-applocker-publisher-with-app.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) + ![Local security snap-in, showing the new rule.](images/intune-local-security-snapin-updated.png) 10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) + ![Local security snap-in, showing the Export Policy option.](images/intune-local-security-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. @@ -286,7 +286,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** The **Add app rule** box appears. - ![Create Configuration Item wizard, add an AppLocker policy](images/wip-configmgr-addapplockerfile.png) + ![Create Configuration Item wizard, add an AppLocker policy.](images/wip-configmgr-addapplockerfile.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Allowed app list*. @@ -353,7 +353,7 @@ You can specify multiple domains owned by your enterprise by separating them wit - Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. - ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-configmgr-corp-identity.png) + ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity.](images/wip-configmgr-corp-identity.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. @@ -372,7 +372,7 @@ There are no default locations included with WIP, you must add each of your netw 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-configmgr-add-network-domain.png) + ![Add or edit corporate network definition box, Add your enterprise network locations.](images/wip-configmgr-add-network-domain.png)

@@ -431,7 +431,7 @@ There are no default locations included with WIP, you must add each of your netw 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-configmgr-dra.png) + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate.](images/wip-configmgr-dra.png) After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. @@ -440,7 +440,7 @@ There are no default locations included with WIP, you must add each of your netw ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you'll be asked to decide if you want to add any optional WIP settings. -![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-configmgr-additionalsettings.png) +![Create Configuration Item wizard, Choose any additional, optional settings.](images/wip-configmgr-additionalsettings.png) **To set your optional settings** 1. Choose to set any or all of the optional settings: @@ -467,7 +467,7 @@ After you've finished configuring your policy, you can review all of your info o **To view the Summary screen** - Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. - ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-configmgr-summaryscreen.png) + ![Create Configuration Item wizard, Summary screen for all of your policy choices.](images/wip-configmgr-summaryscreen.png) A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 17dcaff4f3..0442c3778a 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -50,7 +50,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 3. Click **Restore Default URLs** or enter the settings for MDM or MAM user scope and click **Save**: - ![Configure MDM or MAM provider](images/mobility-provider.png) + ![Configure MDM or MAM provider.](images/mobility-provider.png) ## Create a WIP policy @@ -58,7 +58,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 2. Open Microsoft Intune and click **Apps** > **App protection policies** > **Create policy**. - ![Open Client apps](images/create-app-protection-policy.png) + ![Open Client apps.](images/create-app-protection-policy.png) 3. In the **App policy** screen, click **Add a policy**, and then fill out the fields: @@ -70,11 +70,11 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or - **Enrollment state.** Choose **Without enrollment** for MAM or **With enrollment** for MDM. - ![Add a mobile app policy](images/add-a-mobile-app-policy.png) + ![Add a mobile app policy.](images/add-a-mobile-app-policy.png) 4. Click **Protected apps** and then click **Add apps**. - ![Add protected apps](images/add-protected-apps.png) + ![Add protected apps.](images/add-protected-apps.png) You can add these types of apps: @@ -89,7 +89,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or Select **Recommended apps** and select each app you want to access your enterprise data or select them all, and click **OK**. -![Microsoft Intune management console: Recommended apps](images/recommended-apps.png) +![Microsoft Intune management console: Recommended apps.](images/recommended-apps.png) ### Add Store apps @@ -99,7 +99,7 @@ Select **Store apps**, type the app product name and publisher, and click **OK** - **Publisher**: `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` - **Product Name**: `Microsoft.MicrosoftPowerBIForWindows` -![Add Store app](images/add-a-protected-store-app.png) +![Add Store app.](images/add-a-protected-store-app.png) To add multiple Store apps, click the ellipsis **…**. @@ -201,7 +201,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo To add another Desktop app, click the ellipsis **…**. After you’ve entered the info into the fields, click **OK**. -![Microsoft Intune management console: Adding Desktop app info](images/wip-azure-add-desktop-apps.png) +![Microsoft Intune management console: Adding Desktop app info.](images/wip-azure-add-desktop-apps.png) If you’re unsure about what to include for the publisher, you can run this PowerShell command: @@ -242,7 +242,7 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules](images/wip-applocker-secpol-1.png) + ![Local security snap-in, showing the Packaged app Rules.](images/wip-applocker-secpol-1.png) 3. Right-click in the right-hand blade, and then click **Create New Rule**. @@ -250,7 +250,7 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 4. On the **Before You Begin** page, click **Next**. - ![Screenshot of the Before You Begin tab](images/wip-applocker-secpol-wizard-1.png) + ![Screenshot of the Before You Begin tab.](images/wip-applocker-secpol-wizard-1.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. @@ -262,25 +262,25 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365. - ![Screenshot of the Select applications list](images/wip-applocker-secpol-wizard-4.png) + ![Screenshot of the Select applications list.](images/wip-applocker-secpol-wizard-4.png) 8. On the updated **Publisher** page, click **Create**. - ![Screenshot of the Publisher tab](images/wip-applocker-secpol-wizard-5.png) + ![Screenshot of the Publisher tab.](images/wip-applocker-secpol-wizard-5.png) 9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy. - ![Screenshot of AppLocker warning](images/wip-applocker-default-rule-warning.png) + ![Screenshot of AppLocker warning.](images/wip-applocker-default-rule-warning.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule](images/wip-applocker-secpol-create.png) + ![Local security snap-in, showing the new rule.](images/wip-applocker-secpol-create.png) 10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option](images/wip-applocker-secpol-export.png) + ![Local security snap-in, showing the Export Policy option.](images/wip-applocker-secpol-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. @@ -320,7 +320,7 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 3. Right-click **Executable Rules** > **Create New Rule**. - ![Local security snap-in, showing the Executable Rules](images/create-new-path-rule.png) + ![Local security snap-in, showing the Executable Rules.](images/create-new-path-rule.png) 4. On the **Before You Begin** page, click **Next**. @@ -328,11 +328,11 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 6. On the **Conditions** page, click **Path** and then click **Next**. - ![Screenshot with Path conditions selected in the Create Executable Rules wizard](images/path-condition.png) + ![Screenshot with Path conditions selected in the Create Executable Rules wizard.](images/path-condition.png) 7. Click **Browse Folders...** and select the path for the unsigned apps. For this example, we’re using "C:\Program Files". - ![Screenshot of the Path field of the Create Executable Rules wizard](images/select-path.png) + ![Screenshot of the Path field of the Create Executable Rules wizard.](images/select-path.png) 8. On the **Exceptions** page, add any exceptions and then click **Next**. @@ -351,11 +351,11 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 1. In **Protected apps**, click **Import apps**. - ![Import protected apps](images/import-protected-apps.png) + ![Import protected apps.](images/import-protected-apps.png) Then import your file. - ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/wip-azure-import-apps.png) + ![Microsoft Intune, Importing your AppLocker policy file using Intune.](images/wip-azure-import-apps.png) 2. Browse to your exported AppLocker policy file, and then click **Open**. @@ -366,7 +366,7 @@ If your app is incompatible with WIP, but still needs to be used with enterprise 1. In **Client apps - App protection policies**, click **Exempt apps**. - ![Exempt apps](images/exempt-apps.png) + ![Exempt apps.](images/exempt-apps.png) 2. In **Exempt apps**, click **Add apps**. @@ -391,7 +391,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi 1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. - ![Microsoft Intune, Required settings blade showing Windows Information Protection mode](images/wip-azure-required-settings-protection-mode.png) + ![Microsoft Intune, Required settings blade showing Windows Information Protection mode.](images/wip-azure-required-settings-protection-mode.png) |Mode |Description | |-----|------------| @@ -413,11 +413,11 @@ Starting with Windows 10, version 1703, Intune automatically determines your cor 2. If the auto-defined identity isn’t correct, you can change the info in the **Corporate identity** field. - ![Microsoft Intune, Set your corporate identity for your organization](images/wip-azure-required-settings-corp-identity.png) + ![Microsoft Intune, Set your corporate identity for your organization.](images/wip-azure-required-settings-corp-identity.png) 3. To add domains, such your email domain names, click **Configure Advanced settings** > **Add network boundary** and select **Protected domains**. - ![Add protected domains](images/add-protected-domains.png) + ![Add protected domains.](images/add-protected-domains.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. Every WIP policy should include your enterprise network locations. @@ -426,7 +426,7 @@ There are no default locations included with WIP, you must add each of your netw To define the network boundaries, click **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**. -![Microsoft Intune, Set where your apps can access enterprise data on your network](images/wip-azure-advanced-settings-network.png) +![Microsoft Intune, Set where your apps can access enterprise data on your network.](images/wip-azure-advanced-settings-network.png) Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then click **OK**. @@ -558,7 +558,7 @@ Decide if you want Windows to look for additional network settings: - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for additional IP ranges on any domain-joined devices connected to your network. -![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise](images/wip-azure-advanced-settings-network-autodetect.png) +![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise.](images/wip-azure-advanced-settings-network-autodetect.png) ## Upload your Data Recovery Agent (DRA) certificate After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data. @@ -573,12 +573,12 @@ After you create and deploy your WIP policy to your employees, Windows begins to 2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate](images/wip-azure-advanced-settings-efsdra.png) + ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate.](images/wip-azure-advanced-settings-efsdra.png) ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you can choose optional settings. -![Advanced optional settings](images/wip-azure-advanced-settings-optional.png) +![Advanced optional settings.](images/wip-azure-advanced-settings-optional.png) **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: @@ -613,7 +613,7 @@ After you've decided where your protected apps can access enterprise data on you You can restrict which files are protected by WIP when they are downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied. -![WIP encrypted file extensions](images/wip-encrypted-file-extensions.png) +![WIP encrypted file extensions.](images/wip-encrypted-file-extensions.png) ## Related topics diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index 524199cf73..8d929e1db4 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -34,7 +34,7 @@ After you’ve created your Windows Information Protection (WIP) policy, you'll The policy is deployed to the selected users' devices. - ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) + ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed.](images/wip-azure-add-user-groups.png) >[!NOTE] diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index b54cc7cbe1..dd3fb2529e 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -36,13 +36,13 @@ You need to add the Enterprise Context column to the **Details** tab of the Task The **Select columns** box appears. - ![Task Manager, Select column box with Enterprise Context option selected](images/wip-select-column.png) + ![Task Manager, Select column box with Enterprise Context option selected.](images/wip-select-column.png) 3. Scroll down and check the **Enterprise Context** option, and then click **OK** to close the box. The **Enterprise Context** column should now be available in Task Manager. - ![Task Manager, Enterprise Context column highlighted](images/wip-taskmgr.png) + ![Task Manager, Enterprise Context column highlighted.](images/wip-taskmgr.png) ## Review the Enterprise Context The **Enterprise Context** column shows you what each app can do with your enterprise data: diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index 1e97616ee8..e2f9ce0a1f 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -38,11 +38,11 @@ In the **Website learning report**, you can view a summary of the devices that h 1. Click **Intune** > **Client apps** > **App protection status** > **Reports**. - ![Image showing the UI path to the WIP report](images/access-wip-learning-report.png) + ![Image showing the UI path to the WIP report.](images/access-wip-learning-report.png) 1. Select either **App learning report for Windows Information Protection** or **Website learning report for Windows Information Protection**. - ![Image showing the UI with for app and website learning reports](images/wip-learning-select-report.png) + ![Image showing the UI with for app and website learning reports.](images/wip-learning-select-report.png) Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. @@ -75,7 +75,7 @@ The information needed for the following steps can be found using Device Health, 4. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app). - ![View of drop down menu for Store or desktop apps](images/wip-learning-choose-store-or-desktop-app.png) + ![View of drop down menu for Store or desktop apps.](images/wip-learning-choose-store-or-desktop-app.png) 5. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 1 above. @@ -87,7 +87,7 @@ The information needed for the following steps can be found using Device Health, `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US` - ![View of Add Apps app info entry boxes](images/wip-learning-app-info.png) + ![View of Add Apps app info entry boxes.](images/wip-learning-app-info.png) 6. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 1ede3ef4ed..ea4b252a30 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -58,7 +58,7 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] 3. Double-click **Turn on Virtualization Based Security**. 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. - ![Enable HVCI using Group Policy](../images/enable-hvci-gp.png) + ![Enable HVCI using Group Policy.](../images/enable-hvci-gp.png) 5. Click **Ok** to close the editor. @@ -279,7 +279,7 @@ This field lists the computer name. All valid values for computer name. Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section. -![Windows Defender Device Guard properties in the System Summary](../images/dg-fig11-dgproperties.png) +![Windows Defender Device Guard properties in the System Summary.](../images/dg-fig11-dgproperties.png) ## Troubleshooting diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md index 6e6173e36d..def1ec0b93 100644 --- a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md +++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md @@ -17,7 +17,7 @@ ms.technology: mde --- # Coordinated Malware Eradication -![coordinated-malware-eradication](images/CoordinatedMalware.png) +![coordinated-malware-eradication.](images/CoordinatedMalware.png) Coordinated Malware Eradication (CME) aims to bring organizations in cybersecurity and in other industries together to change the game against malware. While the cybersecurity industry today is effective at disrupting malware families through individual efforts, those disruptions rarely lead to eradication since malware authors quickly adapt their tactics to survive. diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index e2029f3c2c..b125773d18 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -25,7 +25,7 @@ Attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) fo For clarity, fileless threats are grouped into different categories. -![Comprehensive diagram of fileless malware](images/fileless-malware.png)
+![Comprehensive diagram of fileless malware.](images/fileless-malware.png)
*Figure 1. Comprehensive diagram of fileless malware* Fileless threats can be classified by their entry point, which indicates how fileless malware can arrive on a machine. They can arrive via an exploit, through compromised hardware, or via regular execution of applications and scripts. @@ -56,7 +56,7 @@ It’s possible to carry out such installation via command line without requirin Some malware can have a sort of fileless persistence, but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. Opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe. -![Image of Kovter's registry key](images/kovter-reg-key.png)
+![Image of Kovter's registry key.](images/kovter-reg-key.png)
*Figure 2. Kovter’s registry key* When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an autorun key configured to open such file when the machine starts. diff --git a/windows/security/threat-protection/intelligence/malware-naming.md b/windows/security/threat-protection/intelligence/malware-naming.md index ef4a133061..3b37bdf391 100644 --- a/windows/security/threat-protection/intelligence/malware-naming.md +++ b/windows/security/threat-protection/intelligence/malware-naming.md @@ -20,7 +20,7 @@ ms.technology: mde We name the malware and unwanted software that we detect according to the Computer Antivirus Research Organization (CARO) malware naming scheme. The scheme uses the following format: -![coordinated-malware-eradication](images/NamingMalware1.png) +![coordinated-malware-eradication.](images/NamingMalware1.png) When our analysts research a particular threat, they'll determine what each of the components of the name will be. diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 1f997dac95..01c216b8fe 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -35,7 +35,7 @@ Here are several telltale signs of a phishing scam: * The links or URLs provided in emails are **not pointing to the correct location** or are pointing to a third-party site not affiliated with the sender of the email. For example, in the image below the URL provided doesn't match the URL that you'll be taken to. - ![example of how exploit kits work](./images/URLhover.png) + ![example of how exploit kits work.](./images/URLhover.png) * There's a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email. diff --git a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md index 00eafc82ce..ae7c0e8363 100644 --- a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md +++ b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md @@ -33,7 +33,7 @@ This process requires a global or application admin in the tenant. 2. Select **Grant admin consent for organization**. 3. If you're able to do so, review the API permissions required for this application, as the following image shows. Provide consent for the tenant. - ![grant consent image](images/msi-grant-admin-consent.jpg) + ![grant consent image.](images/msi-grant-admin-consent.jpg) 4. If the administrator receives an error while attempting to provide consent manually, try either [Option 1](#option-1-approve-enterprise-application-permissions-by-user-request) or [Option 2](#option-2-provide-admin-consent-by-authenticating-the-application-as-an-admin) as possible workarounds.   @@ -43,13 +43,13 @@ This process requires a global or application admin in the tenant. Azure Active Directory admins will need to allow for users to request admin consent to apps. Verify the setting is configured to **Yes** in [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/UserSettings/menuId/). -![Enterprise applications user settings](images/msi-enterprise-app-user-setting.jpg) +![Enterprise applications user settings.](images/msi-enterprise-app-user-setting.jpg) More information is available in [Configure Admin consent workflow](/azure/active-directory/manage-apps/configure-admin-consent-workflow). Once this setting is verified, users can go through the enterprise customer sign-in at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission), and submit a request for admin consent, including justification. -![Contoso sign in flow](images/msi-contoso-approval-required.png) +![Contoso sign in flow.](images/msi-contoso-approval-required.png) Admin will be able to review and approve the application permissions [Azure admin consent requests](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AccessRequests/menuId/). @@ -58,7 +58,7 @@ After providing consent, all users in the tenant will be able to use the applica ## Option 2 Provide admin consent by authenticating the application as an admin This process requires that global admins go through the Enterprise customer sign-in flow at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission). -![Consent sign in flow](images/msi-microsoft-permission-required.jpg) +![Consent sign in flow.](images/msi-microsoft-permission-required.jpg) Then, admins review the permissions and make sure to select **Consent on behalf of your organization**, and then select **Accept**. @@ -70,20 +70,20 @@ If neither of these options resolve the issue, try the following steps (as an ad 1. Remove previous configurations for the application. Go to [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Properties/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/982e94b2-fea9-4d1f-9fca-318cda92f90b) and select **delete**. - ![Delete app permissions](images/msi-properties.png) + ![Delete app permissions.](images/msi-properties.png) 2. Capture TenantID from [Properties](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Properties). 3. Replace {tenant-id} with the specific tenant that needs to grant consent to this application in the URL below. Copy this URL into browser. The rest of the parameters are already completed. ``https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=f0cf43e5-8a9b-451c-b2d5-7285c785684d&state=12345&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fwdsi%2ffilesubmission&scope=openid+profile+email+offline_access`` - ![Permissions needed](images/msi-microsoft-permission-requested-your-organization.png) + ![Permissions needed.](images/msi-microsoft-permission-requested-your-organization.png) 4. Review the permissions required by the application, and then select **Accept**. 5. Confirm the permissions are applied in the [Azure portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Permissions/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/ce60a464-5fca-4819-8423-bcb46796b051). - ![Review that permissions are applied](images/msi-permissions.jpg) + ![Review that permissions are applied.](images/msi-permissions.jpg) 6. Sign in to [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission) as an enterprise user with a non-admin account to see if you have access. diff --git a/windows/security/threat-protection/intelligence/worms-malware.md b/windows/security/threat-protection/intelligence/worms-malware.md index ed4e5aaf84..2aa32ed8f6 100644 --- a/windows/security/threat-protection/intelligence/worms-malware.md +++ b/windows/security/threat-protection/intelligence/worms-malware.md @@ -39,7 +39,7 @@ Both Bondat and Gamarue have clever ways of obscuring themselves to evade detect This image shows how a worm can quickly spread through a shared USB drive. -![Worm example](./images/WormUSB-flight.png) +![Worm example.](./images/WormUSB-flight.png) ### *Figure worm spreading from a shared USB drive* diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index f0c6938382..83a6f5e00b 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -29,8 +29,8 @@ For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with Po For example: -[![VBS script](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) -[![PowerShell script](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) +[![VBS script.](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) +[![PowerShell script.](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index 994ade09de..3b18ab25d3 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -45,7 +45,7 @@ Applies to: You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. The following diagram shows the flow between the host PC and the isolated container. -![Flowchart for movement between Microsoft Edge and Application Guard](images/application-guard-container-v-host.png) +![Flowchart for movement between Microsoft Edge and Application Guard.](images/application-guard-container-v-host.png) ## Install Application Guard @@ -55,7 +55,7 @@ Application Guard functionality is turned off by default. However, you can quick 1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**. - ![Windows Features, turning on Microsoft Defender Application Guard](images/turn-windows-features-on-off.png) + ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png) 2. Select the check box next to **Microsoft Defender Application Guard** and then click **OK**. @@ -86,7 +86,7 @@ Application Guard functionality is turned off by default. However, you can quick > [!IMPORTANT] > Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](/mem/intune/enrollment/device-enrollment). -:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune"::: +:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune."::: 1. Go to [https://endpoint.microsoft.com](https://endpoint.microsoft.com) and sign in. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index de798293db..4ad66674a9 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -29,7 +29,7 @@ For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrus For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. For example, this approach makes the isolated container anonymous, so an attacker can't get to your employee's enterprise credentials. -![Hardware isolation diagram](images/appguard-hardware-isolation.png) +![Hardware isolation diagram.](images/appguard-hardware-isolation.png) ### What types of devices should use Application Guard? diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index 74525211f8..d8ff39f397 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -33,7 +33,7 @@ You can see how an employee would use standalone mode with Application Guard. 2. Restart the device, start Microsoft Edge, and then select **New Application Guard window** from the menu. - ![New Application Guard window setting option](images/appguard-new-window.png) + ![New Application Guard window setting option.](images/appguard-new-window.png) 3. Wait for Application Guard to set up the isolated environment. @@ -42,7 +42,7 @@ You can see how an employee would use standalone mode with Application Guard. 4. Go to an untrusted, but safe URL (for this example, we used msn.com) and view the new Microsoft Edge window, making sure you see the Application Guard visual cues. - ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) + ![Untrusted website running in Application Guard.](images/appguard-visual-cues.png) ## Application Guard in Enterprise-managed mode @@ -64,19 +64,19 @@ Before you can use Application Guard in managed mode, you must install Windows 1 c. For the purposes of this scenario, type `.microsoft.com` into the **Enterprise cloud resources** box. - ![Group Policy editor with Enterprise cloud resources setting](images/appguard-gp-network-isolation.png) + ![Group Policy editor with Enterprise cloud resources setting.](images/appguard-gp-network-isolation.png) d. Go to the **Administrative Templates\Network\Network Isolation\Domains categorized as both work and personal** setting. e. For the purposes of this scenario, type `bing.com` into the **Neutral resources** box. - ![Group Policy editor with Neutral resources setting](images/appguard-gp-network-isolation-neutral.png) + ![Group Policy editor with Neutral resources setting.](images/appguard-gp-network-isolation-neutral.png) 4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Turn on Microsoft Defender Application Guard in Managed Mode** setting. 5. Click **Enabled**, choose Option **1**, and click **OK**. - ![Group Policy editor with Turn On/Off setting](images/appguard-gp-turn-on.png) + ![Group Policy editor with Turn On/Off setting.](images/appguard-gp-turn-on.png) >[!NOTE] >Enabling this setting verifies that all the necessary settings are properly configured on your employee devices, including the network isolation settings set earlier in this scenario. @@ -85,13 +85,13 @@ Before you can use Application Guard in managed mode, you must install Windows 1 After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you've marked as trusted and shows the site directly on the host PC instead of in Application Guard. - ![Trusted website running on Microsoft Edge](images/appguard-turned-on-with-trusted-site.png) + ![Trusted website running on Microsoft Edge.](images/appguard-turned-on-with-trusted-site.png) 7. In the same Microsoft Edge browser, type any URL that isn't part of your trusted or neutral site lists. After you submit the URL, Application Guard determines the URL is untrusted and redirects the request to the hardware-isolated environment. - ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) + ![Untrusted website running in Application Guard.](images/appguard-visual-cues.png) ### Customize Application Guard @@ -118,7 +118,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor clipboard options](images/appguard-gp-clipboard.png) + ![Group Policy editor clipboard options.](images/appguard-gp-clipboard.png) 3. Choose how the clipboard works: @@ -144,7 +144,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Print options](images/appguard-gp-print.png) + ![Group Policy editor Print options.](images/appguard-gp-print.png) 3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. @@ -156,7 +156,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Data Persistence options](images/appguard-gp-persistence.png) + ![Group Policy editor Data Persistence options.](images/appguard-gp-persistence.png) 3. Open Microsoft Edge and browse to an untrusted, but safe URL. @@ -186,7 +186,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Download options](images/appguard-gp-download.png) + ![Group Policy editor Download options.](images/appguard-gp-download.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -200,7 +200,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor hardware acceleration options](images/appguard-gp-vgpu.png) + ![Group Policy editor hardware acceleration options.](images/appguard-gp-vgpu.png) 3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. @@ -217,7 +217,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled**, set **Options** to 2, and click **OK**. - ![Group Policy editor File trust options](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) + ![Group Policy editor File trust options.](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -231,7 +231,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Camera and microphone options](images/appguard-gp-allow-camera-and-mic.png) + ![Group Policy editor Camera and microphone options.](images/appguard-gp-allow-camera-and-mic.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -245,7 +245,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. - ![Group Policy editor Root certificate options](images/appguard-gp-allow-root-certificates.png) + ![Group Policy editor Root certificate options.](images/appguard-gp-allow-root-certificates.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -258,10 +258,10 @@ Once a user has the extension and its companion app installed on their enterpris 1. Open either Firefox or Chrome — whichever browser you have the extension installed on. 2. Navigate to an enterprise website, i.e. an internal website maintained by your organization. You might see this evaluation page for an instant before the site is fully loaded. - ![The evaluation page displayed while the page is being loaded, explaining that the user must wait](images/app-guard-chrome-extension-evaluation-page.png) + ![The evaluation page displayed while the page is being loaded, explaining that the user must wait.](images/app-guard-chrome-extension-evaluation-page.png) 3. Navigate to a non-enterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. - ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge](images/app-guard-chrome-extension-launchIng-edge.png) + ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge.](images/app-guard-chrome-extension-launchIng-edge.png) 4. Open a new Application Guard window, by select the Microsoft Defender Application Guard icon, then **New Application Guard Window** ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index 80486846fb..146b20c787 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -61,7 +61,7 @@ If you believe a warning or block was incorrectly shown for a file or applicatio When submitting Microsoft Defender SmartScreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu. -![Windows Security, Microsoft Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) +![Windows Security, Microsoft Defender SmartScreen controls.](images/Microsoft-defender-smartscreen-submission.png) ## Viewing Microsoft Defender SmartScreen anti-phishing events diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md index 85c404a314..89c036958f 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md @@ -60,7 +60,7 @@ Starting with Windows 10, version 1703, users can use Windows Security to set up - **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files. - ![Windows Security, Microsoft Defender SmartScreen controls](images/windows-defender-smartscreen-control-2020.png) + ![Windows Security, Microsoft Defender SmartScreen controls.](images/windows-defender-smartscreen-control-2020.png) ## How Microsoft Defender SmartScreen works when a user tries to run an app Microsoft Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Microsoft Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization. diff --git a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md index c792222c8a..c2a1d31b98 100644 --- a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md @@ -41,7 +41,7 @@ The following procedure describes how to use Group Policy to override individual 1. Open your Group Policy editor and go to the **Administrative Templates\System\Mitigation Options\Process Mitigation Options** setting. - ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active](images/gp-process-mitigation-options.png) + ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active.](images/gp-process-mitigation-options.png) 2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you’ll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. @@ -52,12 +52,12 @@ The following procedure describes how to use Group Policy to override individual **Note**
Setting bit flags in positions not specified here to anything other than ? might cause undefined behavior. - ![Group Policy editor: Process Mitigation Options with Show Contents box and example text](images/gp-process-mitigation-options-show.png) + ![Group Policy editor: Process Mitigation Options with Show Contents box and example text.](images/gp-process-mitigation-options-show.png) ## Setting the bit field Here’s a visual representation of the bit flag locations for the various Process Mitigation Options settings: -![Visual representation of the bit flag locations for the Process Mitigation Options settings](images/gp-process-mitigation-options-bit-flag-image.png) +![Visual representation of the bit flag locations for the Process Mitigation Options settings.](images/gp-process-mitigation-options-bit-flag-image.png) Where the bit flags are read from right to left and are defined as: diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index f98634584d..0a9058b91d 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -130,7 +130,7 @@ You can now see which processes have DEP enabled. -![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png) +![Processes with DEP enabled in Windows 10.](images/security-fig5-dep.png) *Figure 2.  Processes on which DEP has been enabled in Windows 10* @@ -168,7 +168,7 @@ One of the most common techniques used to gain access to a system is to find a v Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. -![ASLR at work](images/security-fig4-aslr.png) +![ASLR at work.](images/security-fig4-aslr.png) **Figure 3.  ASLR at work** diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 220c774696..e24bb48367 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -56,13 +56,13 @@ Because mobile devices are increasingly being used to access corporate informati Devices that are used to access corporate resources must be trusted. An efficient end-to-end security approach is able to evaluate device health and use the current security state when granting access to a high-value asset. -:::image type="content" alt-text="figure 1" source="images/hva-fig1-endtoend1.png"::: +:::image type="content" alt-text="figure 1." source="images/hva-fig1-endtoend1.png"::: A robust design needs to establish the user’s identity, strengthen the authentication method if needed, and learn behavior like the network location the user regularly connects from. Also, a modern approach must be able to release sensitive content only if user devices are determined to be healthy and secure. The following figure shows a solution built to assess device health from the cloud. The device authenticates the user through a connection to an identity provider in the cloud. If the managed asset contains highly confidential information, the conditional access engine of the identity provider may elect to verify the security compliance of the mobile device before access is granted. The user’s device is able to prove its health status that can be sent at any time or when mobile device management (MDM) requests it. -:::image type="content" alt-text="figure 2" source="images/hva-fig2-assessfromcloud2.png"::: +:::image type="content" alt-text="figure 2." source="images/hva-fig2-assessfromcloud2.png"::: Windows devices can be protected from low-level rootkits and bootkits by using low-level hardware technologies such as Unified Extensible Firmware Interface (UEFI) Secure Boot. @@ -94,7 +94,7 @@ In Windows 10, there are three pillars of investments: This section is an overview that describes different parts of the end-to-end security solution that helps protect high-value assets and information from attackers and malware. -:::image type="content" alt-text="figure 3" source="images/hva-fig3-endtoendoverview3.png"::: +:::image type="content" alt-text="figure 3." source="images/hva-fig3-endtoendoverview3.png"::: | Number | Part of the solution | Description | | - | - | - | @@ -115,7 +115,7 @@ This section describes what Windows 10 offers in terms of security defenses and The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-req) section. -:::image type="content" alt-text="figure 4" source="images/hva-fig4-hardware.png"::: +:::image type="content" alt-text="figure 4." source="images/hva-fig4-hardware.png"::: Windows 10 supports features to help prevent sophisticated low-level malware like rootkits and bootkits from loading during the startup process: @@ -230,7 +230,7 @@ The following Windows 10 services are protected with virtualization-based securi The schema below is a high-level view of Windows 10 with virtualization-based security. -:::image type="content" alt-text="figure 5" source="images/hva-fig5-virtualbasedsecurity.png"::: +:::image type="content" alt-text="figure 5." source="images/hva-fig5-virtualbasedsecurity.png"::: ### Credential Guard @@ -425,11 +425,11 @@ The antimalware software can search to determine whether the boot sequence conta Health attestation logs the measurements in various TPM Platform Configuration Registers (PCRs) and TCG logs during the boot process. -:::image type="content" alt-text="figure 6" source="images/hva-fig6-logs.png"::: +:::image type="content" alt-text="figure 6." source="images/hva-fig6-logs.png"::: When starting a device equipped with TPM, a measurement of different components is performed. This includes firmware, UEFI drivers, CPU microcode, and also all the Windows 10 drivers whose type is Boot Start. The raw measurements are stored in the TPM PCR registers while the details of all events (executable path, authority certification, and so on) are available in the TCG log. -:::image type="content" alt-text="figure 7" source="images/hva-fig7-measurement.png"::: +:::image type="content" alt-text="figure 7." source="images/hva-fig7-measurement.png"::: The health attestation process works as follows: @@ -459,7 +459,7 @@ The following process describes how health boot measurements are sent to the hea 4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. -:::image type="content" alt-text="figure 8" source="images/hva-fig8a-healthattest8a.png"::: +:::image type="content" alt-text="figure 8." source="images/hva-fig8a-healthattest8a.png"::: ### Device health attestation components @@ -632,7 +632,7 @@ A solution that leverages MDM and the Health Attestation Service consists of thr 2. After this is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. 3. At any point after this, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it’s been attested. - :::image type="content" alt-text="figure 9" source="images/hva-fig8-evaldevicehealth8.png"::: + :::image type="content" alt-text="figure 9." source="images/hva-fig8-evaldevicehealth8.png"::: Interaction between a Windows 10-based device, the Health Attestation Service, and MDM can be performed as follows: @@ -671,7 +671,7 @@ The remote device health attestation process uses measured boot data to verify t The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service. -:::image type="content" alt-text="figure 10" source="images/hva-fig9-intune.png"::: +:::image type="content" alt-text="figure 10." source="images/hva-fig9-intune.png"::: An MDM solution can then leverage health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device’s ability to prove that it’s malware free, its antimalware system is functional and up to date, the firewall is running, and the devices patch state is compliant. @@ -705,7 +705,7 @@ If the device is not registered, the user will get a message with instructions o **Azure AD** authenticates the user and the device, **MDM** manages the compliance and conditional access policies, and the **Health Attestation Service** reports about the health of the device in an attested way. -:::image type="content" alt-text="figure 11" source="images/hva-fig10-conditionalaccesscontrol.png"::: +:::image type="content" alt-text="figure 11." source="images/hva-fig10-conditionalaccesscontrol.png"::: ### Office 365 conditional access control @@ -725,7 +725,7 @@ The user will be denied access to services when sign-in credentials are changed, Depending on the type of email application that employees use to access Exchange online, the path to establish secured access to email can be slightly different. However, the key components: Azure AD, Office 365/Exchange Online, and Intune, are the same. The IT experience and end-user experience also are similar. -:::image type="content" alt-text="figure 12" source="images/hva-fig11-office365.png"::: +:::image type="content" alt-text="figure 12." source="images/hva-fig11-office365.png"::: Clients that attempt to access Office 365 will be evaluated for the following properties: @@ -758,7 +758,7 @@ For on-premises applications there are two options to enable conditional access - For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](https://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. - Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. -:::image type="content" alt-text="figure 13" source="images/hva-fig12-conditionalaccess12.png"::: +:::image type="content" alt-text="figure 13." source="images/hva-fig12-conditionalaccess12.png"::: The following process describes how Azure AD conditional access works: diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md index eb88a41772..ce251bc758 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -36,7 +36,7 @@ Beginning with Windows 10 version 1607, new functionality was added to Windows 1 This functionality is controlled by a new **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The Privacy setting is off by default, which hides the details. -![Privacy setting](images/privacy-setting-in-sign-in-options.png) +![Privacy setting.](images/privacy-setting-in-sign-in-options.png) The **Interactive logon: Display user information when the session is locked** Group Policy setting controls the same functionality. diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md index 426d291c10..7a58b942a4 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md @@ -157,7 +157,7 @@ The following diagram shows Security Settings and related features. #### Security Settings Policies and Related Features -![components related to security policies](images/secpol-components.gif) +![components related to security policies.](images/secpol-components.gif) - **Scesrv.dll** @@ -181,7 +181,7 @@ The Security Settings extension of the Local Group Policy Editor is part of the **Security Settings Architecture** -![architecture of security policy settings](images/secpol-architecture.gif) +![architecture of security policy settings.](images/secpol-architecture.gif) The security settings configuration and analysis tools include a security configuration engine, which provides local computer (non-domain member) and Group Policy−based configuration and analysis of security settings policies. The security configuration engine also supports the creation of security policy files. The primary features of the security configuration engine are scecli.dll and scesrv.dll. @@ -321,7 +321,7 @@ In the context of Group Policy processing, security settings policy is processed **Multiple GPOs and Merging of Security Policy** - ![multiple gpos and merging of security policy](images/secpol-multigpomerge.gif) + ![multiple gpos and merging of security policy.](images/secpol-multigpomerge.gif) 1. The resultant security policies are stored in secedit.sdb, the security settings database. The security engine gets the security template files and imports them to secedit.sdb. 1. The security settings policies are applied to devices. @@ -329,7 +329,7 @@ The following figure illustrates the security settings policy processing. **Security Settings Policy Processing** -![process and interactions of security policy settings](images/secpol-processes.gif) +![process and interactions of security policy settings.](images/secpol-processes.gif) ### Merging of security policies on domain controllers diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 277bc347d1..a8362c5bda 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -380,9 +380,9 @@ This can easily be extended to other Auto-Execution Start Points keys in the reg Use the following figures to see how you can configure those registry keys. -![default acl for run key](images/runkey.png) +![default acl for run key.](images/runkey.png) -![default acl for runonce key](images/runoncekey.png) +![default acl for runonce key.](images/runoncekey.png) ## Appendix C - Event channel settings (enable and channel access) methods @@ -399,7 +399,7 @@ The following GPO snippet performs the following: - Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50MB. -![configure event channels](images/capi-gpo.png) +![configure event channels.](images/capi-gpo.png) ## Appendix D - Minimum GPO for WEF Client configuration @@ -409,7 +409,7 @@ Here are the minimum steps for WEF to operate: 2. Start the WinRM service. 3. Add the Network Service account to the built-in Event Log Readers security group. This allows reading from secured event channel, such as the security event channel. -![configure the wef client](images/wef-client-config.png) +![configure the wef client.](images/wef-client-config.png) ## Appendix E – Annotated baseline subscription event query diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index 9b1eb730a6..11b4c1a58b 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -299,7 +299,7 @@ One of the most common techniques used by attackers to gain access to a system i Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. The below diagram illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. -![figure 3](images/mobile-security-guide-figure3.png) +![figure 3.](images/mobile-security-guide-figure3.png) Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, applying it across the entire system rather than only in specific apps. With 64bit system and application processes that can take advantage of a vastly increased memory space, it is even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization becomes increasingly unique across devices, adding additional degrees of difficulty for repurposing successful exploits to another system. diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 311cfd2625..8a31f70d8e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -32,7 +32,7 @@ Refer to the below video for an overview and brief demo. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp] ## Policy Authorization Process -![Policy Authorization](images/wdac-intune-policy-authorization.png) +![Policy Authorization.](images/wdac-intune-policy-authorization.png) The general steps for expanding the S mode base policy on your Intune-managed devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. Because you need access to WDAC PowerShell cmdlets to generate your supplemental policy, you should create and manage your policies on a non-S mode device. Once the policy has been uploaded to Intune, we recommend assigning it to a single test S-mode device to verify expected functioning before deploying the policy more broadly. 1. Generate a supplemental policy with WDAC tooling @@ -84,11 +84,11 @@ The general steps for expanding the S mode base policy on your Intune-managed de > When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps) for information on setting the version number. ## Standard Process for Deploying Apps through Intune -![Deploying Apps through Intune](images/wdac-intune-app-deployment.png) +![Deploying Apps through Intune.](images/wdac-intune-app-deployment.png) Refer to [Intune Standalone - Win32 app management](/intune/apps-win32-app-management) for guidance on the existing procedure of packaging signed catalogs and app deployment. ## Optional: Process for Deploying Apps using Catalogs -![Deploying Apps using Catalogs](images/wdac-intune-app-catalogs.png) +![Deploying Apps using Catalogs.](images/wdac-intune-app-catalogs.png) Your supplemental policy can be used to significantly relax the S mode base policy, but there are security trade-offs you must consider in doing so. For example, you can use a signer rule to trust an external signer, but that will authorize all apps signed by that certificate, which may include apps you don't want to allow as well. Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don't want to trust all apps that may share the same signing certificate. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index f197b8f4b2..af49d0b081 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -61,7 +61,7 @@ AppLocker can be configured to display the default message but with a custom URL The following image shows an example of the error message for a blocked app. You can use the **Set a support web link** policy setting to customize the **More information** link. -![applocker blocked application error message](images/blockedappmsg.gif) +![applocker blocked application error message.](images/blockedappmsg.gif) For steps to display a custom URL for the message, see [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index 5350f5c843..9ffaf2b82c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -44,7 +44,7 @@ Because a computer's effective policy includes rules from each linked GPO, dupli The following figure demonstrates how AppLocker rule enforcement is applied through linked GPOs. -![applocker rule enforcement inheritance chart](images/applocker-plan-inheritance.gif) +![applocker rule enforcement inheritance chart.](images/applocker-plan-inheritance.gif) In the preceding illustration, note that all GPOs linked to Contoso are applied in order as configured. The rules that are not configured are also applied. For example, the result of the Contoso and Human Resources GPOs is 33 rules enforced, as shown in the client HR-Term1. The Human Resources GPO contains 10 non-configured rules. When the rule collection is configured for **Audit only**, no rules are enforced. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index 0f909bdf3d..a51539d046 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -30,7 +30,7 @@ To successfully deploy AppLocker policies, you need to identify your application The following diagram shows the main points in the design, planning, and deployment process for AppLocker. -![applocker quick reference guide](images/applocker-plandeploy-quickreference.gif) +![applocker quick reference guide.](images/applocker-plandeploy-quickreference.gif) ## Resources to support the deployment process diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md index c1d7ac7c71..48dc8c3166 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md @@ -42,7 +42,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these **Figure 1. Exceptions to the deployed WDAC policy**
- ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) + ![Event showing exception to WDAC policy.](images/dg-fig23-exceptionstocode.png) 3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 5ed5fa1cf7..7700137052 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -41,7 +41,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these 2. Review the **CodeIntegrity - Operational** and **AppLocker - MSI and Script** event logs to confirm events, like those shown in Figure 1, are generated related to the application. For information about the types of events you should see, refer to [Understanding Application Control events](event-id-explanations.md). **Figure 1. Exceptions to the deployed WDAC policy** - ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) + ![Event showing exception to WDAC policy.](images/dg-fig23-exceptionstocode.png) 3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index f3b993cbc0..7eabd55187 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -35,7 +35,7 @@ ECDSA is not supported. 2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. - ![CA snap-in showing Certificate Templates](images/dg-fig27-managecerttemp.png) + ![CA snap-in showing Certificate Templates.](images/dg-fig27-managecerttemp.png) Figure 1. Manage the certificate templates @@ -51,7 +51,7 @@ ECDSA is not supported. 8. In the **Edit Basic Constraints Extension** dialog box, select **Enable this extension**, as shown in Figure 2. - ![Edit Basic Constraints Extension](images/dg-fig29-enableconstraints.png) + ![Edit Basic Constraints Extension.](images/dg-fig29-enableconstraints.png) Figure 2. Select constraints on the new template @@ -67,7 +67,7 @@ When this certificate template has been created, you must publish it to the CA p 1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 3. - ![Select Certificate Template to Issue](images/dg-fig30-selectnewcert.png) + ![Select Certificate Template to Issue.](images/dg-fig30-selectnewcert.png) Figure 3. Select the new certificate template to issue @@ -85,7 +85,7 @@ Now that the template is available to be issued, you must request one from the c 4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. - ![Request Certificates: more information required](images/dg-fig31-getmoreinfo.png) + ![Request Certificates: more information required.](images/dg-fig31-getmoreinfo.png) Figure 4. Get more information for your code signing certificate diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index 2a3d5a91f3..ba2fcb0f9b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -138,7 +138,7 @@ To sign the existing catalog file, copy each of the following commands into an e 4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 1. - ![Digital Signature list in file Properties](images/dg-fig12-verifysigning.png) + ![Digital Signature list in file Properties.](images/dg-fig12-verifysigning.png) Figure 1. Verify that the signing certificate exists @@ -178,7 +178,7 @@ To simplify the management of catalog files, you can use Group Policy preference > [!NOTE] > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate). - ![Group Policy Management, create a GPO](images/dg-fig13-createnewgpo.png) + ![Group Policy Management, create a GPO.](images/dg-fig13-createnewgpo.png) Figure 2. Create a new GPO @@ -188,7 +188,7 @@ To simplify the management of catalog files, you can use Group Policy preference 5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 3. - ![Group Policy Management Editor, New File](images/dg-fig14-createnewfile.png) + ![Group Policy Management Editor, New File.](images/dg-fig14-createnewfile.png) Figure 3. Create a new file @@ -198,7 +198,7 @@ To simplify the management of catalog files, you can use Group Policy preference 7. To keep versions consistent, in the **New File Properties** dialog box (Figure 4), select **Replace** from the **Action** list so that the newest version is always used. - ![File Properties, Replace option](images/dg-fig15-setnewfileprops.png) + ![File Properties, Replace option.](images/dg-fig15-setnewfileprops.png) Figure 4. Set the new file properties @@ -231,7 +231,7 @@ As an alternative to Group Policy, you can use Configuration Manager to deploy c 3. Name the package, set your organization as the manufacturer, and select an appropriate version number. - ![Create Package and Program Wizard](images/dg-fig16-specifyinfo.png) + ![Create Package and Program Wizard.](images/dg-fig16-specifyinfo.png) Figure 5. Specify information about the new package @@ -253,7 +253,7 @@ As an alternative to Group Policy, you can use Configuration Manager to deploy c - From the **Drive mode** list, select **Runs with UNC name**. - ![Standard Program page of wizard](images/dg-fig17-specifyinfo.png) + ![Standard Program page of wizard.](images/dg-fig17-specifyinfo.png) Figure 6. Specify information about the standard program @@ -281,7 +281,7 @@ After you create the deployment package, deploy it to a collection so that the c - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. - ![Deploy Software Wizard, User Experience page](images/dg-fig18-specifyux.png) + ![Deploy Software Wizard, User Experience page.](images/dg-fig18-specifyux.png) Figure 7. Specify the user experience @@ -306,13 +306,13 @@ When catalog files have been deployed to the computers within your environment, 3. Name the new policy, and under **Select and then configure the custom settings for client devices**, select the **Software Inventory** check box, as shown in Figure 8. - ![Create Custom Client Device Settings](images/dg-fig19-customsettings.png) + ![Create Custom Client Device Settings.](images/dg-fig19-customsettings.png) Figure 8. Select custom settings 4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 9. - ![Software Inventory settings for devices](images/dg-fig20-setsoftwareinv.png) + ![Software Inventory settings for devices.](images/dg-fig20-setsoftwareinv.png) Figure 9. Set the software inventory @@ -325,7 +325,7 @@ When catalog files have been deployed to the computers within your environment, 7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 10. - ![Path Properties, specifying a path](images/dg-fig21-pathproperties.png) + ![Path Properties, specifying a path.](images/dg-fig21-pathproperties.png) Figure 10. Set the path properties diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index 8e8fa29002..f3d496160b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -39,7 +39,7 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Plan for Windows Defender Application Control policy management](plan-windows-defender-application-control-management.md). - ![Group Policy Management, create a GPO](images/dg-fig24-creategpo.png) + ![Group Policy Management, create a GPO.](images/dg-fig24-creategpo.png) 3. Name the new GPO. You can choose any name. @@ -47,7 +47,7 @@ To deploy and manage a WDAC policy with Group Policy: 5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**. - ![Edit the Group Policy for Windows Defender Application Control](images/wdac-edit-gp.png) + ![Edit the Group Policy for Windows Defender Application Control.](images/wdac-edit-gp.png) 6. In the **Deploy Windows Defender Application Control** dialog box, select the **Enabled** option, and then specify the WDAC policy deployment path. @@ -56,7 +56,7 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > This policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. - ![Group Policy called Deploy Windows Defender Application Control](images/dg-fig26-enablecode.png) + ![Group Policy called Deploy Windows Defender Application Control.](images/dg-fig26-enablecode.png) > [!NOTE] > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 8cf09e5b2f..b4cb9a3f05 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -66,7 +66,7 @@ The steps to use Intune's custom OMA-URI functionality are: - **Certificate file**: upload your binary format policy file. You do not need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. > [!div class="mx-imgBorder"] - > ![Configure custom WDAC](images/wdac-intune-custom-oma-uri.png) + > ![Configure custom WDAC.](images/wdac-intune-custom-oma-uri.png) > [!NOTE] > For the _Policy GUID_ value, do not include the curly brackets. diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index a9cd8c8585..12975743d7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -41,7 +41,7 @@ Most WDAC policies will evolve over time and proceed through a set of identifiab 6. Deploy the enforced mode policy to intended devices. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly. 7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes. -![Recommended WDAC policy deployment process](images/policyflow.png) +![Recommended WDAC policy deployment process.](images/policyflow.png) ### Keep WDAC policies in a source control or document management solution diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 2c5382e43b..4915d3faea 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -43,7 +43,7 @@ Each of the template policies has a unique set of policy allow list rules that w More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example WDAC base policies article](example-wdac-base-policies.md). -![Selecting a base template for the policy](images/wdac-wizard-template-selection.png) +![Selecting a base template for the policy.](images/wdac-wizard-template-selection.png) Once the base template is selected, give the policy a name and choose where to save the application control policy on disk. @@ -69,7 +69,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | > [!div class="mx-imgBorder"] -> ![Rule options UI for Windows Allowed mode policy](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) +> ![Rule options UI for Windows Allowed mode policy.](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) ### Advanced Policy Rules Description @@ -84,7 +84,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru | **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | -![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) +![Rule options UI for Windows Allowed mode.](images/wdac-wizard-rule-options-UI.png) > [!NOTE] > We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. @@ -105,7 +105,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | -![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) +![Custom filepublisher file rule creation.](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules @@ -123,7 +123,7 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Internal name** | Specifies the internal name of the binary. | > [!div class="mx-imgBorder"] -> ![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) +> ![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index bca81708e6..5f96c11702 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -33,15 +33,15 @@ Prerequisite information about application control can be accessed through the [ Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. -![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) +![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) If the base policy is not configured for supplemental policies, the Wizard will attempt to convert the policy to one that can be supplemented. Once successful, the Wizard will show a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. -![Wizard confirms modification of base policy](images/wdac-wizard-confirm-base-policy-modification.png) +![Wizard confirms modification of base policy.](images/wdac-wizard-confirm-base-policy-modification.png) Policies that cannot be supplemented, for instance, a supplemental policy, will be detected by the Wizard and will show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). -![Wizard detects a bad base policy](images/wdac-wizard-supplemental-not-base.png) +![Wizard detects a bad base policy.](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules @@ -60,7 +60,7 @@ There are only three policy rules that can be configured by the supplemental pol | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -![Rule options UI for Windows Allowed mode](images/wdac-wizard-supplemental-policy-rule-options-UI.png) +![Rule options UI for Windows Allowed mode.](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules @@ -78,7 +78,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | -![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) +![Custom filepublisher file rule creation.](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules @@ -96,7 +96,7 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Internal name** | Specifies the internal name of the binary. | -![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) +![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index 2b94c7f004..09c88d84aa 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -36,7 +36,7 @@ The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShe The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#adding-file-rules). -![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) +![Configuring the policy rules.](images/wdac-wizard-edit-policy-rules.png) A description of the policy rule is shown at the bottom of the page when the cursor is placed over the rule title. For a complete list of the policy rules and their capabilities, see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). @@ -50,7 +50,7 @@ Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. -![Removing file rule from policy during edit](images/wdac-wizard-edit-remove-file-rule.png) +![Removing file rule from policy during edit.](images/wdac-wizard-edit-remove-file-rule.png) **Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index ec6e988048..66ad01329f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -30,4 +30,4 @@ Select the policies you wish to merge into one policy using the `+ Add Policy` b Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. -![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) +![Merging WDAC policies into a final WDAC policy.](images/wdac-wizard-merge.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md index 6da28ad681..ed1a7fe460 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md @@ -57,4 +57,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md index 80d025f7ac..544e90142e 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md @@ -76,4 +76,4 @@ This can only be done in Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md index 1bfddcc3f2..969d80c8bf 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -32,11 +32,11 @@ ms.technology: mde You can add information about your organization in a contact card to the Windows Security app. You can include a link to a support site, a phone number for a help desk, and an email address for email-based support. -![The security center custom fly-out](images/security-center-custom-flyout.png) +![The security center custom fly-out.](images/security-center-custom-flyout.png) This information will also be shown in some enterprise-specific notifications (including notifications for the [Block at first sight feature](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus), and [potentially unwanted applications](/windows/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)). -![A security center notification](images/security-center-custom-notif.png) +![A security center notification.](images/security-center-custom-notif.png) Users can select the displayed information to initiate a support request: diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md index 919f2cb7a2..13fce0f2d5 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md @@ -56,4 +56,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index f0627d2869..f4d3053cd9 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -50,7 +50,7 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md index c7d0fb4944..274c66bd66 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md @@ -55,4 +55,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md index 5cf74d9fdf..3a14dc7c26 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -52,5 +52,5 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md index 762e9c7402..87960171d1 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -63,7 +63,7 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Hide the Ransomware protection area diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md index 146bdcc78e..30cc06c3d0 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md @@ -34,7 +34,7 @@ Windows 10 in S mode is streamlined for tighter security and superior performanc The Windows Security interface is a little different in Windows 10 in S mode. The **Virus & threat protection** area has fewer options, because the built-in security of Windows 10 in S mode prevents viruses and other threats from running on devices in your organization. In addition, devices running Windows 10 in S mode receive security updates automatically. -![Screen shot of the Windows Security app Virus & threat protection area in Windows 10 in S mode](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) +![Screen shot of the Windows Security app Virus & threat protection area in Windows 10 in S mode.](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) For more information about Windows 10 in S mode, including how to switch out of S mode, see [Windows 10 Pro/Enterprise in S mode](/windows/deployment/windows-10-pro-in-s-mode). diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md index 17eb0a98fd..fe03727f33 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -31,7 +31,7 @@ In Windows 10, version 1709 and later, the app also shows information from third In Windows 10, version 1803, the app has two new areas, **Account protection** and **Device security**. -![Screenshot of the Windows Security app showing that the device is protected and five icons for each of the features](images/security-center-home.png) +![Screenshot of the Windows Security app showing that the device is protected and five icons for each of the features.](images/security-center-home.png) > [!NOTE] > The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal console that is used to review and manage [Microsoft Defender for Endpoint](/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). @@ -55,19 +55,19 @@ You can find more information about each section, including options for configur > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Open the Windows Security app - Click the icon in the notification area on the taskbar. - ![Screenshot of the icon for the Windows Security app on the Windows task bar](images/security-center-taskbar.png) + ![Screenshot of the icon for the Windows Security app on the Windows task bar.](images/security-center-taskbar.png) - Search the Start menu for **Windows Security**. - ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected](images/security-center-start-menu.png) + ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected.](images/security-center-start-menu.png) - Open an area from Windows **Settings**. - ![Screenshot of Windows Settings showing the different areas available in the Windows Security](images/settings-windows-defender-security-center-areas.png) + ![Screenshot of Windows Settings showing the different areas available in the Windows Security.](images/settings-windows-defender-security-center-areas.png) > [!NOTE] > Settings configured with management tools, such as Group Policy, Microsoft Intune, or Microsoft Endpoint Configuration Manager, will generally take precedence over the settings in the Windows Security. See the topics for each of the sections for links to configuring the associated features or products. diff --git a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md index 8b55c05b3e..848345ef8b 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -52,7 +52,7 @@ DRTM lets the system freely boot into untrusted code initially, but shortly afte This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. -![System Guard Secure Launch](images/system-guard-secure-launch.png) +![System Guard Secure Launch.](images/system-guard-secure-launch.png) Secure Launch simplifies management of SRTM measurements because the launch code is now unrelated to a specific hardware configuration. This means the number of valid code measurements is small, and future updates can be deployed more widely and quickly. @@ -82,7 +82,7 @@ While Windows Defender System Guard provides advanced protection that will help As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch will not support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. -![Boot time integrity](images/windows-defender-system-guard-boot-time-integrity.png) +![Boot time integrity.](images/windows-defender-system-guard-boot-time-integrity.png) After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Endpoint Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 14695d80d0..55321967df 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -38,13 +38,13 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) 2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. - ![Secure Launch Configuration](images/secure-launch-group-policy.png) + ![Secure Launch Configuration.](images/secure-launch-group-policy.png) ### Windows Security Center Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**. - ![Windows Security Center](images/secure-launch-security-app.png) + ![Windows Security Center.](images/secure-launch-security-app.png) ### Registry @@ -58,13 +58,13 @@ Click **Start** > **Settings** > **Update & Security** > **Windows Security** > 5. Double-click **Enabled**, change the value to **1**, and click **OK**. - ![Secure Launch Registry](images/secure-launch-registry.png) + ![Secure Launch Registry.](images/secure-launch-registry.png) ## How to verify System Guard Secure Launch is configured and running To verify that Secure Launch is running, use System Information (MSInfo32). Click **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. -![Verifying Secure Launch is running in the Windows Security Center](images/secure-launch-msinfo.png) +![Verifying Secure Launch is running in the Windows Security Center.](images/secure-launch-msinfo.png) > [!NOTE] > To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md), [Credential Guard](../../identity-protection/credential-guard/credential-guard-requirements.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). diff --git a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md index 71f0392376..5819f886fd 100644 --- a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md +++ b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md @@ -38,7 +38,7 @@ type **WF.msc**, and then select **OK**. See also [Open Windows Firewall](./op When you open the Windows Defender Firewall for the first time, you can see the default settings applicable to the local computer. The Overview panel displays security settings for each type of network to which the device can connect. -![Windows Defender Firewall with Advanced Security first time opening](images/fw01-profiles.png) +![Windows Defender Firewall with Advanced Security first time opening.](images/fw01-profiles.png) *Figure 1: Windows Defender Firewall* @@ -55,7 +55,7 @@ View detailed settings for each profile by right-clicking the top-level **Window Maintain the default settings in Windows Defender Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. -![A screenshot of a cell phone Description automatically generated](images/fw03-defaults.png) +![A screenshot of a cell phone Description automatically generated.](images/fw03-defaults.png) *Figure 2: Default inbound/outbound settings* @@ -70,7 +70,7 @@ In many cases, a next step for administrators will be to customize these profile This can be accomplished by right-clicking either **Inbound Rules** or **Outbound Rules**, and selecting **New Rule**. The interface for adding a new rule looks like this: -![Rule creation wizard](images/fw02-createrule.png) +![Rule creation wizard.](images/fw02-createrule.png) *Figure 3: Rule Creation Wizard* @@ -131,7 +131,7 @@ To determine why some applications are blocked from communicating in the network Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. -![Windows Firewall prompt](images/fw04-userquery.png) +![Windows Firewall prompt.](images/fw04-userquery.png) *Figure 4: Dialog box to allow access* @@ -148,7 +148,7 @@ Rule merging settings control how rules from different policy sources can be com The rule merging settings either allow or prevent local admins from creating their own firewall rules in addition to those obtained from Group Policy. -![Customize settings](images/fw05-rulemerge.png) +![Customize settings.](images/fw05-rulemerge.png) *Figure 5: Rule merging setting* @@ -180,11 +180,11 @@ An important firewall feature you can use to mitigate damage during an active at Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or the legacy file *firewall.cpl*. -![Incoming connections](images/fw06-block.png) +![Incoming connections.](images/fw06-block.png) *Figure 6: Windows settings App/Windows Security/Firewall Protection/Network Type* -![Firewall cpl](images/fw07-legacy.png) +![Firewall cpl.](images/fw07-legacy.png) *Figure 7: Legacy firewall.cpl* diff --git a/windows/security/threat-protection/windows-firewall/boundary-zone.md b/windows/security/threat-protection/windows-firewall/boundary-zone.md index 0e67454be2..37d7edb647 100644 --- a/windows/security/threat-protection/windows-firewall/boundary-zone.md +++ b/windows/security/threat-protection/windows-firewall/boundary-zone.md @@ -32,7 +32,7 @@ The GPOs you build for the boundary zone include IPsec or connection security ru Because these boundary zone devices can receive unsolicited inbound communications from untrusted devices that use plaintext, they must be carefully managed and secured in other ways. Mitigating this additional risk is an important part of deciding whether to add a device to the boundary zone. For example, completing a formal business justification process before adding each device to the boundary zone can help ensure that the additional risk is minimized. The following illustration shows a sample process that can help make such a decision. -![design flowchart](images/wfas-designflowchart1.gif) +![design flowchart.](images/wfas-designflowchart1.gif) The goal of this process is to determine whether the risk of adding a device to a boundary zone can be mitigated to a level that makes it acceptable to the organization. Ultimately, if the risk cannot be mitigated, membership must be denied. diff --git a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md index bf9a3f7d47..479b2e67af 100644 --- a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -28,7 +28,7 @@ ms.technology: mde To get started, open Device Configuration in Intune, then create a new profile. Choose Windows 10 as the platform, and Endpoint Protection as the profile type. Select Windows Defender Firewall. -![Windows Defender Firewall in Intune](images/windows-firewall-intune.png) +![Windows Defender Firewall in Intune.](images/windows-firewall-intune.png) >[!IMPORTANT] >A single Endpoint Protection profile may contain up to a maximum of 150 firewall rules. If a client device requires more than 150 rules, then multiple profiles must be assigned to it. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md index 0e7f47576b..8f27c49ab5 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md @@ -32,7 +32,7 @@ In addition to the basic protection provided by the firewall rules in the previo The following illustration shows the traffic protection needed for this design example. -![domain isolation policy design](images/wfas-design2example1.gif) +![domain isolation policy design.](images/wfas-design2example1.gif) 1. All devices on the Woodgrove Bank corporate network that are Active Directory domain members must authenticate inbound network traffic as coming from another computer that is a member of the domain. Unless otherwise specified in this section, Woodgrove Bank's devices reject all unsolicited inbound network traffic that is not authenticated. If the basic firewall design is also implemented, even authenticated inbound network traffic is dropped unless it matches an inbound firewall rule. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index 6c13157e59..659827d1c6 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -34,7 +34,7 @@ By using connection security rules based on IPsec, you provide a logical barrier The design is shown in the following illustration, with the arrows that show the permitted communication paths. -![isolated domain boundary zone](images/wfasdomainisoboundary.gif) +![isolated domain boundary zone.](images/wfasdomainisoboundary.gif) Characteristics of this design, as shown in the diagram, include the following: diff --git a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md index 90d5fd2514..718505a9d7 100644 --- a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md +++ b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md @@ -22,7 +22,7 @@ Debugging packet drops is a continuous issue to Windows customers. In the past, Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152. -![Event properties](images/event-properties-5157.png) +![Event properties.](images/event-properties-5157.png) The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. @@ -73,7 +73,7 @@ To enable a specific audit event, run the corresponding command in an administra As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop and the interface it happened on. -![Event audit](images/event-audit-5157.png) +![Event audit.](images/event-audit-5157.png) The next sections are divided by `Filter Origin` type, the value is either a rule name or the name of one of the default block filters. If the filter origin is one of the default block filters, skip to the section, **Firewall default block filters**. Otherwise, continue to the section **Firewall rules**. @@ -86,7 +86,7 @@ Get-NetFirewallRule -Name “” Get-NetFirewallRule -Name " {A549B7CF-0542-4B67-93F9-EEBCDD584377} " ``` -![Firewall rule](images/firewallrule.png) +![Firewall rule.](images/firewallrule.png) After identifying the rule that caused the drop, the network admin can now modify/disable the rule to allow the traffic they want through command prompt or using the Windows Defender UI. The network admin can find the rule in the UI with the rule’s `DisplayName`. @@ -118,7 +118,7 @@ Get-NetIPInterface –InterfaceIndex Get-NetIPInterface –InterfaceIndex 5 ``` -![Quarantine default block filter](images/quarantine-default-block-filter.png) +![Quarantine default block filter.](images/quarantine-default-block-filter.png) To learn more about the quarantine feature, see [Quarantine behavior](quarantine.md). @@ -139,7 +139,7 @@ To generate a list of all the query user block rules, you can run the following Get-NetFirewallRule | Where {$_.Name -like "*Query User*"} ``` -![Query user default block filter](images/query-user-default-block-filters.png) +![Query user default block filter.](images/query-user-default-block-filters.png) The query user pop-up feature is enabled by default. diff --git a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md index 8c8fb36ee5..5a6acfea96 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md @@ -38,7 +38,7 @@ The network administrators want to implement Windows Defender Firewall with Adva The following illustration shows the traffic protection needs for this design example. -![design example 1](images/wfas-designexample1.gif) +![design example 1.](images/wfas-designexample1.gif) 1. The network infrastructure servers that are running services, such as Active Directory, DNS, DHCP, or WINS, can receive unsolicited inbound requests from network clients. The network clients can receive the responses from the infrastructure servers. diff --git a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md index 7b95852c3d..265019f489 100644 --- a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -41,7 +41,7 @@ The following are important factors in the implementation of your Windows Defend The next step in implementing your design is to determine in what order each of the deployment steps must be performed. This guide uses checklists to help you accomplish the various deployment tasks that are required to implement your design plan. As the following diagram shows, checklists and subchecklists are used as necessary to provide the end-to-end procedure for deploying a design. -![wfas implementation](images/wfas-implement.gif) +![wfas implementation.](images/wfas-implement.gif) Use the following parent checklists in this section of the guide to become familiar with the deployment tasks for implementing your organization's Windows Defender Firewall with Advanced Security design. diff --git a/windows/security/threat-protection/windows-firewall/quarantine.md b/windows/security/threat-protection/windows-firewall/quarantine.md index 87bab115a6..bd087a2124 100644 --- a/windows/security/threat-protection/windows-firewall/quarantine.md +++ b/windows/security/threat-protection/windows-firewall/quarantine.md @@ -196,7 +196,7 @@ Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /s Sample drop audit with `filterOrigin` as `Quarantine Default`. -![Quarantine default](images/quarantine-default1.png) +![Quarantine default.](images/quarantine-default1.png) Once the drop’s filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: @@ -205,7 +205,7 @@ Get-NetIPInterface –InterfaceIndex Get-NetIPInterface –InterfaceIndex 5 ``` -![Quarantine Interfaceindex](images/quarantine-interfaceindex1.png) +![Quarantine Interfaceindex.](images/quarantine-interfaceindex1.png) Using the interface name, event viewer can be searched for any interface related changes. diff --git a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md index 81a548b4ee..8fbeb35412 100644 --- a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md @@ -30,7 +30,7 @@ For devices that share sensitive information over the network, Windows Defender The following illustration shows an encryption zone in an isolated domain. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. -![encryption zone in an isolated domain](images/wfas-domainisoencrypt.gif) +![encryption zone in an isolated domain.](images/wfas-domainisoencrypt.gif) This goal provides the following benefits: diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md index a50232fe28..1a7c288575 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md @@ -34,7 +34,7 @@ You can restrict access by specifying either computer or user credentials. The following illustration shows an isolated server, and examples of devices that can and cannot communicate with it. Devices that are outside the Woodgrove corporate network, or computers that are in the isolated domain but are not members of the required NAG, cannot communicate with the isolated server. -![isolated domain with network access groups](images/wfas-domainnag.gif) +![isolated domain with network access groups.](images/wfas-domainnag.gif) This goal, which corresponds to [Server Isolation Policy Design](server-isolation-policy-design.md), provides the following features: diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index d7de7d8963..5285e56ad9 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -35,7 +35,7 @@ The protection provided by domain isolation can help you comply with regulatory The following illustration shows an isolated domain, with one of the zones that are optionally part of the design. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. -![domain isolation](images/wfas-domainiso.gif) +![domain isolation.](images/wfas-domainiso.gif) These goals, which correspond to [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md), provide the following benefits: diff --git a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 4c6f3f4fb7..8cb2a35d50 100644 --- a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -59,7 +59,7 @@ These procedures assume that you already have a public key infrastructure (PKI) The following Windows PowerShell script establishes a connection security rule that uses IKEv2 for communication between two computers (CLIENT1 and SERVER1) that are joined to the corp.contoso.com domain as shown in Figure 1. -![the contoso corporate network](images/corpnet.gif) +![the contoso corporate network.](images/corpnet.gif) **Figure 1** The Contoso corporate network @@ -77,7 +77,7 @@ This script does the following: - Creates the IKEv2 connection security rule called **My IKEv2 Rule**. -![powershell logo](images/powershelllogosmall.gif)**Windows PowerShell commands** +![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. @@ -117,7 +117,7 @@ Use a Windows PowerShell script similar to the following to create a local IPsec >**Important:**  The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. -![powershell logo](images/powershelllogosmall.gif)**Windows PowerShell commands** +![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md index 0e2b6ce11e..a0070cf114 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md @@ -46,7 +46,7 @@ In addition to the protection provided by the firewall rules and domain isolatio The following illustration shows the traffic protection needs for this design example. -![isolated server example](images/wfas-design3example1.gif) +![isolated server example.](images/wfas-design3example1.gif) 1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. This includes the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it is sent from an authorized computer. Authorization is determined by membership in a network access group (NAG). diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index f4d452b4cf..7d44e7c17c 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -32,7 +32,7 @@ You can implement a server isolation design without using domain isolation. To d The design is shown in the following illustration, with arrows that show the permitted communication paths. -![isolated domain with isolated server](images/wfas-domainisohighsec.gif) +![isolated domain with isolated server.](images/wfas-domainisohighsec.gif) Characteristics of this design include the following: diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 3e383743a4..bf70a3a3b7 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -328,7 +328,7 @@ Windows PowerShell can create powerful, complex IPsec policies like in Netsh and In Netsh, the authentication and cryptographic sets were specified as a list of comma-separated tokens in a specific format. In Windows PowerShell, rather than using default settings, you first create your desired authentication or cryptographic proposal objects and bundle them into lists in your preferred order. Then, you create one or more IPsec rules that reference these sets. The benefit of this model is that programmatic access to the information in the rules is much easier. See the following sections for clarifying examples. -![object model for creating a single ipsec rule](images/createipsecrule.gif) +![object model for creating a single ipsec rule.](images/createipsecrule.gif) ### Create IPsec rules @@ -353,7 +353,7 @@ If you want to create a custom set of quick-mode proposals that includes both AH You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object. -![crypto set object](images/qmcryptoset.gif) +![crypto set object.](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index f18a5180db..8e719f1364 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -61,12 +61,12 @@ You can download the security baselines from the [Microsoft Download Center](htt The security baselines are included in the [Security Compliance Toolkit (SCT)](security-compliance-toolkit-10.md), which can be downloaded from the Microsoft Download Center. The SCT also includes tools to help admins manage the security baselines. -[![Security Compliance Toolkit](images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) -[![Get Support](images/get-support.png)](get-support-for-security-baselines.md) +[![Security Compliance Toolkit.](images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) +[![Get Support.](images/get-support.png)](get-support-for-security-baselines.md) ## Community -[![Microsoft Security Guidance Blog](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) +[![Microsoft Security Guidance Blog.](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) ## Related Videos diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md index cfb7427cbc..170918a4fa 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md @@ -60,12 +60,12 @@ You can download the security baselines from the [Microsoft Download Center](htt The security baselines are included in the [Security Compliance Toolkit (SCT)](security-compliance-toolkit-10.md), which can be downloaded from the Microsoft Download Center. The SCT also includes tools to help admins manage the security baselines. -[![Security Compliance Toolkit](./../images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) -[![Get Support](./../images/get-support.png)](get-support-for-security-baselines.md) +[![Security Compliance Toolkit.](./../images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) +[![Get Support.](./../images/get-support.png)](get-support-for-security-baselines.md) ## Community -[![Microsoft Security Guidance Blog](./../images/community.png)](/archive/blogs/secguide/) +[![Microsoft Security Guidance Blog.](./../images/community.png)](/archive/blogs/secguide/) ## Related Videos diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md index 1387997652..b99b7a48ad 100644 --- a/windows/whats-new/contribute-to-a-topic.md +++ b/windows/whats-new/contribute-to-a-topic.md @@ -38,7 +38,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 1. Go to the article that you want to update, and then click **Edit**. - ![GitHub Web, showing the Edit link](images/contribute-link.png) + ![GitHub Web, showing the Edit link.](images/contribute-link.png) 2. Sign into (or sign up for) a GitHub account. @@ -46,7 +46,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) @@ -55,11 +55,11 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change**. - ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png) The **Comparing changes** screen shows the changes between your version of the article and the original content. @@ -67,7 +67,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner If there are no problems, you’ll see the message, **Able to merge**. - ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 83e1c6b032..256dad7a3a 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -48,7 +48,7 @@ This version of Window 10 includes security improvements for threat protection, The [Microsoft Defender for Endpoint](/windows/security/threat-protection/index) platform includes the security pillars shown in the following diagram. In this version of Windows, Defender for Endpoint includes powerful analytics, security stack integration, and centralized management for better detection, prevention, investigation, response, and management. -![Microsoft Defender for Endpoint](../images/wdatp.png) +![Microsoft Defender for Endpoint.](../images/wdatp.png) ##### Attack surface reduction @@ -275,7 +275,7 @@ The WSC service now requires antivirus products to run as a protected process to WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. -![Security at a glance](../images/defender.png "Windows Security Center") +![Security at a glance.](../images/defender.png "Windows Security Center") #### Group Policy Security Options @@ -288,7 +288,7 @@ A new security policy setting We’ve continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: -![S mode settings](../images/virus-and-threat-protection.png "Virus & threat protection settings") +![S mode settings.](../images/virus-and-threat-protection.png "Virus & threat protection settings") ## Deployment @@ -387,7 +387,7 @@ If you have shared devices deployed in your work place, **Fast sign-in** enables 3. Sign-in to a shared PC with your account. You'll notice the difference! - ![fast sign-in](../images/fastsignin.png "fast sign-in") + ![fast sign-in.](../images/fastsignin.png "fast sign-in") ### Web sign-in to Windows 10 @@ -402,7 +402,7 @@ Until now, Windows logon only supported the use of identities federated to ADFS 3. On the lock screen, select web sign-in under sign-in options. 4. Click the “Sign in” button to continue. -![Sign-in option](../images/websignin.png "web sign-in") +![Sign-in option.](../images/websignin.png "web sign-in") ## Windows Analytics @@ -470,7 +470,7 @@ The OS uninstall period is a length of time that users are given when they can o Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. -![get bulk token action in wizard](../images/bulk-token.png) +![get bulk token action in wizard.](../images/bulk-token.png) ### Windows Spotlight @@ -636,7 +636,7 @@ If you have a device that has been updated to Windows 10 Enterprise LTSC 2019, t We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -![Reg editor](../images/regeditor.png "Registry editor dropdown") +![Reg editor.](../images/regeditor.png "Registry editor dropdown") ## Remote Desktop with Biometrics @@ -650,9 +650,9 @@ To get started, sign into your device using Windows Hello for Business. Bring up See the following example: -![Enter your credentials](../images/RDPwBioTime.png "Windows Hello") -![Provide credentials](../images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016](../images/hyper-v.png "Microsoft Hyper-V Server 2016") +![Enter your credentials.](../images/RDPwBioTime.png "Windows Hello") +![Provide credentials.](../images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016.](../images/hyper-v.png "Microsoft Hyper-V Server 2016") ## See Also diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index b05bba2289..48bf6b509b 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -31,11 +31,11 @@ Previously known as *Windows Imaging and Configuration Designer (ICD)*, the tool Windows Configuration Designer in Windows 10, version 1703, includes several new wizards to make it easier to create provisioning packages. -![wizards for desktop, mobile, kiosk, Surface Hub](images/wcd-options.png) +![wizards for desktop, mobile, kiosk, Surface Hub.](images/wcd-options.png) Both the desktop and kiosk wizards include an option to remove pre-installed software, based on the new [CleanPC configuration service provider (CSP)](/windows/client-management/mdm/cleanpc-csp). -![remove pre-installed software option](images/wcd-cleanpc.png) +![remove pre-installed software option.](images/wcd-cleanpc.png) [Learn more about Windows Configuration Designer.](/windows/configuration/provisioning-packages/provisioning-packages) @@ -44,7 +44,7 @@ Both the desktop and kiosk wizards include an option to remove pre-installed sof Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. -![get bulk token action in wizard](images/bulk-token.png) +![get bulk token action in wizard.](images/bulk-token.png) ### Windows Spotlight @@ -279,7 +279,7 @@ Learn about the new Group Policies that were added in Windows 10, version 1703. The Lockdown Designer app helps you configure and create a lockdown XML file to apply to devices running Windows 10 Mobile, and includes a remote simulation to help you determine the layout for tiles on the Start screen. Using Lockdown Designer is easier than [manually creating a lockdown XML file](/windows/configuration/mobile-devices/lockdown-xml). -![Lockdown Designer app in Store](images/ldstore.png) +![Lockdown Designer app in Store.](images/ldstore.png) [Learn more about the Lockdown Designer app.](/windows/configuration/mobile-devices/mobile-lockdown-designer) diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index e73c5af9bc..6410248ff6 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -46,7 +46,7 @@ To learn more about Autopilot self-deploying mode and to see step-by-step instru We’ve continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: > [!div class="mx-imgBorder"] -> ![Virus & threat protection settings](images/virus-and-threat-protection.png "Virus & threat protection settings") +> ![Virus & threat protection settings.](images/virus-and-threat-protection.png "Virus & threat protection settings") With controlled folder access you can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. @@ -109,16 +109,16 @@ To try this: See the following example: > [!div class="mx-imgBorder"] -> ![Security at a glance](images/1_AppBrowser.png "app and browser control") +> ![Security at a glance.](images/1_AppBrowser.png "app and browser control") > [!div class="mx-imgBorder"] -> ![Isolated browser](images/2_InstallWDAG.png "isolated browsing") +> ![Isolated browser.](images/2_InstallWDAG.png "isolated browsing") > [!div class="mx-imgBorder"] -> ![change WDAG settings](images/3_ChangeSettings.png "change settings") +> ![change WDAG settings.](images/3_ChangeSettings.png "change settings") > [!div class="mx-imgBorder"] -> ![view WDAG settings](images/4_ViewSettings.jpg "view settings") +> ![view WDAG settings.](images/4_ViewSettings.jpg "view settings") ### Windows Security Center @@ -130,7 +130,7 @@ The WSC service now requires antivirus products to run as a protected process to WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. -![alt text](images/defender.png "Windows Security Center") +![alt text.](images/defender.png "Windows Security Center") ### Windows Defender Firewall now supports Windows Subsystem for Linux (WSL) processes @@ -195,7 +195,7 @@ We introduced a simplified assigned access configuration experience in **Setting To use this feature, go to **Settings**, search for **assigned access**, and open the **Set up a kiosk** page. -![set up a kiosk](images/kiosk-mode.png "set up a kiosk") +![set up a kiosk.](images/kiosk-mode.png "set up a kiosk") Microsoft Edge kiosk mode running in single-app assigned access has two kiosk types. @@ -203,7 +203,7 @@ Microsoft Edge kiosk mode running in single-app assigned access has two kiosk ty 2. **Public browsing** supports multi-tab browsing and runs InPrivate mode with minimal features available. Users cannot minimize, close, or open new Microsoft Edge windows or customize them using Microsoft Edge Settings. Users can clear browsing data and downloads, and restart Microsoft Edge by clicking **End session**. Administrators can configure Microsoft Edge to restart after a period of inactivity. -![single app assigned access](images/SingleApp_contosoHotel_inFrame@2x.png "single app assigned access") +![single app assigned access.](images/SingleApp_contosoHotel_inFrame@2x.png "single app assigned access") Microsoft Edge kiosk mode running in multi-app assigned access has two kiosk types. @@ -212,11 +212,11 @@ Microsoft Edge kiosk mode running in multi-app assigned access has two kiosk typ **Public browsing** supports multi-tab browsing and runs InPrivate mode with minimal features available. In this configuration, Microsoft Edge can be one of many apps available. Users can close and open multiple InPrivate mode windows. -![multi-app assigned access](images/Multi-app_kiosk_inFrame.png "multi-app assigned access") +![multi-app assigned access.](images/Multi-app_kiosk_inFrame.png "multi-app assigned access") **Normal mode** runs a full version of Microsoft Edge, although some features may not work depending on what apps are configured in assigned access. For example, if the Microsoft Store is not set up, users cannot get books. -![normal mode](images/Normal_inFrame.png "normal mode") +![normal mode.](images/Normal_inFrame.png "normal mode") Learn more about [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy). @@ -224,7 +224,7 @@ Learn more about [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-ed We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -![Registry editor dropdown](images/regeditor.png "Registry editor dropdown") +![Registry editor dropdown.](images/regeditor.png "Registry editor dropdown") ## Faster sign-in to a Windows 10 shared pc @@ -237,7 +237,7 @@ Do you have shared devices deployed in your work place? **Fast sign-in** enables 3. Sign-in to a shared PC with your account. You'll notice the difference! - ![fast sign-in](images/fastsignin.png "fast sign-in") + ![fast sign-in.](images/fastsignin.png "fast sign-in") >[!NOTE] >This is a private preview feature and therefore not meant or recommended for production purposes. @@ -259,7 +259,7 @@ Until now, Windows logon only supported the use of identities federated to ADFS 4. Click the **Sign in** button to continue. > [!div class="mx-imgBorder"] - > ![Web sign-in](images/websignin.png "web sign-in") + > ![Web sign-in.](images/websignin.png "web sign-in") >[!NOTE] >This is a private preview feature and therefore not meant or recommended for production purposes. @@ -271,7 +271,7 @@ Android phone users, you can finally stop emailing yourself photos. With Your Ph For iPhone users, **Your Phone** app also helps you to link your phone to your PC. Surf the web on your phone, then send the webpage instantly to your computer to continue what you’re doing–-read, watch, or browse-- with all the benefits of a bigger screen. > [!div class="mx-imgBorder"] -> ![your phone](images/your-phone.png "your phone") +> ![your phone.](images/your-phone.png "your phone") The desktop pin takes you directly to the **Your Phone** app for quicker access to your phone’s content. You can also go through the all apps list in Start, or use the Windows key and search for **Your Phone**. @@ -283,7 +283,7 @@ One of the things we’ve heard from you is that it’s hard to know when you’ * Video mode increases the screen-to-screen latency to ensure the video on the big screen plays back smoothly * Productivity modes strikes a balance between game mode and video mode; the screen-to screen-latency is responsive enough that typing feels natural, while ensuring videos don’t glitch as often. -![wireless projection banner](images/beaming.png "wireless projection banner") +![wireless projection banner.](images/beaming.png "wireless projection banner") ## Remote Desktop with Biometrics @@ -293,6 +293,6 @@ To get started, sign into your device using Windows Hello for Business. Bring up See the following example: -![Enter your credentials](images/RDPwBioTime.png "Windows Hello") -![Enter your credentials](images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016](images/hyper-v.png "Microsoft Hyper-V Server 2016") +![Enter your credentials.](images/RDPwBioTime.png "Windows Hello") +![Enter your credentials.](images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016.](images/hyper-v.png "Microsoft Hyper-V Server 2016") diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 371bf97c95..74eb1725e2 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -125,7 +125,7 @@ The draft release of the [security configuration baseline settings](/archive/blo This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: -![System Guard](images/system-guard.png "SMM Firmware Measurement") +![System Guard.](images/system-guard.png "SMM Firmware Measurement") ### Identity Protection diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index ac0d4984f2..692871b1c3 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -43,7 +43,7 @@ In this release, [Windows Defender System Guard](/windows/security/threat-prote With this improvement, the OS can detect a higher level of SMM compliance, enabling devices to be even more hardened against SMM exploits and vulnerabilities. This feature is forward-looking and currently requires new hardware available soon. - ![System Guard](images/system-guard2.png) + ![System Guard.](images/system-guard2.png) ### Windows Defender Application Guard From dd0d39dbb5eaa3beb0f7973cbeecaf98042fc9f7 Mon Sep 17 00:00:00 2001 From: Michael Mardahl Date: Sun, 22 Aug 2021 20:41:56 +0200 Subject: [PATCH 0082/1214] Update hello-feature-remote-desktop.md Just noticed some gibberish wording and have tried to adjust to the sentences make more sense. I just concentrated on the part I needed, I have not gone through the entire document. (Less is more ;)) --- .../hello-for-business/hello-feature-remote-desktop.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 30dc6c78e6..6590ff5250 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -25,7 +25,7 @@ ms.reviewer: - Cloud only, Hybrid, and On-premises only Windows Hello for Business deployments - Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices -Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md). +Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) to establish an RDP connection. Microsoft continues to investigate supporting using keys trust for supplied credentials in a future release. @@ -38,7 +38,7 @@ Microsoft continues to investigate supporting using keys trust for supplied cred - Biometric enrollments - Windows 10, version 1809 -Users using earlier versions of Windows 10 could remote desktop to using Windows Hello for Business but were limited to the using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. +Users using earlier versions of Windows 10 could authenticate to a remote desktop using Windows Hello for Business but were limited to using their PIN as their authentication gesture. Windows 10, version 1809 introduces the ability for users to authenticate to a remote desktop session using their Windows Hello for Business biometric gesture. The feature is on by default, so your users can take advantage of it as soon as they upgrade to Windows 10, version 1809. ### How does it work @@ -69,4 +69,4 @@ Users appreciate convenience of biometrics and administrators value the security - [Windows Hello and password changes](hello-and-password-changes.md) - [Windows Hello errors during PIN creation](hello-errors-during-pin-creation.md) - [Event ID 300 - Windows Hello successfully created](hello-event-300.md) -- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) \ No newline at end of file +- [Windows Hello biometrics in the enterprise](hello-biometrics-in-enterprise.md) From 589ab9dc7edcc0dec5fc8dccd22667f9c8a655d7 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 12:24:16 +0530 Subject: [PATCH 0083/1214] Resolving suggestions for better result --- .../configuration/cortana-at-work/cortana-at-work-overview.md | 4 ++-- .../configuration/cortana-at-work/cortana-at-work-powerbi.md | 2 +- .../cortana-at-work/cortana-at-work-scenario-2.md | 2 +- .../cortana-at-work/cortana-at-work-scenario-4.md | 4 ++-- .../cortana-at-work/cortana-at-work-scenario-5.md | 2 +- .../cortana-at-work/cortana-at-work-scenario-6.md | 2 +- .../cortana-at-work/set-up-and-test-cortana-in-windows-10.md | 2 +- windows/configuration/cortana-at-work/test-scenario-5.md | 2 +- 8 files changed, 10 insertions(+), 10 deletions(-) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-overview.md b/windows/configuration/cortana-at-work/cortana-at-work-overview.md index 140f54edf4..ac0783dddb 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-overview.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-overview.md @@ -2,7 +2,7 @@ title: Configure Cortana in Windows 10 and Windows 11 ms.reviewer: manager: dansimp -description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. +description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and for enterprise environments. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -51,7 +51,7 @@ Cortana's approach to integration with Microsoft 365 has changed with Windows 10 ### Cortana in Windows 10, version 2004 and later, or Windows 11 -Cortana enterprise services that can be accessed using Azure AD through Cortana in Windows 10, version 2004 and later, or Windows 11, meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365). +Cortana enterprise services that can be accessed using Azure AD through Cortana in Windows 10, version 2004 and later, or Windows 11, meet the same enterprise-level privacy, security, and compliance promises as reflected in the [Online Services Terms (OST)](https://www.microsoft.com/en-us/licensing/product-licensing/products). To learn more, see [Cortana in Microsoft 365](/microsoft-365/admin/misc/cortana-integration?view=o365-worldwide#what-data-is-processed-by-cortana-in-office-365&preserve-view=true). #### How does Microsoft store, retain, process, and use Customer Data in Cortana? diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 1ddfd0c705..78c5c80ef5 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -56,7 +56,7 @@ Before you can start this testing scenario, you must first set up your test envi 4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. - ![Cortana at work, showing the Samples link](../images/cortana-powerbi-getdata-samples.png) + ![Cortana at work, showing Samples link](../images/cortana-powerbi-getdata-samples.png) 5. Click **Retail Analysis Sample**, and then click **Connect**. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md index dab5bf883a..029beac994 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-2.md @@ -1,6 +1,6 @@ --- title: Perform a quick search with Cortana at work (Windows) -description: A test scenario about how to perform a quick search with Cortana at work. +description: This is a test scenario about how to perform a quick search with Cortana at work. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md index b5784100ce..ef74c5f580 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-4.md @@ -1,6 +1,6 @@ --- title: Use Cortana at work to find your upcoming meetings (Windows) -description: A test scenario about how to use Cortana at work to find your upcoming meetings. +description: A test scenario on how to use Cortana at work to find your upcoming meetings. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -12,7 +12,7 @@ ms.reviewer: manager: dansimp --- -# Test scenario 4 - Use Cortana to find free time on your calendar +# Test scenario 4 - Use Cortana to find free time on your calendar for your upcoming meetings. This scenario helps you find out if a time slot is free on your calendar. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index a2cefc5ce3..926fcea790 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -1,6 +1,6 @@ --- title: Use Cortana to send email to a co-worker (Windows) -description: A test scenario about how to use Cortana at work to send email to a co-worker. +description: A test scenario on how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md index 003caaecc7..b7ff043455 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-6.md @@ -1,6 +1,6 @@ --- title: Review a reminder suggested by Cortana (Windows) -description: A test scenario about how to use Cortana with the Suggested reminders feature. +description: A test scenario on how to use Cortana with the Suggested reminders feature. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md index 06ff6a75f4..a4f82f1aac 100644 --- a/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md +++ b/windows/configuration/cortana-at-work/set-up-and-test-cortana-in-windows-10.md @@ -2,7 +2,7 @@ title: Set up and test Cortana in Windows 10, version 2004 and later ms.reviewer: manager: dansimp -description: Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments. +description: Cortana includes powerful configuration options specifically to optimize unique small to medium-sized business and enterprise environments. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md index e798d2260a..d730763085 100644 --- a/windows/configuration/cortana-at-work/test-scenario-5.md +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -1,6 +1,6 @@ --- title: Use Cortana to send email to a co-worker (Windows) -description: A test scenario about how to use Cortana at work to send email to a co-worker. +description: A test scenario on how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library From 61149771d21407e0591221acf12c171e6f0b3b64 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 14:11:14 +0530 Subject: [PATCH 0084/1214] TASK 5358645: Windows 11 Inclusion Update -01 TASK 5358645: First batch of Windows 11 Inclusion updates under Windows-defender-application-control folder. (I've also made some changes to few words as per Acrolinx suggestions to meet the PR criteria). --- .../LOB-win32-apps-on-s.md | 11 +++-- ...ows-defender-application-control-policy.md | 13 +++--- ...s-defender-application-control-policies.md | 10 +++-- ...s-defender-application-control-policies.md | 10 +++-- ...-apps-deployed-with-a-managed-installer.md | 10 +++-- .../configure-wdac-managed-installer.md | 12 ++++-- ...or-windows-defender-application-control.md | 10 +++-- .../create-initial-default-policy.md | 30 +++++++------ ...e-wdac-policy-for-fully-managed-devices.md | 40 ++++++++++-------- ...wdac-policy-for-lightly-managed-devices.md | 42 ++++++++++--------- ...rt-windows-defender-application-control.md | 8 +++- ...s-defender-application-control-policies.md | 10 +++-- ...ion-control-policies-using-group-policy.md | 14 ++++--- ...plication-control-policies-using-intune.md | 13 ++++-- ...s-defender-application-control-policies.md | 8 +++- ...s-defender-application-control-policies.md | 12 ++++-- .../example-wdac-base-policies.md | 10 +++-- .../feature-availability.md | 12 ++++-- ...th-windows-defender-application-control.md | 8 +++- ...s-defender-application-control-policies.md | 12 ++++-- .../microsoft-recommended-block-rules.md | 16 ++++--- ...icrosoft-recommended-driver-block-rules.md | 12 ++++-- ...defender-application-control-management.md | 14 ++++--- .../select-types-of-rules-to-create.md | 18 ++++---- .../types-of-devices.md | 16 ++++--- 25 files changed, 236 insertions(+), 135 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 311cfd2625..af1e30dca2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -1,5 +1,5 @@ --- -title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows 10) +title: Allow LOB Win32 Apps on Intune-Managed S Mode Devices (Windows) description: Using WDAC supplemental policies, you can expand the S mode base policy on your Intune-managed devices. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,10 +23,15 @@ ms.technology: mde **Applies to:** - Windows 10 +- Windows 11 +- Windows Server 2016 and above -Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications as well as Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization". +Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications and Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. + +With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization". Refer to the below video for an overview and brief demo. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp] diff --git a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md index 4b3eb396a8..107430388b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/allow-com-object-registration-in-windows-defender-application-control-policy.md @@ -1,5 +1,5 @@ --- -title: Allow COM object registration in a WDAC policy (Windows 10) +title: Allow COM object registration in a WDAC policy (Windows) description: You can allow COM object registration in a Windows Defender Application Control policy. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,17 +22,20 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 -- Windows Server 2019 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). >[!IMPORTANT] ->Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. +>Some information relates to pre-released product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. The [Microsoft Component Object Model (COM)](/windows/desktop/com/the-component-object-model) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM specifies an object model and programming requirements that enable COM objects to interact with other objects. ### COM object configurability in WDAC policy -Prior to the Windows 10 1903 update, Windows Defender Application Control (WDAC) enforced a built-in allow list for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. +Prior to the Windows 10 1903 update, Windows Defender Application Control (WDAC) enforced a built-in allowlist for COM object registration. While this mechanism works for most common application usage scenarios, customers have provided feedback that there are cases where additional COM objects need to be allowed. The 1903 update to Windows 10 introduces the ability to specify allowed COM objects via their GUID in the WDAC policy. **NOTE**: To add this functionality to other versions of Windows 10, you can install the following or later updates: diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md index c1d7ac7c71..bc1218b82c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Use audit events to create then enforce WDAC policy rules (Windows 10) +title: Use audit events to create then enforce WDAC policy rules (Windows) description: Learn how audits allow admins to discover apps, binaries, and scripts that should be added to a WDAC policy, then learn how to switch that WDAC policy from audit to enforced mode. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included. diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 5ed5fa1cf7..cb94565bff 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Use audit events to create WDAC policy rules (Windows 10) +title: Use audit events to create WDAC policy rules (Windows) description: Audits allow admins to discover apps, binaries, and scripts that should be added to the WDAC policy. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Running Application Control in audit mode lets you discover applications, binaries, and scripts that are missing from your WDAC policy but should be included. diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 15639fd8d3..76eb273ded 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -1,5 +1,5 @@ --- -title: Configure authorized apps deployed with a WDAC-managed installer (Windows 10) +title: Configure authorized apps deployed with a WDAC-managed installer (Windows) description: Explains how to configure a custom Manged Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2019 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Windows 10, version 1703 introduced a new option for Windows Defender Application Control (WDAC), called _managed installer_, that helps balance security and manageability when enforcing application control policies. This option lets you automatically allow applications installed by a designated software distribution solution such as Microsoft Endpoint Configuration Manager. diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md index 9d15cbfcc7..14ac17e575 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md @@ -1,5 +1,5 @@ --- -title: Configure a WDAC managed installer (Windows 10) +title: Configure a WDAC managed installer (Windows) description: Explains how to configure a custom Manged Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2019 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Setting up managed installer tracking and application execution enforcement requires applying both an AppLocker and WDAC policy with specific rules and options enabled. There are three primary steps to keep in mind: @@ -126,7 +130,7 @@ For example: In order to enable trust for the binaries laid down by managed installers, the Enabled: Managed Installer option must be specified in your WDAC policy. This can be done by using the [Set-RuleOption cmdlet](/powershell/module/configci/set-ruleoption) with Option 13. -Below are steps to create a WDAC policy which allows Windows to boot and enables the managed installer option. +Below are steps to create a WDAC policy that allows Windows to boot and enables the managed installer option. 1. Copy the DefaultWindows_Audit policy into your working folder from C:\Windows\schemas\CodeIntegrity\ExamplePolicies\DefaultWindows_Audit.xml diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index f3b993cbc0..b9ca84a296 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -1,5 +1,5 @@ --- -title: Create a code signing cert for Windows Defender Application Control (Windows 10) +title: Create a code signing cert for Windows Defender Application Control (Windows) description: Learn how to set up a publicly-issued code signing certificate, so you can sign catalog files or WDAC policies internally. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). As you deploy Windows Defender Application Control (WDAC), you might need to sign catalog files or WDAC policies internally. To do this, you will either need a publicly issued code signing certificate or an internal CA. If you have purchased a code signing certificate, you can skip this topic and instead follow other topics listed in the [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md). @@ -75,7 +79,7 @@ When this certificate template has been created, you must publish it to the CA p 2. Select the WDAC Catalog signing certificate, and then click **OK**. -Now that the template is available to be issued, you must request one from the computer running Windows 10 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: +Now that the template is available to be issued, you must request one from the computer running Windows 10 and Windows 11 on which you create and sign catalog files. To begin, open the MMC, and then complete the following steps: 1. In MMC, from the **File** menu, click **Add/Remove Snap-in**. Double-click **Certificates**, and then select **My user account**. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md index a4d560af0b..40ab4ad3bd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-initial-default-policy.md @@ -1,5 +1,5 @@ --- -title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows 10) +title: Create a WDAC policy for fixed-workload devices using a reference computer (Windows) description: To create a Windows Defender Application Control (WDAC) policy for fixed-workload devices within your organization, follow this guide. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,30 +22,34 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -This section outlines the process to create a WDAC policy for fixed-workload devices within an organization. Fixed-workload devices tend to be dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc... +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -For this example, you must initiate variables to be used during the creation process or use the full file paths in the command. -Then create the WDAC policy by scanning the system for installed applications. +This section outlines the process to create a WDAC policy for fixed-workload devices within an organization. Fixed-workload devices tend to be dedicated to a specific functional purpose and share common configuration attributes with other devices servicing the same functional role. Examples of fixed-workload devices may include Active Directory Domain Controllers, Secure Admin Workstations, pharmaceutical drug-mixing equipment, manufacturing devices, cash registers, ATMs, etc. + +For this example, you must initiate variables to be used during the creation process or use the full file paths in the command. +Then create the WDAC policy by scanning the system for installed applications. The policy file is converted to binary format when it gets created so that Windows can interpret it. ## Overview of the process of creating Windows Defender Application Control policies A common system imaging practice in today’s IT organization is to establish a “golden” image as a reference for what an ideal system should look like, and then use that image to clone additional company assets. WDAC policies follow a similar methodology, that begins with the establishment of a golden computer. As with imaging, you can have multiple golden computers based on model, department, application set, and so on. Although the thought process around the creation of WDAC policies is similar to imaging, these policies should be maintained independently. Assess the necessity of additional WDAC policies based on what should be allowed to be installed and run and for whom. For more details on doing this assessment, see the [WDAC Design Guide](windows-defender-application-control-design-guide.md). -Optionally, WDAC can align with your software catalog as well as any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged or serviced, and managed. +Optionally, WDAC can align with your software catalog and any IT department–approved applications. One straightforward method to implement WDAC is to use existing images to create one master WDAC policy. You do so by creating a WDAC policy from each image, and then by merging the policies. This way, what is installed on all of those images will be allowed to run, if the applications are installed on a computer based on a different image. Alternatively, you may choose to create a base applications policy and add policies based on the computer’s role or department. Organizations have a choice of how their policies are created, merged, or serviced, and managed. -If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). +If you plan to use an internal CA to sign catalog files or WDAC policies, see the steps in [Optional: Create a code signing certificate for Windows Defender Application Control](create-code-signing-cert-for-windows-defender-application-control.md). > [!NOTE] -> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy. +> Make sure the reference computer is virus and malware-free, and install any software you want to be scanned before creating the WDAC policy. -Each installed software application should be validated as trustworthy before you create a policy. -We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable. -Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want to run scripts. -You can remove or disable such software on the reference computer. +Each installed software application should be validated as trustworthy before you create a policy. +We recommend that you review the reference computer for software that can load arbitrary DLLs and run code or scripts that could render the PC more vulnerable. +Examples include software aimed at development or scripting such as msbuild.exe (part of Visual Studio and the .NET Framework) which can be removed if you do not want to run scripts. +You can remove or disable such software on the reference computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md index cceb8da77d..3870af3447 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md @@ -1,5 +1,5 @@ --- -title: Create a WDAC policy for fully-managed devices (Windows 10) +title: Create a WDAC policy for fully managed devices (Windows) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. keywords: security, malware ms.topic: conceptual @@ -19,29 +19,33 @@ ms.date: 11/20/2019 ms.technology: mde --- -# Create a WDAC policy for fully-managed devices +# Create a WDAC policy for fully managed devices **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -This section outlines the process to create a WDAC policy for **fully-managed devices** within an organization. The key difference between this scenario and [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully-managed device is managed by IT and users of the device cannot install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Endpoint Manager (MEM). Additionally, users on fully-managed devices should ideally run as standard user and only authorized IT pros have administrative access. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +This section outlines the process to create a WDAC policy for **fully managed devices** within an organization. The key difference between this scenario and [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md) is that all software deployed to a fully managed device is managed by IT and users of the device cannot install arbitrary apps. Ideally, all apps are deployed using a software distribution solution, such as Microsoft Endpoint Manager (MEM). Additionally, users on fully managed devices should ideally run as standard user and only authorized IT pros have administrative access. > [!NOTE] -> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. +> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. As described in [common WDAC deployment scenarios](types-of-devices.md), we will use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. **Alice Pena** is the IT team lead tasked with the rollout of WDAC. -Alice previously created a policy for the organization's lightly-managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and task-workers are not granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT. +Alice previously created a policy for the organization's lightly managed devices. Some devices, however, are more tightly managed and can benefit from a more constrained policy. In particular, certain job functions such as administrative staff and firstline workers are not granted administrator level access to their devices. Similarly, shared kiosks are configured only with a managed set of apps and all users of the device except IT run as standard user. On these devices, all apps are deployed and installed by IT. -## Define the "circle-of-trust" for fully-managed devices +## Define the "circle-of-trust" for fully managed devices -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully-managed devices: +Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's fully managed devices: -- All clients are running Windows 10 version 1903 or above; +- All clients are running Windows 10 version 1903 or above or Windows 11; - All clients are managed by Microsoft Endpoint Manager (MEM) either with Configuration Manager (MEMCM) standalone or hybrid mode with Intune; > [!NOTE] @@ -55,15 +59,15 @@ Alice's team develops a simple console application, called *LamnaITInstaller.exe Based on the above, Alice defines the pseudo-rules for the policy: -1. **“Windows works”** rules which authorizes: +1. **“Windows works”** rules that authorize: - Windows - WHQL (3rd party kernel drivers) - Windows Store signed apps -2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function +2. **"MEMCM works”** rules that include signer and hash rules for MEMCM components to properly function 3. **Allow Managed Installer** (MEMCM and *LamnaITInstaller.exe* configured as a managed installer) -The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly-managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are: +The critical differences between this set of pseudo-rules and those defined for Lamna's [lightly managed devices](create-wdac-policy-for-lightly-managed-devices.md#define-the-circle-of-trust-for-lightly-managed-devices) are: - Removal of the Intelligent Security Graph (ISG) option; and - Removal of filepath rules. @@ -77,7 +81,7 @@ Alice follows these steps to complete this task: > [!NOTE] > If you do not use MEMCM or prefer to use a different [example WDAC base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the MEMCM policy path with your preferred example base policy. -1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above. +1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above, or Windows 11. 2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables: @@ -129,12 +133,12 @@ Alice follows these steps to complete this task: At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna. -## Security considerations of this fully-managed policy +## Security considerations of this fully managed policy -Alice has defined a policy for Lamna's fully-managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include: +Alice has defined a policy for Lamna's fully managed devices that makes some trade-offs between security and manageability for apps. Some of the trade-offs include: - **Users with administrative access**
- Although applying to fewer users, Lamna still allows some IT staff to log in to its fully-managed devices as administrator. This allows these admin users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer which would allow them to gain persistent app authorization for whatever apps or binaries they wish. + Although applying to fewer users, Lamna still allows some IT staff to log in to its fully managed devices as administrator. This allows these admin users (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish. Possible mitigations: - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. @@ -160,7 +164,7 @@ Alice has defined a policy for Lamna's fully-managed devices that makes some tra Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction. Possible mitigations: - - Use signed WDAC policies which allow authorized signed supplemental policies only. + - Use signed WDAC policies that allow authorized signed supplemental policies only. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. ## Up next diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md index c4dabcde4c..76199f55b5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-lightly-managed-devices.md @@ -1,5 +1,5 @@ --- -title: Create a WDAC policy for lightly-managed devices (Windows 10) +title: Create a WDAC policy for lightly managed devices (Windows) description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. keywords: security, malware ms.topic: conceptual @@ -19,29 +19,33 @@ ms.date: 11/15/2019 ms.technology: mde --- -# Create a WDAC policy for lightly-managed devices +# Create a WDAC policy for lightly managed devices **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -This section outlines the process to create a WDAC policy for **lightly-managed devices** within an organization. Typically, organizations that are new to application control will be most successful if they start with a permissive policy like the one described in this topic. Organizations can choose to harden the policy over time to achieve a stronger overall security posture on their WDAC managed devices as described in later topics. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +This section outlines the process to create a WDAC policy for **lightly managed devices** within an organization. Typically, organizations that are new to application control will be most successful if they start with a permissive policy like the one described in this topic. Organizations can choose to harden the policy over time to achieve a stronger overall security posture on their WDAC-managed devices as described in later topics. > [!NOTE] -> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. +> Some of the WDAC options described in this topic are only available on Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features and assess the impact for any features that may be unavailable on your clients. You may need to adapt this guidance to meet your specific organization's needs. As in the [previous topic](types-of-devices.md), we will use the example of **Lamna Healthcare Company (Lamna)** to illustrate this scenario. Lamna is attempting to adopt stronger application policies, including the use of application control to prevent unwanted or unauthorized applications from running on their managed devices. -**Alice Pena** is the IT team lead tasked with the rollout of WDAC. Recognizing where Lamna is starting from, with very loose application usage policies and a culture of maximum app flexibility for users, Alice knows that she will need to take an incremental approach to application control and use different policies for different workloads. +**Alice Pena** is the IT team lead tasked with the rollout of WDAC. Recognizing where Lamna is starting from, with loose application usage policies and a culture of maximum app flexibility for users, Alice knows that she will need to take an incremental approach to application control and use different policies for different workloads. For the majority of users and devices, Alice wants to create an initial policy that is as relaxed as possible in order to minimize user productivity impact, while still providing security value. -## Define the "circle-of-trust" for lightly-managed devices +## Define the "circle-of-trust" for lightly managed devices -Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's lightly-managed devices, which currently includes most end-user devices: +Alice identifies the following key factors to arrive at the "circle-of-trust" for Lamna's lightly managed devices, which currently include most end-user devices: -- All clients are running Windows 10 version 1903 or above; +- All clients are running Windows 10 version 1903 and above, or Windows 11; - All clients are managed by Microsoft Endpoint Manager (MEM) either with Configuration Manager (MEMCM) standalone or hybrid mode with Intune; > [!NOTE] @@ -53,12 +57,12 @@ Alice identifies the following key factors to arrive at the "circle-of-trust" fo Based on the above, Alice defines the pseudo-rules for the policy: -1. **“Windows works”** rules which authorizes: +1. **“Windows works”** rules that authorize: - Windows - WHQL (3rd party kernel drivers) - Windows Store signed apps -2. **"MEMCM works”** rules which includes signer and hash rules for MEMCM components to properly function +2. **"MEMCM works”** rules which include signer and hash rules for MEMCM components to properly function 3. **Allow Managed Installer** (MEMCM configured as a managed installer) 4. **Allow Intelligent Security Graph (ISG)** (reputation-based authorization) 5. **Admin-only path rules** for the following locations: @@ -68,14 +72,14 @@ Based on the above, Alice defines the pseudo-rules for the policy: ## Create a custom base policy using an example WDAC base policy -Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's lightly-managed devices. She decides to use MEMCM to create the initial base policy and then customize it to meet Lamna's needs. +Having defined the "circle-of-trust", Alice is ready to generate the initial policy for Lamna's lightly managed devices. She decides to use MEMCM to create the initial base policy and then customize it to meet Lamna's needs. Alice follows these steps to complete this task: > [!NOTE] > If you do not use MEMCM or prefer to use a different [example WDAC base policy](example-wdac-base-policies.md) for your own policy, skip to step 2 and substitute the MEMCM policy path with your preferred example base policy. -1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 or above. +1. [Use MEMCM to create and deploy an audit policy](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) to a client device running Windows 10 version 1903 and above, or Windows 11. 2. On the client device, run the following commands in an elevated Windows PowerShell session to initialize variables: @@ -137,12 +141,12 @@ Alice follows these steps to complete this task: At this point, Alice now has an initial policy that is ready to deploy in audit mode to the managed clients within Lamna. -## Security considerations of this lightly-managed policy +## Security considerations of this lightly managed policy In order to minimize user productivity impact, Alice has defined a policy that makes several trade-offs between security and user app flexibility. Some of the trade-offs include: - **Users with administrative access**
- By far the most impactful security trade-off, this allows the device user (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer which would allow them to gain persistent app authorization for whatever apps or binaries they wish. + By far the most impactful security trade-off, this allows the device user (or malware running with the user's privileges) to modify or remove altogether the WDAC policy applied on the device. Additionally, administrators can configure any app they wish to operate as a managed installer that would allow them to gain persistent app authorization for whatever apps or binaries they wish. Possible mitigations: - Use signed WDAC policies and UEFI BIOS access protection to prevent tampering of WDAC policies. @@ -164,13 +168,13 @@ In order to minimize user productivity impact, Alice has defined a policy that m See [security considerations with the Intelligent Security Graph](use-windows-defender-application-control-with-intelligent-security-graph.md#security-considerations-with-the-intelligent-security-graph) Possible mitigations: - - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature based rules. + - Implement policies requiring apps are managed by IT; audit existing app usage and deploy authorized apps using a software distribution solution such as Microsoft Endpoint Manager; move from ISG to managed installer or signature-based rules. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. - **Supplemental policies**
Supplemental policies are designed to relax the associated base policy. Additionally allowing unsigned policies allows any administrator process to expand the "circle-of-trust" defined by the base policy without restriction. Possible mitigations: - - Use signed WDAC policies which allow authorized signed supplemental policies only. + - Use signed WDAC policies that allow authorized signed supplemental policies only. - Use a restrictive audit mode policy to audit app usage and augment vulnerability detection. - **FilePath rules**
See [more information about filepath rules](select-types-of-rules-to-create.md#more-information-about-filepath-rules) @@ -181,5 +185,5 @@ In order to minimize user productivity impact, Alice has defined a policy that m ## Up next -- [Create a WDAC policy for fully-managed devices](create-wdac-policy-for-fully-managed-devices.md) +- [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) - [Prepare to deploy WDAC policies](windows-defender-application-control-deployment-guide.md) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index 2a3d5a91f3..52cac752d2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -1,5 +1,5 @@ --- -title: Deploy catalog files to support Windows Defender Application Control (Windows 10) +title: Deploy catalog files to support Windows Defender Application Control (Windows) description: Catalog files simplify running unsigned applications in the presence of a Windows Defender Application Control (WDAC) policy. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Catalog files can be important in your deployment of Windows Defender Application Control (WDAC) if you have unsigned line-of-business (LOB) applications for which the process of signing is difficult. To prepare to create WDAC policies that allow these trusted applications but block unsigned code (most malware is unsigned), you create a *catalog file* that contains information about the trusted applications. After you sign and distribute the catalog, your trusted applications can be handled by WDAC in the same way as any other signed application. With this foundation, you can more easily block all unsigned applications, allowing only signed applications to run. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md index 33cc699ac1..9ea7cc663a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-multiple-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Use multiple Windows Defender Application Control Policies (Windows 10) +title: Use multiple Windows Defender Application Control Policies (Windows) description: Windows Defender Application Control supports multiple code integrity policies for one device. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 version 1903 and above -- Windows Server 2022 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Prior to Windows 10 1903, WDAC only supported a single active policy on a system at any given time. This significantly limited customers in situations where multiple policies with different intents would be useful. Beginning with Windows 10 version 1903, WDAC supports up to 32 active policies on a device at once in order to enable the following scenarios: diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index 8e8fa29002..d20e96958f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -1,5 +1,5 @@ --- -title: Deploy WDAC policies via Group Policy (Windows 10) +title: Deploy WDAC policies via Group Policy (Windows) description: Windows Defender Application Control (WDAC) policies can easily be deployed and managed with Group Policy. Learn how by following this step-by-step guide. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,11 +22,15 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). > [!NOTE] -> Group Policy-based deployment of WDAC policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, we recommend using an alternative method for policy deployment. +> Group Policy-based deployment of WDAC policies only supports single-policy format WDAC policies. To use WDAC on devices running Windows 10 1903 and greater, or Windows 11, we recommend using an alternative method for policy deployment. Single-policy format WDAC policies (pre-1903 policy schema) can be easily deployed and managed with Group Policy. The following procedure walks you through how to deploy a WDAC policy called **ContosoPolicy.bin** to a test OU called *WDAC Enabled PCs* by using a GPO called **Contoso GPO Test**. @@ -61,4 +65,4 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. -7. Close the Group Policy Management Editor, and then restart the Windows 10 test computer. Restarting the computer updates the WDAC policy. +7. Close the Group Policy Management Editor, and then restart the Windows test computer. Restarting the computer updates the WDAC policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 8cf09e5b2f..250600e081 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -1,5 +1,5 @@ --- -title: Deploy WDAC policies using Mobile Device Management (MDM) (Windows 10) +title: Deploy WDAC policies using Mobile Device Management (MDM) (Windows) description: You can use an MDM like Microsoft Intune to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,13 +22,18 @@ ms.technology: mde **Applies to:** -- Windows 10 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). You can use a Mobile Device Management (MDM) solution, like Microsoft Endpoint Manager (MEM) Intune, to configure Windows Defender Application Control (WDAC) on client machines. Intune includes native support for WDAC which can be a helpful starting point, but customers may find the available circle-of-trust options too limiting. To deploy a custom policy through Intune and define your own circle of trust, you can configure a profile using Custom OMA-URI. If your organization uses another MDM solution, check with your solution provider for WDAC policy deployment steps. ## Use Intune's built-in policies -Intune's built-in WDAC support allows you to configure Windows 10 client computers to only run: +Intune's built-in WDAC support allows you to configure Windows client computers to only run: - Windows components - 3rd party hardware and software kernel drivers @@ -36,7 +41,7 @@ Intune's built-in WDAC support allows you to configure Windows 10 client compute - [Optional] Reputable apps as defined by the Intelligent Security Graph (ISG) > [!NOTE] -> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ as described later in this topic. +> Intune's built-in policies use the pre-1903 single-policy format version of the DefaultWindows policy. You can use Intune's custom OMA-URI feature to deploy your own multiple-policy format WDAC policies and leverage features available on Windows 10 1903+ or Windows 11 as described later in this topic. > [!NOTE] > Intune currently uses the AppLocker CSP to deploy its built-in policies. The AppLocker CSP will always request a reboot when applying WDAC policies. You can use Intune's custom OMA-URI feature with the ApplicationControl CSP to deploy your own WDAC policies rebootlessly. diff --git a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md index 6cbf4d90fa..ad706276ac 100644 --- a/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/disable-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Disable Windows Defender Application Control policies (Windows 10) +title: Disable Windows Defender Application Control policies (Windows) description: Learn how to disable both signed and unsigned Windows Defender Application Control policies, within Windows and within the BIOS. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic covers how to disable unsigned or signed WDAC policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md index 6c3b04eb5a..5dd1fd73f9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/enforce-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Enforce Windows Defender Application Control (WDAC) policies (Windows 10) +title: Enforce Windows Defender Application Control (WDAC) policies (Windows) description: Learn how to switch a WDAC policy from audit to enforced mode. keywords: security, malware ms.prod: m365-security @@ -20,13 +20,17 @@ ms.localizationpriority: medium **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). You should now have one or more WDAC policies broadly deployed in audit mode. You have analyzed events collected from the devices with those policies and you're ready to enforce. Use this procedure to prepare and deploy your WDAC policies in enforcement mode. > [!NOTE] -> Some of the steps described in this article only apply to Windows 10 version 1903 and above. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features. Evaluate the impact for any features that may be unavailable on your clients running earlier versions of Windows 10 and Windows Server. You may need to adapt this guidance to meet your specific organization's needs. +> Some of the steps described in this article only apply to Windows 10 version 1903 and above, or Windows 11. When using this topic to plan your own organization's WDAC policies, consider whether your managed clients can use all or some of these features. Evaluate the impact for any features that may be unavailable on your clients running earlier versions of Windows 10 and Windows Server. You may need to adapt this guidance to meet your specific organization's needs. ## Convert WDAC **base** policy from audit to enforced diff --git a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md index 8457a3a69c..4e249a4f50 100644 --- a/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/example-wdac-base-policies.md @@ -1,5 +1,5 @@ --- -title: Example Windows Defender Application Control (WDAC) base policies (Windows 10) +title: Example Windows Defender Application Control (WDAC) base policies (Windows) description: When creating a WDAC policy for an organization, start from one of the many available example base policies. keywords: security, malware ms.topic: article @@ -23,8 +23,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). When creating policies for use with Windows Defender Application Control (WDAC), start from an existing base policy and then add or remove rules to build your own custom policy. Windows includes several example policies that can be used, or organizations that use the Device Guard Signing Service can download a starter policy from that service. diff --git a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md index 0f9af0978c..16eb1e9257 100644 --- a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md +++ b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md @@ -23,16 +23,20 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). | Capability | WDAC | AppLocker | |-------------|------|-------------| -| Platform support | Available on Windows 10 | Available on Windows 8+ | +| Platform support | Available on Windows 10 and Windows 11 | Available on Windows 8+ | | SKU availability | Cmdlets are available on all SKUs on 1909+ builds.
For pre-1909 builds, cmdlets are only available on Enterprise but policies are effective on all SKUs. | Policies deployed through GP are only effective on Enterprise devices.
Policies deployed through MDM are effective on all SKUs. | | Management solutions |
  • [Intune](./deploy-windows-defender-application-control-policies-using-intune.md) (limited built-in policies or custom policy deployment via OMA-URI)
  • [Microsoft Endpoint Manager Configuration Manager (MEMCM)](/configmgr/protect/deploy-use/use-device-guard-with-configuration-manager) (limited built-in policies or custom policy deployment via Software Distribution)
  • [Group Policy](./deploy-windows-defender-application-control-policies-using-group-policy.md)
  • PowerShell
|
  • [Intune](/windows/client-management/mdm/applocker-csp) (custom policy deployment via OMA-URI only)
  • MEMCM (custom policy deployment via Software Distribution only)
  • [Group Policy](./applocker/determine-group-policy-structure-and-rule-enforcement.md)
  • PowerShell
    • | | Per-User and Per-User group rules | Not available (policies are device-wide) | Available on Windows 8+ | -| Kernel mode policies | Available on all Windows 10 versions | Not available | +| Kernel mode policies | Available on all Windows 10 versions and Windows 11 | Not available | | Per-app rules | [Available on 1703+](./use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md) | Not available | | Managed Installer (MI) | [Available on 1703+](./configure-authorized-apps-deployed-with-a-managed-installer.md) | Not available | | Reputation-Based intelligence | [Available on 1709+](./use-windows-defender-application-control-with-intelligent-security-graph.md) | Not available | diff --git a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md index 4d5cd8178f..2d0ccf9451 100644 --- a/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/manage-packaged-apps-with-windows-defender-application-control.md @@ -1,5 +1,5 @@ --- -title: Manage packaged apps with WDAC (Windows 10) +title: Manage packaged apps with WDAC (Windows) description: Packaged apps, also known as Universal Windows apps, allow you to control the entire app by using a single Windows Defender Application Control (WDAC) rule. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,7 +23,11 @@ ms.technology: mde **Applies to:** - Windows 10 -- Windows Server 2016 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for IT professionals describes concepts and lists procedures to help you manage packaged apps with Windows Defender Application Control (WDAC) as part of your overall application control strategy. diff --git a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md index a3a2084a23..f2561cb90c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/merge-windows-defender-application-control-policies.md @@ -1,5 +1,5 @@ --- -title: Merge Windows Defender Application Control policies (WDAC) (Windows 10) +title: Merge Windows Defender Application Control policies (WDAC) (Windows) description: Learn how to merge WDAC policies as part of your policy lifecycle management. keywords: security, malware ms.prod: m365-security @@ -20,8 +20,12 @@ ms.localizationpriority: medium **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This article shows how to merge multiple policy XML files together and how to merge rules directly into a policy. WDAC deployments often include a few base policies and optional supplemental policies for specific use cases. @@ -87,7 +91,7 @@ Now that you have your new, merged policy, you can convert and deploy the policy ``` > [!NOTE] - > In the sample commands above, for policies targeting Windows 10 version 1903+, replace the string "{InsertPolicyID}" with the actual PolicyID GUID (including braces **{ }**) found in your policy XML file. For Windows 10 versions prior to 1903, use the name SiPolicy.p7b for the binary file name. + > In the sample commands above, for policies targeting Windows 10 version 1903+ or Windows 11, replace the string "{InsertPolicyID}" with the actual PolicyID GUID (including braces **{ }**) found in your policy XML file. For Windows 10 versions prior to 1903, use the name SiPolicy.p7b for the binary file name. 2. Upload your merged policy XML and the associated binary to the source control solution you are using for your WDAC policies. such as [GitHub](https://github.com/) or a document management solution such as [Office 365 SharePoint](https://products.office.com/sharepoint/collaboration). diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index c69955e62b..9d1ed76f05 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -1,5 +1,5 @@ --- -title: Microsoft recommended block rules (Windows 10) +title: Microsoft recommended block rules (Windows) description: View a list of recommended block rules, based on knowledge shared between Microsoft and the wider security community. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Members of the security community* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control. @@ -71,7 +75,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you 1 A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here [BGInfo 4.22](/sysinternals/downloads/bginfo). Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. -2 If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. +2 If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end-user device that is not being used in a development context, we recommend that you block msbuild.exe. * Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people: @@ -96,9 +100,9 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you > [!Note] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. -Certain software applications may allow additional code to run by design. +Certain software applications may allow extra code to run by design. These types of applications should be blocked by your Windows Defender Application Control policy. -In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add deny rules to your WDAC policies for that application’s previous, less secure versions. +Also, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add Deny rules to your WDAC policies for that application’s previous, less secure versions. Microsoft recommends that you install the latest security updates. The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control. diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md index f85b75d3ad..56ff102873 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules.md @@ -1,5 +1,5 @@ --- -title: Microsoft recommended driver block rules (Windows 10) +title: Microsoft recommended driver block rules (Windows) description: View a list of recommended block rules to block vulnerable third-party drivers discovered by Microsoft and the security research community. keywords: security, malware, kernel mode, driver ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -21,10 +21,14 @@ ms.date: **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -Microsoft has strict requirements for code running in kernel. Consequently, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they're patched and rolled out to the ecosystem in an expedited manner. Microsoft then adds the vulnerable versions of the drivers to our ecosystem block policy, which is applied to the following sets of devices: +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +Microsoft has strict requirements for code running in kernel. So, malicious actors are turning to exploit vulnerabilities in legitimate and signed kernel drivers to run malware in kernel. One of the many strengths of the Windows platform is our strong collaboration with independent hardware vendors (IHVs) and OEMs. Microsoft works closely with our IHVs and security community to ensure the highest level of driver security for our customers and when vulnerabilities in drivers do arise, that they're patched and rolled out to the ecosystem in an expedited manner. Microsoft then adds the vulnerable versions of the drivers to our ecosystem block policy, which is applied to the following sets of devices: - Hypervisor-protected code integrity (HVCI) enabled devices - Windows 10 in S mode (S mode) devices diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index a9cd8c8585..848bfe1e62 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -1,5 +1,5 @@ --- -title: Plan for WDAC policy management (Windows 10) +title: Plan for WDAC policy management (Windows) description: Learn about the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control policies. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic describes the decisions you need to make to establish the processes for managing and maintaining Windows Defender Application Control (WDAC) policies. @@ -49,10 +53,10 @@ To effectively manage WDAC policies, you should store and maintain your policy X ### Set PolicyName, PolicyID, and Version metadata for each policy -Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing WDAC events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system auto-generate a unique ID for the policy. +Use the [Set-CIPolicyIDInfo](/powershell/module/configci/set-cipolicyidinfo) cmdlet to give each policy a descriptive name and set a unique ID in order to differentiate each policy when reviewing WDAC events or when viewing the policy XML document. Although you can specify a string value for PolicyId, for policies using the multiple policy format we recommend using the -ResetPolicyId switch to let the system autogenerate a unique ID for the policy. > [!NOTE] -> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-windows-defender-application-control-policies.md) on computers running Windows 10, version 1903 and above. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10. +> PolicyID only applies to policies using the [multiple policy format](deploy-multiple-windows-defender-application-control-policies.md) on computers running Windows 10, version 1903 and above, or Windows 11. Running -ResetPolicyId on a policy created for pre-1903 computers will convert it to multiple policy format and prevent it from running on those earlier versions of Windows 10. > PolicyID should be set only once per policy and use different PolicyID's for the audit and enforced mode versions of each policy. In addition, we recommend using the [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion) cmdlet to increment the policy's internal version number when you make changes to the policy. The version must be defined as a standard four-part version string (e.g. "1.0.0.0"). diff --git a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md index 8f9b6ac45d..403aab58d8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/select-types-of-rules-to-create.md @@ -1,6 +1,6 @@ --- -title: Understand Windows Defender Application Control (WDAC) policy rules and file rules (Windows 10) -description: Learn how WDAC policy rules and file rules can control your Windows 10 computers. +title: Understand Windows Defender Application Control (WDAC) policy rules and file rules (Windows) +description: Learn how WDAC policy rules and file rules can control your Windows 10 and Windows 11 computers. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: m365-security @@ -22,10 +22,14 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -Windows Defender Application Control (WDAC) can control what runs on Windows 10 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +Windows Defender Application Control (WDAC) can control what runs on Windows 10 and Windows 11 by setting policies that specify whether a driver or application is trusted. A policy includes *policy rules* that control options such as audit mode, and *file rules* (or *file rule levels*) that specify how applications are identified and trusted. ## Windows Defender Application Control policy rules @@ -58,10 +62,10 @@ You can set several rule options within a WDAC policy. Table 1 describes each ru | **5 Enabled:Inherit Default Policy** | This option is reserved for future use and currently has no effect. | Yes | | **6 Enabled:Unsigned System Integrity Policy (Default)** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and the certificates that are trusted for future policy updates must be identified in the UpdatePolicySigners section. | Yes | | **7 Allowed:Debug Policy Augmented** | This option is not currently supported. | Yes | -| **8 Required:EV Signers** | This rule requires that drivers must be WHQL signed and have been submitted by a partner with an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | No | +| **8 Required:EV Signers** | This rule requires that drivers must be WHQL signed and have been submitted by a partner with an Extended Verification (EV) certificate. All Windows 10 and Windows 11 drivers will meet this requirement. | No | | **9 Enabled:Advanced Boot Options Menu** | The F8 preboot menu is disabled by default for all WDAC policies. Setting this rule option allows the F8 menu to appear to physically present users. | No | | **10 Enabled:Boot Audit on Failure** | Used when the WDAC policy is in enforcement mode. When a driver fails during startup, the WDAC policy will be placed in audit mode so that Windows will load. Administrators can validate the reason for the failure in the CodeIntegrity event log. | No | -| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows 10 without the proper update may have unintended results. | No | +| **11 Disabled:Script Enforcement** | This option disables script enforcement options. Unsigned PowerShell scripts and interactive PowerShell are no longer restricted to [Constrained Language Mode](/powershell/module/microsoft.powershell.core/about/about_language_modes). NOTE: This option is required to run HTA files, and is supported on 1709, 1803, and 1809 builds with the 2019 10C LCU or higher, and on devices with the Windows 10 May 2019 Update (1903) and higher. Using it on versions of Windows without the proper update may have unintended results. | No | | **12 Required:Enforce Store Applications** | If this rule option is enabled, WDAC policies will also apply to Universal Windows applications. | No | | **13 Enabled:Managed Installer** | Use this option to automatically allow applications installed by a managed installer. For more information, see [Authorize apps deployed with a WDAC managed installer](configure-authorized-apps-deployed-with-a-managed-installer.md) | Yes | | **14 Enabled:Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | Yes | diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md index 936314d342..fcdf006d68 100644 --- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md @@ -1,5 +1,5 @@ --- -title: Policy creation for common WDAC usage scenarios (Windows 10) +title: Policy creation for common WDAC usage scenarios (Windows) description: Develop a plan for deploying Windows Defender Application Control (WDAC) in your organization based on these common scenarios. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,10 +22,14 @@ ms.technology: mde **Applies to** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It is very common for organizations to have device use cases across each of the categories described. +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It is common for organizations to have device use cases across each of the categories described. ## Types of devices @@ -34,7 +38,7 @@ Typically, deployment of Windows Defender Application Control (WDAC) happens bes | **Lightly managed devices**: Company-owned, but users are free to install software.
      Devices are required to run organization's antivirus solution and client management tools. | WDAC can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | | **Fully managed devices**: Allowed software is restricted by IT department.
      Users can request additional software, or install from a list of applications provided by IT department.
      Examples: locked-down, company-owned desktops and laptops. | An initial baseline WDAC policy can be established and enforced. Whenever the IT department approves additional applications, it will update the WDAC policy and (for unsigned LOB applications) the catalog.
      WDAC policies are supported by the HVCI service. | | **Fixed-workload devices**: Perform same tasks every day.
      Lists of approved applications rarely change.
      Examples: kiosks, point-of-sale systems, call center computers. | WDAC can be deployed fully, and deployment and ongoing administration are relatively straightforward.
      After WDAC deployment, only approved applications can run. This is because of protections offered by WDAC. | -| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a block-list only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. | +| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a blocklist only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. | ## An introduction to Lamna Healthcare Company @@ -42,7 +46,7 @@ In the next set of topics, we will explore each of the above scenarios using a f Lamna Healthcare Company (Lamna) is a large healthcare provider operating in the United States. Lamna employs thousands of people, from doctors and nurses to accountants, in-house lawyers, and IT technicians. Their device use cases are varied and include single-user workstations for their professional staff, shared kiosks used by doctors and nurses to access patient records, dedicated medical devices such as MRI scanners, and many others. Additionally, Lamna has a relaxed, bring-your-own-device policy for many of their professional staff. -Lamna uses [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) (MEM) in hybrid mode with both Configuration Manager (MEMCM) and Intune. Although they use MEM to deploy many applications, Lamna has always had very relaxed application usage practices: individual teams and employees have been able to install and use any applications they deem necessary for their role on their own workstations. Lamna also recently started to use [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) for better endpoint detection and response. +Lamna uses [Microsoft Endpoint Manager](https://www.microsoft.com/microsoft-365/microsoft-endpoint-manager) (MEM) in hybrid mode with both Configuration Manager (MEMCM) and Intune. Although they use MEM to deploy many applications, Lamna has always had relaxed application usage practices: individual teams and employees have been able to install and use any applications they deem necessary for their role on their own workstations. Lamna also recently started to use [Microsoft Defender for Endpoint](https://www.microsoft.com/microsoft-365/windows/microsoft-defender-atp) for better endpoint detection and response. > [!NOTE] > Microsoft Endpoint Configuration Manager was previously known as System Center Configuration Manager. From 22daabf0d95e0a137832afd6849dcdc9b4a275b4 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 15:59:29 +0530 Subject: [PATCH 0085/1214] TASK 5358645 : Batch 02, Windows 11 Inclusion updates Second batch of Windows 11 Inclusion updates under Windows-defender-application-control folder. (I've also made some changes to few words as per Acrolinx suggestions to meet the PR criteria). --- ...aged-apps-to-existing-applocker-rule-set.md | 11 ++++++++--- .../applocker/administer-applocker.md | 11 ++++++++--- .../applocker-architecture-and-components.md | 11 ++++++++--- .../applocker/applocker-functions.md | 11 ++++++++--- .../applocker/applocker-overview.md | 13 +++++++++---- .../applocker-policies-deployment-guide.md | 11 ++++++++--- .../applocker-policies-design-guide.md | 11 ++++++++--- .../applocker-policy-use-scenarios.md | 13 +++++++++---- .../applocker-processes-and-interactions.md | 11 ++++++++--- .../types-of-devices.md | 10 +++++++--- ...lication-control-policy-design-decisions.md | 16 ++++++++++------ ...control-for-classic-windows-applications.md | 18 +++++++++++------- ...g-portal-in-microsoft-store-for-business.md | 13 ++++++++----- ...er-application-control-against-tampering.md | 13 ++++++++----- ...ol-specific-plug-ins-add-ins-and-modules.md | 10 +++++++--- ...-control-with-intelligent-security-graph.md | 10 +++++++--- .../wdac-and-applocker-overview.md | 16 ++++++++++------ .../wdac-wizard-create-base-policy.md | 13 +++++++++---- .../wdac-wizard-create-supplemental-policy.md | 13 +++++++++---- .../wdac-wizard-editing-policy.md | 9 +++++++-- .../wdac-wizard.md | 12 ++++++++---- ...der-application-control-deployment-guide.md | 6 +++++- ...efender-application-control-design-guide.md | 17 +++++++++++------ ...er-application-control-operational-guide.md | 6 +++++- .../windows-defender-application-control.md | 10 +++++++--- 25 files changed, 203 insertions(+), 92 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index aafd72be3d..a44ddf2ec0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -1,5 +1,5 @@ --- -title: Add rules for packaged apps to existing AppLocker rule-set (Windows 10) +title: Add rules for packaged apps to existing AppLocker rule-set (Windows) description: This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). ms.assetid: 758c2a9f-c2a3-418c-83bc-fd335a94097f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Add rules for packaged apps to existing AppLocker rule-set **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md index 105e16241c..de30943c9e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md @@ -1,5 +1,5 @@ --- -title: Administer AppLocker (Windows 10) +title: Administer AppLocker (Windows) description: This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. ms.assetid: 511a3b6a-175f-4d6d-a6e0-c1780c02e818 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Administer AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md index 04a1ea12ad..b0f00626d8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md @@ -1,5 +1,5 @@ --- -title: AppLocker architecture and components (Windows 10) +title: AppLocker architecture and components (Windows) description: This topic for IT professional describes AppLocker’s basic architecture and its major components. ms.assetid: efdd8494-553c-443f-bd5f-c8976535135a ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # AppLocker architecture and components **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for IT professional describes AppLocker’s basic architecture and its major components. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md index d28879a339..b411688c4c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md @@ -1,5 +1,5 @@ --- -title: AppLocker functions (Windows 10) +title: AppLocker functions (Windows) description: This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. ms.assetid: bf704198-9e74-4731-8c5a-ee0512df34d2 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # AppLocker functions **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index 29d54546be..c954daf11e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -1,5 +1,5 @@ --- -title: AppLocker (Windows 10) +title: AppLocker (Windows) description: This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. ms.assetid: 94b57864-2112-43b6-96fb-2863c985dc9a ms.reviewer: @@ -21,10 +21,15 @@ ms.technology: mde # AppLocker **Applies to** -- Windows 10 -- Windows Server -This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. > [!NOTE] > AppLocker is unable to control processes running under the system account on any operating system. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md index 60bc44e368..5835e27fd9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md @@ -1,5 +1,5 @@ --- -title: AppLocker deployment guide (Windows 10) +title: AppLocker deployment guide (Windows) description: This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. ms.assetid: 38632795-be13-46b0-a7af-487a4340bea1 ms.reviewer: @@ -22,8 +22,13 @@ ms.technology: mde # AppLocker deployment guide **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md index 960362fe53..978a28cd60 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md @@ -1,5 +1,5 @@ --- -title: AppLocker design guide (Windows 10) +title: AppLocker design guide (Windows) description: This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. ms.assetid: 1c8e4a7b-3164-4eb4-9277-11b1d5a09c7b ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # AppLocker design guide **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md index 897753b906..7f97ef0d96 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md @@ -1,5 +1,5 @@ --- -title: AppLocker policy use scenarios (Windows 10) +title: AppLocker policy use scenarios (Windows) description: This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. ms.assetid: 33f71578-89f0-4063-ac04-cf4f4ca5c31f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # AppLocker policy use scenarios **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. @@ -34,7 +39,7 @@ AppLocker can help you improve the management of application control and the mai 2. **Protection against unwanted software** - AppLocker has the ability to deny apps from running simply by excluding them from the list of allowed apps per business group or user. If an app is not specifically identified by its publisher, installation path, or file hash, the attempt to run the application fails. + AppLocker has the ability to deny apps from running simply by excluding them from the list of allowed apps per business group or user. If an app is not identified by its publisher, installation path, or file hash, the attempt to run the application fails. 3. **Licensing conformance** diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md index 0ffdf6a6e0..747b1b68e9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md @@ -1,5 +1,5 @@ --- -title: AppLocker processes and interactions (Windows 10) +title: AppLocker processes and interactions (Windows) description: This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. ms.assetid: 0beec616-6040-4be7-8703-b6c919755d8e ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # AppLocker processes and interactions **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md index 936314d342..cfc4e34f36 100644 --- a/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/types-of-devices.md @@ -1,5 +1,5 @@ --- -title: Policy creation for common WDAC usage scenarios (Windows 10) +title: Policy creation for common WDAC usage scenarios (Windows) description: Develop a plan for deploying Windows Defender Application Control (WDAC) in your organization based on these common scenarios. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,9 +23,13 @@ ms.technology: mde **Applies to** - Windows 10 +- Windows 11 - Windows Server 2016 and above -Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It is very common for organizations to have device use cases across each of the categories described. +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +Typically, deployment of Windows Defender Application Control (WDAC) happens best in phases, rather than being a feature that you simply “turn on.” The choice and sequence of phases depends on the way various computers and other devices are used in your organization, and to what degree IT manages those devices. The following table can help you begin to develop a plan for deploying WDAC in your organization. It is common for organizations to have device use cases across each of the categories described. ## Types of devices @@ -34,7 +38,7 @@ Typically, deployment of Windows Defender Application Control (WDAC) happens bes | **Lightly managed devices**: Company-owned, but users are free to install software.
      Devices are required to run organization's antivirus solution and client management tools. | WDAC can be used to help protect the kernel, and to monitor (audit) for problem applications rather than limiting the applications that can be run. | | **Fully managed devices**: Allowed software is restricted by IT department.
      Users can request additional software, or install from a list of applications provided by IT department.
      Examples: locked-down, company-owned desktops and laptops. | An initial baseline WDAC policy can be established and enforced. Whenever the IT department approves additional applications, it will update the WDAC policy and (for unsigned LOB applications) the catalog.
      WDAC policies are supported by the HVCI service. | | **Fixed-workload devices**: Perform same tasks every day.
      Lists of approved applications rarely change.
      Examples: kiosks, point-of-sale systems, call center computers. | WDAC can be deployed fully, and deployment and ongoing administration are relatively straightforward.
      After WDAC deployment, only approved applications can run. This is because of protections offered by WDAC. | -| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a block-list only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. | +| **Bring Your Own Device**: Employees are allowed to bring their own devices, and also use those devices away from work. | In most cases, WDAC does not apply. Instead, you can explore other hardening and security features with MDM-based conditional access solutions, such as Microsoft Intune. However, you may choose to deploy an audit-mode policy to these devices or employ a blocklist only policy to prevent specific apps or binaries that are considered malicious or vulnerable by your organization. | ## An introduction to Lamna Healthcare Company diff --git a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md index 7640970646..ce15020a22 100644 --- a/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/understand-windows-defender-application-control-policy-design-decisions.md @@ -1,5 +1,5 @@ --- -title: Understand Windows Defender Application Control policy design decisions (Windows 10) +title: Understand Windows Defender Application Control policy design decisions (Windows) description: Understand Windows Defender Application Control policy design decisions. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic is for the IT professional and lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using Windows Defender Application Control (WDAC) within a Windows operating system environment. @@ -70,7 +74,7 @@ Traditional Win32 apps on Windows can run without being digitally signed. This p | Possible answers | Design considerations | | - | - | | All apps used in your organization must be signed. | Organizations that enforce [codesigning](use-code-signing-to-simplify-application-control-for-classic-windows-applications.md) for all executable code are best-positioned to protect their Windows computers from malicious code execution. WDAC rules can be created to authorize apps and binaries from the organization's internal development teams and from trusted independent software vendors (ISV). | -| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows 10 tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific App Catalog signatures to existing apps as a part of the app deployment process, which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed App Catalogs. | +| Apps used in your organization do not need to meet any codesigning requirements. | Organizations can [use built-in Windows tools](deploy-catalog-files-to-support-windows-defender-application-control.md) to add organization-specific App Catalog signatures to existing apps as a part of the app deployment process, which can be used to authorize code execution. Solutions like Microsoft Endpoint Manager offer multiple ways to distribute signed App Catalogs. | ### Are there specific groups in your organization that need customized application control policies? @@ -79,7 +83,7 @@ Most business teams or departments have specific security requirements that pert | Possible answers | Design considerations | | - | - | | Yes | WDAC policies can be created unique per team, or team-specific supplemental policies can be used to expand what is allowed by a common, centrally defined base policy.| -| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.| +| No | WDAC policies can be applied globally to applications that are installed on PCs running Windows 10 and Windows 11. Depending on the number of apps you need to control, managing all the rules and exceptions might be challenging.| ### Does your IT department have resources to analyze application usage, and to design and manage the policies? @@ -88,7 +92,7 @@ The time and resources that are available to you to perform the research and ana | Possible answers | Design considerations | | - | - | | Yes | Invest the time to analyze your organization's application control requirements, and plan a complete deployment that uses rules that are constructed as simply as possible.| -| No | Consider a focused and phased deployment for specific groups by using a small number of rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. | +| No | Consider a focused and phased deployment for specific groups by using few rules. As you apply controls to applications in a specific group, learn from that deployment to plan your next deployment. Alternatively, you can create a policy with a broad trust profile to authorize as many apps as possible. | ### Does your organization have Help Desk support? diff --git a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md index 8e289e4bf3..dae8561c9b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-code-signing-to-simplify-application-control-for-classic-windows-applications.md @@ -1,5 +1,5 @@ --- -title: Use code signing to simplify application control for classic Windows applications (Windows 10) +title: Use code signing to simplify application control for classic Windows applications (Windows) description: With embedded signing, your WDAC policies typically do not have to be updated when an app is updated. To set this up, you can choose from a variety of methods. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,12 +22,16 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). This topic covers guidelines for using code signing control classic Windows apps. -## Reviewing your applications: application signing and catalog files +## Reviewing your applications: application signing and catalog files Typically, WDAC policies are configured to use the application's signing certificate as part or all of what identifies the application as trusted. This means that applications must either use embedded signing—where the signature is part of the binary—or catalog signing, where you generate a "catalog file" from the applications, sign it, and through the signed catalog file, configure the WDAC policy to recognize the applications as signed. @@ -49,20 +53,20 @@ To use catalog signing, you can choose from the following options: ### Catalog files -Catalog files (which you can create in Windows 10 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application. +Catalog files (which you can create in Windows 10 and Windows 11 with a tool called Package Inspector) contain information about all deployed and executed binary files associated with your trusted but unsigned applications. When you create catalog files, you can also include signed applications for which you do not want to trust the signer but rather the specific application. After creating a catalog, you must sign the catalog file itself by using enterprise public key infrastructure (PKI), or a purchased code signing certificate. Then you can distribute the catalog, so that your trusted applications can be handled by WDAC in the same way as any other signed application. Catalog files are simply Secure Hash Algorithm 2 (SHA2) hash lists of discovered binaries. These binaries' hash values are updated each time an application is updated, which requires the catalog file to be updated also. After you have created and signed your catalog files, you can configure your WDAC policies to trust the signer or signing certificate of those files. > [!NOTE] -> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 Enterprise, Windows 10 Education, Windows 2016 Server, or Windows Enterprise IoT. +> Package Inspector only works on operating systems that support Windows Defender, such as Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, Windows 2016 Server, or Windows Enterprise IoT. For procedures for working with catalog files, see [Deploy catalog files to support Windows Defender Application Control](deploy-catalog-files-to-support-windows-defender-application-control.md). ## Windows Defender Application Control policy formats and signing -When you generate a WDAC policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 Enterprise, along with restrictions on Windows 10 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file. +When you generate a WDAC policy, you are generating a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10 and Windows 11 Enterprise, along with restrictions on Windows 10 and Windows 11 script hosts. You can view your original XML document in a text editor, for example if you want to check the rule options that are present in the **<Rules>** section of the file. We recommend that you keep the original XML file for use when you need to merge the WDAC policy with another policy or update its rule options. For deployment purposes, the file is converted to a binary format, which can be done using a simple Windows PowerShell command. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md index a34f45e591..73f07b3405 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-device-guard-signing-portal-in-microsoft-store-for-business.md @@ -1,5 +1,5 @@ --- -title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows 10) +title: Use the Device Guard Signing Portal in the Microsoft Store for Business (Windows) description: You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,11 +22,14 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2019 -- Windows Server 2016 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed. +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +You can sign code integrity policies with the Device Guard signing portal to prevent them from being tampered with after they're deployed. ## Sign your code integrity policy Before you get started, be sure to review these best practices: diff --git a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md index 498c736696..11d3f0df1e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-signed-policies-to-protect-windows-defender-application-control-against-tampering.md @@ -1,6 +1,6 @@ --- -title: Use signed policies to protect Windows Defender Application Control against tampering (Windows 10) -description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. +title: Use signed policies to protect Windows Defender Application Control against tampering (Windows) +description: Signed WDAC policies give organizations the highest level of malware protection available in Windows 10 and Windows 11. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: m365-security @@ -22,11 +22,14 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -Signed WDAC policies give organizations the highest level of malware protection available in Windows 10. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed WDAC policies. Note that SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies. +Signed WDAC policies give organizations the highest level of malware protection available in Windows. In addition to their enforced policy rules, signed policies cannot be modified or deleted by a user or administrator on the computer. These policies are designed to prevent administrative tampering and kernel mode exploit access. With this in mind, it is much more difficult to remove signed WDAC policies. Note that SecureBoot must be enabled in order to restrict users from updating or removing signed WDAC policies. Before you sign and deploy a signed WDAC policy, we recommend that you [audit the policy](audit-windows-defender-application-control-policies.md) to discover any blocked applications that should be allowed to run. diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md index 9ffbd067e1..22a1c3c03a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-policy-to-control-specific-plug-ins-add-ins-and-modules.md @@ -1,5 +1,5 @@ --- -title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows 10) +title: Use a Windows Defender Application Control policy to control specific plug-ins, add-ins, and modules (Windows) description: WDAC policies can be used not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). As of Windows 10, version 1703, you can use WDAC policies not only to control applications, but also to control whether specific plug-ins, add-ins, and modules can run from specific apps (such as a line-of-business application or a browser): diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md index d9b739c0ae..22c3b5e232 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-intelligent-security-graph.md @@ -1,5 +1,5 @@ --- -title: Authorize reputable apps with the Intelligent Security Graph (ISG) (Windows 10) +title: Authorize reputable apps with the Intelligent Security Graph (ISG) (Windows) description: Automatically authorize applications that Microsoft’s ISG recognizes as having known good reputation. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -22,8 +22,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). Application control can be difficult to implement in organizations that don't deploy and manage applications through an IT-managed system. In such environments, users can acquire the applications they want to use for work, making it hard to build an effective application control policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md index ce2acde0e8..e8557445d0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-and-applocker-overview.md @@ -23,14 +23,18 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -Windows 10 includes two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +Windows 10 and Windows 11 include two technologies that can be used for application control, depending on your organization's specific scenarios and requirements: Windows Defender Application Control (WDAC) and AppLocker. ## Windows Defender Application Control -WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows 10 clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). +WDAC was introduced with Windows 10 and allows organizations to control which drivers and applications are allowed to run on their Windows clients. It was designed as a security feature under the [servicing criteria](https://www.microsoft.com/msrc/windows-security-servicing-criteria), defined by the Microsoft Security Response Center (MSRC). WDAC policies apply to the managed computer as a whole and affects all users of the device. WDAC rules can be defined based on: @@ -45,9 +49,9 @@ Note that prior to Windows 10 version 1709, Windows Defender Application Control ### WDAC System Requirements -WDAC policies can be created on any client edition of Windows 10 build 1903+, or on Windows Server 2016 and above. +WDAC policies can be created on any client edition of Windows 10 build 1903+, or Windows 11, or on Windows Server 2016 and above. -WDAC policies can be applied to devices running any edition of Windows 10, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 Enterprise edition, or Windows Server 2016 and above, but cannot deploy policies to devices running non-Enterprise SKUs of Windows 10. +WDAC policies can be applied to devices running any edition of Windows 10, Windows 11, or Windows Server 2016 and above, via a Mobile Device Management (MDM) solution, for example, Intune; a management interface such as Configuration Manager; or a script host such as PowerShell. Group Policy can also be used to deploy WDAC policies to Windows 10 and Windows 11 Enterprise edition, or Windows Server 2016 and above, but cannot deploy policies to devices running non-Enterprise SKUs of Windows 10. For more information on which individual WDAC features are available on specific WDAC builds, see [WDAC feature availability](feature-availability.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 2c5382e43b..0370e86093 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -22,8 +22,13 @@ ms.technology: mde # Creating a new Base Policy with the Wizard **Applies to** -- Windows 10 -- Windows Server 2016 and above + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). When creating policies for use with Windows Defender Application Control (WDAC), it is recommended to start with a template policy and then add or remove rules to suit your application control scenario. For this reason, the WDAC Wizard offers three template policies to start from and customize during the base policy creation workflow. Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a new application control policy from a template, configure the policy options, and the signer and file rules. @@ -63,7 +68,7 @@ A description of each policy rule, beginning with the left-most column, is provi |**[Hypervisor-protected code integrity (HVCI)](../device-guard/enable-virtualization-based-protection-of-code-integrity.md)**| When enabled, policy enforcement uses virtualization-based security to run the code integrity service inside a secure environment. HVCI provides stronger protections against kernel malware.| | **Intelligent Security Graph Authorization** | Use this option to automatically allow applications with "known good" reputation as defined by Microsoft’s Intelligent Security Graph (ISG). | | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | -| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows 10–compatible driver must be WHQL certified. | +| **Require WHQL** | By default, legacy drivers that are not Windows Hardware Quality Labs (WHQL) signed are allowed to execute. Enabling this rule requires that every executed driver is WHQL signed and removes legacy driver support. Going forward, every new Windows–compatible driver must be WHQL certified. | | **Update Policy without Rebooting** | Use this option to allow future WDAC policy updates to apply without requiring a system reboot. | | **Unsigned System Integrity Policy** | Allows the policy to remain unsigned. When this option is removed, the policy must be signed and have UpdatePolicySigners added to the policy to enable future policy modifications. | | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | @@ -82,7 +87,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | | **Dynamic Code Security** | Enables policy enforcement for .NET applications and dynamically loaded libraries (DLLs). | | **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| -| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | +| **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later, or Windows 11 drivers will meet this requirement. | ![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index bca81708e6..ba4f9bd85e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -22,12 +22,17 @@ ms.technology: mde # Creating a new Supplemental Policy with the Wizard **Applies to** -- Windows 10 -- Windows Server 2016 and above -Beginning in Windows 10 version 1903, WDAC supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When using supplemental policies, applications allowed by the base or its supplemental policy/policies will be allowed to execute. +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +Beginning in Windows 10 version 1903, WDAC supports the creation of multiple active policies on a device. One or more supplemental policies allow customers to expand a [WDAC base policy](wdac-wizard-create-base-policy.md) to increase the circle of trust of the policy. A supplemental policy can expand only one base policy, but multiple supplementals can expand the same base policy. When using supplemental policies, applications allowed by the base or its supplemental policy/policies will be allowed to execute. + +Prerequisite information about application control can be accessed through the [WDAC design guide](windows-defender-application-control-design-guide.md). This page outlines the steps to create a supplemental application control policy, configure the policy options, and the signer and file rules. ## Expanding a Base Policy diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index 2b94c7f004..18e27bfb31 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -22,8 +22,13 @@ ms.technology: mde # Editing existing base and supplemental WDAC policies with the Wizard **Applies to** -- Windows 10 -- Windows Server 2016 and above + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShell cmdlets or manually. The Wizard currently supports the following editing capabilities:
        diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md index e1581cb011..4cdeb72f21 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard.md @@ -23,14 +23,18 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above -The Windows Defender Application Control (WDAC) policy Wizard is an open source Windows desktop application written in C# and bundled as an MSIX package. The Wizard was built to provide security architects, security and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + +The Windows Defender Application Control (WDAC) policy Wizard is an open-source Windows desktop application written in C# and bundled as an MSIX package. The Wizard was built to provide security architects with security, and system administrators with a more user-friendly means to create, edit, and merge WDAC policies. The Wizard desktop application uses the [ConfigCI PowerShell Cmdlets](/powershell/module/configci) in the backend so the output policy of the Wizard and PowerShell cmdlets is identical. ## Downloading the application -The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). +The WDAC Wizard can be downloaded from the official [Wizard installer website](https://bit.ly/3koHwYs) as an MSIX packaged application. The Wizard's source code is available as part of Microsoft's Open Source Software offerings on GitHub at the [WDAC Wizard Repo](https://github.com/MicrosoftDocs/WDAC-Toolkit). **Supported Clients** diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md index ab280eb0bc..40512b4dda 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide.md @@ -1,5 +1,5 @@ --- -title: Deploying Windows Defender Application Control (WDAC) policies (Windows 10) +title: Deploying Windows Defender Application Control (WDAC) policies (Windows) description: Learn how to plan and implement a WDAC deployment. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,8 +23,12 @@ ms.technology: mde **Applies to** - Windows 10 +- Windows 11 - Windows Server 2016 and above +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + You should now have one or more WDAC policies ready to deploy. If you haven't yet completed the steps described in the [WDAC Design Guide](windows-defender-application-control-design-guide.md), do so now before proceeding. ## Plan your deployment diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md index 0f0e3e388f..57db67bee8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-design-guide.md @@ -1,6 +1,6 @@ --- -title: Windows Defender Application Control design guide (Windows 10) -description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows 10 devices. +title: Windows Defender Application Control design guide (Windows) +description: Microsoft Windows Defender Application Control allows organizations to control what apps and drivers will run on their managed Windows devices. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: m365-security @@ -22,19 +22,24 @@ ms.technology: mde # Windows Defender Application Control design guide **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 - Windows Server 2016 and above +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + This guide covers design and planning for Windows Defender Application Control (WDAC). It is intended to help security architects, security administrators, and system administrators create a plan that addresses specific application control requirements for different departments or business groups within an organization. ## Plan for success -A common refrain you may hear about application control is that it is "too hard". While it is true that application control is not as simple as flipping a switch, organizations can be very successful if they take a methodical approach and carefully plan their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning: +A common refrain you may hear about application control is that it is "too hard". While it is true that application control is not as simple as flipping a switch, organizations can be successful if they take a methodical approach and carefully plan their approach. In reality, the issues that lead to failure with application control often arise from business issues rather than technology challenges. Organizations that have successfully deployed application control have ensured the following before starting their planning: - Executive sponsorship and organizational buy-in is in place. - There is a clear **business** objective for using application control and it is not being planned as a purely technical problem from IT. - The organization has a plan to handle potential helpdesk support requests for users who are blocked from running some apps. -- The organization has considered where application control can be most useful (e.g. securing sensitive workloads or business functions) and also where it may be difficult to achieve (e.g. developer workstations). +- The organization has considered where application control can be most useful (for example, securing sensitive workloads or business functions) and also where it may be difficult to achieve (for example, developer workstations). Once these business factors are in place, you are ready to begin planning your WDAC deployment. The following topics can help guide you through your planning process. @@ -46,6 +51,6 @@ Once these business factors are in place, you are ready to begin planning your W | [Understand WDAC policy design decisions](understand-windows-defender-application-control-policy-design-decisions.md) | This topic lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies. | | [Understand WDAC policy rules and file rules](select-types-of-rules-to-create.md) | This topic lists resources you can use when selecting your application control policy rules by using WDAC. | | [Policy creation for common WDAC usage scenarios](types-of-devices.md) | This set of topics outlines common use case scenarios and helps you begin to develop a plan for deploying WDAC in your organization. | -| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit and merge WDAC policies. | +| [Policy creation using the WDAC Wizard tool](wdac-wizard.md) | This set of topics describes how to use the WDAC Wizard desktop app to easily create, edit, and merge WDAC policies. | After planning is complete, the next step is to deploy WDAC. The [Windows Defender Application Control Deployment Guide](windows-defender-application-control-deployment-guide.md) covers the creation and testing of policies, deploying the enforcement setting, and managing and maintaining the policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md index 8a7fec062e..31c5d1fe8e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-operational-guide.md @@ -1,5 +1,5 @@ --- -title: Managing and troubleshooting Windows Defender Application Control policies (Windows 10) +title: Managing and troubleshooting Windows Defender Application Control policies (Windows) description: Gather information about how your deployed Windows Defender Application Control policies are behaving. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -23,8 +23,12 @@ ms.technology: mde **Applies to** - Windows 10 +- Windows 11 - Windows Server 2016 and above +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). + After designing and deploying your Windows Defender Application Control (WDAC) policies, this guide covers understanding the effects your policies are having and troubleshooting when they are not behaving as expected. It contains information on where to find events and what they mean, and also querying these events with Microsoft Defender for Endpoint Advanced Hunting feature. ## WDAC Events Overview diff --git a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md index bbf2800ac4..abe51d1188 100644 --- a/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control.md @@ -23,8 +23,12 @@ ms.technology: mde **Applies to:** -- Windows 10 -- Windows Server 2016 and above +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +> [!NOTE] +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). With thousands of new malicious files created every day, using traditional methods like antivirus solutions—signature-based detection to fight against malware—provides an inadequate defense against new attacks. @@ -37,7 +41,7 @@ Application control is a crucial line of defense for protecting enterprises give > [!NOTE] > Although application control can significantly harden your computers against malicious code, we recommend that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. -Windows 10 includes two technologies that can be used for application control depending on your organization's specific scenarios and requirements: +Windows 10 and Windows 11 include two technologies that can be used for application control depending on your organization's specific scenarios and requirements: - **Windows Defender Application Control**; and - **AppLocker** From 88b13a7afee79bd6e6814e8c4833d7cb95410c18 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 16:11:18 +0530 Subject: [PATCH 0086/1214] Fixing the links --- ...dd-rules-for-packaged-apps-to-existing-applocker-rule-set.md | 2 +- .../applocker/administer-applocker.md | 2 +- .../applocker/applocker-architecture-and-components.md | 2 +- .../applocker/applocker-functions.md | 2 +- .../applocker/applocker-overview.md | 2 +- .../applocker/applocker-policies-deployment-guide.md | 2 +- .../applocker/applocker-policies-design-guide.md | 2 +- .../applocker/applocker-policy-use-scenarios.md | 2 +- .../applocker/applocker-processes-and-interactions.md | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md index a44ddf2ec0..9036f3e4c1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/add-rules-for-packaged-apps-to-existing-applocker-rule-set.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes how to update your existing AppLocker policies for packaged apps using the Remote Server Administration Toolkit (RSAT). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md index de30943c9e..7f2698f4c6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/administer-applocker.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals provides links to specific procedures to use when administering AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md index b0f00626d8..44cb55c39e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-architecture-and-components.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professional describes AppLocker’s basic architecture and its major components. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md index b411688c4c..c6b0e3ecf4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-functions.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This article for the IT professional lists the functions and security levels for the Software Restriction Policies (SRP) and AppLocker features. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md index c954daf11e..93a162dc9a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic provides a description of AppLocker and can help you decide if your organization can benefit from deploying AppLocker application control policies. AppLocker helps you control which apps and files users can run. These include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md index 5835e27fd9..86a8829b86 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-deployment-guide.md @@ -28,7 +28,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals introduces the concepts and describes the steps required to deploy AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md index 978a28cd60..a7d286ac77 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policies-design-guide.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional introduces the design and planning steps required to deploy application control policies by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md index 7f97ef0d96..9afaf76dd4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-policy-use-scenarios.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional lists the various application control scenarios in which AppLocker policies can be effectively implemented. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md index 747b1b68e9..72c593b20b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-processes-and-interactions.md @@ -27,7 +27,7 @@ ms.technology: mde - Windows Server 2016 and above > [!NOTE] -> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +> Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes the process dependencies and interactions when AppLocker evaluates and enforces rules. From b1dfa8c50e4e3eba877e538a1eaad0c693459233 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 16:33:05 +0530 Subject: [PATCH 0087/1214] Suggestion fixes --- .../LOB-win32-apps-on-s.md | 10 +++++----- ...uthorized-apps-deployed-with-a-managed-installer.md | 4 ++-- .../configure-wdac-managed-installer.md | 2 +- .../create-wdac-policy-for-fully-managed-devices.md | 2 +- 4 files changed, 9 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index af1e30dca2..ab40f94622 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -47,18 +47,18 @@ The general steps for expanding the S mode base policy on your Intune-managed de Refer to [Deploy multiple Windows Defender Application Control Policies](deploy-multiple-windows-defender-application-control-policies.md) for guidance on creating supplemental policies and [Deploy Windows Defender Application Control policy rules and file rules](select-types-of-rules-to-create.md) to choose the right type of rules to create for your policy. Below are a basic set of instructions for creating an S mode supplemental policy: - - Create a new base policy using [New-CIPolicy](/powershell/module/configci/new-cipolicy?view=win10-ps) + - Create a new base policy using [New-CIPolicy](/powershell/module/configci/new-cipolicy?view=win10-ps&preserve-view=true) ```powershell New-CIPolicy -MultiplePolicyFormat -ScanPath -UserPEs -FilePath "\SupplementalPolicy.xml" -Level Publisher -Fallback Hash ``` - - Change it to a supplemental policy using [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo?view=win10-ps) + - Change it to a supplemental policy using [Set-CIPolicyIdInfo](/powershell/module/configci/set-cipolicyidinfo?view=win10-ps&preserve-view=true) ```powershell Set-CIPolicyIdInfo -SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784 -FilePath "\SupplementalPolicy.xml" ``` Policies which are supplementing the S mode base policy must use **-SupplementsBasePolicyID 5951A96A-E0B5-4D3D-8FB8-3E5B61030784**, as this is the S mode policy ID. - - Put the policy in enforce mode using [Set-RuleOption](/powershell/module/configci/set-ruleoption?view=win10-ps) + - Put the policy in enforce mode using [Set-RuleOption](/powershell/module/configci/set-ruleoption?view=win10-ps&preserve-view=true) ```powershell Set-RuleOption -FilePath "\SupplementalPolicy.xml>" -Option 3 –Delete @@ -69,7 +69,7 @@ The general steps for expanding the S mode base policy on your Intune-managed de ```powershell Add-SignerRule -FilePath -CertificatePath -User -Update ``` - - Convert to .bin using [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy?view=win10-ps) + - Convert to .bin using [ConvertFrom-CIPolicy](/powershell/module/configci/convertfrom-cipolicy?view=win10-ps&preserve-view=true) ```powershell ConvertFrom-CIPolicy -XmlFilePath "\SupplementalPolicy.xml" -BinaryFilePath "\SupplementalPolicy.bin> @@ -86,7 +86,7 @@ The general steps for expanding the S mode base policy on your Intune-managed de Go to the Azure portal online and navigate to the Microsoft Intune page, then go to the Client apps blade and select 'S mode supplemental policies'. Upload the signed policy to Intune and assign it to user or device groups. Intune will generate tenant- and device- specific authorization tokens. Intune then deploys the corresponding authorization token and supplemental policy to each device in the assigned group. Together, these expand the S mode base policy on the device. > [!Note] -> When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps) for information on setting the version number. +> When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps&preserve-view=true) for information on setting the version number. ## Standard Process for Deploying Apps through Intune ![Deploying Apps through Intune](images/wdac-intune-app-deployment.png) diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md index 76eb273ded..70e5a3a31d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-authorized-apps-deployed-with-a-managed-installer.md @@ -1,6 +1,6 @@ --- title: Configure authorized apps deployed with a WDAC-managed installer (Windows) -description: Explains how to configure a custom Manged Installer. +description: Explains about how to configure a custom Manged Installer. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.prod: m365-security @@ -77,7 +77,7 @@ The identity of the managed installer executable(s) is specified in an AppLocker Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, you can use a text editor to make the changes that are needed to an EXE or DLL rule collection policy, to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO. -1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback but other rule types can be used as well. You may need to reformat the output for readability. +1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback but other rule types can be used as well. You may need to reformat the output for readability. ```powershell Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml diff --git a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md index 14ac17e575..a6fe5ce62e 100644 --- a/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md +++ b/windows/security/threat-protection/windows-defender-application-control/configure-wdac-managed-installer.md @@ -44,7 +44,7 @@ The identity of the managed installer executable(s) is specified in an AppLocker Currently, neither the AppLocker policy creation UI in GPO Editor nor the PowerShell cmdlets allow for directly specifying rules for the Managed Installer rule collection. However, a text editor can be used to make the simple changes needed to an EXE or DLL rule collection policy to specify Type="ManagedInstaller", so that the new rule can be imported into a GPO. -1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback, but other rule types can be used as well. You may need to reformat the output for readability. +1. Use [New-AppLockerPolicy](/powershell/module/applocker/new-applockerpolicy?view=win10-ps&preserve-view=true) to make an EXE rule for the file you are designating as a managed installer. Note that only EXE file types can be designated as managed installers. Below is an example using the rule type Publisher with a hash fallback, but other rule types can be used as well. You may need to reformat the output for readability. ```powershell Get-ChildItem | Get-AppLockerFileInformation | New-AppLockerPolicy -RuleType Publisher, Hash -User Everyone -Xml > AppLocker_MI_PS_ISE.xml diff --git a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md index 3870af3447..0037968837 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-wdac-policy-for-fully-managed-devices.md @@ -1,6 +1,6 @@ --- title: Create a WDAC policy for fully managed devices (Windows) -description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in the system core. +description: Windows Defender Application Control restricts which applications users are allowed to run and the code that runs in system core. keywords: security, malware ms.topic: conceptual ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb From c37b11e2a673464f7ff2607d34e2e0dff723d9ba Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Mon, 23 Aug 2021 16:41:03 +0530 Subject: [PATCH 0088/1214] Fixing suggestions --- .../cortana-at-work/cortana-at-work-scenario-5.md | 2 +- windows/configuration/cortana-at-work/test-scenario-4.md | 4 ++-- windows/configuration/cortana-at-work/test-scenario-5.md | 4 ++-- 3 files changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md index 926fcea790..a2cefc5ce3 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-scenario-5.md @@ -1,6 +1,6 @@ --- title: Use Cortana to send email to a co-worker (Windows) -description: A test scenario on how to use Cortana at work to send email to a co-worker. +description: A test scenario about how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library diff --git a/windows/configuration/cortana-at-work/test-scenario-4.md b/windows/configuration/cortana-at-work/test-scenario-4.md index 74ca02298f..6a77d8dcda 100644 --- a/windows/configuration/cortana-at-work/test-scenario-4.md +++ b/windows/configuration/cortana-at-work/test-scenario-4.md @@ -1,5 +1,5 @@ --- -title: Use Cortana at work to find your upcoming meetings (Windows) +title: Use Cortana to find your upcoming meetings at work (Windows) description: A test scenario about how to use Cortana at work to find your upcoming meetings. ms.prod: w10 ms.mktglfcycl: manage @@ -12,7 +12,7 @@ ms.reviewer: manager: dansimp --- -# Test scenario 4 - Use Cortana at work to find your upcoming meetings +# Test scenario 4 - Use Cortana to find your upcoming meetings at work >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. diff --git a/windows/configuration/cortana-at-work/test-scenario-5.md b/windows/configuration/cortana-at-work/test-scenario-5.md index d730763085..3338b84019 100644 --- a/windows/configuration/cortana-at-work/test-scenario-5.md +++ b/windows/configuration/cortana-at-work/test-scenario-5.md @@ -1,5 +1,5 @@ --- -title: Use Cortana to send email to a co-worker (Windows) +title: Use Cortana to send an email to co-worker (Windows) description: A test scenario on how to use Cortana at work to send email to a co-worker. ms.prod: w10 ms.mktglfcycl: manage @@ -12,7 +12,7 @@ ms.reviewer: manager: dansimp --- -# Test scenario 5 - Use Cortana to send email to a co-worker +# Test scenario 5 - Use Cortana to send an email to co-worker >[!Important] >The data created as part of these scenarios will be uploaded to Microsoft’s Cloud to help Cortana learn and help your employees. This is the same info that Cortana uses in the consumer offering. From 2eebe307971dcd197c8cac3a5f89f79c2d5ccc6f Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 23 Aug 2021 20:11:53 +0530 Subject: [PATCH 0089/1214] updated-per-5358656 Windows Sandbox update for W11 - task 5358656 --- .../windows-sandbox-configure-using-wsb-file.md | 2 +- .../windows-sandbox/windows-sandbox-overview.md | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 6eb53f8e15..553720a2f2 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -16,7 +16,7 @@ ms.technology: mde # Windows Sandbox configuration -Windows Sandbox supports simple configuration files, which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or later. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the `.wsb` file extension. +Windows Sandbox supports simple configuration files, which provide a minimal set of customization parameters for Sandbox. This feature can be used with Windows 10 build 18342 or Windows 11. Windows Sandbox configuration files are formatted as XML and are associated with Sandbox via the `.wsb` file extension. A configuration file enables the user to control the following aspects of Windows Sandbox: diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index 869b04185e..5d3cb0e3e3 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -36,7 +36,7 @@ The following video provides an overview of Windows Sandbox. ## Prerequisites -- Windows 10 Pro, Enterprise or Education build 18305 or later (*Windows Sandbox is currently not supported on Home SKUs*) +- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Home SKUs*) - AMD64 architecture - Virtualization capabilities enabled in BIOS - At least 4 GB of RAM (8 GB recommended) @@ -45,7 +45,7 @@ The following video provides an overview of Windows Sandbox. ## Installation -1. Ensure that your machine is using Windows 10 Pro or Enterprise, build version 18305 or later. +1. Ensure that your machine is using Windows 10 Pro or Enterprise, build version 18305 or Windows 11. 2. Enable virtualization on the machine. From da923c96b7adef6879f44af483fc9862e6712237 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 23 Aug 2021 20:30:35 +0530 Subject: [PATCH 0090/1214] updated-per-5358718 WINDOWS: SmartScreen for W11 --- ...crosoft-defender-smartscreen-available-settings.md | 11 ++++++----- .../microsoft-defender-smartscreen-overview.md | 3 ++- ...soft-defender-smartscreen-set-individual-device.md | 3 ++- 3 files changed, 10 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index f06ae93261..476c4b6291 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -1,5 +1,5 @@ --- -title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows 10) +title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows) description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings. keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: m365-security @@ -18,10 +18,11 @@ ms.technology: mde **Applies to:** - Windows 10 +- Windows 11 Microsoft Defender SmartScreen works with Intune, Group Policy, and mobile device management (MDM) settings to help you manage your organization's computer settings. Based on how you set up Microsoft Defender SmartScreen, you can show employees a warning page and let them continue to the site, or you can block the site entirely. -See [Windows 10 (and later) settings to protect devices using Intune](/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune. +See [Windows 10 (and Windows 11) settings to protect devices using Intune](/intune/endpoint-protection-windows-10#windows-defender-smartscreen-settings) for the controls you can use in Intune. ## Group Policy settings @@ -45,7 +46,7 @@ SmartScreen uses registry-based Administrative Template policy settings.
- + @@ -134,7 +135,7 @@ For Microsoft Defender SmartScreen Edge MDM policies, see [Policy CSP - Browser] - + - + - +
Windows 10, version 2004:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

Windows 10, version 1703:
Administrative Templates\Windows Components\Windows Defender SmartScreen\Microsoft Edge\Configure Windows Defender SmartScreen (Microsoft Edge version 45 and earlier)

Administrative Templates\Microsoft Edge\SmartScreen settings\Configure Microsoft Defender SmartScreen (Microsoft Edge version 77 or later)

Windows 10, Version 1607 and earlier:
Administrative Templates\Windows Components\Microsoft Edge\Configure Windows SmartScreen

Microsoft Edge on Windows 10 or laterMicrosoft Edge on Windows 10 or Windows 11 This policy setting turns on Microsoft Defender SmartScreen.

If you enable this setting, it turns on Microsoft Defender SmartScreen and your employees are unable to turn it off.

If you disable this setting, it turns off Microsoft Defender SmartScreen and your employees are unable to turn it on.

If you don't configure this setting, your employees can decide whether to use Microsoft Defender SmartScreen.

PreventSmartScreenPromptOverrideWindows 10, Version 1511 and laterWindows 10, Version 1511 and Windows 11
  • URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartscreenPromptOverride
  • @@ -146,7 +147,7 @@ For Microsoft Defender SmartScreen Edge MDM policies, see [Policy CSP - Browser]
PreventSmartScreenPromptOverrideForFilesWindows 10, Version 1511 and laterWindows 10, Version 1511 and Windows 11
  • URI full path. ./Vendor/MSFT/Policy/Config/Browser/PreventSmartScreenPromptOverrideForFiles
  • diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index 80486846fb..b08aecf50b 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -1,5 +1,5 @@ --- -title: Microsoft Defender SmartScreen overview (Windows 10) +title: Microsoft Defender SmartScreen overview (Windows) description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: m365-security @@ -20,6 +20,7 @@ ms.technology: mde **Applies to:** - Windows 10 +- Windows 11 - Microsoft Edge Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md index 85c404a314..7d4064e3d3 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md @@ -1,5 +1,5 @@ --- -title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows 10) +title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows) description: Learn how employees can use Windows Security to set up Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects users from running malicious apps. keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: m365-security @@ -19,6 +19,7 @@ ms.technology: mde **Applies to:** - Windows 10, version 1703 +- Windows 11 - Microsoft Edge Microsoft Defender SmartScreen helps to protect users if they try to visit sites previously reported as phishing or malware websites, or if a user tries to download potentially malicious files. From 22e9c02cdec7a228305eece9ceb53c856ac20d23 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Mon, 23 Aug 2021 22:33:33 +0530 Subject: [PATCH 0091/1214] updated-5358710 Kernel DMA++ for W11 - updated topics per task 5358710 --- .../encrypted-hard-drive.md | 3 +- .../kernel-dma-protection-for-thunderbolt.md | 7 ++-- .../secure-the-windows-10-boot-process.md | 39 ++++++++++--------- 3 files changed, 26 insertions(+), 23 deletions(-) diff --git a/windows/security/information-protection/encrypted-hard-drive.md b/windows/security/information-protection/encrypted-hard-drive.md index 1fc11d00d4..94d231d8f3 100644 --- a/windows/security/information-protection/encrypted-hard-drive.md +++ b/windows/security/information-protection/encrypted-hard-drive.md @@ -1,5 +1,5 @@ --- -title: Encrypted Hard Drive (Windows 10) +title: Encrypted Hard Drive (Windows) description: Encrypted Hard Drive uses the rapid encryption that is provided by BitLocker Drive Encryption to enhance data security and management. ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb ms.reviewer: @@ -17,6 +17,7 @@ ms.date: 04/02/2019 **Applies to** - Windows 10 +- Windows 11 - Windows Server 2022 - Windows Server 2019 - Windows Server 2016 diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 31fc1097a4..2a7cc852d6 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -1,5 +1,5 @@ --- -title: Kernel DMA Protection (Windows 10) +title: Kernel DMA Protection (Windows) description: Kernel DMA Protection protects PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to Thunderbolt™ 3 ports. ms.prod: w10 ms.mktglfcycl: deploy @@ -19,6 +19,7 @@ ms.reviewer: **Applies to** - Windows 10 +- Windows 11 In Windows 10 version 1803, Microsoft introduced a new feature called Kernel DMA Protection to protect PCs against drive-by Direct Memory Access (DMA) attacks using PCI hot plug devices connected to externally accessible PCIe ports (e.g., Thunderbolt™ 3 ports and CFexpress). In Windows 10 version 1903, Microsoft expanded the Kernel DMA Protection support to cover internal PCIe ports (e.g., M.2 slots) @@ -92,7 +93,7 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if - Reboot into BIOS settings - Turn on Intel Virtualization Technology. - Turn on Intel Virtualization Technology for I/O (VT-d). In Windows 10 version 1803, only Intel VT-d is supported. Other platforms can use DMA attack mitigations described in [BitLocker countermeasures](bitlocker/bitlocker-countermeasures.md). - - Reboot system into Windows 10. + - Reboot system into Windows. >[!NOTE] > **Hyper-V - Virtualization Enabled in Firmware** is not available when **A hypervisor has been detected. Features required for Hyper-V will not be displayed.** is displayed. This means that **Hyper-V - Virtualization Enabled in Firmware** is set to Yes and the **Hyper-V** Windows feature is enabled. Enabling Hyper-V virtualization in Firmware (IOMMU) is required to enable **Kernel DMA Protection**, even when the firmware has the flag of "ACPI Kernel DMA Protection Indicators" described in [Kernel DMA Protection (Memory Access Protection) for OEMs](/windows-hardware/design/device-experiences/oem-kernel-dma-protection). @@ -121,7 +122,7 @@ Please check the driver instance for the device you are testing. Some drivers ma ### What should I do if the drivers for my PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? -If the peripherals do have class drivers provided by Windows 10, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support [DMA Remapping](/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers). +If the peripherals do have class drivers provided by Windows, please use these drivers on your systems. If there are no class drivers provided by Windows for your peripherals, please contact your peripheral vendor/driver vendor to update the driver to support [DMA Remapping](/windows-hardware/drivers/pci/enabling-dma-remapping-for-device-drivers). ### My system's Kernel DMA Protection is off. Can DMA-remapping for a specific device be turned on? diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 721ae1e1e3..45fc317aa9 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -1,7 +1,7 @@ --- title: Secure the Windows 10 boot process description: This article describes how Windows 10 security features helps protect your PC from malware, including rootkits and other applications -keywords: trusted boot, windows 10 boot proces +keywords: trusted boot, windows 10 boot process ms.prod: w10 ms.mktglfcycl: Explore ms.pagetype: security @@ -22,16 +22,17 @@ ms.author: dansimp **Applies to:** - Windows 10 - Windows 8.1 +- Windows 11 The Windows operating system has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 operating system includes a series of security features that can mitigate the impact. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. -Windows 10 has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. Windows Defender SmartScreen warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. +Windows has multiple levels of protection for desktop apps and data, too. Windows Defender uses signatures to detect and quarantine apps that are known to be malicious. Windows Defender SmartScreen warns users before allowing them to run an untrustworthy app, even if it’s recognized as malware. Before an app can change system settings, the user would have to grant the app administrative privileges by using User Account Control. -Those are just some of the ways that Windows 10 protects you from malware. However, those security features protect you only after Windows 10 starts. Modern malware—and bootkits specifically—are capable of starting before Windows, completely bypassing operating system security, and remaining completely hidden. +Those are just some of the ways that Windows protects you from malware. However, those security features protect you only after Windows starts. Modern malware—and bootkits specifically—are capable of starting before Windows, completely bypassing operating system security, and remaining completely hidden. -When you run Windows 10 on a PC or any PC that supports Unified Extensible Firmware Interface (UEFI), Trusted Boot protects your PC from malware from the moment you power on your PC until your anti-malware starts. In the unlikely event that malware does infect a PC, it can’t remain hidden; Trusted Boot can prove the system’s integrity to your infrastructure in a way that malware can’t disguise. Even on PCs without UEFI, Windows 10 provides even better startup security than previous versions of Windows. +When you run Windows 10 on a PC or any PC that supports Unified Extensible Firmware Interface (UEFI), Trusted Boot protects your PC from malware from the moment you power on your PC until your anti-malware starts. In the unlikely event that malware does infect a PC, it can’t remain hidden; Trusted Boot can prove the system’s integrity to your infrastructure in a way that malware can’t disguise. Even on PCs without UEFI, Windows provides even better startup security than previous versions of Windows. -First, let’s examine what rootkits are and how they work. Then, we’ll show you how Windows 10 can protect you. +First, let’s examine what rootkits are and how they work. Then, we’ll show you how Windows can protect you. ## The threat: rootkits @@ -46,16 +47,16 @@ Different types of rootkits load during different phases of the startup process: - **Driver rootkits.** These kits pretend to be one of the trusted drivers that Windows uses to communicate with the PC hardware. ## The countermeasures -Windows 10 supports four features to help prevent rootkits and bootkits from loading during the startup process: +Windows supports four features to help prevent rootkits and bootkits from loading during the startup process: - **Secure Boot.** PCs with UEFI firmware and a Trusted Platform Module (TPM) can be configured to load only trusted operating system bootloaders. - **Trusted Boot.** Windows checks the integrity of every component of the startup process before loading it. - **Early Launch Anti-Malware (ELAM).** ELAM tests all drivers before they load and prevents unapproved drivers from loading. - **Measured Boot.** The PC’s firmware logs the boot process, and Windows can send it to a trusted server that can objectively assess the PC’s health. -Figure 1 shows the Windows 10 startup process. +Figure 1 shows the Windows startup process. -![Windows 10 startup process](./images/dn168167.boot_process(en-us,MSDN.10).png) +![Windows startup process](./images/dn168167.boot_process(en-us,MSDN.10).png) **Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage** @@ -68,10 +69,10 @@ When a PC starts, it first finds the operating system bootloader. PCs without Se When a PC equipped with UEFI starts, the PC first verifies that the firmware is digitally signed, reducing the risk of firmware rootkits. If Secure Boot is enabled, the firmware examines the bootloader’s digital signature to verify that it hasn’t been modified. If the bootloader is intact, the firmware starts the bootloader only if one of the following conditions is true: -- **The bootloader was signed using a trusted certificate.** In the case of PCs certified for Windows 10, the Microsoft® certificate is trusted. +- **The bootloader was signed using a trusted certificate.** In the case of PCs certified for Windows, the Microsoft® certificate is trusted. - **The user has manually approved the bootloader’s digital signature.** This allows the user to load non-Microsoft operating systems. -All x86-based Certified For Windows 10 PCs must meet several requirements related to Secure Boot: +All x86-based Certified For Windows PCs must meet several requirements related to Secure Boot: - They must have Secure Boot enabled by default. - They must trust Microsoft’s certificate (and thus any bootloader Microsoft has signed). @@ -80,30 +81,30 @@ All x86-based Certified For Windows 10 PCs must meet several requirements relat These requirements help protect you from rootkits while allowing you to run any operating system you want. You have three options for running non-Microsoft operating systems: -- **Use an operating system with a certified bootloader.** Because all Certified For Windows 10 PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows 10 PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to . -- **Configure UEFI to trust your custom bootloader.** All Certified For Windows 10 PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems. -- **Turn off Secure Boot.** All Certified For Windows 10 PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however. +- **Use an operating system with a certified bootloader.** Because all Certified For Windows PCs must trust Microsoft’s certificate, Microsoft offers a service to analyze and sign any non-Microsoft bootloader so that it will be trusted by all Certified For Windows PCs. In fact, an [open source bootloader](http://mjg59.dreamwidth.org/20303.html) capable of loading Linux is already available. To begin the process of obtaining a certificate, go to . +- **Configure UEFI to trust your custom bootloader.** All Certified For Windows PCs allow you to trust a non-certified bootloader by adding a signature to the UEFI database, allowing you to run any operating system, including homemade operating systems. +- **Turn off Secure Boot.** All Certified For Windows PCs allow you to turn off Secure Boot so that you can run any software. This does not help protect you from bootkits, however. To prevent malware from abusing these options, the user must manually configure the UEFI firmware to trust a non-certified bootloader or to turn off Secure Boot. Software cannot change the Secure Boot settings. Like most mobile devices, ARM-based Certified For Windows RT devices, such as the Microsoft Surface RT device, are designed to run only Windows 8.1. Therefore, Secure Boot cannot be turned off, and you cannot load a different operating system. Fortunately, there is a large market of ARM devices designed to run other operating systems. ## Trusted Boot -Trusted Boot takes over where Secure Boot leaves off. The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM. If a file has been modified, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows 10 can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. +Trusted Boot takes over where Secure Boot leaves off. The bootloader verifies the digital signature of the Windows 10 kernel before loading it. The Windows 10 kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM. If a file has been modified, the bootloader detects the problem and refuses to load the corrupted component. Often, Windows can automatically repair the corrupted component, restoring the integrity of Windows and allowing the PC to start normally. ## Early Launch Anti-Malware Because Secure Boot has protected the bootloader and Trusted Boot has protected the Windows kernel, the next opportunity for malware to start is by infecting a non-Microsoft boot driver. Traditional anti-malware apps don’t start until after the boot drivers have been loaded, giving a rootkit disguised as a driver the opportunity to work. Early Launch Anti-Malware (ELAM) can load a Microsoft or non-Microsoft anti-malware driver before all non-Microsoft boot drivers and applications, thus continuing the chain of trust established by Secure Boot and Trusted Boot. Because the operating system hasn’t started yet, and because Windows needs to boot as quickly as possible, ELAM has a simple task: examine every boot driver and determine whether it is on the list of trusted drivers. If it’s not trusted, Windows won’t load it. -An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows 10) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](/lifecycle/products/microsoft-system-center-2012-endpoint-protection) and several non-Microsoft anti-malware apps. +An ELAM driver isn’t a full-featured anti-malware solution; that loads later in the boot process. Windows Defender (included with Windows) supports ELAM, as does [Microsoft System Center 2012 Endpoint Protection](/lifecycle/products/microsoft-system-center-2012-endpoint-protection) and several non-Microsoft anti-malware apps. ## Measured Boot If a PC in your organization does become infected with a rootkit, you need to know about it. Enterprise anti-malware apps can report malware infections to the IT department, but that doesn’t work with rootkits that hide their presence. In other words, you can’t trust the client to tell you whether it’s healthy. As a result, PCs infected with rootkits appear to be healthy, even with anti-malware running. Infected PCs continue to connect to the enterprise network, giving the rootkit access to vast amounts of confidential data and potentially allowing the rootkit to spread across the internal network. -Working with the TPM and non-Microsoft software, Measured Boot in Windows 10 allows a trusted server on the network to verify the integrity of the Windows startup process. Measured Boot uses the following process: +Working with the TPM and non-Microsoft software, Measured Boot in Windows allows a trusted server on the network to verify the integrity of the Windows startup process. Measured Boot uses the following process: 1. The PC’s UEFI firmware stores in the TPM a hash of the firmware, bootloader, boot drivers, and everything that will be loaded before the anti-malware app. 2. At the end of the startup process, Windows starts the non-Microsoft remote attestation client. The trusted attestation server sends the client a unique key. @@ -121,12 +122,12 @@ Figure 2 illustrates the Measured Boot and remote attestation process. **Figure 2. Measured Boot proves the PC’s health to a remote server** -Windows 10 includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For an example of such a tool, download the [TPM Platform Crypto-Provider Toolkit](https://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/) from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin’s [Measured Boot Tool](http://mbt.codeplex.com/). +Windows includes the application programming interfaces to support Measured Boot, but you’ll need non-Microsoft tools to implement a remote attestation client and trusted attestation server to take advantage of it. For an example of such a tool, download the [TPM Platform Crypto-Provider Toolkit](https://research.microsoft.com/en-us/downloads/74c45746-24ad-4cb7-ba4b-0c6df2f92d5d/) from Microsoft Research or Microsoft Enterprise Security MVP Dan Griffin’s [Measured Boot Tool](http://mbt.codeplex.com/). -Measured Boot uses the power of UEFI, TPM, and Windows 10 to give you a way to confidently assess the trustworthiness of a client PC across the network. +Measured Boot uses the power of UEFI, TPM, and Windows to give you a way to confidently assess the trustworthiness of a client PC across the network. ## Summary -Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows 10, these features have the potential to eliminate kernel-level malware from your network. This is the most ground-breaking anti-malware solution that Windows has ever had; it’s leaps and bounds ahead of everything else. With Windows 10, you can truly trust the integrity of your operating system. +Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows, these features have the potential to eliminate kernel-level malware from your network. This is the most ground-breaking anti-malware solution that Windows has ever had; it’s leaps and bounds ahead of everything else. With Windows, you can truly trust the integrity of your operating system. ## Additional resources - [Windows 10 Enterprise LTSC 2019 or v2004 Evaluation](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) \ No newline at end of file From ca964f9f6b753c3b075f9500dcaad4cf349b6a70 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Mon, 23 Aug 2021 10:08:27 -0700 Subject: [PATCH 0092/1214] Update microsoft-recommended-block-rules.md --- .../microsoft-recommended-block-rules.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 64ac22bc1a..655bd9a6df 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -14,7 +14,7 @@ author: jsuther1974 ms.reviewer: isbrahm ms.author: dansimp manager: dansimp -ms.date: 04/09/2019 +ms.date: 08/23/2021 --- # Microsoft recommended block rules @@ -22,7 +22,7 @@ ms.date: 04/09/2019 **Applies to:** - Windows 10 -- Windows Server 2016 and above +- Windows Server 2016 or later Members of the security community* continuously collaborate with Microsoft to help protect customers. With the help of their valuable reports, Microsoft has identified a list of valid applications that an attacker could also potentially use to bypass Windows Defender Application Control. From b7413430cf4da5f59416ef907e948c7669d01d2a Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Mon, 23 Aug 2021 10:17:02 -0700 Subject: [PATCH 0093/1214] Update microsoft-recommended-block-rules.md --- .../microsoft-recommended-block-rules.md | 14 +++++--------- 1 file changed, 5 insertions(+), 9 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index 5a7f65e931..b3fcbfaf59 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -71,9 +71,9 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you 1 A vulnerability in bginfo.exe has been fixed in the latest version 4.22. If you use BGInfo, for security, make sure to download and run the latest version here [BGInfo 4.22](/sysinternals/downloads/bginfo). Note that BGInfo versions earlier than 4.22 are still vulnerable and should be blocked. -2 If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end user device that is not being used in a development context, we recommend that you block msbuild.exe. +2 If you are using your reference system in a development context and use msbuild.exe to build managed applications, we recommend that you allow msbuild.exe in your code integrity policies. However, if your reference system is an end-user device that is not being used in a development context, we recommend that you block msbuild.exe. -* Microsoft recognizes the efforts of those in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people: +* Microsoft recognizes the efforts of people in the security community who help us protect customers through responsible vulnerability disclosure, and extends thanks to the following people:
    @@ -97,13 +97,9 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you > [!Note] > This application list will be updated with the latest vendor information as application vulnerabilities are resolved and new issues are discovered. -Certain software applications may allow additional code to run by design. -These types of applications should be blocked by your Windows Defender Application Control policy. -In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add deny rules to your WDAC policies for that application’s previous, less secure versions. +Certain software applications may allow other code to run by design. Such applications should be blocked by your Windows Defender Application Control policy. In addition, when an application version is upgraded to fix a security vulnerability or potential Windows Defender Application Control bypass, you should add *deny* rules to your application control policies for that application’s previous, less secure versions. -Microsoft recommends that you install the latest security updates. -The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control. -These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes. +Microsoft recommends that you install the latest security updates. The June 2017 Windows updates resolve several issues in PowerShell modules that allowed an attacker to bypass Windows Defender Application Control. These modules cannot be blocked by name or version, and therefore must be blocked by their corresponding hashes. For October 2017, we are announcing an update to system.management.automation.dll in which we are revoking older versions by hash values, instead of version rules. @@ -113,7 +109,7 @@ Microsoft recommends that you block the following Microsoft-signed applications - msxml6.dll - jscript9.dll -Pick the correct version of each .dll for the Windows release you plan to support, and remove the other versions. Ensure that you also uncomment them in the signing scenarios section. +Select the correct version of each .dll for the Windows release you plan to support, and remove the other versions. Ensure that you also uncomment them in the signing scenarios section. ```xml From 1cde0e2127c921e6b1aad9929f352c31f801b9e9 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Mon, 23 Aug 2021 10:18:11 -0700 Subject: [PATCH 0094/1214] Update microsoft-recommended-block-rules.md --- .../microsoft-recommended-block-rules.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index b3fcbfaf59..d223615212 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -79,18 +79,18 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you |Name|Twitter| |---|---| -|Alex Ionescu | @aionescu| -|Brock Mammen| | -|Casey Smith |@subTee| -|Jimmy Bayne | @bohops | -|Lasse Trolle Borup | Langkjaer Cyber Defence | -|Lee Christensen|@tifkin_| -|Matt Graeber | @mattifestation| -|Matt Nelson | @enigma0x3| -|Oddvar Moe |@Oddvarmoe| -|Philip Tsukerman | @PhilipTsukerman | -|Vladas Bulavas | Kaspersky Lab | -|William Easton | @Strawgate | +| Alex Ionescu | @aionescu| +| Brock Mammen| | +| Casey Smith | @subTee| +| Jimmy Bayne | @bohops | +| Lasse Trolle Borup | Langkjaer Cyber Defence | +| Lee Christensen| @tifkin_| +| Matt Graeber | @mattifestation| +| Matt Nelson | @enigma0x3| +| Oddvar Moe | @Oddvarmoe| +| Philip Tsukerman | @PhilipTsukerman | +| Vladas Bulavas | Kaspersky Lab | +| William Easton | @Strawgate |
    From 3bd09d2ae2088f0587efa6c0eb5b7ff35d636d91 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Mon, 23 Aug 2021 10:21:15 -0700 Subject: [PATCH 0095/1214] Update microsoft-recommended-block-rules.md --- .../microsoft-recommended-block-rules.md | 24 +++++++++---------- 1 file changed, 12 insertions(+), 12 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md index d223615212..1bea88acc3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-block-rules.md @@ -79,18 +79,18 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you |Name|Twitter| |---|---| -| Alex Ionescu | @aionescu| -| Brock Mammen| | -| Casey Smith | @subTee| -| Jimmy Bayne | @bohops | -| Lasse Trolle Borup | Langkjaer Cyber Defence | -| Lee Christensen| @tifkin_| -| Matt Graeber | @mattifestation| -| Matt Nelson | @enigma0x3| -| Oddvar Moe | @Oddvarmoe| -| Philip Tsukerman | @PhilipTsukerman | -| Vladas Bulavas | Kaspersky Lab | -| William Easton | @Strawgate | +| `Alex Ionescu` | `@aionescu`| +| `Brock Mammen`| | +| `Casey Smith` | `@subTee` | +| `Jimmy Bayne` | `@bohops` | +| `Lasse Trolle Borup` | `Langkjaer Cyber Defence` | +| `Lee Christensen` | `@tifkin_` | +| `Matt Graeber` | `@mattifestation` | +| `Matt Nelson` | `@enigma0x3` | +| `Oddvar Moe` | `@Oddvarmoe` | +| `Philip Tsukerman` | `@PhilipTsukerman` | +| `Vladas Bulavas` | `Kaspersky Lab` | +| `William Easton` | `@Strawgate` |
    From 3bf0f46973b4a1f5e7484bcaea55d02593210626 Mon Sep 17 00:00:00 2001 From: Jaime Ondrusek Date: Mon, 23 Aug 2021 11:33:42 -0700 Subject: [PATCH 0096/1214] Update update-compliance-monitor.md --- windows/deployment/update/update-compliance-monitor.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/windows/deployment/update/update-compliance-monitor.md b/windows/deployment/update/update-compliance-monitor.md index c3ed45ac22..7d3ea12222 100644 --- a/windows/deployment/update/update-compliance-monitor.md +++ b/windows/deployment/update/update-compliance-monitor.md @@ -18,11 +18,6 @@ ms.custom: seo-marvel-apr2020 # Monitor Windows Updates with Update Compliance -> [!IMPORTANT] -> While [Windows Analytics was retired on January 31, 2020](https://docs.microsoft.com/windows/deployment/update/update-compliance-monitor), support for Update Compliance has continued through the Azure Portal. Two planned feature removals for Update Compliance – Microsoft Defender Antivirus reporting and Perspectives – are now scheduled to be removed beginning Monday, May 11, 2020. -> * The retirement of Microsoft Defender Antivirus reporting will begin Monday, May 11, 2020. You can continue to review malware definition status and manage and monitor malware attacks with Microsoft Endpoint Manager's [Endpoint security node in Microsoft Intune](https://docs.microsoft.com/mem/intune/protect/endpoint-security-antivirus-policy#antivirus-policy-reports). Configuration Manager customers can monitor Endpoint Protection with [Endpoint Protection in Configuration Manager](https://docs.microsoft.com/configmgr/protect/deploy-use/monitor-endpoint-protection). -> * The Perspectives feature of Update Compliance will be retired Monday, May 11, 2020. The Perspectives feature is part of the Log Search portal of Log Analytics, which was deprecated on February 15, 2019 in favor of [Azure Monitor Logs](https://docs.microsoft.com/azure/azure-monitor/log-query/log-search-transition). Your Update Compliance solution will be automatically upgraded to Azure Monitor Logs, and the data available in Perspectives will be migrated to a set of queries in the [Needs Attention section](update-compliance-need-attention.md) of Update Compliance. - ## Introduction Update Compliance enables organizations to: @@ -44,4 +39,4 @@ See the following topics in this guide for detailed information about configurin * [Get started with Update Compliance](update-compliance-get-started.md) * [Use Update Compliance to monitor Windows Updates](update-compliance-using.md) -* [Update Compliance Schema Reference](update-compliance-schema.md) \ No newline at end of file +* [Update Compliance Schema Reference](update-compliance-schema.md) From df9f5b6c8a7d8d9507d3b4f1e47e829e18ee7e74 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Mon, 23 Aug 2021 17:57:14 -0600 Subject: [PATCH 0097/1214] edits to line 732 --- .../demonstrate-deployment-on-vm.md | 111 +++++++++--------- 1 file changed, 56 insertions(+), 55 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 3f1ace4736..0c231195de 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -32,7 +32,7 @@ In this topic, you'll learn how to set up a Windows Autopilot deployment for a V > [!NOTE] > Although there are [multiple platforms](/mem/autopilot/add-devices#registering-devices) available to enable Autopilot, this lab primarily uses Intune. > -> Hyper-V and a VM are not required for this lab. You can also use a physical device. However, the instructions assume that you're using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. +> Hyper-V and a VM are not required for this lab. You can use a physical device instead. However, the instructions assume that you're using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. The following video provides an overview of the process: @@ -54,7 +54,7 @@ These are the things you'll need to complete this lab: ## Procedures -A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendix. +A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendices. If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version. @@ -95,8 +95,8 @@ If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [C ## Verify support for Hyper-V - If you don't already have Hyper-V enabled, enable it on a computer running Windows 10 or Windows Server (2012 R2 or later). -- If you already have Hyper-V enabled, skip to the [create a demo VM](#create-a-demo-vm) step. If you're using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). -- If you're not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [appendix A](#appendix-a-verify-support-for-hyper-v) in this article for details on verifying that Hyper-V can be successfully installed. +- If you already have Hyper-V enabled, skip to the [Create a demo VM](#create-a-demo-vm) step. If you're using a physical device instead of a VM, skip to [Install Windows 10](#install-windows-10). +- If you're not sure that your device supports Hyper-V, or you have problems installing Hyper-V, see [Appendix A](#appendix-a-verify-support-for-hyper-v) in this article for details on verifying that Hyper-V can be successfully installed. ## Enable Hyper-V @@ -106,7 +106,7 @@ To enable Hyper-V, open an elevated Windows PowerShell prompt and run the follow Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Hyper-V -All ``` -This command works on all operating systems that support Hyper-V, but on Windows Server operating systems you must type an additional command (below) to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. The following command will also install Hyper-V if it isn't already installed, so if you're using Windows Server, you can just type the following command instead of using the Enable-WindowsOptionalFeature command: +This command works on all operating systems that support Hyper-V. However, on Windows Server operating systems you must type an additional command (below) to add the Hyper-V Windows PowerShell module and the Hyper-V Manager console. The following command will also install Hyper-V if it isn't already installed. So, if you're using Windows Server, you can just type the following command instead of using the **Enable-WindowsOptionalFeature** command: ```powershell Install-WindowsFeature -Name Hyper-V -IncludeManagementTools @@ -120,7 +120,7 @@ Alternatively, you can install Hyper-V using the Control Panel in Windows under ![Hyper-V](images/svr_mgr2.png) -If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under **Role Administration Tools\Hyper-V Management Tools**. +If you choose to install Hyper-V using Server Manager, accept all default selections. Make sure to install both items under **Role Administration Tools\Hyper-V Management Tools**. After installation is complete, open Hyper-V Manager by typing **virtmgmt.msc** at an elevated command prompt, or by typing **Hyper-V** in the Start menu search box. @@ -158,7 +158,7 @@ After you download this file, the name will be extremely long (ex: 19042.508.200 ### Determine network adapter name -The Get-NetAdaper cmdlet is used to automatically find the network adapter that's most likely to be the one you use to connect to the internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: +The **Get-NetAdaper** cmdlet is used to automatically find the network adapter that's most likely to be the one you use to connect to the internet. You should test this command first by running the following at an elevated Windows PowerShell prompt: ```powershell (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name @@ -166,7 +166,7 @@ The Get-NetAdaper cmdlet is used to automatically find the network adapter that' The output of this command should be the name of the network interface you use to connect to the internet. Verify that this is the correct interface name. If it isn't the correct interface name, you'll need to edit the first command below to use your network interface name. -For example, if the command above displays Ethernet but you wish to use Ethernet2, then the first command below would be New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. +For example, if the command above displays **Ethernet** but you wish to use **Ethernet2**, then the first command below would be **New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName **Ethernet2**. ### Use Windows PowerShell to create the demo VM @@ -174,6 +174,7 @@ All VM data will be created under the current path in your PowerShell prompt. Co > [!IMPORTANT] > **VM switch**: a VM switch is how Hyper-V connects VMs to a network. +> >- If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal." >- If you have never created an external VM switch before, then just run the commands below. >- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). @@ -185,9 +186,9 @@ Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot Start-VM -VMName WindowsAutopilot ``` -After entering these commands, connect to the VM that you just created and wait for a prompt to press a key and boot from the DVD. You can connect to the VM by double-clicking it in Hyper-V Manager. +After you enter these commands, connect to the VM that you just created. Double-click the VM in Hyper-V Manager to connect to it. Then wait for a prompt to press a key and boot from the DVD. -See the sample output below. In this sample, the VM is created under the **c:\autopilot** directory and the vmconnect.exe command is used (which is only available on Windows Server). If you installed Hyper-V on Windows 10, use Hyper-V Manager to connect to your VM. +See the sample output below. In this sample, the VM is created under the **c:\autopilot** directory and the **vmconnect.exe** command is used (which is only available on Windows Server). If you installed Hyper-V on Windows 10, use Hyper-V Manager to connect to your VM.
     PS C:\autopilot> dir c:\iso
    @@ -232,9 +233,9 @@ PS C:\autopilot>
     ### Install Windows 10
     
     > [!NOTE]
    -> The VM will be booted to gather a hardware ID, then it will be reset. The goal in the next few steps is to get to the desktop quickly so don't worry about how it's configured at this stage. The VM only needs to be connected to the Internet.
    +> The VM will be booted to gather a hardware ID. Then it will be reset. The goal in the next few steps is to get to the desktop quickly, so don't worry about how it's configured at this stage. The VM only needs to be connected to the internet.
     
    -Ensure the VM booted from the installation ISO, select **Next** then select **Install now** and complete the Windows installation process. See the following examples:
    +Make sure that the VM booted from the installation ISO, select **Next**, select **Install now**, and then complete the Windows installation process. See the following examples:
     
        ![Windows setup example 1](images/winsetup1.png)
     
    @@ -252,12 +253,12 @@ After the VM restarts, during OOBE, it's fine to select **Set up for personal us
     
        ![Windows setup example 7](images/winsetup7.png)
     
    -Once the installation is complete, sign in and verify that you're at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state.
    +Once the installation is complete, sign in and verify that you're at the Windows 10 desktop. Then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state.
     
        > [!div class="mx-imgBorder"]
        > ![Windows setup example 8](images/winsetup8.png)
     
    -To create a checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following:
    +To create a checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM), and then run the following:
     
     ```powershell
     Checkpoint-VM -Name WindowsAutopilot -SnapshotName "Finished Windows install"
    @@ -326,14 +327,14 @@ Follow these steps to run the PowerShell script:
         PS C:\HWID>
         ```
         
    -1. Verify that there is an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size.  This file contains the complete 4K HH.
    +1. Verify that there's an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH.
     
        > [!NOTE]
    -   > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you're curious. The file format will be validated when it's imported into Autopilot. An example of the data in this file is shown below.
    +   > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you're curious. The file format is validated when it's imported into Autopilot. An example of the data in this file is shown below.
     
        ![Serial number and hardware hash](images/hwid.png)
     
    -   You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal.  If you're using a physical device instead of a VM, you can copy the file to a USB stick.  If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM).
    +   You'll need to upload this data into Intune to register your device for Autopilot. So the next step is to transfer this file to the computer you will use to access the Azure portal.  If you're using a physical device instead of a VM, you can copy the file to a USB stick.  If you’re using a VM, you can right-click the **AutopilotHWID.csv** file and copy it. Then right-click and paste the file to your desktop (outside the VM).
     
        If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this.
     
    @@ -355,13 +356,13 @@ Resetting the VM or device can take a while. Proceed to the next step (verify su
     
     ## Verify subscription level
     
    -For this lab, you need an AAD Premium subscription.  You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example:
    +For this lab, you need an Azure AD Premium subscription.  You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example:
     
     **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune**
     
     ![MDM and Intune](images/mdm-intune2.png)
     
    -If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription.  Auto-enrollment is a feature only available in AAD Premium.
    +If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription.  Auto-enrollment is a feature only available in Azure Active Directory (Azure AD) Premium.
     
     To convert your Intune trial account to a free Premium trial account, go to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5.
     
    @@ -369,7 +370,7 @@ To convert your Intune trial account to a free Premium trial account, go to **Az
     
     ## Configure company branding
     
    -If you already have company branding configured in Azure Active Directory, you can skip this step.
    +If you already have company branding configured in Azure AD, you can skip this step.
     
     > [!IMPORTANT]
     > Make sure to sign-in with a Global Administrator account.
    @@ -385,7 +386,7 @@ When you're finished, select **Save**.
     
     ## Configure Microsoft Intune auto-enrollment
     
    -If you already have MDM auto-enrollment configured in Azure Active Directory, you can skip this step.
    +If you already have MDM auto-enrollment configured in Azure AD, you can skip this step.
     
     Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, select **Add application** and choose **Intune**.
     
    @@ -395,7 +396,7 @@ For the purposes of this demo, select **All** under the **MDM user scope** and s
     
     ## Register your VM
     
    -Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB).  Both processes are shown here, but only pick one for purposes of this lab. We highly recommend using Intune rather than MSfB.
    +Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB).  Both processes are shown here, but *only pick one* for purposes of this lab. We highly recommend using Intune rather than MSfB.
     
     ### Autopilot registration using Intune
     
    @@ -404,17 +405,17 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B
         ![Intune device import](images/enroll1.png)
     
         > [!NOTE]
    -    > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI.  You might need to provide Intune configuration privileges in a challenge window that appeared.
    +    > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI.  You might need to provide Intune configuration privileges in a challenge window that appears.
     
    -2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer.  The file should contain the serial number and 4K HH of your VM (or device).  It's okay if other fields (Windows Product ID) are left blank.
    +2. Under **Add Windows Autopilot devices** in the far-right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer.  The file should contain the serial number and 4K HH of your VM (or device).  It's okay if other fields (Windows Product ID) are left blank.
     
         ![HWID CSV](images/enroll2.png)
     
    -    You should receive confirmation that the file is formatted correctly before uploading it, as shown above.
    +    You should receive confirmation that the file is formatted correctly before you upload it, as shown above.
     
     3. Select **Import** and wait until the import process completes. This can take up to 15 minutes.
     
    -4. Select **Refresh** to verify your VM or device has been added. See the following example.
    +4. Select **Refresh** to verify your VM or device is added. See the following example.
     
        ![Import HWID](images/enroll3.png)
     
    @@ -437,14 +438,14 @@ Select **Manage** from the top menu, then click the **Windows Autopilot Deployme
     
     ![Microsoft Store for Business](images/msfb.png)
     
    -Select the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added.
    +Select the **Add devices** link to upload your CSV file. A message appears indicating your request is being processed. Wait a few moments before refreshing to see that your new device is added.
     
     ![Microsoft Store for Business Devices](images/msfb-device.png)
     
     ## Create and assign a Windows Autopilot deployment profile
     
     > [!IMPORTANT]
    -> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB.  Both processes are shown here, but only pick one for purposes of this lab:
    +> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB.  Both processes are shown here, but only *pick one for purposes of this lab*:
     
     Pick one:
     - [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune)
    @@ -453,13 +454,13 @@ Pick one:
     ### Create a Windows Autopilot deployment profile using Intune
     
     > [!NOTE]
    -> Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list.
    +> Even if you registered your device in MSfB, it still appears in Intune. Although, you might have to **sync** and then **refresh** your device list.
     
     ![Devices](images/enroll4.png)
     
     #### Create a device group
     
    -The Autopilot deployment profile wizard will ask for a device group, so we must create one first.  To create a device group:
    +The Autopilot deployment profile wizard asks for a device group, so we must create one first. To create a device group:
     
     1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Groups** > **New group**.
     
    @@ -478,7 +479,7 @@ The Autopilot deployment profile wizard will ask for a device group, so we must
     
     #### Create the deployment profile
     
    -To create a Windows Autopilot profile, scroll back to the left-side pane and select **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**.
    +To create a Windows Autopilot profile, scroll back to the left-side pane and select **Devices**. Then, under **Enroll devices | Windows enrollment** select **Deployment Profiles**.
     
     > [!div class="mx-imgBorder"]
     > ![Deployment profiles](images/dp.png)
    @@ -526,11 +527,11 @@ Select **Next** to continue with the **Assignments** settings:
     Select **OK**, and then select **Create**.
     
     > [!NOTE]
    -> If you want to add an app to your profile via Intune, the OPTIONAL steps for doing so can be found in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile).
    +> If you want to add an app to your profile via Intune, use the *optional* steps in [Appendix B: Adding apps to your profile](#appendix-b-adding-apps-to-your-profile).
     
     ### Create a Windows Autopilot deployment profile using MSfB
     
    -If you have already created and assigned a profile via Intune by using the steps immediately above, then skip this section.
    +If already created and assigned a profile via Intune by using the steps immediately above, then skip this section.
     
     A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below.
     
    @@ -563,30 +564,30 @@ The new profile is added to the Autopilot deployment list.
     
     To ASSIGN the profile:
     
    -To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown:
    +To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab. Then, select the profile you want to assign from the **Autopilot deployment** dropdown menu, as shown:
     
     > [!div class="mx-imgBorder"]
     > ![MSfB assign step 1](images/msfb-assign1.png)
     
    -Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column:
    +Confirm the profile was successfully assigned to the intended device, check the contents of the **Profile** column:
     
     > [!div class="mx-imgBorder"]
     > ![MSfB assign step 2](images/msfb-assign2.png)
     
     > [!IMPORTANT]
    -> The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
    +> The new profile is only applied if the device isn't started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device.
     
     ## See Windows Autopilot in action
     
    -If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**:
    +If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience. However, don't attempt to start your device again until the **PROFILE STATUS** for your device in Intune is changed from **Not assigned** to **Assigning**, and finally to **Assigned**:
     
     > [!div class="mx-imgBorder"]
     > ![Device status](images/device-status.png)
     
    -Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up.
    +Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding). Otherwise, these changes might not show up.
     
     > [!TIP]
    -> If you reset your device previously after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting.  If you do not see the Autopilot OOBE experience, then reset the device again (**Settings** > **Update & Security** > **Recovery** and select **Get started**.  Under **Reset this PC**, select **Remove everything and Just remove my files**. Select **Reset**).
    +> If you reset your device previously, after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you don't see the Autopilot OOBE experience, then reset the device again (**Settings** > **Update & Security** > **Recovery** and select **Get started**.  Under **Reset this PC**, select **Remove everything and Just remove my files**. Select **Reset**).
     
     - Ensure your device has an internet connection.
     - Turn on the device
    @@ -594,46 +595,46 @@ Also, make sure to wait at least 30 minutes from the time you've [configured com
     
     ![OOBE sign-in page](images/autopilot-oobe.png)
     
    -Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device.  Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated.
    +Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device.  Go into the Intune Azure portal, and select **Devices > All devices**. Then, **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated.
     
     > [!div class="mx-imgBorder"]
     > ![Device enabled](images/devices1.png)
     
    -Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done.
    +Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure AD credentials. Then you're all done.
     
     > [!TIP]
    -> If you receive a message that "Something went wrong" and it "Looks like we can't connect to the URL for your organization's MDM terms of use", verify that you have correctly [assigned licenses](/mem/intune/fundamentals/licenses-assign) to the current user.
    +> If you receive a message that "Something went wrong" and it "Looks like we can't connect to the URL for your organization's MDM terms of use", verify that you correctly [assigned licenses](/mem/intune/fundamentals/licenses-assign) to the current user.
     
    -Windows Autopilot will now take over to automatically join your device into Azure Active Directory and enroll it to Microsoft Intune. Use the checkpoint you've created to go through this process again with different settings.
    +Windows Autopilot takes over to automatically join your device into Azure AD and enroll it into Microsoft Intune. Use the checkpoint you've created to go through this process again with different settings.
     
     ## Remove devices from Autopilot
     
    -To use the device (or VM) for other purposes after completion of this lab, you will need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it.  Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](/intune/enrollment-autopilot#create-an-autopilot-device-group) and [Remove devices by using wipe, retire, or manually unenrolling the device](/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal) and below.
    +To use the device (or VM) for other purposes after completion of this lab, you need to remove (deregister) it from Autopilot via either Intune or MSfB, and then reset it.  Instructions for deregistering devices can be found at [Enroll Windows devices in Intune by using Windows Autopilot](/intune/enrollment-autopilot#create-an-autopilot-device-group), [Remove devices by using wipe, retire, or manually unenrolling the device](/intune/devices-wipe#delete-devices-from-the-azure-active-directory-portal), and below.
     
     ### Delete (deregister) Autopilot device
     
    -You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then go to **Intune > Devices > All Devices**.  Select the device you want to delete, then select the **Delete** button along the top menu.
    +You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure AD), log into the MEM admin center, then go to **Intune > Devices > All Devices**.  Select the device you want to delete, then select the **Delete** button along the top menu.
     
     > [!div class="mx-imgBorder"]
     > ![Delete device step 1](images/delete-device1.png)
     
    -This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**.
    +This action removes the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot. So, the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**.
     
     The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores.  The former (All devices) is the list of devices currently enrolled into Intune.
     
     > [!NOTE]
    -> A device will only appear in the All devices list once it has booted.  The latter (**Windows Autopilot Deployment Program** > **Devices**) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.
    +> A device only appears in the All devices list once it has booted.  The latter (**Windows Autopilot Deployment Program** > **Devices**) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune.
     
    -To remove the device from the Autopilot program, select the device, and then select **Delete**. You will get a popup dialog box to confirm deletion.
    +To remove the device from the Autopilot program, select the device, and then select **Delete**. A popup dialog box appears to confirm deletion.
     
     > [!div class="mx-imgBorder"]
     > ![Delete device](images/delete-device2.png)
     
    -At this point, your device has been unenrolled from Intune and also deregistered from Autopilot.  After several minutes, select the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program:
    +At this point, your device is unenrolled from Intune and also deregistered from Autopilot.  After several minutes, select the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program.
     
     Once the device no longer appears, you're free to reuse it for other purposes.
     
    -If you also (optionally) want to remove your device from AAD, go to **Azure Active Directory > Devices > All Devices**, select your device, and then select the **Delete** button:
    +If you also (optionally) want to remove your device from Azure AD, go to **Azure Active Directory > Devices > All Devices**, select your device, and then select the **Delete** button:
     
     ## Appendix A: Verify support for Hyper-V
     
    @@ -654,7 +655,7 @@ Hyper-V Requirements:      VM Monitor Mode Extensions: Yes
     In this example, the computer supports SLAT and Hyper-V.
     
     > [!NOTE]
    -> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V.  However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting will depend on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings.
    +> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V.  However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting depends on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings.
     
     You can also identify Hyper-V support using [tools](/archive/blogs/taylorb/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v) provided by the processor manufacturer, the [msinfo32](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731397(v=ws.11)) tool, or you can download the [Coreinfo](/sysinternals/downloads/coreinfo) utility and run it, as shown in the following example:
     
    @@ -682,7 +683,7 @@ EPT             *       Supports Intel extended page tables (SLAT)
     
     #### Prepare the app for Intune
     
    -Before we can pull an application into Intune to make it part of our AP profile, we need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool).  After downloading the tool, gather the following three bits of information to use the tool:
    +Before we can pull an application into Intune to make it part of our AP profile, we need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool:
     
     1. The source folder for your application
     2. The name of the setup executable file
    @@ -690,7 +691,7 @@ Before we can pull an application into Intune to make it part of our AP profile,
     
     For the purposes of this lab, we'll use the Notepad++ tool as our Win32 app.
     
    -Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available) and then copy the file to a known location, such as C:\Notepad++msi.
    +Download the [Notepad++ msi package](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available), and then copy the file to a known location, such as C:\Notepad++msi.
     
     Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example:
     
    @@ -701,7 +702,7 @@ After the tool finishes running, you should have an .intunewin file in the Outpu
     
     #### Create app in Intune
     
    -Log into the Azure portal and select **Intune**.
    +Log in to the Azure portal, and then select **Intune**.
     
     Go to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package.
     
    @@ -728,7 +729,7 @@ Uninstall:  msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q
     ```
     
     > [!NOTE]
    -> Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file.
    +> Likely, you don't have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file.
     
     ![Add app step 5](images/app06.png)
     
    
    From 84373c8d5fc210e9c89ccf8addfbbdcfbb42db87 Mon Sep 17 00:00:00 2001
    From: Michael Mardahl 
    Date: Tue, 24 Aug 2021 10:06:20 +0200
    Subject: [PATCH 0098/1214] Update
     windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
    
    Sounds better. I like it!
    
    Co-authored-by: JohanFreelancer9 <48568725+JohanFreelancer9@users.noreply.github.com>
    ---
     .../hello-for-business/hello-feature-remote-desktop.md          | 2 +-
     1 file changed, 1 insertion(+), 1 deletion(-)
    
    diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
    index 6590ff5250..2ff74ab038 100644
    --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
    +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md
    @@ -25,7 +25,7 @@ ms.reviewer:
     - Cloud only, Hybrid, and On-premises only  Windows Hello for Business deployments
     - Azure AD joined, Hybrid Azure AD joined, and Enterprise joined devices
     
    -Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) to establish an RDP connection.
    +Windows Hello for Business supports using a certificate deployed to a Windows Hello for Business container as a supplied credential to establish a remote desktop connection to a server or another device. This functionality is not supported for key trust deployments. This feature takes advantage of the redirected smart card capabilities of the remote desktop protocol. Windows Hello for Business key trust can be used with [Windows Defender Remote Credential Guard](../remote-credential-guard.md) to establish a remote desktop protocol connection.
     
     Microsoft continues to investigate supporting using keys trust for supplied credentials in a future release.
     
    
    From 941f089142938bb7f2797251621e301cd8d17724 Mon Sep 17 00:00:00 2001
    From: Alekhya Jupudi 
    Date: Tue, 24 Aug 2021 14:31:46 +0530
    Subject: [PATCH 0099/1214] TASK 5358645 : Batch 03, Windows 11 Inclusion
     updates
    
    Third batch of Windows 11 Inclusion updates under Windows-defender-application-control folder. (I've also made some changes to few words as per Acrolinx suggestions to meet the PR criteria).
    ---
     .../applocker/applocker-settings.md               | 11 ++++++++---
     .../applocker/applocker-technical-reference.md    | 11 ++++++++---
     ...onfigure-an-applocker-policy-for-audit-only.md | 11 ++++++++---
     ...igure-an-applocker-policy-for-enforce-rules.md | 11 ++++++++---
     .../configure-exceptions-for-an-applocker-rule.md | 11 ++++++++---
     .../configure-the-appLocker-reference-device.md   | 11 ++++++++---
     .../configure-the-application-identity-service.md | 11 ++++++++---
     .../applocker/create-a-rule-for-packaged-apps.md  | 15 ++++++++++-----
     ...eate-a-rule-that-uses-a-file-hash-condition.md | 11 ++++++++---
     .../create-a-rule-that-uses-a-path-condition.md   | 11 ++++++++---
     ...eate-a-rule-that-uses-a-publisher-condition.md | 11 ++++++++---
     .../applocker/create-applocker-default-rules.md   | 11 ++++++++---
     ...pplications-deployed-to-each-business-group.md | 11 ++++++++---
     .../applocker/create-your-applocker-policies.md   | 11 ++++++++---
     .../applocker/create-your-applocker-rules.md      | 11 ++++++++---
     .../applocker/delete-an-applocker-rule.md         | 11 ++++++++---
     ...policies-by-using-the-enforce-rules-setting.md | 11 ++++++++---
     ...deploy-the-applocker-policy-into-production.md | 11 ++++++++---
     ...group-policy-structure-and-rule-enforcement.md | 11 ++++++++---
     ...re-digitally-signed-on-a-reference-computer.md | 11 ++++++++---
     ...termine-your-application-control-objectives.md | 11 ++++++++---
     ...when-users-try-to-run-a-blocked-application.md | 11 ++++++++---
     .../applocker/dll-rules-in-applocker.md           | 11 ++++++++---
     ...cy-structure-and-applocker-rule-enforcement.md | 11 ++++++++---
     .../applocker/document-your-application-list.md   | 11 ++++++++---
     25 files changed, 202 insertions(+), 77 deletions(-)
    
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
    index 56d2fcb24d..e6ffbc2ba9 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-settings.md
    @@ -1,5 +1,5 @@
     ---
    -title: AppLocker settings (Windows 10)
    +title: AppLocker settings (Windows)
     description: This topic for the IT professional lists the settings used by AppLocker.
     ms.assetid: 9cb4aa19-77c0-4415-9968-bd07dab86839
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # AppLocker settings
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This topic for the IT professional lists the settings used by AppLocker.
     
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
    index db60e0f7bc..49e952d360 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-technical-reference.md
    @@ -1,5 +1,5 @@
     ---
    -title: AppLocker technical reference (Windows 10)
    +title: AppLocker technical reference (Windows)
     description: This overview topic for IT professionals provides links to the topics in the technical reference.
     ms.assetid: 2b2678f8-c46b-4e1d-b8c5-037c0be255ab
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # AppLocker technical reference
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This overview topic for IT professionals provides links to the topics in the technical reference.
     AppLocker advances the application control features and functionality of Software Restriction Policies. AppLocker contains new capabilities and extensions that allow you to create rules to allow or deny apps from running based on unique identities of files and to specify which users or groups can run those apps.
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
    index 8995d1c8cf..44e68d79c2 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-audit-only.md
    @@ -1,5 +1,5 @@
     ---
    -title: Configure an AppLocker policy for audit only (Windows 10)
    +title: Configure an AppLocker policy for audit only (Windows)
     description: This topic for IT professionals describes how to set AppLocker policies to Audit only within your IT environment by using AppLocker.
     ms.assetid: 10bc87d5-cc7f-4500-b7b3-9006e50afa50
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # Configure an AppLocker policy for audit only
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This topic for IT professionals describes how to set AppLocker policies to **Audit only** within your IT environment by using AppLocker.
     
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
    index 1f3d8928cf..e59657993f 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-an-applocker-policy-for-enforce-rules.md
    @@ -1,5 +1,5 @@
     ---
    -title: Configure an AppLocker policy for enforce rules (Windows 10)
    +title: Configure an AppLocker policy for enforce rules (Windows)
     description: This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.
     ms.assetid: 5dbbb290-a5ae-4f88-82b3-21e95972e66c
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # Configure an AppLocker policy for enforce rules
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This topic for IT professionals describes the steps to enable the AppLocker policy enforcement setting.
     
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
    index fea958441d..a018cafadb 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-exceptions-for-an-applocker-rule.md
    @@ -1,5 +1,5 @@
     ---
    -title: Add exceptions for an AppLocker rule (Windows 10)
    +title: Add exceptions for an AppLocker rule (Windows)
     description: This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.
     ms.assetid: d15c9d84-c14b-488d-9f48-bf31ff7ff0c5
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # Add exceptions for an AppLocker rule
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This topic for IT professionals describes the steps to specify which apps can or cannot run as exceptions to an AppLocker rule.
     
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
    index 9b81e3d6fe..e836660931 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-appLocker-reference-device.md
    @@ -1,5 +1,5 @@
     ---
    -title: Configure the AppLocker reference device (Windows 10)
    +title: Configure the AppLocker reference device (Windows)
     description: This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer.
     ms.assetid: 034bd367-146d-4956-873c-e1e09e6fefee
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # Configure the AppLocker reference device
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This topic for the IT professional describes the steps to create an AppLocker policy platform structure on a reference computer.
     
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
    index 83c7422028..0501a133b2 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/configure-the-application-identity-service.md
    @@ -1,5 +1,5 @@
     ---
    -title: Configure the Application Identity service (Windows 10)
    +title: Configure the Application Identity service (Windows)
     description: This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.
     ms.assetid: dc469599-37fd-448b-b23e-5b8e4f17e561
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # Configure the Application Identity service
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This topic for IT professionals shows how to configure the Application Identity service to start automatically or manually.
     
    diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
    index e7c76c7e98..eecd667d2b 100644
    --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
    +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-for-packaged-apps.md
    @@ -1,5 +1,5 @@
     ---
    -title: Create a rule for packaged apps (Windows 10)
    +title: Create a rule for packaged apps (Windows)
     description: This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.
     ms.assetid: e4ffd400-7860-47b3-9118-0e6853c3dfa0
     ms.reviewer: 
    @@ -21,8 +21,13 @@ ms.technology: mde
     # Create a rule for packaged apps
     
     **Applies to**
    -- Windows 10
    -- Windows Server
    +
    +- Windows 10
    +- Windows 11
    +- Windows Server 2016 and above
    +
    +>[!NOTE]
    +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability).
     
     This article for IT professionals shows how to create an AppLocker rule for packaged apps with a publisher condition.
     
    @@ -32,7 +37,7 @@ Packaged apps, also known as Universal Windows apps, are based on an app model t
     -   Package name
     -   Package version
     
    -All the files within a package as well as the package installer share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation as well as the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups.
    +All the files within a package and the package installers share these attributes. Therefore, an AppLocker rule for a packaged app controls both the installation and the running of the app. Otherwise, the publisher rules for packaged apps are no different than the rest of the rule collections; they support exceptions, can be increased or decreased in scope, and can be assigned to users and groups.
     
     For info about the publisher condition, see [Understanding the publisher rule condition in AppLocker](understanding-the-publisher-rule-condition-in-applocker.md).
     
    @@ -67,7 +72,7 @@ You can perform this task by using the Group Policy Management Console for an Ap
         

Use a packaged app installer as a reference

If selected, AppLocker requires you to choose an app installer on which to base your new rule. A packaged app installer has the .appx extension. AppLocker uses the publisher, package name, and package version of the installer to define the rule.

Your company has developed a number of internal line-of-business packaged apps. The app installers are stored on a common file share. Employees can install the required apps from that file share. You want to allow all your employees to install the Payroll app from this share. So you choose this option from the wizard, browse to the file share, and choose the installer for the Payroll app as a reference to create your rule.

Your company has developed many internal line-of-business packaged apps. The app installers are stored on a common file share. Employees can install the required apps from that file share. You want to allow all your employees to install the Payroll app from this share. So you choose this option from the wizard, browse to the file share, and choose the installer for the Payroll app as a reference to create your rule.

diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md index c68870383e..141694e9b1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-file-hash-condition.md @@ -1,5 +1,5 @@ --- -title: Create a rule that uses a file hash condition (Windows 10) +title: Create a rule that uses a file hash condition (Windows) description: This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. ms.assetid: eb3b3524-1b3b-4979-ba5a-0a0b1280c5c7 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create a rule that uses a file hash condition **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals shows how to create an AppLocker rule with a file hash condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md index fd4ebfd86a..3efd61d7e9 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-path-condition.md @@ -1,5 +1,5 @@ --- -title: Create a rule that uses a path condition (Windows 10) +title: Create a rule that uses a path condition (Windows) description: This topic for IT professionals shows how to create an AppLocker rule with a path condition. ms.assetid: 9b2093f5-5976-45fa-90c3-da1e0e845d95 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create a rule that uses a path condition **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals shows how to create an AppLocker rule with a path condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md index f7f9061767..8554f3c9f2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-a-rule-that-uses-a-publisher-condition.md @@ -1,5 +1,5 @@ --- -title: Create a rule that uses a publisher condition (Windows 10) +title: Create a rule that uses a publisher condition (Windows) description: This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. ms.assetid: 345ad45f-2bc1-4c4c-946f-17804e29f55b ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create a rule that uses a publisher condition **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals shows how to create an AppLocker rule with a publisher condition. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md index 8e818f8d12..1b41d7d17d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-applocker-default-rules.md @@ -1,5 +1,5 @@ --- -title: Create AppLocker default rules (Windows 10) +title: Create AppLocker default rules (Windows) description: This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. ms.assetid: 21e9dc68-a6f4-4ebe-ac28-4c66a7ab6e18 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create AppLocker default rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to create a standard set of AppLocker rules that will allow Windows system files to run. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md index 9d57825f8a..61d80caa45 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-list-of-applications-deployed-to-each-business-group.md @@ -1,5 +1,5 @@ --- -title: Create a list of apps deployed to each business group (Windows 10) +title: Create a list of apps deployed to each business group (Windows) description: This topic describes the process of gathering app usage requirements from each business group to implement application control policies by using AppLocker. ms.assetid: d713aa07-d732-4bdc-8656-ba616d779321 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create a list of apps deployed to each business group **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the process of gathering app usage requirements from each business group in order to implement application control policies by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md index d0a53377ec..a4dd6d3cbb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-policies.md @@ -1,5 +1,5 @@ --- -title: Create Your AppLocker policies (Windows 10) +title: Create Your AppLocker policies (Windows) description: This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. ms.assetid: d339dee2-4da2-4d4a-b46e-f1dfb7cb4bf0 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create Your AppLocker policies **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This overview topic for the IT professional describes the steps to create an AppLocker policy and prepare it for deployment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md index dd866880d3..49afa8e599 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/create-your-applocker-rules.md @@ -1,5 +1,5 @@ --- -title: Create Your AppLocker rules (Windows 10) +title: Create Your AppLocker rules (Windows) description: This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. ms.assetid: b684a3a5-929c-4f70-8742-04088022f232 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Create Your AppLocker rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes what you need to know about AppLocker rules and the methods that you can to create rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md index 37cc05e7a2..d99290ca20 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/delete-an-applocker-rule.md @@ -1,5 +1,5 @@ --- -title: Delete an AppLocker rule (Windows 10) +title: Delete an AppLocker rule (Windows) description: This article for IT professionals describes the steps to delete an AppLocker rule. ms.assetid: 382b4be3-0df9-4308-89b2-dcf9df351eb5 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Delete an AppLocker rule **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This article for IT professionals describes the steps to delete an AppLocker rule. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md index bd480092c0..4eacf25176 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-applocker-policies-by-using-the-enforce-rules-setting.md @@ -1,5 +1,5 @@ --- -title: Deploy AppLocker policies by using the enforce rules setting (Windows 10) +title: Deploy AppLocker policies by using the enforce rules setting (Windows) description: This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. ms.assetid: fd3a3d25-ff3b-4060-8390-6262a90749ba ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Deploy AppLocker policies by using the enforce rules setting **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to deploy AppLocker policies by using the enforcement setting method. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md index 64f60860f0..1cef053c49 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/deploy-the-applocker-policy-into-production.md @@ -1,5 +1,5 @@ --- -title: Deploy the AppLocker policy into production (Windows 10) +title: Deploy the AppLocker policy into production (Windows) description: This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. ms.assetid: ebbb1907-92dc-499e-8cee-8e637483c9ae ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Deploy the AppLocker policy into production **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes the tasks that should be completed before you deploy AppLocker application control settings. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md index fdeb9db2dc..4e97c71abe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-group-policy-structure-and-rule-enforcement.md @@ -1,5 +1,5 @@ --- -title: Determine the Group Policy structure and rule enforcement (Windows 10) +title: Determine the Group Policy structure and rule enforcement (Windows) description: This overview topic describes the process to follow when you are planning to deploy AppLocker rules. ms.assetid: f435fcbe-c7ac-4ef0-9702-729aab64163f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Determine the Group Policy structure and rule enforcement **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This overview topic describes the process to follow when you are planning to deploy AppLocker rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md index 44775ea2d0..cd61c3ae04 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-which-applications-are-digitally-signed-on-a-reference-computer.md @@ -1,5 +1,5 @@ --- -title: Find digitally signed apps on a reference device (Windows 10) +title: Find digitally signed apps on a reference device (Windows) description: This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. ms.assetid: 24609a6b-fdcb-4083-b234-73e23ff8bcb8 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Determine which apps are digitally signed on a reference device **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes how to use AppLocker logs and tools to determine which applications are digitally signed. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md index 516f7eaff2..90e037220c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/determine-your-application-control-objectives.md @@ -1,5 +1,5 @@ --- -title: Determine your application control objectives (Windows 10) +title: Determine your application control objectives (Windows) description: Determine which applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. ms.assetid: 0e84003e-6095-46fb-8c4e-2065869bb53b ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Determine your application control objectives **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This article helps with decisions you need to make to determine what applications to control and how to control them by comparing Software Restriction Policies (SRP) and AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md index 4f89790b1c..0337e87f46 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md @@ -1,5 +1,5 @@ --- -title: Display a custom URL message when users try to run a blocked app (Windows 10) +title: Display a custom URL message when users try to run a blocked app (Windows) description: This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. ms.assetid: 9a2534a5-d1fa-48a9-93c6-989d4857cf85 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Display a custom URL message when users try to run a blocked app **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps for displaying a customized message to users when an AppLocker policy denies access to an app. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md index aec41fda97..f547e9a47c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/dll-rules-in-applocker.md @@ -1,5 +1,5 @@ --- -title: DLL rules in AppLocker (Windows 10) +title: DLL rules in AppLocker (Windows) description: This topic describes the file formats and available default rules for the DLL rule collection. ms.assetid: a083fd08-c07e-4534-b0e7-1e15d932ce8f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # DLL rules in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the file formats and available default rules for the DLL rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md index 7c80353023..94b76c08b1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-group-policy-structure-and-applocker-rule-enforcement.md @@ -1,5 +1,5 @@ --- -title: Document Group Policy structure & AppLocker rule enforcement (Windows 10) +title: Document Group Policy structure & AppLocker rule enforcement (Windows) description: This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. ms.assetid: 389ffa8e-11fc-49ff-b0b1-89553e6fb6e5 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Document the Group Policy structure and AppLocker rule enforcement **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This planning topic describes what you need to investigate, determine, and record in your application control policies plan when you use AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md index 64318e0bd7..abace52005 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-application-list.md @@ -1,5 +1,5 @@ --- -title: Document your app list (Windows 10) +title: Document your app list (Windows) description: This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. ms.assetid: b155284b-f75d-4405-aecf-b74221622dc0 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Document your app list **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This planning topic describes the app information that you should document when you create a list of apps for AppLocker policies. From 7d543c500b97df11fbbcd2c49706a46f5ffcf3c9 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Tue, 24 Aug 2021 15:00:19 +0530 Subject: [PATCH 0100/1214] TASK 5358645 : Batch 04, Windows 11 Inclusion updates Fourth batch of Windows 11 Inclusion updates under Windows-defender-application-control folder. (I've also made some changes to few words as per Acrolinx suggestions to meet the PR criteria). --- .../applocker/document-your-applocker-rules.md | 11 ++++++++--- .../applocker/edit-an-applocker-policy.md | 11 ++++++++--- .../applocker/edit-applocker-rules.md | 11 ++++++++--- .../applocker/enable-the-dll-rule-collection.md | 11 ++++++++--- .../applocker/enforce-applocker-rules.md | 11 ++++++++--- .../applocker/executable-rules-in-applocker.md | 11 ++++++++--- .../export-an-applocker-policy-from-a-gpo.md | 11 ++++++++--- .../export-an-applocker-policy-to-an-xml-file.md | 11 ++++++++--- .../applocker/how-applocker-works-techref.md | 11 ++++++++--- ...t-an-applocker-policy-from-another-computer.md | 11 ++++++++--- .../import-an-applocker-policy-into-a-gpo.md | 11 ++++++++--- .../applocker/maintain-applocker-policies.md | 11 ++++++++--- .../manage-packaged-apps-with-applocker.md | 11 ++++++++--- ...ocker-policies-by-using-set-applockerpolicy.md | 11 ++++++++--- .../merge-applocker-policies-manually.md | 11 ++++++++--- .../monitor-application-usage-with-applocker.md | 11 ++++++++--- .../applocker/optimize-applocker-performance.md | 11 ++++++++--- ...d-packaged-app-installer-rules-in-applocker.md | 11 ++++++++--- .../plan-for-applocker-policy-management.md | 11 ++++++++--- .../applocker/refresh-an-applocker-policy.md | 11 ++++++++--- ...quirements-for-deploying-applocker-policies.md | 11 ++++++++--- .../applocker/requirements-to-use-applocker.md | 15 ++++++++++----- ...run-the-automatically-generate-rules-wizard.md | 11 ++++++++--- .../applocker/script-rules-in-applocker.md | 11 ++++++++--- .../security-considerations-for-applocker.md | 11 ++++++++--- .../applocker/select-types-of-rules-to-create.md | 11 ++++++++--- 26 files changed, 210 insertions(+), 80 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index 1000876fbf..40154a27ac 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -1,5 +1,5 @@ --- -title: Document your AppLocker rules (Windows 10) +title: Document your AppLocker rules (Windows) description: Learn how to document your AppLocker rules and associate rule conditions with files, permissions, rule source, and implementation. ms.assetid: 91a198ce-104a-45ff-b49b-487fb40cd2dd ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Document your AppLocker rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes what AppLocker rule conditions to associate with each file, how to associate these rule conditions, the source of the rule, and whether the file should be included or excluded. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md index 9865b4a5d9..d9503e8a00 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-an-applocker-policy.md @@ -1,5 +1,5 @@ --- -title: Edit an AppLocker policy (Windows 10) +title: Edit an AppLocker policy (Windows) description: This topic for IT professionals describes the steps required to modify an AppLocker policy. ms.assetid: dbc72d1f-3fe0-46c2-aeeb-96621fce7637 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Edit an AppLocker policy **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps required to modify an AppLocker policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md index 9fba4220b8..ae57316f95 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/edit-applocker-rules.md @@ -1,5 +1,5 @@ --- -title: Edit AppLocker rules (Windows 10) +title: Edit AppLocker rules (Windows) description: This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. ms.assetid: 80016cda-b915-46a0-83c6-5e6b0b958e32 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Edit AppLocker rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to edit a publisher rule, path rule, and file hash rule in AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md index 33f8fc5205..a7127c01e3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enable-the-dll-rule-collection.md @@ -1,5 +1,5 @@ --- -title: Enable the DLL rule collection (Windows 10) +title: Enable the DLL rule collection (Windows) description: This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. ms.assetid: 88ef9561-6eb2-491a-803a-b8cdbfebae27 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Enable the DLL rule collection **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to enable the DLL rule collection feature for AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md index 977c71d0cf..d5af5704b4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/enforce-applocker-rules.md @@ -1,5 +1,5 @@ --- -title: Enforce AppLocker rules (Windows 10) +title: Enforce AppLocker rules (Windows) description: This topic for IT professionals describes how to enforce application control rules by using AppLocker. ms.assetid: e1528b7b-77f2-4419-8e27-c9cc3721d96d ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Enforce AppLocker rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes how to enforce application control rules by using AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md index 13e0194acf..4a08f289bb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/executable-rules-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Executable rules in AppLocker (Windows 10) +title: Executable rules in AppLocker (Windows) description: This topic describes the file formats and available default rules for the executable rule collection. ms.assetid: 65e62f90-6caa-48f8-836a-91f8ac9018ee ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Executable rules in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the file formats and available default rules for the executable rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md index 6f17980018..6a31ee8659 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-from-a-gpo.md @@ -1,5 +1,5 @@ --- -title: Export an AppLocker policy from a GPO (Windows 10) +title: Export an AppLocker policy from a GPO (Windows) description: This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. ms.assetid: 7db59719-a8be-418b-bbfd-22cf2176c9c0 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Export an AppLocker policy from a GPO **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to export an AppLocker policy from a Group Policy Object (GPO) so that it can be modified. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md index a2c2fda488..b31a06093c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/export-an-applocker-policy-to-an-xml-file.md @@ -1,5 +1,5 @@ --- -title: Export an AppLocker policy to an XML file (Windows 10) +title: Export an AppLocker policy to an XML file (Windows) description: This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. ms.assetid: 979bd23f-6815-478b-a6a4-a25239cb1080 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Export an AppLocker policy to an XML file **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to export an AppLocker policy to an XML file for review or testing. Membership in the local **Administrators** group, or equivalent, is the minimum required to complete this procedure. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md index 6e4827d32a..a69c492e7b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/how-applocker-works-techref.md @@ -1,5 +1,5 @@ --- -title: How AppLocker works (Windows 10) +title: How AppLocker works (Windows) description: This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. ms.assetid: 24bb1d73-0ff5-4af7-8b8a-2fa44d4ddbcd ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # How AppLocker works **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional provides links to topics about AppLocker architecture and components, processes and interactions, rules and policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md index 572410407e..ee2571025c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-from-another-computer.md @@ -1,5 +1,5 @@ --- -title: Import an AppLocker policy from another computer (Windows 10) +title: Import an AppLocker policy from another computer (Windows) description: This topic for IT professionals describes how to import an AppLocker policy. ms.assetid: b48cb2b2-8ef8-4cc0-89bd-309d0b1832f6 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Import an AppLocker policy from another computer **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes how to import an AppLocker policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md index 10cdc3f2c5..a1f2c8e829 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/import-an-applocker-policy-into-a-gpo.md @@ -1,5 +1,5 @@ --- -title: Import an AppLocker policy into a GPO (Windows 10) +title: Import an AppLocker policy into a GPO (Windows) description: This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). ms.assetid: 0629ce44-f5e2-48a8-ba47-06544c73261f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Import an AppLocker policy into a GPO **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to import an AppLocker policy into a Group Policy Object (GPO). AppLocker policies can be created as local security policies and modified like any other local security policy, or they can be created as part of a GPO and managed by using Group Policy. You can create AppLocker policies on any supported computer. For info about which Windows editions are supported, see [Requirements to Use AppLocker](requirements-to-use-applocker.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md index 45ecd00528..495e5578cb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/maintain-applocker-policies.md @@ -1,5 +1,5 @@ --- -title: Maintain AppLocker policies (Windows 10) +title: Maintain AppLocker policies (Windows) description: Learn how to maintain rules within AppLocker policies. View common AppLocker maintenance scenarios and see the methods to use to maintain AppLocker policies. ms.assetid: b4fbfdfe-ef3d-49e0-a390-f2dfe74602bc ms.reviewer: @@ -20,8 +20,13 @@ ms.technology: mde # Maintain AppLocker policies **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes how to maintain rules within AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md index 5629e15a24..963ec6547b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/manage-packaged-apps-with-applocker.md @@ -1,5 +1,5 @@ --- -title: Manage packaged apps with AppLocker (Windows 10) +title: Manage packaged apps with AppLocker (Windows) description: Learn concepts and lists procedures to help you manage packaged apps with AppLocker as part of your overall application control strategy. ms.assetid: 6d0c99e7-0284-4547-a30a-0685a9916650 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Manage packaged apps with AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes concepts and lists procedures to help you manage Packaged apps with AppLocker as part of your overall application control strategy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md index 3701ca5daf..1034d8e194 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-by-using-set-applockerpolicy.md @@ -1,5 +1,5 @@ --- -title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows 10) +title: Merge AppLocker policies by using Set-ApplockerPolicy (Windows) description: This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. ms.assetid: f1c7d5c0-463e-4fe2-a410-844a404f18d0 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Merge AppLocker policies by using Set-ApplockerPolicy **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to merge AppLocker policies by using Windows PowerShell. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md index 7567707461..c6beb49771 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/merge-applocker-policies-manually.md @@ -1,5 +1,5 @@ --- -title: Merge AppLocker policies manually (Windows 10) +title: Merge AppLocker policies manually (Windows) description: This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). ms.assetid: 3605f293-e5f2-481d-8efd-775f9f23c30f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Merge AppLocker policies manually **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to manually merge AppLocker policies to update the Group Policy Object (GPO). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md index 56d201be4e..15bd4e6197 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/monitor-application-usage-with-applocker.md @@ -1,5 +1,5 @@ --- -title: Monitor app usage with AppLocker (Windows 10) +title: Monitor app usage with AppLocker (Windows) description: This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. ms.assetid: 0516da6e-ebe4-45b4-a97b-31daba96d1cf ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Monitor app usage with AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes how to monitor app usage when AppLocker policies are applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md index 48b6672c34..15357f0a4c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/optimize-applocker-performance.md @@ -1,5 +1,5 @@ --- -title: Optimize AppLocker performance (Windows 10) +title: Optimize AppLocker performance (Windows) description: This topic for IT professionals describes how to optimize AppLocker policy enforcement. ms.assetid: a20efa20-bc98-40fe-bd81-28ec4905e0f6 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Optimize AppLocker performance **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes how to optimize AppLocker policy enforcement. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md index 5889dda71b..7cd27ec5a6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/packaged-apps-and-packaged-app-installer-rules-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Packaged apps and packaged app installer rules in AppLocker (Windows 10) +title: Packaged apps and packaged app installer rules in AppLocker (Windows) description: This topic explains the AppLocker rule collection for packaged app installers and packaged apps. ms.assetid: 8fd44d08-a0c2-4c5b-a91f-5cb9989f971d ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Packaged apps and packaged app installer rules in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the AppLocker rule collection for packaged app installers and packaged apps. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index f197b8f4b2..b2c76c96e0 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -1,5 +1,5 @@ --- -title: Plan for AppLocker policy management (Windows 10) +title: Plan for AppLocker policy management (Windows) description: This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. ms.assetid: dccc196f-6ae0-4ae4-853a-a3312b18751b ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Plan for AppLocker policy management **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for describes the decisions you need to make to establish the processes for managing and maintaining AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md index 462a865a4f..c306fa8809 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/refresh-an-applocker-policy.md @@ -1,5 +1,5 @@ --- -title: Refresh an AppLocker policy (Windows 10) +title: Refresh an AppLocker policy (Windows) description: This topic for IT professionals describes the steps to force an update for an AppLocker policy. ms.assetid: 3f24fcbc-3926-46b9-a1a2-dd036edab8a9 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Refresh an AppLocker policy **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to force an update for an AppLocker policy. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md index acabab7d69..a643ae51a4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md @@ -1,5 +1,5 @@ --- -title: Requirements for deploying AppLocker policies (Windows 10) +title: Requirements for deploying AppLocker policies (Windows) description: This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. ms.assetid: 3e55bda2-3cd7-42c7-bad3-c7dfbe193d48 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Requirements for deploying AppLocker policies **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This deployment topic for the IT professional lists the requirements that you need to consider before you deploy AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md index d4778ed70d..63b249672d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-to-use-applocker.md @@ -1,5 +1,5 @@ --- -title: Requirements to use AppLocker (Windows 10) +title: Requirements to use AppLocker (Windows) description: This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. ms.assetid: dc380535-071e-4794-8f9d-e5d1858156f0 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Requirements to use AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional lists software requirements to use AppLocker on the supported Windows operating systems. @@ -38,11 +43,11 @@ To use AppLocker, you need: ## Operating system requirements -The following table show the on which operating systems AppLocker features are supported. +The following table shows the on which operating systems AppLocker features are supported. | Version | Can be configured | Can be enforced | Available rules | Notes | | - | - | - | - | - | -| Windows 10| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| You can use the [AppLocker CSP](/windows/client-management/mdm/applocker-csp) to configure AppLocker policies on any edition of Windows 10 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 Enterprise, Windows 10 Education, and Windows Server 2016. | +| Windows 10 and Windows 11| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| You can use the [AppLocker CSP](/windows/client-management/mdm/applocker-csp) to configure AppLocker policies on any edition of Windows 10 and Windows 11 supported by Mobile Device Management (MDM). You can only manage AppLocker with Group Policy on devices running Windows 10 and Windows 11 Enterprise, Windows 10 and Windows 11 Education, and Windows Server 2016. | | Windows Server 2019
Windows Server 2016
Windows Server 2012 R2
Windows Server 2012| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| | | Windows 8.1 Pro| Yes| No| N/A|| | Windows 8.1 Enterprise| Yes| Yes| Packaged apps
Executable
Windows Installer
Script
DLL| | diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md index da19e309e8..4c9ff4b21a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/run-the-automatically-generate-rules-wizard.md @@ -1,5 +1,5 @@ --- -title: Run the Automatically Generate Rules wizard (Windows 10) +title: Run the Automatically Generate Rules wizard (Windows) description: This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. ms.assetid: 8cad1e14-d5b2-437c-8f88-70cffd7b3d8e ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Run the Automatically Generate Rules wizard **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes steps to run the wizard to create AppLocker rules on a reference device. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md index db4968297c..4b4ca99f66 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/script-rules-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Script rules in AppLocker (Windows 10) +title: Script rules in AppLocker (Windows) description: This topic describes the file formats and available default rules for the script rule collection. ms.assetid: fee24ca4-935a-4c5e-8a92-8cf1d134d35f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Script rules in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the file formats and available default rules for the script rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md index 7e757f7903..006efd19a1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/security-considerations-for-applocker.md @@ -1,5 +1,5 @@ --- -title: Security considerations for AppLocker (Windows 10) +title: Security considerations for AppLocker (Windows) description: This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. ms.assetid: 354a5abb-7b31-4bea-a442-aa9666117625 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Security considerations for AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes the security considerations you need to address when implementing AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md index 174e5d8a77..9dedd807d1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/select-types-of-rules-to-create.md @@ -1,5 +1,5 @@ --- -title: Select the types of rules to create (Windows 10) +title: Select the types of rules to create (Windows) description: This topic lists resources you can use when selecting your application control policy rules by using AppLocker. ms.assetid: 14751169-0ed1-47cc-822c-8c01a7477784 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Select the types of rules to create **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic lists resources you can use when selecting your application control policy rules by using AppLocker. From 8f46ac52b0ad052f76d2a0e74a2ec02d915479c2 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Tue, 24 Aug 2021 16:11:30 +0530 Subject: [PATCH 0101/1214] Resolving suggestions Resolving suggestions and trying if Acrolinx is working! --- .../applocker/document-your-applocker-rules.md | 2 +- .../applocker/plan-for-applocker-policy-management.md | 2 +- .../applocker/requirements-for-deploying-applocker-policies.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md index 40154a27ac..61e0ea6cd7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/document-your-applocker-rules.md @@ -46,7 +46,7 @@ Document the following items for each business group or organizational unit: The following table details sample data for documenting rule type and rule condition findings. In addition, you should now consider whether to allow an app to run or deny permission for it to run. For info about these settings, see [Understanding AppLocker allow and deny actions on rules](understanding-applocker-allow-and-deny-actions-on-rules.md). - +
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index b2c76c96e0..5f7299192b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -143,7 +143,7 @@ The three key areas to determine for AppLocker policy management are: The following table contains the added sample data that was collected when determining how to maintain and manage AppLocker policies. -
+
diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md index a643ae51a4..3d09d68ef3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/requirements-for-deploying-applocker-policies.md @@ -41,7 +41,7 @@ The following requirements must be met or addressed before you deploy your AppLo An AppLocker policy deployment plan is the result of investigating which applications are required and necessary in your organization, which apps are optional, and which apps are forbidden. To develop this plan, see [AppLocker Design Guide](applocker-policies-design-guide.md). The following table is an example of the data you need to collect and the decisions you need to make to successfully deploy AppLocker policies on the supported operating systems (as listed in [Requirements to use AppLocker](requirements-to-use-applocker.md)). -
+
From 3dacc0220839c3cff6027f3262f48b0d56e0b7e7 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Tue, 24 Aug 2021 16:46:48 +0530 Subject: [PATCH 0102/1214] TASK 5358645 : Batch 05, Windows 11 Inclusion updates Fifth batch of Windows 11 Inclusion updates under Windows-defender-application-control folder. (I've also made some changes to few words as per Acrolinx suggestions to meet the PR criteria). --- ...cker-policy-by-using-test-applockerpolicy.md | 11 ++++++++--- .../test-and-update-an-applocker-policy.md | 11 ++++++++--- .../applocker/tools-to-use-with-applocker.md | 11 ++++++++--- ...understand-applocker-enforcement-settings.md | 11 ++++++++--- ...erstand-applocker-policy-design-decisions.md | 17 ++++++++++++----- ...ement-setting-inheritance-in-group-policy.md | 13 +++++++++---- ...d-the-applocker-policy-deployment-process.md | 11 ++++++++--- ...applocker-allow-and-deny-actions-on-rules.md | 11 ++++++++--- .../understanding-applocker-default-rules.md | 11 ++++++++--- .../understanding-applocker-rule-behavior.md | 11 ++++++++--- .../understanding-applocker-rule-collections.md | 11 ++++++++--- ...erstanding-applocker-rule-condition-types.md | 11 ++++++++--- .../understanding-applocker-rule-exceptions.md | 11 ++++++++--- ...the-file-hash-rule-condition-in-applocker.md | 11 ++++++++--- ...ding-the-path-rule-condition-in-applocker.md | 11 ++++++++--- ...the-publisher-rule-condition-in-applocker.md | 11 ++++++++--- ...to-create-and-maintain-applocker-policies.md | 11 ++++++++--- ...e-restriction-policies-in-the-same-domain.md | 17 +++++++++++------ ...-the-applocker-windows-powershell-cmdlets.md | 11 ++++++++--- .../using-event-viewer-with-applocker.md | 11 ++++++++--- ...striction-policies-and-applocker-policies.md | 11 ++++++++--- .../applocker/what-is-applocker.md | 11 ++++++++--- .../windows-installer-rules-in-applocker.md | 11 ++++++++--- .../working-with-applocker-policies.md | 11 ++++++++--- .../applocker/working-with-applocker-rules.md | 11 ++++++++--- .../deploy-wdac-policies-with-memcm.md | 8 ++++++-- .../deploy-wdac-policies-with-script.md | 6 +++++- .../operations/known-issues.md | 9 +++++++-- 28 files changed, 226 insertions(+), 86 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md index fd78e7c563..ca0dc2f8e4 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-an-applocker-policy-by-using-test-applockerpolicy.md @@ -1,5 +1,5 @@ --- -title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows 10) +title: Test an AppLocker policy by using Test-AppLockerPolicy (Windows) description: This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. ms.assetid: 048bfa38-6825-4a9a-ab20-776cf79f402a ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Test an AppLocker policy by using Test-AppLockerPolicy **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes the steps to test an AppLocker policy prior to importing it into a Group Policy Object (GPO) or another computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md index 2027085b0e..3a42a9d7aa 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/test-and-update-an-applocker-policy.md @@ -1,5 +1,5 @@ --- -title: Test and update an AppLocker policy (Windows 10) +title: Test and update an AppLocker policy (Windows) description: This topic discusses the steps required to test an AppLocker policy prior to deployment. ms.assetid: 7d53cbef-078c-4d20-8b00-e821e33b6ea1 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Test and update an AppLocker policy **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic discusses the steps required to test an AppLocker policy prior to deployment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md index a39370e796..19eb7cd1d3 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/tools-to-use-with-applocker.md @@ -1,5 +1,5 @@ --- -title: Tools to use with AppLocker (Windows 10) +title: Tools to use with AppLocker (Windows) description: This topic for the IT professional describes the tools available to create and administer AppLocker policies. ms.assetid: db2b7cb3-7643-4be5-84eb-46ba551e1ad1 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Tools to use with AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes the tools available to create and administer AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md index cbd1b7c62e..7058ee0c64 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-enforcement-settings.md @@ -1,5 +1,5 @@ --- -title: Understand AppLocker enforcement settings (Windows 10) +title: Understand AppLocker enforcement settings (Windows) description: This topic describes the AppLocker enforcement settings for rule collections. ms.assetid: 48773007-a343-40bf-8961-b3ff0a450d7e ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understand AppLocker enforcement settings **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the AppLocker enforcement settings for rule collections. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md index 95dcad5fe6..ccdfd461a6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-policy-design-decisions.md @@ -1,5 +1,5 @@ --- -title: Understand AppLocker policy design decisions (Windows 10) +title: Understand AppLocker policy design decisions (Windows) description: Review some common considerations while you are planning to use AppLocker to deploy application control policies within a Windows environment. ms.assetid: 3475def8-949a-4b51-b480-dc88b5c1e6e6 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understand AppLocker policy design decisions **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional lists the design questions, possible answers, and ramifications of the decisions when you plan a deployment of application control policies by using AppLocker within a Windows operating system environment. @@ -46,7 +51,7 @@ You might need to control a limited number of apps because they access sensitive | Possible answers | Design considerations| | - | - | | Control all apps | AppLocker policies control applications by creating an allowed list of applications by file type. Exceptions are also possible. AppLocker policies can only be applied to applications installed on computers running one of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| -| Control specific apps | When you create AppLocker rules, a list of allowed apps are created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| +| Control specific apps | When you create AppLocker rules, a list of allowed apps is created. All apps on that list will be allowed to run (except those on the exception list). Apps that are not on the list will be prevented from running. AppLocker policies can only be applied to apps installed on computers running any of the supported versions of Windows. For specific operating system version requirements, see [Requirements to use AppLocker](requirements-to-use-applocker.md).| |Control only Classic Windows applications, only Universal Windows apps, or both| AppLocker policies control apps by creating an allowed list of apps by file type. Because Universal Windows apps are categorized under the Publisher condition, Classic Windows applications and Universal Windows apps can be controlled together. AppLocker policies for Universal Windows apps can be applied only to apps that are installed on PCs that support the Microsoft Store, but Classic Windows applications can be controlled with AppLocker on all supported versions of Windows. The rules you currently have configured for Classic Windows applications can remain, and you can create new ones for Universal Windows apps.
For a comparison of Classic Windows applications and Universal Windows apps, see [Comparing Classic Windows applications and Universal Windows apps for AppLocker policy design decisions](#bkmk-compareclassicmetro) in this topic.| | Control apps by business group and user | AppLocker policies can be applied through a Group Policy Object (GPO) to computer objects within an organizational unit (OU). Individual AppLocker rules can be applied to individual users or to groups of users.| | Control apps by computer, not user | AppLocker is a computer-based policy implementation. If your domain or site organizational structure is not based on a logical user structure, such as an OU, you might want to set up that structure before you begin your AppLocker planning. Otherwise, you will have to identify users, their computers, and their app access requirements.| @@ -54,7 +59,7 @@ You might need to control a limited number of apps because they access sensitive >**Important:** The following list contains files or types of files that cannot be managed by AppLocker: -- AppLocker does not protect against running 16-bit DOS binaries in a NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe. +- AppLocker does not protect against running 16-bit DOS binaries in an NT Virtual DOS Machine (NTVDM). This technology allows running legacy DOS and 16-bit Windows programs on computers that are using Intel 80386 or higher when there is already another operating system running and controlling the hardware. The result is that 16-bit binaries can still run on Windows Server 2008 R2 and Windows 7 when AppLocker is configured to otherwise block binaries and libraries. If it is a requirement to prevent 16-bit applications from running, you must configure the Deny rule in the Executable rule collection for NTVDM.exe. - You cannot use AppLocker to prevent code from running outside the Win32 subsystem. In particular, this applies to the (POSIX) subsystem in Windows NT. If it is a requirement to prevent applications from running in the POSIX subsystem, you must disable the subsystem. @@ -108,6 +113,7 @@ If your organization supports multiple Windows operating systems, app control po
- +

SRP can also be configured in the “allowlist mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow.

+ @@ -126,7 +131,7 @@ The following table compares the features and functions of Software Restriction - + diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md index 58576ff79e..ce28a56e21 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-the-applocker-windows-powershell-cmdlets.md @@ -1,5 +1,5 @@ --- -title: Use the AppLocker Windows PowerShell cmdlets (Windows 10) +title: Use the AppLocker Windows PowerShell cmdlets (Windows) description: This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. ms.assetid: 374e029c-5c0a-44ab-a57a-2a9dd17dc57d ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Use the AppLocker Windows PowerShell cmdlets **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes how each AppLocker Windows PowerShell cmdlet can help you administer your AppLocker application control policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md index 7895373d6e..3015885de1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-event-viewer-with-applocker.md @@ -1,5 +1,5 @@ --- -title: Using Event Viewer with AppLocker (Windows 10) +title: Using Event Viewer with AppLocker (Windows) description: This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. ms.assetid: 109abb10-78b1-4c29-a576-e5a17dfeb916 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Using Event Viewer with AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic lists AppLocker events and describes how to use Event Viewer with AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md index 5e34495965..79b2485918 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/using-software-restriction-policies-and-applocker-policies.md @@ -1,5 +1,5 @@ --- -title: Use Software Restriction Policies and AppLocker policies (Windows 10) +title: Use Software Restriction Policies and AppLocker policies (Windows) description: This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. ms.assetid: c3366be7-e632-4add-bd10-9df088f74c6d ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Use Software Restriction Policies and AppLocker policies **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes how to use Software Restriction Policies (SRP) and AppLocker policies in the same Windows deployment. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md index 5e8f5b2efb..b65a70c0fe 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/what-is-applocker.md @@ -1,5 +1,5 @@ --- -title: What Is AppLocker (Windows 10) +title: What Is AppLocker (Windows) description: This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. ms.assetid: 44a8a2bb-0f83-4f95-828e-1f364fb65869 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # What Is AppLocker? **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes what AppLocker is and how its features differ from Software Restriction Policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md index 77b78c5a84..0975dd70c7 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/windows-installer-rules-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Windows Installer rules in AppLocker (Windows 10) +title: Windows Installer rules in AppLocker (Windows) description: This topic describes the file formats and available default rules for the Windows Installer rule collection. ms.assetid: 3fecde5b-88b3-4040-81fa-a2d36d052ec9 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Windows Installer rules in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the file formats and available default rules for the Windows Installer rule collection. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md index 276960c4b0..e4c6caae70 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-policies.md @@ -1,5 +1,5 @@ --- -title: Working with AppLocker policies (Windows 10) +title: Working with AppLocker policies (Windows) description: This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. ms.assetid: 7062d2e0-9cbb-4cb8-aa8c-b24945c3771d ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Working with AppLocker policies **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals provides links to procedural topics about creating, maintaining, and testing AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md index 67910704f3..74ce2ea9d8 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules.md @@ -1,5 +1,5 @@ --- -title: Working with AppLocker rules (Windows 10) +title: Working with AppLocker rules (Windows) description: This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. ms.assetid: 3966b35b-f2da-4371-8b5f-aec031db6bc9 ms.reviewer: @@ -19,8 +19,13 @@ ms.technology: mde # Working with AppLocker rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes AppLocker rule types and how to work with them for your application control policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md index 6e4c3d3b7a..3dcca008bc 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-memcm.md @@ -1,5 +1,5 @@ --- -title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Endpoint Configuration Manager (MEMCM) (Windows 10) +title: Deploy Windows Defender Application Control (WDAC) policies by using Microsoft Endpoint Configuration Manager (MEMCM) (Windows) description: You can use Microsoft Endpoint Configuration Manager (MEMCM) to configure Windows Defender Application Control (WDAC). Learn how with this step-by-step guide. keywords: security, malware ms.prod: m365-security @@ -21,13 +21,17 @@ ms.localizationpriority: medium **Applies to:** - Windows 10 +- Windows 11 - Windows Server 2016 and above +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). + You can use Microsoft Endpoint Configuration Manager (MEMCM) to configure Windows Defender Application Control (WDAC) on client machines. ## Use MEMCM's built-in policies -MEMCM includes native support for WDAC, which allows you to configure Windows 10 client computers with a policy that will only allow: +MEMCM includes native support for WDAC, which allows you to configure Windows 10 and Windows 11 client computers with a policy that will only allow: - Windows components - Microsoft Store apps diff --git a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md index ca2d5fed65..2212ae92fb 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md +++ b/windows/security/threat-protection/windows-defender-application-control/deployment/deploy-wdac-policies-with-script.md @@ -1,5 +1,5 @@ --- -title: Deploy Windows Defender Application Control (WDAC) policies using script (Windows 10) +title: Deploy Windows Defender Application Control (WDAC) policies using script (Windows) description: Use scripts to deploy Windows Defender Application Control (WDAC) policies. Learn how with this step-by-step guide. keywords: security, malware ms.prod: m365-security @@ -21,8 +21,12 @@ ms.localizationpriority: medium **Applies to:** - Windows 10 +- Windows 11 - Windows Server 2016 and above +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). + This topic describes how to deploy Windows Defender Application Control (WDAC) policies using script. The instructions below use PowerShell but can work with any scripting host. > [!NOTE] diff --git a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md index c525c8832f..3cd76bde2b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md +++ b/windows/security/threat-protection/windows-defender-application-control/operations/known-issues.md @@ -20,8 +20,13 @@ ms.localizationpriority: medium **Applies to:** -- Windows 10 -- Windows Server 2016 and above + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic covers tips and tricks for admins as well as known issues with WDAC. Test this configuration in your lab before enabling it in production. From 82317a45d67bd9a09a63954a1bcd46bf64cc7c76 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Tue, 24 Aug 2021 11:47:28 -0400 Subject: [PATCH 0103/1214] removing article from TOC, acrolinx --- .openpublishing.redirection.json | 5 +++ .../apps-in-windows-10.md | 44 +++++++++---------- windows/application-management/index.yml | 10 ++--- .../provisioned-apps-windows-client-os.md | 6 +-- .../system-apps-windows-client-os.md | 4 +- 5 files changed, 36 insertions(+), 33 deletions(-) diff --git a/.openpublishing.redirection.json b/.openpublishing.redirection.json index 1e2452332b..ad9f41fa2b 100644 --- a/.openpublishing.redirection.json +++ b/.openpublishing.redirection.json @@ -1,5 +1,10 @@ { "redirections": [ + { + "source_path": "windows/application-management/msix-app-packaging-tool.md", + "redirect_url": "/windows/application-management/apps-in-windows-10", + "redirect_document_id": false + }, { "source_path": "browsers/edge/about-microsoft-edge.md", "redirect_url": "/previous-versions/windows/edge-legacy/about-microsoft-edge", diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 0b8ebbf7c7..51766c306a 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -1,14 +1,14 @@ --- title: Learn about the different app types in Windows 10 | Microsoft Docs ms.reviewer: -manager: dansimp -description: Use this article to understand the different types of apps that run on Windows 10, such as UWP and Win32 apps. +manager: dougeby +description: Learn more and understand the different types of apps that run on Windows 10 and Windows 11. For example, learn more about UWP, WPF, Win32, and Windows Forms apps, including the best way to install these apps. ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile -ms.author: greglin -author: greg-lindsay +ms.author: mandia +author: MandiOhlinger ms.localizationpriority: medium ms.topic: article --- @@ -33,9 +33,9 @@ In this article, we mention these services. If you're not managing your devices There are different types of apps that can run on your Windows client devices. This section lists some of the common apps used on Windows devices. -- **Microsoft 365 apps**: These apps are used for business and productivity, and include Outlook, Word, Teams, OneNote, and more. +- **Microsoft 365 apps**: These apps are used for business and productivity, and include Outlook, Word, Teams, OneNote, and more. Depending on the licenses your organization has, you may already have these apps. Using an MDM provider, these apps can also be deployed to mobile devices, including smartphones. - [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans) + For more information on the Microsoft 365 license options, and what you get, see [Transform your enterprise with Microsoft 365](https://www.microsoft.com/microsoft-365/compare-microsoft-365-enterprise-plans). - **Power Apps**: These apps connect to business data available online and on-premises, and can run in a web browser, and on mobile devices. They can be created by business analysts and professional developers. For more information, see [What is Power Apps?](/powerapps/powerapps-overview). @@ -48,12 +48,12 @@ There are different types of apps that can run on your Windows client devices. T - **Apps**: All apps installed in `C:\Program Files\WindowsApps`. There are two classes of apps: - - **Provisioned**: Installed in user account the first time you sign in with a new user account. + - **Provisioned**: Installed in user account the first time you sign in with a new user account. For a list of some common provisioned apps, see [Provisioned apps installed with the Windows client OS](provisioned-apps-windows-client-os.md). - **Installed**: Installed as part of the OS. - - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. + - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. For a list of some common system apps, see [System apps installed with the Windows client OS](system-apps-windows-client-os.md). -- **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. But, not all Windows apps are UWP apps. +- **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. Not all Windows apps are UWP apps. For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide). @@ -61,7 +61,7 @@ There are different types of apps that can run on your Windows client devices. T Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a Web App](https://azure.microsoft.com/get-started/web-app/). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview). - Use MDM to create shortcut on devices + Use an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. - **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. @@ -74,25 +74,25 @@ There are different types of apps that can run on your Windows client devices. T When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. -- **Manually install**: On your devices, users can install apps from the Microsoft Store and from the internet. These apps, and more, are listed in **Settings** > **Apps and Features**. +- **Manually install**: On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps and Features**. - If you want to prevent users from downloading apps on organization owned devices, you can use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10). + If you want to prevent users from downloading apps on organization owned devices, use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10). For an overview of the different types of device policies you can create, see [Apply features and settings on your devices using device profiles in Microsoft Intune](/mem/intune/configuration/device-profiles). -- **Mobile device management (MDM)**: Use a MDM provider, like Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add Store apps, and more. +- **Mobile device management (MDM)**: Use an MDM provider, like Microsoft Intune (cloud) or Configuration Manager (on-premises), to deploy apps. For example, you can create app policies that deploy Microsoft 365 apps, deploy Win32 apps, create shortcuts to web apps, add Store apps, and more. For more information, see: - [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) - [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) -- **Microsoft Store**: Using the Microsoft Store app, Windows users can download apps from the public store, and download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **Windows Package Manager** to add apps to the private store. +- **Microsoft Store**: Using the Microsoft Store app, Windows users can download apps from the public store. And, they can download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **Windows Package Manager** to add apps to the private store. To help manage the Microsoft Store on your devices, you can use policies: - On premises, you can use Administrative Templates in group policy to control access to the Microsoft Store app (`User Configuration\Administrative Templates\Windows Components\Store`). - - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to control access to the Microsoft Store app. + - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to control access to the Microsoft Store app. For more information, see: @@ -104,7 +104,7 @@ When your apps are ready, you can add or deploy these apps to your Windows devic To deploy MSIX packages and their apps, you can: - Use an MDM provider, like Microsoft Intune and Configuration Manager. - - Use an App Installer so users double-click an installer file, or select a link on a web page. + - Use an App Installer. User users double-click an installer file, or select a link on a web page. - And more. For more information, see: @@ -112,7 +112,7 @@ When your apps are ready, you can add or deploy these apps to your Windows devic - [What is MSIX?](/windows/msix/overview) - [MSIX app distribution for enterprises](/windows/msix/desktop/managing-your-msix-deployment-enterprise) -- **Windows Package Manager**: Windows Package Manager is a command line tool commonly used by developers to install Windows apps. Using the command line, you can can get apps from the Microsoft Store or from GitHub (and more), and install these apps on Windows devices. It's helpful if you want to bypass user interfaces for getting apps from organizations and from developers. +- **Windows Package Manager**: Windows Package Manager is a command line tool commonly used by developers to install Windows apps. Using the command line, you can get apps from the Microsoft Store or from GitHub (and more), and install these apps on Windows devices. It's helpful if you want to bypass user interfaces for getting apps from organizations and from developers. If your organization uses `.EXE`, `.MSIX`, or `.MSI` files, then Windows Package Manager might be the right deployment option for your organization. @@ -120,26 +120,24 @@ When your apps are ready, you can add or deploy these apps to your Windows devic - **Azure Virtual desktop with MSIX app attach**: With Azure virtual desktop, you can virtualize the Windows client OS desktop, and use virtual apps on this desktop. With MSIX app attach, you dynamically deliver MSIX packaged apps to users and user groups. - The benefit is to use the cloud to deliver virtual apps in real time, and as-needed. Users use the apps as if they were installed locally. + The benefit is to use the cloud to deliver virtual apps in real time, and as-needed. Users use the apps as if they're installed locally. - If you currently use App-V, and want to decrease your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the right deployment for your organization. + If you currently use App-V, and want to reduce your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the right deployment for your organization. For more information, see: - [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) - [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal) -- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps. On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they were installed locally. +- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps. On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally. The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md). To help manage App-V on your devices, you can use policies: - On premises, you can use Administrative Templates in group policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`). - - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) to deploy App-V policies. + - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to deploy App-V policies. > [!TIP] > If you want to decrease your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the better deployment for your organization. -## Remove apps - diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index d3a95df0d0..d9d22489a8 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -13,8 +13,8 @@ metadata: ms.collection: windows-10 author: greg-lindsay #Required; your GitHub user alias, with correct capitalization. ms.author: greglin #Required; microsoft alias of author; optional team alias. - ms.date: 04/30/2021 #Required; mm/dd/yyyy format. - localization_priority: medium + ms.date: 08/24/2021 #Required; mm/dd/yyyy format. + ms.localizationpriority : medium # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -26,11 +26,11 @@ landingContent: linkLists: - linkListType: overview links: - - text: Understand apps in Windows 10 + - text: Understand apps in Windows client OS url: apps-in-windows-10.md - - text: How to add apps and features to Windows 10 + - text: How to add apps and features url: add-apps-and-features.md - - text: Sideload LOB apps in Windows 10 + - text: Sideload LOB apps url: sideload-apps-in-windows-10.md - text: Keep removed apps from returning during an update url: remove-provisioned-apps-during-update.md diff --git a/windows/application-management/provisioned-apps-windows-client-os.md b/windows/application-management/provisioned-apps-windows-client-os.md index c426de223d..48795d6801 100644 --- a/windows/application-management/provisioned-apps-windows-client-os.md +++ b/windows/application-management/provisioned-apps-windows-client-os.md @@ -21,9 +21,9 @@ ms.topic: article Provisioned apps are included with the OS, and automatically installed when a user signs into a Windows device the first time. They are per-user apps, and typically installed in the `C:\Program Files\WindowsApps` folder. On your Windows devices, you can use Windows PowerShell to see the provisioned apps automatically installed. -This article lists some of the built-in provisioned apps on the different Windows client OS versions, and lists the Windows Powershell command to get a list. +This article lists some of the built-in provisioned apps on the different Windows client OS versions, and lists the Windows PowerShell command to get a list. -## Use Windows Powershell +## Use Windows PowerShell To get a list of all the provisioned apps, use Windows PowerShell: @@ -382,7 +382,7 @@ Provisioned apps are also listed in **Settings** > **Apps and Features**. --- - - The Store app shouldn't be removed. If you remove the Store app, and want to reinstall it, you can restore your system from a backup, or reset your system. Instead of removing the Store app, use group policies to hide or disable it. + - The Store app shouldn't be removed. If you remove the Store app, and want to reinstall it, you must restore your system from a backup, or reset your system. Instead of removing the Store app, use group policies to hide or disable it. - [Xbox Live in-game experience](ms-windows-store://pdp/?PFN=Microsoft.Xbox.TCUI_8wekyb3d8bbwe) | Package name: Microsoft.Xbox.TCUI - Supported versions: diff --git a/windows/application-management/system-apps-windows-client-os.md b/windows/application-management/system-apps-windows-client-os.md index 0ac52b682f..6ebea1ded8 100644 --- a/windows/application-management/system-apps-windows-client-os.md +++ b/windows/application-management/system-apps-windows-client-os.md @@ -21,9 +21,9 @@ ms.topic: article On all Windows devices, the OS automatically installs some apps. These apps are called system apps, and are typically installed in the `C:\Windows\` folder. On your Windows devices, you can use Windows PowerShell to see the system apps automatically installed. -This article lists the built-in system apps on some Windows OS versions, and lists the Windows Powershell command to get a list. +This article lists the built-in system apps on some Windows OS versions, and lists the Windows PowerShell command to get a list. -## Use Windows Powershell +## Use Windows PowerShell To get a list of all the system apps, use Windows PowerShell: From 30437e4ea787e11c9c8a1789d2c10578738081b7 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Tue, 24 Aug 2021 12:05:03 -0400 Subject: [PATCH 0104/1214] fixed validation warnings --- .../add-apps-and-features.md | 4 +- .../apps-in-windows-10.md | 2 +- .../msix-app-packaging-tool.md | 42 ------------------- windows/application-management/toc.yml | 5 +-- 4 files changed, 6 insertions(+), 47 deletions(-) delete mode 100644 windows/application-management/msix-app-packaging-tool.md diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md index 2834995eab..6a6c743b1c 100644 --- a/windows/application-management/add-apps-and-features.md +++ b/windows/application-management/add-apps-and-features.md @@ -16,7 +16,9 @@ ms.topic: article # How to add apps and features to Windows 10 > Applies to: Windows 10 -Windows 10 includes a range of [applications](apps-in-windows-10.md), from [system apps](apps-in-windows-10.md#system-apps) that support the operating system (like Settings) to ["provisioned" apps](apps-in-windows-10.md#provisioned-windows-apps) (like Feedback Hub) that are installed the first time you run Windows. We also provide additional apps and features, called Features on Demand (like language packs or handwriting recognition), that you can install at any time. If you're working in a managed environment (like at work, where you have an administrator who manages your systems and resources), your admin can use [Windows Update to install Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). If you're working on your own device, you can add apps and features from the Settings app. +Windows 10 includes a range of [applications](apps-in-windows-10.md), from [system apps](system-apps-windows-client-os.md) that support the operating system (like Settings) to ["provisioned" apps](provisioned-apps-windows-client-os.md) (like Feedback Hub) that are installed the first time you run Windows. We also provide additional apps and features, called Features on Demand (like language packs or handwriting recognition), that you can install at any time. If you're working in a managed environment (like at work, where you have an administrator who manages your systems and resources), your admin can use [Windows Update to install Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). + +If you're working on your own device, you can add apps and features from the Settings app. Here's how you do that: diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 51766c306a..185ad28d5e 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -25,7 +25,7 @@ As organizations become more global, and to support employees working from anywh In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: -- [Microsoft Endpoint Manager overview](mem/endpoint-manager-overview) +- [Microsoft Endpoint Manager overview](/mem/endpoint-manager-overview) - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) diff --git a/windows/application-management/msix-app-packaging-tool.md b/windows/application-management/msix-app-packaging-tool.md deleted file mode 100644 index 97a832c6e9..0000000000 --- a/windows/application-management/msix-app-packaging-tool.md +++ /dev/null @@ -1,42 +0,0 @@ ---- -title: Repackage your existing win32 applications to the MSIX format. -description: Learn how to install and use the MSIX packaging tool to repackage your existing win32 applications to the MSIX format. -keywords: ["MSIX", "application", "app", "win32", "packaging tool"] -ms.prod: w10 -ms.mktglfcycl: manage -ms.sitesec: library -ms.localizationpriority: medium -ms.author: greglin -ms.topic: article -ms.date: 12/03/2018 -ms.reviewer: -manager: dansimp -author: greg-lindsay - -ROBOTS: NOINDEX ---- - -# Repackage existing win32 applications to the MSIX format - -MSIX is a packaging format built to be safe, secure and reliable, based on a combination of .msi, .appx, App-V and ClickOnce installation technologies. You can [use the MSIX packaging tool](/windows/msix/packaging-tool/create-app-package-msi-vm) to repackage your existing Win32 applications to the MSIX format. - -You can either run your installer interactively (through the UI) or create a package from the command line. Either way, you can convert an application without having the source code. Then, you can make your app available through the Microsoft Store. - -- [Package your favorite application installer](/windows/msix/packaging-tool/create-app-package-msi-vm) interactively (msi, exe, App-V 5.x and ClickOnce) in MSIX format. -- Create a [modification package](/windows/msix/packaging-tool/package-editor) to update an existing MSIX package. -- [Bundle multiple MSIX packages](/windows/msix/packaging-tool/bundle-msix-packages) for distribution. - -## Installing the MSIX Packaging Tool - -### Prerequisites - -- Windows 10, version 1809 (or later) -- Participation in the Windows Insider Program (if you're using an Insider build) -- A valid Microsoft work or school account to access the app from the Microsoft Store -- Admin privileges on your PC account - -### Get the app from the Microsoft Store - -1. Use the Microsoft work or school account login associated with your Windows Insider Program credentials in the [Microsoft Store](https://www.microsoft.com/store/r/9N5LW3JBCXKF). -2. Open the product description page. -3. Click the install icon to begin installation. \ No newline at end of file diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index c72329ed9e..0e0f44a1bb 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -4,8 +4,9 @@ items: - name: Application management items: - name: Apps in Windows client OS - href: apps-in-windows-10.md items: + - name: Common app types + href: apps-in-windows-10.md - name: Provisioned apps in Windows client OS href: provisioned-apps-windows-client-os.md - name: System apps in Windows client OS @@ -18,8 +19,6 @@ items: href: enterprise-background-activity-controls.md - name: Enable or block Windows Mixed Reality apps in the enterprise href: manage-windows-mixed-reality.md - - name: Repackage win32 apps in the MSIX format - DELETE - href: msix-app-packaging-tool.md - name: Application Virtualization (App-V) items: - name: App-V for Windows 10 overview From 984cdfb77318e31ab89e1ff1b4b44c8976fbb506 Mon Sep 17 00:00:00 2001 From: Benzy Dharmanayagam Date: Tue, 24 Aug 2021 22:35:14 +0530 Subject: [PATCH 0105/1214] Updated-5358673 --- .../bitlocker/bcd-settings-and-bitlocker.md | 7 ++- .../bitlocker/bitlocker-basic-deployment.md | 10 +++-- .../bitlocker/bitlocker-countermeasures.md | 17 +++++--- .../bitlocker-deployment-comparison.md | 12 +++--- ...r-device-encryption-overview-windows-10.md | 43 ++++++++++--------- .../bitlocker-group-policy-settings.md | 16 +++---- .../bitlocker-how-to-enable-network-unlock.md | 5 ++- .../bitlocker-management-for-enterprises.md | 8 ++-- .../bitlocker/bitlocker-overview.md | 13 +++--- .../bitlocker-recovery-guide-plan.md | 10 +++-- ...ve-encryption-tools-to-manage-bitlocker.md | 5 ++- ...-use-bitlocker-recovery-password-viewer.md | 5 ++- ...ion-for-bitlocker-planning-and-policies.md | 6 ++- .../ts-bitlocker-cannot-encrypt-issues.md | 6 +-- .../bitlocker/ts-bitlocker-config-issues.md | 4 +- .../ts-bitlocker-decode-measured-boot-logs.md | 2 +- .../bitlocker/ts-bitlocker-intune-issues.md | 20 ++++----- .../bitlocker/ts-bitlocker-recovery-issues.md | 16 +++---- .../bitlocker/ts-bitlocker-tpm-issues.md | 6 +-- 19 files changed, 120 insertions(+), 91 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md index 876cf87f79..34a70a7698 100644 --- a/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bcd-settings-and-bitlocker.md @@ -21,7 +21,10 @@ ms.custom: bitlocker # Boot Configuration Data settings and BitLocker **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This topic for IT professionals describes the Boot Configuration Data (BCD) settings that are used by BitLocker. @@ -105,7 +108,7 @@ The following table contains the default BCD validation profile used by BitLocke ### Full list of friendly names for ignored BCD settings -This following is a full list of BCD settings with friendly names which are ignored by default. These settings are not part of the default BitLocker validation profile, but can be added if you see a need to validate any of these settings before allowing a BitLocker–protected operating system drive to be unlocked. +This following is a full list of BCD settings with friendly names, which are ignored by default. These settings are not part of the default BitLocker validation profile, but can be added if you see a need to validate any of these settings before allowing a BitLocker–protected operating system drive to be unlocked. > **Note:**  Additional BCD settings exist that have hex values but do not have friendly names. These settings are not included in this list. | Hex Value | Prefix | Friendly Name | diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index 6d53e36d70..5582a89d66 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -22,7 +22,9 @@ ms.custom: bitlocker **Applies to** -- Windows 10 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This article for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. @@ -108,14 +110,14 @@ Windows Explorer allows users to launch the BitLocker Drive Encryption wizard by The following table shows the compatibility matrix for systems that have been BitLocker enabled then presented to a different version of Windows. -Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes +Table 1: Cross compatibility for Windows 11, Windows 10, Windows 8.1, Windows 8, and Windows 7 encrypted volumes -|Encryption Type|Windows 10 and Windows 8.1|Windows 8|Windows 7| +|Encryption Type|Windows 11, Windows 10, and Windows 8.1|Windows 8|Windows 7| |--- |--- |--- |--- | |Fully encrypted on Windows 8|Presents as fully encrypted|N/A|Presented as fully encrypted| |Used Disk Space Only encrypted on Windows 8|Presents as encrypt on write|N/A|Presented as fully encrypted| |Fully encrypted volume from Windows 7|Presents as fully encrypted|Presented as fully encrypted|N/A| -|Partially encrypted volume from Windows 7|Windows 10 and Windows 8.1 will complete encryption regardless of policy|Windows 8 will complete encryption regardless of policy|N/A| +|Partially encrypted volume from Windows 7|Windows 11, Windows 10, and Windows 8.1 will complete encryption regardless of policy|Windows 8 will complete encryption regardless of policy|N/A| ## Encrypting volumes using the manage-bde command-line interface diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index fc9b15fdef..680f50a12b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -21,7 +21,10 @@ ms.custom: bitlocker # BitLocker Countermeasures **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above Windows uses technologies including Trusted Platform Module (TPM), Secure Boot, and Measured Boot to help protect BitLocker encryption keys against attacks. BitLocker is part of a strategic approach to securing data against offline attacks through encryption technology. @@ -33,9 +36,9 @@ BitLocker helps mitigate unauthorized data access on lost or stolen computers be - **Encrypting volumes on your computer.** For example, you can turn on BitLocker for your operating system volume, or a volume on a fixed or removable data drive (such as a USB flash drive, SD card, and so on). Turning on BitLocker for your operating system volume encrypts all system files on the volume, including the paging files and hibernation files. The only exception is for the System partition, which includes the Windows Boot Manager and minimal boot collateral required for decryption of the operating system volume after the key is unsealed. - **Ensuring the integrity of early boot components and boot configuration data.** On devices that have a TPM version 1.2 or higher, BitLocker uses the enhanced security capabilities of the TPM to make data accessible only if the computer’s BIOS firmware code and configuration, original boot sequence, boot components, and BCD configuration all appear unaltered and the encrypted disk is located in the original computer. On systems that leverage TPM PCR[7], BCD setting changes deemed safe are permitted to improve usability. -The next sections provide more details about how Windows protects against various attacks on the BitLocker encryption keys in Windows 10, Windows 8.1, and Windows 8. +The next sections provide more details about how Windows protects against various attacks on the BitLocker encryption keys in Windows 11, Windows 10, Windows 8.1, and Windows 8. -For more information about how to enable the best overall security configuration for devices beginning with Windows 10 version 1803, see [Standards for a highly secure Windows 10 device](/windows-hardware/design/device-experiences/oem-highly-secure). +For more information about how to enable the best overall security configuration for devices beginning with Windows 10 version 1803 or Windows 11, see [Standards for a highly secure Windows device](/windows-hardware/design/device-experiences/oem-highly-secure). ## Protection before startup @@ -105,8 +108,8 @@ It requires direct ethernet connectivity to an enterprise Windows Deployment Ser ### Protecting Thunderbolt and other DMA ports There are a few different options to protect DMA ports, such as Thunderbolt™3. -Beginning with Windows 10 version 1803, new Intel-based devices have kernel protection against DMA attacks via Thunderbolt™ 3 ports enabled by default. -This Kernel DMA Protection is available only for new systems beginning with Windows 10 version 1803, as it requires changes in the system firmware and/or BIOS. +Beginning with Windows 10 version 1803 or Windows 11, new Intel-based devices have kernel protection against DMA attacks via Thunderbolt™ 3 ports enabled by default. +This Kernel DMA Protection is available only for new systems beginning with Windows 10 version 1803 or Windows 11, as it requires changes in the system firmware and/or BIOS. You can use the System Information desktop app (MSINFO32) to check if a device has kernel DMA protection enabled: @@ -116,7 +119,7 @@ If kernel DMA protection *not* enabled, follow these steps to protect Thunderbol 1. Require a password for BIOS changes 2. Intel Thunderbolt Security must be set to User Authorization in BIOS settings. Please refer to [Intel Thunderbolt™ 3 and Security on Microsoft Windows® 10 Operating System documentation](https://thunderbolttechnology.net/security/Thunderbolt%203%20and%20Security.pdf) -3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607): +3. Additional DMA security may be added by deploying policy (beginning with Windows 10 version 1607 or Windows 11): - MDM: [DataProtection/AllowDirectMemoryAccess](/windows/client-management/mdm/policy-csp-dataprotection#dataprotection-allowdirectmemoryaccess) policy - Group Policy: [Disable new DMA devices when this computer is locked](./bitlocker-group-policy-settings.md#disable-new-dma-devices-when-this-computer-is-locked) (This setting is not configured by default.) @@ -136,7 +139,7 @@ This is the default configuration. A BIOS password is recommended for defense-in-depth in case a BIOS exposes settings that may weaken the BitLocker security promise. Intel Boot Guard and AMD Hardware Verified Boot support stronger implementations of Secure Boot that provide additional resilience against malware and physical attacks. -Intel Boot Guard and AMD Hardware Verified Boot are part of platform boot verification [standards for a highly secure Windows 10 device](/windows-hardware/design/device-experiences/oem-highly-secure). +Intel Boot Guard and AMD Hardware Verified Boot are part of platform boot verification [standards for a highly secure Windows device](/windows-hardware/design/device-experiences/oem-highly-secure). ### Brute force attacks against a PIN Require TPM + PIN for anti-hammering protection. diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index 4864bdf4d4..d8520ae44b 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -20,7 +20,9 @@ ms.custom: bitlocker **Applies to** -- Windows 10 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This article depicts the BitLocker deployment comparison chart. @@ -28,9 +30,9 @@ This article depicts the BitLocker deployment comparison chart. | Requirements |Microsoft Intune |Microsoft Endpoint Configuration Manager |Microsoft BitLocker Administration and Monitoring (MBAM) | |---------|---------|---------|---------| -|Minimum client operating system version |Windows 10 | Windows 10 and Windows 8.1 | Windows 7 and later | -|Supported Windows 10 SKUs | Enterprise, Pro, Education | Enterprise, Pro, Education | Enterprise | -|Minimum Windows 10 version |1909 | None | None | +|Minimum client operating system version |Windows 11 and Windows 10 | Windows 11, Windows 10, and Windows 8.1 | Windows 7 and later | +|Supported Windows SKUs | Enterprise, Pro, Education | Enterprise, Pro, Education | Enterprise | +|Minimum Windows version |1909 | None | None | |Supported domain-joined status | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory joined, hybrid Azure AD joined | Active Directory joined | |Permissions required to manage policies | Endpoint security manager or custom | Full administrator or custom | Domain Admin or Delegated GPO access | |Cloud or on premises | Cloud | On premises | On premises | @@ -54,7 +56,7 @@ This article depicts the BitLocker deployment comparison chart. |Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | |Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | |Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later or Windows 11) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | |Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | | |Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | |Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | diff --git a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md index cf15c6cd30..ddb93cce30 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md +++ b/windows/security/information-protection/bitlocker/bitlocker-device-encryption-overview-windows-10.md @@ -1,6 +1,6 @@ --- -title: Overview of BitLocker Device Encryption in Windows 10 -description: This topic provides an overview of how BitLocker Device Encryption can help protect data on devices running Windows 10. +title: Overview of BitLocker Device Encryption in Windows +description: This topic provides an overview of how BitLocker Device Encryption can help protect data on devices running Windows. ms.prod: w10 ms.mktglfcycl: explore ms.sitesec: library @@ -17,21 +17,24 @@ ms.reviewer: ms.custom: bitlocker --- -# Overview of BitLocker Device Encryption in Windows 10 +# Overview of BitLocker Device Encryption in Windows **Applies to** -- Windows 10 -This topic explains how BitLocker Device Encryption can help protect data on devices running Windows 10. +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +This topic explains how BitLocker Device Encryption can help protect data on devices running Windows. For a general overview and list of topics about BitLocker, see [BitLocker](bitlocker-overview.md). When users travel, their organization’s confidential data goes with them. Wherever confidential data is stored, it must be protected against unauthorized access. Windows has a long history of providing at-rest data-protection solutions that guard against nefarious attackers, beginning with the Encrypting File System in the Windows 2000 operating system. More recently, BitLocker has provided encryption for full drives and portable drives. Windows consistently improves data protection by improving existing options and by providing new strategies. -Table 2 lists specific data-protection concerns and how they are addressed in Windows 10 and Windows 7. +Table 2 lists specific data-protection concerns and how they are addressed in Windows 11, Windows 10, and Windows 7. -**Table 2. Data Protection in Windows 10 and Windows 7** +**Table 2. Data Protection in Windows 11, Windows 10, and Windows 7** -| Windows 7 | Windows 10 | +| Windows 7 | Windows 11 and Windows 10 | |---|---| | When BitLocker is used with a PIN to protect startup, PCs such as kiosks cannot be restarted remotely. | Modern Windows devices are increasingly protected with BitLocker Device Encryption out of the box and support SSO to seamlessly protect the BitLocker encryption keys from cold boot attacks.

Network Unlock allows PCs to start automatically when connected to the internal network. | | When BitLocker is enabled, the provisioning process can take several hours. | BitLocker pre-provisioning, encrypting hard drives, and Used Space Only encryption allow administrators to enable BitLocker quickly on new computers. | @@ -44,7 +47,7 @@ Table 2 lists specific data-protection concerns and how they are addressed in Wi ## Prepare for drive and file encryption The best type of security measures are transparent to the user during implementation and use. Every time there is a possible delay or difficulty because of a security feature, there is strong likelihood that users will try to bypass security. This situation is especially true for data protection, and that’s a scenario that organizations need to avoid. -Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 10 meets your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. +Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 11 and Windows 10 meet your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. ### TPM pre-provisioning @@ -55,22 +58,22 @@ In Windows 7, preparing the TPM for use offered a couple of challenges: Basically, it was a big hassle. If IT staff were provisioning new PCs, they could handle all of this, but if you wanted to add BitLocker to devices that were already in users’ hands, those users would have struggled with the technical challenges and would either call IT for support or simply leave BitLocker disabled. -Microsoft includes instrumentation in Windows 10 that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. +Microsoft includes instrumentation in Windows 11 and Windows 10 that enable the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. ## Deploy hard drive encryption -BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. -With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 10. +BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 11 and Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. +With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 11 and Windows 10. ## BitLocker Device Encryption -Beginning in Windows 8.1, Windows automatically enables BitLocker Device Encryption on devices that support Modern Standby. With Windows 10, Microsoft offers BitLocker Device Encryption support on a much broader range of devices, including those that are Modern Standby, and devices that run Windows 10 Home edition. +Beginning in Windows 8.1, Windows automatically enables BitLocker Device Encryption on devices that support Modern Standby. With Windows 11 and Windows 10, Microsoft offers BitLocker Device Encryption support on a much broader range of devices, including those that are Modern Standby, and devices that run Windows 10 Home edition or Windows 11. Microsoft expects that most devices in the future will pass the testing requirements, which makes BitLocker Device Encryption pervasive across modern Windows devices. BitLocker Device Encryption further protects the system by transparently implementing device-wide data encryption. Unlike a standard BitLocker implementation, BitLocker Device Encryption is enabled automatically so that the device is always protected. The following list outlines how this happens: -* When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, BitLocker Device Encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). In this state, the drive is shown with a warning icon in Windows Explorer. The yellow warning icon is removed after the TPM protector is created and the recovery key is backed up, as explained in the following bullet points. +* When a clean installation of Windows 11 or Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, BitLocker Device Encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). In this state, the drive is shown with a warning icon in Windows Explorer. The yellow warning icon is removed after the TPM protector is created and the recovery key is backed up, as explained in the following bullet points. * If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. * If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. * Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. @@ -88,28 +91,28 @@ Administrators can manage domain-joined devices that have BitLocker Device Encry ## Used Disk Space Only encryption BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted. In that case, traces of the confidential data could remain on portions of the drive marked as unused. -But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. +But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 11 and Windows 10 let users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. ## Encrypted hard drive support SEDs have been available for years, but Microsoft couldn’t support their use with some earlier versions of Windows because the drives lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker supports the next generation of SEDs, which are called encrypted hard drives. -Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. +Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 11 or Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. For more information about encrypted hard drives, see [Encrypted Hard Drive](../encrypted-hard-drive.md). ## Preboot information protection An effective implementation of information protection, like most security controls, considers usability as well as security. Users typically prefer a simple security experience. In fact, the more transparent a security solution becomes, the more likely users are to conform to it. It is crucial that organizations protect information on their PCs regardless of the state of the computer or the intent of users. This protection should not be cumbersome to users. One undesirable and previously commonplace situation is when the user is prompted for input during preboot, and then again during Windows logon. Challenging users for input more than once should be avoided. -Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information, see [BitLocker Countermeasures](bitlocker-countermeasures.md). +Windows 11 and Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information, see [BitLocker Countermeasures](bitlocker-countermeasures.md). ## Manage passwords and PINs When BitLocker is enabled on a system drive and the PC has a TPM, you can choose to require that users type a PIN before BitLocker will unlock the drive. Such a PIN requirement can prevent an attacker who has physical access to a PC from even getting to the Windows logon, which makes it virtually impossible for the attacker to access or modify user data and system files. Requiring a PIN at startup is a useful security feature because it acts as a second authentication factor (a second “something you know”). This configuration comes with some costs, however. One of the most significant is the need to change the PIN regularly. In enterprises that used BitLocker with Windows 7 and the Windows Vista operating system, users had to contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis. -Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, Modern Standby devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. -For more information about how startup security works and the countermeasures that Windows 10 provides, see [Protect BitLocker from pre-boot attacks](./bitlocker-countermeasures.md). +Windows 11 and Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, Modern Standby devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. +For more information about how startup security works and the countermeasures that Windows 11 and Windows 10 provide, see [Protect BitLocker from pre-boot attacks](./bitlocker-countermeasures.md). ## Configure Network Unlock @@ -138,6 +141,6 @@ Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage * Enforces the BitLocker encryption policy options that you set for your enterprise. * Integrates with existing management tools, such as Microsoft Endpoint Configuration Manager. * Offers an IT-customizable recovery user experience. -* Supports Windows 10. +* Supports Windows 11 and Windows 10. For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/) on the MDOP TechCenter. \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md index c695b4b77c..25c64a62b1 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md +++ b/windows/security/information-protection/bitlocker/bitlocker-group-policy-settings.md @@ -22,7 +22,7 @@ ms.custom: bitlocker **Applies to:** -- Windows 10, Windows Server 2019, Windows Server 2016, Windows 8.1, and Windows Server 2012 R2 +- Windows 10, Windows 11, Windows Server 2019, Windows Server 2016, Windows 8.1, and Windows Server 2012 R2 This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker Drive Encryption. @@ -108,7 +108,7 @@ This policy setting allows users on devices that are compliant with Modern Stand | |   | |:---|:---| |**Policy description**|With this policy setting, you can allow TPM-only protection for newer, more secure devices, such as devices that support Modern Standby or HSTI, while requiring PIN on older devices.| -|**Introduced**|Windows 10, version 1703| +|**Introduced**|Windows 10, version 1703, or Windows 11| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption\Operating System Drives| |**Conflicts**|This setting overrides the **Require startup PIN with TPM** option of the [Require additional authentication at startup](#bkmk-unlockpol1) policy on compliant hardware.| @@ -247,8 +247,8 @@ If the PIN is 4 digits, all 9999 possible PIN combinations could be attempted in Increasing the PIN length requires a greater number of guesses for an attacker. In that case, the lockout duration between each guess can be shortened to allow legitimate users to retry a failed attempt sooner, while maintaining a similar level of protection. -Beginning with Windows 10, version 1703, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello. -To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. +Beginning with Windows 10, version 1703, or Windows 11, the minimum length for the BitLocker PIN was increased to 6 characters to better align with other Windows features that leverage TPM 2.0, including Windows Hello. +To help organizations with the transition, beginning with Windows 10, version 1709 and Windows 10, version 1703 with the October 2017, or Windows 11 [cumulative update](https://support.microsoft.com/help/4018124) installed, the BitLocker PIN length is 6 characters by default, but it can be reduced to 4 characters. If the minimum PIN length is reduced from the default of six characters, then the TPM 2.0 lockout period will be extended. ### Disable new DMA devices when this computer is locked @@ -258,7 +258,7 @@ This policy setting allows you to block direct memory access (DMA) for all hot p | |   | |:---|:---| |**Policy description**|This setting helps prevent attacks that use external PCI-based devices to access BitLocker keys.| -|**Introduced**|Windows 10, version 1703| +|**Introduced**|Windows 10, version 1703, or Windows 11| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| |**Conflicts**|None| @@ -612,7 +612,7 @@ This policy setting is used to control the encryption method and cipher strength |**Policy path**|Computer Configuration\Administrative Templates\Windows Components\BitLocker Drive Encryption| |**Conflicts**|None| |**When enabled**|You can choose an encryption algorithm and key cipher strength for BitLocker to use to encrypt drives.| -|**When disabled or not configured**|Beginning with Windows 10, version 1511, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| +|**When disabled or not configured**|Beginning with Windows 10, version 1511, or Windows 11, BitLocker uses the default encryption method of XTS-AES 128-bit or the encryption method that is specified by the setup script. Windows Phone does not support XTS; it uses AES-CBC 128-bit by default and supports AES-CBC 256-bit by policy.| **Reference** @@ -621,7 +621,7 @@ Enterprises may want to control the encryption level for increased security (AES If you enable this setting, you will be able to configure an encryption algorithm and key cipher strength for fixed data drives, operating system drives, and removable data drives individually. For fixed and operating system drives, we recommend that you use the XTS-AES algorithm. -For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511 or later. +For removable drives, you should use AES-CBC 128-bit or AES-CBC 256-bit if the drive will be used in other devices that are not running Windows 10, version 1511 or later, or Windows 11. Changing the encryption method has no effect if the drive is already encrypted or if encryption is in progress. In these cases, this policy setting is ignored. @@ -965,7 +965,7 @@ This policy setting is used to configure the entire recovery message and to repl | |   | |:---|:---| |**Policy description**|With this policy setting, you can configure the BitLocker recovery screen to display a customized message and URL.| -|**Introduced**|Windows 10| +|**Introduced**|Windows| |**Drive type**|Operating system drives| |**Policy path**|Computer Configuration \ Administrative Templates \ Windows Components \ BitLocker Drive Encryption \ Operating System Drives \ Configure pre-boot recovery message and URL| |**Conflicts**|None| diff --git a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md index 0327b8ec18..5adf857335 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md +++ b/windows/security/information-protection/bitlocker/bitlocker-how-to-enable-network-unlock.md @@ -21,7 +21,10 @@ ms.custom: bitlocker # BitLocker: How to enable Network Unlock **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This article for IT professionals describes how BitLocker Network Unlock works and how to configure it. diff --git a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md index 54f967207f..eabe91593f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md +++ b/windows/security/information-protection/bitlocker/bitlocker-management-for-enterprises.md @@ -35,11 +35,11 @@ Enterprises can use [Microsoft BitLocker Administration and Monitoring (MBAM)](/ ## Managing devices joined to Azure Active Directory -Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider/), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access/) to services like Exchange Online and SharePoint Online. +Devices joined to Azure AD are managed using Mobile Device Management (MDM) policy from an MDM solution such as Microsoft Intune. Without Windows 10, version 1809, or Windows 11, only local administrators can enable BitLocker via Intune policy. Starting with Windows 10, version 1809, or Windows 11, Intune can enable BitLocker for standard users. [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) status can be queried from managed machines via the [Policy Configuration Settings Provider (CSP)](/windows/client-management/mdm/policy-configuration-service-provider/), which reports on whether BitLocker Device Encryption is enabled on the device. Compliance with BitLocker Device Encryption policy can be a requirement for [Conditional Access](https://www.microsoft.com/cloud-platform/conditional-access/) to services like Exchange Online and SharePoint Online. -Starting with Windows 10 version 1703 (also known as the Windows Creators Update), the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider/) or the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp/). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 10 and on Windows phones. +Starting with Windows 10 version 1703 (also known as the Windows Creators Update), or Windows 11, the enablement of BitLocker can be triggered over MDM either by the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider/) or the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp/). The BitLocker CSP adds policy options that go beyond ensuring that encryption has occurred, and is available on computers that run Windows 11, Windows 10, and on Windows phones. -For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), admins can use the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. +For hardware that is compliant with Modern Standby and HSTI, when using either of these features, [BitLocker Device Encryption](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) is automatically turned on whenever the user joins a device to Azure AD. Azure AD provides a portal where recovery keys are also backed up, so users can retrieve their own recovery key for self-service, if required. For older devices that are not yet encrypted, beginning with Windows 10 version 1703 (the Windows 10 Creators Update), or Windows 11, admins can use the [BitLocker CSP](/windows/client-management/mdm/bitlocker-csp/) to trigger encryption and store the recovery key in Azure AD. This is applicable to Azure Hybrid AD as well. @@ -105,7 +105,7 @@ Enable-BitLocker -MountPoint "C:" -EncryptionMethod XtsAes256 -UsedSpaceOnly -Pi [Microsoft BitLocker Administration and Management (MBAM)](/microsoft-desktop-optimization-pack/mbam-v25/) -[Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) +[Overview of BitLocker Device Encryption in Windows](bitlocker-device-encryption-overview-windows-10.md#bitlocker-device-encryption) [BitLocker Group Policy Reference](./bitlocker-group-policy-settings.md) diff --git a/windows/security/information-protection/bitlocker/bitlocker-overview.md b/windows/security/information-protection/bitlocker/bitlocker-overview.md index 60ab1074cd..fd212875f8 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-overview.md +++ b/windows/security/information-protection/bitlocker/bitlocker-overview.md @@ -21,7 +21,10 @@ ms.custom: bitlocker # BitLocker **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This topic provides a high-level overview of BitLocker, including a list of system requirements, practical applications, and deprecated features. @@ -49,7 +52,7 @@ BitLocker control panel, and they are appropriate to use for automated deploymen ## New and changed functionality -To find out what's new in BitLocker for Windows 10, such as support for the XTS-AES encryption algorithm, see the [BitLocker](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10." +To find out what's new in BitLocker for Windows, such as support for the XTS-AES encryption algorithm, see the [BitLocker](/windows/whats-new/whats-new-windows-10-version-1507-and-1511#bitlocker) section in "What's new in Windows 10."   ## System requirements @@ -84,7 +87,7 @@ When installing the BitLocker optional component on a server you will also need | Topic | Description | | - | - | -| [Overview of BitLocker Device Encryption in Windows 10](bitlocker-device-encryption-overview-windows-10.md) | This topic for the IT professional provides an overview of the ways that BitLocker Device Encryption can help protect data on devices running Windows 10. | +| [Overview of BitLocker Device Encryption in Windows](bitlocker-device-encryption-overview-windows-10.md) | This topic for the IT professional provides an overview of the ways that BitLocker Device Encryption can help protect data on devices running Windows. | | [BitLocker frequently asked questions (FAQ)](bitlocker-frequently-asked-questions.yml) | This topic for the IT professional answers frequently asked questions concerning the requirements to use, upgrade, deploy and administer, and key management policies for BitLocker.| | [Prepare your organization for BitLocker: Planning and policies](prepare-your-organization-for-bitlocker-planning-and-policies.md)| This topic for the IT professional explains how can you plan your BitLocker deployment. | | [BitLocker basic deployment](bitlocker-basic-deployment.md) | This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. | @@ -95,7 +98,7 @@ When installing the BitLocker optional component on a server you will also need | [BitLocker Group Policy settings](bitlocker-group-policy-settings.md) | This topic for IT professionals describes the function, location, and effect of each Group Policy setting that is used to manage BitLocker. | | [BCD settings and BitLocker](bcd-settings-and-bitlocker.md) | This topic for IT professionals describes the BCD settings that are used by BitLocker.| | [BitLocker Recovery Guide](bitlocker-recovery-guide-plan.md)| This topic for IT professionals describes how to recover BitLocker keys from AD DS. | -| [Protect BitLocker from pre-boot attacks](./bitlocker-countermeasures.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. | +| [Protect BitLocker from pre-boot attacks](./bitlocker-countermeasures.md)| This detailed guide will help you understand the circumstances under which the use of pre-boot authentication is recommended for devices running Windows 11, Windows 10, Windows 8.1, Windows 8, or Windows 7; and when it can be safely omitted from a device’s configuration. | | [Troubleshoot BitLocker](troubleshoot-bitlocker.md) | This guide describes the resources that can help you troubleshoot BitLocker issues, and provides solutions for several common BitLocker issues. | | [Protecting cluster shared volumes and storage area networks with BitLocker](protecting-cluster-shared-volumes-and-storage-area-networks-with-bitlocker.md)| This topic for IT pros describes how to protect CSVs and SANs with BitLocker.| -| [Enabling Secure Boot and BitLocker Device Encryption on Windows 10 IoT Core](/windows/iot-core/secure-your-device/SecureBootAndBitLocker) | This topic covers how to use BitLocker with Windows 10 IoT Core | \ No newline at end of file +| [Enabling Secure Boot and BitLocker Device Encryption on Windows IoT Core](/windows/iot-core/secure-your-device/SecureBootAndBitLocker) | This topic covers how to use BitLocker with Windows IoT Core | \ No newline at end of file diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index eaccfb9c9f..54fbc0d5fd 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -22,7 +22,9 @@ ms.custom: bitlocker **Applies to:** -- Windows 10 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This article for IT professionals describes how to recover BitLocker keys from AD DS. @@ -123,7 +125,7 @@ Before you create a thorough BitLocker recovery process, we recommend that you t When planning the BitLocker recovery process, first consult your organization's current best practices for recovering sensitive information. For example: How does your enterprise handle lost Windows passwords? How does your organization perform smart card PIN resets? You can use these best practices and related resources (people and tools) to help formulate a BitLocker recovery model. -Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/mbam-v25/). +Organizations that rely on BitLocker Drive Encryption and BitLocker To Go to protect data on a large number of computers and removable drives running the Windows 11, Windows 10, Windows 8, or Windows 7 operating systems and Windows to Go should consider using the Microsoft BitLocker Administration and Monitoring (MBAM) Tool version 2.0, which is included in the Microsoft Desktop Optimization Pack (MDOP) for Microsoft Software Assurance. MBAM makes BitLocker implementations easier to deploy and manage and allows administrators to provision and monitor encryption for operating system and fixed drives. MBAM prompts the user before encrypting fixed drives. MBAM also manages recovery keys for fixed and removable drives, making recovery easier to manage. MBAM can be used as part of a Microsoft System Center deployment or as a stand-alone solution. For more info, see [Microsoft BitLocker Administration and Monitoring](/microsoft-desktop-optimization-pack/mbam-v25/). After a BitLocker recovery has been initiated, users can use a recovery password to unlock access to encrypted data. Consider both self-recovery and recovery password retrieval methods for your organization. @@ -291,7 +293,7 @@ During BitLocker recovery, Windows can display a custom recovery message and hin ### Custom recovery message -BitLocker Group Policy settings in Windows 10, version 1511, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support. +BitLocker Group Policy settings in Windows 10, version 1511, or Windows 11, let you configure a custom recovery message and URL on the BitLocker recovery screen, which can include the address of the BitLocker self-service recovery portal, the IT internal website, or a phone number for support. This policy can be configured using GPO under **Computer Configuration** > **Administrative Templates** > **Windows Components** > **BitLocker Drive Encryption** > **Operating System Drives** > **Configure pre-boot recovery message and URL**. @@ -307,7 +309,7 @@ Example of customized recovery screen: ### BitLocker recovery key hints -BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. +BitLocker metadata has been enhanced in Windows 10, version 1903 or Windows 11 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. ![Customized BitLocker recovery screen](./images/bl-password-hint2.png) diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index c6483a8057..7de4fac8f2 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -21,7 +21,10 @@ ms.custom: bitlocker # BitLocker: Use BitLocker Drive Encryption Tools to manage BitLocker **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This article for the IT professional describes how to use tools to manage BitLocker. diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md index ce88a53275..7c4a6c76bf 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-recovery-password-viewer.md @@ -21,7 +21,10 @@ ms.custom: bitlocker # BitLocker: Use BitLocker Recovery Password Viewer **Applies to** -- Windows 10 + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This topic for the IT professional describes how to use the BitLocker Recovery Password Viewer. diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index b3b6894cac..27cd120572 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -22,7 +22,9 @@ ms.custom: bitlocker **Applies to** -- Windows 10 +- Windows 10 +- Windows 11 +- Windows Server 2016 and above This topic for the IT professional explains how can you plan your BitLocker deployment. @@ -98,7 +100,7 @@ In your deployment plan, identify what TPM-based hardware platforms will be supp ### TPM 1.2 states and initialization -For TPM 1.2, there are multiple possible states. Windows 10 automatically initializes the TPM, which brings it to an enabled, activated, and owned state. This is the state that BitLocker requires before it can use the TPM. +For TPM 1.2, there are multiple possible states. Windows automatically initializes the TPM, which brings it to an enabled, activated, and owned state. This is the state that BitLocker requires before it can use the TPM. ### Endorsement keys diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index d41b2c7bf1..7766f6b14c 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -25,7 +25,7 @@ This article describes common issues that may prevent BitLocker from encrypting ## Error 0x80310059: BitLocker Drive Encryption is already performing an operation on this drive -When you turn on BitLocker Drive Encryption on a computer that is running Windows 10 Professional, you receive a message that resembles the following: +When you turn on BitLocker Drive Encryption on a computer that is running Windows 10 Professional or Windows 11, you receive a message that resembles the following: > **ERROR:** An error occurred (code 0x80310059):BitLocker Drive Encryption is already performing an operation on this drive. Please complete all operations before continuing.NOTE: If the -on switch has failed to add key protectors or start encryption,you may need to call manage-bde -off before attempting -on again. @@ -52,7 +52,7 @@ To resolve this issue, follow these steps: ## "Access is denied" message when you try to encrypt removable drives -You have a computer that is running Windows 10, version 1709 or version 1607. You try to encrypt a USB drive by following these steps: +You have a computer that is running Windows 10, version 1709 or version 1607, or Windows 11. You try to encrypt a USB drive by following these steps: 1. In Windows Explorer, right-click the USB drive and select **Turn on BitLocker**. 1. On the **Choose how you want to unlock this drive** page, select **Use a password to unlock the drive**. @@ -60,7 +60,7 @@ You have a computer that is running Windows 10, version 1709 or version 1607. Yo 1. On the **Are you ready to encrypt this drive?** page, select **Start encrypting**. 1. The **Starting encryption** page displays the message "Access is denied." -You receive this message on any computer that runs Windows 10 version 1709 or version 1607, when you use any USB drive. +You receive this message on any computer that runs Windows 10 version 1709 or version 1607, or Windows 11, when you use any USB drive. ### Cause diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md index 36adf14e88..6b1ee39717 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-config-issues.md @@ -20,9 +20,9 @@ ms.custom: bitlocker This article describes common issues that affect your BitLocker configuration and BitLocker's general functionality. This article also provides guidance to address these issues. -## BitLocker encryption is slower in Windows 10 +## BitLocker encryption is slower in Windows 10 and Windows 11 -In both Windows 10 and Windows 7, BitLocker runs in the background to encrypt drives. However, in Windows 10, BitLocker is less aggressive about requesting resources. This behavior reduces the chance that BitLocker will affect the computer's performance. +In both Windows 11, Windows 10, and Windows 7, BitLocker runs in the background to encrypt drives. However, in Windows 11 and Windows 10, BitLocker is less aggressive about requesting resources. This behavior reduces the chance that BitLocker will affect the computer's performance. To compensate for these changes, BitLocker uses a new conversion model. This model, (referred to as Encrypt-On-Write), makes sure that any new disk writes on all client SKUs and any internal drives are always encrypted *as soon as you turn on BitLocker*. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index bab9c21e3e..541e093039 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -31,7 +31,7 @@ For more information about Measured Boot and PCRs, see the following articles: ## Use TBSLogGenerator to decode Measured Boot logs -Use TBSLogGenerator to decode Measured Boot logs that you have collected from Windows 10 and earlier versions. You can install this tool on the following systems: +Use TBSLogGenerator to decode Measured Boot logs that you have collected from Windows 11, Windows 10, and earlier versions. You can install this tool on the following systems: - A computer that is running Windows Server 2016 and that has a TPM enabled - A Gen 2 virtual machine (running on Hyper-V) that is running Windows Server 2016 (you can use the virtual TPM) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 60c34a7bb6..85fd424c68 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -98,7 +98,7 @@ You can resolve this issue by verifying the configuration of the disk partitions #### Step 1: Verify the configuration of the disk partitions -The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 10 automatically creates a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. +The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 11 and Windows 10 automatically create a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. ![Default disk partitions, including the recovery partition](./images/4509194-en-1.png) @@ -221,7 +221,7 @@ To verify the Secure Boot state, use the System Information app. To do this, fol ## Event ID 846, 778, and 851: Error 0x80072f9a -In this case, you are deploying Intune policy to encrypt a Windows 10, version 1809 device and store the recovery password in Azure Active Directory (Azure AD). As part of the policy configuration, you have selected the **Allow standard users to enable encryption during Azure AD Join** option. +In this case, you are deploying Intune policy to encrypt a Windows 11, Windows 10, version 1809 device, and store the recovery password in Azure Active Directory (Azure AD). As part of the policy configuration, you have selected the **Allow standard users to enable encryption during Azure AD Join** option. The policy deployment fails and generates the following events (visible in Event Viewer in the **Applications and Services Logs\\Microsoft\\Windows\\BitLocker API** folder): @@ -250,7 +250,7 @@ These events refer to Error code 0x80072f9a. These events indicate that the signed-in user does not have permission to read the private key on the certificate that is generated as part of the provisioning and enrollment process. Therefore, the BitLocker MDM policy refresh fails. -The issue affects Windows 10 version 1809. +The issue affects Windows 11 and Windows 10 version 1809. ### Resolution @@ -282,11 +282,11 @@ For information about how to use policy together with BitLocker and Intune, see Intune offers the following enforcement types for BitLocker: -- **Automatic** (Enforced when the device joins Azure AD during the provisioning process. This option is available in Windows 10 version 1703 and later.) -- **Silent** (Endpoint protection policy. This option is available in Windows 10 version 1803 and later.) -- **Interactive** (Endpoint policy for Windows versions that are older than Windows 10 version 1803.) +- **Automatic** (Enforced when the device joins Azure AD during the provisioning process. This option is available in Windows 10 version 1703 and later, or Windows 11.) +- **Silent** (Endpoint protection policy. This option is available in Windows 10 version 1803 and later, or Windows 11.) +- **Interactive** (Endpoint policy for Windows versions that are older than Windows 10 version 1803, or Windows 11.) -If your device runs Windows 10 version 1703 or later, supports Modern Standby (also known as Instant Go) and is HSTI-compliant, joining the device to Azure AD triggers automatic device encryption. A separate endpoint protection policy is not required to enforce device encryption. +If your device runs Windows 10 version 1703 or later, or Windows 11, supports Modern Standby (also known as Instant Go) and is HSTI-compliant, joining the device to Azure AD triggers automatic device encryption. A separate endpoint protection policy is not required to enforce device encryption. If your device is HSTI-compliant but does not support Modern Standby, you have to configure an endpoint protection policy to enforce silent BitLocker Drive Encryption. The settings for this policy should resemble the following: @@ -303,18 +303,18 @@ The OMA-URI references for these settings are as follows: Value: **0** (0 = Blocked, 1 = Allowed) > [!NOTE] -> Because of an update to the BitLocker Policy CSP, if the device uses Windows 10 version 1809 or later, you can use an endpoint protection policy to enforce silent BitLocker Device Encryption even if the device is not HSTI-compliant. +> Because of an update to the BitLocker Policy CSP, if the device uses Windows 10 version 1809 or later, or Windows 11, you can use an endpoint protection policy to enforce silent BitLocker Device Encryption even if the device is not HSTI-compliant. > [!NOTE] > If the **Warning for other disk encryption** setting is set to **Not configured**, you have to manually start the BitLocker Drive Encryption wizard. -If the device does not support Modern Standby but is HSTI-compliant, and it uses a version of Windows that is earlier than Windows 10, version 1803, an endpoint protection policy that has the settings that are described in this article delivers the policy configuration to the device. However, Windows then notifies the user to manually enable BitLocker Drive Encryption. To do this, the user selects the notification. This action starts the BitLocker Drive Encryption wizard. +If the device does not support Modern Standby but is HSTI-compliant, and it uses a version of Windows that is earlier than Windows 10, version 1803, or Windows 11, an endpoint protection policy that has the settings that are described in this article delivers the policy configuration to the device. However, Windows then notifies the user to manually enable BitLocker Drive Encryption. To do this, the user selects the notification. This action starts the BitLocker Drive Encryption wizard. The Intune 1901 release provides settings that you can use to configure automatic device encryption for Autopilot devices for standard users. Each device must meet the following requirements: - Be HSTI-compliant - Support Modern Standby -- Use Windows 10 version 1803 or later +- Use Windows 10 version 1803 or later, or Windows 11 ![Intune policy setting](./images/4509188-en-1.png) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md index 9d48930488..aa70c53412 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-recovery-issues.md @@ -23,9 +23,9 @@ This article describes common issues that may prevent BitLocker from behaving as > [!NOTE] > In this article, "recovery password" refers to the 48-digit recovery password and "recovery key" refers to 32-digit recovery key. For more information, see [BitLocker key protectors](./prepare-your-organization-for-bitlocker-planning-and-policies.md#bitlocker-key-protectors). -## Windows 10 prompts for a non-existing BitLocker recovery password +## Windows prompts for a non-existing BitLocker recovery password -Windows 10 prompts you for a BitLocker recovery password. However, you did not configure a BitLocker recovery password. +Windows prompts you for a BitLocker recovery password. However, you did not configure a BitLocker recovery password. ### Resolution @@ -37,7 +37,7 @@ The BitLocker and Active Directory Domain Services (AD DS) FAQ addresses situati ## The recovery password for a laptop was not backed up, and the laptop is locked -You have a Windows 10 Home-based laptop, and you have to recover its hard disk. The disk was encrypted by using BitLocker Driver Encryption. However, the BitLocker recovery password was not backed up, and the usual user of the laptop is not available to provide the password. +You have a Windows 11 or Windows 10 Home-based laptop, and you have to recover its hard disk. The disk was encrypted by using BitLocker Driver Encryption. However, the BitLocker recovery password was not backed up, and the usual user of the laptop is not available to provide the password. ### Resolution @@ -223,7 +223,7 @@ To re-enable BitLocker Drive Encryption, select **Start**, type **Manage BitLock ## After you install an update to a Hyper V-enabled computer, BitLocker prompts for the recovery password and returns error 0xC0210000 -You have a device that runs Windows 10, version 1703, Windows 10, version 1607, or Windows Server 2016. Also, Hyper-V is enabled on the device. After you install an affected update and restart the device, the device enters BitLocker Recovery mode and you see error code 0xC0210000. +You have a device that runs Windows 11, Windows 10, version 1703, Windows 10, version 1607, or Windows Server 2016. Also, Hyper-V is enabled on the device. After you install an affected update and restart the device, the device enters BitLocker Recovery mode and you see error code 0xC0210000. ### Workaround @@ -262,12 +262,12 @@ Manage-bde -protectors -disable c: -rc 1 To resolve this issue, install the appropriate update on the affected device: -- For Windows 10, version 1703: [July 9, 2019—KB4507450 (OS Build 15063.1928)](https://support.microsoft.com/help/4507450/windows-10-update-kb4507450) -- For Windows 10, version 1607 and Windows Server 2016: [July 9, 2019—KB4507460 (OS Build 14393.3085)](https://support.microsoft.com/help/4507460/windows-10-update-kb4507460) +- For Windows 10, version 1703, or Windows 11: [July 9, 2019—KB4507450 (OS Build 15063.1928)](https://support.microsoft.com/help/4507450/windows-10-update-kb4507450) +- For Windows 11, Windows 10, version 1607 and Windows Server 2016: [July 9, 2019—KB4507460 (OS Build 14393.3085)](https://support.microsoft.com/help/4507460/windows-10-update-kb4507460) ## Credential Guard/Device Guard on TPM 1.2: At every restart, BitLocker prompts for the recovery password and returns error 0xC0210000 -You have a device that uses TPM 1.2 and runs Windows 10, version 1809. Also, the device uses [Virtualization-based Security](/windows-hardware/design/device-experiences/oem-vbs) features such as [Device Guard and Credential Guard](/windows-hardware/drivers/bringup/device-guard-and-credential-guard). Every time that you start the device, the device enters BitLocker Recovery mode and you see error code 0xc0210000, and a message that resembles the following. +You have a device that uses TPM 1.2 and runs Windows 10, version 1809, or Windows 11. Also, the device uses [Virtualization-based Security](/windows-hardware/design/device-experiences/oem-vbs) features such as [Device Guard and Credential Guard](/windows-hardware/drivers/bringup/device-guard-and-credential-guard). Every time that you start the device, the device enters BitLocker Recovery mode and you see error code 0xc0210000, and a message that resembles the following. > Recovery > @@ -282,7 +282,7 @@ You have a device that uses TPM 1.2 and runs Windows 10, version 1809. Also, the TPM 1.2 does not support Secure Launch. For more information, see [System Guard Secure Launch and SMM protection: Requirements Met by System Guard Enabled Machines](../../threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) -For more information about this technology, see [Windows Defender System Guard: How a hardware-based root of trust helps protect Windows 10](../../threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) +For more information about this technology, see [Windows Defender System Guard: How a hardware-based root of trust helps protect Windows](../../threat-protection/windows-defender-system-guard/system-guard-how-hardware-based-root-of-trust-helps-protect-windows.md) ### Resolution diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md index 8f914dd05c..6f05c69982 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-tpm-issues.md @@ -66,7 +66,7 @@ To resolve this issue, follow these steps to troubleshoot the TPM: ## TPM 1.2 Error: Loading the management console failed. The device that is required by the cryptographic provider is not ready for use -You have a Windows 10 version 1703-based computer that uses TPM version 1.2. When you try to open the TPM management console, you receive a message that resembles the following: +You have a Windows 11 or Windows 10 version 1703-based computer that uses TPM version 1.2. When you try to open the TPM management console, you receive a message that resembles the following: > Loading the management console failed. The device that is required by the cryptographic provider is not ready for use. > HRESULT 0x800900300x80090030 - NTE\_DEVICE\_NOT\_READY @@ -103,8 +103,8 @@ This issue may occur when the Windows operating system is not the owner of the T |Message |Reason | Resolution| | - | - | - | |NTE\_BAD\_KEYSET (0x80090016/-2146893802) |TPM operation failed or was invalid |This issue was probably caused by a corrupted sysprep image. Make sure that you create the sysprep image by using a computer that is not joined to or registered in Azure AD or hybrid Azure AD. | -|TPM\_E\_PCP\_INTERNAL\_ERROR (0x80290407/-2144795641) |Generic TPM error. |If the device returns this error, disable its TPM. Windows 10, version 1809 and later versions automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | -|TPM\_E\_NOTFIPS (0x80280036/-2144862154) |The FIPS mode of the TPM is currently not supported. |If the device gives this error, disable its TPM. Windows 10, version 1809 and later versions automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | +|TPM\_E\_PCP\_INTERNAL\_ERROR (0x80290407/-2144795641) |Generic TPM error. |If the device returns this error, disable its TPM. Windows 10, version 1809 and later versions, or Windows 11 automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | +|TPM\_E\_NOTFIPS (0x80280036/-2144862154) |The FIPS mode of the TPM is currently not supported. |If the device gives this error, disable its TPM. Windows 10, version 1809 and later versions, or Windows 11 automatically detect TPM failures and finish the hybrid Azure AD join without using the TPM. | |NTE\_AUTHENTICATION\_IGNORED (0x80090031/-2146893775) |The TPM is locked out. |This error is transient. Wait for the cooldown period, and then retry the join operation. | For more information about TPM issues, see the following articles: From b6b9d3accf833e49dd7b64e3890adb0f832bac0f Mon Sep 17 00:00:00 2001 From: Alice-at-Microsoft <79878795+Alice-at-Microsoft@users.noreply.github.com> Date: Tue, 24 Aug 2021 10:11:18 -0700 Subject: [PATCH 0106/1214] Update policy-csp-system.md Update AllowWUfBCloudProcessing --- windows/client-management/mdm/policy-csp-system.md | 13 +++++++++++-- 1 file changed, 11 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index b02ba826b4..0a38aefabc 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -62,7 +62,7 @@ manager: dansimp System/AllowUserToResetPhone
- System/AllowWuFBCloudProcessing + System/AllowWUfBCloudProcessing
System/BootStartDriverInitialization @@ -964,7 +964,7 @@ The following list shows the supported values:
-**System/AllowWuFBCloudProcessing** +**System/AllowWUfBCloudProcessing**
@@ -985,6 +985,15 @@ If you disable or do not configure this policy setting, devices enrolled to the
+ + +The following list shows the supported values: + +- 0 - Disabled. +- 8 - Enabled. + + + **System/BootStartDriverInitialization** From 8fa4270748c2aed4cbbe2ea46134c35adede2222 Mon Sep 17 00:00:00 2001 From: Benzy Dharmanayagam Date: Tue, 24 Aug 2021 22:45:46 +0530 Subject: [PATCH 0107/1214] Fixed suggestion --- ...ur-organization-for-bitlocker-planning-and-policies.md | 8 ++++---- .../bitlocker/ts-bitlocker-cannot-encrypt-issues.md | 2 +- .../bitlocker/ts-bitlocker-intune-issues.md | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md index 27cd120572..8a15267bc2 100644 --- a/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md +++ b/windows/security/information-protection/bitlocker/prepare-your-organization-for-bitlocker-planning-and-policies.md @@ -62,7 +62,7 @@ On computers that do not have a TPM version 1.2 or higher, you can still use Bi | TPM | A hardware device used to help establish a secure root-of-trust. BitLocker only supports TPM version 1.2 or higher.| | PIN | A user-entered numeric key protector that can only be used in addition to the TPM.| | Enhanced PIN | A user-entered alphanumeric key protector that can only be used in addition to the TPM.| -| Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or in conjunction with a TPM for added security.| +| Startup key | An encryption key that can be stored on most removable media. This key protector can be used alone on non-TPM computers, or with a TPM for added security.| | Recovery password | A 48-digit number used to unlock a volume when it is in recovery mode. Numbers can often be typed on a regular keyboard, if the numbers on the normal keyboard are not responding you can always use the function keys (F1-F10) to input the numbers.| | Recovery key| An encryption key stored on removable media that can be used for recovering data encrypted on a BitLocker volume.| @@ -88,7 +88,7 @@ However, TPM-only authentication method offers the lowest level of data protecti **What areas of your organization need a more secure level of data protection?** -If there are areas of your organization where data residing on user computers is considered highly-sensitive, consider the best practice of deploying BitLocker with multifactor authentication on those systems. Requiring the user to input a PIN significantly increases the level of protection for the system. You can also use BitLocker Network Unlock to allow these computers to automatically unlock when connected to a trusted wired network that can provide the Network Unlock key. +If there are areas of your organization where data residing on user computers is considered highly sensitive, consider the best practice of deploying BitLocker with multifactor authentication on those systems. Requiring the user to input a PIN significantly increases the level of protection for the system. You can also use BitLocker Network Unlock to allow these computers to automatically unlock when connected to a trusted wired network that can provide the Network Unlock key. **What multifactor authentication method does your organization prefer?** @@ -127,7 +127,7 @@ Test your individual hardware platforms with the BitLocker system check option w To function correctly, BitLocker requires a specific disk configuration. BitLocker requires two partitions that meet the following requirements: - The operating system partition contains the operating system and its support files; it must be formatted with the NTFS file system -- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size +- The system partition (or boot partition) contains the files that are needed to load Windows after the BIOS or UEFI firmware has prepared the system hardware. BitLocker is not enabled on this partition. For BitLocker to work, the system partition must not be encrypted and must be on a different partition than the operating system. On UEFI platforms, the system partition must be formatted with the FAT 32 file system. On BIOS platforms the system partition must be formatted with the NTFS file system. It should be at least 350 MB in size Windows setup will automatically configure the disk drives of your computer to support BitLocker encryption. @@ -139,7 +139,7 @@ Windows RE can also be used from boot media other than the local hard disk. If y In Windows Vista and Windows 7, BitLocker was provisioned post installation for system and data volumes through either the manage-bde command line interface or the Control Panel user interface. With newer operating systems, BitLocker can be easily provisioned before the operating system is installed. Preprovisioning requires that the computer have a TPM. -To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet or Windows Explorer. A status of "Waiting For Activation" with a yellow exclamation icon means that the drive was preprovisioned for BitLocker. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not protected and needs to have a secure key added to the volume before the drive is considered fully protected. Administrators can use the control panel options, manage-bde tool or WMI APIs to add an appropriate key protector and the volume status will be updated. +To check the BitLocker status of a particular volume, administrators can look at the status of the drive in the BitLocker control panel applet or Windows Explorer. A status of "Waiting For Activation" with a yellow exclamation icon means that the drive was preprovisioned for BitLocker. This status means that there was only a clear protector used when encrypting the volume. In this case, the volume is not protected and needs to have a secure key added to the volume before the drive is considered fully protected. Administrators can use the control panel options, manage-bde tool, or WMI APIs to add an appropriate key protector and the volume status will be updated. When using the control panel options, administrators can choose to **Turn on BitLocker** and follow the steps in the wizard to add a protector, such as a PIN for an operating system volume (or a password if no TPM exists), or a password or smart card protector to a data volume. Then the drive security window is presented prior to changing the volume status. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index 7766f6b14c..1861e5f188 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -80,7 +80,7 @@ To verify that this issue has occurred, follow these steps: > D:(A;;CCDCLCSWRPWPDTLORCWDWO;;;SY)(A;;CCDCLCSWRPWPDTLORCWDWO;;;BA)(A;;CCLCSWRPLORC;;;BU)(A;;CCLCSWRPLORC;;;AU)S:(AU;FA;CCDCLCSWRPWPDTLOSDRCWDWO;;;WD) -1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring?view=powershell-6) command in the PowerShell window, as follows. +1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring) command in the PowerShell window, as follows. ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE](./images/ts-bitlocker-usb-sddl.png) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 85fd424c68..4234def6cf 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -209,7 +209,7 @@ To verify the Secure Boot state, use the System Information app. To do this, fol ![System Information app, showing a unsupported Secure Boot State](./images/4509202-en-1.png) > [!NOTE] -> You can also use the [Confirm-SecureBootUEFI](/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: +> You can also use the [Confirm-SecureBootUEFI](/powershell/module/secureboot/confirm-securebootuefi) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: > ```ps > PS C:\> Confirm-SecureBootUEFI > ``` From e5e0e83b89d02681d4315027d890f7321d38a040 Mon Sep 17 00:00:00 2001 From: Evan Miller Date: Tue, 24 Aug 2021 10:46:27 -0700 Subject: [PATCH 0108/1214] place steps in policy --- .../mdm/policy-csp-mixedreality.md | 28 +++++++++---------- 1 file changed, 14 insertions(+), 14 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index cdf909411f..7f7e8ae961 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -40,20 +40,6 @@ manager: dansimp
-Steps to use this policy correctly: - -1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). -1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). - 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays - 1. The value can be between min / max allowed. -1. Enroll HoloLens devices and verify both configurations get applied to the device. -1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. -1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. -1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. - -> [!NOTE] -> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. -
@@ -79,6 +65,20 @@ Steps to use this policy correctly:

Your organization's computers are running a combination of the following operating systems:

    +
  • Windows 11

  • Windows 10

  • Windows 8

  • Windows 7

  • @@ -130,6 +136,7 @@ If your organization supports multiple Windows operating systems, app control po

Your organization's computers are running only the following operating systems:

    +
  • Windows 11

  • Windows 10

  • Windows 8.1

  • Windows 8

  • diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index 5350f5c843..05ac74902a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -1,5 +1,5 @@ --- -title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows 10) +title: Understand AppLocker rules and enforcement setting inheritance in Group Policy (Windows) description: This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. ms.assetid: c1c5a3d3-540a-4698-83b5-0dab5d27d871 ms.reviewer: @@ -21,12 +21,17 @@ ms.technology: mde # Understand AppLocker rules and enforcement setting inheritance in Group Policy **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes how application control policies configured in AppLocker are applied through Group Policy. -Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. +Rule enforcement is applied only to collections of rules, not individual rules. AppLocker divides the rules into the following collections: executable files, Windows Installer files, scripts, packaged apps, and packaged app installers, and DLL files. The options for rule enforcement are **Not configured**, **Enforce rules**, or **Audit only**. Together, all AppLocker rule collections compose the application control policy, or AppLocker policy. Group Policy merges AppLocker policy in two ways: diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index 0f909bdf3d..f3554e846c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -1,5 +1,5 @@ --- -title: Understand the AppLocker policy deployment process (Windows 10) +title: Understand the AppLocker policy deployment process (Windows) description: This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. ms.assetid: 4cfd95c1-fbd3-41fa-8efc-d23c1ea6fb16 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understand the AppLocker policy deployment process **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This planning and deployment topic for the IT professional describes the process for using AppLocker when deploying application control policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md index 941aa4f30d..319498a599 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-allow-and-deny-actions-on-rules.md @@ -1,5 +1,5 @@ --- -title: Understanding AppLocker allow and deny actions on rules (Windows 10) +title: Understanding AppLocker allow and deny actions on rules (Windows) description: This topic explains the differences between allow and deny actions on AppLocker rules. ms.assetid: ea0370fa-2086-46b5-a0a4-4a7ead8cbed9 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding AppLocker allow and deny actions on rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the differences between allow and deny actions on AppLocker rules. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md index e9e449b52e..7a33f4dde5 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-default-rules.md @@ -1,5 +1,5 @@ --- -title: Understanding AppLocker default rules (Windows 10) +title: Understanding AppLocker default rules (Windows) description: This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. ms.assetid: bdb03d71-05b7-41fb-96e3-a289ce1866e1 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding AppLocker default rules **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professional describes the set of rules that can be used to ensure that required Windows system files are allowed to run when the policy is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md index 041eee8f69..92f40c3d8c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-behavior.md @@ -1,5 +1,5 @@ --- -title: Understanding AppLocker rule behavior (Windows 10) +title: Understanding AppLocker rule behavior (Windows) description: This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. ms.assetid: 3e2738a3-8041-4095-8a84-45c1894c97d0 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding AppLocker rule behavior **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes how AppLocker rules are enforced by using the allow and deny options in AppLocker. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md index 319c895fd9..e8cf87080b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-collections.md @@ -1,5 +1,5 @@ --- -title: Understanding AppLocker rule collections (Windows 10) +title: Understanding AppLocker rule collections (Windows) description: This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. ms.assetid: 03c05466-4fb3-4880-8d3c-0f6f59fc5579 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding AppLocker rule collections **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the five different types of AppLocker rules used to enforce AppLocker policies. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md index 8dfb91c58e..80ce31b642 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-condition-types.md @@ -1,5 +1,5 @@ --- -title: Understanding AppLocker rule condition types (Windows 10) +title: Understanding AppLocker rule condition types (Windows) description: This topic for the IT professional describes the three types of AppLocker rule conditions. ms.assetid: c21af67f-60a1-4f7d-952c-a6f769c74729 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding AppLocker rule condition types **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes the three types of AppLocker rule conditions. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md index eb3084b691..c4cf8ac3ea 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-applocker-rule-exceptions.md @@ -1,5 +1,5 @@ --- -title: Understanding AppLocker rule exceptions (Windows 10) +title: Understanding AppLocker rule exceptions (Windows) description: This topic describes the result of applying AppLocker rule exceptions to rule collections. ms.assetid: e6bb349f-ee60-4c8d-91cd-6442f2d0eb9c ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding AppLocker rule exceptions **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic describes the result of applying AppLocker rule exceptions to rule collections. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md index 7a8bfc63d1..1bb2c999af 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-file-hash-rule-condition-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Understanding the file hash rule condition in AppLocker (Windows 10) +title: Understanding the file hash rule condition in AppLocker (Windows) description: This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 4c6d9af4-2b1a-40f4-8758-1a6f9f147756 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding the file hash rule condition in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the AppLocker file hash rule condition, the advantages and disadvantages, and how it is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md index 057a3dabde..e8856ed8ee 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-path-rule-condition-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Understanding the path rule condition in AppLocker (Windows 10) +title: Understanding the path rule condition in AppLocker (Windows) description: This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. ms.assetid: 3fa54ded-4466-4f72-bea4-2612031cad43 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding the path rule condition in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the AppLocker path rule condition, the advantages and disadvantages, and how it is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md index 8636e3b8dd..8dade37801 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understanding-the-publisher-rule-condition-in-applocker.md @@ -1,5 +1,5 @@ --- -title: Understanding the publisher rule condition in AppLocker (Windows 10) +title: Understanding the publisher rule condition in AppLocker (Windows) description: This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. ms.assetid: df61ed8f-a97e-4644-9d0a-2169f18c1c4f ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Understanding the publisher rule condition in AppLocker **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic explains the AppLocker publisher rule condition, what controls are available, and how it is applied. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md index 228ca42a8d..a283a7ab4f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-a-reference-computer-to-create-and-maintain-applocker-policies.md @@ -1,5 +1,5 @@ --- -title: Use a reference device to create and maintain AppLocker policies (Windows 10) +title: Use a reference device to create and maintain AppLocker policies (Windows) description: This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. ms.assetid: 10c3597f-f44c-4c8e-8fe5-105d4ac016a6 ms.author: macapara @@ -21,8 +21,13 @@ ms.technology: mde # Use a reference device to create and maintain AppLocker policies **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for the IT professional describes the steps to create and maintain AppLocker policies by using a reference computer. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md index b6018803fb..6dcd91c001 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/use-applocker-and-software-restriction-policies-in-the-same-domain.md @@ -1,5 +1,5 @@ --- -title: Use AppLocker and Software Restriction Policies in the same domain (Windows 10) +title: Use AppLocker and Software Restriction Policies in the same domain (Windows) description: This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. ms.assetid: 2b7e0cec-df62-49d6-a2b7-6b8e30180943 ms.reviewer: @@ -21,8 +21,13 @@ ms.technology: mde # Use AppLocker and Software Restriction Policies in the same domain **Applies to** -- Windows 10 -- Windows Server + +- Windows 10 +- Windows 11 +- Windows Server 2016 and above + +>[!NOTE] +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](/windows/security/threat-protection/windows-defender-application-control/feature-availability). This topic for IT professionals describes concepts and procedures to help you manage your application control strategy using Software Restriction Policies and AppLocker. @@ -71,8 +76,8 @@ The following table compares the features and functions of Software Restriction

Enforcement mode

SRP works in the “deny list mode” where administrators can create rules for files that they do not want to allow in this Enterprise whereas the rest of the file is allowed to run by default.

-

SRP can also be configured in the “allow list mode” so that by default all files are blocked and administrators need to create allow rules for files that they want to allow.

AppLocker by default works in the “allow list mode” where only those files are allowed to run for which there is a matching allow rule.

AppLocker by default works in the “allowlist mode” where only those files are allowed to run for which there is a matching allow rule.

File types that can be controlled

Editing the hash value

In Windows XP, you could use SRP to provide custom hash values.

Beginning with Windows 7 and Windows Server 2008 R2, you can only select the file to hash, not provide the hash value.

AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and a SHA2 flat file hash for the rest.

AppLocker computes the hash value itself. Internally, it uses the SHA2 Authenticode hash for Portable Executables (exe and dll) and Windows Installers and an SHA2 flat file hash for the rest.

Support for different security levels

+Steps to use this policy correctly: + +1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). +1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). + 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays + 1. The value can be between min / max allowed. +1. Enroll HoloLens devices and verify both configurations get applied to the device. +1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. +1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. +1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. + +> [!NOTE] +> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. +


From 5c4750b396c242154e643b8204b6bc02b6752e8d Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Tue, 24 Aug 2021 12:56:06 -0700 Subject: [PATCH 0109/1214] fix links --- windows/deployment/TOC.yml | 2 ++ windows/deployment/index.yml | 2 +- 2 files changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index d61509c788..967f57f92e 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -271,6 +271,8 @@ href: update/how-windows-update-works.md - name: Windows 10 upgrade paths href: upgrade/windows-10-upgrade-paths.md + - name: Windows 10 edition upgrade + href: upgrade/windows-10-edition-upgrades.md - name: Deploy Windows 10 with Microsoft 365 href: deploy-m365.md - name: Understand the Unified Update Platform diff --git a/windows/deployment/index.yml b/windows/deployment/index.yml index d938c4922b..1bb703d0bf 100644 --- a/windows/deployment/index.yml +++ b/windows/deployment/index.yml @@ -67,7 +67,7 @@ landingContent: - text: What's new in Windows deployment url: deploy-whats-new.md - text: Windows 11 overview - url: /windows/whats-new/windows-11.md + url: /windows/whats-new/windows-11 - text: Windows client deployment scenarios url: windows-10-deployment-scenarios.md - text: Basics of Windows updates, channels, and tools From a3369733d619fe6cdd8089bcc99b6bc579da9a74 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Tue, 24 Aug 2021 20:03:56 -0600 Subject: [PATCH 0110/1214] dh-ep-various --- .../demonstrate-deployment-on-vm.md | 60 +++++++++---------- 1 file changed, 30 insertions(+), 30 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 0c231195de..476b544dc0 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -733,7 +733,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q ![Add app step 5](images/app06.png) -Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have a .msi version of their program, but we got a .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). +Simply using an install command like "notepad++.exe /S" doesn't actually install Notepad++; it only launches the app. To install the program, you need to use the .msi file instead. Notepad++ doesn't have a .msi version of their program, but there's a .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). Select **OK** to save your input and activate the **Requirements** blade. @@ -742,12 +742,12 @@ On the **Requirements Configuration** blade, specify the **OS architecture** and > [!div class="mx-imgBorder"] > ![Add app step 6](images/app07.png) -Next, configure the **Detection rules**. For our purposes, we will select manual format: +Next, configure the **Detection rules**. For the purpose of this lab, select manual format: > [!div class="mx-imgBorder"] > ![Add app step 7](images/app08.png) -Select **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: +Select **Add** to define the rule properties. For **Rule type**, select **MSI**, which automatically imports the correct MSI product code into the rule: ![Add app step 8](images/app09.png) @@ -760,16 +760,16 @@ Select **OK** twice to save, as you back out to the main **Add app** blade again Select **OK** to exit. -You may skip configuring the final **Scope (Tags)** blade. +You can skip configuring the final **Scope (Tags)** blade. Select the **Add** button to finalize and save your app package. -Once the indicator message says the addition has completed. +Wait for indicator message that says the addition has completed. > [!div class="mx-imgBorder"] > ![Add app step 10](images/app11.png) -You will be able to find your app in your app list: +Find your app in your app list: > [!div class="mx-imgBorder"] > ![Add app step 11](images/app12.png) @@ -777,16 +777,16 @@ You will be able to find your app in your app list: #### Assign the app to your Intune profile > [!NOTE] -> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you haven't done that, return to the main part of the lab and complete those steps before returning here. In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then select **Assignments** from the menu: > [!div class="mx-imgBorder"] > ![Assign app step 1](images/app13.png) -Select **Add Group** to open the **Add group** pane that is related to the app. +Select **Add Group** to open the **Add group** pane that's related to the app. -For our purposes, select **Required** from the **Assignment type** dropdown menu. +For the purpose of this lab, select **Required** from the **Assignment type** dropdown menu. > [!NOTE] > **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. @@ -817,7 +817,7 @@ For more information on adding apps to Intune, see [Intune Standalone - Win32 ap #### Create app in Intune -Log into the Azure portal and select **Intune**. +Log in to the Azure portal and select **Intune**. Go to **Intune > Clients apps > Apps**, and then select the **Add** button to create a new app package. @@ -827,14 +827,14 @@ Under **App Type**, select **Office 365 Suite > Windows 10**: ![Create app step 2](images/app18.png) -Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this lab we have only selected Excel: +Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this lab, only select Excel: > [!div class="mx-imgBorder"] > ![Create app step 3](images/app19.png) Select **OK**. -In the **App Suite Information** pane, enter a unique suite name, and a suitable description. +In the **App Suite Information** pane, enter a *unique* suite name, and a suitable description. Enter the name of the app suite as it's displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. @@ -843,7 +843,7 @@ Enter the name of the app suite as it's displayed in the company portal. Make su Select **OK**. -In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: +In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection is okay for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: ![Create app step 5](images/app21.png) @@ -852,14 +852,14 @@ Select **OK** and, then select **Add**. #### Assign the app to your Intune profile > [!NOTE] -> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you have not done that, please return to the main part of the lab and complete those steps before returning here. +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you haven't done that, return to the main part of the lab and complete those steps before returning here. In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then select **Assignments** from the menu: > [!div class="mx-imgBorder"] > ![Create app step 6](images/app22.png) -Select **Add Group** to open the **Add group** pane that is related to the app. +Select **Add Group** to open the **Add group** pane that's related to the app. For our purposes, select **Required** from the **Assignment type** dropdown menu. @@ -886,23 +886,23 @@ At this point, you have completed steps to add Office to Intune. For more information on adding Office apps to Intune, see [Assign Office 365 apps to Windows 10 devices with Microsoft Intune](/intune/apps-add-office365). -If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: +If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list. It might take several minutes to populate. ![Create app step 10](images/app26.png) ## Glossary - - - - - - - - - - - - - -
OEMOriginal Equipment Manufacturer
CSVComma Separated Values
MPCMicrosoft Partner Center
CSPCloud Solution Provider
MSfBMicrosoft Store for Business
AADAzure Active Directory
4K HH4K Hardware Hash
CBRComputer Build Report
ECEnterprise Commerce (server)
DDSDevice Directory Service
OOBEOut of the Box Experience
VMVirtual Machine
\ No newline at end of file +| | Description | +|:---|:---| +|**OEM** | Original Equipment Manufacturer | +|**CSV** | Comma Separated Values | +|**MPC** | Microsoft Partner Center | +|**CSP** | Cloud Solution Provider | +|**MSfB** | Microsoft Store for Business | +|**Azure AD** | Azure Active Directory | +|**4K HH** | 4K Hardware Hash | +|**CBR** | Computer Build Report | +|**EC** | Enterprise Commerce (server) | +|**DDS** | Device Directory Service | +|**OOBE** | Out of the Box Experience | +|**VM** |Virtual Machine | From d9c01d5fca28b943d6188083a4a1874104fc332a Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Wed, 25 Aug 2021 09:02:26 +0530 Subject: [PATCH 0111/1214] update-task-5358656 To fix suggestions --- .../windows-sandbox/windows-sandbox-architecture.md | 2 +- .../windows-sandbox/windows-sandbox-configure-using-wsb-file.md | 2 +- .../windows-sandbox/windows-sandbox-overview.md | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md index 1ea2225ff6..40ce6c2dea 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-architecture.md @@ -1,6 +1,6 @@ --- title: Windows Sandbox architecture -description: +description: Windows Sandbox architecture ms.prod: m365-security audience: ITPro author: dansimp diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md index 553720a2f2..1f1a23bd49 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-configure-using-wsb-file.md @@ -1,6 +1,6 @@ --- title: Windows Sandbox configuration -description: +description: Windows Sandbox configuration ms.prod: m365-security audience: ITPro author: dansimp diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index 5d3cb0e3e3..47287eeff3 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -1,6 +1,6 @@ --- title: Windows Sandbox -description: +description: Windows Sandbox overview ms.prod: m365-security audience: ITPro author: dansimp From 7d5dcb5f0737fd0ea2cd300380145bced5316cc0 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Wed, 25 Aug 2021 09:39:20 +0530 Subject: [PATCH 0112/1214] update-per-5358718 Removed keywords tag for SEO guidelines --- .../microsoft-defender-smartscreen-available-settings.md | 1 - .../microsoft-defender-smartscreen-overview.md | 1 - .../microsoft-defender-smartscreen-set-individual-device.md | 1 - 3 files changed, 3 deletions(-) diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md index 476c4b6291..9229244aa8 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-available-settings.md @@ -1,7 +1,6 @@ --- title: Available Microsoft Defender SmartScreen Group Policy and mobile device management (MDM) settings (Windows) description: A list of all available settings for Microsoft Defender SmartScreen using Group Policy and mobile device management (MDM) settings. -keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index b08aecf50b..eb3198ffba 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -1,7 +1,6 @@ --- title: Microsoft Defender SmartScreen overview (Windows) description: Learn how Microsoft Defender SmartScreen protects against phishing or malware websites and applications, and the downloading of potentially malicious files. -keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md index 7d4064e3d3..fd30a2affc 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md @@ -1,7 +1,6 @@ --- title: Set up and use Microsoft Defender SmartScreen on individual devices (Windows) description: Learn how employees can use Windows Security to set up Microsoft Defender SmartScreen. Microsoft Defender SmartScreen protects users from running malicious apps. -keywords: SmartScreen Filter, Windows SmartScreen, Microsoft Defender SmartScreen ms.prod: m365-security ms.mktglfcycl: explore ms.sitesec: library From 6b0616f71f6d79769a0b54b135aec3d139b867a0 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Wed, 25 Aug 2021 11:34:51 +0530 Subject: [PATCH 0113/1214] Updated --- images/no.png | Bin 0 -> 874 bytes images/yes.png | Bin 0 -> 614 bytes includes/appliesto-2013-2016-2019-xxx-md.md | 1 + .../appliesto-xxx-2016-2019-SUB-xxx-md.md | 1 + .../mdm/policy-csp-abovelock.md | 20 ++++++++---------- 5 files changed, 11 insertions(+), 11 deletions(-) create mode 100644 images/no.png create mode 100644 images/yes.png create mode 100644 includes/appliesto-2013-2016-2019-xxx-md.md create mode 100644 includes/appliesto-xxx-2016-2019-SUB-xxx-md.md diff --git a/images/no.png b/images/no.png new file mode 100644 index 0000000000000000000000000000000000000000..1aa084e6a3326f74e77306adc0bab27e6225b291 GIT binary patch literal 874 zcmV-w1C{)VP)1D+=^TCDiFvbv#PS{_?BS{~Hb)mp=v5JDn;p0srp zDBgaW-85T$xMZegr&Ez=(t>Ey}+rZ+~|$YN#|mt~xI#DM*RC1^}GS&Ol&CvNL58mSw8<`_Yj=Sus;0jgQ;anX**WR8^qo z!zlEI6Xk~wOloK@0FDs|c7az*3xk0BemZ5p zjtJ`U`t0HIYnvwcd45-~uA9K~|2CI5q&^}j=W^>fmpdpo@%1}K$7cZm1$j9T(lqo- zD;NlAE&y;ixwWXF)~)TqKWm$=fS#PwK{Yl50H`P_L}f)WYN{%Bn#-^p1h&}h;M|_6 zsG(k;PdPsOP3!af0RW6h2#TU`t+WW2&z}LXcg8}R1|t%IqISA>L^Hi$wr({A8Advh znp(TgD!)wp4on-P*&22V8O^rc_nG+x>kCEi-6M}dLI~Pk4?I*)YBzZP|D#Z=GuU2s z54MK$i3&;x!LwIAWgWdrt;u5Zhl6c9IP&J>=weG}-~EF;qQ2Sypi!<6CnX$zBw@ux zu@W{-!ZJym%VTqLt~Ce8Ef~$V$Mto!=7Z}00)LUfCpD&o@&Et;07*qoM6N<$f~ppT Awg3PC literal 0 HcmV?d00001 diff --git a/images/yes.png b/images/yes.png new file mode 100644 index 0000000000000000000000000000000000000000..d2285c5c46cfb8c983a2a725f4ff13e241a5f319 GIT binary patch literal 614 zcmV-s0-61ZP)Mxgdo$d#k7bF$_Of$yBR1%&{?RX(S-St3z34+VrXLUxEO`o(2VC^ z&+dKC``+ikIsC3rO5tTmTbu{3118W0ECLx|N?K~XR#&)%N?U}1$3VPBECs}*rB?S1 zmA1GByabvx;(1^|T58NQRNA5u$N~}VQ$hi_EG_lbY5H7zU_=M#69$IQzbk`4QrhBx zYpAqE6u6_4?QTsFyE=~F2=7`QK(A})PI1q5ZRg z^H1P-gUOB71V0No-put^_M={)ZBB8!{R91Gn!^WM00`C{)YRo0a`@ zUZ9IkkzRO6sJ@B5s7*s4!p)1LGzL!cc0SJf@3}quy3mYMgz(MDvjB-=e++ih~EgalK(_1H>BM+G@)tWBhcwIC%->I;N$c9E4Ear zT6YO}<}}<)q!wTX2x%S^KmlFSQfa5DJ&~lPz5(}vzb=4}DuLkbFLMD%0_`e6c&_{XFn7~=ecbB33Xr4+-ZB*-T1Bh3d_?=3=T>t<807*qoM6N<$f|?{1 AbN~PV literal 0 HcmV?d00001 diff --git a/includes/appliesto-2013-2016-2019-xxx-md.md b/includes/appliesto-2013-2016-2019-xxx-md.md new file mode 100644 index 0000000000..9a496e3070 --- /dev/null +++ b/includes/appliesto-2013-2016-2019-xxx-md.md @@ -0,0 +1 @@ +**APPLIES TO:** ![yes](../media/yes.png)2013 ![yes](../media/yes.png)2016 ![yes](../media/yes.png)2019 ![no](../media/no.png)SharePoint in Microsoft 365 diff --git a/includes/appliesto-xxx-2016-2019-SUB-xxx-md.md b/includes/appliesto-xxx-2016-2019-SUB-xxx-md.md new file mode 100644 index 0000000000..a97c23d538 --- /dev/null +++ b/includes/appliesto-xxx-2016-2019-SUB-xxx-md.md @@ -0,0 +1 @@ +**APPLIES TO:** ![no-img-13](../media/no.png)2013 ![yes-img-16](../media/yes.png)2016 ![yes-img-19](../media/yes.png)2019 ![yes-img-se](../media/yes.png)Subscription Edition ![no-img-sop](../media/no.png)SharePoint in Microsoft 365 diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 23c1bb8142..b1bc434f3a 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -14,6 +14,7 @@ manager: dansimp # Policy CSP - AboveLock +[!INCLUDE[appliesto-xxx-xxx-xxx-SUB-xxx-md](../includes/appliesto-xxx-xxx-xxx-SUB-xxx-md.md)]
@@ -40,29 +41,26 @@ manager: dansimp - - + + + - + - - - - - + - + - - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procheck mark1
Businesscheck mark1Yes, starting in Windows 10, version 1903Yes
Enterprisecheck mark1Yes, starting in Windows 10, version 1909Yes
Educationcheck mark1
Yes, starting in Windows 10, version 2004Yes
From c25ad29c512d2bc0042b8407df5ef6c6c6e66d65 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Wed, 25 Aug 2021 13:21:30 -0400 Subject: [PATCH 0114/1214] final updates - hopefully --- .../add-apps-and-features.md | 76 ++++++++++--- .../apps-in-windows-10.md | 11 +- windows/application-management/index.yml | 2 +- .../sideload-apps-in-windows-10.md | 106 ++++++++++-------- windows/application-management/toc.yml | 2 +- 5 files changed, 125 insertions(+), 72 deletions(-) diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md index 6a6c743b1c..835543cb01 100644 --- a/windows/application-management/add-apps-and-features.md +++ b/windows/application-management/add-apps-and-features.md @@ -1,32 +1,74 @@ --- -title: Windows 10 - How to add apps from Apps & features -description: Learn how to add apps, like XPS Viewer, to your Windows 10 device with the Apps & features page in Settings +title: Add or hide optional apps and features on Windows devices | Microsoft Docs +description: Learn how to add Windows 10 and Windows 11 optional features using the Apps & features page in the Settings app. Also see the group policy objects (GPO) and MDM policies that show or hide Apps and Windows Features in the Settings app. Use Windows PowerShell to show or hide specific features in Windows Features. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: article -ms.author: greglin -author: greg-lindsay +ms.author: mandia +author: MandiOhlinger ms.localizationpriority: medium -ms.date: 04/26/2018 +ms.date: 08/25/2021 ms.reviewer: -manager: dansimp +manager: dougeby ms.topic: article --- -# How to add apps and features to Windows 10 -> Applies to: Windows 10 -Windows 10 includes a range of [applications](apps-in-windows-10.md), from [system apps](system-apps-windows-client-os.md) that support the operating system (like Settings) to ["provisioned" apps](provisioned-apps-windows-client-os.md) (like Feedback Hub) that are installed the first time you run Windows. We also provide additional apps and features, called Features on Demand (like language packs or handwriting recognition), that you can install at any time. If you're working in a managed environment (like at work, where you have an administrator who manages your systems and resources), your admin can use [Windows Update to install Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities). +# Add or hide features on the Windows client OS -If you're working on your own device, you can add apps and features from the Settings app. +> Applies to: +> +> - Windows 10 -Here's how you do that: +The Windows client operating systems include more features that you and your users can install. These features are called [Features on Demand](/windows-hardware/manufacture/desktop/features-on-demand-v2--capabilities) (opens another Microsoft web site), and can be installed at any time. On your organization-owned devices, you may want to control access to these other features. -1. In the Search bar, search for "apps." -2. Select **Apps and features** in the results. -3. Select **Manage optional features**, and then select **Add a feature**. -4. Select the feature you want to add, like **XPS Viewer**, and then select **Install.** +This article: -And that's it. You can see the apps you have installed on the **Apps & features** page and the features on **Manage optional features**. +- Shows you how to add features using the user interface. +- Lists the group policies and Mobile device management (MDM) policies to hide Windows Features. +- Includes information on using Windows PowerShell to disable specific Windows Features. -You can manage and uninstall apps and features from the same Settings page. Just select the app or feature, and then select **Uninstall**. \ No newline at end of file +If you're working on your own device, use the **Settings** app to add features. + +## Add or uninstall features + +1. In the Search bar, search for "apps", and select **Apps and features**. +2. Select **Optional features** > **Add a feature**. +3. Select the feature you want to add, like **XPS Viewer**, and then select **Install.** + +When the installation completes, the feature is listed in **Apps & features**. In **Apps & features** > **Optional features** > **More Windows features**, there are more features that you and your users can install. + +To uninstall a feature, open the **Settings** app. Select the feature, and then select **Uninstall**. + +## Use Group Policy or MDM to hide Windows Features + +By default, the OS might show Windows Features, and allow users to install and uninstall these optional apps and features. + +To hide Windows Features on your user devices, you can use Group Policy (on-premises), or use an MDM provider, such as Microsoft Intune (cloud). + +### Group Policy + +If you use Group Policy, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Windows Features"` policy. By default, this policy may be set to **Not configured**, which means users can add or remove features. When this setting is **Enabled**, the Windows Features is hidden on the device. + +You can't use Group Policy to disable specific Windows Features, such as XPS Viewer. If you want to disable specific features, use [Windows PowerShell](#use-windows-powershell-to-disable-specific-features) (in this article). + +If you want to hide the entire **Apps** feature in the Settings app, use the `User Configuration\Administrative Template\Control Panel\Programs\Hide "Programs and Features" page` policy. + +### MDM + +Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to hide Windows Features. + +If you want to hide the entire **Apps** feature in the Settings app, you can use a configuration policy on Intune enrolled devices. For more information on the Control Panel settings you can configure, see [Control Panel settings in Microsoft Intune](/mem/intune/configuration/device-restrictions-windows-10#control-panel-and-settings). + +## Use Windows PowerShell to disable specific features + +To disable specific features, you can use the Windows PowerShell [Disable-WindowsOptionalFeature](/powershell/module/dism/disable-windowsoptionalfeature) command. There isn't a Group Policy that disables specific Windows Features. + +If you're looking to automate disabling specific features, you can create a scheduled task. Then, use the scheduled task to run your Windows PowerShell script. For more information about Task Scheduler, see [Task Scheduler for developers](/windows/win32/taskschd/task-scheduler-start-page). + +Microsoft Intune can also execute Windows PowerShell scripts. For more information, see [Use PowerShell scripts on Windows client devices in Intune](/mem/intune/apps/intune-management-extension). + +## Restore Windows features + +- If you use Group Policy or MDM to hide Windows Features or the entire Apps feature, you can set the policy to **Not configured**. Then, deploy your policy. When the device receives the policy, the features are shown. +- Using Windows PowerShell, you can also enable specific features using the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) command. diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 185ad28d5e..0ad35e3d24 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -74,7 +74,7 @@ There are different types of apps that can run on your Windows client devices. T When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. -- **Manually install**: On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps and Features**. +- **Manually install**: On your devices, users can install apps from the Microsoft Store, from the internet, and from an organization shared drive. These apps, and more, are listed in **Settings** > **Apps** > **Apps and Features**. If you want to prevent users from downloading apps on organization owned devices, use an MDM provider, like Microsoft Intune. For example, you can create a policy that allows or prevents users from sideloading apps, only allow the private store, and more. For more information on the features you can restrict, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10). @@ -87,11 +87,13 @@ When your apps are ready, you can add or deploy these apps to your Windows devic - [Add apps to Microsoft Intune](/mem/intune/apps/apps-add) - [Application management in Configuration Manager](/mem/configmgr/apps/understand/introduction-to-application-management) -- **Microsoft Store**: Using the Microsoft Store app, Windows users can download apps from the public store. And, they can download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **Windows Package Manager** to add apps to the private store. +- **Microsoft Store**: Using the Microsoft Store app, Windows users can download apps from the public store. And, they can download apps provided by your organization, which is called the "private store". If your organization creates its own apps, you can use **[Windows Package Manager](/windows/package-manager)** to add apps to the private store. To help manage the Microsoft Store on your devices, you can use policies: - - On premises, you can use Administrative Templates in group policy to control access to the Microsoft Store app (`User Configuration\Administrative Templates\Windows Components\Store`). + - On premises, you can use Administrative Templates in Group Policy to control access to the Microsoft Store app: + - `User Configuration\Administrative Templates\Windows Components\Store` + - `Computer Configuration\Administrative Templates\Windows Components\Store` - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to control access to the Microsoft Store app. For more information, see: @@ -135,9 +137,8 @@ When your apps are ready, you can add or deploy these apps to your Windows devic To help manage App-V on your devices, you can use policies: - - On premises, you can use Administrative Templates in group policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`). + - On premises, you can use Administrative Templates in Group Policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`). - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to deploy App-V policies. > [!TIP] > If you want to decrease your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the better deployment for your organization. - diff --git a/windows/application-management/index.yml b/windows/application-management/index.yml index d9d22489a8..e6739ae97e 100644 --- a/windows/application-management/index.yml +++ b/windows/application-management/index.yml @@ -28,7 +28,7 @@ landingContent: links: - text: Understand apps in Windows client OS url: apps-in-windows-10.md - - text: How to add apps and features + - text: How to add features url: add-apps-and-features.md - text: Sideload LOB apps url: sideload-apps-in-windows-10.md diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 4759d12a8c..5ab1d678f5 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -1,93 +1,103 @@ --- -title: Sideload LOB apps in Windows 10 (Windows 10) -description: Learn how to sideload line-of-business (LOB) apps in Windows 10. When you sideload an app, you deploy a signed app package to a device. +title: Sideload LOB apps in Windows client OS | Microsoft Docs +description: Learn how to sideload line-of-business (LOB) apps in Windows client operating systems, including Windows 10. When you sideload an app, you deploy a signed app package to a device. ms.assetid: C46B27D0-375B-4F7A-800E-21595CF1D53D ms.reviewer: -manager: dansimp +manager: dougeby ms.author: greglin ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile author: greg-lindsay -ms.date: 05/20/2019 +ms.date: 08/25/2021 +ms.localizationpriority: medium --- -# Sideload LOB apps in Windows 10 +# Sideload line of business (LOB) apps in Windows client devices -**Applies to** - -- Windows 10 +> Applies to: +> +> - Windows 10 > [!NOTE] -> As of Windows Insider Build 18956, sideloading is enabled by default. Now, you can deploy a signed package onto a device without a special configuration. +> As of Windows Insider Build 18956, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration. -"Line-of-Business" (LOB) apps are present in a wide range of businesses and organizations. Organizations value these apps because they solve problems unique to each business. +Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft store. Your organization may create its own apps, including line-of-business (LOB) apps. Many organizations create their own apps to solve problems unique to their business. When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1 -In Windows 10, sideloading is different than in earlier versions of Windows: +Starting with Windows 10, sideloading is different than in earlier versions of Windows: -- You can unlock a device for sideloading using an enterprise policy, or through **Settings** +- You can unlock a device for sideloading using an enterprise policy, or through the **Settings** app. +- License keys aren't required. +- Devices don't have to be joined to a domain. -- License keys are not required +To allow these apps to run on your Windows devices, you might have to enable sideloading on your devices. This article shows you how to: -- Devices do not have to be joined to a domain +- **Turn on sideloading**: You can deploy using Group Policy or a mobile device management (MDM) provider. Or, you can use **Settings** apps to turn on sideloading. +- **Install the app certificate**: Import the security certificate to the local device. This certificate tells the local device to trust the app. +- **Install the app**: Use Windows PowerShell to install the app package. -## Requirements -Here's what you'll need to have: +## Prerequisites -- Devices need to be unlocked for sideloading (unlock policy enabled) +- Windows devices that are unlocked for sideloading (unlock policy enabled). Meaning, sideloading isn't blocked by a policy. +- A trusted certificate that's assigned to your app. +- An app package that's signed with your certificate. -- Certificate assigned to app +## Step 1: Turn on sideloading -- Signed app package - -And here's what you'll need to do: - -- Turn on sideloading - you can push a policy with an MDM provider, or you can use **Settings**. - -- Trust the app - import the security certificate to the local device. - -- Install the app - use PowerShell to install the app package. - -## How do I sideload an app on desktop You can sideload apps on managed or unmanaged devices. ->[!IMPORTANT] -> To install an app on Windows 10, in addition to following [these procedures](/windows/msix/app-installer/installing-windows10-apps-web), users can also double-click any APPX/MSIX package. +Managed devices are typically owned by your organization. They're managed by Group Policy (on-premises), or a Mobile Device Management (MDM) provider, such as Microsoft Intune (cloud). Bring your own devices (BYOD) and personal devices can also be managed by your organization. On managed devices, you can create a policy that turns on sideloading, and then deploy this policy to your Windows devices. +Unmanaged devices are devices that are not managed by your organization. These devices are typically personal devices owned by users. Users can turn on sideloading using the Settings app. -**To turn on sideloading for managed devices** +> [!IMPORTANT] +> To install an app on Windows 10 and later, you can: +> +> - [Install Windows 10 apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web). +> - Users can double-click any `.APPX` or `.MSIX` package. -- Deploy an enterprise policy. +### User interface +If you're working on your own device, or if devices are unmanaged, use the Settings app: +1. Open the **Settings** app > **Update & Security** > **For developers**. +2. Select **Sideload apps**. -**To turn on sideloading for unmanaged devices** +For more information, see [Enable your device for development](/windows/apps/get-started/enable-your-device-for-development) and [Developer Mode features and debugging](/windows/apps/get-started/developer-mode-features-and-debugging). -1. Open **Settings**. +### Group Policy -2. Click **Update & Security** > **For developers**. +If you use Group Policy, use the `Computer Configuration\Administrative Templates\Windows Components\App Package Deployment` policies to enable or prevent sideloading apps: -3. On **Use developer features**, select **Sideload apps**. +- Allows development of Windows Store apps and installing them from an integrated development environment (IDE) +- Allow all trusted apps to install -**To import the security certificate** +By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, users can sideload apps. -1. Open the security certificate for the appx package, and select **Install Certificate**. +### MDM -2. On the **Certificate Import Wizard**, select **Local Machine**. +Using Microsoft Intune, you can also enable sideloading apps on managed devices. For more information, see: -3. Import the certificate to the **Trusted Root Certification Authorities** folder. +- [Sign line-of-business apps so they can be deployed to Windows devices with Intune](/mem/intune/apps/app-sideload-windows) +- [App Store device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#app-store) + +## Step 2: Import the security certificate + +This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device. + +1. Open the security certificate for the `.appx` package, and select **Install Certificate**. + +2. On the **Certificate Import Wizard**, select **Local Machine**. + +3. Import the certificate to the **Trusted Root Certification Authorities** folder. -OR- - You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package to a Windows 10 device, see runtime instructions on [Build and apply a provisioning package]( https://go.microsoft.com/fwlink/p/?LinkId=619162). + You can use a runtime provisioning package to import a security certificate. For information about applying a provisioning package to a Windows 10 device, see runtime instructions on [Create a provisioning package for Windows 10](/windows/configuration/provisioning-packages/provisioning-create-package). -**To install the app** -- From the folder with the appx package, run the PowerShell `Add-AppxPackage` command to install the appx package. +## Step 3: Install the app - -  - -  \ No newline at end of file +From the folder with the `.appx` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.appx` package. For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). diff --git a/windows/application-management/toc.yml b/windows/application-management/toc.yml index 0e0f44a1bb..6847361924 100644 --- a/windows/application-management/toc.yml +++ b/windows/application-management/toc.yml @@ -11,7 +11,7 @@ items: href: provisioned-apps-windows-client-os.md - name: System apps in Windows client OS href: system-apps-windows-client-os.md - - name: Add apps and features in Windows 10 + - name: Add features in Windows client href: add-apps-and-features.md - name: Sideload apps href: sideload-apps-in-windows-10.md From 98f0716d6228609e0487c8de90c296bc8d2f41f5 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Wed, 25 Aug 2021 13:31:13 -0400 Subject: [PATCH 0115/1214] fixed small things --- .../sideload-apps-in-windows-10.md | 14 +++++++++----- 1 file changed, 9 insertions(+), 5 deletions(-) diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 5ab1d678f5..2895977bac 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -27,15 +27,17 @@ Sideloading apps is when you install apps that aren't from an official source, s When you sideload an app, you deploy a signed app package to a device. You maintain the signing, hosting, and deployment of these apps. Sideloading was also available with Windows 8 and Windows 8.1 -Starting with Windows 10, sideloading is different than in earlier versions of Windows: +Starting with Windows 10, sideloading is different than earlier versions of Windows: - You can unlock a device for sideloading using an enterprise policy, or through the **Settings** app. - License keys aren't required. - Devices don't have to be joined to a domain. -To allow these apps to run on your Windows devices, you might have to enable sideloading on your devices. This article shows you how to: +To allow these apps to run on your Windows devices, you might have to enable sideloading on your devices. -- **Turn on sideloading**: You can deploy using Group Policy or a mobile device management (MDM) provider. Or, you can use **Settings** apps to turn on sideloading. +This article shows you how to: + +- **Turn on sideloading**: You can deploy using Group Policy or a mobile device management (MDM) provider. Or, you can use the **Settings** app to turn on sideloading. - **Install the app certificate**: Import the security certificate to the local device. This certificate tells the local device to trust the app. - **Install the app**: Use Windows PowerShell to install the app package. @@ -75,7 +77,7 @@ If you use Group Policy, use the `Computer Configuration\Administrative Template - Allows development of Windows Store apps and installing them from an integrated development environment (IDE) - Allow all trusted apps to install -By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, users can sideload apps. +By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps. ### MDM @@ -100,4 +102,6 @@ This step installs the app certificate to the local device. Installing the certi ## Step 3: Install the app -From the folder with the `.appx` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.appx` package. For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). +From the folder with the `.appx` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.appx` package. + +For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). From c9e3804d059d509595f8ed4171d75aceb825c502 Mon Sep 17 00:00:00 2001 From: v-dihans Date: Wed, 25 Aug 2021 15:50:17 -0600 Subject: [PATCH 0116/1214] dh-removing we --- .../demonstrate-deployment-on-vm.md | 108 +++++++++--------- 1 file changed, 54 insertions(+), 54 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 476b544dc0..dedf8c406a 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -31,7 +31,7 @@ In this topic, you'll learn how to set up a Windows Autopilot deployment for a V > [!NOTE] > Although there are [multiple platforms](/mem/autopilot/add-devices#registering-devices) available to enable Autopilot, this lab primarily uses Intune. -> +> > Hyper-V and a VM are not required for this lab. You can use a physical device instead. However, the instructions assume that you're using a VM. To use a physical device, skip the instructions to install Hyper-V and create a VM. All references to 'device' in the guide refer to the client device, either physical or virtual. The following video provides an overview of the process: @@ -50,7 +50,7 @@ These are the things you'll need to complete this lab: |**Windows 10 installation media**|Windows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.| |**Internet access**|If you're behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.| |**Hyper-V or a physical device running Windows 10**|The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.| -|**An account with Azure AD Premium license**|This guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| +|**An account with Azure Active Directory (AD) Premium license**|This guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| ## Procedures @@ -134,13 +134,13 @@ To use Windows PowerShell, you need to know two things: 1. The location of the Windows 10 ISO file. - In the example, we assume the location is **c:\iso\win10-eval.iso**. + In the example, the location is **c:\iso\win10-eval.iso**. 2. The name of the network interface that connects to the internet. - In the example, we use a Windows PowerShell command to determine this automatically. + In the example, you'll use a Windows PowerShell command to determine this automatically. -After we have set the ISO file location and determined the name of the appropriate network interface, we can install Windows 10. +After you determine the ISO file location and the name of the appropriate network interface, you can install Windows 10. ### Set ISO file location @@ -175,9 +175,9 @@ All VM data will be created under the current path in your PowerShell prompt. Co > [!IMPORTANT] > **VM switch**: a VM switch is how Hyper-V connects VMs to a network. > ->- If you have previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal." +>- If you previously enabled Hyper-V and your Internet-connected network interface is already bound to a VM switch, then the PowerShell commands below will fail. In this case, you can either delete the existing VM switch (so that the commands below can create one), or you can reuse this VM switch by skipping the first command below and either modifying the second command to replace the switch name **AutopilotExternal** with the name of your switch, or by renaming your existing switch to "AutopilotExternal." >- If you have never created an external VM switch before, then just run the commands below. ->- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that is used to connect to the Internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). +>- If you're not sure if you already have an External VM switch, enter **get-vmswitch** at a Windows PowerShell prompt to display a currently list of the VM switches that are provisioned in Hyper-V. If one of them is of SwitchType **External**, then you already have a VM switch configured on the server that's used to connect to the internet. In this case, you need to skip the first command below and modify the others to use the name of your VM switch instead of the name "AutopilotExternal" (or change the name of your switch). ```powershell New-VMSwitch -Name AutopilotExternal -AllowManagementOS $true -NetAdapterName (Get-NetAdapter |?{$_.Status -eq "Up" -and !$_.Virtual}).Name @@ -186,7 +186,7 @@ Add-VMDvdDrive -Path c:\iso\win10-eval.iso -VMName WindowsAutopilot Start-VM -VMName WindowsAutopilot ``` -After you enter these commands, connect to the VM that you just created. Double-click the VM in Hyper-V Manager to connect to it. Then wait for a prompt to press a key and boot from the DVD. +After you enter these commands, connect to the VM that you just created. Double-click the VM in Hyper-V Manager to connect to it. Then wait for a prompt to press a key and boot from the DVD. See the sample output below. In this sample, the VM is created under the **c:\autopilot** directory and the **vmconnect.exe** command is used (which is only available on Windows Server). If you installed Hyper-V on Windows 10, use Hyper-V Manager to connect to your VM. @@ -269,7 +269,7 @@ Select the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see ** ## Capture the hardware ID > [!NOTE] -> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For purposes of this lab, you're acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PowerShell script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. +> Normally, the Device ID is captured by the OEM as they run the OA3 Tool on each device in the factory. The OEM then submits the 4K HH created by the OA3 Tool to Microsoft by submitting it with a Computer Build Report (CBR). For the purposes of this lab, you're acting as the OEM (capturing the 4K HH), but you're not going to use the OA3 Tool to capture the full 4K HH for various reasons (you'd have to install the OA3 tool, your device couldn't have a volume license version of Windows, it's a more complicated process than using a PowerShell script, etc.). Instead, you'll simulate running the OA3 tool by running a PowerShell script, which captures the device 4K HH just like the OA3 tool. Follow these steps to run the PowerShell script: @@ -327,19 +327,19 @@ Follow these steps to run the PowerShell script: PS C:\HWID> ``` -1. Verify that there's an **AutopilotHWID.csv** file in the **c:\HWID** directory that is about 8 KB in size. This file contains the complete 4K HH. +1. Verify that there's an **AutopilotHWID.csv** file in the **c:\HWID** directory that's about 8 KB in size. This file contains the complete 4K HH. > [!NOTE] - > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you're curious. The file format is validated when it's imported into Autopilot. An example of the data in this file is shown below. + > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you're curious. The file format is validated when it's imported into Autopilot. Here's an example of the data in this file: ![Serial number and hardware hash](images/hwid.png) - You'll need to upload this data into Intune to register your device for Autopilot. So the next step is to transfer this file to the computer you will use to access the Azure portal. If you're using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the **AutopilotHWID.csv** file and copy it. Then right-click and paste the file to your desktop (outside the VM). + You'll need to upload this data into Intune to register your device for Autopilot. So, the next step is to transfer this file to the computer you'll use to access the Azure portal. If you're using a physical device instead of a VM, you can copy the file to a USB drive. If you’re using a VM, you can right-click the **AutopilotHWID.csv** file and copy it. Then right-click and paste the file to your desktop (outside the VM). - If you have trouble copying and pasting the file, just view the contents in Notepad on the VM and copy the text into Notepad outside the VM. Do not use another text editor to do this. + If you have trouble copying and pasting the file, just view the contents in Notepad on the VM, and then copy the text into Notepad outside the VM. Don't use another text editor to do this. > [!NOTE] - > When copying and pasting to or from VMs, avoid clicking other things with your mouse cursor between the copy and paste process as this can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. + > When copying and pasting to or from VMs, avoid selecting other things with your mouse cursor in between the copy and paste process. Doing so can empty or overwrite the clipboard and require that you start over. Go directly from copy to paste. ## Reset the VM back to Out-Of-Box-Experience (OOBE) @@ -356,13 +356,13 @@ Resetting the VM or device can take a while. Proceed to the next step (verify su ## Verify subscription level -For this lab, you need an Azure AD Premium subscription. You can tell if you have a Premium subscription by navigating to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example: +For this lab, you need an Azure AD Premium subscription. To tell if you have a Premium subscription, go to the [MDM enrollment configuration](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) blade. See the following example: **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** ![MDM and Intune](images/mdm-intune2.png) -If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in Azure Active Directory (Azure AD) Premium. +If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in Azure AD Premium. To convert your Intune trial account to a free Premium trial account, go to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. @@ -388,7 +388,7 @@ When you're finished, select **Save**. If you already have MDM auto-enrollment configured in Azure AD, you can skip this step. -Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you do not see Microsoft Intune, select **Add application** and choose **Intune**. +Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Mobility) and select **Microsoft Intune**. If you don't see Microsoft Intune, select **Add application** and choose **Intune**. For the purposes of this demo, select **All** under the **MDM user scope** and select **Save**. @@ -396,7 +396,7 @@ For the purposes of this demo, select **All** under the **MDM user scope** and s ## Register your VM -Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but *only pick one* for purposes of this lab. We highly recommend using Intune rather than MSfB. +Your VM (or device) can be registered either via Intune or Microsoft Store for Business (MSfB). Both processes are shown here, but *only pick one* for the purposes of this lab. It's highly recommend to use Intune rather than MSfB. ### Autopilot registration using Intune @@ -405,9 +405,9 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B ![Intune device import](images/enroll1.png) > [!NOTE] - > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appears. + > If menu items like **Windows enrollment** aren't active for you, look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appears. -2. Under **Add Windows Autopilot devices** in the far-right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. +2. Under **Add Windows Autopilot devices** in the far-right pane, go to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. ![HWID CSV](images/enroll2.png) @@ -430,22 +430,22 @@ Optional: see the following video for an overview of the process. > [!video https://www.youtube.com/embed/IpLIZU_j7Z0] -First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](/microsoft-store/windows-store-for-business-overview) to create a new one. +First, you need a MSfB account. You can use the same one you created above for Intune, or follow [these instructions](/microsoft-store/windows-store-for-business-overview) to create a new one. -Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) using your test account by clicking **Sign in** on the upper-right-corner of the main page. +Next, to sign in to [Microsoft Store for Business](https://businessstore.microsoft.com/en-us/store) with your test account, select **Sign in** on the upper-right-corner of the main page. -Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: +Select **Manage** from the top menu, then select the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: ![Microsoft Store for Business](images/msfb.png) -Select the **Add devices** link to upload your CSV file. A message appears indicating your request is being processed. Wait a few moments before refreshing to see that your new device is added. +Select the **Add devices** link to upload your CSV file. A message appears that indicates your request is being processed. Wait a few moments before refreshing to see that your new device is added. ![Microsoft Store for Business Devices](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile > [!IMPORTANT] -> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only *pick one for purposes of this lab*: +> Autopilot profiles can be created and assigned to your registered VM or device either through Intune or MSfB. Both processes are shown here, but only *pick one for the purposes of this lab*: Pick one: - [Create profiles using Intune](#create-a-windows-autopilot-deployment-profile-using-intune) @@ -460,7 +460,7 @@ Pick one: #### Create a device group -The Autopilot deployment profile wizard asks for a device group, so we must create one first. To create a device group: +The Autopilot deployment profile wizard asks for a device group, so you must create one first. To create a device group: 1. In the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431), choose **Groups** > **New group**. @@ -531,7 +531,7 @@ Select **OK**, and then select **Create**. ### Create a Windows Autopilot deployment profile using MSfB -If already created and assigned a profile via Intune by using the steps immediately above, then skip this section. +If you already created and assigned a profile via Intune with the steps immediately above, then skip this section. A [video](https://www.youtube.com/watch?v=IpLIZU_j7Z0) is available that covers the steps required to create and assign profiles in MSfB. These steps are also summarized below. @@ -569,17 +569,17 @@ To assign (or reassign) the profile to a device, select the checkboxes next to t > [!div class="mx-imgBorder"] > ![MSfB assign step 1](images/msfb-assign1.png) -Confirm the profile was successfully assigned to the intended device, check the contents of the **Profile** column: +To confirm the profile was successfully assigned to the intended device, check the contents of the **Profile** column: > [!div class="mx-imgBorder"] > ![MSfB assign step 2](images/msfb-assign2.png) > [!IMPORTANT] -> The new profile is only applied if the device isn't started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. +> The new profile is only applied if the device hasn't started and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. ## See Windows Autopilot in action -If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience. However, don't attempt to start your device again until the **PROFILE STATUS** for your device in Intune is changed from **Not assigned** to **Assigning**, and finally to **Assigned**: +If you shut down your VM after the last reset, it's time to start it back up again so it can progress through the Autopilot OOBE experience. However, don't attempt to start your device again until the **PROFILE STATUS** for your device in Intune is changed from **Not assigned** to **Assigning**, and finally to **Assigned**: > [!div class="mx-imgBorder"] > ![Device status](images/device-status.png) @@ -587,15 +587,15 @@ If you shut down your VM after the last reset, it's time to start it back up aga Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding). Otherwise, these changes might not show up. > [!TIP] -> If you reset your device previously, after collecting the 4K HH info, and then let it restart back to the first OOBE screen, then you might need to restart the device again to ensure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you don't see the Autopilot OOBE experience, then reset the device again (**Settings** > **Update & Security** > **Recovery** and select **Get started**. Under **Reset this PC**, select **Remove everything and Just remove my files**. Select **Reset**). +> If you reset your device previously, after collecting the 4K HH info, let it restart back to the first OOBE screen. Then you might need to restart the device again to make sure the device is recognized as an Autopilot device and displays the Autopilot OOBE experience you're expecting. If you don't see the Autopilot OOBE experience, then reset the device again (**Settings** > **Update & Security** > **Recovery** and select **Get started**. Under **Reset this PC**, select **Remove everything and Just remove my files**. Select **Reset**). -- Ensure your device has an internet connection. -- Turn on the device -- Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). +1. Make sure your device has an internet connection. +1. Turn on the device. +1. Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). ![OOBE sign-in page](images/autopilot-oobe.png) -Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**. Then, **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. +Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**. Then, **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. > [!div class="mx-imgBorder"] > ![Device enabled](images/devices1.png) @@ -620,17 +620,17 @@ You need to delete (or retire, or factory reset) the device from Intune before d This action removes the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot. So, the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. -The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. +The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. > [!NOTE] -> A device only appears in the All devices list once it has booted. The latter (**Windows Autopilot Deployment Program** > **Devices**) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. +> A device only appears in the **All devices** list once it has booted. The latter (**Windows Autopilot Deployment Program** > **Devices**) is the list of devices currently registered from that Intune account into the Autopilot program - which may or may not be enrolled to Intune. -To remove the device from the Autopilot program, select the device, and then select **Delete**. A popup dialog box appears to confirm deletion. +To remove the device from the Autopilot program, select the device, and then select **Delete**. A pop-up dialog box appears to confirm deletion. > [!div class="mx-imgBorder"] > ![Delete device](images/delete-device2.png) -At this point, your device is unenrolled from Intune and also deregistered from Autopilot. After several minutes, select the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program. +At this point, your device is unenrolled from Intune and also deregistered from Autopilot. After several minutes, select the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program. Once the device no longer appears, you're free to reuse it for other purposes. @@ -640,7 +640,7 @@ If you also (optionally) want to remove your device from Azure AD, go to **Azure Starting with Windows 8, the host computer's microprocessor must support second level address translation (SLAT) to install Hyper-V. See [Hyper-V: List of SLAT-Capable CPUs for Hosts](https://social.technet.microsoft.com/wiki/contents/articles/1401.hyper-v-list-of-slat-capable-cpus-for-hosts.aspx) for more information. -To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press ENTER, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: +To verify your computer supports SLAT, open an administrator command prompt, type **systeminfo**, press **ENTER**, scroll down, and review the section displayed at the bottom of the output, next to Hyper-V Requirements. See the following example: ```console C:>systeminfo @@ -655,7 +655,7 @@ Hyper-V Requirements: VM Monitor Mode Extensions: Yes In this example, the computer supports SLAT and Hyper-V. > [!NOTE] -> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting depends on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. +> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting depends on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. You can also identify Hyper-V support using [tools](/archive/blogs/taylorb/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v) provided by the processor manufacturer, the [msinfo32](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731397(v=ws.11)) tool, or you can download the [Coreinfo](/sysinternals/downloads/coreinfo) utility and run it, as shown in the following example: @@ -683,13 +683,13 @@ EPT * Supports Intel extended page tables (SLAT) #### Prepare the app for Intune -Before we can pull an application into Intune to make it part of our AP profile, we need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool: +Before you can pull an application into Intune to make it part of your AP profile, you need to "package" the application for delivery using the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool). After downloading the tool, gather the following three bits of information to use the tool: 1. The source folder for your application 2. The name of the setup executable file 3. The output folder for the new file -For the purposes of this lab, we'll use the Notepad++ tool as our Win32 app. +For the purposes of this lab, we'll use the Notepad++ tool as the Win32 app. Download the [Notepad++ msi package](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available), and then copy the file to a known location, such as C:\Notepad++msi. @@ -698,13 +698,13 @@ Run the IntuneWinAppUtil tool, supplying answers to the three questions, for exa > [!div class="mx-imgBorder"] > ![Add app example](images/app01.png) -After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. +After the tool finishes running, you should have an .intunewin file in the Output folder. You can upload the file into Intune by using the following steps. #### Create app in Intune Log in to the Azure portal, and then select **Intune**. -Go to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. +Go to **Intune > Clients apps > Apps**, and then select the **Add** button to create a new app package. ![Add app step 1](images/app02.png) @@ -733,7 +733,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q ![Add app step 5](images/app06.png) -Simply using an install command like "notepad++.exe /S" doesn't actually install Notepad++; it only launches the app. To install the program, you need to use the .msi file instead. Notepad++ doesn't have a .msi version of their program, but there's a .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). +Simply using an install command like "notepad++.exe /S" doesn't actually install Notepad++; it only launches the app. To install the program, you need to use the .msi file instead. Notepad++ doesn't have a .msi version of their program, but there's a .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). Select **OK** to save your input and activate the **Requirements** blade. @@ -742,18 +742,18 @@ On the **Requirements Configuration** blade, specify the **OS architecture** and > [!div class="mx-imgBorder"] > ![Add app step 6](images/app07.png) -Next, configure the **Detection rules**. For the purpose of this lab, select manual format: +Next, configure the **Detection rules**. For the purposes of this lab, select manual format: > [!div class="mx-imgBorder"] > ![Add app step 7](images/app08.png) -Select **Add** to define the rule properties. For **Rule type**, select **MSI**, which automatically imports the correct MSI product code into the rule: +Select **Add** to define the rule properties. For **Rule type**, select **MSI**, which automatically imports the correct MSI product code into the rule: ![Add app step 8](images/app09.png) Select **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. -**Return codes**: For our purposes, leave the return codes at their default values: +**Return codes**: For the purposes of this lab, leave the return codes at their default values: > [!div class="mx-imgBorder"] > ![Add app step 9](images/app10.png) @@ -777,7 +777,7 @@ Find your app in your app list: #### Assign the app to your Intune profile > [!NOTE] -> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you haven't done that, return to the main part of the lab and complete those steps before returning here. +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you haven't done that, return to the main part of the lab and complete those steps before returning here. In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then select **Assignments** from the menu: @@ -786,7 +786,7 @@ In the **Intune > Client Apps > Apps** pane, select the app package you already Select **Add Group** to open the **Add group** pane that's related to the app. -For the purpose of this lab, select **Required** from the **Assignment type** dropdown menu. +For the purposes of this lab, select **Required** from the **Assignment type** dropdown menu. > [!NOTE] > **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. @@ -827,7 +827,7 @@ Under **App Type**, select **Office 365 Suite > Windows 10**: ![Create app step 2](images/app18.png) -Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this lab, only select Excel: +Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this lab, only select Excel: > [!div class="mx-imgBorder"] > ![Create app step 3](images/app19.png) @@ -852,7 +852,7 @@ Select **OK** and, then select **Add**. #### Assign the app to your Intune profile > [!NOTE] -> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you haven't done that, return to the main part of the lab and complete those steps before returning here. +> The following steps only work if you previously [created a GROUP in Intune and assigned a profile to it](#create-a-device-group). If you haven't done that, return to the main part of the lab and complete those steps before returning here. In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then select **Assignments** from the menu: @@ -861,7 +861,7 @@ In the **Intune > Client Apps > Apps** pane, select the Office package you alrea Select **Add Group** to open the **Add group** pane that's related to the app. -For our purposes, select **Required** from the **Assignment type** dropdown menu. +For the purposes of this lab, select **Required** from the **Assignment type** dropdown menu. **Available for enrolled devices** means users install the app from the Company Portal app or Company Portal website. From 8b0f8c20faf7cc845d58e4fbfb75ec94ddfcc59b Mon Sep 17 00:00:00 2001 From: v-dihans Date: Wed, 25 Aug 2021 16:07:16 -0600 Subject: [PATCH 0117/1214] dh acro fixes --- .../demonstrate-deployment-on-vm.md | 14 +++++++------- 1 file changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index dedf8c406a..caf50f2f1d 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -47,14 +47,14 @@ These are the things you'll need to complete this lab: | | Description | |:---|:---| -|**Windows 10 installation media**|Windows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you do not already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.| +|**Windows 10 installation media**|Windows 10 Professional or Enterprise (ISO file) for a supported version of Windows 10, semi-annual channel. If you don't already have an ISO to use, a link is provided to download an evaluation version of Windows 10 Enterprise.| |**Internet access**|If you're behind a firewall, see the detailed networking requirements. Otherwise, just ensure that you have a connection to the Internet.| -|**Hyper-V or a physical device running Windows 10**|The guide assumes that you will use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.| +|**Hyper-V or a physical device running Windows 10**|The guide assumes that you'll use a Hyper-V VM, and provides instructions to install and configure Hyper-V if needed. To use a physical device, skip the steps to install and configure Hyper-V.| |**An account with Azure Active Directory (AD) Premium license**|This guide will describe how to obtain a free 30-day trial Azure AD Premium subscription that can be used to complete the lab.| ## Procedures -A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that do not apply to you. Optional procedures are provided in the appendices. +A summary of the sections and procedures in the lab is provided below. Follow each section in the order it's presented, skipping the sections that don't apply to you. Optional procedures are provided in the appendices. If you already have Hyper-V and a Windows 10 VM, you can skip directly to the [Capture the hardware ID](#capture-the-hardware-id) step. The VM must be running Windows 10, version 1903 or a later version. @@ -273,7 +273,7 @@ Select the **WindowsAutopilot** VM in Hyper-V Manager and verify that you see ** Follow these steps to run the PowerShell script: -1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same regardless of whether you're using a VM or a physical device: +1. **On the client VM**: Open an elevated Windows PowerShell prompt and run the following commands. These commands are the same whether you're using a VM or a physical device: ```powershell md c:\HWID @@ -362,7 +362,7 @@ For this lab, you need an Azure AD Premium subscription. To tell if you have a P ![MDM and Intune](images/mdm-intune2.png) -If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in Azure AD Premium. +If the configuration blade shown above doesn't appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in Azure AD Premium. To convert your Intune trial account to a free Premium trial account, go to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. @@ -618,7 +618,7 @@ You need to delete (or retire, or factory reset) the device from Intune before d > [!div class="mx-imgBorder"] > ![Delete device step 1](images/delete-device1.png) -This action removes the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot. So, the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. +This action removes the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this doesn't yet deregister the device from Autopilot. So, the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices** list mean different things and are two completely separate datastores. The former (All devices) is the list of devices currently enrolled into Intune. @@ -655,7 +655,7 @@ Hyper-V Requirements: VM Monitor Mode Extensions: Yes In this example, the computer supports SLAT and Hyper-V. > [!NOTE] -> If one or more requirements are evaluated as **No** then the computer does not support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting depends on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. +> If one or more requirements are evaluated as **No** then the computer doesn't support installing Hyper-V. However, if only the virtualization setting is incompatible, you might be able to enable virtualization in the BIOS and change the **Virtualization Enabled In Firmware** setting from **No** to **Yes**. The location of this setting depends on the manufacturer and BIOS version, but is typically found associated with the BIOS security settings. You can also identify Hyper-V support using [tools](/archive/blogs/taylorb/hyper-v-will-my-computer-run-hyper-v-detecting-intel-vt-and-amd-v) provided by the processor manufacturer, the [msinfo32](/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/cc731397(v=ws.11)) tool, or you can download the [Coreinfo](/sysinternals/downloads/coreinfo) utility and run it, as shown in the following example: From 46599fc90e9a126c62c59d6343a3e3e47230f1cb Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Thu, 26 Aug 2021 15:01:43 +0530 Subject: [PATCH 0118/1214] Updated --- .vscode/settings.json | 5 - .../policy-csp-admx-activexinstallservice.md | 2 +- .../mdm/policy-csp-admx-addremoveprograms.md | 243 +++++++++++------- .../mdm/policy-csp-admx-appcompat.md | 199 ++++++++------ 4 files changed, 281 insertions(+), 168 deletions(-) delete mode 100644 .vscode/settings.json diff --git a/.vscode/settings.json b/.vscode/settings.json deleted file mode 100644 index f66a07d2e4..0000000000 --- a/.vscode/settings.json +++ /dev/null @@ -1,5 +0,0 @@ -{ - "cSpell.words": [ - "emie" - ] -} \ No newline at end of file diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index a4020d12f2..67982daf0e 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -95,7 +95,7 @@ If the trusted site uses the HTTPS protocol, this policy setting can also contro ADMX Info: -- GP English name: *Establish ActiveX installation policy for sites in Trusted zones* +- GP Friendly name: *Establish ActiveX installation policy for sites in Trusted zones* - GP name: *AxISURLZonePolicies* - GP path: *Windows Components\ActiveX Installer Service* - GP ADMX file name: *ActiveXInstallService.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 647cff6ce4..478ce5c0d7 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -67,28 +67,33 @@ manager: dansimp - - + + + - + + - + + - + + - - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck mark
YesYes
Educationcross markNoNo
@@ -125,7 +130,7 @@ If you disable this setting or do not configure it, all programs (Category: All) ADMX Info: -- GP English name: *Specify default category for Add New Programs* +- GP Friendly name: *Specify default category for Add New Programs* - GP name: *DefaultCategory* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -150,28 +155,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markYesYes
Enterprisecheck markNoNo
Educationcross markNoNo
@@ -206,7 +217,7 @@ If you disable this setting or do not configure it, the "Add a program from CD-R ADMX Info: -- GP English name: *Hide the "Add a program from CD-ROM or floppy disk" option* +- GP Friendly name: *Hide the "Add a program from CD-ROM or floppy disk" option* - GP name: *NoAddFromCDorFloppy* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -231,28 +242,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -287,7 +304,7 @@ If you disable this setting or do not configure it, "Add programs from Microsoft ADMX Info: -- GP English name: *Hide the "Add programs from Microsoft" option* +- GP Friendly name: *Hide the "Add programs from Microsoft" option* - GP name: *NoAddFromInternet* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -312,28 +329,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -370,7 +393,7 @@ If you disable this setting or do not configure it, "Add programs from your netw ADMX Info: -- GP English name: *Hide the "Add programs from your network" option* +- GP Friendly name: *Hide the "Add programs from your network" option* - GP name: *NoAddFromNetwork* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -394,28 +417,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -447,7 +476,7 @@ If you disable this setting or do not configure it, the Add New Programs button ADMX Info: -- GP English name: *Hide Add New Programs page* +- GP Friendly name: *Hide Add New Programs page* - GP name: *NoAddPage* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -472,28 +501,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -525,7 +560,7 @@ If you disable this setting or do not configure it, Add or Remove Programs is av ADMX Info: -- GP English name: *Remove Add or Remove Programs* +- GP Friendly name: *Remove Add or Remove Programs* - GP name: *NoAddRemovePrograms* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -550,28 +585,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -604,7 +645,7 @@ If you disable this setting or do not configure it, the Set Program Access and D ADMX Info: -- GP English name: *Hide the Set Program Access and Defaults page* +- GP Friendly name: *Hide the Set Program Access and Defaults page* - GP name: *NoChooseProgramsPage* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -629,28 +670,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -682,7 +729,7 @@ If you disable this setting or do not configure it, the Change or Remove Program ADMX Info: -- GP English name: *Hide Change or Remove Programs page* +- GP Friendly name: *Hide Change or Remove Programs page* - GP name: *NoRemovePage* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -707,28 +754,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -763,7 +816,7 @@ If you disable this setting or do not configure it, "Set up services" appears on ADMX Info: -- GP English name: *Go directly to Components Wizard* +- GP Friendly name: *Go directly to Components Wizard* - GP name: *NoServices* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -788,28 +841,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -844,7 +903,7 @@ If you disable this setting or do not configure it, the Support Info hyperlink a ADMX Info: -- GP English name: *Remove Support Information* +- GP Friendly name: *Remove Support Information* - GP name: *NoSupportInfo* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* @@ -869,28 +928,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -922,7 +987,7 @@ If you disable this setting or do not configure it, the Add/Remove Windows Compo ADMX Info: -- GP English name: *Hide Add/Remove Windows Components page* +- GP Friendly name: *Hide Add/Remove Windows Components page* - GP name: *NoWindowsSetupPage* - GP path: *Control Panel/Add or Remove Programs* - GP ADMX file name: *addremoveprograms.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index ff2c292c54..901a7a04b6 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -70,28 +70,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -131,7 +137,7 @@ If the status is set to Not Configured, the OS falls back on a local policy set ADMX Info: -- GP English name: *Prevent access to 16-bit applications* +- GP Friendly name: *Prevent access to 16-bit applications* - GP name: *AppCompatPrevent16BitMach* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -147,28 +153,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -202,7 +214,7 @@ Enabling this policy setting removes the property page from the context-menus, b ADMX Info: -- GP English name: *Remove Program Compatibility Property Page* +- GP Friendly name: *Remove Program Compatibility Property Page* - GP name: *AppCompatRemoveProgramCompatPropPage* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -218,28 +230,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -277,7 +295,7 @@ Disabling telemetry will take effect on any newly launched applications. To ensu ADMX Info: -- GP English name: *Turn off Application Telemetry* +- GP Friendly name: *Turn off Application Telemetry* - GP name: *AppCompatTurnOffApplicationImpactTelemetry* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -293,28 +311,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -353,7 +377,7 @@ Reboot the system after changing the setting to ensure that your system accurate ADMX Info: -- GP English name: *Turn off SwitchBack Compatibility Engine* +- GP Friendly name: *Turn off SwitchBack Compatibility Engine* - GP name: *AppCompatTurnOffSwitchBack* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -369,29 +393,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross mark
NoNo
@@ -431,7 +460,7 @@ This option is useful to server administrators who require faster performance an ADMX Info: -- GP English name: *Turn off Application Compatibility Engine* +- GP Friendly name: *Turn off Application Compatibility Engine* - GP name: *AppCompatTurnOffEngine* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -447,28 +476,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -498,7 +533,7 @@ Available in the latest Windows 10 Insider Preview Build. This policy setting ex ADMX Info: -- GP English name: *Turn off Program Compatibility Assistant* +- GP Friendly name: *Turn off Program Compatibility Assistant* - GP name: *AppCompatTurnOffProgramCompatibilityAssistant_1* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -514,28 +549,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -572,7 +613,7 @@ If you disable or do not configure this policy setting, the PCA will be turned o ADMX Info: -- GP English name: *Turn off Program Compatibility Assistant* +- GP Friendly name: *Turn off Program Compatibility Assistant* - GP name: *AppCompatTurnOffProgramCompatibilityAssistant_2* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -588,28 +629,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -645,7 +692,7 @@ If you disable or do not configure this policy setting, Steps Recorder will be e ADMX Info: -- GP English name: *Turn off Steps Recorder* +- GP Friendly name: *Turn off Steps Recorder* - GP name: *AppCompatTurnOffUserActionRecord* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* @@ -661,28 +708,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procross markNoNo
Businesscross markNoNo
Enterprisecheck markYesYes
Educationcross markNoNo
@@ -721,7 +774,7 @@ If you disable or do not configure this policy setting, the Inventory Collector ADMX Info: -- GP English name: *Turn off Inventory Collector* +- GP Friendly name: *Turn off Inventory Collector* - GP name: *AppCompatTurnOffProgramInventory* - GP path: *Windows Components/Application Compatibility* - GP ADMX file name: *AppCompat.admx* From b5f096d970edb28d63a2a66c3abebacbb1a02a68 Mon Sep 17 00:00:00 2001 From: Denise Vangel-MSFT Date: Thu, 26 Aug 2021 08:40:13 -0700 Subject: [PATCH 0119/1214] Update policy-csp-system.md --- windows/client-management/mdm/policy-csp-system.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 0a38aefabc..d627137d97 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 10/14/2020 +ms.date: 08/26/2021 ms.reviewer: manager: dansimp --- From ade4256933687941f52d9354a39d2c24b7845582 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 26 Aug 2021 09:39:08 -0700 Subject: [PATCH 0120/1214] BitLocker 2 go deprecation announce --- windows/deployment/planning/windows-10-deprecated-features.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 72bcfc72c9..9f5ea44089 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -8,7 +8,7 @@ ms.sitesec: library audience: itpro author: greg-lindsay ms.author: greglin -manager: laurawi +manager: dougeby ms.topic: article --- # Windows 10 features we’re no longer developing @@ -26,6 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | +| BitLocker 2 Go Reader | Reading of BitLocker-protected removable drives from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11. The ADMX policy **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**, the command line parameter [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv), the catalog file **c:\windows\BitLockerDiscoveryVolumeContents**, and the BitLocker 2 Go Reader app **bitlockertogo.exe** might not be available in future releases of Windows client. | 21H1 | | Internet Explorer (IE) 11 | The IE11 desktop application will end support for certain operating systems starting June 15, 2022. For more information, see [Internet Explorer 11](/lifecycle/products/internet-explorer-11). | 21H1 | | Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | | Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](/powershell/scripting/learn/ps101/07-working-with-wmi). Note: This deprecation only applies to the [command-line management tool](/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | From 1359094c7792cd2b25bb730cc7b19f2ad56d671b Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 26 Aug 2021 09:58:55 -0700 Subject: [PATCH 0121/1214] update --- windows/deployment/planning/windows-10-deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 9f5ea44089..74bfc3ac68 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,7 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| BitLocker 2 Go Reader | Reading of BitLocker-protected removable drives from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11. The ADMX policy **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**, the command line parameter [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv), the catalog file **c:\windows\BitLockerDiscoveryVolumeContents**, and the BitLocker 2 Go Reader app **bitlockertogo.exe** might not be available in future releases of Windows client. | 21H1 | +| BitLocker To Go Reader | Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11.
The following might not be available in a future release of Windows client:
- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**
- Command line parameter: [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv)
- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**
- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 | | Internet Explorer (IE) 11 | The IE11 desktop application will end support for certain operating systems starting June 15, 2022. For more information, see [Internet Explorer 11](/lifecycle/products/internet-explorer-11). | 21H1 | | Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | | Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](/powershell/scripting/learn/ps101/07-working-with-wmi). Note: This deprecation only applies to the [command-line management tool](/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | From 0c2508c342452c369488065f68431d2c9c40722b Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 26 Aug 2021 12:20:12 -0700 Subject: [PATCH 0122/1214] update --- windows/deployment/planning/windows-10-deprecated-features.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/planning/windows-10-deprecated-features.md b/windows/deployment/planning/windows-10-deprecated-features.md index 74bfc3ac68..c23e505800 100644 --- a/windows/deployment/planning/windows-10-deprecated-features.md +++ b/windows/deployment/planning/windows-10-deprecated-features.md @@ -26,7 +26,7 @@ The features described below are no longer being actively developed, and might b |Feature | Details and mitigation | Announced in version | | ----------- | --------------------- | ---- | -| BitLocker To Go Reader | Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11.
The following might not be available in a future release of Windows client:
- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**
- Command line parameter: [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv)
- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**
- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 | +| BitLocker To Go Reader | Reading of BitLocker-protected removable drives ([BitLocker To Go](/windows/security/information-protection/bitlocker/bitlocker-to-go-faq)) from Windows XP or Windows Vista in later operating systems is deprecated and might be removed in a future release of Windows 10/11.
The following items might not be available in a future release of Windows client:
- ADMX policy: **Allow access to BitLocker-protected removable data drives from earlier versions of Windows**
- Command line parameter: [manage-bde -DiscoveryVolumeType](/windows-server/administration/windows-commands/manage-bde-on) (-dv)
- Catalog file: **c:\windows\BitLockerDiscoveryVolumeContents**
- BitLocker 2 Go Reader app: **bitlockertogo.exe** and associated files | 21H1 | | Internet Explorer (IE) 11 | The IE11 desktop application will end support for certain operating systems starting June 15, 2022. For more information, see [Internet Explorer 11](/lifecycle/products/internet-explorer-11). | 21H1 | | Personalization roaming | Roaming of Personalization settings (including wallpaper, slideshow, accent colors, and lock screen images) is no longer being developed and might be removed in a future release. | 21H1 | | Windows Management Instrumentation Command line (WMIC) tool. | The WMIC tool is deprecated in Windows 10, version 21H1 and the 21H1 semi-annual channel release of Windows Server. This tool is superseded by [Windows PowerShell for WMI](/powershell/scripting/learn/ps101/07-working-with-wmi). Note: This deprecation only applies to the [command-line management tool](/windows/win32/wmisdk/wmic). WMI itself is not affected. | 21H1 | From 1f0920d20a05ae66d0f4b4f807a3d7dddf66db2a Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 26 Aug 2021 16:39:52 -0700 Subject: [PATCH 0123/1214] update --- windows/deployment/upgrade/setupdiag.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 9e7a29631c..361081ed5e 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -29,10 +29,10 @@ ms.topic: article ## About SetupDiag -Current downloadable version of SetupDiag: 1.6.2107.27002 ->Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. +Current downloadable version of SetupDiag: 1.6.2107.27002. +> Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. -SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. +SetupDiag is a diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. @@ -344,6 +344,10 @@ Each rule name and its associated unique rule identifier are listed with a descr ## Release notes +07/27/2021 - SetupDiag v1.6.2107.27002 is released with 61 rules, as a standalone tool available in the Download Center. +- This version contains compliance updates and minor bug fixes. +- With this release and subsequent releases, the version number of the downloadable SetupDiag tool is different from the one included with Windows Setup. + 05/06/2021 - SetupDiag v1.6.1.0 is released with 61 rules, as a standalone tool available in the Download Center. - This version of SetupDiag is included with Windows 10, version 21H1. - A new rule is added: UserProfileSuffixMismatch. From 19d5bb2f415b2a41bd8ba454cd00152705e5bb09 Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Fri, 27 Aug 2021 11:29:08 +0530 Subject: [PATCH 0124/1214] Updated --- .../mdm/policy-csp-abovelock.md | 12 +++++------ .../mdm/policy-csp-activexcontrols.md | 20 ++++++++----------- .../policy-csp-admx-activexinstallservice.md | 17 ++++++---------- 3 files changed, 20 insertions(+), 29 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index b1bc434f3a..341da28ece 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -14,7 +14,6 @@ manager: dansimp # Policy CSP - AboveLock -[!INCLUDE[appliesto-xxx-xxx-xxx-SUB-xxx-md](../includes/appliesto-xxx-xxx-xxx-SUB-xxx-md.md)]
@@ -55,11 +54,11 @@ manager: dansimp Enterprise - Yes, starting in Windows 10, version 1909Yes + Yes, starting in Windows 10, version 1903Yes Education - Yes, starting in Windows 10, version 2004Yes + Yes, starting in Windows 10, version 1903Yes @@ -81,7 +80,7 @@ Added in Windows 10, version 1607. Specifies whether or not the user can intera ADMX Info: -- GP English name: *Allow Cortana above lock screen* +- GP Friendly name: *Allow Cortana above lock screen* - GP name: *AllowCortanaAboveLock* - GP path: *Windows Components/Search* - GP ADMX file name: *Search.admx* @@ -104,8 +103,9 @@ The following list shows the supported values: - - + + + diff --git a/windows/client-management/mdm/policy-csp-activexcontrols.md b/windows/client-management/mdm/policy-csp-activexcontrols.md index d760021b1e..218006e1a3 100644 --- a/windows/client-management/mdm/policy-csp-activexcontrols.md +++ b/windows/client-management/mdm/policy-csp-activexcontrols.md @@ -36,29 +36,25 @@ manager: dansimp
Windows EditionSupported?EditionWindows 10Windows 11
Home
- - + + + - + - - - - - + - + - - +
Windows EditionSupported?EditionWindows 10Windows 11
Homecross markNoNo
Procheck mark
Businesscheck markYes, starting in Windows 10, version 1607Yes
Enterprisecheck markYes, starting in Windows 10, version 1607Yes
Educationcheck mark
Yes, starting in Windows 10, version 1607Yes
@@ -92,7 +88,7 @@ Note: Wild card characters cannot be used when specifying the host URLs. ADMX Info: -- GP English name: *Approved Installation Sites for ActiveX Controls* +- GP Friendly name: *Approved Installation Sites for ActiveX Controls* - GP name: *ApprovedActiveXInstallSites* - GP path: *Windows Components/ActiveX Installer Service* - GP ADMX file name: *ActiveXInstallService.admx* diff --git a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md index 67982daf0e..b4cea8e9e5 100644 --- a/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md +++ b/windows/client-management/mdm/policy-csp-admx-activexinstallservice.md @@ -37,28 +37,23 @@ manager: dansimp - - + + - + - - - - - + - + - - +
Windows EditionSupported?
Windows 10Windows 11
Homecross markNoNo
Procross mark
Businesscross markYes, starting in Windows 10, version 1903Yes
Enterprisecheck markYes, starting in Windows 10, version 1903Yes
Educationcross mark
Yes, starting in Windows 10, version 1903Yes
From e87ef8501d40b3c702f8ea2aea542b91cc179bf2 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Fri, 27 Aug 2021 11:58:56 +0530 Subject: [PATCH 0125/1214] Revert "Merge branch 'master' into aljupudi-w11defender-branch01" This reverts commit 6e47b57bcd3bccd4020bf71580e90b8a10cd716e, reversing changes made to 4467c6631d67200cfabcdd9d4ff576855e14a2e5. --- CONTRIBUTING.md | 10 +- ...ct-data-using-enterprise-site-discovery.md | 14 +- ...rprise-mode-logging-and-data-collection.md | 18 +- ...-on-enterprise-mode-and-use-a-site-list.md | 4 +- ...control-and-logging-for-enterprise-mode.md | 4 +- ...ct-data-using-enterprise-site-discovery.md | 14 +- .../deprecated-document-modes.md | 2 +- ...doc-modes-and-enterprise-mode-site-list.md | 6 +- .../out-of-date-activex-control-blocking.md | 6 +- ...-the-default-browser-using-group-policy.md | 2 +- ...rprise-mode-logging-and-data-collection.md | 18 +- ...s-and-tricks-to-manage-ie-compatibility.md | 4 +- ...-on-enterprise-mode-and-use-a-site-list.md | 4 +- ...control-and-logging-for-enterprise-mode.md | 4 +- .../licensing-version-and-features-ieak11.md | 52 ++--- .../educator-tib-get-started.md | 62 +++--- education/trial-in-a-box/index.md | 4 +- .../trial-in-a-box/itadmin-tib-get-started.md | 46 ++--- education/trial-in-a-box/support-options.md | 12 +- education/windows/autopilot-reset.md | 8 +- education/windows/change-to-pro-education.md | 20 +- .../windows/chromebook-migration-guide.md | 4 +- .../configure-windows-for-education.md | 10 +- .../deploy-windows-10-in-a-school-district.md | 16 +- .../windows/deploy-windows-10-in-a-school.md | 14 +- .../windows/edu-deployment-recommendations.md | 12 +- .../education-scenarios-store-for-business.md | 4 +- .../windows/get-minecraft-for-education.md | 6 +- education/windows/index.md | 10 +- education/windows/school-get-minecraft.md | 46 ++--- .../set-up-school-pcs-azure-ad-join.md | 2 +- .../set-up-students-pcs-to-join-domain.md | 2 +- .../windows/set-up-students-pcs-with-apps.md | 26 +-- education/windows/set-up-windows-10.md | 2 +- education/windows/take-a-test-multiple-pcs.md | 14 +- education/windows/take-a-test-single-pc.md | 4 +- education/windows/take-tests-in-windows-10.md | 2 +- education/windows/teacher-get-minecraft.md | 22 +- .../windows/use-set-up-school-pcs-app.md | 2 +- smb/cloud-mode-business-setup.md | 92 ++++----- smb/index.md | 6 +- ...quire-apps-microsoft-store-for-business.md | 2 +- .../billing-understand-your-invoice-msfb.md | 6 +- ...or-business-education-powershell-module.md | 2 +- ...oubleshoot-microsoft-store-for-business.md | 10 +- ...-new-microsoft-store-business-education.md | 4 +- .../working-with-line-of-business-apps.md | 2 +- ...ation-publishing-and-client-interaction.md | 6 +- .../app-v/appv-deployment-checklist.md | 6 +- .../app-v/appv-install-the-sequencer.md | 2 +- .../app-v/appv-planning-checklist.md | 12 +- ...enterprise-background-activity-controls.md | 6 +- .../per-user-services-in-windows.md | 14 +- .../svchost-service-refactoring.md | 8 +- .../administrative-tools-in-windows-10.md | 4 +- ...nced-troubleshooting-802-authentication.md | 20 +- .../advanced-troubleshooting-boot-problems.md | 2 +- ...eshooting-wireless-network-connectivity.md | 4 +- ...t-removal-policy-external-storage-media.md | 2 +- .../connect-to-remote-aadj-pc.md | 4 +- .../client-management/img-boot-sequence.md | 2 +- .../introduction-page-file.md | 6 +- ...e-device-installation-with-group-policy.md | 38 ++-- .../manage-settings-app-with-group-policy.md | 2 +- ...-in-your-organization-modern-management.md | 2 +- .../mandatory-user-profile.md | 16 +- .../mdm/accountmanagement-csp.md | 2 +- ...ure-ad-tenant-and-azure-ad-subscription.md | 32 +-- .../client-management/mdm/applocker-csp.md | 6 +- .../mdm/appv-deploy-and-config.md | 2 +- ...e-active-directory-integration-with-mdm.md | 6 +- ...omatic-mdm-enrollment-in-the-new-portal.md | 4 +- .../client-management/mdm/bootstrap-csp.md | 2 +- .../mdm/browserfavorite-csp.md | 2 +- ...ollment-using-windows-provisioning-tool.md | 16 +- .../mdm/cellularsettings-csp.md | 2 +- .../mdm/cm-cellularentries-csp.md | 2 +- ...onfiguration-service-provider-reference.md | 60 +++--- .../mdm/device-update-management.md | 14 +- .../mdm/deviceinstanceservice-csp.md | 2 +- .../client-management/mdm/devicelock-csp.md | 2 +- .../diagnose-mdm-failures-in-windows-10.md | 20 +- .../disconnecting-from-mdm-unenrollment.md | 2 +- .../mdm/eap-configuration.md | 22 +- .../mdm/enable-admx-backed-policies-in-mdm.md | 12 +- ...dded-8-1-handheld-devices-to-windows-10.md | 44 ++-- ...device-automatically-using-group-policy.md | 44 ++-- .../mdm/enterprise-app-management.md | 2 +- .../mdm/enterpriseappmanagement-csp.md | 2 +- .../client-management/mdm/filesystem-csp.md | 2 +- .../mdm/healthattestation-csp.md | 2 +- windows/client-management/mdm/hotspot-csp.md | 2 +- ...rver-side-mobile-application-management.md | 2 +- ...ent-tool-for-windows-store-for-business.md | 6 +- .../mdm/mdm-enrollment-of-windows-devices.md | 76 +++---- .../client-management/mdm/messaging-csp.md | 2 +- .../mdm/mobile-device-enrollment.md | 2 +- windows/client-management/mdm/napdef-csp.md | 4 +- ...ew-in-windows-mdm-enrollment-management.md | 10 +- .../mdm/passportforwork-csp.md | 4 +- .../policy-configuration-service-provider.md | 2 +- .../mdm/policy-csp-deviceinstallation.md | 8 +- .../mdm/policy-csp-mixedreality.md | 28 +-- .../mdm/policy-csp-system.md | 15 +- .../mdm/push-notification-windows-mdm.md | 16 +- .../client-management/mdm/pxlogical-csp.md | 4 +- ...ree-azure-active-directory-subscription.md | 6 +- .../mdm/securitypolicy-csp.md | 2 +- .../mdm/understanding-admx-backed-policies.md | 4 +- .../mdm/unifiedwritefilter-csp.md | 2 +- windows/client-management/mdm/vpn-csp.md | 2 +- .../mdm/w4-application-csp.md | 2 +- .../mdm/w7-application-csp.md | 2 +- windows/client-management/mdm/wifi-csp.md | 2 +- .../mdm/windows-mdm-enterprise-settings.md | 2 +- .../windowsadvancedthreatprotection-csp.md | 2 +- .../mdm/wmi-providers-supported-in-windows.md | 60 +++--- windows/client-management/quick-assist.md | 2 +- .../troubleshoot-inaccessible-boot-device.md | 16 +- .../troubleshoot-stop-errors.md | 4 +- .../troubleshoot-tcpip-connectivity.md | 16 +- .../troubleshoot-tcpip-netmon.md | 8 +- .../troubleshoot-tcpip-port-exhaust.md | 18 +- .../troubleshoot-tcpip-rpc-errors.md | 10 +- .../windows-version-search.md | 10 +- .../configure-windows-10-taskbar.md | 16 +- .../cortana-at-work/cortana-at-work-crm.md | 4 +- .../cortana-at-work-powerbi.md | 26 +-- .../cortana-at-work-voice-commands.md | 2 +- .../customize-and-export-start-layout.md | 2 +- ...-10-start-screens-by-using-group-policy.md | 4 +- ...-by-using-provisioning-packages-and-icd.md | 2 +- ...ation-user-model-id-of-an-installed-app.md | 2 +- windows/configuration/kiosk-methods.md | 12 +- windows/configuration/kiosk-prepare.md | 4 +- windows/configuration/kiosk-shelllauncher.md | 2 +- windows/configuration/kiosk-single-app.md | 10 +- windows/configuration/kiosk-troubleshoot.md | 2 +- .../lock-down-windows-10-applocker.md | 8 +- .../lock-down-windows-10-to-specific-apps.md | 14 +- .../manage-wifi-sense-in-enterprise.md | 6 +- .../mobile-devices/lockdown-xml.md | 30 +-- .../mobile-lockdown-designer.md | 28 +-- .../provisioning-configure-mobile.md | 6 +- .../mobile-devices/provisioning-nfc.md | 2 +- ...kiosk-for-windows-10-for-mobile-edition.md | 12 +- .../mobile-devices/start-layout-xml-mobile.md | 2 +- windows/configuration/provisioning-apn.md | 4 +- ...can-use-configuration-service-providers.md | 10 +- .../provision-pcs-for-initial-deployment.md | 6 +- ...rovision-pcs-with-apps-and-certificates.md | 8 +- .../provision-pcs-with-apps.md | 10 +- .../provisioning-apply-package.md | 14 +- .../provisioning-create-package.md | 10 +- .../provisioning-install-icd.md | 2 +- .../provisioning-multivariant.md | 2 +- .../provisioning-packages.md | 2 +- .../provisioning-script-to-install-app.md | 4 +- .../set-up-shared-or-guest-pc.md | 8 +- .../start-layout-troubleshoot.md | 14 +- .../configuration/start-secondary-tiles.md | 8 +- .../uev-deploy-uev-for-custom-applications.md | 2 +- windows/configuration/ue-v/uev-for-windows.md | 4 +- .../ue-v/uev-prepare-for-deployment.md | 16 +- .../uev-upgrade-uev-from-previous-releases.md | 2 +- .../configuration/wcd/wcd-admxingestion.md | 4 +- ...ws-10-start-layout-options-and-policies.md | 4 +- windows/configuration/windows-spotlight.md | 8 +- windows/deployment/TOC.yml | 2 - .../deployment/deploy-enterprise-licenses.md | 6 +- windows/deployment/deploy-m365.md | 4 +- windows/deployment/deploy-whats-new.md | 2 +- ...ystem-image-using-configuration-manager.md | 4 +- ...-windows-pe-using-configuration-manager.md | 16 +- ...e-boot-image-with-configuration-manager.md | 10 +- ...ence-with-configuration-manager-and-mdt.md | 4 +- ...-windows-10-using-configuration-manager.md | 4 +- ...-10-using-pxe-and-configuration-manager.md | 30 +-- ...0-deployment-with-configuration-manager.md | 12 +- ...f-windows-10-with-configuration-manager.md | 22 +- ...-windows-10-using-configuration-manager.md | 22 +- ...-windows-10-using-configuration-manager.md | 24 +-- ...to-windows-10-with-configuraton-manager.md | 16 +- .../assign-applications-using-roles-in-mdt.md | 6 +- ...d-environment-for-windows-10-deployment.md | 10 +- .../configure-mdt-settings.md | 2 +- .../create-a-windows-10-reference-image.md | 28 +-- .../deploy-a-windows-10-image-using-mdt.md | 38 ++-- ...d-with-the-microsoft-deployment-toolkit.md | 8 +- ...prepare-for-windows-deployment-with-mdt.md | 10 +- ...sh-a-windows-7-computer-with-windows-10.md | 6 +- ...s-7-computer-with-a-windows-10-computer.md | 12 +- .../set-up-mdt-for-bitlocker.md | 6 +- ...ows-10-deployment-in-a-test-environment.md | 4 +- ...0-with-the-microsoft-deployment-toolkit.md | 8 +- .../use-orchestrator-runbooks-with-mdt.md | 20 +- ...stage-windows-10-deployment-information.md | 8 +- .../use-web-services-in-mdt.md | 16 +- windows/deployment/index.yml | 2 +- windows/deployment/mbr-to-gpt.md | 2 +- ...compatibility-administrator-users-guide.md | 2 +- ...oyment-considerations-for-windows-to-go.md | 12 +- ...rstanding-and-using-compatibility-fixes.md | 4 +- .../deployment/planning/using-the-sua-tool.md | 2 +- .../planning/using-the-sua-wizard.md | 2 +- .../windows-10-infrastructure-requirements.md | 2 +- windows/deployment/s-mode.md | 4 +- windows/deployment/update/PSFxWhitepaper.md | 8 +- windows/deployment/update/WIP4Biz-intro.md | 2 +- .../deployment/update/check-release-health.md | 12 +- .../update/deployment-service-overview.md | 4 +- .../get-started-updates-channels-tools.md | 12 +- .../update/how-windows-update-works.md | 14 +- .../deployment/update/media-dynamic-update.md | 2 +- .../olympia/olympia-enrollment-guidelines.md | 14 +- .../deployment/update/plan-define-strategy.md | 4 +- windows/deployment/update/safeguard-holds.md | 2 +- ...update-compliance-delivery-optimization.md | 2 +- ...update-compliance-feature-update-status.md | 2 +- .../update-compliance-need-attention.md | 2 +- ...pdate-compliance-security-update-status.md | 2 +- .../update/update-compliance-using.md | 8 +- .../deployment/update/waas-configure-wufb.md | 2 +- .../waas-delivery-optimization-setup.md | 2 +- .../update/waas-delivery-optimization.md | 2 +- ...aas-deployment-rings-windows-10-updates.md | 12 +- .../deployment/update/waas-integrate-wufb.md | 2 +- .../update/waas-manage-updates-wsus.md | 48 ++--- .../update/waas-manage-updates-wufb.md | 14 +- .../waas-optimize-windows-10-updates.md | 16 +- windows/deployment/update/waas-overview.md | 14 +- windows/deployment/update/waas-restart.md | 19 +- ...s-servicing-channels-windows-10-updates.md | 24 +-- .../update/waas-servicing-differences.md | 6 +- ...s-servicing-strategy-windows-10-updates.md | 14 +- .../deployment/update/waas-wufb-csp-mdm.md | 18 +- .../update/waas-wufb-group-policy.md | 18 +- windows/deployment/update/waas-wufb-intune.md | 20 +- .../deployment/update/windows-update-logs.md | 10 +- .../update/windows-update-overview.md | 2 +- .../update/wufb-compliancedeadlines.md | 12 +- .../deployment/update/wufb-manageupdate.md | 2 +- windows/deployment/upgrade/quick-fixes.md | 8 +- windows/deployment/upgrade/setupdiag.md | 14 +- windows/deployment/upgrade/submit-errors.md | 4 +- .../upgrade/troubleshoot-upgrade-errors.md | 14 +- .../upgrade/windows-10-edition-upgrades.md | 42 ++-- .../upgrade/windows-error-reporting.md | 2 +- .../usmt/migration-store-types-overview.md | 2 +- .../usmt/usmt-common-migration-scenarios.md | 4 +- ...ctive-directory-based-activation-client.md | 12 +- ...ivate-using-key-management-service-vamt.md | 12 +- .../activate-windows-10-clients-vamt.md | 4 +- .../add-remove-computers-vamt.md | 2 +- .../configure-client-computers-vamt.md | 2 +- .../volume-activation/install-vamt.md | 4 +- .../volume-activation/introduction-vamt.md | 4 +- .../plan-for-volume-activation-client.md | 6 +- .../scenario-online-activation-vamt.md | 2 +- .../scenario-proxy-activation-vamt.md | 2 +- ...olume-activation-management-tool-client.md | 4 +- .../volume-activation/vamt-known-issues.md | 2 +- .../windows-10-deployment-posters.md | 4 +- windows/deployment/windows-10-media.md | 4 +- windows/deployment/windows-10-poc-mdt.md | 4 +- .../windows-10-poc-sc-config-mgr.md | 18 +- windows/deployment/windows-10-poc.md | 16 +- .../windows-10-subscription-activation.md | 14 +- .../demonstrate-deployment-on-vm.md | 128 ++++++------ .../windows-deployment-scenarios-and-tools.md | 28 +-- .../privacy/Microsoft-DiagnosticDataViewer.md | 4 +- .../diagnostic-data-viewer-overview.md | 16 +- ...system-components-to-microsoft-services.md | 192 +++++++++--------- .../active-directory-accounts.md | 30 +-- .../access-control/local-accounts.md | 16 +- .../access-control/security-identifiers.md | 2 +- .../access-control/security-principals.md | 2 +- .../identity-protection/configure-s-mime.md | 8 +- .../credential-guard-how-it-works.md | 2 +- .../credential-guard-manage.md | 4 +- .../enterprise-certificate-pinning.md | 12 +- .../feature-multifactor-unlock.md | 4 +- .../hello-adequate-domain-controllers.md | 10 +- .../hello-cert-trust-adfs.md | 20 +- .../hello-cert-trust-validate-ad-prereq.md | 2 +- .../hello-deployment-rdp-certs.md | 6 +- .../hello-errors-during-pin-creation.md | 2 +- .../hello-feature-pin-reset.md | 8 +- .../hello-feature-remote-desktop.md | 2 +- .../hello-how-it-works-authentication.md | 10 +- .../hello-how-it-works-provisioning.md | 12 +- .../hello-hybrid-aadj-sso-base.md | 52 ++--- .../hello-hybrid-aadj-sso-cert.md | 94 ++++----- .../hello-hybrid-cert-trust-devreg.md | 18 +- .../hello-hybrid-cert-whfb-provision.md | 8 +- .../hello-hybrid-key-whfb-provision.md | 8 +- .../hello-key-trust-adfs.md | 20 +- .../hello-for-business/hello-overview.md | 2 +- .../hello-prepare-people-to-use.md | 6 +- .../passwordless-strategy.md | 20 +- .../retired/hello-how-it-works.md | 2 +- .../remote-credential-guard.md | 6 +- .../smart-card-and-remote-desktop-services.md | 2 +- .../smart-cards/smart-card-architecture.md | 8 +- ...rt-card-certificate-propagation-service.md | 2 +- ...ertificate-requirements-and-enumeration.md | 12 +- .../smart-card-removal-policy-service.md | 2 +- .../how-user-account-control-works.md | 10 +- ...l-smart-card-deploy-virtual-smart-cards.md | 2 +- .../virtual-smart-card-evaluate-security.md | 2 +- .../virtual-smart-card-get-started.md | 22 +- ...tual-smart-card-use-virtual-smart-cards.md | 2 +- .../vpn/vpn-authentication.md | 2 +- .../vpn/vpn-auto-trigger-profile.md | 4 +- .../vpn/vpn-conditional-access.md | 2 +- .../vpn/vpn-connection-type.md | 6 +- .../vpn/vpn-name-resolution.md | 2 +- .../vpn/vpn-profile-options.md | 2 +- .../identity-protection/vpn/vpn-routing.md | 4 +- .../vpn/vpn-security-features.md | 2 +- ...dential-theft-mitigation-guide-abstract.md | 2 +- .../bitlocker/bitlocker-countermeasures.md | 4 +- .../bitlocker-deployment-comparison.md | 48 ++--- .../bitlocker-recovery-guide-plan.md | 16 +- ...ve-encryption-tools-to-manage-bitlocker.md | 2 +- .../bitlocker/troubleshoot-bitlocker.md | 4 +- .../ts-bitlocker-cannot-encrypt-issues.md | 4 +- .../ts-bitlocker-decode-measured-boot-logs.md | 16 +- .../bitlocker/ts-bitlocker-intune-issues.md | 38 ++-- .../kernel-dma-protection-for-thunderbolt.md | 10 +- .../secure-the-windows-10-boot-process.md | 4 +- .../tpm/how-windows-uses-the-tpm.md | 4 +- ...reate-and-verify-an-efs-dra-certificate.md | 2 +- ...e-vpn-and-wip-policy-using-intune-azure.md | 8 +- .../create-wip-policy-using-configmgr.md | 40 ++-- .../create-wip-policy-using-intune-azure.md | 56 ++--- .../deploy-wip-policy-using-intune-azure.md | 2 +- .../wip-app-enterprise-context.md | 4 +- .../wip-learning.md | 8 +- ...tion-based-protection-of-code-integrity.md | 4 +- .../coordinated-malware-eradication.md | 2 +- .../intelligence/fileless-threats.md | 4 +- .../intelligence/malware-naming.md | 2 +- .../intelligence/phishing.md | 2 +- .../portal-submission-troubleshooting.md | 14 +- .../intelligence/worms-malware.md | 2 +- .../mbsa-removal-and-guidance.md | 4 +- .../install-md-app-guard.md | 6 +- .../md-app-guard-overview.md | 2 +- .../test-scenarios-md-app-guard.md | 34 ++-- ...microsoft-defender-smartscreen-overview.md | 2 +- ...ender-smartscreen-set-individual-device.md | 2 +- ...tions-for-app-related-security-policies.md | 6 +- ...iew-of-threat-mitigations-in-windows-10.md | 4 +- ...-the-health-of-windows-10-based-devices.md | 26 +-- ...-information-when-the-session-is-locked.md | 2 +- .../security-policy-settings.md | 8 +- ...arding-to-assist-in-intrusion-detection.md | 8 +- .../windows-10-mobile-security-guide.md | 2 +- .../LOB-win32-apps-on-s.md | 6 +- .../plan-for-applocker-policy-management.md | 2 +- ...ent-setting-inheritance-in-group-policy.md | 2 +- ...the-applocker-policy-deployment-process.md | 2 +- ...s-defender-application-control-policies.md | 2 +- ...s-defender-application-control-policies.md | 2 +- ...or-windows-defender-application-control.md | 8 +- ...rt-windows-defender-application-control.md | 20 +- ...ion-control-policies-using-group-policy.md | 6 +- ...plication-control-policies-using-intune.md | 2 +- ...defender-application-control-management.md | 2 +- .../wdac-wizard-create-base-policy.md | 10 +- .../wdac-wizard-create-supplemental-policy.md | 12 +- .../wdac-wizard-editing-policy.md | 4 +- .../wdac-wizard-merging-policies.md | 2 +- .../wdsc-account-protection.md | 2 +- .../wdsc-app-browser-control.md | 2 +- .../wdsc-customize-contact-information.md | 4 +- .../wdsc-device-performance-health.md | 2 +- .../wdsc-device-security.md | 2 +- .../wdsc-family-options.md | 2 +- .../wdsc-firewall-network-protection.md | 2 +- .../wdsc-virus-threat-protection.md | 2 +- .../wdsc-windows-10-in-s-mode.md | 2 +- .../windows-defender-security-center.md | 10 +- ...sed-root-of-trust-helps-protect-windows.md | 4 +- ...-guard-secure-launch-and-smm-protection.md | 8 +- .../best-practices-configuring.md | 14 +- .../windows-firewall/boundary-zone.md | 2 +- ...create-windows-firewall-rules-in-intune.md | 2 +- .../domain-isolation-policy-design-example.md | 2 +- .../domain-isolation-policy-design.md | 2 +- .../filter-origin-documentation.md | 10 +- .../firewall-policy-design-example.md | 2 +- ...wall-with-advanced-security-design-plan.md | 2 +- .../windows-firewall/quarantine.md | 4 +- ...n-accessing-sensitive-network-resources.md | 2 +- ...cess-to-only-specified-users-or-devices.md | 2 +- ...restrict-access-to-only-trusted-devices.md | 2 +- ...to-end-ipsec-connections-by-using-ikev2.md | 6 +- .../server-isolation-policy-design-example.md | 2 +- .../server-isolation-policy-design.md | 2 +- ...-administration-with-windows-powershell.md | 4 +- .../windows-security-baselines.md | 6 +- .../windows-security-baselines.md | 6 +- windows/whats-new/contribute-to-a-topic.md | 10 +- .../ltsc/whats-new-windows-10-2019.md | 20 +- .../whats-new-windows-10-version-1703.md | 8 +- .../whats-new-windows-10-version-1809.md | 36 ++-- .../whats-new-windows-10-version-1903.md | 2 +- .../whats-new-windows-10-version-2004.md | 2 +- 410 files changed, 2121 insertions(+), 2137 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index ef3a69ff52..75cb7255c8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,7 +20,7 @@ We've tried to make editing an existing, public file as simple as possible. 1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. - ![GitHub Web, showing the Edit link.](images/contribute-link.png) + ![GitHub Web, showing the Edit link](images/contribute-link.png) 2. Log into (or sign up for) a GitHub account. @@ -28,7 +28,7 @@ We've tried to make editing an existing, public file as simple as possible. 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) @@ -37,11 +37,11 @@ We've tried to make editing an existing, public file as simple as possible. 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. - ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png) + ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) The **Comparing changes** screen appears to see what the changes are between your fork and the original content. @@ -49,7 +49,7 @@ We've tried to make editing an existing, public file as simple as possible. If there are no problems, you’ll see the message, **Able to merge**. - ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png) + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index d4f9600d8b..4fc4fb1ecc 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -34,11 +34,11 @@ Before you start, you need to make sure you have the following: 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. - ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) + ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - ![affected software section.](images/affectedsoftware.png) + ![affected software section](images/affectedsoftware.png) 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. @@ -280,13 +280,13 @@ You can collect your hardware inventory using the MOF Editor, while you’re con 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) + ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) 2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. 3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) 4. Select the check boxes next to the following classes, and then click **OK**: @@ -393,12 +393,12 @@ The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sam ### SCCM Report Sample – ActiveX.rdl Gives you a list of all of the ActiveX-related sites visited by the client computer. -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) ### SCCM Report Sample – Site Discovery.rdl Gives you a list of all of the sites visited by the client computer. -![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) +![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) ## View the collected XML data After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: @@ -436,7 +436,7 @@ You can import this XML data into the correct version of the Enterprise Mode Sit 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) + ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) 2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md index 923d4dfe04..47322f0c03 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md @@ -27,11 +27,11 @@ ms.date: 07/27/2017 Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. -![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) +![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. -![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) +![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. @@ -47,11 +47,11 @@ This lets you create an ASP form that accepts the incoming POST messages. 3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) + ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) 4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - ![IIS Manager, setting logging options.](images/ie-emie-logging.png) + ![IIS Manager, setting logging options](images/ie-emie-logging.png) 5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. @@ -72,7 +72,7 @@ This code logs your POST fields to your IIS log file, where you can review all o ### IIS log file information This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. -![Enterprise Mode log file.](images/ie-emie-logfile.png) +![Enterprise Mode log file](images/ie-emie-logfile.png) ## Using the GitHub sample to collect your data @@ -99,14 +99,14 @@ The required packages are automatically downloaded and included in the solution. 1. Right-click on the name, PhoneHomeSample, and click **Publish**. - ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) + ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) 2. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. **Important**
Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) + ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) After you finish the publishing process, you need to test to make sure the app deployed successfully. @@ -131,7 +131,7 @@ The required packages are automatically downloaded and included in the solution. - Go to `https:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. - ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) + ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) ### Troubleshooting publishing errors @@ -141,7 +141,7 @@ If you have errors while you’re publishing your project, you should try to upd 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) + ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) 2. Click **Updates** on the left side of the tool, and click the **Update All** button.

You may need to do some additional package cleanup to remove older package versions. diff --git a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md index 4573423115..4651adf5cf 100644 --- a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md @@ -9,7 +9,7 @@ centralized control, you can create one global list of websites that render usin 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Configure the Enterprise Mode Site List** setting.

Turning this setting on also requires you to create and store a site list. 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. @@ -24,7 +24,7 @@ All of your managed devices must have access to this location if you want them t 2. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file.

For example: + ![Enterprise mode with site list in the registry](../edge/images/enterprise-mode-value-data.png) --> - **HTTPS location:** `"SiteList"="https://localhost:8080/sites.xml"` diff --git a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md index c8ef3d030c..b34f9be63f 100644 --- a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -33,7 +33,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) + ![group policy editor with emie setting](images/ie-emie-editpolicy.png) 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. @@ -45,7 +45,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 3. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) + ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) Your **Value data** location can be any of the following types: diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index 65fbb8eaaf..1acd936993 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -38,11 +38,11 @@ Before you start, you need to make sure you have the following: 1. Go to the [Microsoft Security Bulletin](/security-updates/) page, and change the filter to **Windows Internet Explorer 11**. - ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) + ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - ![affected software section.](images/affectedsoftware.png) + ![affected software section](images/affectedsoftware.png) 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. @@ -284,13 +284,13 @@ You can collect your hardware inventory using the MOF Editor, while you’re con 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) + ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) 2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. 3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) 4. Select the check boxes next to the following classes, and then click **OK**: @@ -397,12 +397,12 @@ The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sam ### SCCM Report Sample – ActiveX.rdl Gives you a list of all of the ActiveX-related sites visited by the client computer. -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) ### SCCM Report Sample – Site Discovery.rdl Gives you a list of all of the sites visited by the client computer. -![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) +![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) ## View the collected XML data After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: @@ -440,7 +440,7 @@ You can import this XML data into the correct version of the Enterprise Mode Sit 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) + ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) 2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index 5cfa201d18..e8d1ec3d7d 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -48,7 +48,7 @@ The compatibility improvements made in IE11 lets older websites just work in the ## Document mode selection flowchart This flowchart shows how IE11 works when document modes are used. -![Flowchart detailing how document modes are chosen in IE11.](images/docmode-decisions-sm.png)
+![Flowchart detailing how document modes are chosen in IE11](images/docmode-decisions-sm.png)
[Click this link to enlarge image](img-ie11-docmode-lg.md) ## Known Issues with Internet Explorer 8 document mode in Enterprise Mode diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md index 9ec7ddf862..333686dc07 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md @@ -45,7 +45,7 @@ To see if this fix might help you, run through this process one step at a time, 1. Go to a site having compatibility problems, press **F12** to open the **F12 Developer Tools**, and go to the **Emulation** tool. - ![Emulation tool showing document mode selection.](images/docmode-f12.png) + ![Emulation tool showing document mode selection](images/docmode-f12.png) 2. Starting with the **11 (Default)** option, test your broken scenario.
If that doesn’t work, continue down to the next lowest document mode, stopping as soon as you find a document mode that fixes your problems. For more information about the Emulation tool, see [Emulate browsers, screen sizes, and GPS locations](/previous-versions/windows/internet-explorer/ie-developer/samples/dn255001(v=vs.85)). @@ -62,7 +62,7 @@ There are two versions of the Enterprise Mode site list schema and the Enterpris 1. Open the Enterprise Mode Site List Manager, and click **Add**. - ![Enterprise Mode Site List Manager, showing the available modes.](images/emie-listmgr.png) + ![Enterprise Mode Site List Manager, showing the available modes](images/emie-listmgr.png) 2. Add the **URL** and pick the document mode from the **Launch in** box. This should be the same document mode you found fixed your problems while testing the site.
Similar to Enterprise Mode, you can specify a document mode for a particular web path—such as contoso.com/ERP—or at a domain level. In the above, the entire contoso.com domain loads in Enterprise Mode, while microsoft.com is forced to load into IE8 Document Mode and bing.com loads in IE11. @@ -74,7 +74,7 @@ For more information about Enterprise Mode, see [What is Enterprise Mode?](what- ### Review your Enterprise Mode site list Take a look at your Enterprise Mode site list and make sure everything is the way you want it. The next step will be to turn the list on and start to use it in your company. The Enterprise Mode Site List Manager will look something like: -![Enterprise Mode Site List Manager, showing the different modes.](images/emie-sitelistmgr.png) +![Enterprise Mode Site List Manager, showing the different modes](images/emie-sitelistmgr.png) And the underlying XML code will look something like: diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 4eed39657f..75283c1f64 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -62,15 +62,15 @@ When IE blocks an outdated ActiveX control, you’ll see a notification bar simi **Internet Explorer 9 through Internet Explorer 11** -![Warning about outdated activex controls (ie9+).](images/outdatedcontrolwarning.png) +![Warning about outdated activex controls (ie9+)](images/outdatedcontrolwarning.png) **Windows Internet Explorer 8** -![Warning about outdated activex controls (ie8).](images/ieoutdatedcontrolwarning.png) +![Warning about outdated activex controls (ie8)](images/ieoutdatedcontrolwarning.png) Out-of-date ActiveX control blocking also gives you a security warning that tells you if a webpage tries to launch specific outdated apps, outside of IE: -![Warning about outdated activex controls outside ie.](images/ieoutdatedcontroloutsideofie.png) +![Warning about outdated activex controls outside ie](images/ieoutdatedcontroloutsideofie.png) ## How do I fix an outdated ActiveX control or app? diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 9424e5e32f..6edccdda73 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -27,7 +27,7 @@ You can use the Group Policy setting, **Set a default associations configuration 1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). - ![set default associations group policy setting.](images/setdefaultbrowsergp.png) + ![set default associations group policy setting](images/setdefaultbrowsergp.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your default associations configuration file.

If this setting is turned on and your employee's device is domain-joined, this file is processed and default associations are applied at logon. If this setting isn't configured or is turned off, or if your employee's device isn't domain-joined, no default associations are applied at logon. diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md index b42426f1d7..dd26f8e369 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md @@ -31,11 +31,11 @@ ms.date: 07/27/2017 Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. -![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) +![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. -![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) +![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. @@ -51,11 +51,11 @@ When you turn logging on, you need a valid URL that points to a server that can 3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) + ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) 4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - ![IIS Manager, setting logging options.](images/ie-emie-logging.png) + ![IIS Manager, setting logging options](images/ie-emie-logging.png) 5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. @@ -76,7 +76,7 @@ When you turn logging on, you need a valid URL that points to a server that can ### IIS log file information This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. -![Enterprise Mode log file.](images/ie-emie-logfile.png) +![Enterprise Mode log file](images/ie-emie-logfile.png) ## Using the GitHub sample to collect your data @@ -103,14 +103,14 @@ For logging, you’re going to need a valid URL that points to a server that can 5. Right-click on the name, PhoneHomeSample, and click **Publish**. - ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) + ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) 6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. **Important**
Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) + ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) After you finish the publishing process, you need to test to make sure the app deployed successfully. @@ -135,7 +135,7 @@ For logging, you’re going to need a valid URL that points to a server that can - Go to `https:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. - ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) + ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) ### Troubleshooting publishing errors @@ -145,7 +145,7 @@ If you have errors while you’re publishing your project, you should try to upd 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) + ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) 2. Click **Updates** on the left side of the tool, and click the **Update All** button.

You may need to do some additional package cleanup to remove older package versions. diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md index ec77071c73..14bd40e745 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md @@ -28,7 +28,7 @@ Jump to: [Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) can be very effective in providing backward compatibility for older web apps. The Enterprise Mode Site List includes the ability to put any web app in any document mode, include IE8 and IE7 Enterprise Modes, without changing a single line of code on the website. -![Internet Explorer Enterprise Modes and document modes.](images/img-enterprise-mode-site-list-xml.jpg) +![Internet Explorer Enterprise Modes and document modes](images/img-enterprise-mode-site-list-xml.jpg) Sites in the \ section can be rendered in any document mode, as shown in blue above. Some sites designed for older versions of Internet Explorer may require better backward compatibility, and these can leverage the \ section of the Enterprise Mode Site List. IE8 Enterprise Mode provides higher-fidelity emulation for Internet Explorer 8 by using, among other improvements, the original Internet Explorer 8 user agent string. IE7 Enterprise Mode further improves emulation by adding Compatibility View. @@ -84,7 +84,7 @@ To see if the site works in the Internet Explorer 5, Internet Explorer 7, Intern - Open the site in Internet Explorer 11, load the F12 tools by pressing the **F12** key or by selecting **F12 Developer Tools** from the **Tools** menu, and select the **Emulation** tab. - ![F12 Developer Tools Emulation tab.](images/img-f12-developer-tools-emulation.jpg) + ![F12 Developer Tools Emulation tab](images/img-f12-developer-tools-emulation.jpg) - Run the site in each document mode until you find the mode in which the site works. diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md index 1b32fa64ad..8c84054dc3 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md @@ -39,7 +39,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi 1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - ![local group policy editor for using a site list.](images/ie-emie-grouppolicysitelist.png) + ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. @@ -51,7 +51,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi 4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example: - ![enterprise mode with site list in the registry.](images/ie-emie-registrysitelist.png) + ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png) - **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"` diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md index 897b27ceed..b4db0fb7a4 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -37,7 +37,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) + ![group policy editor with emie setting](images/ie-emie-editpolicy.png) 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. @@ -49,7 +49,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) + ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) Your **Value data** location can be any of the following types: diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index 54ae269373..fd6904f4a8 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -33,32 +33,32 @@ During installation, you must pick a version of IEAK 11, either **External** or | Feature | Internal | External | |-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:| -| Welcome screen | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| File locations | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Platform selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Language selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Package type selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Feature selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic Version Synchronization (AVS) | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Custom components | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Internal install | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| User experience | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Browser user interface | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Search providers | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Important URLs – Home page and support | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Accelerators | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Favorites, Favorites bar, and feeds | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Browsing options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| First Run wizard and Welcome page options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection manager | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic configuration | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Proxy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Security and privacy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Add a root certificate | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Programs | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Additional settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Wizard complete | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Welcome screen | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| File locations | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Platform selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Language selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Package type selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Feature selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Automatic Version Synchronization (AVS) | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Custom components | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Internal install | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| User experience | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Browser user interface | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Search providers | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Important URLs – Home page and support | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Accelerators | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Favorites, Favorites bar, and feeds | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Browsing options | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| First Run wizard and Welcome page options | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Connection manager | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Connection settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Automatic configuration | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Proxy settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Security and privacy settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Add a root certificate | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Programs | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Additional settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Wizard complete | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | --- diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index bbf1be6015..d0251e80ba 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -24,13 +24,13 @@ manager: dansimp | Tool | Description | | :---: |:--- | -| [![Connect the device to Wi-Fi.](images/edu-TIB-setp-1-v3.png)](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. | -| [![Try Learning Tools Immersive Reader.](images/edu-TIB-setp-2-v3.png)](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)**
Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. | -| [![Launch Microsoft Teams.](images/edu-TIB-setp-3-v3.png)](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?**
Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. | -| [![Open OneNote.](images/edu-TIB-setp-4-v3.png)](#edu-task4) | **Trying to expand classroom creativity and interaction between students?**
Open [OneNote](#edu-task4) and create an example group project for your class. | -| [![Try Photos app.](images/edu-tib-setp-5-v4.png)](#edu-task5) | **Curious about telling stories through video?**
Try the [Photos app](#edu-task5) to make your own example video. | -| [![Play with Minecraft: Education Edition.](images/edu-tib-setp-6-v4.png)](#edu-task6) | **Want to teach kids to further collaborate and problem solve?**
Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. | -| [![Do Math with Windows Ink.](images/edu-tib-setp-7-v1.png)](#edu-task7) | **Want to provide a personal math tutor for your students?**
Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. | +| [![Connect the device to Wi-Fi](images/edu-TIB-setp-1-v3.png)](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. | +| [![Try Learning Tools Immersive Reader](images/edu-TIB-setp-2-v3.png)](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)**
Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. | +| [![Launch Microsoft Teams](images/edu-TIB-setp-3-v3.png)](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?**
Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. | +| [![Open OneNote](images/edu-TIB-setp-4-v3.png)](#edu-task4) | **Trying to expand classroom creativity and interaction between students?**
Open [OneNote](#edu-task4) and create an example group project for your class. | +| [![Try Photos app](images/edu-tib-setp-5-v4.png)](#edu-task5) | **Curious about telling stories through video?**
Try the [Photos app](#edu-task5) to make your own example video. | +| [![Play with Minecraft: Education Edition](images/edu-tib-setp-6-v4.png)](#edu-task6) | **Want to teach kids to further collaborate and problem solve?**
Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. | +| [![Do Math with Windows Ink](images/edu-tib-setp-7-v1.png)](#edu-task7) | **Want to provide a personal math tutor for your students?**
Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. |
@@ -41,7 +41,7 @@ manager: dansimp
-![Log in to Device A and connect to the school network.](images/edu-TIB-setp-1-jump.png) +![Log in to Device A and connect to the school network](images/edu-TIB-setp-1-jump.png) ## 1. Log in and connect to the school network To try out the educator tasks, start by logging in as a teacher. @@ -55,7 +55,7 @@ To try out the educator tasks, start by logging in as a teacher.

-![Improve student reading speed and comprehension.](images/edu-TIB-setp-2-jump.png) +![Improve student reading speed and comprehension](images/edu-TIB-setp-2-jump.png) ## 2. Significantly improve student reading speed and comprehension > [!VIDEO https://www.youtube.com/embed/GCzSAslq_2Y] @@ -78,7 +78,7 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse 4. Select the **Immersive Reader** button. - ![Word's Immersive Reader.](images/word_online_immersive_reader.png) + ![Word's Immersive Reader](images/word_online_immersive_reader.png) 5. Press the **Play** button to hear text read aloud. @@ -86,14 +86,14 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse | Text to Speech | Text Preferences | Grammar Options | Line Focus | | :------------: | :--------------: | :-------------: | :--------: | - | ![Word Text to Speech.](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) | + | ![Word Text to Speech](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) |

-![Spark communication, critical thinking, and creativity with Microsoft Teams.](images/edu-TIB-setp-3-jump.png) +![Spark communication, critical thinking, and creativity with Microsoft Teams](images/edu-TIB-setp-3-jump.png) ## 3. Spark communication, critical thinking, and creativity in the classroom > [!VIDEO https://www.youtube.com/embed/riQr4Dqb8B8] @@ -114,7 +114,7 @@ Take a guided tour of Microsoft Teams and test drive this digital hub.

-![Expand classroom collaboration and interaction with OneNote.](images/edu-TIB-setp-4-jump.png) +![Expand classroom collaboration and interaction with OneNote](images/edu-TIB-setp-4-jump.png) ## 4. Expand classroom collaboration and interaction between students > [!VIDEO https://www.youtube.com/embed/dzDSWMb_fIE] @@ -135,16 +135,16 @@ When you're not using the pen, just use the magnet to stick it to the left side 3. Follow the instructions for the project. Look for the **Try this!** callouts to experiment with these engaging activities. - Discover the power of digital ink by selecting the Draw tab. Choose your pen and get scribbling. - ![OneNote Draw tab.](images/onenote_draw.png) + ![OneNote Draw tab](images/onenote_draw.png) - Type anywhere on the page! Just click your cursor where you want to place text. - Use the checkmark in the **Home** tab to keep track of completed tasks. - ![OneNote To Do Tag.](images/onenote_checkmark.png) + ![OneNote To Do Tag](images/onenote_checkmark.png) - To find information without leaving OneNote, use the Researcher tool found under the Insert tab. - ![OneNote Researcher.](images/onenote_researcher.png) + ![OneNote Researcher](images/onenote_researcher.png)

@@ -178,7 +178,7 @@ Use video to create a project summary. 8. Drag the videos to the Storyboard, one by one. Your project should look roughly like this: - ![Photos app layout showing videos added in previous steps.](images/photo_app_1.png) + ![Photos app layout showing videos added in previous steps](images/photo_app_1.png) 9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**. @@ -191,7 +191,7 @@ Use video to create a project summary. 4. Play back your effect. 5. Select **Done** when you have it where you want it. - ![Lighting bolt effect being added to a video clip.](images/photo_app_2.png) + ![Lighting bolt effect being added to a video clip](images/photo_app_2.png) 12. Select **Music** and select a track from the **Recommended** music collection. 1. The music will update automatically to match the length of your video project, even as you make changes. @@ -208,7 +208,7 @@ Check out this use case video of the Photos team partnering with the Bureau Of F

-![Further collaborate and problem solve with Minecraft: Education Edition.](images/edu-TIB-setp-5-jump.png) +![Further collaborate and problem solve with Minecraft: Education Edition](images/edu-TIB-setp-5-jump.png) ## 6. Get kids to further collaborate and problem solve > [!VIDEO https://www.youtube.com/embed/QI_bRNUugog] @@ -226,7 +226,7 @@ Today, we'll explore a Minecraft world through the eyes of a student. 3. Scroll down to the **Details** section and select **Download World**. - ![Select the download world link.](images/mcee_downloadworld.png) + ![Select the download world link](images/mcee_downloadworld.png) 4. When prompted, save the world. @@ -250,7 +250,7 @@ Today, we'll explore a Minecraft world through the eyes of a student. To try more advanced movements or building within Minecraft, use the Minecraft Controls Diagram. - ![Minecraft mouse and keyboard controls.](images/mcee_keyboard_mouse_controls.png) + ![Minecraft mouse and keyboard controls](images/mcee_keyboard_mouse_controls.png) 12. Access and adapt over 300 lesson plans, spanning all grades and subjects, to meet your needs. Enjoy exploring new worlds and happy crafting. @@ -260,13 +260,13 @@ Today, we'll explore a Minecraft world through the eyes of a student. 2. Click **Class Resources**. 3. Click **Find a Lesson**. - ![Access and adapt over 300 Minecraft lesson plans.](images/minecraft_lesson_plans.png) + ![Access and adapt over 300 Minecraft lesson plans](images/minecraft_lesson_plans.png)


-![Help students understand new math concepts with the Math Assistant in OneNote.](images/Inking.png) +![Help students understand new math concepts with the Math Assistant in OneNote](images/Inking.png) ## 7. Use Windows Ink to provide a personal math tutor for your students The **Math Assistant** and **Ink Replay** features available in the OneNote app give your students step-by-step instructions on how to solve their math problems and help them visualize math functions on an interactive 2D graph. @@ -275,15 +275,15 @@ The **Math Assistant** and **Ink Replay** features available in the OneNote app To get started: 1. Open the OneNote app for Windows 10 (not OneNote 2016). - ![OneNote icon.](images/OneNote_logo.png) + ![OneNote icon](images/OneNote_logo.png) 2. In the top left corner, click on the **<** arrow to access your notebooks and pages. - ![OneNote back arrow navigation button.](images/left_arrow.png) + ![OneNote back arrow navigation button](images/left_arrow.png) 3. Click **Add Page** to launch a blank work space. - ![Select add page button.](images/plus-page.png) + ![Select add page button](images/plus-page.png) 4. Make sure your pen is paired to the device. To pair, see Connect to Bluetooth devices. @@ -292,26 +292,26 @@ To solve the equation 3x+4=7, follow these instructions: 2. If you wrote the equation using digital ink, use the **Lasso tool** to circle the equation. If you typed the equation, highlight it using your mouse. - ![Lasso button.](images/lasso.png) + ![Lasso button](images/lasso.png) 3. On the **Draw** tab, click the **Math** button. - ![Math button.](images/math-button.png) + ![Math button](images/math-button.png) 4. From the drop-down menu in the **Math** pane, select the option to **Solve for x**. You can now see the final solution of the equation. - ![Solve for x menu.](images/solve-for-x.png) + ![Solve for x menu](images/solve-for-x.png) 5. From the second drop-down below, choose **Steps for Solving Linear Formula**, which shows you the step-by-step solution of this equation. 6. On the **View** tab, click the **Replay** button. Use your mouse to select the written equation and watch your text in replay. Replay is great for students to review how the teacher solved the equation and for teachers to review how students approached a problem. - ![Replay button.](images/replay.png) + ![Replay button](images/replay.png) To graph the equation 3x+4=7, follow these instructions: 1. From the drop-down menu in the **Math** pane, select the option to **Graph Both Sides in 2D**. You can play with the interactive graph of your equation - use a single finger to move the graph position or two fingers to change the **zoom** level. - ![Graph both sides in 2D.](images/graph-for-x.png) + ![Graph both sides in 2D](images/graph-for-x.png) 2. Click the **Insert on Page** button below the graph to add a screenshot of the graph to your page.
diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index 5f1c865bce..f21a0ddcf4 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -16,7 +16,7 @@ ms.date: 12/11/2017 # Microsoft Education Trial in a Box -![Microsoft Education Trial in a Box - Unlock Limitless Learning.](images/Unlock-Limitless-Learning.png) +![Microsoft Education Trial in a Box - Unlock Limitless Learning](images/Unlock-Limitless-Learning.png)
@@ -28,7 +28,7 @@ Welcome to Microsoft Education Trial in a Box. We built this trial to make it ea
-| [![Get started for Educators.](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | +| [![Get started for Educators](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | | :---: | :---: | | **Educator**
Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills.
[Get started](educator-tib-get-started.md) | **IT Admin**
Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage.
[Get started](itadmin-tib-get-started.md) | diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index d0ba6a05b3..be9a131941 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -24,11 +24,11 @@ manager: dansimp |  |  | | :---: |:--- | -| [![Log in to Device A.](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | -| [![Configure Device B with Set up School PCs.](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | -| [![Configure Intune for Education.](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | -| [![Find and deploy apps.](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | -| [![Create custom folders.](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. | +| [![Log in to Device A](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | +| [![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | +| [![Configure Intune for Education](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | +| [![Find and deploy apps](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | +| [![Create custom folders](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. |
@@ -42,7 +42,7 @@ If you run into any problems while following the steps in this guide, or you hav
-![Log in to Device A.](images/admin-TIB-setp-1-jump.png) +![Log in to Device A](images/admin-TIB-setp-1-jump.png) ## 1. Log in to Device A with your IT Admin credentials and connect to the school network To try out the IT admin tasks, start by logging in as an IT admin. @@ -56,7 +56,7 @@ To try out the IT admin tasks, start by logging in as an IT admin.
-![Configure Device B with Set up School PCs.](images/admin-TIB-setp-2-jump.png) +![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-jump.png) ## 2. Configure Device B with Set up School PCs Now you're ready to learn how to configure a brand new device. You will start on **Device A** by downloading and running the Set up School PCs app. Then, you will configure **Device B**. @@ -66,11 +66,11 @@ If you've previously used Set up School PCs to provision student devices, you ca 1. From the **Start** menu, find and then click **Microsoft Store** to launch the Store. - ![Microsoft Store from the Start menu.](images/start_microsoft_store.png) + ![Microsoft Store from the Start menu](images/start_microsoft_store.png) 2. Search for the **Set up School PCs** app. - ![Set up School PCs on Microsoft Store.](images/microsoft_store_suspc_install.png) + ![Set up School PCs on Microsoft Store](images/microsoft_store_suspc_install.png) 3. Click **Install**. @@ -78,7 +78,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 1. On **Device A**, launch the Set up School PCs app. - ![Launch the Set up School PCs app.](images/suspc_start.png) + ![Launch the Set up School PCs app](images/suspc_start.png) 2. Click **Get started**. 3. Select **Sign-in**. @@ -95,7 +95,7 @@ If you've previously used Set up School PCs to provision student devices, you ca We recommend checking the highlighted settings below: - ![Configure student PC settings.](images/suspc_configure_pcsettings_selected.png) + ![Configure student PC settings](images/suspc_configure_pcsettings_selected.png) - **Remove apps pre-installed by the device manufacturer** - If you select this option, this will reset the machine and the provisioning process will take longer (about 30 minutes). - **Allow local storage (not recommended for shared devices)** lets students save files to the **Desktop** and **Documents** folder on the student PC. @@ -108,7 +108,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 7. **Set up the Take a Test app** configures the device for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. Windows will lock down the student PC so that students can't access anything else while taking the test. - ![Configure the Take a Test app.](images/suspc_takeatest.png) + ![Configure the Take a Test app](images/suspc_takeatest.png) 1. Specify if you want to create a Take a Test button on the students' sign-in screens. 2. Select **Advanced settings** to allow keyboard text suggestions to appear and to allow teachers to monitor online tests. @@ -120,7 +120,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 8. **Add recommended apps** lets you choose from a set of recommended Microsoft Store apps to provision. - ![Recommended apps in Set up School PCs package configuration.](images/suspc_configure_recommendedapps_v2.png) + ![Recommended apps in Set up School PCs package configuration](images/suspc_configure_recommendedapps_v2.png) The recommended apps include the following: * **Office 365 for Windows 10 S (Education Preview)** - Optional. This works well for the Trial in a Box PCs running Windows 10 S. However, if you try to install this app on other editions of Windows 10, setup will fail. Also note that if you select **Office 365 for Windows 10 S (Education Preview)**, it will take about 30-45 minutes longer for Set up School PCs to create the provisioning package as the app downloads Office 365 for Windows 10 S (Education Preview) from the Microsoft Store. @@ -131,7 +131,7 @@ If you've previously used Set up School PCs to provision student devices, you ca To change any of the settings, select the page or section (such as **Sign-in** or **Settings**) to go back to that page and make your changes. - ![Select the section or page name to make a change.](images/suspc_review_summary.png) + ![Select the section or page name to make a change](images/suspc_review_summary.png) 10. Accept the summary and then insert a USB drive in **Device A**. Use the USB drive that came in the Trial in a Box accessories box to save the provisioning package. 11. Select the drive and then **Save** to create the provisioning package. @@ -153,7 +153,7 @@ A provisioning package is a method for applying settings to Windows 10 without n 1. Start with **Device B** turned off or with the PC on the first-run setup screen. In Windows 10 S Fall Creators Update, the first-run setup screen says **Let's start with region. Is this right?**. - ![The first screen to set up a new PC in Windows 10 Fall Creators Update.](images/win10_oobe_firstscreen.png) + ![The first screen to set up a new PC in Windows 10 Fall Creators Update](images/win10_oobe_firstscreen.png) If you go past the region selection screen, select **Ctrl + Shift + F3** which will prompt the "System Preparation Tool." Select **Okay** in the tool to return to the region selection screen. If this doesn't work, reset the PC by going to **Settings > Update & Security > Recovery > Reset this PC.** @@ -166,20 +166,20 @@ You can complete the rest of the IT admin tasks using **Device A**.
-![Express configure Intune for Education.](images/admin-TIB-setp-3-jump.png) +![Express configure Intune for Education](images/admin-TIB-setp-3-jump.png) ## 3. Express configure Intune for Education to manage devices, users, and policies Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here. 1. Log into the Intune for Education console. 2. On the Intune for Education dashboard, click **Launch Express Configuration** or select the **Express configuration**. - ![Intune for Education dashboard.](images/i4e_dashboard_expressconfig.png) + ![Intune for Education dashboard](images/i4e_dashboard_expressconfig.png) 3. In the **Welcome to Intune for Education** screen, click **Get started** and follow the prompts until you get to the **Choose group** screen. 4. In the **Choose group** screen, select **All Users** so that all apps and settings that we select during express setup will apply to this group. 5. In the **Choose apps** screen, you will see a selection of desktop (Win32) apps, Web apps, and Microsoft Store apps. - ![Choose apps you want to provision to the group.](images/i4e_expressconfig_chooseapps.png) + ![Choose apps you want to provision to the group](images/i4e_expressconfig_chooseapps.png) 6. Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in step 5. @@ -197,7 +197,7 @@ Intune for Education provides an **Express configuration** option so you can get
-![Find apps from the Microsoft Store for Education.](images/admin-TIB-setp-4-jump.png) +![Find apps from the Microsoft Store for Education](images/admin-TIB-setp-4-jump.png) ## 4. Find apps from the Microsoft Store for Education and deploy them to managed devices in your tenant The Microsoft Store for Education is where you can shop for more apps for your school. @@ -205,7 +205,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s 2. In the **Store apps** section, select **+ New app** to go to the Microsoft Store for Education. 3. Select **Sign in** and start shopping for apps for your school. - ![Microsoft Store for Education site.](images/msfe_portal.png) + ![Microsoft Store for Education site](images/msfe_portal.png) 4. Check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express configuration for Intune for Education. For example, these apps are free: - Duolingo - Learn Languages for Free @@ -222,7 +222,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s The apps will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant. - ![List of apps bought for the school.](images/msfe_boughtapps.png) + ![List of apps bought for the school](images/msfe_boughtapps.png) In the **Private store** column of the **Products & services** page, the status for some apps will indicate that it's "In private store" while others will say "Adding to private store" or "Not applicable". Learn more about this in Distribute apps using your private store. @@ -231,7 +231,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s
-![Create custom folders that appear on managed devices.](images/admin-TIB-setp-5-jump.png) +![Create custom folders that appear on managed devices](images/admin-TIB-setp-5-jump.png) ## 5. Create custom folders that will appear on each managed device's Start menu Update settings for all devices in your tenant by adding the **Documents** and **Downloads** folders to all devices managed in Intune for Education. @@ -239,7 +239,7 @@ Update settings for all devices in your tenant by adding the **Documents** and * 2. Select **Group > All Devices > Settings** and expand **Windows interface settings**. 3. In **Choose folders that appear in the Start menu**, select **Documents** and **Downloads**. - ![Choose folders that appear in the Start menu.](images/screenshot-bug.png) + ![Choose folders that appear in the Start menu](images/screenshot-bug.png) 4. **Save** your changes. diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md index 627a78c9ef..9cb32351de 100644 --- a/education/trial-in-a-box/support-options.md +++ b/education/trial-in-a-box/support-options.md @@ -38,7 +38,7 @@ For more information about checking for updates, and how to optionally turn on a > [!NOTE] > For the alternate email address, make sure you use a different address from your Office 365 email address. - ![Complete your contact details.](images/o365_adminaccountinfo.png) + ![Complete your contact details](images/o365_adminaccountinfo.png) 4. Click **Save**. @@ -46,17 +46,17 @@ For more information about checking for updates, and how to optionally turn on a 1. Click the **Need help?** button in the lower right-hand corner of the Office 365 console. - ![Select Need help to get support.](images/o365_needhelp.png) + ![Select Need help to get support](images/o365_needhelp.png) You will see a sidebar window open up on the right-hand side of the screen. - ![Option to have a support representative call you.](images/o365_needhelp_callingoption.png) + ![Option to have a support representative call you](images/o365_needhelp_callingoption.png) If you chose to have a support representative call you, a new support ticket will be opened and you can track these in **Support tickets**. - ![Track your support tickets.](images/o365_needhelp_supporttickets.png) + ![Track your support tickets](images/o365_needhelp_supporttickets.png) -2. Click the **question button** ![Question button.](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window. +2. Click the **question button** ![Question button](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window. 3. In the field below **Need help?**, enter a description of your help request. 4. Click the **Get help button**. 5. In the **Let us call you** section, enter a phone number where you can be reached. @@ -69,7 +69,7 @@ Forget your password? Follow these steps to recover it. 1. Go to https://portal.office.com 2. Select **Can't access your account** and follow the prompts to get back into your account. - ![Recover your account.](images/officeportal_cantaccessaccount.png) + ![Recover your account](images/officeportal_cantaccessaccount.png) diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index c0ac95e03e..00b99a4c75 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -61,7 +61,7 @@ You can set the policy using one of these methods: - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example: - ![Configure student PC settings in Set up School PCs.](images/suspc_configure_pc2.jpg) + ![Configure student PC settings in Set up School PCs](images/suspc_configure_pc2.jpg) ## Trigger Autopilot Reset Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. @@ -70,7 +70,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo 1. From the Windows device lock screen, enter the keystroke: **CTRL + Windows key + R**. - ![Enter CTRL+Windows key+R on the Windows lockscreen.](images/autopilot-reset-lockscreen.png) + ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png) This will open up a custom login screen for Autopilot Reset. The screen serves two purposes: @@ -78,7 +78,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo 2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. - ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) + ![Custom login screen for Autopilot Reset](images/autopilot-reset-customlogin.png) 2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. @@ -97,7 +97,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo - Is returned to a known good managed state, connected to Azure AD and MDM. - ![Notification that provisioning is complete.](images/autopilot-reset-provisioningcomplete.png) + ![Notification that provisioning is complete](images/autopilot-reset-provisioningcomplete.png) Once provisioning is complete, the device is again ready for use. diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md index ea30225b3e..b104042dbc 100644 --- a/education/windows/change-to-pro-education.md +++ b/education/windows/change-to-pro-education.md @@ -65,7 +65,7 @@ See [change using Microsoft Store for Education](#change-using-microsoft-store-f **Figure 1** - Enter the details for the Windows edition change - ![Enter the details for the Windows edition change.](images/i4e_editionupgrade.png) + ![Enter the details for the Windows edition change](images/i4e_editionupgrade.png) 3. The change will automatically be applied to the group you selected. @@ -78,7 +78,7 @@ You can use Windows Configuration Designer to create a provisioning package that **Figure 2** - Enter the license key - ![Enter the license key to change to Windows 10 Pro Education.](images/wcd_productkey.png) + ![Enter the license key to change to Windows 10 Pro Education](images/wcd_productkey.png) 3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to change to Windows 10 Pro Education. @@ -123,7 +123,7 @@ Once you enable the setting to change to Windows 10 Pro Education, the change wi **Figure 3** - Check the box to confirm - ![Check the box to confirm.](images/msfe_manage_benefits_checktoconfirm.png) + ![Check the box to confirm](images/msfe_manage_benefits_checktoconfirm.png) 5. Click **Change all my devices**. @@ -169,13 +169,13 @@ If the Windows device is running Windows 10, version 1703, follow these steps. **Figure 4** - Select how you'd like to set up the device - ![Select how you'd like to set up the device.](images/1_howtosetup.png) + ![Select how you'd like to set up the device](images/1_howtosetup.png) 2. On the **Sign in with Microsoft** page, enter the username and password to use with Office 365 or other services from Microsoft, and then click **Next**. **Figure 5** - Enter the account details - ![Enter the account details you use with Office 365 or other Microsoft services.](images/2_signinwithms.png) + ![Enter the account details you use with Office 365 or other Microsoft services](images/2_signinwithms.png) 3. Go through the rest of Windows device setup. Once you're done, the device will be Azure AD joined to your school's subscription. @@ -188,21 +188,21 @@ If the Windows device is running Windows 10, version 1703, follow these steps. **Figure 6** - Go to **Access work or school** in Settings - ![Go to Access work or school in Settings.](images/settings_workorschool_1.png) + ![Go to Access work or school in Settings](images/settings_workorschool_1.png) 2. In **Access work or school**, click **Connect**. 3. In the **Set up a work or school account** window, click the **Join this device to Azure Active Directory** option at the bottom. **Figure 7** - Select the option to join the device to Azure Active Directory - ![Select the option to join the device to Azure Active Directory.](images/settings_setupworkorschoolaccount_2.png) + ![Select the option to join the device to Azure Active Directory](images/settings_setupworkorschoolaccount_2.png) 4. On the **Let's get you signed in** window, enter the Azure AD credentials (username and password) and sign in. This will join the device to the school's Azure AD. 5. To verify that the device was successfully joined to Azure AD, go back to **Settings > Accounts > Access work or school**. You should now see a connection under the **Connect to work or school** section that indicates the device is connected to Azure AD. **Figure 8** - Verify the device connected to Azure AD - ![Verify the device is connected to Azure AD.](images/settings_connectedtoazuread_3.png) + ![Verify the device is connected to Azure AD](images/settings_connectedtoazuread_3.png) #### Step 2: Sign in using Azure AD account @@ -286,7 +286,7 @@ Once the automatic change to Windows 10 Pro Education is turned off, the change **Figure 12** - Revert to Windows 10 Pro - ![Revert to Windows 10 Pro.](images/msfe_manage_reverttowin10pro.png) + ![Revert to Windows 10 Pro](images/msfe_manage_reverttowin10pro.png) 4. You will be asked if you're sure that you want to turn off automatic changes to Windows 10 Pro Education. Click **Yes**. 5. Click **Close** in the **Success** page. @@ -304,7 +304,7 @@ You need to synchronize these identities so that users will have a *single ident **Figure 13** - On-premises AD DS integrated with Azure AD -![Illustration of Azure Active Directory Connect.](images/windows-ad-connect.png) +![Illustration of Azure Active Directory Connect](images/windows-ad-connect.png) For more information about integrating on-premises AD DS domains with Azure AD, see these resources: - [Integrating your on-premises identities with Azure Active Directory](/azure/active-directory/hybrid/whatis-hybrid-identity) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index d927aef072..59da859362 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -118,7 +118,7 @@ At the end of this section, you should have a list of Chromebook user and device You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. -![figure 1.](images/chromebook-fig1-googleadmin.png) +![figure 1](images/chromebook-fig1-googleadmin.png) Figure 1. Google Admin Console @@ -221,7 +221,7 @@ Table 3. Settings in the Security node in the Google Admin Console In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). -![figure 2.](images/fig2-locallyconfig.png) +![figure 2](images/fig2-locallyconfig.png) Figure 2. Locally-configured settings on Chromebook diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index 27b3806af5..f662b8ac78 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -94,19 +94,19 @@ Use one of these methods to set this policy. - Data type: Integer - Value: 0 - ![Create an OMA URI for AllowCortana.](images/allowcortana_omauri.png) + ![Create an OMA URI for AllowCortana](images/allowcortana_omauri.png) ### Group Policy Set **Computer Configuration > Administrative Templates > Windows Components > Search > AllowCortana** to **Disabled**. -![Set AllowCortana to disabled through Group Policy.](images/allowcortana_gp.png) +![Set AllowCortana to disabled through Group Policy](images/allowcortana_gp.png) ### Provisioning tools - [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. - [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Under **Runtime settings**, click the **Policies** settings group, set **Experience > Cortana** to **No**. - ![Set AllowCortana to No in Windows Configuration Designer.](images/allowcortana_wcd.png) + ![Set AllowCortana to No in Windows Configuration Designer](images/allowcortana_wcd.png) ## SetEduPolicies **SetEduPolicies** is a policy that applies a set of configuration behaviors to Windows. It is a policy node in the [SharedPC configuration service provider](/windows/client-management/mdm/sharedpc-csp). @@ -123,7 +123,7 @@ Use one of these methods to set this policy. - Data type: Boolean - Value: true - ![Create an OMA URI for SetEduPolices.](images/setedupolicies_omauri.png) + ![Create an OMA URI for SetEduPolices](images/setedupolicies_omauri.png) ### Group Policy **SetEduPolicies** is not natively supported in Group Policy. Instead, use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to set the policy in [MDM SharedPC](/windows/win32/dmwmibridgeprov/mdm-sharedpc). @@ -147,7 +147,7 @@ For example: - [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Under **Runtime settings**, click the **SharedPC** settings group, set **PolicyCustomization > SetEduPolicies** to **True**. - ![Set SetEduPolicies to True in Windows Configuration Designer.](images/setedupolicies_wcd.png) + ![Set SetEduPolicies to True in Windows Configuration Designer](images/setedupolicies_wcd.png) ## Ad-free search with Bing Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 9dcdd7ca81..5ca4cb7ea0 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -34,21 +34,21 @@ Proper preparation is essential for a successful district deployment. To avoid c As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. > [!div class="mx-imgBorder"] -> ![Typical district configuration for this guide.](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") +> ![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") *Figure 1. Typical district configuration for this guide* A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses. > [!div class="mx-imgBorder"] -> ![Typical school configuration for this guide.](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") +> ![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") *Figure 2. Typical school configuration for this guide* Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses. > [!div class="mx-imgBorder"] -> ![Typical classroom configuration in a school.](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") +> ![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") *Figure 3. Typical classroom configuration in a school* @@ -181,7 +181,7 @@ The high-level process for deploying and configuring devices within individual c 9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Azure AD integration. > [!div class="mx-imgBorder"] -> ![How district configuration works.](images/edu-districtdeploy-fig4.png "How district configuration works") +> ![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") *Figure 4. How district configuration works* @@ -768,7 +768,7 @@ In this method, you have an on-premises AD DS domain. As shown in Figure 5, the > Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)). > [!div class="mx-imgBorder"] -> ![Automatic synchronization between AD DS and Azure AD.](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") +> ![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") *Figure 5. Automatic synchronization between AD DS and Azure AD* @@ -779,7 +779,7 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. > [!div class="mx-imgBorder"] -> ![Bulk import into Azure AD from other sources.](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") +> ![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") *Figure 6. Bulk import into Azure AD from other sources* @@ -812,14 +812,14 @@ You can deploy the Azure AD Connect tool: - **On premises.** As shown in Figure 7, Azure AD Connect runs on premises, which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server. > [!div class="mx-imgBorder"] - > ![Azure AD Connect on premises.](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") + > ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") *Figure 7. Azure AD Connect on premises* - **In Azure.** As shown in Figure 8, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. > [!div class="mx-imgBorder"] - > ![Azure AD Connect in Azure.](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") + > ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") *Figure 8. Azure AD Connect in Azure* diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index 318b892188..3b464f9fa6 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -30,13 +30,13 @@ Proper preparation is essential for a successful school deployment. To avoid com As part of preparing for your school deployment, you need to plan your configuration—the focus of this guide. Figure 1 illustrates a typical finished school configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. -![fig 1.](images/deploy-win-10-school-figure1.png) +![fig 1](images/deploy-win-10-school-figure1.png) *Figure 1. Typical school configuration for this guide* Figure 2 shows the classroom configuration this guide uses. -![fig 2.](images/deploy-win-10-school-figure2.png) +![fig 2](images/deploy-win-10-school-figure2.png) *Figure 2. Typical classroom configuration in a school* @@ -112,7 +112,7 @@ The high-level process for deploying and configuring devices within individual c 6. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. 7. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS and Azure AD integration. -![fig 3.](images/deploy-win-10-school-figure3.png) +![fig 3](images/deploy-win-10-school-figure3.png) *Figure 3. How school configuration works* @@ -346,7 +346,7 @@ In this method, you have an on-premises AD DS domain. As shown in Figure 4, the **Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)?f=255&MSPPError=-2147217396). -![fig 4.](images/deploy-win-10-school-figure4.png) +![fig 4](images/deploy-win-10-school-figure4.png) *Figure 4. Automatic synchronization between AD DS and Azure AD* @@ -356,7 +356,7 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 5, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. -![fig 5.](images/deploy-win-10-school-figure5.png) +![fig 5](images/deploy-win-10-school-figure5.png) *Figure 5. Bulk import into Azure AD from other sources* @@ -383,13 +383,13 @@ You can deploy the Azure AD Connect tool by using one of the following methods: - **On premises.** As shown in Figure 6, Azure AD Connect runs on premises, which has the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server. - ![fig 6.](images/deploy-win-10-school-figure6.png) + ![fig 6](images/deploy-win-10-school-figure6.png) *Figure 6. Azure AD Connect on premises* - **In Azure**. As shown in Figure 7, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - ![fig 7.](images/deploy-win-10-school-figure7.png) + ![fig 7](images/deploy-win-10-school-figure7.png) *Figure 7. Azure AD Connect in Azure* diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index 03a761c858..eaa2f7c35b 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -55,11 +55,11 @@ To turn off access to contacts for all apps on individual Windows devices: 1. On the computer, go to **Settings** and select **Privacy**. - ![Privacy settings.](images/win10_settings_privacy.png) + ![Privacy settings](images/win10_settings_privacy.png) 2. Under the list of **Privacy** areas, select **Contacts**. - ![Contacts privacy settings.](images/win10_settings_privacy_contacts.png) + ![Contacts privacy settings](images/win10_settings_privacy_contacts.png) 3. Turn off **Let apps access my contacts**. @@ -73,7 +73,7 @@ For IT-managed Windows devices, you can use a Group Policy to turn off the setti If you want to allow only certain apps to have access to contacts, you can use the switch for each app to specify which ones you want on or off. -![Choose apps with access to contacts.](images/win10_settings_privacy_contacts_apps.png) +![Choose apps with access to contacts](images/win10_settings_privacy_contacts_apps.png) The list of apps on the Windows-based device may vary from the above example. The list depends on what apps you have installed and which of these apps access contacts. @@ -83,7 +83,7 @@ To allow only certain apps to have access to contacts, you can: * Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** and then specify the default for each app by adding the app's Package Family Name under the default behavior you want to enforce. - ![App privacy Group Policy.](images/gp_letwinappsaccesscontacts.png) + ![App privacy Group Policy](images/gp_letwinappsaccesscontacts.png) ## Skype and Xbox settings @@ -109,7 +109,7 @@ Skype uses the user’s contact details to deliver important information about t To manage and edit your profile in the Skype UWP app, follow these steps: -1. In the Skype UWP app, select the user profile icon ![Skype profile icon.](images/skype_uwp_userprofile_icon.png) to go to the user’s profile page. +1. In the Skype UWP app, select the user profile icon ![Skype profile icon](images/skype_uwp_userprofile_icon.png) to go to the user’s profile page. 2. In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal. @@ -127,7 +127,7 @@ To manage and edit your profile in the Skype UWP app, follow these steps: 6. To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up. - ![Skype profile icon.](images/skype_uwp_manageprofilepic.png) + ![Skype profile icon](images/skype_uwp_manageprofilepic.png) * To take a new picture, click the camera icon in the pop up window. To upload a new picture, click the three dots (**...**). diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index f4ea0cf4ef..586d6ea6b8 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -39,7 +39,7 @@ Admins can control whether or not teachers are automatically assigned the **Basi 2. Click **Manage**, and then click **Settings**. 3. On **Shop**, select or clear **Make everyone a Basic Purchaser**. -![manage settings to control Basic Purchaser role assignment.](images/sfe-make-everyone-bp.png) +![manage settings to control Basic Purchaser role assignment](images/sfe-make-everyone-bp.png) > [!NOTE] > **Make everyone a Basic Purchaser** is on by default. @@ -52,7 +52,7 @@ When **Make everyone a Basic Purchaser** is turned off, admins can manually assi 2. Click **Manage**, and then choose **Permissions**. 3. On **Roles**, click **Assign roles**, type and select a name, choose the role you want to assign, and then click **Save**. - ![Permission page for Microsoft Store for Business.](images/sfe-roles.png) + ![Permission page for Microsoft Store for Business](images/sfe-roles.png) **Blocked Basic Purchasers** diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index a89e29de02..78f1759c45 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -29,7 +29,7 @@ ms.topic: conceptual Teachers and IT administrators can now get early access to **Minecraft: Education Edition** and add it their Microsoft Store for Business for distribution. - + ## Prerequisites @@ -39,11 +39,11 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio - Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan) - If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](/windows/client-management/mdm/register-your-free-azure-active-directory-subscription) - + [Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher-get-minecraft.md) - + [Learn how IT administrators can get and distribute **Minecraft: Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index cf961bfe83..81e3f97634 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -14,15 +14,15 @@ ms.date: 10/13/2017 # Windows 10 for Education -![Windows 10 Education and Windows 10 Pro Education.](images/windows-10-for-education-banner.png) +![Windows 10 Education and Windows 10 Pro Education](images/windows-10-for-education-banner.png) -## ![Learn more about Windows.](images/education.png) Learn +## ![Learn more about Windows](images/education.png) Learn

Windows 10 editions for education customers
Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.

Compare each Windows edition
Find out more about the features and functionality we support in each edition of Windows.

Get Windows 10 Education or Windows 10 Pro Education
When you've made your decision, find out how to buy Windows for your school.

-## ![Plan for Windows 10 in your school.](images/clipboard.png) Plan +## ![Plan for Windows 10 in your school](images/clipboard.png) Plan

Windows 10 configuration recommendations for education customers
Provides guidance on ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school.

Deployment recommendations for school IT administrators
Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.

@@ -30,14 +30,14 @@ ms.date: 10/13/2017

Take tests in Windows 10
Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up.

Chromebook migration guide
Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment.

-## ![Deploy Windows 10 for Education.](images/PCicon.png) Deploy +## ![Deploy Windows 10 for Education](images/PCicon.png) Deploy

Set up Windows devices for education
Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs.

Deploy Windows 10 in a school
Get step-by-step guidance to help you deploy Windows 10 in a school environment.

Deploy Windows 10 in a school district
Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.

Test Windows 10 S on existing Windows 10 education devices
Test Windows 10 S on a variety of Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us.

-## ![Switch to Windows 10 for Education.](images/windows.png) Switch +## ![Switch to Windows 10 for Education](images/windows.png) Switch

Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S
If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education.

diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index a728b75a41..e3900603b6 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -50,15 +50,15 @@ If you’ve been approved and are part of the Enrollment for Education Solutions 1. Go to [https://education.minecraft.net/](https://education.minecraft.net/) and select **GET STARTED**. - + 2. Enter your email address, and select Educator, Administrator, or Student.
If your email address isn't associated to an Azure AD or Office 365 Education tenant, you'll be asked to create one. - + 3. Select **Get the app**. This will take you to the Microsoft Store for Education to download the app. You will also receive an email with instructions and a link to the Store. - + 4. Sign in to Microsoft Store for Education with your email address. @@ -66,7 +66,7 @@ If you’ve been approved and are part of the Enrollment for Education Solutions 6. **Minecraft: Education Edition** opens in the Microsoft Store for Education. Select **Get the app**. This places **Minecraft: Education Edition** in your Store inventory. - + Now that the app is in your Microsoft Store for Education inventory, you can choose how to distribute Minecraft. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft). @@ -113,11 +113,11 @@ After you've finished the purchase, you can find your invoice by checking **Mine 2. Click **Minecraft: Education Edition** in the list of apps. 3. On **Minecraft: Education Edition**, click **View Bills**. - ![Minecraft: Education Edition app details page with view bills link highlighted.](images/mcee-view-bills.png) + ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-view-bills.png) 4. On **Invoice Bills**, click the invoice number to view and download your invoice. It downloads as a .pdf. - ![Minecraft: Education Edition app details page with view bills link highlighted.](images/mcee-invoice-bills.png) + ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-invoice-bills.png) The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check. @@ -133,11 +133,11 @@ Admins can also add Minecraft: Education Edition to the private store. This allo ### Configure automatic subscription assignment @@ -168,7 +168,7 @@ You can install the app on your PC. This gives you a chance to test the app and 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. - + 3. Click **Install**. @@ -180,33 +180,33 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. - ![Minecraft Education Edition product page.](images/mc-install-for-me-teacher.png) + ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) 3. Click **Invite people**. 4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. You can only assign the app to students with work or school accounts. If you don't find the student, you might need to add a work or school account for the student. - ![Assign to people showing student name.](images/minecraft-assign-to-people-name.png) + ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) **To finish Minecraft install (for students)** 1. Students will receive an email with a link that will install the app on their PC.
- ![Email with Get the app link.](images/minecraft-student-install-email.png) + ![Email with Get the app link](images/minecraft-student-install-email.png) 2. Click **Get the app** to start the app install in Microsoft Store app. 3. In Microsoft Store app, click **Install**. - ![Microsoft Store app with Minecraft page.](images/minecraft-in-windows-store-app.png) + ![Microsoft Store app with Minecraft page](images/minecraft-in-windows-store-app.png) After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**. Microsoft Store app is preinstalled with Windows 10. - ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) When students click **My Library** they'll find apps assigned to them. - ![My Library for example student.](images/minecraft-my-library.png) + ![My Library for example student](images/minecraft-my-library.png) ### Download for others Download for others allows teachers or IT admins to download an app that they can install on PCs. This will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when: @@ -225,11 +225,11 @@ Minecraft: Education Edition will not install if there are updates pending for o 1. Start Microsoft Store app on the PC (click **Start**, and type **Store**). 2. Click the account button, and then click **Downloads and updates**. - ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) 3. Click **Check for updates**, and install all available updates. - ![Microsoft Store app showing access to My Library.](images/mc-check-for-updates.png) + ![Microsoft Store app showing access to My Library](images/mc-check-for-updates.png) 4. Restart the computer before installing Minecraft: Education Edition. @@ -238,7 +238,7 @@ You'll download a .zip file, extract the files, and then use one of the files to 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**. - ![Microsoft Store app showing access to My Library.](images/mc-dnld-others-teacher.png) + ![Microsoft Store app showing access to My Library](images/mc-dnld-others-teacher.png) 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. @@ -257,7 +257,7 @@ However, tenant admins can control whether or not teachers automatically sign up To prevent educators from automatically signing up for Microsoft Store for Business 1. In Microsoft Store for Business, click **Settings**, and then click **Permissions**. - ![Permission page for Microsoft Store for Business.](images/minecraft-admin-permissions.png) + ![Permission page for Microsoft Store for Business](images/minecraft-admin-permissions.png) 2. Click **Allow educators in my organization to sign up for the Microsoft Store for Business.** @@ -269,7 +269,7 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. - Acquire and manage the app - Info on Support page (including links to documentation and access to support through customer service) - ![assign roles to manage Minecraft permissions.](images/minecraft-perms.png) + ![assign roles to manage Minecraft permissions](images/minecraft-perms.png) **To assign Basic Purchaser role** @@ -280,15 +280,15 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. 2. Click **Settings**, and then choose **Permissions**. - ![Permission page for Microsoft Store for Business.](images/minecraft-admin-permissions.png) + ![Permission page for Microsoft Store for Business](images/minecraft-admin-permissions.png) 3. Click **Add people**, type a name, select the correct person, choose the role you want to assign, and click **Save**. - ![Permission page for Microsoft Store for Business.](images/minecraft-assign-roles.png) + ![Permission page for Microsoft Store for Business](images/minecraft-assign-roles.png) Microsoft Store for Business updates the list of people and permissions. - ![Permission page for Microsoft Store for Business.](images/minecraft-assign-roles-2.png) + ![Permission page for Microsoft Store for Business](images/minecraft-assign-roles-2.png) --> diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md index 02198518ca..6d62b6bb55 100644 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ b/education/windows/set-up-school-pcs-azure-ad-join.md @@ -48,7 +48,7 @@ Active Directory** \> **Devices** \> **Device settings**. for Azure AD by selecting **All** or **Selected**. If you choose the latter option, select the teachers and IT staff to allow them to connect to Azure AD. -![Select the users you want to let join devices to Azure AD.](images/suspc-enable-shared-pc-1807.png) +![Select the users you want to let join devices to Azure AD](images/suspc-enable-shared-pc-1807.png) You can also create an account that holds the exclusive rights to join devices. When a student PC needs to be set up, provide the account credentials to the appropriate teachers or staff. diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 328b2f80a1..22d45b09fc 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -43,7 +43,7 @@ Follow the steps in [Provision PCs with common settings for initial deployment ( **Figure 7** - Add the account to use for test-taking - ![Add the account to use for test-taking.](images/wcd_settings_assignedaccess.png) + ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png) The account can be in one of the following formats: - username diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index f0bb65fa78..7d803777e5 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -35,7 +35,7 @@ You can apply a provisioning package on a USB drive to off-the-shelf devices dur 2. 2. On the **Finish** page, select **Switch to advanced editor**. - ![Switch to advanced editor.](images/icd-school-adv-edit.png) + ![Switch to advanced editor](images/icd-school-adv-edit.png) **Next steps** - [Add a desktop app to your package](#add-a-desktop-app-to-your-package) @@ -52,7 +52,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options.](images/icdstart-option.png) + ![ICD start options](images/icdstart-option.png) 3. Name your project and click **Next**. @@ -89,17 +89,17 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package.](images/uwp-family.png) + ![details for offline app package](images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package.](images/uwp-dependencies.png) + ![required frameworks for offline app package](images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. In Microsoft Store for Business, you generate the license for the app on the app's download page. - ![generate license for offline app.](images/uwp-license.png) + ![generate license for offline app](images/uwp-license.png) [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) @@ -168,7 +168,7 @@ If your build is successful, the name of the provisioning package, output direct **During initial setup, from a USB drive** 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC.](images/oobe.jpg) + ![The first screen to set up a new PC](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -176,11 +176,11 @@ If your build is successful, the name of the provisioning package, output direct 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device.](images/prov.jpg) + ![Provision this device](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package.](images/choose-package.png) + ![Choose a package](images/choose-package.png) 5. Select **Yes, add it**. @@ -188,11 +188,11 @@ If your build is successful, the name of the provisioning package, output direct 6. Read and accept the Microsoft Software License Terms. - ![Sign in.](images/license-terms.png) + ![Sign in](images/license-terms.png) 7. Select **Use Express settings**. - ![Get going fast.](images/express-settings.png) + ![Get going fast](images/express-settings.png) 8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**. @@ -200,18 +200,18 @@ If your build is successful, the name of the provisioning package, output direct 9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**. - ![Connect to Azure AD.](images/connect-aad.png) + ![Connect to Azure AD](images/connect-aad.png) 10. Sign in with your domain, Azure AD, or Office 365 account and password. When you see the progress ring, you can remove the USB drive. - ![Sign in.](images/sign-in-prov.png) + ![Sign in](images/sign-in-prov.png) **After setup, from a USB drive, network folder, or SharePoint site** On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and select the package to install. -![add a package option.](images/package.png) +![add a package option](images/package.png) --> diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index e1acdf9f1d..b401df97ef 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -27,7 +27,7 @@ Choose the tool that is appropriate for how your students will sign in (Active D You can use the following diagram to compare the tools. -![Which tool to use to set up Windows 10.](images/suspc_wcd_featureslist.png) +![Which tool to use to set up Windows 10](images/suspc_wcd_featureslist.png) ## In this section diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 10e2d2f7e0..3044c770e5 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -39,7 +39,7 @@ If you set up Take a Test, this adds a **Take a Test** button on the student PC' **Figure 1** - Configure Take a Test in the Set up School PCs app -![Configure Take a Test in the Set up School PCs app.](images/suspc_choosesettings_setuptakeatest.png) +![Configure Take a Test in the Set up School PCs app](images/suspc_choosesettings_setuptakeatest.png) ### Set up a test account in Intune for Education You can set up a test-taking account in Intune for Education. To do this, follow these steps: @@ -49,7 +49,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 2** - Add a test profile in Intune for Education - ![Add a test profile in Intune for Education.](images/i4e_takeatestprofile_addnewprofile.png) + ![Add a test profile in Intune for Education](images/i4e_takeatestprofile_addnewprofile.png) 3. In the new profile page: 1. Enter a name for the profile. @@ -60,7 +60,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 3** - Add information about the test profile - ![Add information about the test profile.](images/i4e_takeatestprofile_newtestaccount.png) + ![Add information about the test profile](images/i4e_takeatestprofile_newtestaccount.png) After you save the test profile, you will see a summary of the settings that you configured for Take a Test. Next, you'll need to assign the test profile to a group that will be using the test account. @@ -68,13 +68,13 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 4** - Assign the test account to a group - ![Assign the test account to a group.](images/i4e_takeatestprofile_accountsummary.png) + ![Assign the test account to a group](images/i4e_takeatestprofile_accountsummary.png) 5. In the **Groups** page, click **Change group assignments**. **Figure 5** - Change group assignments - ![Change group assignments.](images/i4e_takeatestprofile_groups_changegroupassignments.png) + ![Change group assignments](images/i4e_takeatestprofile_groups_changegroupassignments.png) 6. In the **Change group assignments** page: 1. Select a group from the right column and click **Add Members** to select the group and assign the test-taking account to that group. You can select more than one group. @@ -82,7 +82,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 6** - Select the group(s) that will use the test account - ![Select the groups that will use the test account.](images/i4e_takeatestprofile_groupassignment_selected.png) + ![Select the groups that will use the test account](images/i4e_takeatestprofile_groupassignment_selected.png) And that's it! When the students from the selected group sign in to the student PCs using the Take a Test user name that you selected, the PC will be locked down and Take a Test will open the assessment URL and students can start taking tests. @@ -136,7 +136,7 @@ To set up a test account through Windows Configuration Designer, follow these st **Figure 7** - Add the account to use for test-taking - ![Add the account to use for test-taking.](images/wcd_settings_assignedaccess.png) + ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png) The account can be in one of the following formats: - username diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 9d26301975..1286a5aec8 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -30,13 +30,13 @@ To configure the assessment URL and a dedicated testing account on a single PC, **Figure 1** - Use the Settings app to set up a test-taking account - ![Use the Settings app to set up a test-taking account.](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png) + ![Use the Settings app to set up a test-taking account](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png) 4. In the **Set up an account for taking tests** window, choose an existing account to use as the dedicated testing account. **Figure 2** - Choose the test-taking account - ![Choose the test-taking account.](images/tat_settingsapp_setuptesttakingaccount_1703.png) + ![Choose the test-taking account](images/tat_settingsapp_setuptesttakingaccount_1703.png) > [!NOTE] > If you don't have an account on the device, you can create a new account. To do this, go to **Settings > Accounts > Other people > Add someone else to this PC > I don’t have this person’s sign-in information > Add a user without a Microsoft account**. diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index f9ba6a9479..7e016c22c0 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -32,7 +32,7 @@ Many schools use online testing for formative and summative assessments. It's cr ## How to use Take a Test -![Set up and user flow for the Take a Test app.](images/take_a_test_flow_dark.png) +![Set up and user flow for the Take a Test app](images/take_a_test_flow_dark.png) There are several ways to configure devices for assessments, depending on your use case: diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 6f0d1d4341..136499ee4c 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -65,7 +65,7 @@ After Minecraft: Education Edition licenses have been purchased, either directly - You can assign the app to others. - You can download the app to distribute. - + ### Install for me You can install the app on your PC. This gives you a chance to work with the app before using it with your students. @@ -73,7 +73,7 @@ You can install the app on your PC. This gives you a chance to work with the app 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. - + 3. Click **Install**. @@ -84,13 +84,13 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. - + 3. Click **Invite people**. 4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. - ![Assign to people showing student name.](images/minecraft-assign-to-people-name.png) + ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) You can assign the app to students with work or school accounts.
If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Microsoft 365 admin center where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. @@ -100,20 +100,20 @@ Enter email addresses for your students, and each student will get an email with Students will receive an email with a link that will install the app on their PC. -![Email with Get the app link.](images/minecraft-student-install-email.png) +![Email with Get the app link](images/minecraft-student-install-email.png) 1. Click **Get the app** to start the app install in Microsoft Store app. 2. In Microsoft Store app, click **Install**. - ![Microsoft Store app with Minecraft page.](images/minecraft-in-windows-store-app.png) + ![Microsoft Store app with Minecraft page](images/minecraft-in-windows-store-app.png) After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**. - ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) When students click **My Library** they'll find apps assigned to them. - ![My Library for example student.](images/minecraft-my-library.png) + ![My Library for example student](images/minecraft-my-library.png) ### Download for others Download for others allows teachers or IT admins to download a packages that they can install on student PCs. This will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when: @@ -132,11 +132,11 @@ Minecraft: Education Edition will not install if there are updates pending for o 1. Start Microsoft Store app on the PC (click **Start**, and type **Store**). 2. Click the account button, and then click **Downloads and updates**. - ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) 3. Click **Check for updates**, and install all available updates. - ![Microsoft Store app showing access to My Library.](images/mc-check-for-updates.png) + ![Microsoft Store app showing access to My Library](images/mc-check-for-updates.png) 4. Restart the computer before installing Minecraft: Education Edition. @@ -145,7 +145,7 @@ You'll download a .zip file, extract the files, and then use one of the files to 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**. - ![Microsoft Store app showing access to My Library.](images/mc-dnld-others-teacher.png) + ![Microsoft Store app showing access to My Library](images/mc-dnld-others-teacher.png) 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index ca36e12e5a..3f31119391 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -103,7 +103,7 @@ We strongly recommend that you avoid changing preset policies. Changes can slow The **Set up School PCs** app guides you through the configuration choices for the student PCs. To begin, open the app on your PC and click **Get started**. - ![Launch the Set up School PCs app.](images/suspc_getstarted_050817.png) + ![Launch the Set up School PCs app](images/suspc_getstarted_050817.png) ### Package name Type a unique name to help distinguish your school's provisioning packages. The name appears: diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 3b6a109ef3..4294d7199e 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -18,7 +18,7 @@ ms.topic: conceptual # Get started: Deploy and manage a full cloud IT solution for your business -![Learn how to set up a full cloud infrastructure for your business.](images/business-cloud-mode.png) +![Learn how to set up a full cloud infrastructure for your business](images/business-cloud-mode.png) **Applies to:** @@ -61,7 +61,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 1** - Try or buy Office 365 - ![Office 365 for business sign up.](images/office365_tryorbuy_now.png) + ![Office 365 for business sign up](images/office365_tryorbuy_now.png) 2. Fill out the sign up form and provide information about you and your company. 3. Create a user ID and password to use to sign into your account. @@ -76,7 +76,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 2** - Microsoft 365 admin center - ![Microsoft 365 admin center.](images/office365_portal.png) + ![Microsoft 365 admin center](images/office365_portal.png) 6. Select the **Admin** tile to go to the admin center. @@ -86,7 +86,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 3** - Admin center - ![Microsoft 365 admin center.](images/office365_admin_portal.png) + ![Microsoft 365 admin center](images/office365_admin_portal.png) 8. Go back to the admin center to add or buy a domain. @@ -94,14 +94,14 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 4** - Option to add or buy a domain - ![Add or buy a domain in admin center.](images/office365_buy_domain.png) + ![Add or buy a domain in admin center](images/office365_buy_domain.png) 2. In the **Home > Domains** page, you will see the Microsoft-provided domain, such as *fabrikamdesign.onmicrosoft.com*. **Figure 5** - Microsoft-provided domain - ![Microsoft-provided domain.](images/office365_ms_provided_domain.png) + ![Microsoft-provided domain](images/office365_ms_provided_domain.png) - If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain. - If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order. @@ -110,7 +110,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 6** - Domains - ![Verify your domains in the admin center.](images/office365_additional_domain.png) + ![Verify your domains in the admin center](images/office365_additional_domain.png) ### 1.2 Add users and assign product licenses Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Microsoft 365 admin center. @@ -123,7 +123,7 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 7** - Add users - ![Add Office 365 users.](images/office365_users.png) + ![Add Office 365 users](images/office365_users.png) 2. In the **Home > Active users** page, add users individually or in bulk. - To add users one at a time, select **+ Add a user**. @@ -132,7 +132,7 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 8** - Add an individual user - ![Add an individual user.](images/office365_add_individual_user.png) + ![Add an individual user](images/office365_add_individual_user.png) - To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users. @@ -140,13 +140,13 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 9** - Import multiple users - ![Import multiple users.](images/office365_import_multiple_users.png) + ![Import multiple users](images/office365_import_multiple_users.png) 3. Verify that all the users you added appear in the list of **Active users**. The **Status** should indicate the product licenses that were assigned to them. **Figure 10** - List of active users - ![Verify users and assigned product licenses.](images/o365_active_users.png) + ![Verify users and assigned product licenses](images/o365_active_users.png) ### 1.3 Add Microsoft Intune Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see What is Intune? @@ -160,14 +160,14 @@ Microsoft Intune provides mobile device management, app management, and PC manag **Figure 11** - Assign Intune licenses - ![Assign Microsoft Intune licenses to users.](images/o365_assign_intune_license.png) + ![Assign Microsoft Intune licenses to users](images/o365_assign_intune_license.png) 5. In the admin center, confirm that **Intune** shows up in the list under **Admin centers**. If it doesn't, sign out and then sign back in and then check again. 6. Select **Intune**. This will take you to the Intune management portal. **Figure 12** - Microsoft Intune management portal - ![Microsoft Intune management portal.](images/intune_portal_home.png) + ![Microsoft Intune management portal](images/intune_portal_home.png) Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution). @@ -185,21 +185,21 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick **Figure 13** - Access to Azure AD is not available - ![Access to Azure AD not available.](images/azure_ad_access_not_available.png) + ![Access to Azure AD not available](images/azure_ad_access_not_available.png) 3. From the error message, select the country/region for your business. This should match with the location you specified when you signed up for Office 365. 4. Click **Azure subscription**. This will take you to a free trial sign up screen. **Figure 14** - Sign up for Microsoft Azure - ![Sign up for Microsoft Azure.](images/azure_ad_sign_up_screen.png) + ![Sign up for Microsoft Azure](images/azure_ad_sign_up_screen.png) 5. In the **Free trial sign up** screen, fill in the required information and then click **Sign up**. 6. After you sign up, you should see the message that your subscription is ready. Click **Start managing my service**. **Figure 15** - Start managing your Azure subscription - ![Start managing your Azure subscription.](images/azure_ad_successful_signup.png) + ![Start managing your Azure subscription](images/azure_ad_successful_signup.png) This will take you to the Microsoft Azure portal. @@ -216,26 +216,26 @@ To add Azure AD group(s), we will use the Microsoft Store for Business using the same tenant account that you used to sign into Intune. 4. Accept the EULA. @@ -312,20 +312,20 @@ In this part of the walkthrough, we'll be working on the Intune management portal, select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**. 8. In the **Microsoft Store for Business** page, select **Configure Sync** to sync your Store for Business volume-purchased apps with Intune. **Figure 26** - Configure Store for Business sync in Intune - ![Configure Store for Business sync in Intune.](images/intune_admin_mdm_store_sync.png) + ![Configure Store for Business sync in Intune](images/intune_admin_mdm_store_sync.png) 9. In the **Configure Microsoft Store for Business app sync** dialog box, check **Enable Microsoft Store for Business sync**. In the **Language** dropdown list, choose the language in which you want apps from the Store to be displayed in the Intune console and then click **OK**. **Figure 27** - Enable Microsoft Store for Business sync in Intune - ![Enable Store for Business sync in Intune.](images/intune_configure_store_app_sync_dialog.png) + ![Enable Store for Business sync in Intune](images/intune_configure_store_app_sync_dialog.png) The **Microsoft Store for Business** page will refresh and it will show the details from the sync. @@ -348,7 +348,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 28** - Shop for Store apps - ![Shop for Store apps.](images/wsfb_shop_microsoft_apps.png) + ![Shop for Store apps](images/wsfb_shop_microsoft_apps.png) 2. Click to select an app, such as **Reader**. This opens the app page. 3. In the app's Store page, click **Get the app**. You should see a dialog that confirms your order. Click **Close**. This will refresh the app's Store page. @@ -358,7 +358,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 29** - App inventory shows the purchased apps - ![Confirm that your inventory shows purchased apps.](images/wsfb_manage_inventory_newapps.png) + ![Confirm that your inventory shows purchased apps](images/wsfb_manage_inventory_newapps.png) > [!NOTE] > Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync). @@ -372,7 +372,7 @@ If you need to sync your most recently purchased apps and have it appear in your **Figure 30** - Force a sync in Intune - ![Force a sync in Intune.](images/intune_admin_mdm_forcesync.png) + ![Force a sync in Intune](images/intune_admin_mdm_forcesync.png) **To view purchased apps** - In the Intune management portal, select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly. @@ -393,7 +393,7 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 31** - First screen in Windows device setup - ![First screen in Windows device setup.](images/win10_hithere.png) + ![First screen in Windows device setup](images/win10_hithere.png) > [!NOTE] > During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection. @@ -403,13 +403,13 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 32** - Choose how you'll connect your Windows device - ![Choose how you'll connect the Windows device.](images/win10_choosehowtoconnect.png) + ![Choose how you'll connect the Windows device](images/win10_choosehowtoconnect.png) 4. In the **Let's get you signed in** screen, sign in using one of the user accounts you added in section [1.2 Add users and assign product licenses](#12-add-users-and-assign-product-licenses). We suggest signing in as one of the global administrators. Later, sign in on another device using one of the non-admin accounts. **Figure 33** - Sign in using one of the accounts you added - ![Sign in using one of the accounts you added.](images/win10_signin_admin_account.png) + ![Sign in using one of the accounts you added](images/win10_signin_admin_account.png) 5. If this is the first time you're signing in, you will be asked to update your password. Update the password and continue with sign-in and setup. @@ -430,7 +430,7 @@ In the Intune management **Figure 34** - Check the PC name on your device - ![Check the PC name on your device.](images/win10_settings_pcname.png) + ![Check the PC name on your device](images/win10_settings_pcname.png) 2. Log in to the Intune management portal. 3. Select **Groups** and then go to **Devices**. @@ -441,7 +441,7 @@ In the Intune management **Figure 35** - Check that the device appears in Intune - ![Check that the device appears in Intune.](images/intune_groups_devices_list.png) + ![Check that the device appears in Intune](images/intune_groups_devices_list.png) ## 3. Manage device settings and features You can use Microsoft Intune admin settings and policies to manage features on your organization's mobile devices and computers. For more info, see [Manage settings and features on your devices with Microsoft Intune policies](/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies). @@ -460,7 +460,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 36** - Reconfigure an app's deployment setting in Intune - ![Reconfigure app deployment settings in Intune.](images/intune_apps_deploymentaction.png) + ![Reconfigure app deployment settings in Intune](images/intune_apps_deploymentaction.png) 6. Click **Finish**. 7. Repeat steps 2-6 for other apps that you want to deploy to the device(s) as soon as possible. @@ -470,7 +470,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 37** - Confirm that additional apps were deployed to the device - ![Confirm that additional apps were deployed to the device.](images/win10_deploy_apps_immediately.png) + ![Confirm that additional apps were deployed to the device](images/win10_deploy_apps_immediately.png) ### 3.2 Configure other settings in Intune @@ -486,7 +486,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 38** - Add a configuration policy - ![Add a configuration policy.](images/intune_policy_disablecamera.png) + ![Add a configuration policy](images/intune_policy_disablecamera.png) 7. Click **Save Policy**. A confirmation window will pop up. 8. On the **Deploy Policy** confirmation window, select **Yes** to deploy the policy now. @@ -495,7 +495,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 39** - The new policy should appear in the **Policies** list. - ![New policy appears on the list.](images/intune_policies_newpolicy_deployed.png) + ![New policy appears on the list](images/intune_policies_newpolicy_deployed.png) **To turn off Windows Hello and PINs during device setup** 1. In the Intune management portal, select **Admin**. @@ -504,7 +504,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 40** - Policy to disable Windows Hello for Business - ![Disable Windows Hello for Business.](images/intune_policy_disable_windowshello.png) + ![Disable Windows Hello for Business](images/intune_policy_disable_windowshello.png) 4. Click **Save**. @@ -531,32 +531,32 @@ For other devices, such as those personally-owned by employees who need to conne **Figure 41** - Add an Azure AD account to the device - ![Add an Azure AD account to the device.](images/win10_add_new_user_join_aad.png) + ![Add an Azure AD account to the device](images/win10_add_new_user_join_aad.png) 4. In the **Let's get you signed in** window, enter the work credentials for the account and then click **Sign in** to authenticate the user. **Figure 42** - Enter the account details - ![Enter the account details.](images/win10_add_new_user_account_aadwork.png) + ![Enter the account details](images/win10_add_new_user_account_aadwork.png) 5. You will be asked to update the password so enter a new password. 6. Verify the details to make sure you're connecting to the right organization and then click **Join**. **Figure 43** - Make sure this is your organization - ![Make sure this is your organization.](images/win10_confirm_organization_details.png) + ![Make sure this is your organization](images/win10_confirm_organization_details.png) 7. You will see a confirmation window that says the device is now connected to your organization. Click **Done**. **Figure 44** - Confirmation that the device is now connected - ![Confirmation that the device is now connected.](images/win10_confirm_device_connected_to_org.png) + ![Confirmation that the device is now connected](images/win10_confirm_device_connected_to_org.png) 8. The **Connect to work or school** window will refresh and will now include an entry that shows you're connected to your organization's Azure AD. This means the device is now registered in Azure AD and enrolled in MDM and the account should have access to the organization's resources. **Figure 45** - Device is now enrolled in Azure AD - ![Device is enrolled in Azure AD.](images/win10_device_enrolled_in_aad.png) + ![Device is enrolled in Azure AD](images/win10_device_enrolled_in_aad.png) 9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. diff --git a/smb/index.md b/smb/index.md index a6ae7f1200..cc4c596a1c 100644 --- a/smb/index.md +++ b/smb/index.md @@ -17,16 +17,16 @@ audience: itpro # Windows 10 for SMB -![Windows 10 for SMB.](images/smb_portal_banner.png) +![Windows 10 for SMB](images/smb_portal_banner.png) -## ![Learn more about Windows and other resources for SMBs.](images/learn.png) Learn +## ![Learn more about Windows and other resources for SMBs](images/learn.png) Learn

Windows 10 for business
Learn how Windows 10 and Windows devices can help your business.

SMB blog
Read about the latest stories, technology insights, and business strategies for SMBs.

How to buy
Go here when you're ready to buy or want to learn more about Microsoft products you can use to help transform your business.

-## ![Deploy a Microsoft solution for your business.](images/deploy.png) Deploy +## ![Deploy a Microsoft solution for your business](images/deploy.png) Deploy

Get started: Deploy and manage a full cloud IT solution for your business
Find out how easy it is to deploy and manage a full cloud IT solution for your small to midsize business using Microsoft cloud services and tools.

diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index 882b7e57ba..73c2ce1f3d 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -55,7 +55,7 @@ There are a couple of things we need to know when you pay for apps. You can add 2. Select **Manage**, and then select **Settings**. 3. On **Shop**, , under **Shopping behavior**, turn on or turn off **Allow users to shop**. -![manage settings to control Basic Purchaser role assignment.](images/sfb-allow-shop-setting.png) +![manage settings to control Basic Purchaser role assignment](images/sfb-allow-shop-setting.png) ## Allow app requests diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md index bee1e82435..26bb2598f8 100644 --- a/store-for-business/billing-understand-your-invoice-msfb.md +++ b/store-for-business/billing-understand-your-invoice-msfb.md @@ -51,7 +51,7 @@ invoice and descriptions for each term. The **Invoice Summary** is on the top of the first page and shows information about your billing profile and how you pay. -![Invoice summary section.](images/invoicesummary.png) +![Invoice summary section](images/invoicesummary.png) | Term | Description | @@ -68,7 +68,7 @@ The **Invoice Summary** is on the top of the first page and shows information ab The **Billing Summary** shows the charges against the billing profile since the previous billing period, any credits that were applied, tax, and the total amount due. -![Billing summary section.](images/billingsummary.png) +![Billing summary section](images/billingsummary.png) | Term | Description | | --- | --- | @@ -91,7 +91,7 @@ The total amount due for each service family is calculated by subtracting Azure `Total = Charges/Credits - Azure Credit + Tax` -![Details by invoice section.](images/invoicesectiondetails.png) +![Details by invoice section](images/invoicesectiondetails.png) | Term |Description | | --- | --- | diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index 3bdd7d61bc..bb29be21a9 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -91,7 +91,7 @@ Get-MSStoreInventory >1. Sign in to [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) or [Microsoft Store for Education](https://businessstore.microsoft.com/). >2. Click **Manage** and then choose **Apps & software**. >3. Click the line-of-business app. The URL of the page will contain the product ID and SKU as part of the URL. For example: ->![Url after apps/ is product id and next is SKU.](images/lob-sku.png) +>![Url after apps/ is product id and next is SKU](images/lob-sku.png) ## View people assigned to a product Most items in **Products and Services** in **Microsoft Store for Business and Education** need to be assigned to people in your org. You can view the people in your org assigned to a specific product by using these commands: diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md index 0a66d2a739..784e422a8a 100644 --- a/store-for-business/troubleshoot-microsoft-store-for-business.md +++ b/store-for-business/troubleshoot-microsoft-store-for-business.md @@ -36,23 +36,23 @@ The private store for your organization is a page in Microsoft Store app that co 1. Click the people icon in Microsoft Store app, and click **Sign in**. - ![Sign in to Store app with a different account.](images/wsfb-wsappsignin.png) + ![Sign in to Store app with a different account](images/wsfb-wsappsignin.png) 2. Click **Add account**, and then click **Work or school account**. - ![Choose an account to use.](images/wsfb-wsappaddacct.png) + ![Choose an account to use](images/wsfb-wsappaddacct.png) 3. Type the email account and password, and click **Sign in**. - ![Sign in for work or school account.](images/wsfb-wsappworkacct.png) + ![Sign in for work or school account](images/wsfb-wsappworkacct.png) 4. You should see the private store for your organization. In our example, the page is named **Contoso publishing**. - ![Private store with name highlighted.](images/wsfb-wsappprivatestore.png) + ![Private store with name highlighted](images/wsfb-wsappprivatestore.png) Click the private store to see apps in your private store. - ![Private store for Contoso publishing.](images/wsfb-privatestoreapps.png) + ![Private store for Contoso publishing](images/wsfb-privatestoreapps.png) ## Troubleshooting Microsoft Store for Business integration with Microsoft Endpoint Configuration Manager diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index 4b0cd1e47d..66f34fdabe 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -26,7 +26,7 @@ Microsoft Store for Business and Education regularly releases new and improved f :::row::: :::column span="1"::: - ![Security groups.](images/security-groups-icon.png) + ![Security groups](images/security-groups-icon.png) :::column-end::: :::column span="1"::: **Use security groups with Private store apps**

On the details page for apps in your private store, you can set **Private store availability**. This allows you to choose which security groups can see an app in the private store.

[Get more info](./app-inventory-management-microsoft-store-for-business.md#private-store-availability)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education @@ -38,7 +38,7 @@ Microsoft Store for Business and Education regularly releases new and improved f We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features! | | | |-----------------------|---------------------------------| -| ![Private store performance icon.](images/perf-improvement-icon.png) |**Performance improvements in private store**

We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them.

[Get more info](./manage-private-store-settings.md#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | +| ![Private store performance icon](images/perf-improvement-icon.png) |**Performance improvements in private store**

We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them.

[Get more info](./manage-private-store-settings.md#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | | | **Manage Windows device deployment with Windows Autopilot Deployment**

In Microsoft Store for Business, you can manage devices for your organization and apply an Autopilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the Autopilot deployment profile you applied to the device.

[Get more info](add-profile-to-devices.md)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | | ![Microsoft Store for Business Settings page, Distribute tab showing app requests setting.](images/msfb-wn-1709-app-request.png) |**Request an app**

People in your organization can request additional licenses for apps in your private store, and then Admins or Purchasers can make the purchases.

[Get more info](./acquire-apps-microsoft-store-for-business.md#request-apps)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | || ![Image showing Add a Collection.](images/msfb-add-collection.png) |**Private store collections**

You can groups of apps in your private store with **Collections**. This can help you organize apps and help people find apps for their job or classroom.

[Get more info](https://review.docs.microsoft.com/microsoft-store/manage-private-store-settings?branch=msfb-14856406#add-a-collection)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | diff --git a/store-for-business/working-with-line-of-business-apps.md b/store-for-business/working-with-line-of-business-apps.md index 8efc8effad..2150c9e7c3 100644 --- a/store-for-business/working-with-line-of-business-apps.md +++ b/store-for-business/working-with-line-of-business-apps.md @@ -46,7 +46,7 @@ You'll need to set up: - LOB publishers need to have an app in Microsoft Store, or have an app ready to submit to the Store. The process and timing look like this: -![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer.](images/lob-workflow.png) +![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer](images/lob-workflow.png) ## Add an LOB publisher (Admin) Admins need to invite developer or ISVs to become an LOB publisher. diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index 130ad633ee..b0bdee5283 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -423,7 +423,7 @@ The process then configures the client for package or connection group additions This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). -![Package add file and registry data.](images/packageaddfileandregistrydata.png) +![Package add file and registry data](images/packageaddfileandregistrydata.png) **Package add file and registry data** @@ -454,7 +454,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. -![package add file and registry data - global.](images/packageaddfileandregistrydata-global.png) +![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) **Package add file and registry data—global** @@ -481,7 +481,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as-needed basis. - ![package add file and registry data - stream.](images/packageaddfileandregistrydata-stream.png) + ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) **Package add file and registry data—stream** diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index 4183212c31..501a6eae9f 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -20,9 +20,9 @@ This checklist outlines the recommended steps and items to consider when deployi |Status|Task|References|Notes| |---|---|---|---| -|![Checklist box.](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| >[!NOTE] >Keep track of server names and associated URLs you create during installation. You'll need this information throughout the installation process. diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index 9bde5d0531..e8785b3d7f 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -28,7 +28,7 @@ The App-V Sequencer is included in the Windows 10 Assessment and Deployment Kit 1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). 2. Select the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation. - ![Selecting APP-V features in ADK.](images/app-v-in-adk.png) + ![Selecting APP-V features in ADK](images/app-v-in-adk.png) 3. To open the Sequencer, go to the **Start** menu and select **Microsoft Application Virtualization (App-V) Sequencer**. See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index 50887ca724..e838f04c45 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -23,12 +23,12 @@ This checklist can be used to help you plan for preparing your organization for |Status|Task|References|Notes| |---|---|---|---| -|![Checklist box.](../app-v/images/checklistbox.gif)|Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning.|[Getting started with App-V](appv-getting-started.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Plan for App-V deployment prerequisites and prepare your computing environment.|[App-V prerequisites](appv-prerequisites.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|If you plan to use the App-V management server, plan for the required roles.|[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Plan for the App-V sequencer and client to create and run virtualized applications.|[Planning for the App-V Sequencer and client deployment](appv-planning-for-sequencer-and-client-deployment.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|If applicable, review the options and steps for migrating from a previous version of App-V.|[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md)|| -|![Checklist box.](../app-v/images/checklistbox.gif)|Decide whether to configure App-V clients in Shared Content Store mode.|[Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning.|[Getting started with App-V](appv-getting-started.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Plan for App-V deployment prerequisites and prepare your computing environment.|[App-V prerequisites](appv-prerequisites.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|If you plan to use the App-V management server, plan for the required roles.|[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Plan for the App-V sequencer and client to create and run virtualized applications.|[Planning for the App-V Sequencer and client deployment](appv-planning-for-sequencer-and-client-deployment.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|If applicable, review the options and steps for migrating from a previous version of App-V.|[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md)|| +|![Checklist box](../app-v/images/checklistbox.gif)|Decide whether to configure App-V clients in Shared Content Store mode.|[Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)|| diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index 0a72c19e87..d123957cd1 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -23,15 +23,15 @@ Enterprise users want the same ability to enable or limit background activity. I Users have the ability to control background activity for their device through two interfaces in the **Settings** app: the **Background apps** page and the **Battery usage by app** page. The **Background apps** page has a master switch to turn background activity on or off for all apps, and provides individual switches to control each app's ability to run in the background.  -![Background apps settings page.](images/backgroundapps-setting.png) +![Background apps settings page](images/backgroundapps-setting.png) The **Battery usage by app** page allows fine-grained tuning of background activity. Users have the ability to set background activity to by **Managed By Windows**, as well as turning it on or off for each app. Only devices with a battery have this page available in the **Settings** app. Here is the set of available controls on desktop:  -![Battery usage by app on desktop.](images/battery-usage-by-app-desktop.png) +![Battery usage by app on desktop](images/battery-usage-by-app-desktop.png) Here is the set of available controls for mobile devices:  -![Battery usage by app on mobile.](images/battery-usage-by-app-mobile.png) +![Battery usage by app on mobile](images/battery-usage-by-app-mobile.png) Although the user interface differs across editions of the operating system, the policy and developer interface is consistent across Windows 10. For more information about these controls, see [Optimize background activity](/windows/uwp/debug-test-perf/optimize-background-activity). diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 4483687ba8..0cda2dc8c9 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -102,19 +102,19 @@ If a per-user service can't be disabled using a the security template, you can d 5. Right-click **Registry** > **New** > **Registry Item**. - ![Group Policy preferences disabling per-user services.](media/gpp-per-user-services.png) + ![Group Policy preferences disabling per-user services](media/gpp-per-user-services.png) 6. Make sure that HKEY_Local_Machine is selected for Hive and then click ... (the ellipses) next to Key Path. - ![Choose HKLM.](media/gpp-hklm.png) + ![Choose HKLM](media/gpp-hklm.png) 7. Browse to **System\CurrentControlSet\Services\PimIndexMaintenanceSvc**. In the list of values, highlight **Start** and click **Select**. - ![Select Start.](media/gpp-svc-start.png) + ![Select Start](media/gpp-svc-start.png) 8. Change **Value data** from **00000003** to **00000004** and click **OK**. Note setting the Value data to **4** = **Disabled**. - ![Startup Type is Disabled.](media/gpp-svc-disabled.png) + ![Startup Type is Disabled](media/gpp-svc-disabled.png) 9. To add the other services that cannot be managed with a Group Policy templates, edit the policy and repeat steps 5-8. @@ -140,14 +140,14 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t RE If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled): -![Using Regedit to change servive Starup Type.](media/regedit-change-service-startup-type.png) +![Using Regedit to change servive Starup Type](media/regedit-change-service-startup-type.png) > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: -![Create per-user services in disabled state.](media/user-service-flag.png) +![Create per-user services in disabled state](media/user-service-flag.png) ### Manage template services by modifying the Windows image @@ -186,4 +186,4 @@ For example, you might see the following per-user services listed in the Service You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. -![Use sc.exe to view service type.](media/cmd-type.png) \ No newline at end of file +![Use sc.exe to view service type](media/cmd-type.png) \ No newline at end of file diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index 8482a3497c..4130fde7e5 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -48,11 +48,11 @@ Refactoring also makes it easier to view running processes in Task Manager. You For example, here are the running processes displayed in Task Manager in Windows 10 version 1607: -![Running processes in Task Manager, version 1607.](media/svchost-grouped-processes.png) +![Running processes in Task Manager, version 1607](media/svchost-grouped-processes.png) Compare that to the same view of running processes in Windows 10 version 1703: -![Running processes in Task Manager, version 1703.](media/svchost-separated-processes.png) +![Running processes in Task Manager, version 1703](media/svchost-separated-processes.png) @@ -66,7 +66,7 @@ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The default value of **1** prevents the service from being split. For example, this is the registry key configuration for BFE: -![Example of a service that cannot be separated.](media/svchost-separation-disabled.png) +![Example of a service that cannot be separated](media/svchost-separation-disabled.png) ## Memory footprint @@ -77,7 +77,7 @@ Consider the following: |Grouped Services (< 3.5GB) | Split Services (3.5GB+) |--------------------------------------- | ------------------------------------------ | -|![Memory utilization for grouped services.](media/svchost-grouped-utilization.png) |![Memory utilization for separated services](media/svchost-separated-utilization.png) | +|![Memory utilization for grouped services](media/svchost-grouped-utilization.png) |![Memory utilization for separated services](media/svchost-separated-utilization.png) | > [!NOTE] > The above represents the peak observed values. diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 6da0fdfdb9..260944a53c 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -23,11 +23,11 @@ ms.topic: article Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. -![Screenshot of Control Panel.](images/admin-tools.png) +![Screenshot of Control Panel](images/admin-tools.png) The tools in the folder might vary depending on which edition of Windows you are using. -![Screenshot of folder of admin tools.](images/admin-tools-folder.png) +![Screenshot of folder of admin tools](images/admin-tools-folder.png) These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index c2a8ea0c57..ac96c101cf 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -41,53 +41,53 @@ Check Windows Security Event log on the NPS Server for NPS events that correspon In the event message, scroll to the very bottom, and then check the [Reason Code](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it. - ![example of an audit failure.](images/auditfailure.png) + ![example of an audit failure](images/auditfailure.png) *Example: event ID 6273 (Audit Failure)*

‎ - ![example of an audit success.](images/auditsuccess.png) + ![example of an audit success](images/auditsuccess.png) *Example: event ID 6272 (Audit Success)*
‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one. On the client side, go to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, go to **..\Wired-AutoConfig/Operational**. See the following example: -![event viewer screenshot showing wired-autoconfig and WLAN autoconfig.](images/eventviewer.png) +![event viewer screenshot showing wired-autoconfig and WLAN autoconfig](images/eventviewer.png) Most 802.1X authentication issues are because of problems with the certificate that's used for client or server authentication. Examples include invalid certificate, expiration, chain verification failure, and revocation check failure. First, validate the type of EAP method that's used: -![eap authentication type comparison.](images/comparisontable.png) +![eap authentication type comparison](images/comparisontable.png) If a certificate is used for its authentication method, check whether the certificate is valid. For the server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In **NPS snap-in**, go to **Policies** > **Network Policies**. Select and hold (or right-click) the policy, and then select **Properties**. In the pop-up window, go to the **Constraints** tab, and then select the **Authentication Methods** section. -![Constraints tab of the secure wireless connections properties.](images/eappropertymenu.png) +![Constraints tab of the secure wireless connections properties](images/eappropertymenu.png) The CAPI2 event log is useful for troubleshooting certificate-related issues. By default, this log isn't enabled. To enable this log, expand **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, select and hold (or right-click) **Operational**, and then select **Enable Log**. -![screenshot of event viewer.](images/capi.png) +![screenshot of event viewer](images/capi.png) For information about how to analyze CAPI2 event logs, see [Troubleshooting PKI Problems on Windows Vista](/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). When troubleshooting complex 802.1X authentication issues, it's important to understand the 802.1X authentication process. Here's an example of wireless connection process with 802.1X authentication: -![authenticator flow chart.](images/authenticator_flow_chart.png) +![authenticator flow chart](images/authenticator_flow_chart.png) If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter for a client-side capture, and **EAP** for an NPS-side capture. See the following examples: -![client-side packet capture data.](images/clientsidepacket_cap_data.png) +![client-side packet capture data](images/clientsidepacket_cap_data.png) *Client-side packet capture data*

-![NPS-side packet capture data.](images/NPS_sidepacket_capture_data.png) +![NPS-side packet capture data](images/NPS_sidepacket_capture_data.png) *NPS-side packet capture data*
‎ > [!NOTE] > If you have a wireless trace, you can also [view ETL files with network monitor](/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. If you need to load the required [parser](/archive/blogs/netmon/parser-profiles-in-network-monitor-3-4), see the instructions under the **Help** menu in Network Monitor. Here's an example: -![ETL parse.](images/etl.png) +![ETL parse](images/etl.png) ## Audit policy diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index d039c10c17..646585085e 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -50,7 +50,7 @@ The kernel passes control to the session manager process (Smss.exe) which initia Here is a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before starting troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement. -![thumbnail of boot sequence flowchart.](images/boot-sequence-thumb.png)
+![thumbnail of boot sequence flowchart](images/boot-sequence-thumb.png)
[Click to enlarge](img-boot-sequence.md)
diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index 57d2cc10a8..ce4154396e 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -152,7 +152,7 @@ The important components of the MSM include: - Security Manager (SecMgr) - handles all pre and post-connection security operations. - Authentication Engine (AuthMgr) – Manages 802.1x auth requests - ![MSM details.](images/msmdetails.png) + ![MSM details](images/msmdetails.png) Each of these components has their own individual state machines which follow specific transitions. Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** filters in TextAnalysisTool for more detail. @@ -327,4 +327,4 @@ Copy and paste all the lines below and save them into a text file named "wifi.ta In the following example, the **View** settings are configured to **Show Only Filtered Lines**. -![TAT filter example.](images/tat.png) \ No newline at end of file +![TAT filter example](images/tat.png) \ No newline at end of file diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md index d59710d70b..69fa51d4e4 100644 --- a/windows/client-management/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -54,4 +54,4 @@ To change the policy for an external storage device: 7. Select the policy that you want to use. - ![Policy options for disk management.](./images/change-def-rem-policy-2.png) + ![Policy options for disk management](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 4d8f35673e..275869bf99 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -24,7 +24,7 @@ ms.topic: article From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). -![Remote Desktop Connection client.](images/rdp.png) +![Remote Desktop Connection client](images/rdp.png) ## Set up @@ -40,7 +40,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. - ![Allow remote connections to this computer.](images/allow-rdp.png) + ![Allow remote connections to this computer](images/allow-rdp.png) 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies: diff --git a/windows/client-management/img-boot-sequence.md b/windows/client-management/img-boot-sequence.md index 6ce343dade..b1077e5be6 100644 --- a/windows/client-management/img-boot-sequence.md +++ b/windows/client-management/img-boot-sequence.md @@ -14,4 +14,4 @@ ms.prod: w10 Return to: [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
-![Full-sized boot sequence flowchart.](images/boot-sequence.png) +![Full-sized boot sequence flowchart](images/boot-sequence.png) diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md index 9354d9c8c9..376916c1d3 100644 --- a/windows/client-management/introduction-page-file.md +++ b/windows/client-management/introduction-page-file.md @@ -56,13 +56,13 @@ Page files extend how much "committed memory" (also known as "virtual memory") i The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support. -![Task manager.](images/task-manager.png) +![Task manager](images/task-manager.png) The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage. -![Out of memory.](images/out-of-memory.png) +![Out of memory](images/out-of-memory.png) -![Task Manager.](images/task-manager-commit.png) +![Task Manager](images/task-manager-commit.png) The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values. diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index db00986ab0..263dd24430 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -212,7 +212,7 @@ This policy setting will change the evaluation order in which Allow and Prevent Some of these policies take precedence over other policies. The flowchart shown below illustrates how Windows processes them to determine whether a user can install a device or not, as shown in Figure below. -![Device Installation policies flow chart.](images/device-installation-flowchart.png)
_Device Installation policies flow chart_ +![Device Installation policies flow chart](images/device-installation-flowchart.png)
_Device Installation policies flow chart_ @@ -261,17 +261,17 @@ To find device identification strings using Device Manager 4. Find the “Printers” section and find the target printer - ![Selecting the printer in Device Manager.](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ + ![Selecting the printer in Device Manager](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ 5. Double-click the printer and move to the ‘Details’ tab. - ![‘Details’ tab.](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ + ![‘Details’ tab](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ 6. From the ‘Value’ window, copy the most detailed Hardware ID – we will use this in the policies. - ![HWID.](images/device-installation-dm-printer-hardware-ids.png) + ![HWID](images/device-installation-dm-printer-hardware-ids.png) - ![Compatible ID.](images/device-installation-dm-printer-compatible-ids.png)
_HWID and Compatible ID_ + ![Compatible ID](images/device-installation-dm-printer-compatible-ids.png)
_HWID and Compatible ID_ > [!TIP] > You can also determine your device identification strings by using the PnPUtil command-line utility. For more information, see [PnPUtil - Windows drivers](/windows-hardware/drivers/devtest/pnputil) in Microsoft Docs. @@ -360,7 +360,7 @@ Creating the policy to prevent all printers from being installed: 6. Enter the printer class GUID you found above with the curly braces (this is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} - ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ + ![List of prevent Class GUIDs](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ 7. Click ‘OK’. @@ -399,7 +399,7 @@ Getting the right device identifier to prevent it from being installed: 1. Get your printer’s Hardware ID – in this example we will use the identifier we found previously - ![Printer Hardware ID identifier.](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ + ![Printer Hardware ID identifier](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ 2. Write down the device ID (in this case Hardware ID) – WSDPRINT\CanonMX920_seriesC1A0; Take the more specific identifier to make sure you block a specific printer and not a family of printers @@ -417,7 +417,7 @@ Creating the policy to prevent a single printer from being installed: 5. Enter the printer device ID you found above – WSDPRINT\CanonMX920_seriesC1A0 - ![Prevent Device ID list.](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ + ![Prevent Device ID list](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ 6. Click ‘OK’. @@ -477,7 +477,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 6. Enter the printer class GUID you found above with the curly braces (this is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} - ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ + ![List of prevent Class GUIDs](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ 7. Click ‘OK’. @@ -489,7 +489,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one ![Image of Local Group Policy Editor that shows the policies under "Device Installation Restrictions" and the policy named in this step.](images/device-installation-apply-layered_policy-1.png) - ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.".](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ + ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria."](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ 9. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. @@ -497,7 +497,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 11. Enter the printer device ID you found above: WSDPRINT\CanonMX920_seriesC1A0. - ![Allow Printer Hardware ID.](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ + ![Allow Printer Hardware ID](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ 12. Click ‘OK’. @@ -532,22 +532,22 @@ Getting the right device identifier to prevent it from being installed and its l 3. Find the USB thumb-drive and select it. - ![Selecting the usb thumb-drive in Device Manager.](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ + ![Selecting the usb thumb-drive in Device Manager](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ 4. Change View (in the top menu) to ‘Devices by connections’. This view represents the way devices are installed in the PnP tree. - ![Changing view in Device Manager to see the PnP connection tree.](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ + ![Changing view in Device Manager to see the PnP connection tree](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ > [!NOTE] > When blocking\Preventing a device that sits higher in the PnP tree, all the devices that sit under it will be blocked. For example: Preventing a “Generic USB Hub” from being installed, all the devices that lay below a “Generic USB Hub” will be blocked. - ![Blocking nested devices from the root.](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ + ![Blocking nested devices from the root](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ 5. Double-click the USB thumb-drive and move to the ‘Details’ tab. 6. From the ‘Value’ window, copy the most detailed Hardware ID—we will use this in the policies. In this case Device ID = USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![USB device hardware IDs.](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ + ![USB device hardware IDs](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ Creating the policy to prevent a single USB thumb-drive from being installed: @@ -563,7 +563,7 @@ Creating the policy to prevent a single USB thumb-drive from being installed: 5. Enter the USB thumb-drive device ID you found above – USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![Prevent Device IDs list.](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ + ![Prevent Device IDs list](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ 6. Click ‘OK’. @@ -620,7 +620,7 @@ As mentioned in scenario #4, it is not enough to enable only a single hardware I - “USB Root Hub (USB 3.0)” -> USB\ROOT_HUB30 - “Generic USB Hub” -> USB\USB20_HUB -![USB devices nested in the PnP tree.](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ +![USB devices nested in the PnP tree](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ These devices are internal devices on the machine that define the USB port connection to the outside world. Enabling them should not enable any external/peripheral device from being installed on the machine. @@ -663,7 +663,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 9. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it – this policy will enable you to override the wide coverage of the ‘Prevent’ policy with a specific device. - ![Apply layered order of evaluation policy.](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ + ![Apply layered order of evaluation policy](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ 10. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. @@ -671,7 +671,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 12. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation – USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs.".](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ + ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs."](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ 13. Click ‘OK’. diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index f64ee0de0c..a177277d07 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -35,7 +35,7 @@ Policy paths: **User Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. -![Settings page visibility policy.](images/settings-page-visibility-gp.png) +![Settings page visibility policy](images/settings-page-visibility-gp.png) ## Configuring the Group Policy diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 0e9dd8a789..22ba2d74a8 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -92,7 +92,7 @@ For more information about how Windows 10 and Azure AD optimize access to work r As you review the roles in your organization, you can use the following generalized decision tree to begin to identify users or devices that require domain join. Consider switching the remaining users to Azure AD. -![Decision tree for device authentication options.](images/windows-10-management-cyod-byod-flow.png) +![Decision tree for device authentication options](images/windows-10-management-cyod-byod-flow.png) ## Settings and Configuration diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index 7b77f47742..b5b30659d6 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -75,7 +75,7 @@ First, you create a default user profile with the customizations that you want, > [!TIP] > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\\System32\\Sysprep\\Panther\\setupact.log and look for an entry like the following: > - > ![Microsoft Bing Translator package error.](images/sysprep-error.png) + > ![Microsoft Bing Translator package error](images/sysprep-error.png) > > Use the [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true) and [Remove-AppxPackage -AllUsers](/powershell/module/appx/remove-appxpackage?view=win10-ps&preserve-view=true) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. @@ -86,11 +86,11 @@ First, you create a default user profile with the customizations that you want, 1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. - ![Example of User Profiles UI.](images/copy-to.png) + ![Example of User Profiles UI](images/copy-to.png) 1. In **Copy To**, under **Permitted to use**, click **Change**. - ![Example of Copy To UI.](images/copy-to-change.png) + ![Example of Copy To UI](images/copy-to-change.png) 1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. @@ -98,11 +98,11 @@ First, you create a default user profile with the customizations that you want, - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - ![Example of Copy profile to.](images/copy-to-path.png) + ![Example of Copy profile to](images/copy-to-path.png) - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of Copy To UI with UNC path.](images/copy-to-path.png) + ![Example of Copy To UI with UNC path](images/copy-to-path.png) 1. Click **OK** to copy the default user profile. @@ -139,9 +139,9 @@ When a user is configured with a mandatory profile, Windows 10 starts as though | Group Policy setting | Windows 10 | Windows Server 2016 | Windows 8.1 | Windows Server 2012 | | --- | --- | --- | --- | --- | -| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported.](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | > [!NOTE] > The Group Policy settings above can be applied in Windows 10 Professional edition. diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 42722f7bd7..930343209f 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -22,7 +22,7 @@ AccountManagement CSP is used to configure setting in the Account Manager servic The following diagram shows the AccountManagement configuration service provider in tree format. -![accountmanagement csp.](images/provisioning-csp-accountmanagement.png) +![accountmanagement csp](images/provisioning-csp-accountmanagement.png) **./Vendor/MSFT/AccountManagement** Root node for the AccountManagement configuration service provider. diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 64394a6989..34f60116f4 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -21,45 +21,45 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a 1. Sign up for Azure AD tenant from [this website](https://account.windowsazure.com/organization) by creating an administrator account for your organization. - ![sign up for azure ad tenant.](images/azure-ad-add-tenant1.png) + ![sign up for azure ad tenant](images/azure-ad-add-tenant1.png) 2. Enter the information for your organization. Select **check availability** to verify that domain name that you selected is available. - ![sign up for azure ad.](images/azure-ad-add-tenant2.png) + ![sign up for azure ad](images/azure-ad-add-tenant2.png) 3. Complete the login and country information. Enter a valid phone number, then select **Send text message** or **Call me**. - ![create azure account.](images/azure-ad-add-tenant3.png) + ![create azure account](images/azure-ad-add-tenant3.png) 4. Enter the code that you receive and then select **Verify code**. After the code is verified and the continue button turns green, select **continue**. - ![add aad tenant.](images/azure-ad-add-tenant3-b.png) + ![add aad tenant](images/azure-ad-add-tenant3-b.png) 5. After you finish creating your Azure account, you can add an Azure AD subscription. If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to the Office 356 portal at https://portal.office.com/, and then sign in using the admin account that you created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). - ![login to office 365.](images/azure-ad-add-tenant4.png) + ![login to office 365](images/azure-ad-add-tenant4.png) 6. Select **Install software**. - ![login to office 365.](images/azure-ad-add-tenant5.png) + ![login to office 365](images/azure-ad-add-tenant5.png) 7. In the Microsoft 365 admin center, select **Purchase Services** from the left navigation. - ![purchase service option in admin center menu.](images/azure-ad-add-tenant6.png) + ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) 8. On the **Purchase services** page, scroll down until you see **Azure Active Directory Premium**, then select to purchase. - ![azure active directory option in purchase services page.](images/azure-ad-add-tenant7.png) + ![azure active directory option in purchase services page](images/azure-ad-add-tenant7.png) 9. Continue with your purchase. - ![azure active directory premium payment page.](images/azure-ad-add-tenant8.png) + ![azure active directory premium payment page](images/azure-ad-add-tenant8.png) 10. After the purchase is completed, you can log in to your Office 365 Admin Portal and you will see the **Azure AD** option from the Admin drop-down menu along with other services (SharePoint, Exchange, etc....). - ![admin center left navigation menu.](images/azure-ad-add-tenant9.png) + ![admin center left navigation menu](images/azure-ad-add-tenant9.png) When you choose Azure AD, it will take you to the Azure AD portal where you can manage your Azure AD applications. @@ -69,27 +69,27 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread.](images/azure-ad-add-tenant10.png) + ![register azuread](images/azure-ad-add-tenant10.png) 2. On the **Home** page, select on the Admin tools icon. - ![register azuread.](images/azure-ad-add-tenant11.png) + ![register azuread](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. - ![register azuread.](images/azure-ad-add-tenant12.png) + ![register azuread](images/azure-ad-add-tenant12.png) 4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread.](images/azure-ad-add-tenant13.png) + ![register azuread](images/azure-ad-add-tenant13.png) 5. It may take a few minutes to process the request. - ![register azuread.](images/azure-ad-add-tenant14.png) + ![register azuread](images/azure-ad-add-tenant14.png) 6. You will see a welcome page when the process completes. - ![register azuread.](images/azure-ad-add-tenant15.png) + ![register azuread](images/azure-ad-add-tenant15.png) diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 5669fcf0f8..3df830bda7 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -263,16 +263,16 @@ Supported operations are Get, Add, Delete, and Replace. The **Device Portal** page opens on your browser. - ![device portal screenshot.](images/applocker-screenshot1.png) + ![device portal screenshot](images/applocker-screenshot1.png) 8. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**. 9. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps. - ![device portal app manager.](images/applocker-screenshot3.png) + ![device portal app manager](images/applocker-screenshot3.png) 10. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed. - ![app manager.](images/applocker-screenshot2.png) + ![app manager](images/applocker-screenshot2.png) The following table shows the mapping of information to the AppLocker publisher rule field. diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index 4c8f6eaecd..157bf6f4d0 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -23,7 +23,7 @@ manager: dansimp [EnterpriseAppVManagement CSP reference](./enterpriseappvmanagement-csp.md) -![enterpriseappvmanagement csp.](images/provisioning-csp-enterpriseappvmanagement.png) +![enterpriseappvmanagement csp](images/provisioning-csp-enterpriseappvmanagement.png)

(./User/Vendor/MSFT/EnterpriseAppVManagement) contains the following sub-nodes.

diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 97f22aae88..82a11f3eb6 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -90,7 +90,7 @@ After the users accepts the Terms of Use, the device is registered in Azure AD a The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Subsequently, the device is enrolled for management with the MDM. This is done by calling the enrollment endpoint and requesting enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is made available to the MDM in the form of claims within an access token presented at the enrollment endpoint. -![azure ad enrollment flow.](images/azure-ad-enrollment-flow.png) +![azure ad enrollment flow](images/azure-ad-enrollment-flow.png) The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Azure AD Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this topic. @@ -173,7 +173,7 @@ IT administrators use the Azure AD app gallery to add an MDM for their organizat The following image illustrates how MDM applications will show up in the Azure app gallery in a category dedicated to MDM software. -![azure ad add an app for mdm.](images/azure-ad-app-gallery.png) +![azure ad add an app for mdm](images/azure-ad-app-gallery.png) ### Add cloud-based MDM to the app gallery @@ -732,7 +732,7 @@ Response: When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenrollment.](images/azure-ad-unenrollment.png) +![aadj unenrollment](images/azure-ad-unenrollment.png) ## Error codes diff --git a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index ce25592491..21499425a9 100644 --- a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -20,10 +20,10 @@ manager: dansimp 2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. 3. Select **Microsoft Intune** and configure the blade. -![How to get to the Blade.](images/azure-mdm-intune.png) +![How to get to the Blade](images/azure-mdm-intune.png) Configure the blade -![Configure the Blade.](images/azure-intune-configure-scope.png) +![Configure the Blade](images/azure-intune-configure-scope.png) You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index e07354fa81..0bb9326924 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -27,7 +27,7 @@ The BOOTSTRAP configuration service provider sets the Trusted Provisioning Serve The following image shows the BOOTSTRAP configuration service provider in tree format as used by Open Mobile Alliance (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. -![bootstrap csp (cp).](images/provisioning-csp-bootstrap-cp.png) +![bootstrap csp (cp)](images/provisioning-csp-bootstrap-cp.png) **CONTEXT-ALLOW** Optional. Specifies a context for the TPS. Only one context is supported, so this parameter is ignored and "0" is assumed for its value. diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index 15a939f7eb..46ee3a5e98 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -30,7 +30,7 @@ This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID The following diagram shows the BrowserFavorite configuration service provider in tree format as used by Open Mobile Alliance Device (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. -![browserfavorite csp (cp).](images/provisioning-csp-browserfavorite-cp.png) +![browserfavorite csp (cp)](images/provisioning-csp-browserfavorite-cp.png) ***favorite name*** Required. Specifies the user-friendly name of the favorite URL that is displayed in the Favorites list of Internet Explorer. diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index d1db6d514e..4fabdbc971 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -57,7 +57,7 @@ Using the WCD, create a provisioning package using the enrollment information re 1. Open the WCD tool. 2. Click **Advanced Provisioning**. - ![icd start page.](images/bulk-enrollment7.png) + ![icd start page](images/bulk-enrollment7.png) 3. Enter a project name and click **Next**. 4. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then click **Next**. 5. Skip **Import a provisioning package (optional)** and click **Finish**. @@ -74,20 +74,20 @@ Using the WCD, create a provisioning package using the enrollment information re For detailed descriptions of these settings, see [Provisioning CSP](provisioning-csp.md). Here is the screenshot of the WCD at this point. - ![bulk enrollment screenshot.](images/bulk-enrollment.png) + ![bulk enrollment screenshot](images/bulk-enrollment.png) 9. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (e.g., **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). 10. When you are done adding all the settings, on the **File** menu, click **Save**. 11. On the main menu click **Export** > **Provisioning package**. - ![icd menu for export.](images/bulk-enrollment2.png) + ![icd menu for export](images/bulk-enrollment2.png) 12. Enter the values for your package and specify the package output location. - ![enter package information.](images/bulk-enrollment3.png) - ![enter additional information for package information.](images/bulk-enrollment4.png) - ![specify file location.](images/bulk-enrollment6.png) + ![enter package information](images/bulk-enrollment3.png) + ![enter additional information for package information](images/bulk-enrollment4.png) + ![specify file location](images/bulk-enrollment6.png) 13. Click **Build**. - ![icb build window.](images/bulk-enrollment5.png) + ![icb build window](images/bulk-enrollment5.png) 14. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). 15. Apply the package to your devices. @@ -108,7 +108,7 @@ Using the WCD, create a provisioning package using the enrollment information re 5. Set **ExportCertificate** to False. 6. For **KeyLocation**, select **Software only**. - ![icd certificates section.](images/bulk-enrollment8.png) + ![icd certificates section](images/bulk-enrollment8.png) 7. Specify the workplace settings. 1. Got to **Workplace** > **Enrollments**. 2. Enter the **UPN** for the enrollment and then click **Add**. diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index ab4cb97c8f..64372f26a8 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -21,7 +21,7 @@ The CellularSettings configuration service provider is used to configure cellula The following image shows the CellularSettings CSP in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. -![provisioning for cellular settings.](images/provisioning-csp-cellularsettings.png) +![provisioning for cellular settings](images/provisioning-csp-cellularsettings.png) **DataRoam**

Optional. Integer. Specifies the default roaming value. Valid values are:

diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 1d42413872..5063181c3f 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -20,7 +20,7 @@ This configuration service provider requires the ID\_CAP\_NETWORKING\_ADMIN capa The following diagram shows the CM\_CellularEntries configuration service provider management object in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. -![cm\-cellularentries csp.](images/provisioning-csp-cm-cellularentries.png) +![cm\-cellularentries csp](images/provisioning-csp-cm-cellularentries.png) ***entryname***

Defines the name of the connection.

diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index d4793c91e6..cce8060fe3 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2555,36 +2555,36 @@ The following list shows the CSPs supported in HoloLens devices: | Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | |------|--------|--------|--------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) -| [Accounts CSP](accounts-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [AppLocker CSP](applocker-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [CertificateStore CSP](certificatestore-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | -| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DevDetail CSP](devdetail-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | -| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DevInfo CSP](devinfo-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMAcc CSP](dmacc-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMClient CSP](dmclient-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | -| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| -| [NodeCache CSP](nodecache-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -[PassportForWork CSP](passportforwork-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | -| [Update CSP](update-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [WiFi CSP](wifi-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) +| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| +| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | +| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | ## CSPs supported in Microsoft Surface Hub diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index cc589f1f13..8e886f3661 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -42,7 +42,7 @@ For more information about the CSPs, see [Update CSP](update-csp.md) and the upd The following diagram provides a conceptual overview of how this works: -![mobile device update management.](images/mdm-update-sync.png) +![mobile device update management](images/mdm-update-sync.png) The diagram can be roughly divided into three areas: @@ -56,7 +56,7 @@ The Microsoft Update Catalog is huge and contains many updates that are not need This section describes how this is done. The following diagram shows the server-server sync protocol process. -![mdm server-server sync.](images/deviceupdateprocess2.png) +![mdm server-server sync](images/deviceupdateprocess2.png) MSDN provides much information about the Server-Server sync protocol. In particular: @@ -140,7 +140,7 @@ The enterprise IT can configure auto-update polices via OMA DM using the [Policy The following diagram shows the Update policies in a tree format. -![update policies.](images/update-policies.png) +![update policies](images/update-policies.png) **Update/ActiveHoursEnd** > [!NOTE] @@ -676,7 +676,7 @@ Example The enterprise IT can configure the set of approved updates and get compliance status via OMA DM using the [Update CSP](update-csp.md). The following diagram shows the Update CSP in tree format.. -![provisioning csp update.](images/provisioning-csp-update.png) +![provisioning csp update](images/provisioning-csp-update.png) **Update** The root node. @@ -889,9 +889,9 @@ Here is the list of older policies that are still supported for backward compati The following screenshots of the administrator console show the list of update titles, approval status, and additional metadata fields. -![mdm update management screenshot.](images/deviceupdatescreenshot1.png) +![mdm update management screenshot](images/deviceupdatescreenshot1.png) -![mdm update management metadata screenshot.](images/deviceupdatescreenshot2.png) +![mdm update management metadata screenshot](images/deviceupdatescreenshot2.png) ## SyncML example @@ -945,5 +945,5 @@ Set auto update to notify and defer. The following diagram and screenshots show the process flow of the device update process using Windows Server Update Services and Microsoft Update Catalog. -![mdm device update management screenshot3.](images/deviceupdatescreenshot3.png)![mdm device update management screenshot4](images/deviceupdatescreenshot4.png)![mdm device update management screenshot5](images/deviceupdatescreenshot5.png)![mdm device update management screenshot6](images/deviceupdatescreenshot6.png)![mdm device update management screenshot7](images/deviceupdatescreenshot7.png)![mdm device update management screenshot8](images/deviceupdatescreenshot8.png)![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) +![mdm device update management screenshot3](images/deviceupdatescreenshot3.png)![mdm device update management screenshot4](images/deviceupdatescreenshot4.png)![mdm device update management screenshot5](images/deviceupdatescreenshot5.png)![mdm device update management screenshot6](images/deviceupdatescreenshot6.png)![mdm device update management screenshot7](images/deviceupdatescreenshot7.png)![mdm device update management screenshot8](images/deviceupdatescreenshot8.png)![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index 0db22bf159..f24564545c 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -26,7 +26,7 @@ The DeviceInstance CSP is only supported in Windows 10 Mobile. The following diagram shows the DeviceInstanceService configuration service provider in tree format. -![provisioning\-csp\-deviceinstanceservice.](images/provisioning-csp-deviceinstanceservice.png) +![provisioning\-csp\-deviceinstanceservice](images/provisioning-csp-deviceinstanceservice.png) **Roaming** A boolean value that specifies the roaming status of the device. In dual SIM mode when the device supports two different phone numbers, querying SIM 1 explicitly with ./Vendor/MSFT/DeviceInstanceService/Identify1/Roaming is functionally equivalent to using ./Vendor/MSFT/DeviceInstanceService/Roaming. diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index 9933e58a23..cef65071ec 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -32,7 +32,7 @@ The DevicePasswordEnabled setting must be set to 0 (device password is enabled) The following image shows the DeviceLock configuration service provider in tree format. -![devicelock csp.](images/provisioning-csp-devicelock.png) +![devicelock csp](images/provisioning-csp-devicelock.png) **Provider** Required. An interior node to group all policy providers. Scope is permanent. Supported operation is Get. diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 92ed52968c..6043b61d8c 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -20,13 +20,13 @@ To help diagnose enrollment or device management issues in Windows 10 devices m 1. On your managed device go to **Settings** > **Accounts** > **Access work or school**. 1. Click your work or school account, then click **Info.** - ![Access work or school page in Settings.](images/diagnose-mdm-failures15.png) + ![Access work or school page in Settings](images/diagnose-mdm-failures15.png) 1. At the bottom of the **Settings** page, click **Create report**. - ![Access work or school page and then Create report.](images/diagnose-mdm-failures16.png) + ![Access work or school page and then Create report](images/diagnose-mdm-failures16.png) 1. A window opens that shows the path to the log files. Click **Export**. - ![Access work or school log files.](images/diagnose-mdm-failures17.png) + ![Access work or school log files](images/diagnose-mdm-failures17.png) 1. In File Explorer, navigate to c:\Users\Public\Documents\MDMDiagnostics to see the report. @@ -59,7 +59,7 @@ Starting with the Windows 10, version 1511, MDM logs are captured in the Event Here's a screenshot: -![mdm event viewer.](images/diagnose-mdm-failures1.png) +![mdm event viewer](images/diagnose-mdm-failures1.png) In this location, the **Admin** channel logs events by default. However, if you need more details logs you can enable **Debug** logs by choosing **Show Analytic and Debug** logs option in **View** menu in Event Viewer. @@ -238,26 +238,26 @@ For best results, ensure that the PC or VM on which you are viewing logs matches 1. Open eventvwr.msc. 2. Right-click on **Event Viewer(Local)** and select **Open Saved Log**. - ![event viewer screenshot.](images/diagnose-mdm-failures9.png) + ![event viewer screenshot](images/diagnose-mdm-failures9.png) 3. Navigate to the etl file that you got from the device and then open the file. 4. Click **Yes** when prompted to save it to the new log format. - ![event viewer prompt.](images/diagnose-mdm-failures10.png) + ![event viewer prompt](images/diagnose-mdm-failures10.png) - ![diagnose mdm failures.](images/diagnose-mdm-failures11.png) + ![diagnose mdm failures](images/diagnose-mdm-failures11.png) 5. The new view contains traces from the channel. Click on **Filter Current Log** from the **Actions** menu. - ![event viewer actions.](images/diagnose-mdm-failures12.png) + ![event viewer actions](images/diagnose-mdm-failures12.png) 6. Add a filter to Event sources by selecting **DeviceManagement-EnterpriseDiagnostics-Provider** and click **OK**. - ![event filter for Device Management.](images/diagnose-mdm-failures13.png) + ![event filter for Device Management](images/diagnose-mdm-failures13.png) 7. Now you are ready to start reviewing the logs. - ![event viewer review logs.](images/diagnose-mdm-failures14.png) + ![event viewer review logs](images/diagnose-mdm-failures14.png) ## Collect device state data diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 5f48d033a0..35fe6568b0 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -137,7 +137,7 @@ You can only use the Work Access page to unenroll under the following conditions When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenerollment.](images/azure-ad-unenrollment.png) +![aadj unenerollment](images/azure-ad-unenrollment.png) When a device is enrolled into MDM through Azure Active Directory Join and then remotely unenrolled, the device may get into a state where it must be re-imaged. When devices are remotely unenrolled from MDM, the AAD association is also removed. This safeguard is in place to avoid leaving the corporated devices in unmanaged state. diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 2ef69ad6c3..43882781ec 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -24,35 +24,35 @@ To get the EAP configuration from your desktop using the rasphone tool that is s 1. Run rasphone.exe. - ![vpnv2 rasphone.](images/vpnv2-csp-rasphone.png) + ![vpnv2 rasphone](images/vpnv2-csp-rasphone.png) 1. If you don't currently have a VPN connection and you see the following message, select **OK**. - ![vpnv2 csp network connections.](images/vpnv2-csp-networkconnections.png) + ![vpnv2 csp network connections](images/vpnv2-csp-networkconnections.png) 1. In the wizard, select **Workplace network**. - ![vpnv2 csp set up connection.](images/vpnv2-csp-setupnewconnection.png) + ![vpnv2 csp set up connection](images/vpnv2-csp-setupnewconnection.png) 1. Enter an Internet address and connection name. These can be fake since it does not impact the authentication parameters. - ![vpnv2 csp set up connection 2.](images/vpnv2-csp-setupnewconnection2.png) + ![vpnv2 csp set up connection 2](images/vpnv2-csp-setupnewconnection2.png) 1. Create a fake VPN connection. In the UI shown here, select **Properties**. - ![vpnv2 csp choose nw connection.](images/vpnv2-csp-choosenetworkconnection.png) + ![vpnv2 csp choose nw connection](images/vpnv2-csp-choosenetworkconnection.png) 1. In the **Test Properties** dialog, select the **Security** tab. - ![vpnv2 csp test props.](images/vpnv2-csp-testproperties.png) + ![vpnv2 csp test props](images/vpnv2-csp-testproperties.png) 1. On the **Security** tab, select **Use Extensible Authentication Protocol (EAP)**. - ![vpnv2 csp test props2.](images/vpnv2-csp-testproperties2.png) + ![vpnv2 csp test props2](images/vpnv2-csp-testproperties2.png) 1. From the drop-down menu, select the EAP method that you want to configure, and then select **Properties** to configure as needed. - ![vpnv2 csp test props3.](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) + ![vpnv2 csp test props3](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) 1. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. @@ -267,7 +267,7 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Follow steps 1 through 7 in the EAP configuration article. 1. In the **Microsoft VPN SelfHost Properties** dialog box, select **Microsoft: Smart Card or other Certificate** from the drop-down menu (this selects EAP TLS). - ![vpn self host properties window.](images/certfiltering1.png) + ![vpn self host properties window](images/certfiltering1.png) > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. @@ -277,11 +277,11 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Select the **Properties** button underneath the drop-down menu. 1. On the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - ![smart card or other certificate properties window.](images/certfiltering2.png) + ![smart card or other certificate properties window](images/certfiltering2.png) 1. On the **Configure Certificate Selection** menu, adjust the filters as needed. - ![configure certificate window.](images/certfiltering3.png) + ![configure certificate window](images/certfiltering3.png) 1. Select **OK** to close the windows and get back to the main rasphone.exe dialog box. 1. Close the rasphone dialog box. diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index cfc9928a0b..d6a0127bab 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -47,19 +47,19 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( 2. Under **Best match**, click **Edit group policy** to launch it. - ![GPEdit search.](images/admx-gpedit-search.png) + ![GPEdit search](images/admx-gpedit-search.png) 3. In **Local Computer Policy** navigate to the policy you want to configure. In this example, navigate to **Administrative Templates > System > App-V**. - ![App-V policies.](images/admx-appv.png) + ![App-V policies](images/admx-appv.png) 4. Double-click **Enable App-V Client**. The **Options** section is empty, which means there are no parameters necessary to enable the policy. If the **Options** section is not empty, follow the procedure in [Enable a policy that requires parameters](#enable-a-policy-that-requires-parameters) - ![Enable App-V client.](images/admx-appv-enableapp-vclient.png) + ![Enable App-V client](images/admx-appv-enableapp-vclient.png) 3. Create the SyncML to enable the policy that does not require any parameter. @@ -99,15 +99,15 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. - ![Enable publishing server 2 policy.](images/admx-appv-publishingserver2.png) + ![Enable publishing server 2 policy](images/admx-appv-publishingserver2.png) - ![Enable publishing server 2 settings.](images/admx-app-v-enablepublishingserver2settings.png) + ![Enable publishing server 2 settings](images/admx-app-v-enablepublishingserver2settings.png) 2. Find the variable names of the parameters in the ADMX file. You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). - ![Publishing server 2 policy description.](images/admx-appv-policy-description.png) + ![Publishing server 2 policy description](images/admx-appv-policy-description.png) 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index bab52cb7fd..f4c951af17 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -84,7 +84,7 @@ After the upgrade to Windows 10 is complete, if you decide to push down a new we The following diagram shows a high-level overview of the process. -![update process for windows embedded 8.1 devices.](images/windowsembedded-update.png) +![update process for windows embedded 8.1 devices](images/windowsembedded-update.png) ## Step 1: Prepare a test device to download updates from Microsoft Update @@ -107,15 +107,15 @@ Trigger the device to check for updates either manually or using Microsoft Endpo 1. Remotely trigger a scan of the test device by deploying a Trigger Scan configuration baseline. - ![device scan using Configuration Manager.](images/windowsembedded-update2.png) + ![device scan using Configuration Manager](images/windowsembedded-update2.png) 2. Set the value of this OMA-URI by going to **Configuration Item**, and then selecting the newly created Trigger Scan settings from the previous step. - ![device scan using Configuration Manager.](images/windowsembedded-update3.png) + ![device scan using Configuration Manager](images/windowsembedded-update3.png) 3. Ensure that the value that is specified for this URI is greater than the value on the device(s), and that the **Remediate noncompliant rules when supported** option is selected. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. - ![device scan using Configuration Manager.](images/windowsembedded-update4.png) + ![device scan using Configuration Manager](images/windowsembedded-update4.png) 4. Create a configuration baseline for Trigger Scan and Deploy. We recommend that this configuration baseline be deployed after the Controlled Updates baseline has been applied to the device. (The corresponding files are deployed on the device through a device sync session.) 5. Follow the prompts for downloading the updates, but do not install the updates on the device. @@ -216,11 +216,11 @@ The deployment process has three parts: 1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then select **Select**. - ![embedded device update.](images/windowsembedded-update18.png) + ![embedded device update](images/windowsembedded-update18.png) 2. Browse to the DUControlledUpdates.xml that was created from the test device, and then specify the file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. - ![embedded device update.](images/windowsembedded-update19.png) + ![embedded device update](images/windowsembedded-update19.png) 3. Select **Remediate noncompliant settings**, and then select **OK**. @@ -231,7 +231,7 @@ The deployment process has three parts: 1. Create a configuration item and specify the file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` 2. Select **Remediate noncompliant settings**. - ![embedded device update.](images/windowsembedded-update21.png) + ![embedded device update](images/windowsembedded-update21.png) 3. Select **OK**. @@ -242,11 +242,11 @@ The deployment process has three parts: 1. Create a configuration baseline item and give it a name (such as ControlledUpdates). 2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then select **OK**. - ![embedded device update.](images/windowsembedded-update22.png) + ![embedded device update](images/windowsembedded-update22.png) 3. Deploy the configuration baseline to the appropriate device or device collection. - ![embedded device update.](images/windowsembedded-update23.png) + ![embedded device update](images/windowsembedded-update23.png) 4. Select **OK**. @@ -472,57 +472,57 @@ Use this procedure for pre-GDR1 devices: 2. In Microsoft Endpoint Configuration Manager, under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Items**. 3. Select **Create Configuration Item**. - ![device update using Configuration Manager.](images/windowsembedded-update5.png) + ![device update using Configuration Manager](images/windowsembedded-update5.png) 4. Enter a filename (such as GetDUReport), and then select **Mobile Device**. 5. On the **Mobile Device Settings** page, select **Configure Additional Settings that are not in the default settings group**, and then select **Next**. - ![device update using Configuration Manager.](images/windowsembedded-update6.png) + ![device update using Configuration Manager](images/windowsembedded-update6.png) 6. On the **Additional Settings** page, select **Add**. - ![device update using Configuration Manager.](images/windowsembedded-update7.png) + ![device update using Configuration Manager](images/windowsembedded-update7.png) 7. On the **Browse Settings** page, select **Create Setting**. - ![device update.](images/windowsembedded-update8.png) + ![device update](images/windowsembedded-update8.png) 8. Enter a unique **Name**. For **Setting type**, select **OMA-URI**, and for **Data type**, select **String**. 9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, and then select **OK**. - ![handheld device update.](images/windowsembedded-update9.png) + ![handheld device update](images/windowsembedded-update9.png) 10. On the **Browse Settings** page, select **Close**. 11. On the **Create Configuration Item Wizard** page, select **All Windows Embedded 8.1 Handheld** as the supported platform, and then select **Next**. - ![embedded device update.](images/windowsembedded-update10.png) + ![embedded device update](images/windowsembedded-update10.png) 12. Close the **Create Configuration Item Wizard** page. 13. Right-click on the newly create configuration item, and then select the **Compliance Rules** tab. 14. Select the new created mobile device setting (such as DUReport), and then select **Select**. 15. Enter a dummy value (such as zzz) that is different from the one on the device. - ![embedded device update.](images/windowsembedded-update11.png) + ![embedded device update](images/windowsembedded-update11.png) 16. Disable remediation by deselecting the **Remediate noncompliant rules when supported** option. 17. Select **OK** to close the **Edit Rule** page. 18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Baselines**. 19. Select **Create Configuration Item**. - ![embedded device update.](images/windowsembedded-update12.png) + ![embedded device update](images/windowsembedded-update12.png) 20. Enter a baseline name (such as RetrieveDUReport). 21. Add the configuration item that you just created. Select **Add**, and then select the configuration item that you just created (such as DUReport). - ![embedded device update.](images/windowsembedded-update13.png) + ![embedded device update](images/windowsembedded-update13.png) 22. Select **OK**, and then select **OK** again to complete the configuration baseline. 23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created, and then select **Deploy**. - ![embedded device update.](images/windowsembedded-update14.png) + ![embedded device update](images/windowsembedded-update14.png) 24. Select **Remediate noncompliant rules when supported**. 25. Select the appropriate device collection and define the schedule. - ![device update.](images/windowsembedded-update15.png) + ![device update](images/windowsembedded-update15.png) 26. To view the DUReport content, select the appropriate deployment for the configuration baseline that you created. Right-click on the deployment, and then select **View Status**. 27. Select **Run Summarization**, and then select **Refresh**. The test device(s) should be listed on the **Non-Compliant** tab. 28. Under **Asset Details**, right-click on the test device, and then select **Mode Details**. - ![device update.](images/windowsembedded-update16.png) + ![device update](images/windowsembedded-update16.png) 29. On the **Non-compliant** tab, you can see the DUReport, but you cannot retrieve the content from here. - ![device update.](images/windowsembedded-update17.png) + ![device update](images/windowsembedded-update17.png) 30. To retrieve the DUReport, open C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. 31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz," where zzz is the dummy value. Just above this, copy the information for UpdateData and use this information to create the DUControlledUpdates.xml. diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index c9f13235e0..322e4dbc40 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -46,11 +46,11 @@ To ensure that the auto-enrollment feature is working as expected, you must veri The following steps demonstrate required settings using the Intune service: 1. Verify that the user who is going to enroll the device has a valid Intune license. - ![Intune license verification.](images/auto-enrollment-intune-license-verification.png) + ![Intune license verification](images/auto-enrollment-intune-license-verification.png) 2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). - ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) + ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) > [!IMPORTANT] > For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. @@ -62,23 +62,23 @@ The following steps demonstrate required settings using the Intune service: You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. - ![Auto-enrollment device status result.](images/auto-enrollment-device-status-result.png) + ![Auto-enrollment device status result](images/auto-enrollment-device-status-result.png) Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. - ![Auto-enrollment Azure AD prt verification.](images/auto-enrollment-azureadprt-verification.png) + ![Auto-enrollment Azure AD prt verification](images/auto-enrollment-azureadprt-verification.png) This information can also be found on the Azure AD device list. - ![Azure AD device list.](images/azure-ad-device-list.png) + ![Azure AD device list](images/azure-ad-device-list.png) 5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc - ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) + ![MDM discovery URL](images/auto-enrollment-mdm-discovery-url.png) 6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. - ![Mobility setting MDM intune.](images/auto-enrollment-microsoft-intune-setting.png) + ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) 7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. @@ -87,7 +87,7 @@ You may contact your domain administrators to verify if the group policy has bee 9. Verify that Microsoft Intune should allow enrollment of Windows devices. - ![Enrollment of Windows devices.](images/auto-enrollment-enrollment-of-windows-devices.png) + ![Enrollment of Windows devices](images/auto-enrollment-enrollment-of-windows-devices.png) ## Configure the auto-enrollment Group Policy for a single PC @@ -102,18 +102,18 @@ Requirements: Click Start, then in the text box type gpedit. - ![GPEdit desktop app search result.](images/autoenrollment-gpedit.png) + ![GPEdit desktop app search result](images/autoenrollment-gpedit.png) 2. Under **Best match**, click **Edit group policy** to launch it. 3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. > [!div class="mx-imgBorder"] - > ![MDM policies.](images/autoenrollment-mdm-policies.png) + > ![MDM policies](images/autoenrollment-mdm-policies.png) 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - ![MDM autoenrollment policy.](images/autoenrollment-policy.png) + ![MDM autoenrollment policy](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. @@ -129,7 +129,7 @@ Requirements: If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. - ![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) + ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) > [!Tip] > You can avoid this behavior by using Conditional Access Policies in Azure AD. @@ -139,7 +139,7 @@ Requirements: 7. Click **Info** to see the MDM enrollment information. - ![Work School Settings.](images/autoenrollment-settings-work-school.png) + ![Work School Settings](images/autoenrollment-settings-work-school.png) If you do not see the **Info** button or the enrollment information, it is possible that the enrollment failed. Check the status in [Task Scheduler app](#task-scheduler-app). @@ -148,13 +148,13 @@ Requirements: 1. Click **Start**, then in the text box type **task scheduler**. - ![Task Scheduler search result.](images/autoenrollment-task-schedulerapp.png) + ![Task Scheduler search result](images/autoenrollment-task-schedulerapp.png) 2. Under **Best match**, click **Task Scheduler** to launch it. 3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. - ![Auto-enrollment scheduled task.](images/autoenrollment-scheduled-task.png) + ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. @@ -239,13 +239,13 @@ To collect Event Viewer logs: 3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully: - ![Event ID 75.](images/auto-enrollment-troubleshooting-event-id-75.png) + ![Event ID 75](images/auto-enrollment-troubleshooting-event-id-75.png) If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons: - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed: - ![Event ID 76.](images/auto-enrollment-troubleshooting-event-id-76.png) + ![Event ID 76](images/auto-enrollment-troubleshooting-event-id-76.png) To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. @@ -253,7 +253,7 @@ To collect Event Viewer logs: The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot: - ![Task scheduler.](images/auto-enrollment-task-scheduler.png) + ![Task scheduler](images/auto-enrollment-task-scheduler.png) > [!Note] > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. @@ -262,24 +262,24 @@ To collect Event Viewer logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. - ![Event ID 107.](images/auto-enrollment-event-id-107.png) + ![Event ID 107](images/auto-enrollment-event-id-107.png) When the task is completed, a new event ID 102 is logged. - ![Event ID 102.](images/auto-enrollment-event-id-102.png) + ![Event ID 102](images/auto-enrollment-event-id-102.png) Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - ![Outdated enrollment entries.](images/auto-enrollment-outdated-enrollment-entries.png) + ![Outdated enrollment entries](images/auto-enrollment-outdated-enrollment-entries.png) By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016. A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - ![Manually deleted entries.](images/auto-enrollment-activation-verification-less-entries.png) + ![Manually deleted entries](images/auto-enrollment-activation-verification-less-entries.png) ### Related topics diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index c29e2047ad..b809041a65 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -41,7 +41,7 @@ These classifications are represented as nodes in the EnterpriseModernAppManagem The following diagram shows the EnterpriseModernAppManagement CSP in a tree format. -![enterprisemodernappmanagement csp diagram.](images/provisioning-csp-enterprisemodernappmanagement.png) +![enterprisemodernappmanagement csp diagram](images/provisioning-csp-enterprisemodernappmanagement.png) Each app displays one package family name and 1-n package full names for installed apps. The apps are categorized based on their origin (Store, nonStore, System). diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index 98249aad50..51c1a6581f 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -23,7 +23,7 @@ The EnterpriseAppManagement enterprise configuration service provider is used to The following diagram shows the EnterpriseAppManagement configuration service provider in tree format. -![enterpriseappmanagement csp.](images/provisioning-csp-enterpriseappmanagement.png) +![enterpriseappmanagement csp](images/provisioning-csp-enterpriseappmanagement.png) ***EnterpriseID*** Optional. A dynamic node that represents the EnterpriseID as a GUID. It is used to enroll or unenroll enterprise applications. diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 3df7b51be2..12547591ba 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -24,7 +24,7 @@ The FileSystem configuration service provider is used to query, add, modify, and The following diagram shows the FileSystem configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider. -![filesystem csp (dm).](images/provisioning-csp-filesystem-dm.png) +![filesystem csp (dm)](images/provisioning-csp-filesystem-dm.png) **FileSystem** Required. Defines the root of the file system management object. It functions as the root directory for file system queries. diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 03fb5b432d..9f691cab8c 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -104,7 +104,7 @@ The following is a list of functions performed by the Device HealthAttestation C - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device - Receives attestation requests (DHA-Requests) from a DHA-Enabled-MDM, and replies with a device health report (DHA-Report) -![healthattestation service diagram.](images/healthattestation_2.png) +![healthattestation service diagram](images/healthattestation_2.png) diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index af7934b674..36a979715e 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -27,7 +27,7 @@ The HotSpot configuration service provider is used to configure and enable Inter The following diagram shows the HotSpot configuration service provider management object in tree format as used by OMA Client Provisioning. The OMA DM protocol is not supported by this configuration service provider. -![hotspot csp (cp).](images/provisioning-csp-hotspot-cp.png) +![hotspot csp (cp)](images/provisioning-csp-hotspot-cp.png) **Enabled** Required. Specifies whether to enable Internet sharing on the device. The default is false. diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index 68633b48af..08a455f462 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -44,7 +44,7 @@ To make applications WIP-aware, app developers need to include the following dat MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.  -![Mobile application management app.](images/implement-server-side-mobile-application-management.png) +![Mobile application management app](images/implement-server-side-mobile-application-management.png) MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.  diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 875c7d0ded..12e50c7af7 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -59,13 +59,13 @@ The Store for Business provides services that enable a management tool to synchr The following diagram provides an overview of app distribution from acquisition of an offline-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. -![business store offline app distribution.](images/businessstoreportalservices2.png) +![business store offline app distribution](images/businessstoreportalservices2.png) ### Online-licensed application distribution The following diagram provides an overview of app distribution from acquisition of an online-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. For online-licensed applications, the management tool calls back into the Store for Business management services to assign an application prior to issuing the policy to install the application. -![business store online app distribution.](images/businessstoreportalservices3.png) +![business store online app distribution](images/businessstoreportalservices3.png) ## Integrate with Azure Active Directory @@ -105,7 +105,7 @@ After registering your management tool with Azure AD, the management tool can ca The diagram below shows the call patterns for acquiring a new or updated application. -![business store portal service flow diagram.](images/businessstoreportalservicesflow.png) +![business store portal service flow diagram](images/businessstoreportalservicesflow.png) **Here is the list of available operations**: diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index 6dbe747d92..d1e7b033f2 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -25,7 +25,7 @@ In today’s cloud-first world, enterprise IT departments increasingly want to l You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. -![active directory azure ad signin.](images/unifiedenrollment-rs1-1.png) +![active directory azure ad signin](images/unifiedenrollment-rs1-1.png) ### Connect your device to an Active Directory domain (join a domain) @@ -40,15 +40,15 @@ Joining your device to an Active Directory domain during the out-of-box-experien 1. On the **Who Owns this PC?** page, select **My work or school owns it**. - ![oobe local account creation.](images/unifiedenrollment-rs1-2.png) + ![oobe local account creation](images/unifiedenrollment-rs1-2.png) 2. Next, select **Join a domain**. - ![select domain or azure ad.](images/unifiedenrollment-rs1-3.png) + ![select domain or azure ad](images/unifiedenrollment-rs1-3.png) 3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. - ![create pc account.](images/unifiedenrollment-rs1-4.png) + ![create pc account](images/unifiedenrollment-rs1-4.png) ### Use the Settings app @@ -56,27 +56,27 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page.](images/unifiedenrollment-rs1-5.png) + ![windows settings page](images/unifiedenrollment-rs1-5.png) 2. Next, select **Accounts**. - ![windows settings accounts select.](images/unifiedenrollment-rs1-6.png) + ![windows settings accounts select](images/unifiedenrollment-rs1-6.png) 3. Navigate to **Access work or school**. - ![select access work or school.](images/unifiedenrollment-rs1-7.png) + ![select access work or school](images/unifiedenrollment-rs1-7.png) 4. Select **Connect**. - ![connect to work or school.](images/unifiedenrollment-rs1-8.png) + ![connect to work or school](images/unifiedenrollment-rs1-8.png) 5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. - ![join account to active directory domain.](images/unifiedenrollment-rs1-9.png) + ![join account to active directory domain](images/unifiedenrollment-rs1-9.png) 6. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. - ![type in domain name.](images/unifiedenrollment-rs1-10.png) + ![type in domain name](images/unifiedenrollment-rs1-10.png) ### Help with connecting to an Active Directory domain @@ -101,11 +101,11 @@ To join a domain: 1. Select **My work or school owns it**, then select **Next.** - ![oobe local account creation.](images/unifiedenrollment-rs1-11.png) + ![oobe local account creation](images/unifiedenrollment-rs1-11.png) 2. Select **Join Azure AD**, and then select **Next.** - ![select domain or azure ad.](images/unifiedenrollment-rs1-12.png) + ![select domain or azure ad](images/unifiedenrollment-rs1-12.png) 3. Type in your Azure AD username. This is the email address you use to log into Microsoft Office 365 and similar services. @@ -113,7 +113,7 @@ To join a domain: Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant is not configured for auto-enrollment, you will have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization’s Azure AD domain. - ![azure ad signin.](images/unifiedenrollment-rs1-13.png) + ![azure ad signin](images/unifiedenrollment-rs1-13.png) ### Use the Settings app @@ -121,27 +121,27 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page.](images/unifiedenrollment-rs1-14.png) + ![windows settings page](images/unifiedenrollment-rs1-14.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts select.](images/unifiedenrollment-rs1-15.png) + ![windows settings accounts select](images/unifiedenrollment-rs1-15.png) 3. Navigate to **Access work or school**. - ![select access work or school.](images/unifiedenrollment-rs1-16.png) + ![select access work or school](images/unifiedenrollment-rs1-16.png) 4. Select **Connect**. - ![connect to work or school.](images/unifiedenrollment-rs1-17.png) + ![connect to work or school](images/unifiedenrollment-rs1-17.png) 5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**. - ![join work or school account to azure ad.](images/unifiedenrollment-rs1-18.png) + ![join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) 6. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![azure ad sign in.](images/unifiedenrollment-rs1-19.png) + ![azure ad sign in](images/unifiedenrollment-rs1-19.png) 7. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -151,7 +151,7 @@ To create a local account and connect the device: After you reach the end of the flow, your device should be connected to your organization’s Azure AD domain. You may now log out of your current account and sign in using your Azure AD username. - ![corporate sign in.](images/unifiedenrollment-rs1-20.png) + ![corporate sign in](images/unifiedenrollment-rs1-20.png) ### Help with connecting to an Azure AD domain @@ -183,19 +183,19 @@ To create a local account and connect the device: 1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. - ![windows settings page.](images/unifiedenrollment-rs1-21-b.png) + ![windows settings page](images/unifiedenrollment-rs1-21-b.png) 2. Navigate to **Access work or school**. - ![select access work or school.](images/unifiedenrollment-rs1-23-b.png) + ![select access work or school](images/unifiedenrollment-rs1-23-b.png) 3. Select **Connect**. - ![connect to work or school.](images/unifiedenrollment-rs1-24-b.png) + ![connect to work or school](images/unifiedenrollment-rs1-24-b.png) 4. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![join work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) + ![join work or school account to azure ad](images/unifiedenrollment-rs1-25-b.png) 5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -205,11 +205,11 @@ To create a local account and connect the device: Starting in Windows 10, version 1709, you will see the status page that shows the progress of your device being set up. - ![corporate sign in.](images/unifiedenrollment-rs1-26.png) + ![corporate sign in](images/unifiedenrollment-rs1-26.png) 6. After you complete the flow, your Microsoft account will be connected to your work or school account. - ![account successfully added.](images/unifiedenrollment-rs1-27.png) + ![account successfully added](images/unifiedenrollment-rs1-27.png) ### Connect to MDM on a desktop (enrolling in device management) @@ -221,29 +221,29 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page.](images/unifiedenrollment-rs1-28.png) + ![windows settings page](images/unifiedenrollment-rs1-28.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts page.](images/unifiedenrollment-rs1-29.png) + ![windows settings accounts page](images/unifiedenrollment-rs1-29.png) 3. Navigate to **Access work or school**. - ![access work or school.](images/unifiedenrollment-rs1-30.png) + ![access work or school](images/unifiedenrollment-rs1-30.png) 4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). - ![connect to work or school.](images/unifiedenrollment-rs1-31.png) + ![connect to work or school](images/unifiedenrollment-rs1-31.png) 5. Type in your work email address. - ![set up work or school account.](images/unifiedenrollment-rs1-32.png) + ![set up work or school account](images/unifiedenrollment-rs1-32.png) 6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen. - ![corporate sign in.](images/unifiedenrollment-rs1-33-b.png) + ![corporate sign in](images/unifiedenrollment-rs1-33-b.png) After you complete the flow, your device will be connected to your organization’s MDM. @@ -300,7 +300,7 @@ To connect your devices to MDM using deep links: - IT admins can add this link to a welcome email that users can select to enroll into MDM. - ![using enrollment deeplink in email.](images/deeplinkenrollment1.png) + ![using enrollment deeplink in email](images/deeplinkenrollment1.png) - IT admins can also add this link to an internal web page that users refer to enrollment instructions. @@ -308,20 +308,20 @@ To connect your devices to MDM using deep links: Type in your work email address. - ![set up work or school account.](images/deeplinkenrollment3.png) + ![set up work or school account](images/deeplinkenrollment3.png) 3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. After you complete the flow, your device will be connected to your organization's MDM. - ![corporate sign in.](images/deeplinkenrollment4.png) + ![corporate sign in](images/deeplinkenrollment4.png) ## Manage connections To manage your work or school connections, select **Settings** > **Accounts** > **Access work or school**. Your connections will show on this page and selecting one will expand options for that connection. -![managing work or school account.](images/unifiedenrollment-rs1-34-b.png) +![managing work or school account](images/unifiedenrollment-rs1-34-b.png) ### Info @@ -335,7 +335,7 @@ Selecting the **Info** button will open a new page in the Settings app that prov Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. -![work or school info.](images/unifiedenrollment-rs1-35-b.png) +![work or school info](images/unifiedenrollment-rs1-35-b.png) > [!NOTE] > Starting in Windows 10, version 1709, the **Manage** button is no longer available. @@ -357,7 +357,7 @@ You can collect diagnostic logs around your work connections by going to **Setti Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you will see the button to create a report, as shown here. -![collecting enrollment management log files.](images/unifiedenrollment-rs1-37-c.png) +![collecting enrollment management log files](images/unifiedenrollment-rs1-37-c.png) diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index ad2d4edddc..e9383e871f 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -17,7 +17,7 @@ The Messaging configuration service provider is used to configure the ability to The following diagram shows the Messaging configuration service provider in tree format. -![messaging csp.](images/provisioning-csp-messaging.png) +![messaging csp](images/provisioning-csp-messaging.png) **./User/Vendor/MSFT/Messaging** diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 6c898afe02..32f9b5ee66 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -68,7 +68,7 @@ Devices that are joined to an on-premises Active Directory can enroll into MDM v Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. -![Disable MDM enrollment policy in GP Editor.](images/mdm-enrollment-disable-policy.png) +![Disable MDM enrollment policy in GP Editor](images/mdm-enrollment-disable-policy.png) Here is the corresponding registry key: diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 0b715c1a53..1b5f5ecdd4 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -27,11 +27,11 @@ The NAPDEF configuration service provider is used to add, modify, or delete WAP The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. -![napdef csp (cp) (initial bootstrapping).](images/provisioning-csp-napdef-cp.png) +![napdef csp (cp) (initial bootstrapping)](images/provisioning-csp-napdef-cp.png) The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **updating the bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. -![napdef csp (cp) (update bootstrapping).](images/provisioning-csp-napdef-cp-2.png) +![napdef csp (cp) (update bootstrapping)](images/provisioning-csp-napdef-cp-2.png) **NAPAUTHINFO** Defines a group of authentication settings. diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 272489e4a8..ce79fdb702 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -240,7 +240,7 @@ Passing CDATA in data in SyncML to ConfigManager and CSPs does not work in Windo The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10. In Windows Phone 8.1, when you set the client certificate to "Accept," it works fine. -![ssl settings.](images/ssl-settings.png) +![ssl settings](images/ssl-settings.png) ### MDM enrollment fails on the mobile device when traffic is going through proxy @@ -439,7 +439,7 @@ Alternatively you can use the following procedure to create an EAP Configuration 1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) article. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) - ![vpn selfhost properties window.](images/certfiltering1.png) + ![vpn selfhost properties window](images/certfiltering1.png) > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. @@ -447,10 +447,10 @@ Alternatively you can use the following procedure to create an EAP Configuration 3. Click the **Properties** button underneath the drop down menu. 4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - ![smart card or other certificate properties window.](images/certfiltering2.png) + ![smart card or other certificate properties window](images/certfiltering2.png) 5. In the **Configure Certificate Selection** menu, adjust the filters as needed. - ![configure certificate selection window.](images/certfiltering3.png) + ![configure certificate selection window](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. 8. Continue following the procedure in the [EAP configuration](eap-configuration.md) article from Step 9 to get an EAP TLS profile with appropriate filtering. @@ -492,7 +492,7 @@ No. Only one MDM is allowed. 4. Click **Configure**. 5. Set quota to unlimited. - ![aad maximum joined devices.](images/faq-max-devices.png) + ![aad maximum joined devices](images/faq-max-devices.png) ### **What is dmwappushsvc?** diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index 84ff8f5e34..c73d5fdc8d 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -23,13 +23,13 @@ The PassportForWork configuration service provider is used to provision Windows The following diagram shows the PassportForWork configuration service provider in tree format. -![passportforwork csp.](images/provisioning-csp-passportforwork.png) +![passportforwork csp](images/provisioning-csp-passportforwork.png) ### Device configuration diagram The following diagram shows the PassportForWork configuration service provider in tree format. -![passportforwork diagram.](images/provisioning-csp-passportforwork2.png) +![passportforwork diagram](images/provisioning-csp-passportforwork2.png) **PassportForWork** Root node for PassportForWork configuration service provider. diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index da0f0543dc..ddeb61f84a 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -44,7 +44,7 @@ The Policy configuration service provider has the following sub-categories: The following diagram shows the Policy configuration service provider in tree format as used by both Open Mobile Alliance Device Management (OMA DM) and OMA Client Provisioning. -![policy csp diagram.](images/provisioning-csp-policy.png) +![policy csp diagram](images/provisioning-csp-policy.png) **./Vendor/MSFT/Policy** diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 013edacaec..9d7aa06011 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -549,7 +549,7 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and ``` You can also change the evaluation order of device installation policy settings by using a custom profile in Intune. -:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image."::: +:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image"::: @@ -743,7 +743,7 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i You can also block installation by using a custom profile in Intune. -![Custom profile prevent devices.](images/custom-profile-prevent-other-devices.png) +![Custom profile prevent devices](images/custom-profile-prevent-other-devices.png) @@ -863,7 +863,7 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile blocks installation and usage of USB devices with hardware IDs "USB\Composite" and "USB\Class_FF", and applies to USB devices with matching hardware IDs that are already installed. -![Custom profile prevent device ids.](images/custom-profile-prevent-device-ids.png) +![Custom profile prevent device ids](images/custom-profile-prevent-device-ids.png) @@ -977,7 +977,7 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile prevents installation of devices with matching device instance IDs. -![Custom profile.](images/custom-profile-prevent-device-instance-ids.png) +![Custom profile](images/custom-profile-prevent-device-instance-ids.png) To prevent installation of devices with matching device instance IDs by using custom profile in Intune: 1. Locate the device instance ID. diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index 7f7e8ae961..cdf909411f 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -40,6 +40,20 @@ manager: dansimp +Steps to use this policy correctly: + +1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). +1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). + 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays + 1. The value can be between min / max allowed. +1. Enroll HoloLens devices and verify both configurations get applied to the device. +1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. +1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. +1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. + +> [!NOTE] +> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. +
@@ -65,20 +79,6 @@ manager: dansimp
-Steps to use this policy correctly: - -1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). -1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). - 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays - 1. The value can be between min / max allowed. -1. Enroll HoloLens devices and verify both configurations get applied to the device. -1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. -1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. -1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. - -> [!NOTE] -> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. -
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index d627137d97..b02ba826b4 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 08/26/2021 +ms.date: 10/14/2020 ms.reviewer: manager: dansimp --- @@ -62,7 +62,7 @@ manager: dansimp System/AllowUserToResetPhone
- System/AllowWUfBCloudProcessing + System/AllowWuFBCloudProcessing
System/BootStartDriverInitialization @@ -964,7 +964,7 @@ The following list shows the supported values:
-**System/AllowWUfBCloudProcessing** +**System/AllowWuFBCloudProcessing**
@@ -985,15 +985,6 @@ If you disable or do not configure this policy setting, devices enrolled to the
- - -The following list shows the supported values: - -- 0 - Disabled. -- 8 - Enabled. - - - **System/BootStartDriverInitialization** diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index 92df20eba2..a0a34ee244 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -52,34 +52,34 @@ To get a PFN and WNS credentials, you must create an Microsoft Store app. 1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. - ![mdm push notification1.](images/push-notification1.png) + ![mdm push notification1](images/push-notification1.png) 2. Create a new app. - ![mdm push notification2.](images/push-notification2.png) + ![mdm push notification2](images/push-notification2.png) 3. Reserve an app name. - ![mdm push notification3.](images/push-notification3.png) + ![mdm push notification3](images/push-notification3.png) 4. Click **Services**. - ![mdm push notification4.](images/push-notification4.png) + ![mdm push notification4](images/push-notification4.png) 5. Click **Push notifications**. - ![mdm push notification5.](images/push-notification5.png) + ![mdm push notification5](images/push-notification5.png) 6. Click **Live Services site**. A new window opens for the **Application Registration Portal** page. - ![mdm push notification6.](images/push-notification6.png) + ![mdm push notification6](images/push-notification6.png) 7. In the **Application Registration Portal** page, you will see the properties for the app that you created, such as: - Application Id - Application Secrets - Microsoft Store Package SID, Application Identity, and Publisher. - ![mdm push notification7.](images/push-notification7.png) + ![mdm push notification7](images/push-notification7.png) 8. Click **Save**. 9. Close the **Application Registration Portal** window and go back to the Windows Dev Center Dashboard. 10. Select your app from the list on the left. 11. From the left nav, expand **App management** and then click **App identity**. - ![mdm push notification10.](images/push-notification10.png) + ![mdm push notification10](images/push-notification10.png) 12. In the **App identity** page, you will see the **Package Family Name (PFN)** of your app.   diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index e2d40a822a..48baff3fe8 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -23,11 +23,11 @@ The PXLOGICAL configuration service provider is used to add, remove, or modify W The following diagram shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for initial bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. -![pxlogical csp (cp) (initial bootstrapping).](images/provisioning-csp-pxlogical-cp.png) +![pxlogical csp (cp) (initial bootstrapping)](images/provisioning-csp-pxlogical-cp.png) The following diagram shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for updating the bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. -![pxlogical csp (cp) (update bootstrapping).](images/provisioning-csp-pxlogical-cp-2.png) +![pxlogical csp (cp) (update bootstrapping)](images/provisioning-csp-pxlogical-cp-2.png) **PXPHYSICAL** Defines a group of logical proxy settings. diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index 28e198aa1f..be9c8a5339 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -23,15 +23,15 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread.](images/azure-ad-add-tenant10.png) + ![register azuread](images/azure-ad-add-tenant10.png) 2. On the **Home** page, click on the Admin tools icon. - ![register azuread.](images/azure-ad-add-tenant11.png) + ![register azuread](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. - ![Azure-AD-updated.](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) + ![Azure-AD-updated](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 4ffdbad557..9e203d4d39 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -25,7 +25,7 @@ For the SecurityPolicy CSP, you cannot use the Replace command unless the node a The following diagram shows the SecurityPolicy configuration service provider management object in tree format as used by both OMA DM and OMA Client Provisioning. -![securitypolicy csp (dm,cp).](images/provisioning-csp-securitypolicy-dmandcp.png) +![securitypolicy csp (dm,cp)](images/provisioning-csp-securitypolicy-dmandcp.png) ***PolicyID*** Defines the security policy identifier as a decimal value. diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 21f39c4389..5b211a0f55 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -56,11 +56,11 @@ Group Policy option button setting: The following diagram shows the main display for the Group Policy Editor. -![Group Policy editor.](images/group-policy-editor.png) +![Group Policy editor](images/group-policy-editor.png) The following diagram shows the settings for the "Publishing Server 2 Settings" Group Policy in the Group Policy Editor. -![Group Policy publisher server 2 settings.](images/group-policy-publisher-server-2-settings.png) +![Group Policy publisher server 2 settings](images/group-policy-publisher-server-2-settings.png) Note that most Group Policies are a simple Boolean type. For a Boolean Group Policy, if you select **Enabled**, the options panel contains no data input fields and the payload of the SyncML is simply ``. However, if there are data input fields in the options panel, the MDM server must supply this data. The following *Enabling a Group Policy* example illustrates this complexity. In this example, 10 name-value pairs are described by `` tags in the payload, which correspond to the 10 data input fields in the Group Policy Editor options panel for the "Publishing Server 2 Settings" Group Policy. The ADMX file, which defines the Group Policies, is consumed by the MDM server, similarly to how the Group Policy Editor consumes it. The Group Policy Editor displays a UI to receive the complete Group Policy instance data, which the MDM server's IT administrator console must also do. For every `` element and id attribute in the ADMX policy definition, there must be a corresponding `` element and id attribute in the payload. The ADMX file drives the policy definition and is required by the MDM server via the SyncML protocol. diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index 00d2b86cd5..7916778bec 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -119,7 +119,7 @@ Currently SwapfileSize should not be relied for determining or controlling the o **CurrentSession/MaximumOverlaySize** or **NextSession/MaximumOverlaySize** should be used for that purpose. -:::image type="content" source="images/overlaysetting.png" alt-text="This is the overlay setting."::: +:::image type="content" source="images/overlaysetting.png" alt-text="This is the overlay setting"::: > [!NOTE] > Only single swapfile is supported in current implementation and creating swapfile on specific volume will disable any other swapfile created on other volumes. diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 42a6882673..3f6badf192 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -33,7 +33,7 @@ Important considerations: The following diagram shows the VPN configuration service provider in tree format. -![provisioning\-csp\-vpnimg.](images/provisioning-csp-vpn.png) +![provisioning\-csp\-vpnimg](images/provisioning-csp-vpn.png) ***ProfileName*** Unique alpha numeric Identifier for the profile. The profile name must not include a forward slash (/). diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index e7321b1888..d6b9110b32 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -25,7 +25,7 @@ The default security roles are defined in the root characteristic, and map to ea The following diagram shows the configuration service provider in tree format as used by OMA Client Provisioning. -![w4 application csp (cp).](images/provisioning-csp-w4-application-cp.png) +![w4 application csp (cp)](images/provisioning-csp-w4-application-cp.png) **APPID** Required. This parameter takes a string value. The only supported value for configuring MMS is "w4". diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 7aaa801796..20f21f79bc 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -23,7 +23,7 @@ The APPLICATION configuration service provider that has an APPID of w7 is used f The following image shows the configuration service provider in tree format as used by OMA Client Provisioning. -![w7 application csp (dm).](images/provisioning-csp-w7-application-dm.png) +![w7 application csp (dm)](images/provisioning-csp-w7-application-dm.png) > **Note**   All parm names and characteristic types are case sensitive and must use all uppercase. Both APPSRV and CLIENT credentials must be provided in provisioning XML. diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index e867ae66ef..125bbfb687 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -31,7 +31,7 @@ Programming considerations: The following image shows the WiFi configuration service provider in tree format. -![wi-fi csp diagram.](images/provisioning-csp-wifi.png) +![wi-fi csp diagram](images/provisioning-csp-wifi.png) The following list shows the characteristics and parameters. diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index e5e7511669..a8be6bba9c 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -25,7 +25,7 @@ The DM client is configured during the enrollment process to be invoked by the t The following diagram shows the work flow between server and client. -![windows client and server mdm diagram.](images/enterprise-workflow.png) +![windows client and server mdm diagram](images/enterprise-workflow.png) ## Management workflow diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index fc13fd3034..c68424cd04 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -19,7 +19,7 @@ The Windows Defender Advanced Threat Protection (WDATP) configuration service pr The following diagram shows the WDATP configuration service provider in tree format as used by the Open Mobile Alliance (OMA) Device Management (DM). -![windowsadvancedthreatprotection csp diagram.](images/provisioning-csp-watp.png) +![windowsadvancedthreatprotection csp diagram](images/provisioning-csp-watp.png) The following list describes the characteristics and parameters. diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 2fe71b5e76..2f3cdf7fc7 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -213,16 +213,16 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw | Class | Test completed in Windows 10 for desktop | |--------------------------------------------------------------------------|------------------------------------------| -| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | | [**wpcRatingsDescriptor**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | | -| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | -| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | @@ -232,17 +232,17 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw |--------------------------------------------------------------------------|------------------------------------------| [**Win32\_1394Controller**](/windows/win32/cimwin32prov/win32-1394controller) | [**Win32\_BaseBoard**](/windows/win32/cimwin32prov/win32-baseboard) | -[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | ![cross mark.](images/checkmark.png) -[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | ![cross mark.](images/checkmark.png) +[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | ![cross mark](images/checkmark.png) +[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | ![cross mark](images/checkmark.png) [**Win32\_CDROMDrive**](/windows/win32/cimwin32prov/win32-cdromdrive) | -[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | ![cross mark.](images/checkmark.png) -[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | ![cross mark.](images/checkmark.png) -[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | ![cross mark.](images/checkmark.png) +[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | ![cross mark](images/checkmark.png) +[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | ![cross mark](images/checkmark.png) +[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | ![cross mark](images/checkmark.png) [**Win32\_Desktop**](/windows/win32/cimwin32prov/win32-desktop) | -[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |![cross mark.](images/checkmark.png) -[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | ![cross mark.](images/checkmark.png) +[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |![cross mark](images/checkmark.png) +[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | ![cross mark](images/checkmark.png) [**Win32\_DiskPartition**](/windows/win32/cimwin32prov/win32-diskpartition) | -[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | ![cross mark.](images/checkmark.png) +[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | ![cross mark](images/checkmark.png) [**Win32\_DMAChannel**](/windows/win32/cimwin32prov/win32-dmachannel) | [**Win32\_DriverVXD**](/previous-versions//aa394141(v=vs.85)) | [**Win32\_EncryptableVolume**](/windows/win32/secprov/win32-encryptablevolume) | @@ -252,23 +252,23 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_IRQResource**](/windows/win32/cimwin32prov/win32-irqresource) | [**Win32\_Keyboard**](/windows/win32/cimwin32prov/win32-keyboard) | [**Win32\_LoadOrderGroup**](/windows/win32/cimwin32prov/win32-loadordergroup) | -[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | ![cross mark.](images/checkmark.png) +[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | ![cross mark](images/checkmark.png) [**Win32\_LoggedOnUser**](/windows/win32/cimwin32prov/win32-loggedonuser) | -[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | ![cross mark.](images/checkmark.png) +[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | ![cross mark](images/checkmark.png) [**Win32\_MotherboardDevice**](/windows/win32/cimwin32prov/win32-motherboarddevice) | -[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | ![cross mark.](images/checkmark.png) +[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | ![cross mark](images/checkmark.png) [**Win32\_NetworkAdapterConfiguration**](/windows/win32/cimwin32prov/win32-networkadapterconfiguration) | [**Win32\_NetworkClient**](/windows/win32/cimwin32prov/win32-networkclient) | [**Win32\_NetworkLoginProfile**](/windows/win32/cimwin32prov/win32-networkloginprofile) | [**Win32\_NetworkProtocol**](/windows/win32/cimwin32prov/win32-networkprotocol) | [**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) | -[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | ![cross mark.](images/checkmark.png) +[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | ![cross mark](images/checkmark.png) [**Win32\_OSRecoveryConfiguration**](/windows/win32/cimwin32prov/win32-osrecoveryconfiguration) | [**Win32\_PageFileSetting**](/windows/win32/cimwin32prov/win32-pagefilesetting) | [**Win32\_ParallelPort**](/windows/win32/cimwin32prov/win32-parallelport) | [**Win32\_PCMCIAController**](/windows/win32/cimwin32prov/win32-pcmciacontroller) | [**Win32\_PhysicalMedia**](/previous-versions/windows/desktop/cimwin32a/win32-physicalmedia) | -[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | ![cross mark.](images/checkmark.png) +[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | ![cross mark](images/checkmark.png) [**Win32\_PnPDevice**](/windows/win32/cimwin32prov/win32-pnpdevice) | [**Win32\_PnPEntity**](/windows/win32/cimwin32prov/win32-pnpentity) | [**Win32\_PointingDevice**](/windows/win32/cimwin32prov/win32-pointingdevice) | @@ -277,25 +277,25 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_POTSModem**](/windows/win32/cimwin32prov/win32-potsmodem) | [**Win32\_Printer**](/windows/win32/cimwin32prov/win32-printer) | [**Win32\_PrinterConfiguration**](/windows/win32/cimwin32prov/win32-printerconfiguration) | -[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | ![cross mark.](images/checkmark.png) -[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | ![cross mark.](images/checkmark.png) +[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | ![cross mark](images/checkmark.png) +[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | ![cross mark](images/checkmark.png) [**Win32\_Registry**](/windows/win32/cimwin32prov/win32-registry) | [**Win32\_SCSIController**](/windows/win32/cimwin32prov/win32-scsicontroller) | [**Win32\_SerialPort**](/windows/win32/cimwin32prov/win32-serialport) | [**Win32\_SerialPortConfiguration**](/windows/win32/cimwin32prov/win32-serialportconfiguration) | [**Win32\_ServerFeature**](/windows/win32/wmisdk/win32-serverfeature) | -[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | ![cross mark.](images/checkmark.png) -[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | ![cross mark.](images/checkmark.png) +[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | ![cross mark](images/checkmark.png) +[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | ![cross mark](images/checkmark.png) [**Win32\_SoundDevice**](/windows/win32/cimwin32prov/win32-sounddevice) | [**Win32\_SystemAccount**](/windows/win32/cimwin32prov/win32-systemaccount) | -[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | ![cross mark.](images/checkmark.png) +[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | ![cross mark](images/checkmark.png) [**Win32\_SystemDriver**](/windows/win32/cimwin32prov/win32-systemdriver) | -[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | ![cross mark.](images/checkmark.png) +[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | ![cross mark](images/checkmark.png) [**Win32\_TapeDrive**](/windows/win32/cimwin32prov/win32-tapedrive) | -[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | ![cross mark.](images/checkmark.png) +[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | ![cross mark](images/checkmark.png) [**Win32\_UninterruptiblePowerSupply**](/previous-versions//aa394503(v=vs.85)) | [**Win32\_USBController**](/windows/win32/cimwin32prov/win32-usbcontroller) | -[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | ![cross mark.](images/checkmark.png) +[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | ![cross mark](images/checkmark.png) [**Win32\_VideoController**](/windows/win32/cimwin32prov/win32-videocontroller) | **Win32\_WindowsUpdateAgentVersion** | diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md index acdcd2d268..6a50151342 100644 --- a/windows/client-management/quick-assist.md +++ b/windows/client-management/quick-assist.md @@ -57,7 +57,7 @@ Both the helper and sharer must be able to reach these endpoints over port 443: 7. RDP shares the video to the helper over https (port 443) through the RDP relay service to the helper's RDP control. Input is shared from the helper to the sharer through the RDP relay service. -:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established."::: +:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established"::: ### Data and privacy diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index 490b24075a..e0afd3d480 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -119,7 +119,7 @@ To verify the BCD entries: > [!NOTE] > If the computer is UEFI-based, the file path value that's specified in the **path** parameter of **{bootmgr}** and **{default}** contains an **.efi** extension. - ![bcdedit.](images/screenshot1.png) + ![bcdedit](images/screenshot1.png) If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that's named **bcdbackup**. To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup**. @@ -179,11 +179,11 @@ Dism /Image:: /Get-packages After you run this command, you'll see the **Install pending** and **Uninstall Pending** packages: -![Dism output pending update.](images/pendingupdate.png) +![Dism output pending update](images/pendingupdate.png) 1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. - ![Dism output revert pending.](images/revertpending.png) + ![Dism output revert pending](images/revertpending.png) 2. Navigate to ***OSdriveLetter*:\Windows\WinSxS**, and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. @@ -193,14 +193,14 @@ After you run this command, you'll see the **Install pending** and **Uninstall P 5. Navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **COMPONENT** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineComponentHive** for the new hive. - ![Load Hive.](images/loadhive.png) + ![Load Hive](images/loadhive.png) 6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. 7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. > [!div class="mx-imgBorder"] - > ![Unload Hive.](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) + > ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) 8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **SYSTEM** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineSystemHive** for the new hive. @@ -256,7 +256,7 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the \Control\Class\\{71A27CDD-812A-11D0-BEC7-08002BE2092F} > [!div class="mx-imgBorder"] - > ![Registry.](images/controlset.png) + > ![Registry](images/controlset.png) If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it's not a Windows default filter driver, such as PartMgr), remove the entry. To remove it, double-click it in the right pane, and then delete only that value. @@ -274,8 +274,8 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the * `chkdsk /f /r OsDrive:` - ![Check disk.](images/check-disk.png) + ![Check disk](images/check-disk.png) * `sfc /scannow /offbootdir=OsDrive:\ /offwindir=OsDrive:\Windows` - ![SFC scannow.](images/sfc-scannow.png) + ![SFC scannow](images/sfc-scannow.png) diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 390add3169..454101462a 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -165,13 +165,13 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below. - ![WinDbg img.](images/windbg.png) + ![WinDbg img](images/windbg.png) 7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page. 8. A detailed bugcheck analysis will appear. See the example below. - ![Bugcheck analysis.](images/bugcheck-analysis.png) + ![Bugcheck analysis](images/bugcheck-analysis.png) 9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL. diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md index 10ae554304..77e524634d 100644 --- a/windows/client-management/troubleshoot-tcpip-connectivity.md +++ b/windows/client-management/troubleshoot-tcpip-connectivity.md @@ -44,17 +44,17 @@ If the initial TCP handshake is failing because of packet drops, then you would Source side connecting on port 445: -![Screenshot of frame summary in Network Monitor.](images/tcp-ts-6.png) +![Screenshot of frame summary in Network Monitor](images/tcp-ts-6.png) Destination side: applying the same filter, you do not see any packets. -![Screenshot of frame summary with filter in Network Monitor.](images/tcp-ts-7.png) +![Screenshot of frame summary with filter in Network Monitor](images/tcp-ts-7.png) For the rest of the data, TCP will retransmit the packets five times. **Source 192.168.1.62 side trace:** -![Screenshot showing packet side trace.](images/tcp-ts-8.png) +![Screenshot showing packet side trace](images/tcp-ts-8.png) **Destination 192.168.1.2 side trace:** @@ -79,15 +79,15 @@ In the below screenshots, you see that the packets seen on the source and the de **Source Side** -![Screenshot of packets on source side in Network Monitor.](images/tcp-ts-9.png) +![Screenshot of packets on source side in Network Monitor](images/tcp-ts-9.png) **On the destination-side trace** -![Screenshot of packets on destination side in Network Monitor.](images/tcp-ts-10.png) +![Screenshot of packets on destination side in Network Monitor](images/tcp-ts-10.png) You also see an ACK+RST flag packet in a case when the TCP establishment packet SYN is sent out. The TCP SYN packet is sent when the client wants to connect on a particular port, but if the destination/server for some reason does not want to accept the packet, it would send an ACK+RST packet. -![Screenshot of packet flag.](images/tcp-ts-11.png) +![Screenshot of packet flag](images/tcp-ts-11.png) The application that's causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. @@ -110,8 +110,8 @@ auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /fai You can then review the Security event logs to see for a packet drop on a particular port-IP and a filter ID associated with it. -![Screenshot of Event Properties.](images/tcp-ts-12.png) +![Screenshot of Event Properties](images/tcp-ts-12.png) Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. After you open this file and filter for the ID that you find in the above event (2944008), you'll be able to see a firewall rule name that's associated with this ID that's blocking the connection. -![Screenshot of wfpstate.xml file.](images/tcp-ts-13.png) +![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index daa23de8b1..b432191920 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -21,7 +21,7 @@ In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image: -![Adapters.](images/nm-adapters.png) +![Adapters](images/nm-adapters.png) When the driver gets hooked to the network interface card (NIC) during installation, the NIC is reinitialized, which might cause a brief network glitch. @@ -29,15 +29,15 @@ When the driver gets hooked to the network interface card (NIC) during installat 1. Run netmon in an elevated status by choosing Run as Administrator. - ![Image of Start search results for Netmon.](images/nm-start.png) + ![Image of Start search results for Netmon](images/nm-start.png) 2. Network Monitor opens with all network adapters displayed. Select the network adapters where you want to capture traffic, click **New Capture**, and then click **Start**. - ![Image of the New Capture option on menu.](images/tcp-ts-4.png) + ![Image of the New Capture option on menu](images/tcp-ts-4.png) 3. Reproduce the issue, and you will see that Network Monitor grabs the packets on the wire. - ![Frame summary of network packets.](images/tcp-ts-5.png) + ![Frame summary of network packets](images/tcp-ts-5.png) 4. Select **Stop**, and go to **File > Save as** to save the results. By default, the file will be saved as a ".cap" file. diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index 4c1e8b1b7f..ca8551b1dd 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -58,19 +58,19 @@ Since outbound connections start to fail, you will see a lot of the below behavi - Unable to sign in to the machine with domain credentials, however sign-in with local account works. Domain sign-in will require you to contact the DC for authentication which is again an outbound connection. If you have cache credentials set, then domain sign-in might still work. - ![Screenshot of error for NETLOGON in Event Viewer.](images/tcp-ts-14.png) + ![Screenshot of error for NETLOGON in Event Viewer](images/tcp-ts-14.png) - Group Policy update failures: - ![Screenshot of event properties for Group Policy failure.](images/tcp-ts-15.png) + ![Screenshot of event properties for Group Policy failure](images/tcp-ts-15.png) - File shares are inaccessible: - ![Screenshot of error message "Windows cannot access."](images/tcp-ts-16.png) + ![Screenshot of error message "Windows cannot access"](images/tcp-ts-16.png) - RDP from the affected server fails: - ![Screenshot of error when Remote Desktop is unable to connect.](images/tcp-ts-17.png) + ![Screenshot of error when Remote Desktop is unable to connect](images/tcp-ts-17.png) - Any other application running on the machine will start to give out errors @@ -84,15 +84,15 @@ If you suspect that the machine is in a state of port exhaustion: a. **Event ID 4227** - ![Screenshot of event id 4227 in Event Viewer.](images/tcp-ts-18.png) + ![Screenshot of event id 4227 in Event Viewer](images/tcp-ts-18.png) b. **Event ID 4231** - ![Screenshot of event id 4231 in Event Viewer.](images/tcp-ts-19.png) + ![Screenshot of event id 4231 in Event Viewer](images/tcp-ts-19.png) 3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. - ![Screenshot of netstate command output.](images/tcp-ts-20.png) + ![Screenshot of netstate command output](images/tcp-ts-20.png) After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state. @@ -136,7 +136,7 @@ If method 1 does not help you identify the process (prior to Windows 10 and Wind 1. Add a column called “handles” under details/processes. 2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. - ![Screenshot of handles column in Windows Task Maner.](images/tcp-ts-21.png) + ![Screenshot of handles column in Windows Task Maner](images/tcp-ts-21.png) 3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. @@ -157,7 +157,7 @@ Steps to use Process explorer: File \Device\AFD - ![Screenshot of Process Explorer.](images/tcp-ts-22.png) + ![Screenshot of Process Explorer](images/tcp-ts-22.png) 10. Some are normal, but large numbers of them are not (hundreds to thousands). Close the process in question. If that restores outbound connectivity, then you have further proven that the app is the cause. Contact the vendor of that app. diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index ba02501c81..37b4dfa002 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -16,7 +16,7 @@ manager: dansimp You might encounter an **RPC server unavailable** error when connecting to Windows Management Instrumentation (WMI), SQL Server, during a remote connection, or for some Microsoft Management Console (MMC) snap-ins. The following image is an example of an RPC error. -![The following error has occurred: the RPC server is unavailable.](images/rpc-error.png) +![The following error has occurred: the RPC server is unavailable](images/rpc-error.png) This is a commonly encountered error message in the networking world and one can lose hope very fast without trying to understand much, as to what is happening ‘under the hood’. @@ -37,7 +37,7 @@ Before getting in to troubleshooting the *RPC server unavailable- error Client A wants to execute some functions or wants to make use of a service running on the remote server, will first establish the connection with the Remote Server by doing a three-way handshake. -![Diagram illustrating connection to remote server.](images/rpc-flow.png) +![Diagram illustrating connection to remote server](images/rpc-flow.png) RPC ports can be given from a specific range as well. ### Configure RPC dynamic port allocation @@ -162,13 +162,13 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) - Now check if you are getting a response from the server. If you get a response, note the dynamic port number that you have been allocated to use. - ![Screenshot of Network Monitor with dynamic port highlighted.](images/tcp-ts-23.png) + ![Screenshot of Network Monitor with dynamic port highlighted](images/tcp-ts-23.png) - Check if we are connecting successfully to this Dynamic port successfully. - The filter should be something like this: `tcp.port==` and `ipv4.address==` - ![Screenshot of Network Monitor with filter applied.](images/tcp-ts-24.png) + ![Screenshot of Network Monitor with filter applied](images/tcp-ts-24.png) This should help you verify the connectivity and isolate if any network issues are seen. @@ -177,7 +177,7 @@ This should help you verify the connectivity and isolate if any network issues a The most common reason why we would see the RPC server unavailable is when the dynamic port that the client tries to connect is not reachable. The client side trace would then show TCP SYN retransmits for the dynamic port. -![Screenshot of Network Monitor with TCP SYN retransmits.](images/tcp-ts-25.png) +![Screenshot of Network Monitor with TCP SYN retransmits](images/tcp-ts-25.png) The port cannot be reachable due to one of the following reasons: diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/windows-version-search.md index 16c416a9cd..29a781be98 100644 --- a/windows/client-management/windows-version-search.md +++ b/windows/client-management/windows-version-search.md @@ -22,27 +22,27 @@ Click **Start** > **Settings** > **System** > click **About** from the bottom of You'll now see **Edition**, **Version**, and **OS Build** information. Something like this: -![screenshot of the system properties window for a device running Windows 10.](images/systemcollage.png) +![screenshot of the system properties window for a device running Windows 10](images/systemcollage.png) ## Using Keyword Search You can simply type the following in the search bar and press **ENTER** to see version details for your device. **“winver”** -![screenshot of the About Windows display text.](images/winver.png) +![screenshot of the About Windows display text](images/winver.png) **“msinfo”** or **"msinfo32"** to open **System Information**: -![screenshot of the System Information display text.](images/msinfo32.png) +![screenshot of the System Information display text](images/msinfo32.png) ## Using Command Prompt or PowerShell At the Command Prompt or PowerShell interface, type **"systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"** and then press **ENTER** -![screenshot of system information display text.](images/refcmd.png) +![screenshot of system information display text](images/refcmd.png) At the Command Prompt or PowerShell, type **"slmgr /dlv"**, and then press ENTER. The /dlv command displays the detailed licensing information. Notice the output displays "EnterpriseS" as seen in the image below: -![screenshot of software licensing manager.](images/slmgr_dlv.png) +![screenshot of software licensing manager](images/slmgr_dlv.png) ## What does it all mean? diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 5f433844ac..15407ebc50 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -31,7 +31,7 @@ The order of apps in the XML file dictates the order of pinned apps on the taskb The following example shows how apps will be pinned: Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using the XML file to the right (green square). -![Windows left, user center, enterprise to the right.](images/taskbar-generic.png) +![Windows left, user center, enterprise to the right](images/taskbar-generic.png) ## Configure taskbar (general) @@ -142,11 +142,11 @@ The `` section will append listed apps to the tas ``` **Before:** -![default apps pinned to taskbar.](images/taskbar-default.png) +![default apps pinned to taskbar](images/taskbar-default.png) **After:** - ![additional apps pinned to taskbar.](images/taskbar-default-plus.png) + ![additional apps pinned to taskbar](images/taskbar-default-plus.png) ## Remove default apps and add your own @@ -175,11 +175,11 @@ If you only want to remove some of the default pinned apps, you would use this m ``` **Before:** -![Taskbar with default apps.](images/taskbar-default.png) +![Taskbar with default apps](images/taskbar-default.png) **After:** -![Taskbar with default apps removed.](images/taskbar-default-removed.png) +![Taskbar with default apps removed](images/taskbar-default-removed.png) ## Remove default apps @@ -250,15 +250,15 @@ The following example shows you how to configure taskbars by country or region. When the preceding example XML file is applied, the resulting taskbar for computers in the US or UK: -![taskbar for US and UK locale.](images/taskbar-region-usuk.png) +![taskbar for US and UK locale](images/taskbar-region-usuk.png) The resulting taskbar for computers in Germany or France: -![taskbar for DE and FR locale.](images/taskbar-region-defr.png) +![taskbar for DE and FR locale](images/taskbar-region-defr.png) The resulting taskbar for computers in any other country region: -![taskbar for all other regions.](images/taskbar-region-other.png) +![taskbar for all other regions](images/taskbar-region-other.png) > [!NOTE] diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 1190119050..e8a0cdee55 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -19,7 +19,7 @@ Cortana integration is a Preview feature that's available for your test or dev e >[!NOTE] >For more info about Dynamics CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](https://go.microsoft.com/fwlink/p/?LinkId=746819). -![Cortana at work, showing the sales data pulled from Dynamics CRM.](../images/cortana-crm-screen.png) +![Cortana at work, showing the sales data pulled from Dynamics CRM](../images/cortana-crm-screen.png) ## Turn on Cortana with Dynamics CRM in your organization You must be a CRM administrator to turn on and use Preview features. For more info about what Preview features are and how to use them, see [What are Preview features and how do I enable them](https://go.microsoft.com/fwlink/p/?LinkId=746817)? @@ -43,7 +43,7 @@ You must tell your employees to turn on Cortana, before they’ll be able to use 2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. - ![Cotana at work, showing how to turn on the connected services for Dynamics CRM.](../images/cortana-connect-crm.png) + ![Cotana at work, showing how to turn on the connected services for Dynamics CRM](../images/cortana-connect-crm.png) The employee can also disconnect by clicking **Disconnect** from the **Dynamics CRM** screen. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 481cb27659..65919eb8e8 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -48,35 +48,35 @@ Before you can start this testing scenario, you must first set up your test envi 2. Expand the left rail by clicking the **Show the navigation pane** icon. - ![Cortana at work, showing the navigation expand icon in Power BI.](../images/cortana-powerbi-expand-nav.png) + ![Cortana at work, showing the navigation expand icon in Power BI](../images/cortana-powerbi-expand-nav.png) 3. Click **Get Data** from the left-hand navigation in Power BI. - ![Cortana at work, showing the Get Data link.](../images/cortana-powerbi-getdata.png) + ![Cortana at work, showing the Get Data link](../images/cortana-powerbi-getdata.png) 4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. - ![Cortana at work, showing the Samples link.](../images/cortana-powerbi-getdata-samples.png) + ![Cortana at work, showing the Samples link](../images/cortana-powerbi-getdata-samples.png) 5. Click **Retail Analysis Sample**, and then click **Connect**. - ![Cortana at work, showing the Samples link.](../images/cortana-powerbi-retail-analysis-sample.png) + ![Cortana at work, showing the Samples link](../images/cortana-powerbi-retail-analysis-sample.png) The sample data is imported and you’re returned to the **Power BI** screen. 6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. - ![Cortana at work, showing a dashboard view of the sample data.](../images/cortana-powerbi-retail-analysis-dashboard.png) + ![Cortana at work, showing a dashboard view of the sample data](../images/cortana-powerbi-retail-analysis-dashboard.png) 7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. - ![Cortana at work, showing where to find the Settings option.](../images/cortana-powerbi-settings.png) + ![Cortana at work, showing where to find the Settings option](../images/cortana-powerbi-settings.png) 8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. 9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. - ![Cortana at work, showing where to find the dataset options.](../images/cortana-powerbi-retail-analysis-dataset.png) + ![Cortana at work, showing where to find the dataset options](../images/cortana-powerbi-retail-analysis-dataset.png) >[!NOTE] >It can take up to 30 minutes for a new dataset to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately.

If you enable a dataset for Cortana, and that dataset is part of a content pack you own, you’ll need to re-publish for your colleagues to also use it with Cortana. @@ -92,7 +92,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu **To create a custom sales data Answer Page for Cortana** 1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. - ![Cortana at work, showing where to create the new report.](../images/cortana-powerbi-create-report.png) + ![Cortana at work, showing where to create the new report](../images/cortana-powerbi-create-report.png) 2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. @@ -100,11 +100,11 @@ After you’ve finished creating your Answer Page, you can continue to the inclu 3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. - ![Cortana at work, showing the Visualizations options.](../images/cortana-powerbi-pagesize.png) + ![Cortana at work, showing the Visualizations options](../images/cortana-powerbi-pagesize.png) 4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. - ![Cortana at work, showing the Field options.](../images/cortana-powerbi-field-selection.png) + ![Cortana at work, showing the Field options](../images/cortana-powerbi-field-selection.png) The automatically generated graph is added to your blank report. You have the option to change colors, add borders, add additional visualizations, and modify this page so that it answers the question about sales data as precisely, and in as custom a way, as you want. You just need to make sure that it all stays within the page borders. @@ -112,7 +112,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu The alternate names help Cortana to know what questions to look for and when to show this report. To also improve your results, you should avoid using the names of your report columns. - ![Cortana at work, showing the page info for your specific report.](../images/cortana-powerbi-report-qna.png) + ![Cortana at work, showing the page info for your specific report](../images/cortana-powerbi-report-qna.png) 6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. @@ -128,13 +128,13 @@ Now that you’ve set up your device, you can use Cortana to show your info from Cortana shows you the available results. - ![Cortana at work, showing the best matches based on the Power BI data.](../images/cortana-powerbi-search.png) + ![Cortana at work, showing the best matches based on the Power BI data](../images/cortana-powerbi-search.png) 3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. Cortana returns your custom report. - ![Cortana at work, showing your custom report from Power BI.](../images/cortana-powerbi-myreport.png) + ![Cortana at work, showing your custom report from Power BI](../images/cortana-powerbi-myreport.png) >[!NOTE] >For more info about how to connect your own data, build your own custom Power BI cards and Answer Pages for Cortana, and how to share the cards with everyone in your organization, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/documentation/powerbi-service-cortana-desktop-entity-cards/). diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index c701623a88..478aeb7938 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -49,7 +49,7 @@ While these aren't line-of-business apps, we've worked to make sure to implement 2. Click on **Connected Services**, click **Uber**, and then click **Connect**. - ![Cortana at work, showing where to connect the Uber service to Cortana.](../images/cortana-connect-uber.png) + ![Cortana at work, showing where to connect the Uber service to Cortana](../images/cortana-connect-uber.png) **To use the voice-enabled commands with Cortana** 1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index f50e213ce8..601ad70810 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -161,7 +161,7 @@ When you have the Start layout that you want your users to see, use the [Export- A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users cannot change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. -![locked tile group.](images/start-pinned-app.png) +![locked tile group](images/start-pinned-app.png) When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 7b7dcaed64..12f62c8444 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -92,13 +92,13 @@ This procedure adds the customized Start and taskbar layout to the user configur 2. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. - ![start screen layout policy settings.](images/starttemplate.jpg) + ![start screen layout policy settings](images/starttemplate.jpg) 3. Right-click **Start Layout** in the right pane, and click **Edit**. This opens the **Start Layout** policy settings. - ![policy settings for start screen layout.](images/startlayoutpolicy.jpg) + ![policy settings for start screen layout](images/startlayoutpolicy.jpg) 4. Enter the following settings, and then click **OK**: diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index 42b70e6248..ea856b24cd 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -87,7 +87,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted.](images/customization-start.png) + ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) 7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md index f5540c6ddd..aa195fb89f 100644 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md @@ -50,7 +50,7 @@ To get the names and AUMIDs for all apps installed for the current user, perform 3. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to change the **View** setting from **Tiles** to **Details**.) -![Image of the Choose Details options.](images/aumid-file-explorer.png) +![Image of the Choose Details options](images/aumid-file-explorer.png) ## To find the AUMID of an installed app for the current user by using the registry diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md index 9efa2b652d..bd502511d7 100644 --- a/windows/configuration/kiosk-methods.md +++ b/windows/configuration/kiosk-methods.md @@ -24,13 +24,13 @@ Some desktop devices in an enterprise serve a special purpose, such as a PC in t A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk does not run above the lockscreen. - ![Illustration of a full-screen kiosk experience.](images/kiosk-fullscreen.png) + ![Illustration of a full-screen kiosk experience](images/kiosk-fullscreen.png) - **A multi-app kiosk**, which runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device. - ![Illustration of a kiosk Start screen.](images/kiosk-desktop.png) + ![Illustration of a kiosk Start screen](images/kiosk-desktop.png) Kiosk configurations are based on **Assigned Access**, a feature in Windows 10 that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. @@ -38,25 +38,25 @@ There are several kiosk configuration methods that you can choose from, dependin - **Which type of app will your kiosk run?** - ![icon that represents apps.](images/office-logo.png) + ![icon that represents apps](images/office-logo.png) Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](setup-digital-signage.md), simply select a digital sign player as your kiosk app. [Check out the guidelines for kiosk apps.](guidelines-for-assigned-access-app.md) - **Which type of kiosk do you need?** - ![icon that represents a kiosk.](images/kiosk.png) + ![icon that represents a kiosk](images/kiosk.png) If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a [Universal Windows Platform (UWP) app](#uwp) or a [Windows desktop application](#classic). For a kiosk that people can sign in to with their accounts or that runs more than one app, choose [a multi-app kiosk](#desktop). - **Which edition of Windows 10 will the kiosk run?** - ![icon that represents Windows.](images/windows.png) + ![icon that represents Windows](images/windows.png) All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home. - **Which type of user account will be the kiosk account?** - ![icon that represents a user account.](images/user.png) + ![icon that represents a user account](images/user.png) The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index ba1aaa2b58..154b35c3d0 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -54,7 +54,7 @@ Disable removable media. | Go to **Group Policy Editor** > **Computer Con Logs can help you [troubleshoot issues](./kiosk-troubleshoot.md) kiosk issues. Logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. -![Event Viewer, right-click Operational, select enable log.](images/enable-assigned-access-log.png) +![Event Viewer, right-click Operational, select enable log](images/enable-assigned-access-log.png) ## Automatic logon @@ -257,7 +257,7 @@ A single-app kiosk configuration runs an app above the lock screen. It doesn't w When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** is not selected in the **View** menu; that means it's a basic session. -![VM windows, View menu, Extended session is not selected.](images/vm-kiosk.png) +![VM windows, View menu, Extended session is not selected](images/vm-kiosk.png) To connect to a VM in a basic session, do not select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog. diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index 73e724bd75..f510b637bd 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -137,7 +137,7 @@ The OMA-URI path is `./Device/Vendor/MSFT/AssignedAccess/ShellLauncher`. For the value, you can select data type `String` and paste the desired configuration file content into the value box. If you wish to upload the xml instead of pasting the content, choose data type `String (XML file)`. -![Screenshot of custom OMA-URI settings.](images/slv2-oma-uri.png) +![Screenshot of custom OMA-URI settings](images/slv2-oma-uri.png) After you configure the profile containing the custom Shell Launcher setting, select **All Devices** or selected groups of devices to apply the profile to. Don't assign the profile to users or user groups. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index eac49be093..8baee6a466 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -24,7 +24,7 @@ ms.topic: article A single-app kiosk uses the Assigned Access feature to run a single app above the lockscreen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. -![Illustration of a single-app kiosk experience.](images/kiosk-fullscreen-sm.png) +![Illustration of a single-app kiosk experience](images/kiosk-fullscreen-sm.png) >[!IMPORTANT] >[User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. @@ -66,7 +66,7 @@ When your kiosk is a local device that is not managed by Active Directory or Azu - If you do not want the kiosk account signed in automatically when the device restarts, you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account, go to **Settings** > **Accounts** > **Sign-in options**, and toggle the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device. -![Screenshot of automatic sign-in setting.](images/auto-signin.png) +![Screenshot of automatic sign-in setting](images/auto-signin.png) ### Instructions for Windows 10, version 1809 @@ -98,7 +98,7 @@ To remove assigned access, select the account tile on the **Set up a kiosk** pag When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows 10, version 1803 and earlier, you must select an existing local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) -![The Set up assigned access page in Settings.](images/kiosk-settings.png) +![The Set up assigned access page in Settings](images/kiosk-settings.png) **To set up assigned access in PC settings** @@ -131,7 +131,7 @@ To remove assigned access, choose **Turn off assigned access and sign out of the > >Account type: Local standard user -![PowerShell windows displaying Set-AssignedAccess cmdlet.](images/set-assignedaccess.png) +![PowerShell windows displaying Set-AssignedAccess cmdlet](images/set-assignedaccess.png) You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. @@ -191,7 +191,7 @@ Clear-AssignedAccess > >Account type: Local standard user, Active Directory -![Kiosk wizard option in Windows Configuration Designer.](images/kiosk-wizard.png) +![Kiosk wizard option in Windows Configuration Designer](images/kiosk-wizard.png) >[!IMPORTANT] diff --git a/windows/configuration/kiosk-troubleshoot.md b/windows/configuration/kiosk-troubleshoot.md index e34bee8204..75781737fb 100644 --- a/windows/configuration/kiosk-troubleshoot.md +++ b/windows/configuration/kiosk-troubleshoot.md @@ -53,7 +53,7 @@ For example: 3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. 4. Additional logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. -![Event Viewer, right-click Operational, select enable log.](images/enable-assigned-access-log.png) +![Event Viewer, right-click Operational, select enable log](images/enable-assigned-access-log.png) ### Automatic logon issues diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index 5c2cfa795b..c2221b549a 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -34,7 +34,7 @@ AppLocker rules are organized into collections based on file format. If no AppLo This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. -![install create lockdown customize.](images/lockdownapps.png) +![install create lockdown customize](images/lockdownapps.png) ## Install apps @@ -50,13 +50,13 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - ![configure rule enforcement.](images/apprule.png) + ![configure rule enforcement](images/apprule.png) 3. Check **Configured** under **Executable rules**, and then click **OK**. 4. Right-click **Executable Rules** and then click **Automatically generate rules**. - ![automatically generate rules.](images/genrule.png) + ![automatically generate rules](images/genrule.png) 5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. @@ -68,7 +68,7 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 9. Read the message and click **Yes**. - ![default rules warning.](images/appwarning.png) + ![default rules warning](images/appwarning.png) 10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 2bbcd7f1a3..702221c085 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -81,7 +81,7 @@ Let's start by looking at the basic structure of the XML file. - A profile has no effect if it’s not associated to a config section. - ![profile = app and config = account.](images/profile-config.png) + ![profile = app and config = account](images/profile-config.png) You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md) @@ -271,7 +271,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, >[!NOTE] >If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. -![What the Start screen looks like when the XML sample is applied.](images/sample-start.png) +![What the Start screen looks like when the XML sample is applied](images/sample-start.png) ##### Taskbar @@ -494,7 +494,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. In the center pane, click **Browse** to locate and select the assigned access configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer.](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) 8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. @@ -544,7 +544,7 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC.](images/oobe.jpg) + ![The first screen to set up a new PC](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -552,11 +552,11 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device.](images/prov.jpg) + ![Provision this device](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package.](images/choose-package.png) + ![Choose a package](images/choose-package.png) 5. Select **Yes, add it**. @@ -570,7 +570,7 @@ Provisioning packages can be applied to a device during the first-run experience >[!NOTE] >if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. -![add a package option.](images/package.png) +![add a package option](images/package.png) ### Use MDM to deploy the multi-app configuration diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md index 6dc4c73ddb..d577b69cff 100644 --- a/windows/configuration/manage-wifi-sense-in-enterprise.md +++ b/windows/configuration/manage-wifi-sense-in-enterprise.md @@ -46,7 +46,7 @@ You can manage your Wi-Fi Sense settings by using Group Policy and your Group Po 1. Open your Group Policy editor and go to the `Computer Configuration\Administrative Templates\Network\WLAN Service\WLAN Settings\Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services` setting. - ![Group Policy Editor, showing the Wi-Fi Sense setting.](images/wifisense-grouppolicy.png) + ![Group Policy Editor, showing the Wi-Fi Sense setting](images/wifisense-grouppolicy.png) 2. Turn Wi-Fi Sense on (enabled) or off (disabled), based on your company's environment. @@ -60,7 +60,7 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry 2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**.

Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see How to configure Wi-Fi Sense on Windows 10 in an enterprise. - ![Registry Editor, showing the creation of a new DWORD value.](images/wifisense-registry.png) + ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) ### Using the Windows Provisioning settings You can manage your Wi-Fi Sense settings by changing the Windows provisioning setting, **WiFISenseAllowed**. @@ -81,7 +81,7 @@ If your company still uses Unattend, you can manage your Wi-Fi Sense settings by ### How employees can change their own Wi-Fi Sense settings If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. -![Wi-Fi Sense options shown to employees if it's not turned off.](images/wifisense-settingscreens.png) +![Wi-Fi Sense options shown to employees if it's not turned off](images/wifisense-settingscreens.png) **Important**
The service that was used to share networks with Facebook friends, Outlook.com contacts, or Skype contacts is no longer available. This means: diff --git a/windows/configuration/mobile-devices/lockdown-xml.md b/windows/configuration/mobile-devices/lockdown-xml.md index 87f2b7b7cf..ecf485cb1d 100644 --- a/windows/configuration/mobile-devices/lockdown-xml.md +++ b/windows/configuration/mobile-devices/lockdown-xml.md @@ -62,7 +62,7 @@ The settings for the Default role and other roles must be listed in your XML fil ## Action Center -![XML for Action Center.](../images/ActionCenterXML.jpg) +![XML for Action Center](../images/ActionCenterXML.jpg) The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. @@ -92,7 +92,7 @@ The following example is a complete lockdown XML file that disables Action Cente ## Apps -![XML for Apps.](../images/AppsXML.png) +![XML for Apps](../images/AppsXML.png) The Apps setting serves as an allow list and specifies the applications that will be available in the All apps list. Apps that are not included in this setting are hidden from the user and blocked from running. @@ -110,7 +110,7 @@ The following example makes Outlook Calendar available on the device. When you list an app, you can also set the app to be pinned to the Start screen by specifying the tile size and location. Tip: draw a grid and mark your app tiles on it to make sure you get the result you want. The width (X axis) in the following example is the limit for Windows 10 Mobile, but the length (Y axis) is unlimited. The number of columns available to you depends on the value for [StartScreenSize](#start-screen-size). -![Grid to lay out tiles for Start.](../images/StartGrid.jpg) +![Grid to lay out tiles for Start](../images/StartGrid.jpg) Tile sizes are: * Small: 1x1 @@ -152,7 +152,7 @@ In the following example, Outlook Calendar and Outlook Mail are pinned to the St That layout would appear on a device like this: -![Example of the layout on a Start screen.](../images/StartGridPinnedApps.jpg) +![Example of the layout on a Start screen](../images/StartGridPinnedApps.jpg) You can create and pin folders to Start by using the Apps setting. Each folder requires a **folderId**, which must be a consecutive positive integer starting with `1`. You can also specify a **folderName** (optional) which will be displayed on Start. @@ -203,7 +203,7 @@ When an app is contained in a folder, its **PinToStart** configuration (tile siz ## Buttons -![XML for buttons.](../images/ButtonsXML.jpg) +![XML for buttons](../images/ButtonsXML.jpg) In the Buttons setting, you use ButtonLockdownList to disable hardware buttons and ButtonRemapList to change button events to open an app that you specify. @@ -213,11 +213,11 @@ When a user taps a button that is in the lockdown list, nothing will happen. The Button | Press | PressAndHold | All ---|:---:|:---:|:--:|- -Start | ![no.](../images/crossmark.png) | ![yes](../images/checkmark.png) | ![no](../images/crossmark.png) -Back | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Search | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Camera | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Custom 1, 2, and 3 | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Start | ![no](../images/crossmark.png) | ![yes](../images/checkmark.png) | ![no](../images/crossmark.png) +Back | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Search | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Camera | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Custom 1, 2, and 3 | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) > [!NOTE] > Custom buttons are hardware buttons that can be added to devices by OEMs. @@ -270,7 +270,7 @@ In the following example, when a user presses the Search button, the phone diale ## CSPRunner -![XML for CSP Runner.](../images/CSPRunnerXML.jpg) +![XML for CSP Runner](../images/CSPRunnerXML.jpg) You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) or [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). @@ -317,7 +317,7 @@ SyncML entry | Description ## Menu items -![XML for menu items.](../images/MenuItemsXML.png) +![XML for menu items](../images/MenuItemsXML.png) Use DisableMenuItems to prevent use of the context menu, which is displayed when a user presses and holds an application in the All Apps list. You can include this entry in the default profile and in any additional user role profiles that you create. @@ -329,7 +329,7 @@ Use DisableMenuItems to prevent use of the context menu, which is displayed when ## Settings -![XML for settings.](../images/SettingsXML.png) +![XML for settings](../images/SettingsXML.png) The **Settings** section contains an `allow` list of pages in the Settings app and quick actions. The following example allows all settings. @@ -363,7 +363,7 @@ For a list of the settings and quick actions that you can allow or block, see [S ## Tiles - ![XML for tiles.](../images/TilesXML.png) + ![XML for tiles](../images/TilesXML.png) By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile. @@ -446,7 +446,7 @@ Use the Windows ICD tool included in the Windows Assessment and Deployment Kit ( 3. In the center pane, click **Browse** to locate and select the lockdown XML file that you created. - ![browse button.](../images/icdbrowse.png) + ![browse button](../images/icdbrowse.png) 4. On the **File** menu, select **Save.** diff --git a/windows/configuration/mobile-devices/mobile-lockdown-designer.md b/windows/configuration/mobile-devices/mobile-lockdown-designer.md index a7d82f6088..68774e0da5 100644 --- a/windows/configuration/mobile-devices/mobile-lockdown-designer.md +++ b/windows/configuration/mobile-devices/mobile-lockdown-designer.md @@ -16,7 +16,7 @@ manager: dansimp # Use the Lockdown Designer app to create a Lockdown XML file -![Lockdown Designer in the Store.](../images/ldstore.png) +![Lockdown Designer in the Store](../images/ldstore.png) Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. For example, the enterprise can lock down a device so that only applications and settings in an allow list are available. This is accomplished using Lockdown XML, an XML file that contains settings for Windows 10 Mobile. @@ -55,7 +55,7 @@ Perform these steps on the device running Windows 10 Mobile that you will use to >[!IMPORTANT] >Check **Settings > Personalization > Start > Show more tiles** on the test mobile device. If **Show more tiles** is **On**, you must select **Large** on the [**Start screen** page](#start) in Lockdown Designer. If you want to apply a **Small** layout, set **Show more tiles** on the test mobile device to **Off**. > ->![turn off show more tiles for small start screen size.](../images/show-more-tiles.png) +>![turn off show more tiles for small start screen size](../images/show-more-tiles.png) ## Prepare the PC @@ -89,7 +89,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 3. Click **Pair**. - ![Pair.](../images/ld-pair.png) + ![Pair](../images/ld-pair.png) **Connect to remote device** appears. @@ -99,7 +99,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 6. Next, click **Sync** to pull information from the device in to Lockdown Designer. - ![Sync.](../images/ld-sync.png) + ![Sync](../images/ld-sync.png) 7. Click the **Save** icon and enter a name for your project. @@ -113,7 +113,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 3. On the **Project setting** > **General settings** page, click **Pair**. - ![Pair.](../images/ld-pair.png) + ![Pair](../images/ld-pair.png) **Connect to remote device** appears. @@ -123,7 +123,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 6. Next, click **Sync** to pull information from the device in to Lockdown Designer. - ![Sync.](../images/ld-sync.png) + ![Sync](../images/ld-sync.png) 7. Click the **Save** icon and enter a name for your project. @@ -134,13 +134,13 @@ The apps and settings available in the pages of Lockdown Designer should now be | Page | Description | | --- | --- | -| ![Applications.](../images/ld-apps.png) | Each app from the test mobile device is listed. Select the apps that you want visible to users.

You can select an app to run automatically when a user signs in to the device. The **Select Auto-Run** menu is populated by the apps that you select to allow on the device. | -| ![CSP Runner.](../images/ld-csp.png) | CSPRunner enables you to include settings and policies that are not defined in other sections of the app. To make use of CSPRunner, you must create the SyncML block that contains the settings, and then import the SyncML in Lockdown Designer. [Learn how to use CSPRunner and author SyncML.](lockdown-xml.md#csprunner) | -| ![Settings.](../images/ld-settings.png) | On this page, you select the settings that you want visible to users. See the [ms settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to see which Settings page maps to a URI. | -| ![Quick actions.](../images/ld-quick.png) | On this page, you select the settings that you want visible to users. | -| ![Buttons.](../images/ld-buttons.png) | Each hardware button on a mobile device has different actions that can be disabled. In addition, the behavior for **Search** button can be changed to open an app other than **Search**.

Some devices may have additional hardware buttons provided by the OEM. These are listed as Custom1, Custom2, and Custom3. If your device has custom hardware buttons, contact your equipment provider to identify how their custom buttons are defined. | -| ![Other settings.](../images/ld-other.png) | This page contains several settings that you can configure:

- The context menu is displayed when a user presses and holds an application in the All Apps list. You can enable or disable the context menu.

- Tile manipulation allows users to pin, unpin, move, and resize tiles on the Start screen. You can enable or disable tile manipulation.

- The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. | -| ![Start screen.](../images/ld-start.png) | On this page, you can start a remote simulation session with the test mobile device. Click **Start remote simulation**. You will see a **Start screen remote simulation in progress** message on the PC. (If the **Start remote simulation** button is not active, [pair the mobile device with the PC again](#pair).)

On the test mobile device, tiles for the apps that you allowed on the **Applications** page are displayed on the screen. You can move, resize, or unpin these tiles to achieve the desired layout.

When you are done changing the layout on the test mobile device, click **Accept** on the PC. | +| ![Applications](../images/ld-apps.png) | Each app from the test mobile device is listed. Select the apps that you want visible to users.

You can select an app to run automatically when a user signs in to the device. The **Select Auto-Run** menu is populated by the apps that you select to allow on the device. | +| ![CSP Runner](../images/ld-csp.png) | CSPRunner enables you to include settings and policies that are not defined in other sections of the app. To make use of CSPRunner, you must create the SyncML block that contains the settings, and then import the SyncML in Lockdown Designer. [Learn how to use CSPRunner and author SyncML.](lockdown-xml.md#csprunner) | +| ![Settings](../images/ld-settings.png) | On this page, you select the settings that you want visible to users. See the [ms settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to see which Settings page maps to a URI. | +| ![Quick actions](../images/ld-quick.png) | On this page, you select the settings that you want visible to users. | +| ![Buttons](../images/ld-buttons.png) | Each hardware button on a mobile device has different actions that can be disabled. In addition, the behavior for **Search** button can be changed to open an app other than **Search**.

Some devices may have additional hardware buttons provided by the OEM. These are listed as Custom1, Custom2, and Custom3. If your device has custom hardware buttons, contact your equipment provider to identify how their custom buttons are defined. | +| ![Other settings](../images/ld-other.png) | This page contains several settings that you can configure:

- The context menu is displayed when a user presses and holds an application in the All Apps list. You can enable or disable the context menu.

- Tile manipulation allows users to pin, unpin, move, and resize tiles on the Start screen. You can enable or disable tile manipulation.

- The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. | +| ![Start screen](../images/ld-start.png) | On this page, you can start a remote simulation session with the test mobile device. Click **Start remote simulation**. You will see a **Start screen remote simulation in progress** message on the PC. (If the **Start remote simulation** button is not active, [pair the mobile device with the PC again](#pair).)

On the test mobile device, tiles for the apps that you allowed on the **Applications** page are displayed on the screen. You can move, resize, or unpin these tiles to achieve the desired layout.

When you are done changing the layout on the test mobile device, click **Accept** on the PC. | ## Validate and export @@ -169,4 +169,4 @@ You can create additional roles for the device and have unique configurations fo 4. Configure the settings for the role as above, but make sure on each page that you select the correct role. - ![Current role selection box.](../images/ld-role.png) \ No newline at end of file + ![Current role selection box](../images/ld-role.png) \ No newline at end of file diff --git a/windows/configuration/mobile-devices/provisioning-configure-mobile.md b/windows/configuration/mobile-devices/provisioning-configure-mobile.md index ebd4218503..1d321fd9cb 100644 --- a/windows/configuration/mobile-devices/provisioning-configure-mobile.md +++ b/windows/configuration/mobile-devices/provisioning-configure-mobile.md @@ -66,13 +66,13 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us 1. Insert an SD card containing the provisioning package into the device. 2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. - ![add a package option.](../images/packages-mobile.png) + ![add a package option](../images/packages-mobile.png) 3. Click **Add**. 4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust.](../images/package-trust.png) + ![Is this package from a source you trust](../images/package-trust.png) ### Copying the provisioning package to the device @@ -82,7 +82,7 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us 3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust.](../images/package-trust.png) + ![Is this package from a source you trust](../images/package-trust.png) ## Related topics diff --git a/windows/configuration/mobile-devices/provisioning-nfc.md b/windows/configuration/mobile-devices/provisioning-nfc.md index 42ff3ff229..571a1488af 100644 --- a/windows/configuration/mobile-devices/provisioning-nfc.md +++ b/windows/configuration/mobile-devices/provisioning-nfc.md @@ -31,7 +31,7 @@ All Windows 10 Mobile Enterprise and Windows 10 Mobile images have the NFC provi On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key, which shows the **Provision this device** screen. In the **Provision this device** screen, select **NFC** for NFC-based provisioning. -![Example of Provision this device screen.](../images/nfc.png) +![Example of Provision this device screen](../images/nfc.png) If there is an error during NFC provisioning, the device will show a message if any of the following errors occur: diff --git a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index a265a544e3..711f3cfc4e 100644 --- a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -168,28 +168,28 @@ Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or **To set up Apps Corner** -1. On Start ![start.](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner**. +1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner**. -2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon.](images/doneicon.png). +2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon](images/doneicon.png). -3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back.](../images/backicon.png) to the Apps Corner settings. +3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back](../images/backicon.png) to the Apps Corner settings. 4. Turn **Action center** on or off, depending on whether you want people to be able to use these features when using the device in kiosk mode. 5. Tap **advanced**, and then turn features on or off, depending on whether you want people to be able to use them. -6. Press **Back** ![back.](../images/backicon.png) when you're done. +6. Press **Back** ![back](../images/backicon.png) when you're done. **To use Apps Corner** -1. On Start ![start.](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). +1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). >[!TIP] >Want to get to Apps Corner with one tap? In **Settings**, tap **Apps Corner** > **pin** to pin the Apps Corner tile to your Start screen. 2. Give the device to someone else, so they can use the device and only the one app you chose. -3. When they're done and you get the device back, press and hold Power ![power.](../images/powericon.png), and then swipe right to exit Apps Corner. +3. When they're done and you get the device back, press and hold Power ![power](../images/powericon.png), and then swipe right to exit Apps Corner. ## Related topics diff --git a/windows/configuration/mobile-devices/start-layout-xml-mobile.md b/windows/configuration/mobile-devices/start-layout-xml-mobile.md index 858de39174..41fc17fe04 100644 --- a/windows/configuration/mobile-devices/start-layout-xml-mobile.md +++ b/windows/configuration/mobile-devices/start-layout-xml-mobile.md @@ -36,7 +36,7 @@ On Windows 10 Mobile, the customized Start works by: The following diagrams show the default Windows 10, version 1607 Start layouts for single SIM and dual SIM devices with Cortana support, and single SIM and dual SIM devices with no Cortana support. -![Start layout for Windows 10 Mobile.](../images/mobile-start-layout.png) +![Start layout for Windows 10 Mobile](../images/mobile-start-layout.png) The diagrams show: diff --git a/windows/configuration/provisioning-apn.md b/windows/configuration/provisioning-apn.md index a8d47b38e2..326ea5b8b8 100644 --- a/windows/configuration/provisioning-apn.md +++ b/windows/configuration/provisioning-apn.md @@ -53,11 +53,11 @@ For users who work in different locations, you can configure one APN to connect 5. Enter a name for the connection, and then click **Add**. - ![Example of APN connection name.](images/apn-add.png) + ![Example of APN connection name](images/apn-add.png) 6. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection. - ![settings for new connection.](images/apn-add-details.png) + ![settings for new connection](images/apn-add-details.png) 7. The following table describes the settings available for the connection. diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index 38d6791423..67c28a8b90 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -38,7 +38,7 @@ Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/win CSPs are behind many of the management tasks and policies for Windows 10, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). -![how intune maps to csp.](../images/policytocsp.png) +![how intune maps to csp](../images/policytocsp.png) CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. @@ -66,7 +66,7 @@ You can use Windows Configuration Designer to create [provisioning packages](./p Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. -![how help content appears in icd.](../images/cspinicd.png) +![how help content appears in icd](../images/cspinicd.png) [Provisioning packages in Windows 10](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package. @@ -86,7 +86,7 @@ All CSPs in Windows 10 are documented in the [Configuration service provider ref The [main CSP topic](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. -![csp per windows edition.](../images/csptable.png) +![csp per windows edition](../images/csptable.png) The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format. @@ -94,7 +94,7 @@ The full path to a specific configuration setting is represented by its Open Mob The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. -![assigned access csp tree.](../images/provisioning-csp-assignedaccess.png) +![assigned access csp tree](../images/provisioning-csp-assignedaccess.png) The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). @@ -104,7 +104,7 @@ The element in the tree diagram after the root node tells you the name of the CS When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. -![placeholder in csp tree.](../images/csp-placeholder.png) +![placeholder in csp tree](../images/csp-placeholder.png) After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 818a935488..38b7e01c09 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -58,7 +58,7 @@ Provisioning packages can include management instructions and policies, installa > [!TIP] > Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. > ->![open advanced editor.](../images/icd-simple-edit.png) +>![open advanced editor](../images/icd-simple-edit.png) ## Create the provisioning package @@ -68,11 +68,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 2. Click **Provision desktop devices**. - ![ICD start options.](../images/icd-create-options-1703.png) + ![ICD start options](../images/icd-create-options-1703.png) 3. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. - ![ICD desktop provisioning.](../images/icd-desktop-1703.png) + ![ICD desktop provisioning](../images/icd-desktop-1703.png) > [!IMPORTANT] > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md index 68cfcc37af..a71916bfab 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md @@ -46,7 +46,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options.](../images/icdstart-option.png) + ![ICD start options](../images/icdstart-option.png) 3. Name your project and click **Next**. @@ -73,19 +73,19 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package.](../images/uwp-family.png) + ![details for offline app package](../images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package.](../images/uwp-dependencies.png) + ![required frameworks for offline app package](../images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page, and change the extension of the license file from **.xml** to **.ms-windows-store-license**. - ![generate license for offline app.](../images/uwp-license.png) + ![generate license for offline app](../images/uwp-license.png) - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**. diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index f6f7f9876b..cca8b46be8 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -74,11 +74,11 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate 2. Enter a name for the first app, and then click **Add**. - ![enter name for first app.](../images/wcd-app-name.png) + ![enter name for first app](../images/wcd-app-name.png) 3. Configure the settings for the appropriate installer type. - ![enter settings for first app.](../images/wcd-app-commands.png) + ![enter settings for first app](../images/wcd-app-commands.png) ## Add a universal app to your package @@ -88,19 +88,19 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package.](../images/uwp-family.png) + ![details for offline app package](../images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package.](../images/uwp-dependencies.png) + ![required frameworks for offline app package](../images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - ![generate license for offline app.](../images/uwp-license.png) + ![generate license for offline app](../images/uwp-license.png) - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**. diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index 4a9381ab1c..4a1bb159ac 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -35,7 +35,7 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC.](../images/oobe.jpg) + ![The first screen to set up a new PC](../images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -43,11 +43,11 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device.](../images/prov.jpg) + ![Provision this device](../images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package.](../images/choose-package.png) + ![Choose a package](../images/choose-package.png) 5. Select **Yes, add it**. @@ -59,7 +59,7 @@ Provisioning packages can be applied to a device during the first-run experience Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation. -![add a package option.](../images/package.png) +![add a package option](../images/package.png) ## Mobile editions @@ -68,13 +68,13 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account 1. Insert an SD card containing the provisioning package into the device. 2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. - ![add a package option.](../images/packages-mobile.png) + ![add a package option](../images/packages-mobile.png) 3. Click **Add**. 4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust.](../images/package-trust.png) + ![Is this package from a source you trust](../images/package-trust.png) ### Copying the provisioning package to the device @@ -84,7 +84,7 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account 3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust.](../images/package-trust.png) + ![Is this package from a source you trust](../images/package-trust.png) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index 0aa10c16b5..b67e28b34d 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -39,7 +39,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: - ![Configuration Designer wizards.](../images/icd-create-options-1703.png) + ![Configuration Designer wizards](../images/icd-create-options-1703.png) - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: @@ -56,7 +56,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > - > ![Switch to advanced editor.](../images/icd-switch.png) + > ![Switch to advanced editor](../images/icd-switch.png) 3. Enter a name for your project, and then select **Next**. @@ -87,7 +87,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings. -![What the ICD interface looks like.](../images/icd-runtime.png) +![What the ICD interface looks like](../images/icd-runtime.png) The settings in Windows Configuration Designer are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md). @@ -103,14 +103,14 @@ The process for configuring settings is similar for all settings. The following For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference topic for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image. -![Windows Configuration Designer opens the reference topic when you select a setting.](../images/icd-setting-help.png) +![Windows Configuration Designer opens the reference topic when you select a setting](../images/icd-setting-help.png) ## Build package 1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. - ![Export on top bar.](../images/icd-export-menu.png) + ![Export on top bar](../images/icd-export-menu.png) 2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 1a467d4e6d..8a7b9c464d 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -66,7 +66,7 @@ On devices running Windows 10, you can install [the Windows Configuration Design 6. On the **Select the features you want to install** page, clear all selections except **Configuration Designer**, and then click **Install**. - ![Only Configuration Designer selected for installation.](../images/icd-install.png) + ![Only Configuration Designer selected for installation](../images/icd-install.png) ## Current Windows Configuration Designer limitations diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index 6e54b39009..e5d60aba7f 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -35,7 +35,7 @@ In the XML file, you provide an **Id**, or friendly name, for each **Target**. E A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**. -![Target with multiple target states and conditions.](../images/multi-target.png) +![Target with multiple target states and conditions](../images/multi-target.png) The following table describes the logic for the target definition. diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index a3b4e25f84..2313b0e929 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -124,7 +124,7 @@ For details about the settings you can customize in provisioning packages, see [ Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios. -![Configuration Designer options.](../images/icd.png) +![Configuration Designer options](../images/icd.png) Windows ICD in Windows 10, version 1607, supported the following scenarios for IT administrators: diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index 6e01640c44..a616731808 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -189,13 +189,13 @@ cmd /c InstallMyApp.bat In Windows Configuration Designer, this looks like: -![Command line in Selected customizations.](../images/icd-script1.png) +![Command line in Selected customizations](../images/icd-script1.png) You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files. In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting. -![Command files in Selected customizations.](../images/icd-script2.png) +![Command files in Selected customizations](../images/icd-script2.png) When you are done, [build the package](provisioning-create-package.md#build-package). diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index ed5c4ee3a3..e4327a7b35 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -108,13 +108,13 @@ You can configure Windows to be in shared PC mode in a couple different ways: 8. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. > [!div class="mx-imgBorder"] - > ![Shared PC mode in the Configuration settings page.](images/shared_pc_3.png) + > ![Shared PC mode in the Configuration settings page](images/shared_pc_3.png) 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. - A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. - ![Shared PC settings in ICD.](images/icd-adv-shared-pc.png) + ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) - WMI bridge: Environments that use Group Policy can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the [MDM_SharedPC class](/windows/win32/dmwmibridgeprov/mdm-sharedpc). For all device settings, the WMI Bridge client must be executed under local system user; for more information, see [Using PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). For example, open PowerShell as an administrator and enter the following: @@ -189,7 +189,7 @@ You can apply the provisioning package to a PC during initial setup or to a PC t 1. Start with a PC on the setup screen. - ![The first screen to set up a new PC.](images/oobe.jpg) + ![The first screen to set up a new PC](images/oobe.jpg) 2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. @@ -206,7 +206,7 @@ You can apply the provisioning package to a PC during initial setup or to a PC t On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and selects the package to install. -![add a package option.](images/package.png) +![add a package option](images/package.png) > [!NOTE] > If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index 5a39031455..24dbcd1b32 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -42,7 +42,7 @@ When troubleshooting basic Start issues (and for the most part, all other Window - `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost` - `get-AppXPackage -Name Microsoft.Windows.Cortana` - ![Example of output from cmdlets.](images/start-ts-1.png) + ![Example of output from cmdlets](images/start-ts-1.png) Failure messages will appear if they aren't installed @@ -188,7 +188,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded ### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted -![Screenshots that show download icons on app tiles and missing app tiles.](images/start-ts-2.png) +![Screenshots that show download icons on app tiles and missing app tiles](images/start-ts-2.png) **Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps. @@ -236,11 +236,11 @@ Specifically, behaviors include - If a new roaming user is created, the first sign-in appears normal, but on subsequent sign-ins, tiles are missing. -![Example of a working layout.](images/start-ts-3.png) +![Example of a working layout](images/start-ts-3.png) *Working layout on first sign-in of a new roaming user profile* -![Example of a failing layout.](images/start-ts-4.png) +![Example of a failing layout](images/start-ts-4.png) *Failing layout on subsequent sign-ins* @@ -256,15 +256,15 @@ Specifically, behaviors include Before the upgrade: - ![Example of Start screen with customizations applied.](images/start-ts-5.jpg) + ![Example of Start screen with customizations applied](images/start-ts-5.jpg) After the upgrade the user pinned tiles are missing: - ![Example of Start screen with previously pinned tiles missing.](images/start-ts-6.png) + ![Example of Start screen with previously pinned tiles missing](images/start-ts-6.png) Additionally, users may see blank tiles if sign-in was attempted without network connectivity. - ![Example of blank tiles.](images/start-ts-7.png) + ![Example of blank tiles](images/start-ts-7.png) **Resolution**: This issue was fixed in the [October 2017 update](https://support.microsoft.com/en-us/help/4041676). diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index 351f09ce8e..d988f11531 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -31,15 +31,15 @@ In a Start layout for Windows 10, version 1703, you can include secondary tiles Suppose that the [Start layout that you export](customize-and-export-start-layout.md) had two secondary tiles, such as in the following image: -![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) +![tile for MSN and for a SharePoint site](images/edge-with-logo.png) In prior versions of Windows 10, when you applied the Start layout to a device, the tiles would display as shown in the following image: -![tile for MSN and for a SharePoint site with no logos.](images/edge-without-logo.png) +![tile for MSN and for a SharePoint site with no logos](images/edge-without-logo.png) In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles will now display the same as they did on the device from which you exported the Start layout. -![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) +![tile for MSN and for a SharePoint site](images/edge-with-logo.png) **Example of secondary tiles in XML generated by Export-StartLayout** @@ -156,7 +156,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 12. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted.](images/customization-start-edge.png) + ![Customizations file with the placeholder text to replace highlighted](images/customization-start-edge.png) 13. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md index 75fcbcdad0..83744db2ca 100644 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md @@ -121,7 +121,7 @@ UE-V for Windows 10, version 1607 includes a new template generator. If you are --> -![Selecting UE-V features in ADK.](images/uev-adk-select-uev-feature.png) +![Selecting UE-V features in ADK](images/uev-adk-select-uev-feature.png) 3. To open the generator, select **Microsoft Application Virtualization Generator** from the **Start** menu. diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md index 0d091fe1bb..bb6d70d870 100644 --- a/windows/configuration/ue-v/uev-for-windows.md +++ b/windows/configuration/ue-v/uev-for-windows.md @@ -41,7 +41,7 @@ The diagram below illustrates how UE-V components work together to synchronize u UE-V architecture, with server share, desktop, and UE-V service | **Component** | **Function** | @@ -65,7 +65,7 @@ Use these UE-V components to create and manage custom templates for your third-p --> -![UE-V template generator process.](images/uev-generator-process.png) +![UE-V template generator process](images/uev-generator-process.png) ## Settings synchronized by default diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index 08853f5b22..bfc7cfa6f3 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -44,7 +44,7 @@ If you want to use UE-V to synchronize user-defined settings for custom applicat The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make. -![UE-V deployment preparation.](images/uev-deployment-preparation.png) +![UE-V deployment preparation](images/uev-deployment-preparation.png) Update & Security --> Windows Update**. - **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index e56e7a3b5b..f822925011 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -93,11 +93,11 @@ Once the device is in the pending restart state, it will attempt to restart the Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline.](images/wufb-quality-notification.png) +![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline.](images/wufb-feature-notification.png) +![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) ### Deadline with user engagement @@ -130,17 +130,17 @@ Before the deadline the device will be in two states: auto-restart period and en Notification users get for quality update engaged deadline: -![The notification users get for an impending engaged quality update deadline example.](images/wufb-quality-engaged-notification.png) +![The notification users get for an impending engaged quality update deadline example](images/wufb-quality-engaged-notification.png) Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline example.](images/wufb-quality-notification.png) +![The notification users get for an impending quality update deadline example](images/wufb-quality-notification.png) Notification users get for a feature update engaged deadline: -![The notification users get for an impending feature update engaged deadline example.](images/wufb-feature-update-engaged-notification.png) +![The notification users get for an impending feature update engaged deadline example](images/wufb-feature-update-engaged-notification.png) Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline example.](images/wufb-feature-update-deadline-notification.png) +![The notification users get for an impending feature update deadline example](images/wufb-feature-update-deadline-notification.png) diff --git a/windows/deployment/update/wufb-manageupdate.md b/windows/deployment/update/wufb-manageupdate.md index 8589495141..93a5ab27b7 100644 --- a/windows/deployment/update/wufb-manageupdate.md +++ b/windows/deployment/update/wufb-manageupdate.md @@ -40,7 +40,7 @@ If you don't need a wave deployment and have a small set of devices to manage, w |Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled| ## Suggested configuration for a wave deployment -![Graphic showing a deployment divided into rings for a wave deployment.](images/wufb-wave-deployment.png) +![Graphic showing a deployment divided into rings for a wave deployment](images/wufb-wave-deployment.png) ## Early validation and testing Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings). diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index 8aafc8f67d..e044463423 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -174,7 +174,7 @@ To check your system for unsigned drivers: 5. Type **sigverif** and press ENTER. 6. The File Signature Verification tool will open. Click **Start**. - ![File Signature Verification.](../images/sigverif.png) + ![File Signature Verification](../images/sigverif.png) 7. After the scanning process is complete, if you see **Your files have been scanned and verified as digitally signed** then you have no unsigned drivers. Otherwise, you will see **The following files have not been digitally signed** and a list will be provided with name, location, and version of all unsigned drivers. 8. To view and save a log file, click **Advanced**, and then click **View Log**. Save the log file if desired. @@ -268,7 +268,7 @@ To obtain the proper firmware drivers, search for the most updated driver versio When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example: -![Get important updates.](../images/update.jpg) +![Get important updates](../images/update.jpg) ### Verify disk space @@ -280,13 +280,13 @@ In File Explorer, click on **Computer** or **This PC** on the left, then look un The amount of space available on the system drive will be displayed under the drive. See the following example: -![System drive.](../images/drive.png) +![System drive](../images/drive.png) In the previous example, there is 703 GB of available free space on the system drive (C:). To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example: -![Disk cleanup.](../images/cleanup.png) +![Disk cleanup](../images/cleanup.png) For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space). diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 1e87d9bff7..9e7a29631c 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -25,14 +25,14 @@ ms.topic: article >This is a 300 level topic (moderate advanced).
>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
- [![Download SetupDiag.](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) + [![Download SetupDiag](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) ## About SetupDiag -Current downloadable version of SetupDiag: 1.6.2107.27002. -> Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. +Current downloadable version of SetupDiag: 1.6.2107.27002 +>Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. -SetupDiag is a diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. +SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. @@ -344,10 +344,6 @@ Each rule name and its associated unique rule identifier are listed with a descr ## Release notes -07/27/2021 - SetupDiag v1.6.2107.27002 is released with 61 rules, as a standalone tool available in the Download Center. -- This version contains compliance updates and minor bug fixes. -- With this release and subsequent releases, the version number of the downloadable SetupDiag tool is different from the one included with Windows Setup. - 05/06/2021 - SetupDiag v1.6.1.0 is released with 61 rules, as a standalone tool available in the Download Center. - This version of SetupDiag is included with Windows 10, version 21H1. - A new rule is added: UserProfileSuffixMismatch. @@ -567,7 +563,7 @@ Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" f ## Sample registry key -![Example of Addreg.](./../images/addreg.png) +![Example of Addreg](./../images/addreg.png) ## Related topics diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 1cde13e1eb..580a08b67c 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -61,7 +61,7 @@ Click **Submit** to send your feedback. See the following example: -![feedback example.](../images/feedback.png) +![feedback example](../images/feedback.png) After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. @@ -69,7 +69,7 @@ After you click Submit, that's all you need to do. Microsoft will receive your f After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. -![share.](../images/share.jpg) +![share link](../images/share.jpg) ## Related topics diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index bdb7e4814a..842e478dcf 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -59,31 +59,31 @@ When performing an operating system upgrade, Windows Setup uses phases described 1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. - ![downlevel phase.](../images/downlevel.png) + ![downlevel phase](../images/downlevel.png) 2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. - ![safeOS phase.](../images/safeos.png) + ![safeOS phase](../images/safeos.png) 3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. - ![first boot phase.](../images/firstboot.png) + ![first boot phase](../images/firstboot.png) 4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. - ![second boot phase.](../images/secondboot.png) + ![second boot phase](../images/secondboot.png) - ![second boot phase.](../images/secondboot2.png) + ![second boot phase](../images/secondboot2.png) - ![second boot phase.](../images/secondboot3.png) + ![second boot phase](../images/secondboot3.png) 5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. **Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): -![Upgrade process.](../images/upgrade-process.png) +![Upgrade process](../images/upgrade-process.png) DU = Driver/device updates.
OOBE = Out of box experience.
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index c8a2c54c5a..57307ee3d0 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -33,9 +33,9 @@ The following table shows the methods and paths available to change the edition > [!TIP] > Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. -![not supported.](../images/x_blk.png) (X) = not supported
-![supported, reboot required.](../images/check_grn.png) (green checkmark) = supported, reboot required
-![supported, no reboot.](../images/check_blu.png) (blue checkmark) = supported, no reboot required
+![not supported](../images/x_blk.png) (X) = not supported
+![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
+![supported, no reboot](../images/check_blu.png) (blue checkmark) = supported, no reboot required
| Edition upgrade | Using mobile device management (MDM) | Using a provisioning package | Using a command-line tool | Using Microsoft Store for Business or PC | Entering a product key manually | Purchasing a license from the Microsoft Store | |-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- | -| **Home > Pro** | ![not supported.](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro for Workstations** | ![not supported.](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Home > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Pro for Workstations** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | -| **Pro > Pro Education** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Enterprise** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Pro Education** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Enterprise** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro Education > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Enterprise > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Pro** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro for Workstations** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | +| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | > [!NOTE] > - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md) diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 50aad1782d..08c4982f9c 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -63,7 +63,7 @@ Ten parameters are listed in the event: The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. -![Windows Error Reporting.](../images/event.png) +![Windows Error Reporting](../images/event.png) ## Related topics diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index 52b489720f..84a87a0aac 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -49,7 +49,7 @@ You use a command-line option,**/hardlink** , to create a hard-link migration st The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. -![migration store comparison.](images/dep-win8-l-usmt-migrationcomparemigstores.gif) +![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) ## Local Store vs. Remote Store diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index b94bc3041b..30930ac481 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -49,7 +49,7 @@ The following diagram shows a PC-refresh migration, also known as a computer ref   -![usmt pc refresh scenario.](images/dep-win8-l-usmt-pcrefresh.jpg) +![usmt pc refresh scenario](images/dep-win8-l-usmt-pcrefresh.jpg)   @@ -100,7 +100,7 @@ The following diagram shows a PC-replacement migration. First, the administrator   -![usmt pc replace scenario.](images/dep-win8-l-usmt-pcreplace.jpg) +![usmt pc replace scenario](images/dep-win8-l-usmt-pcreplace.jpg)   diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index 10e7c2e418..f32ee0d61e 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -55,7 +55,7 @@ The process proceeds as follows: 3. Client computers are activated by receiving the activation object from a domain controller during startup. > [!div class="mx-imgBorder"] - > ![Active Directory-based activation flow.](../images/volumeactivationforwindows81-10.jpg) + > ![Active Directory-based activation flow](../images/volumeactivationforwindows81-10.jpg) **Figure 10**. The Active Directory-based activation flow @@ -80,31 +80,31 @@ When a reactivation event occurs, the client queries AD DS for the activation o 3. Add the Volume Activation Services role, as shown in Figure 11. - ![Adding the Volume Activation Services role.](../images/volumeactivationforwindows81-11.jpg) + ![Adding the Volume Activation Services role](../images/volumeactivationforwindows81-11.jpg) **Figure 11**. Adding the Volume Activation Services role 4. Click the link to launch the Volume Activation Tools (Figure 12). - ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-12.jpg) + ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-12.jpg) **Figure 12**. Launching the Volume Activation Tools 5. Select the **Active Directory-Based Activation** option (Figure 13). - ![Selecting Active Directory-Based Activation.](../images/volumeactivationforwindows81-13.jpg) + ![Selecting Active Directory-Based Activation](../images/volumeactivationforwindows81-13.jpg) **Figure 13**. Selecting Active Directory-Based Activation 6. Enter your KMS host key and (optionally) a display name (Figure 14). - ![Choosing how to activate your product.](../images/volumeactivationforwindows81-15.jpg) + ![Choosing how to activate your product](../images/volumeactivationforwindows81-15.jpg) **Figure 14**. Entering your KMS host key 7. Activate your KMS host key by phone or online (Figure 15). - ![Entering your KMS host key.](../images/volumeactivationforwindows81-14.jpg) + ![Entering your KMS host key](../images/volumeactivationforwindows81-14.jpg) **Figure 15**. Choosing how to activate your product diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index 5fa4723874..f9cfcf33ac 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -80,39 +80,39 @@ This scenario is commonly used in larger organizations that do not find the over 2. Launch Server Manager. 3. Add the Volume Activation Services role, as shown in Figure 4. - ![Adding the Volume Activation Services role in Server Manager.](../images/volumeactivationforwindows81-04.jpg) + ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) **Figure 4**. Adding the Volume Activation Services role in Server Manager 4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). - ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-05.jpg) + ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) **Figure 5**. Launching the Volume Activation Tools 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - ![Configuring the computer as a KMS host.](../images/volumeactivationforwindows81-06.jpg) + ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) **Figure 6**. Configuring the computer as a KMS host 6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). - ![Installing your KMS host key.](../images/volumeactivationforwindows81-07.jpg) + ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) **Figure 7**. Installing your KMS host key 7. If asked to confirm replacement of an existing key, click **Yes**. 8. After the product key is installed, you must activate it. Click **Next** (Figure 8). - ![Activating the software.](../images/volumeactivationforwindows81-08.jpg) + ![Activating the software](../images/volumeactivationforwindows81-08.jpg) **Figure 8**. Activating the software The KMS key can be activated online or by phone. See Figure 9. - ![Choosing to activate online.](../images/volumeactivationforwindows81-09.jpg) + ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) **Figure 9**. Choosing to activate online diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index 728b60519b..b88d65def4 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -99,12 +99,12 @@ A MAK is used for one-time activation with Microsoft’s hosted activation servi You can activate computers by using a MAK in two ways: - **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. - ![MAK independent activation.](../images/volumeactivationforwindows81-16.jpg) + ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) **Figure 16**. MAK independent activation - **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. - ![MAK proxy activation with the VAMT.](../images/volumeactivationforwindows81-17.jpg) + ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) **Figure 17**. MAK proxy activation with the VAMT diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index e671e92d02..4e2248db96 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -34,7 +34,7 @@ Before adding computers, ensure that the Windows Management Instrumentation (WMI 5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. - ![VAMT, Finding computers dialog box.](images/dep-win8-l-vamt-findingcomputerdialog.gif) + ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) **Important**   This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 5cbd41f410..87cb8d7b0f 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -45,7 +45,7 @@ Enable the VAMT to access client computers using the **Windows Firewall** Contro Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel: -![VAMT Firewall configuration for multiple subnets.](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) +![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) 1. Open the Control Panel and double-click **Administrative Tools**. 2. Click **Windows Firewall with Advanced Security**. diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index 0b67293d6a..f462f8655f 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -49,7 +49,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. - ![In this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) + ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) ### Install VAMT using the ADK @@ -73,7 +73,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. - ![Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) + ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) For remote SQL Server, use `servername.yourdomain.com`. diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index 91d2d8540b..45619726e9 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -45,7 +45,7 @@ VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type prod VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. -![VAMT in the enterprise.](images/dep-win8-l-vamt-image001-enterprise.jpg) +![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. @@ -54,7 +54,7 @@ The Isolated Lab environment is a workgroup that is physically separate from the The following screenshot shows the VAMT graphical user interface. -![VAMT user interface.](images/vamtuserinterfaceupdated.jpg) +![VAMT user interface](images/vamtuserinterfaceupdated.jpg) VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 71d990f500..443e1e417b 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -120,7 +120,7 @@ In the core network, a centralized KMS solution is recommended. You can also use A typical core network that includes a KMS host is shown in Figure 1. -![Typical core network.](../images/volumeactivationforwindows81-01.jpg) +![Typical core network](../images/volumeactivationforwindows81-01.jpg) **Figure 1**. Typical core network @@ -140,7 +140,7 @@ If the isolated network cannot communicate with the core network’s KMS server, If the network is fully isolated, MAK-independent activation would be the recommended choice, perhaps using the telephone option. But VAMT proxy activation may also be possible. You can also use MAKs to activate new computers during setup, before they are placed in the isolated network. -![New KMS host in an isolated network.](../images/volumeactivationforwindows81-02.jpg) +![New KMS host in an isolated network](../images/volumeactivationforwindows81-02.jpg) **Figure 2**. New KMS host in an isolated network @@ -222,7 +222,7 @@ The flow of KMS activation is shown in Figure 3, and it follows this sequence: 7. If the KMS host has a KMS host key that matches the products in the GVLK, the KMS host sends a single packet back to the client. This packet contains a count of the number of computers that have requested activation from this KMS host. 8. If the count exceeds the activation threshold for the product that is being activated, the client is activated. If the activation threshold has not yet been met, the client will try again. -![KMS activation flow.](../images/volumeactivationforwindows81-03.jpg) +![KMS activation flow](../images/volumeactivationforwindows81-03.jpg) **Figure 3**. KMS activation flow diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 118a656e49..2716a475b8 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -25,7 +25,7 @@ In this scenario, the Volume Activation Management Tool (VAMT) is deployed in th - Retail The Secure Zone represents higher-security Core Network computers that have additional firewall protection. -![VAMT firewall configuration for multiple subnets.](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) +![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) ## In This Topic - [Install and start VAMT on a networked host computer](#bkmk-partone) diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index d3b906680d..84e0a8ea19 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -19,7 +19,7 @@ ms.topic: article In this scenario, the Volume Activation Management Tool (VAMT) is used to activate products that are installed on workgroup computers in an isolated lab environment. For workgroups which are isolated from the larger network, you can perform proxy activation of Multiple Activation Keys (MAKs), KMS Host keys (CSVLKs), Generic Volume License Keys (GVLKs) (or KMS client keys), or retail keys. Proxy activation is performed by installing a second instance of VAMT on a computer in the isolated workgroup. You can then use removable media to transfer VAMT Computer Information Lists (CILXs) between the instance of VAMT in the isolated workgroup and another VAMT host that has Internet access. The following diagram shows a Multiple Activation Key (MAK) proxy activation scenario: -![VAMT MAK proxy activation scenario.](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) +![VAMT MAK proxy activation scenario](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) ## Step 1: Install VAMT on a Workgroup Computer in the Isolated Lab diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index 562251c0a9..c8e7913ed2 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -51,7 +51,7 @@ You can use the VAMT to complete the activation process in products by using MAK The VAMT provides an overview of the activation and licensing status of computers across your network, as shown in Figure 18. Several prebuilt reports are also available to help you proactively manage licensing. -![VAMT showing the licensing status of multiple computers.](../images/volumeactivationforwindows81-18.jpg) +![VAMT showing the licensing status of multiple computers](../images/volumeactivationforwindows81-18.jpg) **Figure 18**. The VAMT showing the licensing status of multiple computers @@ -59,7 +59,7 @@ The VAMT provides an overview of the activation and licensing status of computer The VAMT makes it easier to track the various keys that are issued to your organization. You can enter each key into VAMT, and then the VAMT can use those keys for online or proxy activation of clients. The tool can also describe what type of key it is and to which product group it belongs. The VAMT is the most convenient way to quickly determine how many activations remain on a MAK. Figure 19 shows an example of key types and usage. -![VAMT showing key types and usage.](../images/volumeactivationforwindows81-19.jpg) +![VAMT showing key types and usage](../images/volumeactivationforwindows81-19.jpg) **Figure 19**. The VAMT showing key types and usage diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 55fd4c1684..844c46ba14 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -30,7 +30,7 @@ The current known issues with the Volume Activation Management Tool (VAMT), vers Another known issue is that when you try to add a Windows 10 Key Management Service (KMS) Host key (CSVLK) or a Windows Server 2012 R2 for Windows 10 CSVLK into VAMT 3.1 (version 10.0.10240.0), you receive the error message shown here. -![VAMT error message.](./images/vamt-known-issue-message.png) +![VAMT error message](./images/vamt-known-issue-message.png) This issue occurs because VAMT 3.1 does not contain the correct Pkconfig files to recognize this kind of key. To work around this issue, use one of the following methods. diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md index 2a0f0da2a9..3bda096ca5 100644 --- a/windows/deployment/windows-10-deployment-posters.md +++ b/windows/deployment/windows-10-deployment-posters.md @@ -26,13 +26,13 @@ The following posters step through various options for deploying Windows 10 with The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format. -[![Deploy Windows 10 with Autopilot.](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) +[![Deploy Windows 10 with Autopilot](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) ## Deploy Windows 10 with Microsoft Endpoint Configuration Manager The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format. -[![Deploy Windows 10 with Configuration Manager.](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) +[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) ## See also diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index 0e160f2943..a90baefd20 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -42,7 +42,7 @@ Windows 10, version 1709 is available starting on 10/17/2017 in all relevant dis For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: -![Images.](images/table01.png) +![Images](images/table01.png) When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. @@ -69,7 +69,7 @@ This Semi-Annual Channel release of Windows 10 continues the Windows as a servic See the following example for Windows 10, version 1709: -![Windows 10, version 1709 lang pack.](images/lang-pack-1709.png) +![Windows 10, version 1709 lang pack](images/lang-pack-1709.png) ### Features on demand diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index 9d18e1af46..7e6d238721 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -284,7 +284,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 10. In the **Operating Systems** > **Windows 10** node, double-click the operating system that was added to view its properties. Change the operating system name to **Windows 10 Enterprise x64 Custom Image** and then click **OK**. See the following example: - ![custom image.](images/image.png) + ![custom image](images/image.png) ### Create the deployment task sequence @@ -459,7 +459,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed. 8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes. When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator. - ![finish.](images/deploy-finish.png) + ![finish](images/deploy-finish.png) This completes the demonstration of how to deploy a reference image to the network. To conserve resources, turn off the PC2 VM before starting the next section. diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index d69cc3b5db..603113f920 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -331,7 +331,7 @@ WDSUTIL /Set-Server /AnswerClients:None - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. See the following example: - ![Config Mgr PXE.](images/configmgr-pxe.png) + ![Config Mgr PXE](images/configmgr-pxe.png) 5. Click **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: @@ -803,7 +803,7 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce >Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. -![contoso.com\Computers.](images/poc-computers.png) +![contoso.com\Computers](images/poc-computers.png) In the replace procedure, PC1 will not be migrated to a new operating system. It is simplest to perform this procedure before performing the refresh procedure. After refreshing PC1, the operating system will be new. The next (replace) procedure does not install a new operating system on PC1 but rather performs a side-by-side migration of PC1 and another computer (PC4), to copy users and settings from PC1 to the new computer. @@ -907,7 +907,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 14. Click the **Site** tab, click **Configure Settings**, and click **Find Site**. The client will report that it has found the PS1 site. See the following example: - ![site.](images/configmgr-site.png) + ![site](images/configmgr-site.png) If the client is not able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the site code is not located is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode** this must be deleted or updated. @@ -915,7 +915,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 16. Click **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: - ![client.](images/configmgr-client.png) + ![client](images/configmgr-client.png) >It might take several minutes for the client to fully register with the site and complete a client check. When it is complete you will see a green check mark over the client icon as shown above. To refresh the client, click it and then press **F5** or right-click the client and click **Refresh**. @@ -976,7 +976,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 11. Click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. Verify that **PC4** is displayed in the collection. You might have to update and refresh the collection, or wait a few minutes, but do not proceed until PC4 is available. See the following example: - ![collection.](images/configmgr-collection.png) + ![collection](images/configmgr-collection.png) ### Create a device collection for PC1 @@ -1026,7 +1026,7 @@ In the Configuration Manager console, in the Software Library workspace under Op 4. In the Software Center , click **Available Software** and then select the **Replace Task Sequence** checkbox. See the following example: - ![software.](images/configmgr-software-cntr.png) + ![software](images/configmgr-software-cntr.png) >If you do not see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. @@ -1064,17 +1064,17 @@ In the Configuration Manager console, in the Software Library workspace under Op 3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. 4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: - ![installOS.](images/configmgr-install-os.png) + ![installOS](images/configmgr-install-os.png) The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: - ![asset.](images/configmgr-asset.png) + ![asset](images/configmgr-asset.png) You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. - ![post-refresh.](images/configmgr-post-refresh.png) + ![post-refresh](images/configmgr-post-refresh.png) ## Related Topics diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index d4a667a65b..319121950d 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -150,7 +150,7 @@ Hardware requirements are displayed below: The lab architecture is summarized in the following diagram: -![PoC diagram.](images/poc.png) +![PoC diagram](images/poc.png) - Computer 1 is configured to host four VMs on a private, PoC network. - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. @@ -224,9 +224,9 @@ Starting with Windows 8, the host computer’s microprocessor must support secon >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![hyper-v features.](images/hyper-v-feature.png) + ![hyper-v features](images/hyper-v-feature.png) - ![hyper-v.](images/svr_mgr2.png) + ![hyper-v](images/svr_mgr2.png)

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -449,7 +449,7 @@ Notes:
3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd 1.](images/disk2vhd.png) + ![disk2vhd 1](images/disk2vhd.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -482,7 +482,7 @@ Notes:
5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd 2.](images/disk2vhd-gen2.png) + ![disk2vhd 2](images/disk2vhd-gen2.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -506,7 +506,7 @@ Notes:
3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. 4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: - ![disk2vhd 3.](images/disk2vhd4.png) + ![disk2vhd 3](images/disk2vhd4.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -821,7 +821,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. - ![PoC 1.](images/installing-drivers.png) + ![PoC 1](images/installing-drivers.png) >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. @@ -879,7 +879,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to See the following example: - ![ISE 1.](images/ISE.png) + ![ISE 1](images/ISE.png) 19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. 20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1: diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 16e8c70c2a..447ea81cfb 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -65,7 +65,7 @@ To support Inherited Activation, both the host computer and the VM must be runni The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. -![Illustration of how Windows 10 deployment has evolved.](images/sa-evolution.png) +![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) - **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
@@ -117,11 +117,11 @@ If the device is running Windows 10, version 1809 or later: - When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: - ![Subscription Activation with MFA example 1.](images/sa-mfa1.png)
+ ![Subscription Activation with MFA example 1](images/sa-mfa1.png)
- ![Subscription Activation with MFA example 2.](images/sa-mfa2.png)
+ ![Subscription Activation with MFA example 2](images/sa-mfa2.png)
- ![Subscription Activation with MFA example 3.](images/sa-mfa3.png) + ![Subscription Activation with MFA example 3](images/sa-mfa3.png) ### Windows 10 Education requirements @@ -162,7 +162,7 @@ The device is AAD joined from **Settings > Accounts > Access work or school**. The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. -![Windows 10 Enterprise.](images/ent.png) +![Windows 10 Enterprise](images/ent.png) When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. @@ -171,10 +171,10 @@ Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, versio The following figures summarize how the Subscription Activation model works: Before Windows 10, version 1903:
-![1703.](images/before.png) +![1703](images/before.png) After Windows 10, version 1903:
-![1903.](images/after.png) +![1903](images/after.png) > [!NOTE] > diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index 74e099fc82..d132aa99a6 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -115,9 +115,9 @@ When you are prompted to restart the computer, choose **Yes**. The computer migh Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![Hyper-V feature.](images/hyper-v-feature.png) + ![Hyper-V feature](images/hyper-v-feature.png) - ![Hyper-V.](images/svr_mgr2.png) + ![Hyper-V](images/svr_mgr2.png)

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -232,21 +232,21 @@ PS C:\autopilot> Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: - ![Windows setup example 1.](images/winsetup1.png) - ![Windows setup example 2.](images/winsetup2.png) - ![Windows setup example 3.](images/winsetup3.png) - ![Windows setup example 4.](images/winsetup4.png) - ![Windows setup example 5.](images/winsetup5.png) - ![Windows setup example 6.](images/winsetup6.png) + ![Windows setup example 1](images/winsetup1.png) + ![Windows setup example 2](images/winsetup2.png) + ![Windows setup example 3](images/winsetup3.png) + ![Windows setup example 4](images/winsetup4.png) + ![Windows setup example 5](images/winsetup5.png) + ![Windows setup example 6](images/winsetup6.png) After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: - ![Windows setup example 7.](images/winsetup7.png) + ![Windows setup example 7](images/winsetup7.png) Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. > [!div class="mx-imgBorder"] - > ![Windows setup example 8.](images/winsetup8.png) + > ![Windows setup example 8](images/winsetup8.png) To create a checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: @@ -322,7 +322,7 @@ Follow these steps to run the PowerShell script: > [!NOTE] > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. - ![Serial number and hardware hash.](images/hwid.png) + ![Serial number and hardware hash](images/hwid.png) You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). @@ -338,11 +338,11 @@ With the hardware ID captured in a file, prepare your Virtual Machine for Window On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**. -![Reset this PC final prompt.](images/autopilot-reset-prompt.jpg) +![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process. -![Reset this PC screen capture.](images/autopilot-reset-progress.jpg) +![Reset this PC screen capture](images/autopilot-reset-progress.jpg) ## Verify subscription level @@ -350,13 +350,13 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** -![MDM and Intune.](images/mdm-intune2.png) +![MDM and Intune](images/mdm-intune2.png) If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. -![License conversion option.](images/aad-lic1.png) +![License conversion option](images/aad-lic1.png) ## Configure company branding @@ -367,7 +367,7 @@ If you already have company branding configured in Azure Active Directory, you c Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. -![Configure company branding.](images/branding.png) +![Configure company branding](images/branding.png) When you are finished, click **Save**. @@ -382,7 +382,7 @@ Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. -![MDM user scope in the Mobility blade.](images/ap-aad-mdm.png) +![MDM user scope in the Mobility blade](images/ap-aad-mdm.png) ## Register your VM @@ -392,14 +392,14 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B 1. In the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), choose **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices** and then on the **Windows Autopilot devices** page, choose **Import**. - ![Intune device import.](images/enroll1.png) + ![Intune device import](images/enroll1.png) > [!NOTE] > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. 2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. - ![HWID CSV.](images/enroll2.png) + ![HWID CSV](images/enroll2.png) You should receive confirmation that the file is formatted correctly before uploading it, as shown above. @@ -407,7 +407,7 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B 4. Click **Refresh** to verify your VM or device has been added. See the following example. - ![Import HWID.](images/enroll3.png) + ![Import HWID](images/enroll3.png) ### Autopilot registration using MSfB @@ -426,11 +426,11 @@ Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft. Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: -![Microsoft Store for Business.](images/msfb.png) +![Microsoft Store for Business](images/msfb.png) Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. -![Microsoft Store for Business Devices.](images/msfb-device.png) +![Microsoft Store for Business Devices](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile @@ -446,7 +446,7 @@ Pick one: > [!NOTE] > Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list. -![Devices.](images/enroll4.png) +![Devices](images/enroll4.png) #### Create a device group @@ -463,7 +463,7 @@ The Autopilot deployment profile wizard will ask for a device group, so we must 3. Click **Members** and add the Autopilot VM to the group. See the following example: > [!div class="mx-imgBorder"] - > ![add members.](images/group1.png) + > ![add members](images/group1.png) 4. Click **Create**. @@ -472,12 +472,12 @@ The Autopilot deployment profile wizard will ask for a device group, so we must To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. > [!div class="mx-imgBorder"] -> ![Deployment profiles.](images/dp.png) +> ![Deployment profiles](images/dp.png) Click on **Create profile** and then select **Windows PC**. > [!div class="mx-imgBorder"] -> ![Create deployment profile.](images/create-profile.png) +> ![Create deployment profile](images/create-profile.png) On the **Create profile** blade, use the following values: @@ -512,7 +512,7 @@ Click **Next** to continue with the **Assignments** settings: 2. Click the **Autopilot Lab** group, and then click **Select**. 3. Click **Next** to continue and then click **Create**. See the following example: -![Deployment profile.](images/profile.png) +![Deployment profile](images/profile.png) Click on **OK** and then click on **Create**. @@ -529,7 +529,7 @@ First, sign in to the [Microsoft Store for Business](https://businessstore.micro Click **Manage** from the top menu, then click **Devices** from the left navigation tree. -![MSfB manage.](images/msfb-manage.png) +![MSfB manage](images/msfb-manage.png) Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. @@ -538,17 +538,17 @@ To CREATE the profile: Select your device from the **Devices** list: > [!div class="mx-imgBorder"] -> ![MSfB create step 1.](images/msfb-create1.png) +> ![MSfB create step 1](images/msfb-create1.png) On the Autopilot deployment dropdown menu, select **Create new profile**: > [!div class="mx-imgBorder"] -> ![MSfB create step 2.](images/msfb-create2.png) +> ![MSfB create step 2](images/msfb-create2.png) Name the profile, choose your desired settings, and then click **Create**: > [!div class="mx-imgBorder"] -> ![MSfB create step 3.](images/msfb-create3.png) +> ![MSfB create step 3](images/msfb-create3.png) The new profile is added to the Autopilot deployment list. @@ -557,12 +557,12 @@ To ASSIGN the profile: To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: > [!div class="mx-imgBorder"] -> ![MSfB assign step 1.](images/msfb-assign1.png) +> ![MSfB assign step 1](images/msfb-assign1.png) Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: > [!div class="mx-imgBorder"] -> ![MSfB assign step 2.](images/msfb-assign2.png) +> ![MSfB assign step 2](images/msfb-assign2.png) > [!IMPORTANT] > The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. @@ -572,7 +572,7 @@ Confirm the profile was successfully assigned to the intended device by checking If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: > [!div class="mx-imgBorder"] -> ![Device status.](images/device-status.png) +> ![Device status](images/device-status.png) Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. @@ -583,12 +583,12 @@ Also, make sure to wait at least 30 minutes from the time you've [configured com - Turn on the device - Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). -![OOBE sign-in page.](images/autopilot-oobe.png) +![OOBE sign-in page](images/autopilot-oobe.png) Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. > [!div class="mx-imgBorder"] -> ![Device enabled.](images/devices1.png) +> ![Device enabled](images/devices1.png) Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. @@ -606,7 +606,7 @@ To use the device (or VM) for other purposes after completion of this lab, you w You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu. > [!div class="mx-imgBorder"] -> ![Delete device step 1.](images/delete-device1.png) +> ![Delete device step 1](images/delete-device1.png) This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. @@ -618,7 +618,7 @@ The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion. > [!div class="mx-imgBorder"] -> ![Delete device.](images/delete-device2.png) +> ![Delete device](images/delete-device2.png) At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: @@ -686,7 +686,7 @@ Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-ms Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: > [!div class="mx-imgBorder"] -> ![Add app example.](images/app01.png) +> ![Add app example](images/app01.png) After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. @@ -696,20 +696,20 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app step 1.](images/app02.png) +![Add app step 1](images/app02.png) Under **App Type**, select **Windows app (Win32)**: -![Add app step 2.](images/app03.png) +![Add app step 2](images/app03.png) On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: > [!div class="mx-imgBorder"] -> ![Add app step 3.](images/app04.png) +> ![Add app step 3](images/app04.png) On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: -![Add app step 4.](images/app05.png) +![Add app step 4](images/app05.png) On the **Program Configuration** blade, supply the install and uninstall commands: @@ -721,7 +721,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q > [!NOTE] > Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file. -![Add app step 5.](images/app06.png) +![Add app step 5](images/app06.png) Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). @@ -730,23 +730,23 @@ Click **OK** to save your input and activate the **Requirements** blade. On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: > [!div class="mx-imgBorder"] -> ![Add app step 6.](images/app07.png) +> ![Add app step 6](images/app07.png) Next, configure the **Detection rules**. For our purposes, we will select manual format: > [!div class="mx-imgBorder"] -> ![Add app step 7.](images/app08.png) +> ![Add app step 7](images/app08.png) Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: -![Add app step 8.](images/app09.png) +![Add app step 8](images/app09.png) Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. **Return codes**: For our purposes, leave the return codes at their default values: > [!div class="mx-imgBorder"] -> ![Add app step 9.](images/app10.png) +> ![Add app step 9](images/app10.png) Click **OK** to exit. @@ -757,12 +757,12 @@ Click the **Add** button to finalize and save your app package. Once the indicator message says the addition has completed. > [!div class="mx-imgBorder"] -> ![Add app step 10.](images/app11.png) +> ![Add app step 10](images/app11.png) You will be able to find your app in your app list: > [!div class="mx-imgBorder"] -> ![Add app step 11.](images/app12.png) +> ![Add app step 11](images/app12.png) #### Assign the app to your Intune profile @@ -772,7 +772,7 @@ You will be able to find your app in your app list: In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: > [!div class="mx-imgBorder"] -> ![Assign app step 1.](images/app13.png) +> ![Assign app step 1](images/app13.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -783,10 +783,10 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Assign app step 2.](images/app14.png) +![Assign app step 2](images/app14.png) > [!div class="mx-imgBorder"] -> ![Assign app step 3.](images/app15.png) +> ![Assign app step 3](images/app15.png) In the **Select groups** pane, click the **Select** button. @@ -797,7 +797,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. > [!div class="mx-imgBorder"] -> ![Assign app step 4.](images/app16.png) +> ![Assign app step 4](images/app16.png) At this point, you have completed steps to add a Win32 app to Intune. @@ -811,16 +811,16 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Create app step 1.](images/app17.png) +![Create app step 1](images/app17.png) Under **App Type**, select **Office 365 Suite > Windows 10**: -![Create app step 2.](images/app18.png) +![Create app step 2](images/app18.png) Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: > [!div class="mx-imgBorder"] -> ![Create app step 3.](images/app19.png) +> ![Create app step 3](images/app19.png) Click **OK**. @@ -829,13 +829,13 @@ In the **App Suite Information** pane, enter a unique suite name, and a s Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. > [!div class="mx-imgBorder"] -> ![Create app step 4.](images/app20.png) +> ![Create app step 4](images/app20.png) Click **OK**. In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: -![Create app step 5.](images/app21.png) +![Create app step 5](images/app21.png) Click **OK** and then click **Add**. @@ -847,7 +847,7 @@ Click **OK** and then click **Add**. In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: > [!div class="mx-imgBorder"] -> ![Create app step 6.](images/app22.png) +> ![Create app step 6](images/app22.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -857,10 +857,10 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Create app step 7.](images/app23.png) +![Create app step 7](images/app23.png) > [!div class="mx-imgBorder"] -> ![Create app step 8.](images/app24.png) +> ![Create app step 8](images/app24.png) In the **Select groups** pane, click the **Select** button. @@ -870,7 +870,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Create app step 9.](images/app25.png) +![Create app step 9](images/app25.png) At this point, you have completed steps to add Office to Intune. @@ -878,7 +878,7 @@ For more information on adding Office apps to Intune, see [Assign Office 365 app If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: -![Create app step 10.](images/app26.png) +![Create app step 10](images/app26.png) ## Glossary diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 04f798b127..0d04abd1e0 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -29,7 +29,7 @@ In this topic, you also learn about different types of reference images that you Windows ADK contains core assessment and deployment tools and technologies, including Deployment Image Servicing and Management (DISM), Windows Imaging and Configuration Designer (Windows ICD), Windows System Image Manager (Windows SIM), User State Migration Tool (USMT), Volume Activation Management Tool (VAMT), Windows Preinstallation Environment (Windows PE), Windows Assessment Services, Windows Performance Toolkit (WPT), Application Compatibility Toolkit (ACT), and Microsoft SQL Server 2012 Express. For more details, see [Windows ADK for Windows 10](/windows-hardware/get-started/adk-install) or [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). -![figure 1.](images/win-10-adk-select.png) +![figure 1](images/win-10-adk-select.png) The Windows 10 ADK feature selection page. @@ -50,7 +50,7 @@ Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source D:\Sources\SxS -LimitAccess ``` -![figure 2.](images/mdt-11-fig05.png) +![figure 2](images/mdt-11-fig05.png) Using DISM functions in PowerShell. @@ -77,7 +77,7 @@ In addition to these tools, there are also XML templates that manage which data - **Custom templates.** Custom templates that you create. - **Config template.** An optional template, called Config.xml, which you can use to exclude or include components in a migration without modifying the other standard XML templates. -![figure 3.](images/mdt-11-fig06.png) +![figure 3](images/mdt-11-fig06.png) A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. @@ -100,7 +100,7 @@ These are the settings migrated by the default MigUser.xml and MigApp.xml templa Windows Imaging and Configuration Designer (Windows ICD) is a tool designed to assist with the creation of provisioning packages that can be used to dynamically configure a Windows device (PCs, tablets, and phones). This is particularly useful for setting up new devices, without the need for re-imaging the device with a custom image. -![figure 4.](images/windows-icd.png) +![figure 4](images/windows-icd.png) Windows Imaging and Configuration Designer. @@ -110,7 +110,7 @@ For more information, see [Windows Imaging and Configuration Designer](/windows/ Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or Configuration Manager, you don’t need Windows SIM very often because those systems automatically update the Unattend.xml file during the deployment, greatly simplifying the process overall. -![figure 7.](images/mdt-11-fig07.png) +![figure 7](images/mdt-11-fig07.png) Windows answer file opened in Windows SIM. @@ -120,7 +120,7 @@ For more information, see [Windows System Image Manager Technical Reference]( ht If you don’t use KMS, you can still manage your MAKs centrally with the Volume Activation Management Tool (VAMT). With this tool, you can install and manage product keys throughout the organization. VAMT also can activate on behalf of clients without Internet access, acting as a MAK proxy. -![figure 6.](images/mdt-11-fig08.png) +![figure 6](images/mdt-11-fig08.png) The updated Volume Activation Management Tool. @@ -138,7 +138,7 @@ Windows PE is a “Lite” version of Windows 10 and was created to act as a dep The key thing to know about Windows PE is that, like the operating system, it needs drivers for at least network and storage devices in each PC. Luckily Windows PE includes the same drivers as the full Windows 10 operating system, which means much of your hardware will work out of the box. -![figure 7.](images/mdt-11-fig09.png) +![figure 7](images/mdt-11-fig09.png) A machine booted with the Windows ADK default Windows PE boot image. @@ -149,7 +149,7 @@ For more details on Windows PE, see [Windows PE (WinPE)](/windows-hardware/manuf Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you will see an automatic failover into Windows RE. -![figure 8.](images/mdt-11-fig10.png) +![figure 8](images/mdt-11-fig10.png) A Windows 10 client booted into Windows RE, showing Advanced options. @@ -160,7 +160,7 @@ For more information on Windows RE, see [Windows Recovery Environment](/windows- Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you will use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker. -![figure 9.](images/mdt-11-fig11.png) +![figure 9](images/mdt-11-fig11.png) Windows Deployment Services using multicast to deploy three machines. @@ -176,7 +176,7 @@ Also, there are a few new features related to TFTP performance: - **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. - **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. -![figure 10.](images/mdt-11-fig12.png) +![figure 10](images/mdt-11-fig12.png) TFTP changes are now easy to perform. @@ -192,7 +192,7 @@ Lite Touch and Zero Touch are marketing names for the two solutions that MDT sup -![figure 11.](images/mdt-11-fig13.png) +![figure 11](images/mdt-11-fig13.png) The Deployment Workbench in, showing a task sequence. @@ -203,7 +203,7 @@ For more information on MDT, see the [Microsoft Deployment Toolkit](/mem/configm [Microsoft SCM](https://go.microsoft.com/fwlink/p/?LinkId=619246) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer. -![figure 12.](images/mdt-11-fig14.png) +![figure 12](images/mdt-11-fig14.png) The SCM console showing a baseline configuration for a fictional client's computer security compliance. @@ -228,7 +228,7 @@ For more information on the benefits of an MDOP subscription, see [Microsoft Des There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file. -![figure 13.](images/mdt-11-fig15.png) +![figure 13](images/mdt-11-fig15.png) The User Experience selection screen in IEAK 11. @@ -239,7 +239,7 @@ To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Inform WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. -![figure 14.](images/mdt-11-fig16.png) +![figure 14](images/mdt-11-fig16.png) The Windows Server Update Services console. diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index 5852e85928..930819c367 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -64,7 +64,7 @@ Note that this setting does not control whether your device sends diagnostic dat 2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn on data viewing.](images/ddv-data-viewing.png) + ![Location to turn on data viewing](images/ddv-data-viewing.png) **To turn on data viewing through PowerShell** @@ -134,7 +134,7 @@ When you're done reviewing your diagnostic data, we recommend turning off data v 2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn off data viewing.](images/ddv-settings-off.png) + ![Location to turn off data viewing](images/ddv-settings-off.png) **To turn off data viewing through PowerShell** diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index dc9a127179..3b40651ee2 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -38,7 +38,7 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn 2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn on data viewing.](images/ddv-data-viewing.png) + ![Location to turn on data viewing](images/ddv-data-viewing.png) ### Download the Diagnostic Data Viewer Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. @@ -54,7 +54,7 @@ You can start this app from the **Settings** panel. 2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button. - ![Location to turn on the Diagnostic Data Viewer.](images/ddv-settings-launch.png)

-OR-

+ ![Location to turn on the Diagnostic Data Viewer](images/ddv-settings-launch.png)

-OR-

Go to **Start** and search for _Diagnostic Data Viewer_. @@ -73,7 +73,7 @@ The Diagnostic Data Viewer provides you with the following features to view and >[!Important] >Seeing an event does not necessarily mean it has been uploaded yet. It’s possible that some events are still queued and will be uploaded at a later time. - ![View your diagnostic events.](images/ddv-event-view.jpg) + ![View your diagnostic events](images/ddv-event-view.jpg) - **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text. @@ -83,7 +83,7 @@ The Diagnostic Data Viewer provides you with the following features to view and - **Help to make your Windows experience better.** Microsoft only needs diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others. - To signify your contribution, you’ll see this icon (![Icon to review the device-level sampling.](images/ddv-device-sample.png)) if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon (![Icon to review the event-level sampling](images/ddv-event-sample.png)). + To signify your contribution, you’ll see this icon (![Icon to review the device-level sampling](images/ddv-device-sample.png)) if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon (![Icon to review the event-level sampling](images/ddv-event-sample.png)). - **Provide diagnostic event feedback.** The **Feedback** icon in the upper right corner of the window opens the Feedback Hub app, letting you provide feedback about the Diagnostic Data Viewer and the diagnostic events. @@ -99,7 +99,7 @@ The Diagnostic Data Viewer provides you with the following features to view and >[!Important] >This content is a reflection of the history of Windows data the app has stored. If you'd like to have extended analyses, please modify the storage capacity of Diagnostic Data Viewer. - ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer.](images/ddv-analytics.png) + ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer](images/ddv-analytics.png) ## View Office Diagnostic Data By default, Diagnostic Data Viewer shows you Windows data. You can also view Office diagnostic data by enabling the feature in the app settings page. To learn more about how to view Office diagnostic data, please visit this [page](https://go.microsoft.com/fwlink/?linkid=2023830). @@ -112,7 +112,7 @@ When you're done reviewing your diagnostic data, you should turn of data viewing 2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn off data viewing.](images/ddv-settings-off.png) + ![Location to turn off data viewing](images/ddv-settings-off.png) ## Modifying the size of your data history By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first. @@ -139,7 +139,7 @@ You can also use the Windows Error Reporting tool available in the Control Panel Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer. -![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer.](images/ddv-problem-reports.png) +![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer](images/ddv-problem-reports.png) **To view your Windows Error Reporting diagnostic data using the Control Panel** @@ -147,7 +147,7 @@ Go to **Start**, select **Control Panel** > **All Control Panel Items** > **Secu Go to **Start** and search for _Problem Reports_. The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft. -![View problem reports tool with report statuses.](images/control-panel-problem-reports-screen.png) +![View problem reports tool with report statuses](images/control-panel-problem-reports-screen.png) ## Known Issues with Diagnostic Data Viewer diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index f1f0d9469a..aad2616468 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -57,60 +57,60 @@ The following table lists management options for each setting, beginning with Wi | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [5. Find My Device](#find-my-device) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [6. Font streaming](#font-streaming) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [9. License Manager](#bkmk-licmgr) | | | ![Check mark.](images/checkmark.png) | -| [10. Live Tiles](#live-tiles) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | -| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark.](images/checkmark.png) | | ![Check mark.](images/checkmark.png) | -| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark.](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [16. OneDrive](#bkmk-onedrive) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [9. License Manager](#bkmk-licmgr) | | | ![Check mark](images/checkmark.png) | +| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -|     [18.1 General](#bkmk-general) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -|     [18.22 Activity History](#bkmk-act-history) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [20. Storage Health](#bkmk-storage-health) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [22. Teredo](#bkmk-teredo) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [29. Windows Update](#bkmk-wu) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | -| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ### Settings for Windows Server 2016 with Desktop Experience @@ -119,20 +119,20 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [6. Font streaming](#font-streaming) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [10. Live Tiles](#live-tiles) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [16. OneDrive](#bkmk-onedrive) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [22. Teredo](#bkmk-teredo) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -172,54 +172,54 @@ See the following table for a summary of the management settings for Windows Ser | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [5. Find My Device](#find-my-device) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -|     [18.1 General](#bkmk-general) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -|     [18.22 Activity History](#bkmk-act-history) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | | [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 69dba47679..8ac3729427 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -592,7 +592,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s > **Note**  You might have to delegate permissions to join computers to the domain if the account that joins the workstations to the domain does not already have them. For more information, see [Delegation of Administration in Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx). - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample1.gif) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample1.gif) 3. Close Active Directory Users and Computers. @@ -600,13 +600,13 @@ In this procedure, the workstations are dedicated to domain administrators. By s 5. Right-click the new OU, and > **Create a GPO in this domain, and Link it here**. - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample2.png) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample2.png) 6. Name the GPO, and > **OK**. 7. Expand the GPO, right-click the new GPO, and > **Edit**. - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample3.png) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample3.png) 8. Configure which members of accounts can log on locally to these administrative workstations as follows: @@ -625,7 +625,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s 5. Click **Add User or Group**, type **Administrators**, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample4.png) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample4.png) 9. Configure the proxy configuration: @@ -633,7 +633,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s 2. Double-click **Proxy Settings**, select the **Enable proxy settings** check box, type **127.0.0.1** (the network Loopback IP address) as the proxy address, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample5.png) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample5.png) 10. Configure the loopback processing mode to enable the user Group Policy proxy setting to apply to all users on the computer as follows: @@ -696,11 +696,11 @@ In this procedure, the workstations are dedicated to domain administrators. By s 1. Right-click **Windows Firewall with Advanced Security LDAP://path**, and > **Properties**. - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample6.png) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample6.png) 2. On each profile, ensure that the firewall is enabled and that inbound connections are set to **Block all connections**. - ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample7.png) + ![Active Directory local accounts](images/adlocalaccounts-proc1-sample7.png) 3. Click **OK** to complete the configuration. @@ -738,11 +738,11 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Right-click **Group Policy Objects**, and > **New**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample1.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample1.png) 4. In the **New GPO** dialog box, name the GPO that restricts administrators from signing in to workstations, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample2.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample2.png) 5. Right-click **New GPO**, and > **Edit**. @@ -756,7 +756,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Click **Add User or Group**, click **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample3.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample3.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -778,7 +778,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample4.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample4.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -791,7 +791,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 6. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample5.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample5.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -804,11 +804,11 @@ For this procedure, do not link accounts to the OU that contain workstations for 1. Right-click the workstation OU, and then > **Link an Existing GPO**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample6.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample6.png) 2. Select the GPO that you just created, and > **OK**. - ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample7.png) + ![Active Directory local accounts](images/adlocalaccounts-proc2-sample7.png) 10. Test the functionality of enterprise applications on workstations in the first OU and resolve any issues caused by the new policy. @@ -831,7 +831,7 @@ It is a best practice to configure the user objects for all sensitive accounts i As with any configuration change, test this enabled setting fully to ensure that it performs correctly before you implement it. -![Active Directory local accounts.](images/adlocalaccounts-proc3-sample1.png) +![Active Directory local accounts](images/adlocalaccounts-proc3-sample1.png) ## Secure and manage domain controllers diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index 6ad17afded..d67808e585 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -367,15 +367,15 @@ The following table shows the Group Policy and registry settings that are used t 3. In the console tree, right-click **Group Policy Objects**, and > **New**. - ![local accounts 1.](images/localaccounts-proc1-sample1.png) + ![local accounts 1](images/localaccounts-proc1-sample1.png) 4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. - ![local accounts 2.](images/localaccounts-proc1-sample2.png) + ![local accounts 2](images/localaccounts-proc1-sample2.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 3.](images/localaccounts-proc1-sample3.png) + ![local accounts 3](images/localaccounts-proc1-sample3.png) 6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by doing the following: @@ -391,7 +391,7 @@ The following table shows the Group Policy and registry settings that are used t 2. Right-click **Registry**, and > **New** > **Registry Item**. - ![local accounts 4.](images/localaccounts-proc1-sample4.png) + ![local accounts 4](images/localaccounts-proc1-sample4.png) 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. @@ -407,7 +407,7 @@ The following table shows the Group Policy and registry settings that are used t 9. Verify this configuration, and > **OK**. - ![local accounts 5.](images/localaccounts-proc1-sample5.png) + ![local accounts 5](images/localaccounts-proc1-sample5.png) 8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: @@ -415,7 +415,7 @@ The following table shows the Group Policy and registry settings that are used t 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - ![local accounts 6.](images/localaccounts-proc1-sample6.png) + ![local accounts 6](images/localaccounts-proc1-sample6.png) 3. Select the GPO that you just created, and > **OK**. @@ -495,11 +495,11 @@ The following table shows the Group Policy settings that are used to deny networ 4. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it is being used to restrict the local administrative accounts from interactively signing in to the computer. - ![local accounts 7.](images/localaccounts-proc2-sample1.png) + ![local accounts 7](images/localaccounts-proc2-sample1.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 8.](images/localaccounts-proc2-sample2.png) + ![local accounts 8](images/localaccounts-proc2-sample2.png) 6. Configure the user rights to deny network logons for administrative local accounts as follows: diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index be0a573f71..e770d29de4 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -52,7 +52,7 @@ SIDs always remain unique. Security authorities never issue the same SID twice, A security identifier is a data structure in binary format that contains a variable number of values. The first values in the structure contain information about the SID structure. The remaining values are arranged in a hierarchy (similar to a telephone number), and they identify the SID-issuing authority (for example, “NT Authority”), the SID-issuing domain, and a particular security principal or group. The following image illustrates the structure of a SID. -![Security identifier architecture.](images/security-identifider-architecture.jpg) +![Security identifier architecture](images/security-identifider-architecture.jpg) The individual values of a SID are described in the following table. diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index 293acd13c9..26564af45a 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -42,7 +42,7 @@ The following diagram illustrates the Windows authorization and access control **Authorization and access control process** -![authorization and access control process.](images/authorizationandaccesscontrolprocess.gif) +![authorization and access control process](images/authorizationandaccesscontrolprocess.gif) Security principals are closely related to the following components and technologies: diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index 9423de2923..f055141697 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -52,11 +52,11 @@ On the device, perform the following steps: (add select certificate) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. - :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: + :::image type="content" alt-text="settings icon in mail app" source="images/mailsettings.png"::: 3. Tap **Email security**. - :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: + :::image type="content" alt-text="email security settings" source="images/emailsecurity.png"::: 4. In **Select an account**, select the account for which you want to configure S/MIME options. @@ -77,7 +77,7 @@ On the device, perform the following steps: (add select certificate) 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. - :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: + :::image type="content" alt-text="sign or encrypt message" source="images/signencrypt.png"::: ## Read signed or encrypted messages @@ -93,5 +93,5 @@ When you receive a signed email, the app provide feature to install correspondin 3. Tap **Install.** - :::image type="content" alt-text="message security information." source="images/installcert.png"::: + :::image type="content" alt-text="message security information" source="images/installcert.png":::   \ No newline at end of file diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index b122158529..8d0219c5dd 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -33,7 +33,7 @@ When Windows Defender Credential Guard is enabled, Kerberos does not allow uncon Here's a high-level overview on how the LSA is isolated by using virtualization-based security: -![Windows Defender Credential Guard overview.](images/credguard.png) +![Windows Defender Credential Guard overview](images/credguard.png) ## See also diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index 936172770d..c737034fd5 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -45,7 +45,7 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will 5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](../../threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) for more details. - ![Windows Defender Credential Guard Group Policy setting.](images/credguard-gp-2.png) + ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp-2.png) 6. Close the Group Policy Management Console. @@ -168,7 +168,7 @@ You can view System Information to check that Windows Defender Credential Guard Here's an example: > [!div class="mx-imgBorder"] - > ![System Information.](images/credguard-msinfo32.png) + > ![System Information](images/credguard-msinfo32.png) You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index fea29a3fc3..8a678b6ff4 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -176,7 +176,7 @@ Certutil writes the binary information to the following registration location: | Value | Binary contents from the certificate pin rules certificate trust list file | | Data type | REG_BINARY | -![Registry binary information.](images/enterprise-pinning-registry-binary-information.png) +![Registry binary information](images/enterprise-pinning-registry-binary-information.png) ### Deploying Enterprise Pin Rule Settings using Group Policy @@ -203,7 +203,7 @@ Sign-in to the reference computer using domain administrator equivalent credenti 11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box. - ![PinRules Properties.](images/enterprise-certificate-pinning-pinrules-properties.png) + ![PinRules Properties](images/enterprise-certificate-pinning-pinrules-properties.png) 12. Close the **Group Policy Management Editor** to save your settings. 13. Link the **Enterprise Certificate Pinning Rules** Group Policy object to apply to computers that run Windows 10, version 1703 in your enterprise. When these domain-joined computers apply Group Policy, the registry information configured in the Group Policy object is applied to the computer. @@ -258,7 +258,7 @@ These dates must be properly formatted and represented in UTC. You can use Windows PowerShell to format these dates. You can then copy and paste the output of the cmdlet into the XML file. -![Representing a date.](images/enterprise-certificate-pinning-representing-a-date.png) +![Representing a date](images/enterprise-certificate-pinning-representing-a-date.png) For simplicity, you can truncate decimal point (.) and the numbers after it. However, be certain to append the uppercase “Z” to the end of the XML date string. @@ -272,7 +272,7 @@ However, be certain to append the uppercase “Z” to the end of the XML date s You can also use Windows PowerShell to validate convert an XML date into a human readable date to validate it’s the correct date. -![Converting an XML date.](images/enterprise-certificate-pinning-converting-an-xml-date.png) +![Converting an XML date](images/enterprise-certificate-pinning-converting-an-xml-date.png) ## Representing a Duration in XML @@ -280,13 +280,13 @@ Some elements may be configured to use a duration rather than a date. You must represent the duration as an XML timespan data type. You can use Windows PowerShell to properly format and validate durations (timespans) and copy and paste them into your XML file. -![Representing a duration.](images/enterprise-certificate-pinning-representing-a-duration.png) +![Representing a duration](images/enterprise-certificate-pinning-representing-a-duration.png) ## Converting an XML Duration You can convert a XML formatted timespan into a timespan variable that you can read. -![Converting an XML duration.](images/enterprise-certificate-pinning-converting-a-duration.png) +![Converting an XML duration](images/enterprise-certificate-pinning-converting-a-duration.png) ## Certificate Trust List XML Schema Definition (XSD) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index f80ffec25c..b7018e4477 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -372,11 +372,11 @@ The Group Policy object contains the policy settings needed to trigger Windows H 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. - ![Group Policy Editor.](images/multifactorUnlock/gpme.png) + ![Group Policy Editor](images/multifactorUnlock/gpme.png) 8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values. - ![Multifactor Policy Setting.](images/multifactorUnlock/gp-setting.png) + ![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) 9. Configure first and second unlock factors using the information in [Configure Unlock Factors](#configuring-unlock-factors). diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index 25d27e28d3..16be1aa6bc 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -38,23 +38,23 @@ Determining an adequate number of Windows Server domain controllers is important Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: -![dc-chart1.](images/plan/dc-chart1.png) +![dc-chart1](images/plan/dc-chart1.png) The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following: -![dc-chart2.](images/plan/dc-chart2.png) +![dc-chart2](images/plan/dc-chart2.png) The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients? -![dc-chart3.](images/plan/dc-chart3.png) +![dc-chart3](images/plan/dc-chart3.png) Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same. -![dc-chart4.](images/plan/dc-chart4.png) +![dc-chart4](images/plan/dc-chart4.png) Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. -![dc-chart5.](images/plan/dc-chart5.png) +![dc-chart5](images/plan/dc-chart5.png) You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index f354ae19d4..ab73eab4f9 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -91,7 +91,7 @@ Sign-in the federation server with domain administrator equivalent credentials. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Repeat the same to add device registration service name (*enterpriseregistration.contoso.com*) as another alternative name. Click **OK** when finished. 10. Click **Enroll**. @@ -184,7 +184,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. -![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) +![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. 5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as *fs.corp.contoso.com* or *fs.contoso.com*. @@ -204,7 +204,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. -![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) +![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. 5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as fs.corp.mstepdemo.net or fs.mstepdemo.net. @@ -456,7 +456,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. 8. Click **Install** to start the feature installation. - ![Feature selection screen with NLB selected.](images/hello-nlb-feature-install.png) + ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -465,25 +465,25 @@ Before you can load balance all the nodes in the AD FS farm, you must first crea Sign-in a node of the federation farm with _Admin_ equivalent credentials. 1. Open **Network Load Balancing Manager** from **Administrative Tools**. - ![NLB Manager user interface.](images/hello-nlb-manager.png) + ![NLB Manager user interface](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. 3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. - ![NLB Manager - Connect to new Cluster screen.](images/hello-nlb-connect.png) + ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. 6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. - ![NLB Manager - Add IP to New Cluster screen.](images/hello-nlb-add-ip.png) + ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) 7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. - ![NLB Manager - Cluster IP Configuration screen.](images/hello-nlb-cluster-ip-config.png) + ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. 9. In Port Rules, click Edit to modify the default port rules to use port 443. - ![NLB Manager - Add\Edit Port Rule screen.](images/hello-nlb-cluster-port-rule.png) + ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. 2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. - ![NLB Manager - Cluster with nodes.](images/hello-nlb-cluster.png) + ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 57f12a0692..0686de8a9a 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -34,7 +34,7 @@ To locate the schema master role holder, open and command prompt and type: ```Netdom query fsmo | findstr -i “schema”``` -![Netdom example output.](images/hello-cmd-netdom.png) +![Netdom example output](images/hello-cmd-netdom.png) The command should return the name of the domain controller where you need to adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index 0bbce98b00..bafde6afc2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -51,7 +51,7 @@ Three approaches are documented here: 1. Right-click the **Smartcard Logon** template and click **Duplicate Template** - ![Duplicating Smartcard Template.](images/rdpcert/duplicatetemplate.png) + ![Duplicating Smartcard Template](images/rdpcert/duplicatetemplate.png) 1. On the **Compatibility** tab: 1. Clear the **Show resulting changes** check box @@ -109,7 +109,7 @@ Three approaches are documented here: 1. In the Certificate Authority console, right-click **Certificate Templates**, select **New**, and select **Certificate Template to Issue** - ![Selecting Certificate Template to Issue.](images/rdpcert/certificatetemplatetoissue.png) + ![Selecting Certificate Template to Issue](images/rdpcert/certificatetemplatetoissue.png) 1. From the list of templates, select the template you previously created (**WHFB Certificate Authentication**) and click **OK**. It can take some time for the template to replicate to all servers and become available in this list. @@ -123,7 +123,7 @@ Three approaches are documented here: 1. In the left pane of the MMC, right-click **Personal**, click **All Tasks**, and then click **Request New Certificate…** - ![Request a new certificate.](images/rdpcert/requestnewcertificate.png) + ![Request a new certificate](images/rdpcert/requestnewcertificate.png) 1. On the Certificate Enrollment screen, click **Next**. diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 48a0d130df..476aed7683 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -29,7 +29,7 @@ When you set up Windows Hello in Windows 10, you may get an error during the ** The following image shows an example of an error during **Create a PIN**. -![PIN error.](images/pinerror.png) +![PIN error](images/pinerror.png) ## Error mitigations diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 2fbed0b012..0ecc622ba4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -97,20 +97,20 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 1. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. - ![PIN reset service application in Azure.](images/pinreset/pin-reset-service-prompt.png) + ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) 1. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 1. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. - ![PIN reset client application in Azure.](images/pinreset/pin-reset-client-prompt.png) + ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) > [!NOTE] > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. 1. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. - :::image type="content" alt-text="PIN reset service permissions page." source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: + :::image type="content" alt-text="PIN reset service permissions page" source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: ### Configure Windows devices to use PIN reset using Group Policy @@ -210,7 +210,7 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - **Data type:** String - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be _signin.contoso.com;portal.contoso.com_ (without quotation marks) - :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy." source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: + :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy" source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: 1. Click the Save button to save the custom configuration. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index b5361a656c..30dc6c78e6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -55,7 +55,7 @@ Windows Hello for Business emulates a smart card for application compatibility. Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. > [!div class="mx-imgBorder"] -> ![WHFB Certificate GP Setting.](images/rdpbio/rdpbiopolicysetting.png) +> ![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) > [!IMPORTANT] > The remote desktop with biometric feature does not work with [Dual Enrollment](hello-feature-dual-enrollment.md) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index 1efcc90b24..a90f1587c2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -31,7 +31,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Azure AD join authentication to Azure Active Directory -![Azure AD join authentication to Azure Active Directory.](images/howitworks/auth-aadj-cloud.png) +![Azure AD join authentication to Azure Active Directory](images/howitworks/auth-aadj-cloud.png) | Phase | Description | | :----: | :----------- | @@ -42,7 +42,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |E | The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT, and informs winlogon of the success authentication. Winlogon creates a logon session, loads the user's profile, and starts explorer.exe.| ## Azure AD join authentication to Active Directory using a Key -![Azure AD join authentication to Active Directory using a Key.](images/howitworks/auth-aadj-keytrust-kerb.png) +![Azure AD join authentication to Active Directory using a Key](images/howitworks/auth-aadj-keytrust-kerb.png) | Phase | Description | @@ -56,7 +56,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Azure AD join authentication to Active Directory using a Certificate -![Azure AD join authentication to Active Directory using a Certificate.](images/howitworks/auth-aadj-certtrust-kerb.png) +![Azure AD join authentication to Active Directory using a Certificate](images/howitworks/auth-aadj-certtrust-kerb.png) | Phase | Description | | :----: | :----------- | @@ -69,7 +69,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Hybrid Azure AD join authentication using a Key -![Hybrid Azure AD join authentication using a Key.](images/howitworks/auth-haadj-keytrust.png) +![Hybrid Azure AD join authentication using a Key](images/howitworks/auth-haadj-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -85,7 +85,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c > In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business until (a) Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory and (b) device has line of sight to the domain controller for the first time. ## Hybrid Azure AD join authentication using a Certificate -![Hybrid Azure AD join authentication using a Certificate.](images/howitworks/auth-haadj-certtrust.png) +![Hybrid Azure AD join authentication using a Certificate](images/howitworks/auth-haadj-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 20008e7565..0fb161ccb5 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -37,7 +37,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, ## Azure AD joined provisioning in a Managed environment -![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-managed.png) +![Azure AD joined provisioning in a Managed environment](images/howitworks/prov-aadj-managed.png) | Phase | Description | | :----: | :----------- | @@ -48,7 +48,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Azure AD joined provisioning in a Federated environment -![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-federated.png) +![Azure AD joined provisioning in a Managed environment](images/howitworks/prov-aadj-federated.png) | Phase | Description | | :----: | :----------- | @@ -58,7 +58,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment.](images/howitworks/prov-haadj-keytrust-managed.png) +![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](images/howitworks/prov-haadj-keytrust-managed.png) | Phase | Description | @@ -76,7 +76,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment -![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment.](images/howitworks/prov-haadj-instant-certtrust-federated.png) +![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](images/howitworks/prov-haadj-instant-certtrust-federated.png) | Phase | Description | @@ -94,7 +94,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Key Trust deployment -![Domain joined provisioning in an On-premises Key Trust deployment.](images/howitworks/prov-onprem-keytrust.png) +![Domain joined provisioning in an On-premises Key Trust deployment](images/howitworks/prov-onprem-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -105,7 +105,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Certificate Trust deployment -![Domain joined provisioning in an On-premises Certificate Trust deployment.](images/howitworks/prov-onprem-certtrust.png) +![Domain joined provisioning in an On-premises Certificate Trust deployment](images/howitworks/prov-onprem-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 13246cec6f..8e0a208a86 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -40,19 +40,19 @@ Before adding Azure Active Directory (Azure AD) joined devices to your existing Azure AD join, as well as hybrid Azure AD join devices register the user's Windows Hello for Business credential with Azure. To enable on-premises authentication, the credential must be synchronized to the on-premises Active Directory, regardless whether you are using a key or a certificate. Ensure you have Azure AD Connect installed and functioning properly. To learn more about Azure AD Connect, read [Integrate your on-premises directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect). If you upgraded your Active Directory schema to the Windows Server 2016 schema after installing Azure AD Connect, run Azure AD Connect and run **Refresh directory schema** from the list of tasks. -![Azure AD Connect Schema Refresh.](images/aadj/aadconnectschema.png) +![Azure AD Connect Schema Refresh](images/aadj/aadconnectschema.png) ### Azure Active Directory Device Registration A fundamental prerequisite of all cloud and hybrid Windows Hello for Business deployments is device registration. A user cannot provision Windows Hello for Business unless the device from which they are trying to provision has registered with Azure Active Directory. For more information about device registration, read [Introduction to device management in Azure Active Directory](/azure/active-directory/devices/overview). You can use the **dsregcmd.exe** command to determine if your device is registered to Azure Active Directory. -![dsregcmd output.](images/aadj/dsregcmd.png) +![dsregcmd output](images/aadj/dsregcmd.png) ### CRL Distribution Point (CDP) Certificates issued by a certificate authority can be revoked. When a certificate authority revokes as certificate, it writes information about the certificate into a revocation list. During certificate validation, Windows 10 consults the CRL distribution point within the certificate to get a list of revoked certificates. Validation compares the current certificate with information in the certificate revocation list to determine if the certificate remains valid. -![Domain Controller Certificate with LDAP CDP.](images/aadj/Certificate-CDP.png) +![Domain Controller Certificate with LDAP CDP](images/aadj/Certificate-CDP.png) The preceding domain controller certificate shows a CRL distribution path (CDP) using Active Directory. You can determine this because the value in the URL begins with **ldap**. Using Active Directory for domain joined devices provides a highly available CRL distribution point. However, Azure Active Directory joined devices and users on Azure Active Directory joined devices cannot read data from Active Directory, and certificate validation does not provide an opportunity to authenticate prior to reading the certificate revocation list. This becomes a circular problem as the user is attempting to authenticate, but must read Active Directory to complete the authentication, but the user cannot read Active Directory because they have not authenticated. @@ -122,16 +122,16 @@ You need to host your new certificate revocation list of a web server so Azure A 1. From **Windows Administrative Tools**, Open **Internet Information Services (IIS) Manager**. 2. Expand the navigation pane to show **Default Web Site**. Select and then right-click **Default Web site** and click **Add Virtual Directory...**. 3. In the **Add Virtual Directory** dialog box, type **cdp** in **alias**. For physical path, type or browse for the physical file location where you will host the certificate revocation list. For this example, the path **c:\cdp** is used. Click **OK**. - ![Add Virtual Directory.](images/aadj/iis-add-virtual-directory.png) + ![Add Virtual Directory](images/aadj/iis-add-virtual-directory.png) > [!NOTE] > Make note of this path as you will use it later to configure share and file permissions. 4. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Directory Browsing** in the content pane. Click **Enable** in the details pane. 5. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Configuration Editor**. 6. In the **Section** list, navigate to **system.webServer/security/requestFiltering**. - ![IIS Configuration Editor requestFiltering.](images/aadj/iis-config-editor-requestFiltering.png) + ![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) In the list of named value-pairs in the content pane, configure **allowDoubleEscaping** to **True**. Click **Apply** in the actions pane. - ![IIS Configuration Editor double escaping.](images/aadj/iis-config-editor-allowDoubleEscaping.png) + ![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) 7. Close **Internet Information Services (IIS) Manager**. #### Create a DNS resource record for the CRL distribution point URL @@ -139,7 +139,7 @@ You need to host your new certificate revocation list of a web server so Azure A 1. On your DNS server or from an administrative workstation, open **DNS Manager** from **Administrative Tools**. 2. Expand **Forward Lookup Zones** to show the DNS zone for your domain. Right-click your domain name in the navigation pane and click **New Host (A or AAAA)...**. 3. In the **New Host** dialog box, type **crl** in **Name**. Type the IP address of the web server you configured in **IP Address**. Click **Add Host**. Click **OK** to close the **DNS** dialog box. Click **Done**. -![Create DNS host record.](images/aadj/dns-new-host-dialog.png) +![Create DNS host record](images/aadj/dns-new-host-dialog.png) 4. Close the **DNS Manager**. ### Prepare a file share to host the certificate revocation list @@ -151,12 +151,12 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. 3. Select **Share this folder**. Type **cdp$** in **Share name**. Click **Permissions**. -![cdp sharing.](images/aadj/cdp-sharing.png) +![cdp sharing](images/aadj/cdp-sharing.png) 4. In the **Permissions for cdp$** dialog box, click **Add**. 5. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**, and then click **OK**. 7. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, in **Enter the object names to select**, type the name of the server running the certificate authority issuing the certificate revocation list, and then click **Check Names**. Click **OK**. 8. In the **Permissions for cdp$** dialog box, select the certificate authority from the **Group or user names list**. In the **Permissions for** section, select **Allow** for **Full control**. Click **OK**. -![CDP Share Permissions.](images/aadj/cdp-share-permissions.png) +![CDP Share Permissions](images/aadj/cdp-share-permissions.png) 9. In the **Advanced Sharing** dialog box, click **OK**. > [!Tip] @@ -166,7 +166,7 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. 3. Click **Caching**. Select **No files or programs from the shared folder are available offline**. -![CDP disable caching.](images/aadj/cdp-disable-caching.png) +![CDP disable caching](images/aadj/cdp-disable-caching.png) 4. Click **OK**. #### Configure NTFS permission for the CDP folder @@ -175,7 +175,7 @@ These procedures configure NTFS and share permissions on the web server to allow 2. Right-click the **cdp** folder and click **Properties**. Click the **Security** tab. 3. On the **Security** tab, click Edit. 5. In the **Permissions for cdp** dialog box, click **Add**. -![CDP NTFS Permissions.](images/aadj/cdp-ntfs-permissions.png) +![CDP NTFS Permissions](images/aadj/cdp-ntfs-permissions.png) 6. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**. Click **OK**. 7. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, in **Enter the object names to select**, type the name of the certificate authority, and then click **Check Names**. Click **OK**. 8. In the **Permissions for cdp** dialog box, select the name of the certificate authority from the **Group or user names** list. In the **Permissions for** section, select **Allow** for **Full control**. Click **OK**. @@ -192,11 +192,11 @@ The web server is ready to host the CRL distribution point. Now, configure the 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. 4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). - ![CDP New Location dialog box.](images/aadj/cdp-extension-new-location.png) + ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. - ![CDP complete http.](images/aadj/cdp-extension-complete-http.png) + ![CDP complete http](images/aadj/cdp-extension-complete-http.png) 8. Select **Include in CRLs. Clients use this to find Delta CRL locations**. 9. Select **Include in the CDP extension of issued certificates**. 10. Click **Apply** save your selections. Click **No** when ask to restart the service. @@ -213,7 +213,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. - ![CDP publishing location.](images/aadj/cdp-extension-complete-unc.png) + ![CDP publishing location](images/aadj/cdp-extension-complete-unc.png) 8. Select **Publish CRLs to this location**. 9. Select **Publish Delta CRLs to this location**. 10. Click **Apply** save your selections. Click **Yes** when ask to restart the service. Click **OK** to close the properties dialog box. @@ -222,7 +222,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click **Revoked Certificates**, hover over **All Tasks**, and click **Publish** -![Publish a New CRL.](images/aadj/publish-new-crl.png) +![Publish a New CRL](images/aadj/publish-new-crl.png) 3. In the **Publish CRL** dialog box, select **New CRL** and click **OK**. #### Validate CDP Publishing @@ -230,7 +230,7 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. 1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. - ![Validate the new CRL.](images/aadj/validate-cdp-using-browser.png) + ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates @@ -239,9 +239,9 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 1. Sign-in a domain controller using administrative credentials. 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, select the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. -![Certificate Manager Personal store.](images/aadj/certlm-personal-store.png) +![Certificate Manager Personal store](images/aadj/certlm-personal-store.png) 4. Right-click the selected certificate. Hover over **All Tasks** and then select **Renew Certificate with New Key...**. In the **Certificate Enrollment** wizard, click **Next**. -![Renew with New key.](images/aadj/certlm-renew-with-new-key.png) +![Renew with New key](images/aadj/certlm-renew-with-new-key.png) 5. In the **Request Certificates** page of the wizard, verify the selected certificate has the correct certificate template and ensure the status is available. Click **Enroll**. 6. After the enrollment completes, click **Finish** to close the wizard. 7. Repeat this procedure on all your domain controllers. @@ -259,7 +259,7 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. 4. Click the **Details** tab. Scroll down the list until **CRL Distribution Points** is visible in the **Field** column of the list. Select **CRL Distribution Point**. 5. Review the information below the list of fields to confirm the new URL for the CRL distribution point is present in the certificate. Click **OK**.
-![New Certificate with updated CDP.](images/aadj/dc-cert-with-new-cdp.png) +![New Certificate with updated CDP](images/aadj/dc-cert-with-new-cdp.png) ## Configure and Assign a Trusted Certificate Device Configuration Profile @@ -276,13 +276,13 @@ Steps you will perform include: 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. 4. Click the **Certification Path** tab. In the **Certification path** view, select the top most node and click **View Certificate**. -![Certificate Path.](images/aadj/certlm-cert-path-tab.png) +![Certificate Path](images/aadj/certlm-cert-path-tab.png) 5. In the new **Certificate** dialog box, click the **Details** tab. Click **Copy to File**. -![Details tab and copy to file.](images/aadj/certlm-root-cert-details-tab.png) +![Details tab and copy to file](images/aadj/certlm-root-cert-details-tab.png) 6. In the **Certificate Export Wizard**, click **Next**. 7. On the **Export File Format** page of the wizard, click **Next**. 8. On the **File to Export** page in the wizard, type the name and location of the root certificate and click **Next**. Click **Finish** and then click **OK** to close the success dialog box. -![Export root certificate.](images/aadj/certlm-export-root-certificate.png) +![Export root certificate](images/aadj/certlm-export-root-certificate.png) 9. Click **OK** two times to return to the **Certificate Manager** for the local computer. Close the **Certificate Manager**. ### Create and Assign a Trust Certificate Device Configuration Profile @@ -291,12 +291,12 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted 1. Sign-in to the [Microsoft Azure Portal](https://portal.azure.com) and select **Microsoft Intune**. 2. Click **Device configuration**. In the **Device Configuration** blade, click **Create profile**. -![Intune Create Profile.](images/aadj/intune-create-device-config-profile.png) +![Intune Create Profile](images/aadj/intune-create-device-config-profile.png) 3. In the **Create profile** blade, type **Enterprise Root Certificate** in **Name**. Provide a description. Select **Windows 10 and later** from the **Platform** list. Select **Trusted certificate** from the **Profile type** list. Click **Configure**. 4. In the **Trusted Certificate** blade, use the folder icon to browse for the location of the enterprise root certificate file you created in step 8 of [Export Enterprise Root certificate](#export-enterprise-root-certificate). Click **OK**. Click **Create**. -![Intune Trusted Certificate Profile.](images/aadj/intune-create-trusted-certificate-profile.png) +![Intune Trusted Certificate Profile](images/aadj/intune-create-trusted-certificate-profile.png) 5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. -![Intune Profile assignment.](images/aadj/intune-device-config-enterprise-root-assignment.png) +![Intune Profile assignment](images/aadj/intune-device-config-enterprise-root-assignment.png) 6. Sign out of the Microsoft Azure Portal. > [!NOTE] > After the creation, the **supported platform** parameter of the profile will contain the value "Windows 8.1 and later", as the certificate configuration for Windows 8.1 and Windows 10 is the same. @@ -310,7 +310,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Choose **Enroll devices**. 4. Select **Windows enrollment**. 5. Under **Windows enrollment**, select **Windows Hello for Business**. - ![Create Windows Hello for Business Policy.](images/aadj/MEM.png) + ![Create Windows Hello for Business Policy](images/aadj/MEM.png) 6. Select **Enabled** from the **Configure Windows Hello for Business** list. 7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys. 8. Enter the desired **Minimum PIN length** and **Maximum PIN length**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index e4ada9da90..b8ce7af3da 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -82,7 +82,7 @@ The easiest way to verify the onPremisesDistingushedNamne attribute is synchroni 2. Click **Login** and provide Azure credentials 3. In the Azure AD Graph Explorer URL, type https://graph.windows.net/myorganization/users/[userid], where **[userid]** is the user principal name of user in Azure Active Directory. Click **Go** 4. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and the value is accurate for the given user. - ![Azure AD Connect On-Prem DN Attribute.](images/aadjcert/aadconnectonpremdn.png) + ![Azure AD Connect On-Prem DN Attribute](images/aadjcert/aadconnectonpremdn.png) ## Prepare the Network Device Enrollment Services (NDES) Service Account @@ -259,15 +259,15 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 1. Open **Server Manager** on the NDES server. 2. Click **Manage**. Click **Add Roles and Features**. 3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, click **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Click **Next**. Click **Select a server from the server pool**. Select the local server from the **Server Pool** list. Click **Next**. - ![Server Manager destination server.](images/aadjCert/servermanager-destination-server-ndes.png) + ![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) 4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. - ![Server Manager AD CS Role.](images/aadjCert/servermanager-adcs-role.png) + ![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. - ![Server Manager Add Features.](images/aadjcert/serverManager-adcs-add-features.png) + ![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) 5. On the **Features** page, expand **.NET Framework 3.5 Features**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Expand **.NET Framework 4.5 Features**. Expand **WCF Services**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. - ![Server Manager Feature HTTP Activation.](images/aadjcert/servermanager-adcs-http-activation.png) + ![Server Manager Feature HTTP Activation](images/aadjcert/servermanager-adcs-http-activation.png) 6. On the **Select role services** page, clear the **Certificate Authority** check box. Select the **Network Device Enrollment Service**. Click **Add Features** on the **Add Roles and Features Wizard** dialog box. Click **Next**. - ![Server Manager ADCS NDES Role.](images/aadjcert/servermanager-adcs-ndes-role-checked.png) + ![Server Manager ADCS NDES Role](images/aadjcert/servermanager-adcs-ndes-role-checked.png) 7. Click **Next** on the **Web Server Role (IIS)** page. 8. On the **Select role services** page for the Web Serve role, Select the following additional services if they are not already selected and then click **Next**. * **Web Server > Security > Request Filtering** @@ -275,11 +275,11 @@ Sign-in to the certificate authority or management workstations with an _Enterpr * **Web Server > Application Development > ASP.NET 4.5**. . * **Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility** * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** - ![Server Manager Web Server Role.](images/aadjcert/servermanager-adcs-webserver-role.png) + ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. > [!IMPORTANT] > .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ - ![.NET Side by Side.](images/aadjcert/dotNet35sidebyside.png) + ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) ### Configure the NDES service account This task adds the NDES service account to the local IIS_USRS group. The task also configures the NDES service account for Kerberos authentication and delegation @@ -308,7 +308,7 @@ Sign-in the NDES server with access equivalent to _Domain Admins_. > [!NOTE] > If you use the same service account for multiple NDES Servers, repeat the following task for each NDES server under which the NDES service runs. -![Set SPN command prompt.](images/aadjcert/setspn-commandprompt.png) +![Set SPN command prompt](images/aadjcert/setspn-commandprompt.png) #### Configure the NDES Service account for delegation The NDES service enrolls certificates on behalf of users. Therefore, you want to limit the actions it can perform on behalf of the user. You do this through delegation. @@ -317,16 +317,16 @@ Sign-in a domain controller with a minimum access equivalent to _Domain Admins_. 1. Open **Active Directory Users and Computers** 2. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Click the **Delegation** tab. - ![NDES Delegation Tab.](images/aadjcert/ndessvcdelegationtab.png) + ![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) 3. Select **Trust this user for delegation to specified services only**. 4. Select **Use any authentication protocol**. 5. Click **Add**. 6. Click **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Avaiable services** list, select **HOST**. Click **OK**. - ![NDES Service delegation to NDES host.](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) + ![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) 7. Repeat steps 5 and 6 for each NDES server using this service account. Click **Add**. 8. Click **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Click **OK**. 9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates. - ![NDES Service delegation complete.](images/aadjcert/ndessvcdelegation-host-ca-spn.png) + ![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) 10. Click **OK**. Close **Active Directory Users and Computers**. ### Configure the NDES Role and Certificate Templates @@ -338,21 +338,21 @@ Sign-in to the certificate authority or management workstations with an _Enterpr > [!NOTE] > If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. -![Server Manager Post-Install Yellow flag.](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) +![Server Manager Post-Install Yellow flag](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) 1. Click the **Configure Active Directory Certificate Services on the destination server** link. 2. On the **Credentials** page, click **Next**. - ![NDES Installation Credentials.](images/aadjcert/ndesconfig01.png) + ![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) 3. On the **Role Services** page, select **Network Device Enrollment Service** and then click **Next** - ![NDES Role Services.](images/aadjcert/ndesconfig02.png) + ![NDES Role Services](images/aadjcert/ndesconfig02.png) 4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. - ![NDES Service Account for NDES.](images/aadjcert/ndesconfig03b.png) + ![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) 5. On the **CA for NDES** page, select **CA name**. Click **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Click **Next**. - ![NDES CA selection.](images/aadjcert/ndesconfig04.png) + ![NDES CA selection](images/aadjcert/ndesconfig04.png) 6. On the **RA Information**, click **Next**. 7. On the **Cryptography for NDES** page, click **Next**. 8. Review the **Confirmation** page. Click **Configure**. - ![NDES Confirmation.](images/aadjcert/ndesconfig05.png) + ![NDES Confirmation](images/aadjcert/ndesconfig05.png) 8. Click **Close** after the configuration completes. #### Configure Certificate Templates on NDES @@ -407,18 +407,18 @@ Sign-in a workstation with access equivalent to a _domain user_. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Download connector service**. Click **Accept terms & Download**. Save the file (AADApplicationProxyConnectorInstaller.exe) in a location accessible by others on the domain. - ![Azure Application Proxy Connectors.](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) + ![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) 5. Sign-in the computer that will run the connector with access equivalent to a _domain user_. > [!IMPORTANT] > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategically locate Azure AD application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. 6. Start **AADApplicationProxyConnectorInstaller.exe**. 7. Read the license terms and then select **I agree to the license terms and conditions**. Click **Install**. - ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-01.png) + ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-01.png) 8. Sign-in to Microsoft Azure with access equivalent to **Global Administrator**. - ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-02.png) + ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-02.png) 9. When the installation completes. Read the information regarding outbound proxy servers. Click **Close**. - ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-03.png) + ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-03.png) 10. Repeat steps 5 - 10 for each device that will run the Azure AD Application Proxy connector for Windows Hello for Business certificate deployments. #### Create a Connector Group @@ -427,9 +427,9 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/) with access equivalent to **Global Administrator**. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. - ![Azure Application Proxy Connector groups.](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) + ![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) 4. Click **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**. - ![Azure Application New Connector Group.](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) + ![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) 5. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests. 6. Click **Save**. @@ -443,7 +443,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL. 6. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. 7. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). - ![Azure NDES Application Proxy Configuration.](images/aadjcert/azureconsole-appproxyconfig.png) + ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. 10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. @@ -465,7 +465,7 @@ Sign-in the NDES server with access equivalent to _local administrators_. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Click **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Click **Add**. Click **OK** when finished. 9. Click **Enroll** @@ -478,12 +478,12 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. - ![NDES IIS Console.](images/aadjcert/ndes-iis-console.png) + ![NDES IIS Console](images/aadjcert/ndes-iis-console.png) 3. Click **Bindings...*** under **Actions**. Click **Add**. - ![NDES IIS Console.](images/aadjcert/ndes-iis-bindings.png) + ![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) 4. Select **https** from **Type**. Confirm the value for **Port** is **443**. 5. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**. - ![NDES IIS Console.](images/aadjcert/ndes-iis-bindings-add-443.png) + ![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) 6. Select **http** from the **Site Bindings** list. Click **Remove**. 7. Click **Close** on the **Site Bindings** dialog box. 8. Close **Internet Information Services (IIS) Manager**. @@ -509,10 +509,10 @@ Sign-in the NDES server with access equivalent to _local administrator_. A web page similar to the following should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. -![NDES IIS Console.](images/aadjcert/ndes-https-website-test-01.png) +![NDES IIS Console](images/aadjcert/ndes-https-website-test-01.png) Confirm the web site uses the server authentication certificate. -![NDES IIS Console.](images/aadjcert/ndes-https-website-test-01-show-cert.png) +![NDES IIS Console](images/aadjcert/ndes-https-website-test-01-show-cert.png) ## Configure Network Device Enrollment Services to work with Microsoft Intune @@ -527,7 +527,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. 3. In the content pane, double-click **Request Filtering**. Click **Edit Feature Settings...** in the action pane. - ![Intune NDES Request filtering.](images/aadjcert/NDES-IIS-RequestFiltering.png) + ![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) 4. Select **Allow unlisted file name extensions**. 5. Select **Allow unlisted verbs**. 6. Select **Allow high-bit characters**. @@ -554,7 +554,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. 3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. - ![Intune Certificate Authority.](images/aadjcert/profile01.png) + ![Intune Certificate Authority](images/aadjcert/profile01.png) 4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. 5. Sign-out of the Microsoft Endpoint Manager admin center. @@ -564,26 +564,26 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server. 2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server. 3. On the **Microsoft Intune** page, click **Next**. - ![Intune Connector Install 01.](images/aadjcert/intunecertconnectorinstall-01.png) + ![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) 4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation. 5. On the **Destination Folder** page, click **Next**. 6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**. - ![Intune Connector Install 03.](images/aadjcert/intunecertconnectorinstall-03.png) + ![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) 7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. - ![Intune Connector Install 05.](images/aadjcert/intunecertconnectorinstall-05.png) + ![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) > [!NOTE] > The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. 8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**. 9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**. - ![Intune Connector Install 06.](images/aadjcert/intunecertconnectorinstall-06.png) + ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) > [!NOTE] > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder. 10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. - ![Intune Connector install 07.](images/aadjcert/intunecertconnectorinstall-07.png) + ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) ### Configure the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. @@ -594,10 +594,10 @@ Sign-in the NDES server with access equivalent to _domain administrator_. > If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. 2. If your organization uses a proxy server and the proxy is needed for the NDES server to access the Internet, select **Use proxy server**, and then enter the proxy server name, port, and credentials to connect. Click **Apply** - ![Intune Certificate Connector Configuration 01.](images/aadjcert/intunecertconnectorconfig-01.png) + ![Intune Certificate Connector Configuration 01](images/aadjcert/intunecertconnectorconfig-01.png) 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. - ![Intune Certificate Connector Configuration 02.](images/aadjcert/intunecertconnectorconfig-02.png) + ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) > [!IMPORTANT] > The user account must have a valid Intune license assigned. If the user account does not have a valid Intune license, the sign-in fails. @@ -614,7 +614,7 @@ Sign-in the certificate authority used by the NDES Connector with access equival 1. Start the **Certification Authority** management console. 2. In the navigation pane, right-click the name of the certificate authority and select **Properties**. 3. Click the **Security** tab. Click **Add**. In **Enter the object names to select** box, type **NDESSvc** (or the name you gave the NDES Service account). Click *Check Names*. Click **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Click **OK**. - ![Configure Intune certificate revocation 02.](images/aadjcert/intuneconfigcertrevocation-02.png) + ![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) 4. Close the **Certification Authority** #### Enable the NDES Connector for certificate revocation @@ -622,7 +622,7 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Open the **NDES Connector** user interface (**\\NDESConnectorUI\NDESConnectorUI.exe**). 2. Click the **Advanced** tab. Select **Specify a different account username and password**. Type the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. - ![Intune Connector cert revocation configuration 04.](images/aadjcert/intunecertconnectorconfig-04.png) + ![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) 3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**. ### Test the NDES Connector @@ -641,7 +641,7 @@ Sign-in the NDES server with access equivalent to _domain admin_. ``` where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. - ![NDES web site test after Intune Certificate Connector.](images/aadjcert/ndes-https-website-test-after-intune-connector.png) + ![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) 6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**. ## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile @@ -656,7 +656,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Group Name**, type the name of the group. For example, **AADJ WHFB Certificate Users**. 6. Provide a **Group description**, if applicable. 7. Select **Assigned** from the **Membership type** list. - ![Azure AD new group creation.](images/aadjcert/azureadcreatewhfbcertgroup.png) + ![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. @@ -666,7 +666,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Devices**, and then click **Configuration Profiles**. 3. Select **Create Profile**. - ![Intune Device Configuration Create Profile.](images/aadjcert/profile02.png) + ![Intune Device Configuration Create Profile](images/aadjcert/profile02.png) 4. Select **Windows 10 and later** from the **Platform** list. 5. Choose **SCEP certificate** from the **Profile** list, and select **Create**. 6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. @@ -689,7 +689,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. 15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. 16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. - ![WHFB SCEP certificate Profile EKUs.](images/aadjcert/profile03.png) + ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) 17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. 18. Click **Next**. 19. Click **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and click **Create**. @@ -702,7 +702,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Click **WHFB Certificate Enrollment**. 4. Select **Properties**, and then click **Edit** next to the **Assignments** section. 5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. - ![WHFB SCEP Profile Assignment.](images/aadjcert/profile04.png) + ![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) 6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. 7. Click **Review + Save**, and then **Save**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 9e100bc146..e80dc75f72 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -70,7 +70,7 @@ To locate the schema master role holder, open and command prompt and type: ```Netdom query fsmo | findstr -i schema``` -![Netdom example output.](images/hello-cmd-netdom.png) +![Netdom example output](images/hello-cmd-netdom.png) The command should return the name of the domain controller where you need to run adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. @@ -114,14 +114,14 @@ When you are ready to install, follow the **Configuring federation with AD FS** ### Create AD objects for AD FS Device Authentication If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration. -![Device Registration.](images/hybridct/device1.png) +![Device Registration](images/hybridct/device1.png) > [!NOTE] > The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1. 1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**. -![Device Registration.](images/hybridct/device2.png) +![Device Registration](images/hybridct/device2.png) 2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: @@ -132,7 +132,7 @@ If your AD FS farm is not already configured for Device Authentication (you can > [!NOTE] > If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$" -![Device Registration.](images/hybridct/device3.png) +![Device Registration](images/hybridct/device3.png) The above PSH creates the following objects: @@ -140,11 +140,11 @@ The above PSH creates the following objects: - Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration - Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration -![Device Registration.](images/hybridct/device4.png) +![Device Registration](images/hybridct/device4.png) 4. Once this is done, you will see a successful completion message. -![Device Registration.](images/hybridct/device5.png) +![Device Registration](images/hybridct/device5.png) ### Create Service Connection Point (SCP) in Active Directory If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS @@ -155,13 +155,13 @@ If you plan to use Windows 10 domain join (with automatic registration to Azure > [!NOTE] > If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep -![Device Registration.](images/hybridct/device6.png) +![Device Registration](images/hybridct/device6.png) 2. Provide your Azure AD global administrator credentials `PS C:>$aadAdminCred = Get-Credential` -![Device Registration.](images/hybridct/device7.png) +![Device Registration](images/hybridct/device7.png) 3. Run the following PowerShell command @@ -517,7 +517,7 @@ For your reference, below is a comprehensive list of the AD DS devices, containe - Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - Container Device Registration Service DKM under the above container -![Device Registration.](images/hybridct/device8.png) +![Device Registration](images/hybridct/device8.png) - object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - read/write access to the specified AD connector account name on the new object diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index 35bd16ed3e..cfaf049efd 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -27,22 +27,22 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358 from User Device Registration log showing Windows Hello for Business prerequisite check result.](images/Event358.png) +![Event358 from User Device Registration log showing Windows Hello for Business prerequisite check result](images/Event358.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. -![Setup a PIN Provisioning.](images/setupapin.png) +![Setup a PIN Provisioning](images/setupapin.png) The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. -![MFA prompt during provisioning.](images/mfa.png) +![MFA prompt during provisioning](images/mfa.png) After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. -![Create a PIN during provisioning.](images/createPin.png) +![Create a PIN during provisioning](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index e60e0b15f0..9caf362da6 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -27,22 +27,22 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358.](images/Event358-2.png) +![Event358](images/Event358-2.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. -![Setup a PIN Provisioning.](images/setupapin.png) +![Setup a PIN Provisioning](images/setupapin.png) The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. -![MFA prompt during provisioning.](images/mfa.png) +![MFA prompt during provisioning](images/mfa.png) After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. -![Create a PIN during provisioning.](images/createPin.png) +![Create a PIN during provisioning](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 4e83f31ec3..99491fb5c3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -73,7 +73,7 @@ Sign-in the federation server with domain administrator equivalent credentials. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. 9. Click **Enroll**. @@ -155,7 +155,7 @@ Use the following procedures to configure AD FS when your environment uses **Win Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) + ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. @@ -175,7 +175,7 @@ Use the following procedures to configure AD FS when your environment uses **Win Sign-in the federation server with _Domain Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) + ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. @@ -262,7 +262,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. 8. Click **Install** to start the feature installation - ![Feature selection screen with NLB selected.](images/hello-nlb-feature-install.png) + ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -270,25 +270,25 @@ Before you can load balance all the nodes in the AD FS farm, you must first crea Sign-in a node of the federation farm with _Admin_ equivalent credentials. 1. Open **Network Load Balancing Manager** from **Administrative Tools**. - ![NLB Manager user interface.](images/hello-nlb-manager.png) + ![NLB Manager user interface](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. 3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. - ![NLB Manager - Connect to new Cluster screen.](images/hello-nlb-connect.png) + ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. 6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. - ![NLB Manager - Add IP to New Cluster screen.](images/hello-nlb-add-ip.png) + ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) 7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. - ![NLB Manager - Cluster IP Configuration screen.](images/hello-nlb-cluster-ip-config.png) + ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. 9. In Port Rules, click Edit to modify the default port rules to use port 443. - ![NLB Manager - Add\Edit Port Rule screen.](images/hello-nlb-cluster-port-rule.png) + ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. 2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. - ![NLB Manager - Cluster with nodes.](images/hello-nlb-cluster.png) + ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 1a2b17c308..00fa16c254 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -69,7 +69,7 @@ In Windows 10, Windows Hello replaces passwords. When the identity provider sup >[!NOTE] >Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password. -![How authentication works in Windows Hello.](images/authflow.png) +![How authentication works in Windows Hello](images/authflow.png) Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index e7d6a0cea8..3ff85f511f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -35,11 +35,11 @@ People who are currently using virtual or physical smart cards for authenticatio When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. -![who owns this pc.](images/corpown.png) +![who owns this pc](images/corpown.png) Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. -![choose how you'll connect.](images/connect.png) +![choose how you'll connect](images/connect.png) They sign in, and are then asked to verify their identity. People have options to choose from a text message, phone call, or the authentication application. After verification, they create their PIN. The **Create a PIN** screen displays any complexity requirements that you have set, such as minimum length. @@ -55,7 +55,7 @@ People can go to **Settings** > **Accounts** > **Work or school**, select If your policy allows it, people can use biometrics (fingerprint, iris, and facial recognition) with Windows Hello for Business, if the hardware supports it. -![sign in to windows, apps, and services using fingerprint or face.](images/hellosettings.png) +![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 2b1c101fc0..87e71bc747 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -21,7 +21,7 @@ ms.reviewer: ## Four steps to password freedom Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password freedom. -![Passwordless approach.](images/four-steps-passwordless.png) +![Passwordless approach](images/four-steps-passwordless.png) ### 1. Develop a password replacement offering @@ -203,24 +203,24 @@ Windows provides two ways to prevent your users from using passwords. You can us ##### Security Policy You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. -![securityPolicyLocation.](images/passwordless/00-securityPolicy.png) +![securityPolicyLocation](images/passwordless/00-securityPolicy.png) **Windows Server 2016 and earlier** The policy name for these operating systems is **Interactive logon: Require smart card**. -![securityPolicyBefore2016.](images/passwordless/00-securitypolicy-2016.png) +![securityPolicyBefore2016](images/passwordless/00-securitypolicy-2016.png) **Windows 10, version 1703 or later using Remote Server Administrator Tools** The policy name for these operating systems is **Interactive logon: Require Windows Hello for Business or smart card**. -![securityPolicyRSAT.](images/passwordless/00-updatedsecuritypolicytext.png) +![securityPolicyRSAT](images/passwordless/00-updatedsecuritypolicytext.png) When you enable this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. #### Excluding the password credential provider You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > System > Logon** -![HideCredProvPolicy.](images/passwordless/00-hidecredprov.png) +![HideCredProvPolicy](images/passwordless/00-hidecredprov.png) The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. -![HideCredProvPolicy2.](images/passwordless/01-hidecredprov.png) +![HideCredProvPolicy2](images/passwordless/01-hidecredprov.png) Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. @@ -261,7 +261,7 @@ The account options on a user account includes an option -- **Smart card is requ > [!NOTE] > Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. -![SCRIL setting on AD Users and Computers.](images/passwordless/00-scril-dsa.png) +![SCRIL setting on AD Users and Computers](images/passwordless/00-scril-dsa.png) **SCRIL setting for a user on Active Directory Users and Computers.** When you configure a user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users are effectively passwordless because: @@ -270,13 +270,13 @@ When you configure a user account for SCRIL, Active Directory changes the affect - the user is not asked to change their password - domain controllers do not allow passwords for interactive authentication -![SCRIL setting from ADAC on Windows Server 2012.](images/passwordless/01-scril-adac-2012.png) +![SCRIL setting from ADAC on Windows Server 2012](images/passwordless/01-scril-adac-2012.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2012.** > [!NOTE] > Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. -![SCRIL setting from ADAC on Windows Server 2016.](images/passwordless/01-scril-adac-2016.png) +![SCRIL setting from ADAC on Windows Server 2016](images/passwordless/01-scril-adac-2016.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2016.** > [!NOTE] @@ -286,7 +286,7 @@ When you configure a user account for SCRIL, Active Directory changes the affect Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for SCRIL-enabled users by configuring the domain to automatically change the password for SCRIL users. In this configuration, passwords for SCRIL-configured users expire based on Active Directory password policy settings. When the SCRIL user authenticates from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or any authentication outages. -![Rotate Password 2016.](images/passwordless/02-rotate-scril-2016.png) +![Rotate Password 2016](images/passwordless/02-rotate-scril-2016.png) > [!NOTE] > Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability by reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 2ad3bb1f3b..5e24e71b64 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -54,7 +54,7 @@ It’s important to keep in mind that there are no physical containers on disk, The container actually contains a set of keys, some of which are used to protect other keys. The following image shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. -![Each logical container holds one or more sets of keys.](../images/passport-fig3-logicalcontainer.png) +![Each logical container holds one or more sets of keys](../images/passport-fig3-logicalcontainer.png) Containers can contain several types of key material: diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 65fa656745..57bbf194fc 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -34,13 +34,13 @@ Administrator credentials are highly privileged and must be protected. By using The following diagram helps you to understand how a standard Remote Desktop session to a server without Windows Defender Remote Credential Guard works: -![RDP connection to a server without Windows Defender Remote Credential Guard.png.](images/rdp-to-a-server-without-windows-defender-remote-credential-guard.png) +![RDP connection to a server without Windows Defender Remote Credential Guard.png](images/rdp-to-a-server-without-windows-defender-remote-credential-guard.png)
The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) option: -![Windows Defender Remote Credential Guard.](images/windows-defender-remote-credential-guard-with-remote-admin-mode.png) +![Windows Defender Remote Credential Guard](images/windows-defender-remote-credential-guard-with-remote-admin-mode.png)
As illustrated, Windows Defender Remote Credential Guard blocks NTLM (allowing only Kerberos), prevents Pass-the-Hash (PtH) attacks, and also prevents use of credentials after disconnection. @@ -152,7 +152,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C 2. Double-click **Restrict delegation of credentials to remote servers**. - ![Windows Defender Remote Credential Guard Group Policy.](images/remote-credential-guard-gp.png) + ![Windows Defender Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) 3. Under **Use the following restricted mode**: diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index d5c9651f0f..635a9631d6 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -34,7 +34,7 @@ Smart card support is required to enable many Remote Desktop Services scenarios. In a Remote Desktop scenario, a user is using a remote server for running services, and the smart card is local to the computer that the user is using. In a smart card sign-in scenario, the smart card service on the remote server redirects to the smart card reader that is connected to the local computer where the user is trying to sign in. -![Smart card service redirects to smart card reader.](images/sc-image101.png) +![Smart card service redirects to smart card reader](images/sc-image101.png) **Remote Desktop redirection** diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 63cbad9b26..0663f9a479 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -52,7 +52,7 @@ Interactive sign-in in Windows begins when the user presses CTRL+ALT+DEL. The CT After receiving the SAS, the UI then generates the sign-in tile from the information received from the registered credential providers. The following graphic shows the architecture for credential providers in the Windows operating system. -![Credential provider architecture.](images/sc-image201.gif) +![Credential provider architecture](images/sc-image201.gif) **Figure 1**  **Credential provider architecture** @@ -88,7 +88,7 @@ Vendors provide smart cards and smart card readers, and in many cases the vendor Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Card Base Cryptographic Service Provider (Base CSP), and smart card minidrivers. -![Base CSP and smart card minidriver architecture.](images/sc-image203.gif) +![Base CSP and smart card minidriver architecture](images/sc-image203.gif) **Figure 2**  **Base CSP and smart card minidriver architecture** @@ -236,7 +236,7 @@ Applications can call the Base CSP with CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL, set In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or click **Cancel**. If the user cancels the operation, the operation fails. The flow chart in Figure 3 shows the selection steps performed by the Windows operating system. -![Smart card selection process.](images/sc-image205.png) +![Smart card selection process](images/sc-image205.png) **Figure 3**  **Smart card selection behavior** @@ -314,7 +314,7 @@ For other operations, the caller may be able to acquire a "verify" context again Figure 4 shows the Cryptography architecture that is used by the Windows operating system. -![Cryptography architecture.](images/sc-image206.gif) +![Cryptography architecture](images/sc-image206.gif) **Figure 4**  **Cryptography architecture** diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index dbcf86ee67..ae671b4ace 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -38,7 +38,7 @@ The following figure shows the flow of the certificate propagation service. The **Certificate propagation service** -![Certificate propagation service.](images/sc-image302.gif) +![Certificate propagation service](images/sc-image302.gif) 1. A signed-in user inserts a smart card. diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index a220e7e658..ef209588b9 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -89,7 +89,7 @@ If you enable the **Allow signature keys valid for Logon** credential provider p The following diagram illustrates how smart card sign-in works in the supported versions of Windows. -![Smart card sign-in flow.](images/sc-image402.png) +![Smart card sign-in flow](images/sc-image402.png) **Smart card sign-in flow** @@ -206,21 +206,21 @@ SSL/TLS can map certificates that do not have SAN, and the mapping is done by us **Certificate revocation list distribution points** -![Certificate revocation list distribution points.](images/sc-image403.png) +![Certificate revocation list distribution points](images/sc-image403.png) **UPN in Subject Alternative Name field** -![UPN in Subject Alternative Name field.](images/sc-image404.png) +![UPN in Subject Alternative Name field](images/sc-image404.png) **Subject and Issuer fields** -![Subject and Issuer fields.](images/sc-image405.png) +![Subject and Issuer fields](images/sc-image405.png) This account mapping is supported by the KDC in addition to six other mapping methods. The following figure demonstrates a flow of user account mapping logic that is used by the KDC. **High-level flow of certificate processing for sign-in** -![High-level flow of certificate processing for sign-in.](images/sc-image406.png) +![High-level flow of certificate processing for sign-in](images/sc-image406.png) The certificate object is parsed to look for content to perform user account mapping. @@ -236,7 +236,7 @@ The following figure illustrates the process of mapping user accounts for sign-i **Certificate processing logic** -![Certificate processing logic.](images/sc-image407.png) +![Certificate processing logic](images/sc-image407.png) NT\_AUTH policy is best described in the CERT\_CHAIN\_POLICY\_NT\_AUTH parameter section of the CertVerifyCertificateChainPolicy function. For more information, see [CertVerifyCertificateChainPolicy](/windows/win32/api/wincrypt/nf-wincrypt-certverifycertificatechainpolicy). diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index 3f72307e25..fa36cf563f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -26,7 +26,7 @@ The smart card removal policy service is applicable when a user has signed in wi **Smart card removal policy service** -![Smart card removal policy service.](images/sc-image501.gif) +![Smart card removal policy service](images/sc-image501.gif) The numbers in the previous figure represent the following actions: diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 76159c664d..10ffd31a84 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -34,7 +34,7 @@ In order to better understand how this process happens, let's look at the Window The following shows how the logon process for an administrator differs from the logon process for a standard user. -![uac windows logon process.](images/uacwindowslogonprocess.gif) +![uac windows logon process](images/uacwindowslogonprocess.gif) By default, standard users and administrators access resources and run apps in the security context of standard users. When a user logs on to a computer, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. @@ -56,7 +56,7 @@ With UAC enabled, Windows 10 prompts for consent or prompts for credentials of The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. -![uac consent prompt.](images/uacconsentprompt.gif) +![uac consent prompt](images/uacconsentprompt.gif) **The credential prompt** @@ -64,7 +64,7 @@ The credential prompt is presented when a standard user attempts to perform a ta The following is an example of the UAC credential prompt. -![uac credential prompt.](images/uaccredentialprompt.gif) +![uac credential prompt](images/uaccredentialprompt.gif) **UAC elevation prompts** @@ -81,7 +81,7 @@ The elevation prompt color-coding is as follows: Some Control Panel items, such as **Date and Time Properties**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screen shot of the **Date and Time Properties** Control Panel item. -![uac shield icon.](images/uacshieldicon.png) +![uac shield icon](images/uacshieldicon.png) The shield icon on the **Change date and time** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. @@ -99,7 +99,7 @@ While malware could present an imitation of the secure desktop, this issue canno The following diagram details the UAC architecture. -![uac architecture.](images/uacarchitecture.gif) +![uac architecture](images/uacarchitecture.gif) To better understand each component, review the table below: diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index 4468785ff0..badf574468 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -24,7 +24,7 @@ This topic for the IT professional discusses the factors to consider when you de Traditional identity devices, such as physical smart cards, follow a predictable lifecycle in any deployment, as shown in the following diagram. -![Diagram of physical smart card lifecycle.](images/vsc-physical-smart-card-lifecycle.png) +![Diagram of physical smart card lifecycle](images/vsc-physical-smart-card-lifecycle.png) Physical devices are created by a dedicated manufacturer and then purchased by the corporation that will ultimately deploy it. The device passes through the personalization stage, where its unique properties are set. In smart cards, these properties are the administrator key, Personal Identification Number (PIN), PIN Unlock Key (PUK), and its physical appearance. To provision the device, it is loaded with the required certificates, such as a sign-in certificate. After you provision the device, it is ready for use. The device must simply be maintained. For example, you must replace cards when they are lost or stolen and reset PINs when users forget them. Finally, you’ll retire devices when they exceed their intended lifetime or when employees leave the company. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index 044f7c1fe1..6fb462eb81 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -28,7 +28,7 @@ A crucial aspect of TPM virtual smart cards is their ability to securely store a The following diagram illustrates the secure key hierarchy and the process of accessing the user key. -![Diagram of the process of accessing the user key.](images/vsc-process-of-accessing-user-key.png) +![Diagram of the process of accessing the user key](images/vsc-process-of-accessing-user-key.png) The following keys are stored on the hard disk: diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index c6ad4e0710..6810a79d95 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -62,21 +62,21 @@ On your domain server, you need to create a template for the certificate that yo 2. Click **File**, and then click **Add/Remove Snap-in**. - ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) + ![Add or remove snap-in](images/vsc-02-mmc-add-snap-in.png) 3. In the available snap-ins list, click **Certificate Templates**, and then click **Add**. - ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) + ![Add Certificate Templates snap-in](images/vsc-03-add-certificate-templates-snap-in.png) 4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. 5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. - ![Duplicating the Smartcard Logon template.](images/vsc-04-right-click-smartcard-logon-template.png) + ![Duplicating the Smartcard Logon template](images/vsc-04-right-click-smartcard-logon-template.png) 6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. - ![Compatibility tab, certification authority setting.](images/vsc-05-certificate-template-compatibility.png) + ![Compatibility tab, certification authority setting](images/vsc-05-certificate-template-compatibility.png) 7. On the **General** tab: @@ -102,23 +102,23 @@ On your domain server, you need to create a template for the certificate that yo 12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. - ![Add Certification Authority snap-in.](images/vsc-06-add-certification-authority-snap-in.png) + ![Add Certification Authority snap-in](images/vsc-06-add-certification-authority-snap-in.png) 13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. 14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. - ![Right-click menu for Certificate Templates.](images/vsc-07-right-click-certificate-templates.png) + ![Right-click menu for Certificate Templates](images/vsc-07-right-click-certificate-templates.png) 15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. > **Note**  It can take some time for your template to replicate to all servers and become available in this list. - ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) + ![Selecting a certificate template](images/vsc-08-enable-certificate-template.png) 16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. - ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) + ![Stopping and starting the service](images/vsc-09-stop-service-start-service.png) ## Step 2: Create the TPM virtual smart card @@ -128,7 +128,7 @@ In this step, you will create the virtual smart card on the client computer by u 1. On a domain-joined computer, open a Command Prompt window with Administrative credentials. - ![Cmd prompt, Run as administrator.](images/vsc-10-cmd-run-as-administrator.png) + ![Cmd prompt, Run as administrator](images/vsc-10-cmd-run-as-administrator.png) 2. At the command prompt, type the following, and then press ENTER: @@ -150,11 +150,11 @@ The virtual smart card must be provisioned with a sign-in certificate for it to 2. Right-click **Personal**, click **All Tasks**, and then click **Request New Certificate**. - ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) + ![Request New Certificate](images/vsc-11-certificates-request-new-certificate.png) 3. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1). - ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) + ![Certificate enrollment, select certificate](images/vsc-12-certificate-enrollment-select-certificate.png) 4. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)**. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 4d3f59ff0a..789da743aa 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -74,7 +74,7 @@ For more information about these Windows APIs, see: To help users visually distinguish a Trusted Platform Module (TPM)-based virtual smart card from physical smart cards, the virtual smart card has a different icon. The following icon is displayed during sign in, and on other screens that require the user to enter the PIN for a virtual smart card. -![Icon for a virtual smart card.](images/vsc-virtual-smart-card-icon.png) +![Icon for a virtual smart card](images/vsc-virtual-smart-card-icon.png) A TPM-based virtual smart card is labeled **Security Device** in the user interface. diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 2c0a581e8d..9665848076 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -51,7 +51,7 @@ See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EA The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). -![EAP XML configuration in Intune profile.](images/vpn-eap-xml.png) +![EAP XML configuration in Intune profile](images/vpn-eap-xml.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 44b05da541..2c1405d9e0 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -89,11 +89,11 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune. -![Add an app for the VPN connection.](images/vpn-app-trigger.png) +![Add an app for the VPN connection](images/vpn-app-trigger.png) After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. -![Configure rules for the app.](images/vpn-app-rules.png) +![Configure rules for the app](images/vpn-app-rules.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 66baa88e46..393bf3b90b 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -87,7 +87,7 @@ Two client-side configuration service providers are leveraged for VPN device com The VPN client side connection flow works as follows: > [!div class="mx-imgBorder"] -> ![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) +> ![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index 465f79924f..e65b9b6d8b 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -23,7 +23,7 @@ Virtual private networks (VPNs) are point-to-point connections across a private There are many options for VPN clients. In Windows 10, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. -![VPN connection types.](images/vpn-connection.png) +![VPN connection types](images/vpn-connection.png) ## Built-in VPN client @@ -67,12 +67,12 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune: > [!div class="mx-imgBorder"] -> ![Available connection types.](images/vpn-connection-intune.png) +> ![Available connection types](images/vpn-connection-intune.png) In Intune, you can also include custom XML for third-party plug-in profiles: > [!div class="mx-imgBorder"] -> ![Custom XML.](images/vpn-custom-xml-intune.png) +> ![Custom XML](images/vpn-custom-xml-intune.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index 70cec8d554..fcc360257b 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -64,7 +64,7 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune. -![Add DNS rule.](images/vpn-name-intune.png) +![Add DNS rule](images/vpn-name-intune.png) The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table. diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 96eae8c6ac..69940276c8 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -312,7 +312,7 @@ After you configure the settings that you want using ProfileXML, you can apply i 10. Set Data type to **String (XML file)**. 11. Upload the profile XML file. 12. Click **OK**. - ![Custom VPN profile.](images/custom-vpn-profile.png) + ![Custom VPN profile](images/custom-vpn-profile.png) 13. Click **OK**, then **Create**. 14. Assign the profile. diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index ea0cb1c3ae..a33e2b0f3f 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -53,11 +53,11 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration. -![split tunnel.](images/vpn-split.png) +![split tunnel](images/vpn-split.png) Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection. -![add route for split tunnel.](images/vpn-split-route.png) +![add route for split tunnel](images/vpn-split-route.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index c84ab32cb0..bd1a32dde4 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -59,7 +59,7 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune. -![Add a traffic rule.](images/vpn-traffic-rules.png) +![Add a traffic rule](images/vpn-traffic-rules.png) ## LockDown VPN diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 62a4cf6cf0..2c1a02b8db 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -31,7 +31,7 @@ This guide explains how credential theft attacks occur and the strategies and co - Respond to suspicious activity - Recover from a breach -![Security stages.](images/security-stages.png) +![Security stages](images/security-stages.png) ## Attacks that steal credentials diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index 23b9d93073..fc9b15fdef 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -89,7 +89,7 @@ On computers with a compatible TPM, operating system drives that are BitLocker-p In the following Group Policy example, TPM + PIN is required to unlock an operating system drive: -![Pre-boot authentication setting in Group Policy.](images/pre-boot-authentication-group-policy.png) +![Pre-boot authentication setting in Group Policy](images/pre-boot-authentication-group-policy.png) Pre-boot authentication with a PIN can mitigate an attack vector for devices that use a bootable eDrive because an exposed eDrive bus can allow an attacker to capture the BitLocker encryption key during startup. Pre-boot authentication with a PIN can also mitigate DMA port attacks during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port-related policies that have been configured. @@ -110,7 +110,7 @@ This Kernel DMA Protection is available only for new systems beginning with Wind You can use the System Information desktop app (MSINFO32) to check if a device has kernel DMA protection enabled: -![Kernel DMA protection.](images/kernel-dma-protection.png) +![Kernel DMA protection](images/kernel-dma-protection.png) If kernel DMA protection *not* enabled, follow these steps to protect Thunderbolt™ 3 enabled ports: diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index cd0b6543e6..4864bdf4d4 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -34,31 +34,31 @@ This article depicts the BitLocker deployment comparison chart. |Supported domain-joined status | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory joined, hybrid Azure AD joined | Active Directory joined | |Permissions required to manage policies | Endpoint security manager or custom | Full administrator or custom | Domain Admin or Delegated GPO access | |Cloud or on premises | Cloud | On premises | On premises | -|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | |Additional agent required? | No (device enrollment only) | Configuration Manager client | MBAM client | |Administrative plane | Microsoft Endpoint Manager admin center | Configuration Manager console | Group Policy Management Console and MBAM sites | -|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | -|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | +|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | |Standard recovery password storage location | Azure AD or Active Directory | Configuration Manager site database | MBAM database | |Store recovery password for operating system and fixed drives to Azure AD or Active Directory | Yes (Active Directory and Azure AD) | Yes (Active Directory only) | Yes (Active Directory only) | -|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | -|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | | -|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | -|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | +|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | | +|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index a72324edf4..eaccfb9c9f 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -298,18 +298,18 @@ This policy can be configured using GPO under **Computer Configuration** > **Adm It can also be configured using Intune mobile device management (MDM) in the BitLocker CSP: *\./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage\* -![Custom URL.](./images/bl-intune-custom-url.png) +![Custom URL](./images/bl-intune-custom-url.png) Example of customized recovery screen: -![Customized BitLocker Recovery Screen.](./images/bl-password-hint1.png) +![Customized BitLocker Recovery Screen](./images/bl-password-hint1.png) ### BitLocker recovery key hints BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. -![Customized BitLocker recovery screen.](./images/bl-password-hint2.png) +![Customized BitLocker recovery screen](./images/bl-password-hint2.png) > [!IMPORTANT] > We don't recommend printing recovery keys or saving them to a file. Instead, use Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and Microsoft Account. @@ -339,7 +339,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** The hint for the Microsoft Account and the custom URL are displayed. -![Example 1 of Customized BitLocker recovery screen.](./images/rp-example1.png) +![Example 1 of Customized BitLocker recovery screen](./images/rp-example1.png) #### Example 2 (single recovery key with single backup) @@ -354,7 +354,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the custom URL is displayed. -![Example 2 of customized BitLocker recovery screen.](./images/rp-example2.png) +![Example 2 of customized BitLocker recovery screen](./images/rp-example2.png) #### Example 3 (single recovery key with multiple backups) @@ -369,7 +369,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the Microsoft Account hint is displayed. -![Example 3 of customized BitLocker recovery screen.](./images/rp-example3.png) +![Example 3 of customized BitLocker recovery screen](./images/rp-example3.png) #### Example 4 (multiple recovery passwords) @@ -399,7 +399,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the hint for a successfully backed up key is displayed, even if it isn't the most recent key. -![Example 4 of customized BitLocker recovery screen.](./images/rp-example4.png) +![Example 4 of customized BitLocker recovery screen](./images/rp-example4.png) #### Example 5 (multiple recovery passwords) @@ -429,7 +429,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** The hint for the most recent key is displayed. -![Example 5 of customized BitLocker recovery screen.](./images/rp-example5.png) +![Example 5 of customized BitLocker recovery screen](./images/rp-example5.png) ## Using additional recovery information diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index e8045e225c..c6483a8057 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -52,7 +52,7 @@ manage-bde -status ``` This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume: -![Using manage-bde to check encryption status.](images/manage-bde-status.png) +![Using manage-bde to check encryption status](images/manage-bde-status.png) The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md index 664fb40db0..2a08e910d0 100644 --- a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -58,7 +58,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in The output of such a command resembles the following. - ![Display of events that is produced by using Get-WinEvent and a BitLocker filter.](./images/psget-winevent-1.png) + ![Display of events that is produced by using Get-WinEvent and a BitLocker filter](./images/psget-winevent-1.png) - To export BitLocker-related information: ```ps @@ -77,7 +77,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in The output of such a command resembles the following. - ![Display of events that is produced by using Get-WinEvent and a TPM filter.](./images/psget-winevent-2.png) + ![Display of events that is produced by using Get-WinEvent and a TPM filter](./images/psget-winevent-2.png) > [!NOTE] > If you intend to contact Microsoft Support, we recommend that you export the logs listed in this section. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index 6268e09343..d41b2c7bf1 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -82,11 +82,11 @@ To verify that this issue has occurred, follow these steps: 1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring?view=powershell-6) command in the PowerShell window, as follows. - ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE.](./images/ts-bitlocker-usb-sddl.png) + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE](./images/ts-bitlocker-usb-sddl.png) If you see NT AUTHORITY\INTERACTIVE (as highlighted), in the output of this command, this is the cause of the issue. Under typical conditions, the output should resemble the following: - ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users.](./images/ts-bitlocker-usb-default-sddl.png) + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users](./images/ts-bitlocker-usb-default-sddl.png) > [!NOTE] > GPOs that change the security descriptors of services have been known to cause this issue. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index 1def746b1f..bab9c21e3e 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -45,11 +45,11 @@ To install the tool, follow these steps: 1. Accept the default installation path. - ![Specify Location page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-1.png) + ![Specify Location page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-1.png) 1. Under **Select the features you want to install**, select **Windows Hardware Lab Kit—Controller + Studio**. - ![Select features page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-2.png) + ![Select features page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-2.png) 1. Finish the installation. @@ -60,7 +60,7 @@ To use TBSLogGenerator, follow these steps: This folder contains the TBSLogGenerator.exe file. - ![Properties and location of the TBSLogGenerator.exe file.](./images/ts-tpm-3.png) + ![Properties and location of the TBSLogGenerator.exe file](./images/ts-tpm-3.png) 1. Run the following command: ```cmd @@ -78,19 +78,19 @@ To use TBSLogGenerator, follow these steps: TBSLogGenerator.exe -LF C:\MeasuredBoot\0000000005-0000000000.log > C:\MeasuredBoot\0000000005-0000000000.txt ``` - ![Command Prompt window that shows an example of how to use TBSLogGenerator.](./images/ts-tpm-4.png) + ![Command Prompt window that shows an example of how to use TBSLogGenerator](./images/ts-tpm-4.png) The command produces a text file that uses the specified name. In the case of the example, the file is **0000000005-0000000000.txt**. The file is located in the same folder as the original .log file. - ![Windows Explorer window that shows the text file that TBSLogGenerator produces.](./images/ts-tpm-5.png) + ![Windows Explorer window that shows the text file that TBSLogGenerator produces](./images/ts-tpm-5.png) The content of this text file resembles the following. -![Contents of the text file, as shown in NotePad.](./images/ts-tpm-6.png) +![Contents of the text file, as shown in NotePad](./images/ts-tpm-6.png) To find the PCR information, go to the end of the file. - ![View of NotePad that shows the PCR information at the end of the text file.](./images/ts-tpm-7.png) + ![View of NotePad that shows the PCR information at the end of the text file](./images/ts-tpm-7.png) ## Use PCPTool to decode Measured Boot logs @@ -114,4 +114,4 @@ where the variables represent the following values: The content of the XML file resembles the following. -![Command Prompt window that shows an example of how to use PCPTool.](./images/pcptool-output.jpg) +![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 611dc64098..60c34a7bb6 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -20,7 +20,7 @@ ms.custom: bitlocker This article helps you troubleshoot issues that you may experience if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. The Intune portal indicates whether BitLocker has failed to encrypt one or more managed devices. -![The BitLocker status indictors on the Intune portal.](./images/4509189-en-1.png) +![The BitLocker status indictors on the Intune portal](./images/4509189-en-1.png) To start narrowing down the cause of the problem, review the event logs as described in [Troubleshoot BitLocker](troubleshoot-bitlocker.md). Concentrate on the Management and Operations logs in the **Applications and Services logs\\Microsoft\\Windows\\BitLocker-API** folder. The following sections provide more information about how to resolve the indicated events and error messages: @@ -43,7 +43,7 @@ For information about how to verify that Intune policies are enforcing BitLocker Event ID 853 can carry different error messages, depending on the context. In this case, the Event ID 853 error message indicates that the device does not appear to have a TPM. The event information resembles the following: -![Details of event ID 853 (TPM is not available, cannot find TPM).](./images/4509190-en-1.png) +![Details of event ID 853 (TPM is not available, cannot find TPM)](./images/4509190-en-1.png) ### Cause @@ -64,7 +64,7 @@ For more information, see [Troubleshoot the TPM](../tpm/initialize-and-configure In this case, you see event ID 853, and the error message in the event indicates that bootable media is available to the device. The event information resembles the following. -![Details of event ID 853 (TPM is not available, bootable media found).](./images/4509191-en-1.png) +![Details of event ID 853 (TPM is not available, bootable media found)](./images/4509191-en-1.png) ### Cause @@ -100,7 +100,7 @@ You can resolve this issue by verifying the configuration of the disk partitions The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 10 automatically creates a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. -![Default disk partitions, including the recovery partition.](./images/4509194-en-1.png) +![Default disk partitions, including the recovery partition](./images/4509194-en-1.png) To verify the configuration of the disk partitions, open an elevated Command Prompt window, and run the following commands: @@ -108,11 +108,11 @@ To verify the configuration of the disk partitions, open an elevated Command Pro diskpart list volume ``` -![Output of the list volume command in the Diskpart app.](./images/4509195-en-1.png) +![Output of the list volume command in the Diskpart app](./images/4509195-en-1.png) If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Endpoint Configuration Manager). -![Windows image configuration in Microsoft Endpoint Configuration Manager.](./images/configmgr-imageconfig.jpg) +![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/configmgr-imageconfig.jpg) #### Step 2: Verify the status of WinRE @@ -123,7 +123,7 @@ reagentc /info ``` The output of this command resembles the following. -![Output of the reagentc /info command.](./images/4509193-en-1.png) +![Output of the reagentc /info command](./images/4509193-en-1.png) If the **Windows RE status** is not **Enabled**, run the following command to enable it: @@ -141,7 +141,7 @@ bcdedit /enum all The output of this command resembles the following. -![Output of the bcdedit /enum all command.](./images/4509196-en-1.png) +![Output of the bcdedit /enum all command](./images/4509196-en-1.png) In the output, locate the **Windows Boot Loader** section that includes the line **identifier={current}**. In that section, locate the **recoverysequence** attribute. The value of this attribute should be a GUID value, not a string of zeros. @@ -163,7 +163,7 @@ To verify the BIOS mode, use the System Information app. To do this, follow thes 1. Select **Start**, and enter **msinfo32** in the **Search** box. 1. Verify that the **BIOS Mode** setting is **UEFI** and not **Legacy**. - ![System Information app, showing the BIOS Mode setting.](./images/4509198-en-1.png) + ![System Information app, showing the BIOS Mode setting](./images/4509198-en-1.png) 1. If the **BIOS Mode** setting is **Legacy**, you have to switch the BIOS into **UEFI** or **EFI** mode. The steps for doing this are specific to the device. > [!NOTE] > If the device supports only Legacy mode, you cannot use Intune to manage BitLocker Device Encryption on the device. @@ -192,11 +192,11 @@ Manage-bde -protectors -get %systemdrive% In the TPM section of the output of this command, verify that the **PCR Validation Profile** setting includes **7**, as follows. -![Output of the manage-bde command.](./images/4509199-en-1.png) +![Output of the manage-bde command](./images/4509199-en-1.png) If **PCR Validation Profile** doesn't include **7** (for example, the values include **0**, **2**, **4**, and **11**, but not **7**), then Secure Boot is not turned on. -![Output of the manage-bde command when PCR 7 is not present.](./images/4509200-en-1.png) +![Output of the manage-bde command when PCR 7 is not present](./images/4509200-en-1.png) #### 2. Verify the Secure Boot state @@ -204,9 +204,9 @@ To verify the Secure Boot state, use the System Information app. To do this, fol 1. Select **Start**, and enter **msinfo32** in the **Search** box. 1. Verify that the **Secure Boot State** setting is **On**, as follows: - ![System Information app, showing a supported Secure Boot State.](./images/4509201-en-1.png) + ![System Information app, showing a supported Secure Boot State](./images/4509201-en-1.png) 1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device. - ![System Information app, showing a unsupported Secure Boot State.](./images/4509202-en-1.png) + ![System Information app, showing a unsupported Secure Boot State](./images/4509202-en-1.png) > [!NOTE] > You can also use the [Confirm-SecureBootUEFI](/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: @@ -290,7 +290,7 @@ If your device runs Windows 10 version 1703 or later, supports Modern Standby (a If your device is HSTI-compliant but does not support Modern Standby, you have to configure an endpoint protection policy to enforce silent BitLocker Drive Encryption. The settings for this policy should resemble the following: -![Intune policy settings.](./images/4509186-en-1.png) +![Intune policy settings](./images/4509186-en-1.png) The OMA-URI references for these settings are as follows: @@ -316,7 +316,7 @@ The Intune 1901 release provides settings that you can use to configure automati - Support Modern Standby - Use Windows 10 version 1803 or later -![Intune policy setting.](./images/4509188-en-1.png) +![Intune policy setting](./images/4509188-en-1.png) The OMA-URI references for these settings are as follows: @@ -331,17 +331,17 @@ The OMA-URI references for these settings are as follows: During regular operations, BitLocker Drive Encryption generates events such as Event ID 796 and Event ID 845. -![Event ID 796, as shown in Event Viewer.](./images/4509203-en-1.png) +![Event ID 796, as shown in Event Viewer](./images/4509203-en-1.png) -![Event ID 845, as shown in Event Viewer.](./images/4509204-en-1.png) +![Event ID 845, as shown in Event Viewer](./images/4509204-en-1.png) You can also determine whether the BitLocker recovery password has been uploaded to Azure AD by checking the device details in the Azure AD Devices section. -![BitLocker recovery information as viewed in Azure AD.](./images/4509205-en-1.png) +![BitLocker recovery information as viewed in Azure AD](./images/4509205-en-1.png) On the device, check the Registry Editor to verify the policy settings on the device. Verify the entries under the following subkeys: - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\BitLocker** - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device** -![Registry subkeys that relate to Intune policy.](./images/4509206-en-1.png) \ No newline at end of file +![Registry subkeys that relate to Intune policy](./images/4509206-en-1.png) \ No newline at end of file diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 768d8cdd75..31fc1097a4 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -53,7 +53,7 @@ By default, peripherals with DMA Remapping incompatible drivers will be blocked ## User experience -![Kernel DMA protection user experience.](images/kernel-dma-protection-user-experience.png) +![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or logs out of the system. @@ -77,7 +77,7 @@ Systems running Windows 10 version 1803 that do support Kernel DMA Protection do Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. -![Kernel DMA protection in Security Center.](bitlocker/images/kernel-dma-protection-security-center.png) +![Kernel DMA protection in Security Center](bitlocker/images/kernel-dma-protection-security-center.png) ### Using System information @@ -85,7 +85,7 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if 2. Check the value of **Kernel DMA Protection**. - ![Kernel DMA protection in System Information.](bitlocker/images/kernel-dma-protection.png) + ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png) 3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: @@ -113,11 +113,11 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). -![Kernel DMA protection user experience.](images/device_details_tab_1903.png) +![Kernel DMA protection user experience](images/device_details_tab_1903.png) *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. -![Kernel DMA protection user experience.](images/device-details-tab.png) +![Kernel DMA protection user experience](images/device-details-tab.png) ### What should I do if the drivers for my PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 3d8754473d..721ae1e1e3 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -55,7 +55,7 @@ Windows 10 supports four features to help prevent rootkits and bootkits from lo Figure 1 shows the Windows 10 startup process. -![Windows 10 startup process.](./images/dn168167.boot_process(en-us,MSDN.10).png) +![Windows 10 startup process](./images/dn168167.boot_process(en-us,MSDN.10).png) **Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage** @@ -115,7 +115,7 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. -![Measured Boot and remote attestation process.](./images/dn168167.measure_boot(en-us,MSDN.10).png) +![Measured Boot and remote attestation process](./images/dn168167.measure_boot(en-us,MSDN.10).png) **Figure 2. Measured Boot proves the PC’s health to a remote server** diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index dd9e12558e..06d8c54066 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -84,7 +84,7 @@ Identity providers have flexibility in how they provision credentials on client • **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios. -![TPM Capabilities.](images/tpm-capabilities.png) +![TPM Capabilities](images/tpm-capabilities.png) *Figure 1: TPM Cryptographic Key Management* @@ -126,7 +126,7 @@ The TPM provides the following way for scenarios to use the measurements recorde When new security features are added to Windows, Measured Boot adds security-relevant configuration information to the measurements recorded in the TPM. Measured Boot enables remote attestation scenarios that reflect the system firmware and the Windows initialization state. -![Process to Create Evidence of Boot Software and Configuration Using TPM.](images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png) +![Process to Create Evidence of Boot Software and Configuration Using TPM](images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png) *Figure 2: Process used to create evidence of boot software and configuration using a TPM* diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 5a5e12feb9..4a5ddd2df2 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -91,7 +91,7 @@ It's possible that you might revoke data from an unenrolled device only to later To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. - ![Robocopy in S mode.](images/robocopy-s-mode.png) + ![Robocopy in S mode](images/robocopy-s-mode.png) If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index 909073181d..a605d96688 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -34,11 +34,11 @@ Follow these steps to associate your WIP policy with your organization's existin 2. Open the Microsoft Intune mobile application management console, click **Device configuration**, and then click **Create Profile**. - ![Microsoft Intune, Create a new policy using the portal.](images/wip-azure-vpn-device-policy.png) + ![Microsoft Intune, Create a new policy using the portal](images/wip-azure-vpn-device-policy.png) 3. In the **Create Profile** blade, type a name for your profile, such as *Contoso_VPN_Win10*, into the **Name** box, add an optional description for your policy into the **Description** box, select **Windows 10 and later** from the **Platform** dropdown box, select **Custom** from the **Profile type** dropdown box, and then click **Configure**. - ![Microsoft Intune, Create a new policy using the Create Profile blade.](images/wip-azure-vpn-configure-policy.png) + ![Microsoft Intune, Create a new policy using the Create Profile blade](images/wip-azure-vpn-configure-policy.png) 4. In the **Custom OMA-URI Settings** blade, click **Add**. @@ -54,7 +54,7 @@ Follow these steps to associate your WIP policy with your organization's existin - **Value.** Type your fully-qualified domain that should be used by the OMA-URI setting. For example, _corp.contoso.com_. - ![Microsoft Intune, Add your OMA-URI settings.](images/wip-azure-vpn-custom-omauri.png) + ![Microsoft Intune, Add your OMA-URI settings](images/wip-azure-vpn-custom-omauri.png) 6. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy. @@ -73,7 +73,7 @@ After you’ve created your VPN policy, you'll need to deploy it to the same gro The policy is deployed to the selected users' devices. - ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed.](images/wip-azure-add-user-groups.png) + ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md index 32511b9cd5..f13e30a044 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -36,12 +36,12 @@ After you've installed and set up Configuration Manager for your organization, y 1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - ![Configuration Manager, Configuration Items screen.](images/wip-configmgr-addpolicy.png) + ![Configuration Manager, Configuration Items screen](images/wip-configmgr-addpolicy.png) 2. Click the **Create Configuration Item** button.

The **Create Configuration Item Wizard** starts. - ![Create Configuration Item wizard, define the configuration item and choose the configuration type.](images/wip-configmgr-generalscreen.png) + ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-configmgr-generalscreen.png) 3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. @@ -55,11 +55,11 @@ The **Create Configuration Item Wizard** starts. 5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**. - ![Create Configuration Item wizard, choose the supported platforms for the policy.](images/wip-configmgr-supportedplat.png) + ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-configmgr-supportedplat.png) 6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. - ![Create Configuration Item wizard, choose the Windows Information Protection settings.](images/wip-configmgr-devicesettings.png) + ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-configmgr-devicesettings.png) The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. @@ -81,7 +81,7 @@ For this example, we're going to add Microsoft OneNote, a store app, to the **Ap The **Add app rule** box appears. - ![Create Configuration Item wizard, add a universal store app.](images/wip-configmgr-adduniversalapp.png) + ![Create Configuration Item wizard, add a universal store app](images/wip-configmgr-adduniversalapp.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Microsoft OneNote*. @@ -141,7 +141,7 @@ For this example, we're going to add Internet Explorer, a desktop app, to the ** The **Add app rule** box appears. - ![Create Configuration Item wizard, add a classic desktop app.](images/wip-configmgr-adddesktopapp.png) + ![Create Configuration Item wizard, add a classic desktop app](images/wip-configmgr-adddesktopapp.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Internet Explorer*. @@ -218,7 +218,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** 2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules.](images/intune-local-security-snapin.png) + ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) 3. Right-click in the right-hand pane, and then click **Create New Rule**. @@ -226,33 +226,33 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** 4. On the **Before You Begin** page, click **Next**. - ![Create a Packaged app Rules wizard and showing the Before You Begin page.](images/intune-applocker-before-begin.png) + ![Create a Packaged app Rules wizard and showing the Before You Begin page](images/intune-applocker-before-begin.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. - ![Create Packaged app Rules wizard, set action to Allow.](images/intune-applocker-permissions.png) + ![Create Packaged app Rules wizard, set action to Allow](images/intune-applocker-permissions.png) 6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. - ![Create Packaged app Rules wizard, select use an installed packaged app.](images/intune-applocker-publisher.png) + ![Create Packaged app Rules wizard, select use an installed packaged app](images/intune-applocker-publisher.png) 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we're using Microsoft Photos. - ![Create Packaged app Rules wizard, select application and click ok.](images/intune-applocker-select-apps.png) + ![Create Packaged app Rules wizard, select application and click ok](images/intune-applocker-select-apps.png) 8. On the updated **Publisher** page, click **Create**. - ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page.](images/intune-applocker-publisher-with-app.png) + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule.](images/intune-local-security-snapin-updated.png) + ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) 10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option.](images/intune-local-security-export.png) + ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. @@ -286,7 +286,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** The **Add app rule** box appears. - ![Create Configuration Item wizard, add an AppLocker policy.](images/wip-configmgr-addapplockerfile.png) + ![Create Configuration Item wizard, add an AppLocker policy](images/wip-configmgr-addapplockerfile.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Allowed app list*. @@ -353,7 +353,7 @@ You can specify multiple domains owned by your enterprise by separating them wit - Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. - ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity.](images/wip-configmgr-corp-identity.png) + ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-configmgr-corp-identity.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. @@ -372,7 +372,7 @@ There are no default locations included with WIP, you must add each of your netw 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - ![Add or edit corporate network definition box, Add your enterprise network locations.](images/wip-configmgr-add-network-domain.png) + ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-configmgr-add-network-domain.png) @@ -431,7 +431,7 @@ There are no default locations included with WIP, you must add each of your netw 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate.](images/wip-configmgr-dra.png) + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-configmgr-dra.png) After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. @@ -440,7 +440,7 @@ There are no default locations included with WIP, you must add each of your netw ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you'll be asked to decide if you want to add any optional WIP settings. -![Create Configuration Item wizard, Choose any additional, optional settings.](images/wip-configmgr-additionalsettings.png) +![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-configmgr-additionalsettings.png) **To set your optional settings** 1. Choose to set any or all of the optional settings: @@ -467,7 +467,7 @@ After you've finished configuring your policy, you can review all of your info o **To view the Summary screen** - Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. - ![Create Configuration Item wizard, Summary screen for all of your policy choices.](images/wip-configmgr-summaryscreen.png) + ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-configmgr-summaryscreen.png) A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 0442c3778a..17dcaff4f3 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -50,7 +50,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 3. Click **Restore Default URLs** or enter the settings for MDM or MAM user scope and click **Save**: - ![Configure MDM or MAM provider.](images/mobility-provider.png) + ![Configure MDM or MAM provider](images/mobility-provider.png) ## Create a WIP policy @@ -58,7 +58,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 2. Open Microsoft Intune and click **Apps** > **App protection policies** > **Create policy**. - ![Open Client apps.](images/create-app-protection-policy.png) + ![Open Client apps](images/create-app-protection-policy.png) 3. In the **App policy** screen, click **Add a policy**, and then fill out the fields: @@ -70,11 +70,11 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or - **Enrollment state.** Choose **Without enrollment** for MAM or **With enrollment** for MDM. - ![Add a mobile app policy.](images/add-a-mobile-app-policy.png) + ![Add a mobile app policy](images/add-a-mobile-app-policy.png) 4. Click **Protected apps** and then click **Add apps**. - ![Add protected apps.](images/add-protected-apps.png) + ![Add protected apps](images/add-protected-apps.png) You can add these types of apps: @@ -89,7 +89,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or Select **Recommended apps** and select each app you want to access your enterprise data or select them all, and click **OK**. -![Microsoft Intune management console: Recommended apps.](images/recommended-apps.png) +![Microsoft Intune management console: Recommended apps](images/recommended-apps.png) ### Add Store apps @@ -99,7 +99,7 @@ Select **Store apps**, type the app product name and publisher, and click **OK** - **Publisher**: `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` - **Product Name**: `Microsoft.MicrosoftPowerBIForWindows` -![Add Store app.](images/add-a-protected-store-app.png) +![Add Store app](images/add-a-protected-store-app.png) To add multiple Store apps, click the ellipsis **…**. @@ -201,7 +201,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo To add another Desktop app, click the ellipsis **…**. After you’ve entered the info into the fields, click **OK**. -![Microsoft Intune management console: Adding Desktop app info.](images/wip-azure-add-desktop-apps.png) +![Microsoft Intune management console: Adding Desktop app info](images/wip-azure-add-desktop-apps.png) If you’re unsure about what to include for the publisher, you can run this PowerShell command: @@ -242,7 +242,7 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules.](images/wip-applocker-secpol-1.png) + ![Local security snap-in, showing the Packaged app Rules](images/wip-applocker-secpol-1.png) 3. Right-click in the right-hand blade, and then click **Create New Rule**. @@ -250,7 +250,7 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 4. On the **Before You Begin** page, click **Next**. - ![Screenshot of the Before You Begin tab.](images/wip-applocker-secpol-wizard-1.png) + ![Screenshot of the Before You Begin tab](images/wip-applocker-secpol-wizard-1.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. @@ -262,25 +262,25 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365. - ![Screenshot of the Select applications list.](images/wip-applocker-secpol-wizard-4.png) + ![Screenshot of the Select applications list](images/wip-applocker-secpol-wizard-4.png) 8. On the updated **Publisher** page, click **Create**. - ![Screenshot of the Publisher tab.](images/wip-applocker-secpol-wizard-5.png) + ![Screenshot of the Publisher tab](images/wip-applocker-secpol-wizard-5.png) 9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy. - ![Screenshot of AppLocker warning.](images/wip-applocker-default-rule-warning.png) + ![Screenshot of AppLocker warning](images/wip-applocker-default-rule-warning.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule.](images/wip-applocker-secpol-create.png) + ![Local security snap-in, showing the new rule](images/wip-applocker-secpol-create.png) 10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option.](images/wip-applocker-secpol-export.png) + ![Local security snap-in, showing the Export Policy option](images/wip-applocker-secpol-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. @@ -320,7 +320,7 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 3. Right-click **Executable Rules** > **Create New Rule**. - ![Local security snap-in, showing the Executable Rules.](images/create-new-path-rule.png) + ![Local security snap-in, showing the Executable Rules](images/create-new-path-rule.png) 4. On the **Before You Begin** page, click **Next**. @@ -328,11 +328,11 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 6. On the **Conditions** page, click **Path** and then click **Next**. - ![Screenshot with Path conditions selected in the Create Executable Rules wizard.](images/path-condition.png) + ![Screenshot with Path conditions selected in the Create Executable Rules wizard](images/path-condition.png) 7. Click **Browse Folders...** and select the path for the unsigned apps. For this example, we’re using "C:\Program Files". - ![Screenshot of the Path field of the Create Executable Rules wizard.](images/select-path.png) + ![Screenshot of the Path field of the Create Executable Rules wizard](images/select-path.png) 8. On the **Exceptions** page, add any exceptions and then click **Next**. @@ -351,11 +351,11 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 1. In **Protected apps**, click **Import apps**. - ![Import protected apps.](images/import-protected-apps.png) + ![Import protected apps](images/import-protected-apps.png) Then import your file. - ![Microsoft Intune, Importing your AppLocker policy file using Intune.](images/wip-azure-import-apps.png) + ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/wip-azure-import-apps.png) 2. Browse to your exported AppLocker policy file, and then click **Open**. @@ -366,7 +366,7 @@ If your app is incompatible with WIP, but still needs to be used with enterprise 1. In **Client apps - App protection policies**, click **Exempt apps**. - ![Exempt apps.](images/exempt-apps.png) + ![Exempt apps](images/exempt-apps.png) 2. In **Exempt apps**, click **Add apps**. @@ -391,7 +391,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi 1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. - ![Microsoft Intune, Required settings blade showing Windows Information Protection mode.](images/wip-azure-required-settings-protection-mode.png) + ![Microsoft Intune, Required settings blade showing Windows Information Protection mode](images/wip-azure-required-settings-protection-mode.png) |Mode |Description | |-----|------------| @@ -413,11 +413,11 @@ Starting with Windows 10, version 1703, Intune automatically determines your cor 2. If the auto-defined identity isn’t correct, you can change the info in the **Corporate identity** field. - ![Microsoft Intune, Set your corporate identity for your organization.](images/wip-azure-required-settings-corp-identity.png) + ![Microsoft Intune, Set your corporate identity for your organization](images/wip-azure-required-settings-corp-identity.png) 3. To add domains, such your email domain names, click **Configure Advanced settings** > **Add network boundary** and select **Protected domains**. - ![Add protected domains.](images/add-protected-domains.png) + ![Add protected domains](images/add-protected-domains.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. Every WIP policy should include your enterprise network locations. @@ -426,7 +426,7 @@ There are no default locations included with WIP, you must add each of your netw To define the network boundaries, click **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**. -![Microsoft Intune, Set where your apps can access enterprise data on your network.](images/wip-azure-advanced-settings-network.png) +![Microsoft Intune, Set where your apps can access enterprise data on your network](images/wip-azure-advanced-settings-network.png) Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then click **OK**. @@ -558,7 +558,7 @@ Decide if you want Windows to look for additional network settings: - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for additional IP ranges on any domain-joined devices connected to your network. -![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise.](images/wip-azure-advanced-settings-network-autodetect.png) +![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise](images/wip-azure-advanced-settings-network-autodetect.png) ## Upload your Data Recovery Agent (DRA) certificate After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data. @@ -573,12 +573,12 @@ After you create and deploy your WIP policy to your employees, Windows begins to 2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate.](images/wip-azure-advanced-settings-efsdra.png) + ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate](images/wip-azure-advanced-settings-efsdra.png) ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you can choose optional settings. -![Advanced optional settings.](images/wip-azure-advanced-settings-optional.png) +![Advanced optional settings](images/wip-azure-advanced-settings-optional.png) **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: @@ -613,7 +613,7 @@ After you've decided where your protected apps can access enterprise data on you You can restrict which files are protected by WIP when they are downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied. -![WIP encrypted file extensions.](images/wip-encrypted-file-extensions.png) +![WIP encrypted file extensions](images/wip-encrypted-file-extensions.png) ## Related topics diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index 8d929e1db4..524199cf73 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -34,7 +34,7 @@ After you’ve created your Windows Information Protection (WIP) policy, you'll The policy is deployed to the selected users' devices. - ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed.](images/wip-azure-add-user-groups.png) + ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) >[!NOTE] diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index dd3fb2529e..b54cc7cbe1 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -36,13 +36,13 @@ You need to add the Enterprise Context column to the **Details** tab of the Task The **Select columns** box appears. - ![Task Manager, Select column box with Enterprise Context option selected.](images/wip-select-column.png) + ![Task Manager, Select column box with Enterprise Context option selected](images/wip-select-column.png) 3. Scroll down and check the **Enterprise Context** option, and then click **OK** to close the box. The **Enterprise Context** column should now be available in Task Manager. - ![Task Manager, Enterprise Context column highlighted.](images/wip-taskmgr.png) + ![Task Manager, Enterprise Context column highlighted](images/wip-taskmgr.png) ## Review the Enterprise Context The **Enterprise Context** column shows you what each app can do with your enterprise data: diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index e2f9ce0a1f..1e97616ee8 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -38,11 +38,11 @@ In the **Website learning report**, you can view a summary of the devices that h 1. Click **Intune** > **Client apps** > **App protection status** > **Reports**. - ![Image showing the UI path to the WIP report.](images/access-wip-learning-report.png) + ![Image showing the UI path to the WIP report](images/access-wip-learning-report.png) 1. Select either **App learning report for Windows Information Protection** or **Website learning report for Windows Information Protection**. - ![Image showing the UI with for app and website learning reports.](images/wip-learning-select-report.png) + ![Image showing the UI with for app and website learning reports](images/wip-learning-select-report.png) Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. @@ -75,7 +75,7 @@ The information needed for the following steps can be found using Device Health, 4. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app). - ![View of drop down menu for Store or desktop apps.](images/wip-learning-choose-store-or-desktop-app.png) + ![View of drop down menu for Store or desktop apps](images/wip-learning-choose-store-or-desktop-app.png) 5. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 1 above. @@ -87,7 +87,7 @@ The information needed for the following steps can be found using Device Health, `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US` - ![View of Add Apps app info entry boxes.](images/wip-learning-app-info.png) + ![View of Add Apps app info entry boxes](images/wip-learning-app-info.png) 6. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index ea4b252a30..1ede3ef4ed 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -58,7 +58,7 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] 3. Double-click **Turn on Virtualization Based Security**. 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. - ![Enable HVCI using Group Policy.](../images/enable-hvci-gp.png) + ![Enable HVCI using Group Policy](../images/enable-hvci-gp.png) 5. Click **Ok** to close the editor. @@ -279,7 +279,7 @@ This field lists the computer name. All valid values for computer name. Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section. -![Windows Defender Device Guard properties in the System Summary.](../images/dg-fig11-dgproperties.png) +![Windows Defender Device Guard properties in the System Summary](../images/dg-fig11-dgproperties.png) ## Troubleshooting diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md index def1ec0b93..6e6173e36d 100644 --- a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md +++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md @@ -17,7 +17,7 @@ ms.technology: mde --- # Coordinated Malware Eradication -![coordinated-malware-eradication.](images/CoordinatedMalware.png) +![coordinated-malware-eradication](images/CoordinatedMalware.png) Coordinated Malware Eradication (CME) aims to bring organizations in cybersecurity and in other industries together to change the game against malware. While the cybersecurity industry today is effective at disrupting malware families through individual efforts, those disruptions rarely lead to eradication since malware authors quickly adapt their tactics to survive. diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index b125773d18..e2029f3c2c 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -25,7 +25,7 @@ Attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) fo For clarity, fileless threats are grouped into different categories. -![Comprehensive diagram of fileless malware.](images/fileless-malware.png)
+![Comprehensive diagram of fileless malware](images/fileless-malware.png)
*Figure 1. Comprehensive diagram of fileless malware* Fileless threats can be classified by their entry point, which indicates how fileless malware can arrive on a machine. They can arrive via an exploit, through compromised hardware, or via regular execution of applications and scripts. @@ -56,7 +56,7 @@ It’s possible to carry out such installation via command line without requirin Some malware can have a sort of fileless persistence, but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. Opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe. -![Image of Kovter's registry key.](images/kovter-reg-key.png)
+![Image of Kovter's registry key](images/kovter-reg-key.png)
*Figure 2. Kovter’s registry key* When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an autorun key configured to open such file when the machine starts. diff --git a/windows/security/threat-protection/intelligence/malware-naming.md b/windows/security/threat-protection/intelligence/malware-naming.md index 3b37bdf391..ef4a133061 100644 --- a/windows/security/threat-protection/intelligence/malware-naming.md +++ b/windows/security/threat-protection/intelligence/malware-naming.md @@ -20,7 +20,7 @@ ms.technology: mde We name the malware and unwanted software that we detect according to the Computer Antivirus Research Organization (CARO) malware naming scheme. The scheme uses the following format: -![coordinated-malware-eradication.](images/NamingMalware1.png) +![coordinated-malware-eradication](images/NamingMalware1.png) When our analysts research a particular threat, they'll determine what each of the components of the name will be. diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 01c216b8fe..1f997dac95 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -35,7 +35,7 @@ Here are several telltale signs of a phishing scam: * The links or URLs provided in emails are **not pointing to the correct location** or are pointing to a third-party site not affiliated with the sender of the email. For example, in the image below the URL provided doesn't match the URL that you'll be taken to. - ![example of how exploit kits work.](./images/URLhover.png) + ![example of how exploit kits work](./images/URLhover.png) * There's a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email. diff --git a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md index ae7c0e8363..00eafc82ce 100644 --- a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md +++ b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md @@ -33,7 +33,7 @@ This process requires a global or application admin in the tenant. 2. Select **Grant admin consent for organization**. 3. If you're able to do so, review the API permissions required for this application, as the following image shows. Provide consent for the tenant. - ![grant consent image.](images/msi-grant-admin-consent.jpg) + ![grant consent image](images/msi-grant-admin-consent.jpg) 4. If the administrator receives an error while attempting to provide consent manually, try either [Option 1](#option-1-approve-enterprise-application-permissions-by-user-request) or [Option 2](#option-2-provide-admin-consent-by-authenticating-the-application-as-an-admin) as possible workarounds.   @@ -43,13 +43,13 @@ This process requires a global or application admin in the tenant. Azure Active Directory admins will need to allow for users to request admin consent to apps. Verify the setting is configured to **Yes** in [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/UserSettings/menuId/). -![Enterprise applications user settings.](images/msi-enterprise-app-user-setting.jpg) +![Enterprise applications user settings](images/msi-enterprise-app-user-setting.jpg) More information is available in [Configure Admin consent workflow](/azure/active-directory/manage-apps/configure-admin-consent-workflow). Once this setting is verified, users can go through the enterprise customer sign-in at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission), and submit a request for admin consent, including justification. -![Contoso sign in flow.](images/msi-contoso-approval-required.png) +![Contoso sign in flow](images/msi-contoso-approval-required.png) Admin will be able to review and approve the application permissions [Azure admin consent requests](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AccessRequests/menuId/). @@ -58,7 +58,7 @@ After providing consent, all users in the tenant will be able to use the applica ## Option 2 Provide admin consent by authenticating the application as an admin This process requires that global admins go through the Enterprise customer sign-in flow at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission). -![Consent sign in flow.](images/msi-microsoft-permission-required.jpg) +![Consent sign in flow](images/msi-microsoft-permission-required.jpg) Then, admins review the permissions and make sure to select **Consent on behalf of your organization**, and then select **Accept**. @@ -70,20 +70,20 @@ If neither of these options resolve the issue, try the following steps (as an ad 1. Remove previous configurations for the application. Go to [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Properties/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/982e94b2-fea9-4d1f-9fca-318cda92f90b) and select **delete**. - ![Delete app permissions.](images/msi-properties.png) + ![Delete app permissions](images/msi-properties.png) 2. Capture TenantID from [Properties](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Properties). 3. Replace {tenant-id} with the specific tenant that needs to grant consent to this application in the URL below. Copy this URL into browser. The rest of the parameters are already completed. ``https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=f0cf43e5-8a9b-451c-b2d5-7285c785684d&state=12345&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fwdsi%2ffilesubmission&scope=openid+profile+email+offline_access`` - ![Permissions needed.](images/msi-microsoft-permission-requested-your-organization.png) + ![Permissions needed](images/msi-microsoft-permission-requested-your-organization.png) 4. Review the permissions required by the application, and then select **Accept**. 5. Confirm the permissions are applied in the [Azure portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Permissions/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/ce60a464-5fca-4819-8423-bcb46796b051). - ![Review that permissions are applied.](images/msi-permissions.jpg) + ![Review that permissions are applied](images/msi-permissions.jpg) 6. Sign in to [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission) as an enterprise user with a non-admin account to see if you have access. diff --git a/windows/security/threat-protection/intelligence/worms-malware.md b/windows/security/threat-protection/intelligence/worms-malware.md index 2aa32ed8f6..ed4e5aaf84 100644 --- a/windows/security/threat-protection/intelligence/worms-malware.md +++ b/windows/security/threat-protection/intelligence/worms-malware.md @@ -39,7 +39,7 @@ Both Bondat and Gamarue have clever ways of obscuring themselves to evade detect This image shows how a worm can quickly spread through a shared USB drive. -![Worm example.](./images/WormUSB-flight.png) +![Worm example](./images/WormUSB-flight.png) ### *Figure worm spreading from a shared USB drive* diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index 83a6f5e00b..f0c6938382 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -29,8 +29,8 @@ For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with Po For example: -[![VBS script.](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) -[![PowerShell script.](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) +[![VBS script](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) +[![PowerShell script](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index 3b18ab25d3..994ade09de 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -45,7 +45,7 @@ Applies to: You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. The following diagram shows the flow between the host PC and the isolated container. -![Flowchart for movement between Microsoft Edge and Application Guard.](images/application-guard-container-v-host.png) +![Flowchart for movement between Microsoft Edge and Application Guard](images/application-guard-container-v-host.png) ## Install Application Guard @@ -55,7 +55,7 @@ Application Guard functionality is turned off by default. However, you can quick 1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**. - ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png) + ![Windows Features, turning on Microsoft Defender Application Guard](images/turn-windows-features-on-off.png) 2. Select the check box next to **Microsoft Defender Application Guard** and then click **OK**. @@ -86,7 +86,7 @@ Application Guard functionality is turned off by default. However, you can quick > [!IMPORTANT] > Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](/mem/intune/enrollment/device-enrollment). -:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune."::: +:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune"::: 1. Go to [https://endpoint.microsoft.com](https://endpoint.microsoft.com) and sign in. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index 4ad66674a9..de798293db 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -29,7 +29,7 @@ For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrus For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. For example, this approach makes the isolated container anonymous, so an attacker can't get to your employee's enterprise credentials. -![Hardware isolation diagram.](images/appguard-hardware-isolation.png) +![Hardware isolation diagram](images/appguard-hardware-isolation.png) ### What types of devices should use Application Guard? diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index d8ff39f397..74525211f8 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -33,7 +33,7 @@ You can see how an employee would use standalone mode with Application Guard. 2. Restart the device, start Microsoft Edge, and then select **New Application Guard window** from the menu. - ![New Application Guard window setting option.](images/appguard-new-window.png) + ![New Application Guard window setting option](images/appguard-new-window.png) 3. Wait for Application Guard to set up the isolated environment. @@ -42,7 +42,7 @@ You can see how an employee would use standalone mode with Application Guard. 4. Go to an untrusted, but safe URL (for this example, we used msn.com) and view the new Microsoft Edge window, making sure you see the Application Guard visual cues. - ![Untrusted website running in Application Guard.](images/appguard-visual-cues.png) + ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) ## Application Guard in Enterprise-managed mode @@ -64,19 +64,19 @@ Before you can use Application Guard in managed mode, you must install Windows 1 c. For the purposes of this scenario, type `.microsoft.com` into the **Enterprise cloud resources** box. - ![Group Policy editor with Enterprise cloud resources setting.](images/appguard-gp-network-isolation.png) + ![Group Policy editor with Enterprise cloud resources setting](images/appguard-gp-network-isolation.png) d. Go to the **Administrative Templates\Network\Network Isolation\Domains categorized as both work and personal** setting. e. For the purposes of this scenario, type `bing.com` into the **Neutral resources** box. - ![Group Policy editor with Neutral resources setting.](images/appguard-gp-network-isolation-neutral.png) + ![Group Policy editor with Neutral resources setting](images/appguard-gp-network-isolation-neutral.png) 4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Turn on Microsoft Defender Application Guard in Managed Mode** setting. 5. Click **Enabled**, choose Option **1**, and click **OK**. - ![Group Policy editor with Turn On/Off setting.](images/appguard-gp-turn-on.png) + ![Group Policy editor with Turn On/Off setting](images/appguard-gp-turn-on.png) >[!NOTE] >Enabling this setting verifies that all the necessary settings are properly configured on your employee devices, including the network isolation settings set earlier in this scenario. @@ -85,13 +85,13 @@ Before you can use Application Guard in managed mode, you must install Windows 1 After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you've marked as trusted and shows the site directly on the host PC instead of in Application Guard. - ![Trusted website running on Microsoft Edge.](images/appguard-turned-on-with-trusted-site.png) + ![Trusted website running on Microsoft Edge](images/appguard-turned-on-with-trusted-site.png) 7. In the same Microsoft Edge browser, type any URL that isn't part of your trusted or neutral site lists. After you submit the URL, Application Guard determines the URL is untrusted and redirects the request to the hardware-isolated environment. - ![Untrusted website running in Application Guard.](images/appguard-visual-cues.png) + ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) ### Customize Application Guard @@ -118,7 +118,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor clipboard options.](images/appguard-gp-clipboard.png) + ![Group Policy editor clipboard options](images/appguard-gp-clipboard.png) 3. Choose how the clipboard works: @@ -144,7 +144,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Print options.](images/appguard-gp-print.png) + ![Group Policy editor Print options](images/appguard-gp-print.png) 3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. @@ -156,7 +156,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Data Persistence options.](images/appguard-gp-persistence.png) + ![Group Policy editor Data Persistence options](images/appguard-gp-persistence.png) 3. Open Microsoft Edge and browse to an untrusted, but safe URL. @@ -186,7 +186,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Download options.](images/appguard-gp-download.png) + ![Group Policy editor Download options](images/appguard-gp-download.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -200,7 +200,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor hardware acceleration options.](images/appguard-gp-vgpu.png) + ![Group Policy editor hardware acceleration options](images/appguard-gp-vgpu.png) 3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. @@ -217,7 +217,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled**, set **Options** to 2, and click **OK**. - ![Group Policy editor File trust options.](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) + ![Group Policy editor File trust options](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -231,7 +231,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Camera and microphone options.](images/appguard-gp-allow-camera-and-mic.png) + ![Group Policy editor Camera and microphone options](images/appguard-gp-allow-camera-and-mic.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -245,7 +245,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. - ![Group Policy editor Root certificate options.](images/appguard-gp-allow-root-certificates.png) + ![Group Policy editor Root certificate options](images/appguard-gp-allow-root-certificates.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -258,10 +258,10 @@ Once a user has the extension and its companion app installed on their enterpris 1. Open either Firefox or Chrome — whichever browser you have the extension installed on. 2. Navigate to an enterprise website, i.e. an internal website maintained by your organization. You might see this evaluation page for an instant before the site is fully loaded. - ![The evaluation page displayed while the page is being loaded, explaining that the user must wait.](images/app-guard-chrome-extension-evaluation-page.png) + ![The evaluation page displayed while the page is being loaded, explaining that the user must wait](images/app-guard-chrome-extension-evaluation-page.png) 3. Navigate to a non-enterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. - ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge.](images/app-guard-chrome-extension-launchIng-edge.png) + ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge](images/app-guard-chrome-extension-launchIng-edge.png) 4. Open a new Application Guard window, by select the Microsoft Defender Application Guard icon, then **New Application Guard Window** ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index 146b20c787..80486846fb 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -61,7 +61,7 @@ If you believe a warning or block was incorrectly shown for a file or applicatio When submitting Microsoft Defender SmartScreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu. -![Windows Security, Microsoft Defender SmartScreen controls.](images/Microsoft-defender-smartscreen-submission.png) +![Windows Security, Microsoft Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) ## Viewing Microsoft Defender SmartScreen anti-phishing events diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md index 89c036958f..85c404a314 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md @@ -60,7 +60,7 @@ Starting with Windows 10, version 1703, users can use Windows Security to set up - **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files. - ![Windows Security, Microsoft Defender SmartScreen controls.](images/windows-defender-smartscreen-control-2020.png) + ![Windows Security, Microsoft Defender SmartScreen controls](images/windows-defender-smartscreen-control-2020.png) ## How Microsoft Defender SmartScreen works when a user tries to run an app Microsoft Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Microsoft Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization. diff --git a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md index c2a1d31b98..c792222c8a 100644 --- a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md @@ -41,7 +41,7 @@ The following procedure describes how to use Group Policy to override individual 1. Open your Group Policy editor and go to the **Administrative Templates\System\Mitigation Options\Process Mitigation Options** setting. - ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active.](images/gp-process-mitigation-options.png) + ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active](images/gp-process-mitigation-options.png) 2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you’ll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. @@ -52,12 +52,12 @@ The following procedure describes how to use Group Policy to override individual **Note**
Setting bit flags in positions not specified here to anything other than ? might cause undefined behavior. - ![Group Policy editor: Process Mitigation Options with Show Contents box and example text.](images/gp-process-mitigation-options-show.png) + ![Group Policy editor: Process Mitigation Options with Show Contents box and example text](images/gp-process-mitigation-options-show.png) ## Setting the bit field Here’s a visual representation of the bit flag locations for the various Process Mitigation Options settings: -![Visual representation of the bit flag locations for the Process Mitigation Options settings.](images/gp-process-mitigation-options-bit-flag-image.png) +![Visual representation of the bit flag locations for the Process Mitigation Options settings](images/gp-process-mitigation-options-bit-flag-image.png) Where the bit flags are read from right to left and are defined as: diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index 0a9058b91d..f98634584d 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -130,7 +130,7 @@ You can now see which processes have DEP enabled. -![Processes with DEP enabled in Windows 10.](images/security-fig5-dep.png) +![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png) *Figure 2.  Processes on which DEP has been enabled in Windows 10* @@ -168,7 +168,7 @@ One of the most common techniques used to gain access to a system is to find a v Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. -![ASLR at work.](images/security-fig4-aslr.png) +![ASLR at work](images/security-fig4-aslr.png) **Figure 3.  ASLR at work** diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index e24bb48367..220c774696 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -56,13 +56,13 @@ Because mobile devices are increasingly being used to access corporate informati Devices that are used to access corporate resources must be trusted. An efficient end-to-end security approach is able to evaluate device health and use the current security state when granting access to a high-value asset. -:::image type="content" alt-text="figure 1." source="images/hva-fig1-endtoend1.png"::: +:::image type="content" alt-text="figure 1" source="images/hva-fig1-endtoend1.png"::: A robust design needs to establish the user’s identity, strengthen the authentication method if needed, and learn behavior like the network location the user regularly connects from. Also, a modern approach must be able to release sensitive content only if user devices are determined to be healthy and secure. The following figure shows a solution built to assess device health from the cloud. The device authenticates the user through a connection to an identity provider in the cloud. If the managed asset contains highly confidential information, the conditional access engine of the identity provider may elect to verify the security compliance of the mobile device before access is granted. The user’s device is able to prove its health status that can be sent at any time or when mobile device management (MDM) requests it. -:::image type="content" alt-text="figure 2." source="images/hva-fig2-assessfromcloud2.png"::: +:::image type="content" alt-text="figure 2" source="images/hva-fig2-assessfromcloud2.png"::: Windows devices can be protected from low-level rootkits and bootkits by using low-level hardware technologies such as Unified Extensible Firmware Interface (UEFI) Secure Boot. @@ -94,7 +94,7 @@ In Windows 10, there are three pillars of investments: This section is an overview that describes different parts of the end-to-end security solution that helps protect high-value assets and information from attackers and malware. -:::image type="content" alt-text="figure 3." source="images/hva-fig3-endtoendoverview3.png"::: +:::image type="content" alt-text="figure 3" source="images/hva-fig3-endtoendoverview3.png"::: | Number | Part of the solution | Description | | - | - | - | @@ -115,7 +115,7 @@ This section describes what Windows 10 offers in terms of security defenses and The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-req) section. -:::image type="content" alt-text="figure 4." source="images/hva-fig4-hardware.png"::: +:::image type="content" alt-text="figure 4" source="images/hva-fig4-hardware.png"::: Windows 10 supports features to help prevent sophisticated low-level malware like rootkits and bootkits from loading during the startup process: @@ -230,7 +230,7 @@ The following Windows 10 services are protected with virtualization-based securi The schema below is a high-level view of Windows 10 with virtualization-based security. -:::image type="content" alt-text="figure 5." source="images/hva-fig5-virtualbasedsecurity.png"::: +:::image type="content" alt-text="figure 5" source="images/hva-fig5-virtualbasedsecurity.png"::: ### Credential Guard @@ -425,11 +425,11 @@ The antimalware software can search to determine whether the boot sequence conta Health attestation logs the measurements in various TPM Platform Configuration Registers (PCRs) and TCG logs during the boot process. -:::image type="content" alt-text="figure 6." source="images/hva-fig6-logs.png"::: +:::image type="content" alt-text="figure 6" source="images/hva-fig6-logs.png"::: When starting a device equipped with TPM, a measurement of different components is performed. This includes firmware, UEFI drivers, CPU microcode, and also all the Windows 10 drivers whose type is Boot Start. The raw measurements are stored in the TPM PCR registers while the details of all events (executable path, authority certification, and so on) are available in the TCG log. -:::image type="content" alt-text="figure 7." source="images/hva-fig7-measurement.png"::: +:::image type="content" alt-text="figure 7" source="images/hva-fig7-measurement.png"::: The health attestation process works as follows: @@ -459,7 +459,7 @@ The following process describes how health boot measurements are sent to the hea 4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. -:::image type="content" alt-text="figure 8." source="images/hva-fig8a-healthattest8a.png"::: +:::image type="content" alt-text="figure 8" source="images/hva-fig8a-healthattest8a.png"::: ### Device health attestation components @@ -632,7 +632,7 @@ A solution that leverages MDM and the Health Attestation Service consists of thr 2. After this is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. 3. At any point after this, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it’s been attested. - :::image type="content" alt-text="figure 9." source="images/hva-fig8-evaldevicehealth8.png"::: + :::image type="content" alt-text="figure 9" source="images/hva-fig8-evaldevicehealth8.png"::: Interaction between a Windows 10-based device, the Health Attestation Service, and MDM can be performed as follows: @@ -671,7 +671,7 @@ The remote device health attestation process uses measured boot data to verify t The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service. -:::image type="content" alt-text="figure 10." source="images/hva-fig9-intune.png"::: +:::image type="content" alt-text="figure 10" source="images/hva-fig9-intune.png"::: An MDM solution can then leverage health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device’s ability to prove that it’s malware free, its antimalware system is functional and up to date, the firewall is running, and the devices patch state is compliant. @@ -705,7 +705,7 @@ If the device is not registered, the user will get a message with instructions o **Azure AD** authenticates the user and the device, **MDM** manages the compliance and conditional access policies, and the **Health Attestation Service** reports about the health of the device in an attested way. -:::image type="content" alt-text="figure 11." source="images/hva-fig10-conditionalaccesscontrol.png"::: +:::image type="content" alt-text="figure 11" source="images/hva-fig10-conditionalaccesscontrol.png"::: ### Office 365 conditional access control @@ -725,7 +725,7 @@ The user will be denied access to services when sign-in credentials are changed, Depending on the type of email application that employees use to access Exchange online, the path to establish secured access to email can be slightly different. However, the key components: Azure AD, Office 365/Exchange Online, and Intune, are the same. The IT experience and end-user experience also are similar. -:::image type="content" alt-text="figure 12." source="images/hva-fig11-office365.png"::: +:::image type="content" alt-text="figure 12" source="images/hva-fig11-office365.png"::: Clients that attempt to access Office 365 will be evaluated for the following properties: @@ -758,7 +758,7 @@ For on-premises applications there are two options to enable conditional access - For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](https://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. - Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. -:::image type="content" alt-text="figure 13." source="images/hva-fig12-conditionalaccess12.png"::: +:::image type="content" alt-text="figure 13" source="images/hva-fig12-conditionalaccess12.png"::: The following process describes how Azure AD conditional access works: diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md index ce251bc758..eb88a41772 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -36,7 +36,7 @@ Beginning with Windows 10 version 1607, new functionality was added to Windows 1 This functionality is controlled by a new **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The Privacy setting is off by default, which hides the details. -![Privacy setting.](images/privacy-setting-in-sign-in-options.png) +![Privacy setting](images/privacy-setting-in-sign-in-options.png) The **Interactive logon: Display user information when the session is locked** Group Policy setting controls the same functionality. diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md index 7a58b942a4..426d291c10 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md @@ -157,7 +157,7 @@ The following diagram shows Security Settings and related features. #### Security Settings Policies and Related Features -![components related to security policies.](images/secpol-components.gif) +![components related to security policies](images/secpol-components.gif) - **Scesrv.dll** @@ -181,7 +181,7 @@ The Security Settings extension of the Local Group Policy Editor is part of the **Security Settings Architecture** -![architecture of security policy settings.](images/secpol-architecture.gif) +![architecture of security policy settings](images/secpol-architecture.gif) The security settings configuration and analysis tools include a security configuration engine, which provides local computer (non-domain member) and Group Policy−based configuration and analysis of security settings policies. The security configuration engine also supports the creation of security policy files. The primary features of the security configuration engine are scecli.dll and scesrv.dll. @@ -321,7 +321,7 @@ In the context of Group Policy processing, security settings policy is processed **Multiple GPOs and Merging of Security Policy** - ![multiple gpos and merging of security policy.](images/secpol-multigpomerge.gif) + ![multiple gpos and merging of security policy](images/secpol-multigpomerge.gif) 1. The resultant security policies are stored in secedit.sdb, the security settings database. The security engine gets the security template files and imports them to secedit.sdb. 1. The security settings policies are applied to devices. @@ -329,7 +329,7 @@ The following figure illustrates the security settings policy processing. **Security Settings Policy Processing** -![process and interactions of security policy settings.](images/secpol-processes.gif) +![process and interactions of security policy settings](images/secpol-processes.gif) ### Merging of security policies on domain controllers diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index a8362c5bda..277bc347d1 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -380,9 +380,9 @@ This can easily be extended to other Auto-Execution Start Points keys in the reg Use the following figures to see how you can configure those registry keys. -![default acl for run key.](images/runkey.png) +![default acl for run key](images/runkey.png) -![default acl for runonce key.](images/runoncekey.png) +![default acl for runonce key](images/runoncekey.png) ## Appendix C - Event channel settings (enable and channel access) methods @@ -399,7 +399,7 @@ The following GPO snippet performs the following: - Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50MB. -![configure event channels.](images/capi-gpo.png) +![configure event channels](images/capi-gpo.png) ## Appendix D - Minimum GPO for WEF Client configuration @@ -409,7 +409,7 @@ Here are the minimum steps for WEF to operate: 2. Start the WinRM service. 3. Add the Network Service account to the built-in Event Log Readers security group. This allows reading from secured event channel, such as the security event channel. -![configure the wef client.](images/wef-client-config.png) +![configure the wef client](images/wef-client-config.png) ## Appendix E – Annotated baseline subscription event query diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index 11b4c1a58b..9b1eb730a6 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -299,7 +299,7 @@ One of the most common techniques used by attackers to gain access to a system i Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. The below diagram illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. -![figure 3.](images/mobile-security-guide-figure3.png) +![figure 3](images/mobile-security-guide-figure3.png) Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, applying it across the entire system rather than only in specific apps. With 64bit system and application processes that can take advantage of a vastly increased memory space, it is even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization becomes increasingly unique across devices, adding additional degrees of difficulty for repurposing successful exploits to another system. diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 582297f71b..ab40f94622 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -37,7 +37,7 @@ Refer to the below video for an overview and brief demo. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp] ## Policy Authorization Process -![Policy Authorization.](images/wdac-intune-policy-authorization.png) +![Policy Authorization](images/wdac-intune-policy-authorization.png) The general steps for expanding the S mode base policy on your Intune-managed devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. Because you need access to WDAC PowerShell cmdlets to generate your supplemental policy, you should create and manage your policies on a non-S mode device. Once the policy has been uploaded to Intune, we recommend assigning it to a single test S-mode device to verify expected functioning before deploying the policy more broadly. 1. Generate a supplemental policy with WDAC tooling @@ -89,11 +89,11 @@ The general steps for expanding the S mode base policy on your Intune-managed de > When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps&preserve-view=true) for information on setting the version number. ## Standard Process for Deploying Apps through Intune -![Deploying Apps through Intune.](images/wdac-intune-app-deployment.png) +![Deploying Apps through Intune](images/wdac-intune-app-deployment.png) Refer to [Intune Standalone - Win32 app management](/intune/apps-win32-app-management) for guidance on the existing procedure of packaging signed catalogs and app deployment. ## Optional: Process for Deploying Apps using Catalogs -![Deploying Apps using Catalogs.](images/wdac-intune-app-catalogs.png) +![Deploying Apps using Catalogs](images/wdac-intune-app-catalogs.png) Your supplemental policy can be used to significantly relax the S mode base policy, but there are security trade-offs you must consider in doing so. For example, you can use a signer rule to trust an external signer, but that will authorize all apps signed by that certificate, which may include apps you don't want to allow as well. Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don't want to trust all apps that may share the same signing certificate. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index af49d0b081..f197b8f4b2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -61,7 +61,7 @@ AppLocker can be configured to display the default message but with a custom URL The following image shows an example of the error message for a blocked app. You can use the **Set a support web link** policy setting to customize the **More information** link. -![applocker blocked application error message.](images/blockedappmsg.gif) +![applocker blocked application error message](images/blockedappmsg.gif) For steps to display a custom URL for the message, see [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index 9ffaf2b82c..5350f5c843 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -44,7 +44,7 @@ Because a computer's effective policy includes rules from each linked GPO, dupli The following figure demonstrates how AppLocker rule enforcement is applied through linked GPOs. -![applocker rule enforcement inheritance chart.](images/applocker-plan-inheritance.gif) +![applocker rule enforcement inheritance chart](images/applocker-plan-inheritance.gif) In the preceding illustration, note that all GPOs linked to Contoso are applied in order as configured. The rules that are not configured are also applied. For example, the result of the Contoso and Human Resources GPOs is 33 rules enforced, as shown in the client HR-Term1. The Human Resources GPO contains 10 non-configured rules. When the rule collection is configured for **Audit only**, no rules are enforced. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index a51539d046..0f909bdf3d 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -30,7 +30,7 @@ To successfully deploy AppLocker policies, you need to identify your application The following diagram shows the main points in the design, planning, and deployment process for AppLocker. -![applocker quick reference guide.](images/applocker-plandeploy-quickreference.gif) +![applocker quick reference guide](images/applocker-plandeploy-quickreference.gif) ## Resources to support the deployment process diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md index 671bd29bf1..bc1218b82c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md @@ -46,7 +46,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these **Figure 1. Exceptions to the deployed WDAC policy**
- ![Event showing exception to WDAC policy.](images/dg-fig23-exceptionstocode.png) + ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) 3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index 706f2e6d6a..cb94565bff 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -45,7 +45,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these 2. Review the **CodeIntegrity - Operational** and **AppLocker - MSI and Script** event logs to confirm events, like those shown in Figure 1, are generated related to the application. For information about the types of events you should see, refer to [Understanding Application Control events](event-id-explanations.md). **Figure 1. Exceptions to the deployed WDAC policy** - ![Event showing exception to WDAC policy.](images/dg-fig23-exceptionstocode.png) + ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) 3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index 761ea31822..b9ca84a296 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -39,7 +39,7 @@ ECDSA is not supported. 2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. - ![CA snap-in showing Certificate Templates.](images/dg-fig27-managecerttemp.png) + ![CA snap-in showing Certificate Templates](images/dg-fig27-managecerttemp.png) Figure 1. Manage the certificate templates @@ -55,7 +55,7 @@ ECDSA is not supported. 8. In the **Edit Basic Constraints Extension** dialog box, select **Enable this extension**, as shown in Figure 2. - ![Edit Basic Constraints Extension.](images/dg-fig29-enableconstraints.png) + ![Edit Basic Constraints Extension](images/dg-fig29-enableconstraints.png) Figure 2. Select constraints on the new template @@ -71,7 +71,7 @@ When this certificate template has been created, you must publish it to the CA p 1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 3. - ![Select Certificate Template to Issue.](images/dg-fig30-selectnewcert.png) + ![Select Certificate Template to Issue](images/dg-fig30-selectnewcert.png) Figure 3. Select the new certificate template to issue @@ -89,7 +89,7 @@ Now that the template is available to be issued, you must request one from the c 4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. - ![Request Certificates: more information required.](images/dg-fig31-getmoreinfo.png) + ![Request Certificates: more information required](images/dg-fig31-getmoreinfo.png) Figure 4. Get more information for your code signing certificate diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index bdb0bb25f6..52cac752d2 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -142,7 +142,7 @@ To sign the existing catalog file, copy each of the following commands into an e 4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 1. - ![Digital Signature list in file Properties.](images/dg-fig12-verifysigning.png) + ![Digital Signature list in file Properties](images/dg-fig12-verifysigning.png) Figure 1. Verify that the signing certificate exists @@ -182,7 +182,7 @@ To simplify the management of catalog files, you can use Group Policy preference > [!NOTE] > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate). - ![Group Policy Management, create a GPO.](images/dg-fig13-createnewgpo.png) + ![Group Policy Management, create a GPO](images/dg-fig13-createnewgpo.png) Figure 2. Create a new GPO @@ -192,7 +192,7 @@ To simplify the management of catalog files, you can use Group Policy preference 5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 3. - ![Group Policy Management Editor, New File.](images/dg-fig14-createnewfile.png) + ![Group Policy Management Editor, New File](images/dg-fig14-createnewfile.png) Figure 3. Create a new file @@ -202,7 +202,7 @@ To simplify the management of catalog files, you can use Group Policy preference 7. To keep versions consistent, in the **New File Properties** dialog box (Figure 4), select **Replace** from the **Action** list so that the newest version is always used. - ![File Properties, Replace option.](images/dg-fig15-setnewfileprops.png) + ![File Properties, Replace option](images/dg-fig15-setnewfileprops.png) Figure 4. Set the new file properties @@ -235,7 +235,7 @@ As an alternative to Group Policy, you can use Configuration Manager to deploy c 3. Name the package, set your organization as the manufacturer, and select an appropriate version number. - ![Create Package and Program Wizard.](images/dg-fig16-specifyinfo.png) + ![Create Package and Program Wizard](images/dg-fig16-specifyinfo.png) Figure 5. Specify information about the new package @@ -257,7 +257,7 @@ As an alternative to Group Policy, you can use Configuration Manager to deploy c - From the **Drive mode** list, select **Runs with UNC name**. - ![Standard Program page of wizard.](images/dg-fig17-specifyinfo.png) + ![Standard Program page of wizard](images/dg-fig17-specifyinfo.png) Figure 6. Specify information about the standard program @@ -285,7 +285,7 @@ After you create the deployment package, deploy it to a collection so that the c - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. - ![Deploy Software Wizard, User Experience page.](images/dg-fig18-specifyux.png) + ![Deploy Software Wizard, User Experience page](images/dg-fig18-specifyux.png) Figure 7. Specify the user experience @@ -310,13 +310,13 @@ When catalog files have been deployed to the computers within your environment, 3. Name the new policy, and under **Select and then configure the custom settings for client devices**, select the **Software Inventory** check box, as shown in Figure 8. - ![Create Custom Client Device Settings.](images/dg-fig19-customsettings.png) + ![Create Custom Client Device Settings](images/dg-fig19-customsettings.png) Figure 8. Select custom settings 4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 9. - ![Software Inventory settings for devices.](images/dg-fig20-setsoftwareinv.png) + ![Software Inventory settings for devices](images/dg-fig20-setsoftwareinv.png) Figure 9. Set the software inventory @@ -329,7 +329,7 @@ When catalog files have been deployed to the computers within your environment, 7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 10. - ![Path Properties, specifying a path.](images/dg-fig21-pathproperties.png) + ![Path Properties, specifying a path](images/dg-fig21-pathproperties.png) Figure 10. Set the path properties diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index dea3b62b33..d20e96958f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -43,7 +43,7 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Plan for Windows Defender Application Control policy management](plan-windows-defender-application-control-management.md). - ![Group Policy Management, create a GPO.](images/dg-fig24-creategpo.png) + ![Group Policy Management, create a GPO](images/dg-fig24-creategpo.png) 3. Name the new GPO. You can choose any name. @@ -51,7 +51,7 @@ To deploy and manage a WDAC policy with Group Policy: 5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**. - ![Edit the Group Policy for Windows Defender Application Control.](images/wdac-edit-gp.png) + ![Edit the Group Policy for Windows Defender Application Control](images/wdac-edit-gp.png) 6. In the **Deploy Windows Defender Application Control** dialog box, select the **Enabled** option, and then specify the WDAC policy deployment path. @@ -60,7 +60,7 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > This policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. - ![Group Policy called Deploy Windows Defender Application Control.](images/dg-fig26-enablecode.png) + ![Group Policy called Deploy Windows Defender Application Control](images/dg-fig26-enablecode.png) > [!NOTE] > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 29fbbe9431..250600e081 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -71,7 +71,7 @@ The steps to use Intune's custom OMA-URI functionality are: - **Certificate file**: upload your binary format policy file. You do not need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. > [!div class="mx-imgBorder"] - > ![Configure custom WDAC.](images/wdac-intune-custom-oma-uri.png) + > ![Configure custom WDAC](images/wdac-intune-custom-oma-uri.png) > [!NOTE] > For the _Policy GUID_ value, do not include the curly brackets. diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index 0c319af7e6..848bfe1e62 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -45,7 +45,7 @@ Most WDAC policies will evolve over time and proceed through a set of identifiab 6. Deploy the enforced mode policy to intended devices. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly. 7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes. -![Recommended WDAC policy deployment process.](images/policyflow.png) +![Recommended WDAC policy deployment process](images/policyflow.png) ### Keep WDAC policies in a source control or document management solution diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 4915d3faea..2c5382e43b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -43,7 +43,7 @@ Each of the template policies has a unique set of policy allow list rules that w More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example WDAC base policies article](example-wdac-base-policies.md). -![Selecting a base template for the policy.](images/wdac-wizard-template-selection.png) +![Selecting a base template for the policy](images/wdac-wizard-template-selection.png) Once the base template is selected, give the policy a name and choose where to save the application control policy on disk. @@ -69,7 +69,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | > [!div class="mx-imgBorder"] -> ![Rule options UI for Windows Allowed mode policy.](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) +> ![Rule options UI for Windows Allowed mode policy](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) ### Advanced Policy Rules Description @@ -84,7 +84,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru | **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | -![Rule options UI for Windows Allowed mode.](images/wdac-wizard-rule-options-UI.png) +![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) > [!NOTE] > We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. @@ -105,7 +105,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | -![Custom filepublisher file rule creation.](images/wdac-wizard-custom-publisher-rule.png) +![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules @@ -123,7 +123,7 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Internal name** | Specifies the internal name of the binary. | > [!div class="mx-imgBorder"] -> ![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) +> ![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index 5f96c11702..bca81708e6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -33,15 +33,15 @@ Prerequisite information about application control can be accessed through the [ Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. -![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) +![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) If the base policy is not configured for supplemental policies, the Wizard will attempt to convert the policy to one that can be supplemented. Once successful, the Wizard will show a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. -![Wizard confirms modification of base policy.](images/wdac-wizard-confirm-base-policy-modification.png) +![Wizard confirms modification of base policy](images/wdac-wizard-confirm-base-policy-modification.png) Policies that cannot be supplemented, for instance, a supplemental policy, will be detected by the Wizard and will show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). -![Wizard detects a bad base policy.](images/wdac-wizard-supplemental-not-base.png) +![Wizard detects a bad base policy](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules @@ -60,7 +60,7 @@ There are only three policy rules that can be configured by the supplemental pol | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -![Rule options UI for Windows Allowed mode.](images/wdac-wizard-supplemental-policy-rule-options-UI.png) +![Rule options UI for Windows Allowed mode](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules @@ -78,7 +78,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | -![Custom filepublisher file rule creation.](images/wdac-wizard-custom-publisher-rule.png) +![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules @@ -96,7 +96,7 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Internal name** | Specifies the internal name of the binary. | -![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) +![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index 09c88d84aa..2b94c7f004 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -36,7 +36,7 @@ The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShe The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#adding-file-rules). -![Configuring the policy rules.](images/wdac-wizard-edit-policy-rules.png) +![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) A description of the policy rule is shown at the bottom of the page when the cursor is placed over the rule title. For a complete list of the policy rules and their capabilities, see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). @@ -50,7 +50,7 @@ Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. -![Removing file rule from policy during edit.](images/wdac-wizard-edit-remove-file-rule.png) +![Removing file rule from policy during edit](images/wdac-wizard-edit-remove-file-rule.png) **Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index 66ad01329f..ec6e988048 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -30,4 +30,4 @@ Select the policies you wish to merge into one policy using the `+ Add Policy` b Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. -![Merging WDAC policies into a final WDAC policy.](images/wdac-wizard-merge.png) +![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md index ed1a7fe460..6da28ad681 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md @@ -57,4 +57,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md index 544e90142e..80d025f7ac 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md @@ -76,4 +76,4 @@ This can only be done in Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file +> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md index 969d80c8bf..1bfddcc3f2 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -32,11 +32,11 @@ ms.technology: mde You can add information about your organization in a contact card to the Windows Security app. You can include a link to a support site, a phone number for a help desk, and an email address for email-based support. -![The security center custom fly-out.](images/security-center-custom-flyout.png) +![The security center custom fly-out](images/security-center-custom-flyout.png) This information will also be shown in some enterprise-specific notifications (including notifications for the [Block at first sight feature](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus), and [potentially unwanted applications](/windows/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)). -![A security center notification.](images/security-center-custom-notif.png) +![A security center notification](images/security-center-custom-notif.png) Users can select the displayed information to initiate a support request: diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md index 13fce0f2d5..919f2cb7a2 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md @@ -56,4 +56,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index f4d3053cd9..f0627d2869 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -50,7 +50,7 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) ## Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md index 274c66bd66..c7d0fb4944 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md @@ -55,4 +55,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md index 3a14dc7c26..5cf74d9fdf 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -52,5 +52,5 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md index 87960171d1..762e9c7402 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -63,7 +63,7 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) ## Hide the Ransomware protection area diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md index 30cc06c3d0..146bdcc78e 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md @@ -34,7 +34,7 @@ Windows 10 in S mode is streamlined for tighter security and superior performanc The Windows Security interface is a little different in Windows 10 in S mode. The **Virus & threat protection** area has fewer options, because the built-in security of Windows 10 in S mode prevents viruses and other threats from running on devices in your organization. In addition, devices running Windows 10 in S mode receive security updates automatically. -![Screen shot of the Windows Security app Virus & threat protection area in Windows 10 in S mode.](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) +![Screen shot of the Windows Security app Virus & threat protection area in Windows 10 in S mode](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) For more information about Windows 10 in S mode, including how to switch out of S mode, see [Windows 10 Pro/Enterprise in S mode](/windows/deployment/windows-10-pro-in-s-mode). diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md index fe03727f33..17eb0a98fd 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -31,7 +31,7 @@ In Windows 10, version 1709 and later, the app also shows information from third In Windows 10, version 1803, the app has two new areas, **Account protection** and **Device security**. -![Screenshot of the Windows Security app showing that the device is protected and five icons for each of the features.](images/security-center-home.png) +![Screenshot of the Windows Security app showing that the device is protected and five icons for each of the features](images/security-center-home.png) > [!NOTE] > The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal console that is used to review and manage [Microsoft Defender for Endpoint](/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). @@ -55,19 +55,19 @@ You can find more information about each section, including options for configur > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) +> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) ## Open the Windows Security app - Click the icon in the notification area on the taskbar. - ![Screenshot of the icon for the Windows Security app on the Windows task bar.](images/security-center-taskbar.png) + ![Screenshot of the icon for the Windows Security app on the Windows task bar](images/security-center-taskbar.png) - Search the Start menu for **Windows Security**. - ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected.](images/security-center-start-menu.png) + ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected](images/security-center-start-menu.png) - Open an area from Windows **Settings**. - ![Screenshot of Windows Settings showing the different areas available in the Windows Security.](images/settings-windows-defender-security-center-areas.png) + ![Screenshot of Windows Settings showing the different areas available in the Windows Security](images/settings-windows-defender-security-center-areas.png) > [!NOTE] > Settings configured with management tools, such as Group Policy, Microsoft Intune, or Microsoft Endpoint Configuration Manager, will generally take precedence over the settings in the Windows Security. See the topics for each of the sections for links to configuring the associated features or products. diff --git a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md index 848345ef8b..8b55c05b3e 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -52,7 +52,7 @@ DRTM lets the system freely boot into untrusted code initially, but shortly afte This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. -![System Guard Secure Launch.](images/system-guard-secure-launch.png) +![System Guard Secure Launch](images/system-guard-secure-launch.png) Secure Launch simplifies management of SRTM measurements because the launch code is now unrelated to a specific hardware configuration. This means the number of valid code measurements is small, and future updates can be deployed more widely and quickly. @@ -82,7 +82,7 @@ While Windows Defender System Guard provides advanced protection that will help As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch will not support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. -![Boot time integrity.](images/windows-defender-system-guard-boot-time-integrity.png) +![Boot time integrity](images/windows-defender-system-guard-boot-time-integrity.png) After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Endpoint Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 55321967df..14695d80d0 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -38,13 +38,13 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) 2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. - ![Secure Launch Configuration.](images/secure-launch-group-policy.png) + ![Secure Launch Configuration](images/secure-launch-group-policy.png) ### Windows Security Center Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**. - ![Windows Security Center.](images/secure-launch-security-app.png) + ![Windows Security Center](images/secure-launch-security-app.png) ### Registry @@ -58,13 +58,13 @@ Click **Start** > **Settings** > **Update & Security** > **Windows Security** > 5. Double-click **Enabled**, change the value to **1**, and click **OK**. - ![Secure Launch Registry.](images/secure-launch-registry.png) + ![Secure Launch Registry](images/secure-launch-registry.png) ## How to verify System Guard Secure Launch is configured and running To verify that Secure Launch is running, use System Information (MSInfo32). Click **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. -![Verifying Secure Launch is running in the Windows Security Center.](images/secure-launch-msinfo.png) +![Verifying Secure Launch is running in the Windows Security Center](images/secure-launch-msinfo.png) > [!NOTE] > To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md), [Credential Guard](../../identity-protection/credential-guard/credential-guard-requirements.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). diff --git a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md index 5819f886fd..71f0392376 100644 --- a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md +++ b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md @@ -38,7 +38,7 @@ type **WF.msc**, and then select **OK**. See also [Open Windows Firewall](./op When you open the Windows Defender Firewall for the first time, you can see the default settings applicable to the local computer. The Overview panel displays security settings for each type of network to which the device can connect. -![Windows Defender Firewall with Advanced Security first time opening.](images/fw01-profiles.png) +![Windows Defender Firewall with Advanced Security first time opening](images/fw01-profiles.png) *Figure 1: Windows Defender Firewall* @@ -55,7 +55,7 @@ View detailed settings for each profile by right-clicking the top-level **Window Maintain the default settings in Windows Defender Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. -![A screenshot of a cell phone Description automatically generated.](images/fw03-defaults.png) +![A screenshot of a cell phone Description automatically generated](images/fw03-defaults.png) *Figure 2: Default inbound/outbound settings* @@ -70,7 +70,7 @@ In many cases, a next step for administrators will be to customize these profile This can be accomplished by right-clicking either **Inbound Rules** or **Outbound Rules**, and selecting **New Rule**. The interface for adding a new rule looks like this: -![Rule creation wizard.](images/fw02-createrule.png) +![Rule creation wizard](images/fw02-createrule.png) *Figure 3: Rule Creation Wizard* @@ -131,7 +131,7 @@ To determine why some applications are blocked from communicating in the network Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. -![Windows Firewall prompt.](images/fw04-userquery.png) +![Windows Firewall prompt](images/fw04-userquery.png) *Figure 4: Dialog box to allow access* @@ -148,7 +148,7 @@ Rule merging settings control how rules from different policy sources can be com The rule merging settings either allow or prevent local admins from creating their own firewall rules in addition to those obtained from Group Policy. -![Customize settings.](images/fw05-rulemerge.png) +![Customize settings](images/fw05-rulemerge.png) *Figure 5: Rule merging setting* @@ -180,11 +180,11 @@ An important firewall feature you can use to mitigate damage during an active at Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or the legacy file *firewall.cpl*. -![Incoming connections.](images/fw06-block.png) +![Incoming connections](images/fw06-block.png) *Figure 6: Windows settings App/Windows Security/Firewall Protection/Network Type* -![Firewall cpl.](images/fw07-legacy.png) +![Firewall cpl](images/fw07-legacy.png) *Figure 7: Legacy firewall.cpl* diff --git a/windows/security/threat-protection/windows-firewall/boundary-zone.md b/windows/security/threat-protection/windows-firewall/boundary-zone.md index 37d7edb647..0e67454be2 100644 --- a/windows/security/threat-protection/windows-firewall/boundary-zone.md +++ b/windows/security/threat-protection/windows-firewall/boundary-zone.md @@ -32,7 +32,7 @@ The GPOs you build for the boundary zone include IPsec or connection security ru Because these boundary zone devices can receive unsolicited inbound communications from untrusted devices that use plaintext, they must be carefully managed and secured in other ways. Mitigating this additional risk is an important part of deciding whether to add a device to the boundary zone. For example, completing a formal business justification process before adding each device to the boundary zone can help ensure that the additional risk is minimized. The following illustration shows a sample process that can help make such a decision. -![design flowchart.](images/wfas-designflowchart1.gif) +![design flowchart](images/wfas-designflowchart1.gif) The goal of this process is to determine whether the risk of adding a device to a boundary zone can be mitigated to a level that makes it acceptable to the organization. Ultimately, if the risk cannot be mitigated, membership must be denied. diff --git a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md index 479b2e67af..bf9a3f7d47 100644 --- a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -28,7 +28,7 @@ ms.technology: mde To get started, open Device Configuration in Intune, then create a new profile. Choose Windows 10 as the platform, and Endpoint Protection as the profile type. Select Windows Defender Firewall. -![Windows Defender Firewall in Intune.](images/windows-firewall-intune.png) +![Windows Defender Firewall in Intune](images/windows-firewall-intune.png) >[!IMPORTANT] >A single Endpoint Protection profile may contain up to a maximum of 150 firewall rules. If a client device requires more than 150 rules, then multiple profiles must be assigned to it. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md index 8f27c49ab5..0e7f47576b 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md @@ -32,7 +32,7 @@ In addition to the basic protection provided by the firewall rules in the previo The following illustration shows the traffic protection needed for this design example. -![domain isolation policy design.](images/wfas-design2example1.gif) +![domain isolation policy design](images/wfas-design2example1.gif) 1. All devices on the Woodgrove Bank corporate network that are Active Directory domain members must authenticate inbound network traffic as coming from another computer that is a member of the domain. Unless otherwise specified in this section, Woodgrove Bank's devices reject all unsolicited inbound network traffic that is not authenticated. If the basic firewall design is also implemented, even authenticated inbound network traffic is dropped unless it matches an inbound firewall rule. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index 659827d1c6..6c13157e59 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -34,7 +34,7 @@ By using connection security rules based on IPsec, you provide a logical barrier The design is shown in the following illustration, with the arrows that show the permitted communication paths. -![isolated domain boundary zone.](images/wfasdomainisoboundary.gif) +![isolated domain boundary zone](images/wfasdomainisoboundary.gif) Characteristics of this design, as shown in the diagram, include the following: diff --git a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md index 718505a9d7..90d5fd2514 100644 --- a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md +++ b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md @@ -22,7 +22,7 @@ Debugging packet drops is a continuous issue to Windows customers. In the past, Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152. -![Event properties.](images/event-properties-5157.png) +![Event properties](images/event-properties-5157.png) The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. @@ -73,7 +73,7 @@ To enable a specific audit event, run the corresponding command in an administra As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop and the interface it happened on. -![Event audit.](images/event-audit-5157.png) +![Event audit](images/event-audit-5157.png) The next sections are divided by `Filter Origin` type, the value is either a rule name or the name of one of the default block filters. If the filter origin is one of the default block filters, skip to the section, **Firewall default block filters**. Otherwise, continue to the section **Firewall rules**. @@ -86,7 +86,7 @@ Get-NetFirewallRule -Name “” Get-NetFirewallRule -Name " {A549B7CF-0542-4B67-93F9-EEBCDD584377} " ``` -![Firewall rule.](images/firewallrule.png) +![Firewall rule](images/firewallrule.png) After identifying the rule that caused the drop, the network admin can now modify/disable the rule to allow the traffic they want through command prompt or using the Windows Defender UI. The network admin can find the rule in the UI with the rule’s `DisplayName`. @@ -118,7 +118,7 @@ Get-NetIPInterface –InterfaceIndex Get-NetIPInterface –InterfaceIndex 5 ``` -![Quarantine default block filter.](images/quarantine-default-block-filter.png) +![Quarantine default block filter](images/quarantine-default-block-filter.png) To learn more about the quarantine feature, see [Quarantine behavior](quarantine.md). @@ -139,7 +139,7 @@ To generate a list of all the query user block rules, you can run the following Get-NetFirewallRule | Where {$_.Name -like "*Query User*"} ``` -![Query user default block filter.](images/query-user-default-block-filters.png) +![Query user default block filter](images/query-user-default-block-filters.png) The query user pop-up feature is enabled by default. diff --git a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md index 5a6acfea96..8c8fb36ee5 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md @@ -38,7 +38,7 @@ The network administrators want to implement Windows Defender Firewall with Adva The following illustration shows the traffic protection needs for this design example. -![design example 1.](images/wfas-designexample1.gif) +![design example 1](images/wfas-designexample1.gif) 1. The network infrastructure servers that are running services, such as Active Directory, DNS, DHCP, or WINS, can receive unsolicited inbound requests from network clients. The network clients can receive the responses from the infrastructure servers. diff --git a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md index 265019f489..7b95852c3d 100644 --- a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -41,7 +41,7 @@ The following are important factors in the implementation of your Windows Defend The next step in implementing your design is to determine in what order each of the deployment steps must be performed. This guide uses checklists to help you accomplish the various deployment tasks that are required to implement your design plan. As the following diagram shows, checklists and subchecklists are used as necessary to provide the end-to-end procedure for deploying a design. -![wfas implementation.](images/wfas-implement.gif) +![wfas implementation](images/wfas-implement.gif) Use the following parent checklists in this section of the guide to become familiar with the deployment tasks for implementing your organization's Windows Defender Firewall with Advanced Security design. diff --git a/windows/security/threat-protection/windows-firewall/quarantine.md b/windows/security/threat-protection/windows-firewall/quarantine.md index bd087a2124..87bab115a6 100644 --- a/windows/security/threat-protection/windows-firewall/quarantine.md +++ b/windows/security/threat-protection/windows-firewall/quarantine.md @@ -196,7 +196,7 @@ Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /s Sample drop audit with `filterOrigin` as `Quarantine Default`. -![Quarantine default.](images/quarantine-default1.png) +![Quarantine default](images/quarantine-default1.png) Once the drop’s filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: @@ -205,7 +205,7 @@ Get-NetIPInterface –InterfaceIndex Get-NetIPInterface –InterfaceIndex 5 ``` -![Quarantine Interfaceindex.](images/quarantine-interfaceindex1.png) +![Quarantine Interfaceindex](images/quarantine-interfaceindex1.png) Using the interface name, event viewer can be searched for any interface related changes. diff --git a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md index 8fbeb35412..81a548b4ee 100644 --- a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md @@ -30,7 +30,7 @@ For devices that share sensitive information over the network, Windows Defender The following illustration shows an encryption zone in an isolated domain. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. -![encryption zone in an isolated domain.](images/wfas-domainisoencrypt.gif) +![encryption zone in an isolated domain](images/wfas-domainisoencrypt.gif) This goal provides the following benefits: diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md index 1a7c288575..a50232fe28 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md @@ -34,7 +34,7 @@ You can restrict access by specifying either computer or user credentials. The following illustration shows an isolated server, and examples of devices that can and cannot communicate with it. Devices that are outside the Woodgrove corporate network, or computers that are in the isolated domain but are not members of the required NAG, cannot communicate with the isolated server. -![isolated domain with network access groups.](images/wfas-domainnag.gif) +![isolated domain with network access groups](images/wfas-domainnag.gif) This goal, which corresponds to [Server Isolation Policy Design](server-isolation-policy-design.md), provides the following features: diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index 5285e56ad9..d7de7d8963 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -35,7 +35,7 @@ The protection provided by domain isolation can help you comply with regulatory The following illustration shows an isolated domain, with one of the zones that are optionally part of the design. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. -![domain isolation.](images/wfas-domainiso.gif) +![domain isolation](images/wfas-domainiso.gif) These goals, which correspond to [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md), provide the following benefits: diff --git a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 8cb2a35d50..4c6f3f4fb7 100644 --- a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -59,7 +59,7 @@ These procedures assume that you already have a public key infrastructure (PKI) The following Windows PowerShell script establishes a connection security rule that uses IKEv2 for communication between two computers (CLIENT1 and SERVER1) that are joined to the corp.contoso.com domain as shown in Figure 1. -![the contoso corporate network.](images/corpnet.gif) +![the contoso corporate network](images/corpnet.gif) **Figure 1** The Contoso corporate network @@ -77,7 +77,7 @@ This script does the following: - Creates the IKEv2 connection security rule called **My IKEv2 Rule**. -![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** +![powershell logo](images/powershelllogosmall.gif)**Windows PowerShell commands** Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. @@ -117,7 +117,7 @@ Use a Windows PowerShell script similar to the following to create a local IPsec >**Important:**  The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. -![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** +![powershell logo](images/powershelllogosmall.gif)**Windows PowerShell commands** Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md index a0070cf114..0e2b6ce11e 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md @@ -46,7 +46,7 @@ In addition to the protection provided by the firewall rules and domain isolatio The following illustration shows the traffic protection needs for this design example. -![isolated server example.](images/wfas-design3example1.gif) +![isolated server example](images/wfas-design3example1.gif) 1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. This includes the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it is sent from an authorized computer. Authorization is determined by membership in a network access group (NAG). diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index 7d44e7c17c..f4d452b4cf 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -32,7 +32,7 @@ You can implement a server isolation design without using domain isolation. To d The design is shown in the following illustration, with arrows that show the permitted communication paths. -![isolated domain with isolated server.](images/wfas-domainisohighsec.gif) +![isolated domain with isolated server](images/wfas-domainisohighsec.gif) Characteristics of this design include the following: diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index bf70a3a3b7..3e383743a4 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -328,7 +328,7 @@ Windows PowerShell can create powerful, complex IPsec policies like in Netsh and In Netsh, the authentication and cryptographic sets were specified as a list of comma-separated tokens in a specific format. In Windows PowerShell, rather than using default settings, you first create your desired authentication or cryptographic proposal objects and bundle them into lists in your preferred order. Then, you create one or more IPsec rules that reference these sets. The benefit of this model is that programmatic access to the information in the rules is much easier. See the following sections for clarifying examples. -![object model for creating a single ipsec rule.](images/createipsecrule.gif) +![object model for creating a single ipsec rule](images/createipsecrule.gif) ### Create IPsec rules @@ -353,7 +353,7 @@ If you want to create a custom set of quick-mode proposals that includes both AH You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object. -![crypto set object.](images/qmcryptoset.gif) +![crypto set object](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index 8e719f1364..f18a5180db 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -61,12 +61,12 @@ You can download the security baselines from the [Microsoft Download Center](htt The security baselines are included in the [Security Compliance Toolkit (SCT)](security-compliance-toolkit-10.md), which can be downloaded from the Microsoft Download Center. The SCT also includes tools to help admins manage the security baselines. -[![Security Compliance Toolkit.](images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) -[![Get Support.](images/get-support.png)](get-support-for-security-baselines.md) +[![Security Compliance Toolkit](images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) +[![Get Support](images/get-support.png)](get-support-for-security-baselines.md) ## Community -[![Microsoft Security Guidance Blog.](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) +[![Microsoft Security Guidance Blog](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) ## Related Videos diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md index 170918a4fa..cfb7427cbc 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md @@ -60,12 +60,12 @@ You can download the security baselines from the [Microsoft Download Center](htt The security baselines are included in the [Security Compliance Toolkit (SCT)](security-compliance-toolkit-10.md), which can be downloaded from the Microsoft Download Center. The SCT also includes tools to help admins manage the security baselines. -[![Security Compliance Toolkit.](./../images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) -[![Get Support.](./../images/get-support.png)](get-support-for-security-baselines.md) +[![Security Compliance Toolkit](./../images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) +[![Get Support](./../images/get-support.png)](get-support-for-security-baselines.md) ## Community -[![Microsoft Security Guidance Blog.](./../images/community.png)](/archive/blogs/secguide/) +[![Microsoft Security Guidance Blog](./../images/community.png)](/archive/blogs/secguide/) ## Related Videos diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md index b99b7a48ad..1387997652 100644 --- a/windows/whats-new/contribute-to-a-topic.md +++ b/windows/whats-new/contribute-to-a-topic.md @@ -38,7 +38,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 1. Go to the article that you want to update, and then click **Edit**. - ![GitHub Web, showing the Edit link.](images/contribute-link.png) + ![GitHub Web, showing the Edit link](images/contribute-link.png) 2. Sign into (or sign up for) a GitHub account. @@ -46,7 +46,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) @@ -55,11 +55,11 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change**. - ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png) + ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) The **Comparing changes** screen shows the changes between your version of the article and the original content. @@ -67,7 +67,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner If there are no problems, you’ll see the message, **Able to merge**. - ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png) + ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 256dad7a3a..83e1c6b032 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -48,7 +48,7 @@ This version of Window 10 includes security improvements for threat protection, The [Microsoft Defender for Endpoint](/windows/security/threat-protection/index) platform includes the security pillars shown in the following diagram. In this version of Windows, Defender for Endpoint includes powerful analytics, security stack integration, and centralized management for better detection, prevention, investigation, response, and management. -![Microsoft Defender for Endpoint.](../images/wdatp.png) +![Microsoft Defender for Endpoint](../images/wdatp.png) ##### Attack surface reduction @@ -275,7 +275,7 @@ The WSC service now requires antivirus products to run as a protected process to WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. -![Security at a glance.](../images/defender.png "Windows Security Center") +![Security at a glance](../images/defender.png "Windows Security Center") #### Group Policy Security Options @@ -288,7 +288,7 @@ A new security policy setting We’ve continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: -![S mode settings.](../images/virus-and-threat-protection.png "Virus & threat protection settings") +![S mode settings](../images/virus-and-threat-protection.png "Virus & threat protection settings") ## Deployment @@ -387,7 +387,7 @@ If you have shared devices deployed in your work place, **Fast sign-in** enables 3. Sign-in to a shared PC with your account. You'll notice the difference! - ![fast sign-in.](../images/fastsignin.png "fast sign-in") + ![fast sign-in](../images/fastsignin.png "fast sign-in") ### Web sign-in to Windows 10 @@ -402,7 +402,7 @@ Until now, Windows logon only supported the use of identities federated to ADFS 3. On the lock screen, select web sign-in under sign-in options. 4. Click the “Sign in” button to continue. -![Sign-in option.](../images/websignin.png "web sign-in") +![Sign-in option](../images/websignin.png "web sign-in") ## Windows Analytics @@ -470,7 +470,7 @@ The OS uninstall period is a length of time that users are given when they can o Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. -![get bulk token action in wizard.](../images/bulk-token.png) +![get bulk token action in wizard](../images/bulk-token.png) ### Windows Spotlight @@ -636,7 +636,7 @@ If you have a device that has been updated to Windows 10 Enterprise LTSC 2019, t We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -![Reg editor.](../images/regeditor.png "Registry editor dropdown") +![Reg editor](../images/regeditor.png "Registry editor dropdown") ## Remote Desktop with Biometrics @@ -650,9 +650,9 @@ To get started, sign into your device using Windows Hello for Business. Bring up See the following example: -![Enter your credentials.](../images/RDPwBioTime.png "Windows Hello") -![Provide credentials.](../images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016.](../images/hyper-v.png "Microsoft Hyper-V Server 2016") +![Enter your credentials](../images/RDPwBioTime.png "Windows Hello") +![Provide credentials](../images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016](../images/hyper-v.png "Microsoft Hyper-V Server 2016") ## See Also diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index 48bf6b509b..b05bba2289 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -31,11 +31,11 @@ Previously known as *Windows Imaging and Configuration Designer (ICD)*, the tool Windows Configuration Designer in Windows 10, version 1703, includes several new wizards to make it easier to create provisioning packages. -![wizards for desktop, mobile, kiosk, Surface Hub.](images/wcd-options.png) +![wizards for desktop, mobile, kiosk, Surface Hub](images/wcd-options.png) Both the desktop and kiosk wizards include an option to remove pre-installed software, based on the new [CleanPC configuration service provider (CSP)](/windows/client-management/mdm/cleanpc-csp). -![remove pre-installed software option.](images/wcd-cleanpc.png) +![remove pre-installed software option](images/wcd-cleanpc.png) [Learn more about Windows Configuration Designer.](/windows/configuration/provisioning-packages/provisioning-packages) @@ -44,7 +44,7 @@ Both the desktop and kiosk wizards include an option to remove pre-installed sof Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. -![get bulk token action in wizard.](images/bulk-token.png) +![get bulk token action in wizard](images/bulk-token.png) ### Windows Spotlight @@ -279,7 +279,7 @@ Learn about the new Group Policies that were added in Windows 10, version 1703. The Lockdown Designer app helps you configure and create a lockdown XML file to apply to devices running Windows 10 Mobile, and includes a remote simulation to help you determine the layout for tiles on the Start screen. Using Lockdown Designer is easier than [manually creating a lockdown XML file](/windows/configuration/mobile-devices/lockdown-xml). -![Lockdown Designer app in Store.](images/ldstore.png) +![Lockdown Designer app in Store](images/ldstore.png) [Learn more about the Lockdown Designer app.](/windows/configuration/mobile-devices/mobile-lockdown-designer) diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index 6410248ff6..e73c5af9bc 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -46,7 +46,7 @@ To learn more about Autopilot self-deploying mode and to see step-by-step instru We’ve continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: > [!div class="mx-imgBorder"] -> ![Virus & threat protection settings.](images/virus-and-threat-protection.png "Virus & threat protection settings") +> ![Virus & threat protection settings](images/virus-and-threat-protection.png "Virus & threat protection settings") With controlled folder access you can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. @@ -109,16 +109,16 @@ To try this: See the following example: > [!div class="mx-imgBorder"] -> ![Security at a glance.](images/1_AppBrowser.png "app and browser control") +> ![Security at a glance](images/1_AppBrowser.png "app and browser control") > [!div class="mx-imgBorder"] -> ![Isolated browser.](images/2_InstallWDAG.png "isolated browsing") +> ![Isolated browser](images/2_InstallWDAG.png "isolated browsing") > [!div class="mx-imgBorder"] -> ![change WDAG settings.](images/3_ChangeSettings.png "change settings") +> ![change WDAG settings](images/3_ChangeSettings.png "change settings") > [!div class="mx-imgBorder"] -> ![view WDAG settings.](images/4_ViewSettings.jpg "view settings") +> ![view WDAG settings](images/4_ViewSettings.jpg "view settings") ### Windows Security Center @@ -130,7 +130,7 @@ The WSC service now requires antivirus products to run as a protected process to WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. -![alt text.](images/defender.png "Windows Security Center") +![alt text](images/defender.png "Windows Security Center") ### Windows Defender Firewall now supports Windows Subsystem for Linux (WSL) processes @@ -195,7 +195,7 @@ We introduced a simplified assigned access configuration experience in **Setting To use this feature, go to **Settings**, search for **assigned access**, and open the **Set up a kiosk** page. -![set up a kiosk.](images/kiosk-mode.png "set up a kiosk") +![set up a kiosk](images/kiosk-mode.png "set up a kiosk") Microsoft Edge kiosk mode running in single-app assigned access has two kiosk types. @@ -203,7 +203,7 @@ Microsoft Edge kiosk mode running in single-app assigned access has two kiosk ty 2. **Public browsing** supports multi-tab browsing and runs InPrivate mode with minimal features available. Users cannot minimize, close, or open new Microsoft Edge windows or customize them using Microsoft Edge Settings. Users can clear browsing data and downloads, and restart Microsoft Edge by clicking **End session**. Administrators can configure Microsoft Edge to restart after a period of inactivity. -![single app assigned access.](images/SingleApp_contosoHotel_inFrame@2x.png "single app assigned access") +![single app assigned access](images/SingleApp_contosoHotel_inFrame@2x.png "single app assigned access") Microsoft Edge kiosk mode running in multi-app assigned access has two kiosk types. @@ -212,11 +212,11 @@ Microsoft Edge kiosk mode running in multi-app assigned access has two kiosk typ **Public browsing** supports multi-tab browsing and runs InPrivate mode with minimal features available. In this configuration, Microsoft Edge can be one of many apps available. Users can close and open multiple InPrivate mode windows. -![multi-app assigned access.](images/Multi-app_kiosk_inFrame.png "multi-app assigned access") +![multi-app assigned access](images/Multi-app_kiosk_inFrame.png "multi-app assigned access") **Normal mode** runs a full version of Microsoft Edge, although some features may not work depending on what apps are configured in assigned access. For example, if the Microsoft Store is not set up, users cannot get books. -![normal mode.](images/Normal_inFrame.png "normal mode") +![normal mode](images/Normal_inFrame.png "normal mode") Learn more about [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy). @@ -224,7 +224,7 @@ Learn more about [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-ed We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -![Registry editor dropdown.](images/regeditor.png "Registry editor dropdown") +![Registry editor dropdown](images/regeditor.png "Registry editor dropdown") ## Faster sign-in to a Windows 10 shared pc @@ -237,7 +237,7 @@ Do you have shared devices deployed in your work place? **Fast sign-in** enables 3. Sign-in to a shared PC with your account. You'll notice the difference! - ![fast sign-in.](images/fastsignin.png "fast sign-in") + ![fast sign-in](images/fastsignin.png "fast sign-in") >[!NOTE] >This is a private preview feature and therefore not meant or recommended for production purposes. @@ -259,7 +259,7 @@ Until now, Windows logon only supported the use of identities federated to ADFS 4. Click the **Sign in** button to continue. > [!div class="mx-imgBorder"] - > ![Web sign-in.](images/websignin.png "web sign-in") + > ![Web sign-in](images/websignin.png "web sign-in") >[!NOTE] >This is a private preview feature and therefore not meant or recommended for production purposes. @@ -271,7 +271,7 @@ Android phone users, you can finally stop emailing yourself photos. With Your Ph For iPhone users, **Your Phone** app also helps you to link your phone to your PC. Surf the web on your phone, then send the webpage instantly to your computer to continue what you’re doing–-read, watch, or browse-- with all the benefits of a bigger screen. > [!div class="mx-imgBorder"] -> ![your phone.](images/your-phone.png "your phone") +> ![your phone](images/your-phone.png "your phone") The desktop pin takes you directly to the **Your Phone** app for quicker access to your phone’s content. You can also go through the all apps list in Start, or use the Windows key and search for **Your Phone**. @@ -283,7 +283,7 @@ One of the things we’ve heard from you is that it’s hard to know when you’ * Video mode increases the screen-to-screen latency to ensure the video on the big screen plays back smoothly * Productivity modes strikes a balance between game mode and video mode; the screen-to screen-latency is responsive enough that typing feels natural, while ensuring videos don’t glitch as often. -![wireless projection banner.](images/beaming.png "wireless projection banner") +![wireless projection banner](images/beaming.png "wireless projection banner") ## Remote Desktop with Biometrics @@ -293,6 +293,6 @@ To get started, sign into your device using Windows Hello for Business. Bring up See the following example: -![Enter your credentials.](images/RDPwBioTime.png "Windows Hello") -![Enter your credentials.](images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016.](images/hyper-v.png "Microsoft Hyper-V Server 2016") +![Enter your credentials](images/RDPwBioTime.png "Windows Hello") +![Enter your credentials](images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016](images/hyper-v.png "Microsoft Hyper-V Server 2016") diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 74eb1725e2..371bf97c95 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -125,7 +125,7 @@ The draft release of the [security configuration baseline settings](/archive/blo This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: -![System Guard.](images/system-guard.png "SMM Firmware Measurement") +![System Guard](images/system-guard.png "SMM Firmware Measurement") ### Identity Protection diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index 692871b1c3..ac0d4984f2 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -43,7 +43,7 @@ In this release, [Windows Defender System Guard](/windows/security/threat-prote With this improvement, the OS can detect a higher level of SMM compliance, enabling devices to be even more hardened against SMM exploits and vulnerabilities. This feature is forward-looking and currently requires new hardware available soon. - ![System Guard.](images/system-guard2.png) + ![System Guard](images/system-guard2.png) ### Windows Defender Application Guard From de364ca11502abb8d95f93847f7662f557d00144 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Fri, 27 Aug 2021 12:01:28 +0530 Subject: [PATCH 0126/1214] Revert "Revert "Merge branch 'master' into aljupudi-w11defender-branch01"" This reverts commit e87ef8501d40b3c702f8ea2aea542b91cc179bf2. --- CONTRIBUTING.md | 10 +- ...ct-data-using-enterprise-site-discovery.md | 14 +- ...rprise-mode-logging-and-data-collection.md | 18 +- ...-on-enterprise-mode-and-use-a-site-list.md | 4 +- ...control-and-logging-for-enterprise-mode.md | 4 +- ...ct-data-using-enterprise-site-discovery.md | 14 +- .../deprecated-document-modes.md | 2 +- ...doc-modes-and-enterprise-mode-site-list.md | 6 +- .../out-of-date-activex-control-blocking.md | 6 +- ...-the-default-browser-using-group-policy.md | 2 +- ...rprise-mode-logging-and-data-collection.md | 18 +- ...s-and-tricks-to-manage-ie-compatibility.md | 4 +- ...-on-enterprise-mode-and-use-a-site-list.md | 4 +- ...control-and-logging-for-enterprise-mode.md | 4 +- .../licensing-version-and-features-ieak11.md | 52 ++--- .../educator-tib-get-started.md | 62 +++--- education/trial-in-a-box/index.md | 4 +- .../trial-in-a-box/itadmin-tib-get-started.md | 46 ++--- education/trial-in-a-box/support-options.md | 12 +- education/windows/autopilot-reset.md | 8 +- education/windows/change-to-pro-education.md | 20 +- .../windows/chromebook-migration-guide.md | 4 +- .../configure-windows-for-education.md | 10 +- .../deploy-windows-10-in-a-school-district.md | 16 +- .../windows/deploy-windows-10-in-a-school.md | 14 +- .../windows/edu-deployment-recommendations.md | 12 +- .../education-scenarios-store-for-business.md | 4 +- .../windows/get-minecraft-for-education.md | 6 +- education/windows/index.md | 10 +- education/windows/school-get-minecraft.md | 46 ++--- .../set-up-school-pcs-azure-ad-join.md | 2 +- .../set-up-students-pcs-to-join-domain.md | 2 +- .../windows/set-up-students-pcs-with-apps.md | 26 +-- education/windows/set-up-windows-10.md | 2 +- education/windows/take-a-test-multiple-pcs.md | 14 +- education/windows/take-a-test-single-pc.md | 4 +- education/windows/take-tests-in-windows-10.md | 2 +- education/windows/teacher-get-minecraft.md | 22 +- .../windows/use-set-up-school-pcs-app.md | 2 +- smb/cloud-mode-business-setup.md | 92 ++++----- smb/index.md | 6 +- ...quire-apps-microsoft-store-for-business.md | 2 +- .../billing-understand-your-invoice-msfb.md | 6 +- ...or-business-education-powershell-module.md | 2 +- ...oubleshoot-microsoft-store-for-business.md | 10 +- ...-new-microsoft-store-business-education.md | 4 +- .../working-with-line-of-business-apps.md | 2 +- ...ation-publishing-and-client-interaction.md | 6 +- .../app-v/appv-deployment-checklist.md | 6 +- .../app-v/appv-install-the-sequencer.md | 2 +- .../app-v/appv-planning-checklist.md | 12 +- ...enterprise-background-activity-controls.md | 6 +- .../per-user-services-in-windows.md | 14 +- .../svchost-service-refactoring.md | 8 +- .../administrative-tools-in-windows-10.md | 4 +- ...nced-troubleshooting-802-authentication.md | 20 +- .../advanced-troubleshooting-boot-problems.md | 2 +- ...eshooting-wireless-network-connectivity.md | 4 +- ...t-removal-policy-external-storage-media.md | 2 +- .../connect-to-remote-aadj-pc.md | 4 +- .../client-management/img-boot-sequence.md | 2 +- .../introduction-page-file.md | 6 +- ...e-device-installation-with-group-policy.md | 38 ++-- .../manage-settings-app-with-group-policy.md | 2 +- ...-in-your-organization-modern-management.md | 2 +- .../mandatory-user-profile.md | 16 +- .../mdm/accountmanagement-csp.md | 2 +- ...ure-ad-tenant-and-azure-ad-subscription.md | 32 +-- .../client-management/mdm/applocker-csp.md | 6 +- .../mdm/appv-deploy-and-config.md | 2 +- ...e-active-directory-integration-with-mdm.md | 6 +- ...omatic-mdm-enrollment-in-the-new-portal.md | 4 +- .../client-management/mdm/bootstrap-csp.md | 2 +- .../mdm/browserfavorite-csp.md | 2 +- ...ollment-using-windows-provisioning-tool.md | 16 +- .../mdm/cellularsettings-csp.md | 2 +- .../mdm/cm-cellularentries-csp.md | 2 +- ...onfiguration-service-provider-reference.md | 60 +++--- .../mdm/device-update-management.md | 14 +- .../mdm/deviceinstanceservice-csp.md | 2 +- .../client-management/mdm/devicelock-csp.md | 2 +- .../diagnose-mdm-failures-in-windows-10.md | 20 +- .../disconnecting-from-mdm-unenrollment.md | 2 +- .../mdm/eap-configuration.md | 22 +- .../mdm/enable-admx-backed-policies-in-mdm.md | 12 +- ...dded-8-1-handheld-devices-to-windows-10.md | 44 ++-- ...device-automatically-using-group-policy.md | 44 ++-- .../mdm/enterprise-app-management.md | 2 +- .../mdm/enterpriseappmanagement-csp.md | 2 +- .../client-management/mdm/filesystem-csp.md | 2 +- .../mdm/healthattestation-csp.md | 2 +- windows/client-management/mdm/hotspot-csp.md | 2 +- ...rver-side-mobile-application-management.md | 2 +- ...ent-tool-for-windows-store-for-business.md | 6 +- .../mdm/mdm-enrollment-of-windows-devices.md | 76 +++---- .../client-management/mdm/messaging-csp.md | 2 +- .../mdm/mobile-device-enrollment.md | 2 +- windows/client-management/mdm/napdef-csp.md | 4 +- ...ew-in-windows-mdm-enrollment-management.md | 10 +- .../mdm/passportforwork-csp.md | 4 +- .../policy-configuration-service-provider.md | 2 +- .../mdm/policy-csp-deviceinstallation.md | 8 +- .../mdm/policy-csp-mixedreality.md | 28 +-- .../mdm/policy-csp-system.md | 15 +- .../mdm/push-notification-windows-mdm.md | 16 +- .../client-management/mdm/pxlogical-csp.md | 4 +- ...ree-azure-active-directory-subscription.md | 6 +- .../mdm/securitypolicy-csp.md | 2 +- .../mdm/understanding-admx-backed-policies.md | 4 +- .../mdm/unifiedwritefilter-csp.md | 2 +- windows/client-management/mdm/vpn-csp.md | 2 +- .../mdm/w4-application-csp.md | 2 +- .../mdm/w7-application-csp.md | 2 +- windows/client-management/mdm/wifi-csp.md | 2 +- .../mdm/windows-mdm-enterprise-settings.md | 2 +- .../windowsadvancedthreatprotection-csp.md | 2 +- .../mdm/wmi-providers-supported-in-windows.md | 60 +++--- windows/client-management/quick-assist.md | 2 +- .../troubleshoot-inaccessible-boot-device.md | 16 +- .../troubleshoot-stop-errors.md | 4 +- .../troubleshoot-tcpip-connectivity.md | 16 +- .../troubleshoot-tcpip-netmon.md | 8 +- .../troubleshoot-tcpip-port-exhaust.md | 18 +- .../troubleshoot-tcpip-rpc-errors.md | 10 +- .../windows-version-search.md | 10 +- .../configure-windows-10-taskbar.md | 16 +- .../cortana-at-work/cortana-at-work-crm.md | 4 +- .../cortana-at-work-powerbi.md | 26 +-- .../cortana-at-work-voice-commands.md | 2 +- .../customize-and-export-start-layout.md | 2 +- ...-10-start-screens-by-using-group-policy.md | 4 +- ...-by-using-provisioning-packages-and-icd.md | 2 +- ...ation-user-model-id-of-an-installed-app.md | 2 +- windows/configuration/kiosk-methods.md | 12 +- windows/configuration/kiosk-prepare.md | 4 +- windows/configuration/kiosk-shelllauncher.md | 2 +- windows/configuration/kiosk-single-app.md | 10 +- windows/configuration/kiosk-troubleshoot.md | 2 +- .../lock-down-windows-10-applocker.md | 8 +- .../lock-down-windows-10-to-specific-apps.md | 14 +- .../manage-wifi-sense-in-enterprise.md | 6 +- .../mobile-devices/lockdown-xml.md | 30 +-- .../mobile-lockdown-designer.md | 28 +-- .../provisioning-configure-mobile.md | 6 +- .../mobile-devices/provisioning-nfc.md | 2 +- ...kiosk-for-windows-10-for-mobile-edition.md | 12 +- .../mobile-devices/start-layout-xml-mobile.md | 2 +- windows/configuration/provisioning-apn.md | 4 +- ...can-use-configuration-service-providers.md | 10 +- .../provision-pcs-for-initial-deployment.md | 6 +- ...rovision-pcs-with-apps-and-certificates.md | 8 +- .../provision-pcs-with-apps.md | 10 +- .../provisioning-apply-package.md | 14 +- .../provisioning-create-package.md | 10 +- .../provisioning-install-icd.md | 2 +- .../provisioning-multivariant.md | 2 +- .../provisioning-packages.md | 2 +- .../provisioning-script-to-install-app.md | 4 +- .../set-up-shared-or-guest-pc.md | 8 +- .../start-layout-troubleshoot.md | 14 +- .../configuration/start-secondary-tiles.md | 8 +- .../uev-deploy-uev-for-custom-applications.md | 2 +- windows/configuration/ue-v/uev-for-windows.md | 4 +- .../ue-v/uev-prepare-for-deployment.md | 16 +- .../uev-upgrade-uev-from-previous-releases.md | 2 +- .../configuration/wcd/wcd-admxingestion.md | 4 +- ...ws-10-start-layout-options-and-policies.md | 4 +- windows/configuration/windows-spotlight.md | 8 +- windows/deployment/TOC.yml | 2 + .../deployment/deploy-enterprise-licenses.md | 6 +- windows/deployment/deploy-m365.md | 4 +- windows/deployment/deploy-whats-new.md | 2 +- ...ystem-image-using-configuration-manager.md | 4 +- ...-windows-pe-using-configuration-manager.md | 16 +- ...e-boot-image-with-configuration-manager.md | 10 +- ...ence-with-configuration-manager-and-mdt.md | 4 +- ...-windows-10-using-configuration-manager.md | 4 +- ...-10-using-pxe-and-configuration-manager.md | 30 +-- ...0-deployment-with-configuration-manager.md | 12 +- ...f-windows-10-with-configuration-manager.md | 22 +- ...-windows-10-using-configuration-manager.md | 22 +- ...-windows-10-using-configuration-manager.md | 24 +-- ...to-windows-10-with-configuraton-manager.md | 16 +- .../assign-applications-using-roles-in-mdt.md | 6 +- ...d-environment-for-windows-10-deployment.md | 10 +- .../configure-mdt-settings.md | 2 +- .../create-a-windows-10-reference-image.md | 28 +-- .../deploy-a-windows-10-image-using-mdt.md | 38 ++-- ...d-with-the-microsoft-deployment-toolkit.md | 8 +- ...prepare-for-windows-deployment-with-mdt.md | 10 +- ...sh-a-windows-7-computer-with-windows-10.md | 6 +- ...s-7-computer-with-a-windows-10-computer.md | 12 +- .../set-up-mdt-for-bitlocker.md | 6 +- ...ows-10-deployment-in-a-test-environment.md | 4 +- ...0-with-the-microsoft-deployment-toolkit.md | 8 +- .../use-orchestrator-runbooks-with-mdt.md | 20 +- ...stage-windows-10-deployment-information.md | 8 +- .../use-web-services-in-mdt.md | 16 +- windows/deployment/index.yml | 2 +- windows/deployment/mbr-to-gpt.md | 2 +- ...compatibility-administrator-users-guide.md | 2 +- ...oyment-considerations-for-windows-to-go.md | 12 +- ...rstanding-and-using-compatibility-fixes.md | 4 +- .../deployment/planning/using-the-sua-tool.md | 2 +- .../planning/using-the-sua-wizard.md | 2 +- .../windows-10-infrastructure-requirements.md | 2 +- windows/deployment/s-mode.md | 4 +- windows/deployment/update/PSFxWhitepaper.md | 8 +- windows/deployment/update/WIP4Biz-intro.md | 2 +- .../deployment/update/check-release-health.md | 12 +- .../update/deployment-service-overview.md | 4 +- .../get-started-updates-channels-tools.md | 12 +- .../update/how-windows-update-works.md | 14 +- .../deployment/update/media-dynamic-update.md | 2 +- .../olympia/olympia-enrollment-guidelines.md | 14 +- .../deployment/update/plan-define-strategy.md | 4 +- windows/deployment/update/safeguard-holds.md | 2 +- ...update-compliance-delivery-optimization.md | 2 +- ...update-compliance-feature-update-status.md | 2 +- .../update-compliance-need-attention.md | 2 +- ...pdate-compliance-security-update-status.md | 2 +- .../update/update-compliance-using.md | 8 +- .../deployment/update/waas-configure-wufb.md | 2 +- .../waas-delivery-optimization-setup.md | 2 +- .../update/waas-delivery-optimization.md | 2 +- ...aas-deployment-rings-windows-10-updates.md | 12 +- .../deployment/update/waas-integrate-wufb.md | 2 +- .../update/waas-manage-updates-wsus.md | 48 ++--- .../update/waas-manage-updates-wufb.md | 14 +- .../waas-optimize-windows-10-updates.md | 16 +- windows/deployment/update/waas-overview.md | 14 +- windows/deployment/update/waas-restart.md | 19 +- ...s-servicing-channels-windows-10-updates.md | 24 +-- .../update/waas-servicing-differences.md | 6 +- ...s-servicing-strategy-windows-10-updates.md | 14 +- .../deployment/update/waas-wufb-csp-mdm.md | 18 +- .../update/waas-wufb-group-policy.md | 18 +- windows/deployment/update/waas-wufb-intune.md | 20 +- .../deployment/update/windows-update-logs.md | 10 +- .../update/windows-update-overview.md | 2 +- .../update/wufb-compliancedeadlines.md | 12 +- .../deployment/update/wufb-manageupdate.md | 2 +- windows/deployment/upgrade/quick-fixes.md | 8 +- windows/deployment/upgrade/setupdiag.md | 14 +- windows/deployment/upgrade/submit-errors.md | 4 +- .../upgrade/troubleshoot-upgrade-errors.md | 14 +- .../upgrade/windows-10-edition-upgrades.md | 42 ++-- .../upgrade/windows-error-reporting.md | 2 +- .../usmt/migration-store-types-overview.md | 2 +- .../usmt/usmt-common-migration-scenarios.md | 4 +- ...ctive-directory-based-activation-client.md | 12 +- ...ivate-using-key-management-service-vamt.md | 12 +- .../activate-windows-10-clients-vamt.md | 4 +- .../add-remove-computers-vamt.md | 2 +- .../configure-client-computers-vamt.md | 2 +- .../volume-activation/install-vamt.md | 4 +- .../volume-activation/introduction-vamt.md | 4 +- .../plan-for-volume-activation-client.md | 6 +- .../scenario-online-activation-vamt.md | 2 +- .../scenario-proxy-activation-vamt.md | 2 +- ...olume-activation-management-tool-client.md | 4 +- .../volume-activation/vamt-known-issues.md | 2 +- .../windows-10-deployment-posters.md | 4 +- windows/deployment/windows-10-media.md | 4 +- windows/deployment/windows-10-poc-mdt.md | 4 +- .../windows-10-poc-sc-config-mgr.md | 18 +- windows/deployment/windows-10-poc.md | 16 +- .../windows-10-subscription-activation.md | 14 +- .../demonstrate-deployment-on-vm.md | 128 ++++++------ .../windows-deployment-scenarios-and-tools.md | 28 +-- .../privacy/Microsoft-DiagnosticDataViewer.md | 4 +- .../diagnostic-data-viewer-overview.md | 16 +- ...system-components-to-microsoft-services.md | 192 +++++++++--------- .../active-directory-accounts.md | 30 +-- .../access-control/local-accounts.md | 16 +- .../access-control/security-identifiers.md | 2 +- .../access-control/security-principals.md | 2 +- .../identity-protection/configure-s-mime.md | 8 +- .../credential-guard-how-it-works.md | 2 +- .../credential-guard-manage.md | 4 +- .../enterprise-certificate-pinning.md | 12 +- .../feature-multifactor-unlock.md | 4 +- .../hello-adequate-domain-controllers.md | 10 +- .../hello-cert-trust-adfs.md | 20 +- .../hello-cert-trust-validate-ad-prereq.md | 2 +- .../hello-deployment-rdp-certs.md | 6 +- .../hello-errors-during-pin-creation.md | 2 +- .../hello-feature-pin-reset.md | 8 +- .../hello-feature-remote-desktop.md | 2 +- .../hello-how-it-works-authentication.md | 10 +- .../hello-how-it-works-provisioning.md | 12 +- .../hello-hybrid-aadj-sso-base.md | 52 ++--- .../hello-hybrid-aadj-sso-cert.md | 94 ++++----- .../hello-hybrid-cert-trust-devreg.md | 18 +- .../hello-hybrid-cert-whfb-provision.md | 8 +- .../hello-hybrid-key-whfb-provision.md | 8 +- .../hello-key-trust-adfs.md | 20 +- .../hello-for-business/hello-overview.md | 2 +- .../hello-prepare-people-to-use.md | 6 +- .../passwordless-strategy.md | 20 +- .../retired/hello-how-it-works.md | 2 +- .../remote-credential-guard.md | 6 +- .../smart-card-and-remote-desktop-services.md | 2 +- .../smart-cards/smart-card-architecture.md | 8 +- ...rt-card-certificate-propagation-service.md | 2 +- ...ertificate-requirements-and-enumeration.md | 12 +- .../smart-card-removal-policy-service.md | 2 +- .../how-user-account-control-works.md | 10 +- ...l-smart-card-deploy-virtual-smart-cards.md | 2 +- .../virtual-smart-card-evaluate-security.md | 2 +- .../virtual-smart-card-get-started.md | 22 +- ...tual-smart-card-use-virtual-smart-cards.md | 2 +- .../vpn/vpn-authentication.md | 2 +- .../vpn/vpn-auto-trigger-profile.md | 4 +- .../vpn/vpn-conditional-access.md | 2 +- .../vpn/vpn-connection-type.md | 6 +- .../vpn/vpn-name-resolution.md | 2 +- .../vpn/vpn-profile-options.md | 2 +- .../identity-protection/vpn/vpn-routing.md | 4 +- .../vpn/vpn-security-features.md | 2 +- ...dential-theft-mitigation-guide-abstract.md | 2 +- .../bitlocker/bitlocker-countermeasures.md | 4 +- .../bitlocker-deployment-comparison.md | 48 ++--- .../bitlocker-recovery-guide-plan.md | 16 +- ...ve-encryption-tools-to-manage-bitlocker.md | 2 +- .../bitlocker/troubleshoot-bitlocker.md | 4 +- .../ts-bitlocker-cannot-encrypt-issues.md | 4 +- .../ts-bitlocker-decode-measured-boot-logs.md | 16 +- .../bitlocker/ts-bitlocker-intune-issues.md | 38 ++-- .../kernel-dma-protection-for-thunderbolt.md | 10 +- .../secure-the-windows-10-boot-process.md | 4 +- .../tpm/how-windows-uses-the-tpm.md | 4 +- ...reate-and-verify-an-efs-dra-certificate.md | 2 +- ...e-vpn-and-wip-policy-using-intune-azure.md | 8 +- .../create-wip-policy-using-configmgr.md | 40 ++-- .../create-wip-policy-using-intune-azure.md | 56 ++--- .../deploy-wip-policy-using-intune-azure.md | 2 +- .../wip-app-enterprise-context.md | 4 +- .../wip-learning.md | 8 +- ...tion-based-protection-of-code-integrity.md | 4 +- .../coordinated-malware-eradication.md | 2 +- .../intelligence/fileless-threats.md | 4 +- .../intelligence/malware-naming.md | 2 +- .../intelligence/phishing.md | 2 +- .../portal-submission-troubleshooting.md | 14 +- .../intelligence/worms-malware.md | 2 +- .../mbsa-removal-and-guidance.md | 4 +- .../install-md-app-guard.md | 6 +- .../md-app-guard-overview.md | 2 +- .../test-scenarios-md-app-guard.md | 34 ++-- ...microsoft-defender-smartscreen-overview.md | 2 +- ...ender-smartscreen-set-individual-device.md | 2 +- ...tions-for-app-related-security-policies.md | 6 +- ...iew-of-threat-mitigations-in-windows-10.md | 4 +- ...-the-health-of-windows-10-based-devices.md | 26 +-- ...-information-when-the-session-is-locked.md | 2 +- .../security-policy-settings.md | 8 +- ...arding-to-assist-in-intrusion-detection.md | 8 +- .../windows-10-mobile-security-guide.md | 2 +- .../LOB-win32-apps-on-s.md | 6 +- .../plan-for-applocker-policy-management.md | 2 +- ...ent-setting-inheritance-in-group-policy.md | 2 +- ...the-applocker-policy-deployment-process.md | 2 +- ...s-defender-application-control-policies.md | 2 +- ...s-defender-application-control-policies.md | 2 +- ...or-windows-defender-application-control.md | 8 +- ...rt-windows-defender-application-control.md | 20 +- ...ion-control-policies-using-group-policy.md | 6 +- ...plication-control-policies-using-intune.md | 2 +- ...defender-application-control-management.md | 2 +- .../wdac-wizard-create-base-policy.md | 10 +- .../wdac-wizard-create-supplemental-policy.md | 12 +- .../wdac-wizard-editing-policy.md | 4 +- .../wdac-wizard-merging-policies.md | 2 +- .../wdsc-account-protection.md | 2 +- .../wdsc-app-browser-control.md | 2 +- .../wdsc-customize-contact-information.md | 4 +- .../wdsc-device-performance-health.md | 2 +- .../wdsc-device-security.md | 2 +- .../wdsc-family-options.md | 2 +- .../wdsc-firewall-network-protection.md | 2 +- .../wdsc-virus-threat-protection.md | 2 +- .../wdsc-windows-10-in-s-mode.md | 2 +- .../windows-defender-security-center.md | 10 +- ...sed-root-of-trust-helps-protect-windows.md | 4 +- ...-guard-secure-launch-and-smm-protection.md | 8 +- .../best-practices-configuring.md | 14 +- .../windows-firewall/boundary-zone.md | 2 +- ...create-windows-firewall-rules-in-intune.md | 2 +- .../domain-isolation-policy-design-example.md | 2 +- .../domain-isolation-policy-design.md | 2 +- .../filter-origin-documentation.md | 10 +- .../firewall-policy-design-example.md | 2 +- ...wall-with-advanced-security-design-plan.md | 2 +- .../windows-firewall/quarantine.md | 4 +- ...n-accessing-sensitive-network-resources.md | 2 +- ...cess-to-only-specified-users-or-devices.md | 2 +- ...restrict-access-to-only-trusted-devices.md | 2 +- ...to-end-ipsec-connections-by-using-ikev2.md | 6 +- .../server-isolation-policy-design-example.md | 2 +- .../server-isolation-policy-design.md | 2 +- ...-administration-with-windows-powershell.md | 4 +- .../windows-security-baselines.md | 6 +- .../windows-security-baselines.md | 6 +- windows/whats-new/contribute-to-a-topic.md | 10 +- .../ltsc/whats-new-windows-10-2019.md | 20 +- .../whats-new-windows-10-version-1703.md | 8 +- .../whats-new-windows-10-version-1809.md | 36 ++-- .../whats-new-windows-10-version-1903.md | 2 +- .../whats-new-windows-10-version-2004.md | 2 +- 410 files changed, 2137 insertions(+), 2121 deletions(-) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 75cb7255c8..ef3a69ff52 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -20,7 +20,7 @@ We've tried to make editing an existing, public file as simple as possible. 1. Go to the page on docs.microsoft.com that you want to update, and then click **Edit**. - ![GitHub Web, showing the Edit link](images/contribute-link.png) + ![GitHub Web, showing the Edit link.](images/contribute-link.png) 2. Log into (or sign up for) a GitHub account. @@ -28,7 +28,7 @@ We've tried to make editing an existing, public file as simple as possible. 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) @@ -37,11 +37,11 @@ We've tried to make editing an existing, public file as simple as possible. 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change** to create a fork in your personal GitHub account. - ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png) The **Comparing changes** screen appears to see what the changes are between your fork and the original content. @@ -49,7 +49,7 @@ We've tried to make editing an existing, public file as simple as possible. If there are no problems, you’ll see the message, **Able to merge**. - ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md index 4fc4fb1ecc..d4f9600d8b 100644 --- a/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md +++ b/browsers/enterprise-mode/collect-data-using-enterprise-site-discovery.md @@ -34,11 +34,11 @@ Before you start, you need to make sure you have the following: 1. Go to the [Microsoft Security Bulletin](https://go.microsoft.com/fwlink/p/?LinkID=718223) page, and change the filter to **Windows Internet Explorer 11**. - ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) + ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - ![affected software section](images/affectedsoftware.png) + ![affected software section.](images/affectedsoftware.png) 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. @@ -280,13 +280,13 @@ You can collect your hardware inventory using the MOF Editor, while you’re con 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) + ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) 2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. 3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) 4. Select the check boxes next to the following classes, and then click **OK**: @@ -393,12 +393,12 @@ The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sam ### SCCM Report Sample – ActiveX.rdl Gives you a list of all of the ActiveX-related sites visited by the client computer. -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) ### SCCM Report Sample – Site Discovery.rdl Gives you a list of all of the sites visited by the client computer. -![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) +![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) ## View the collected XML data After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: @@ -436,7 +436,7 @@ You can import this XML data into the correct version of the Enterprise Mode Sit 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) + ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) 2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). diff --git a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md index 47322f0c03..923d4dfe04 100644 --- a/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/enterprise-mode/set-up-enterprise-mode-logging-and-data-collection.md @@ -27,11 +27,11 @@ ms.date: 07/27/2017 Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. -![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) +![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. -![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) +![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. @@ -47,11 +47,11 @@ This lets you create an ASP form that accepts the incoming POST messages. 3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) + ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) 4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - ![IIS Manager, setting logging options](images/ie-emie-logging.png) + ![IIS Manager, setting logging options.](images/ie-emie-logging.png) 5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. @@ -72,7 +72,7 @@ This code logs your POST fields to your IIS log file, where you can review all o ### IIS log file information This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. -![Enterprise Mode log file](images/ie-emie-logfile.png) +![Enterprise Mode log file.](images/ie-emie-logfile.png) ## Using the GitHub sample to collect your data @@ -99,14 +99,14 @@ The required packages are automatically downloaded and included in the solution. 1. Right-click on the name, PhoneHomeSample, and click **Publish**. - ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) + ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) 2. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. **Important**
Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) + ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) After you finish the publishing process, you need to test to make sure the app deployed successfully. @@ -131,7 +131,7 @@ The required packages are automatically downloaded and included in the solution. - Go to `https:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. - ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) + ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) ### Troubleshooting publishing errors @@ -141,7 +141,7 @@ If you have errors while you’re publishing your project, you should try to upd 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) + ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) 2. Click **Updates** on the left side of the tool, and click the **Update All** button.

You may need to do some additional package cleanup to remove older package versions. diff --git a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md index 4651adf5cf..4573423115 100644 --- a/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/enterprise-mode/turn-on-enterprise-mode-and-use-a-site-list.md @@ -9,7 +9,7 @@ centralized control, you can create one global list of websites that render usin 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Microsoft Edge\\Configure the Enterprise Mode Site List** setting.

Turning this setting on also requires you to create and store a site list. 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. @@ -24,7 +24,7 @@ All of your managed devices must have access to this location if you want them t 2. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file.

For example: + ![Enterprise mode with site list in the registry.](../edge/images/enterprise-mode-value-data.png) --> - **HTTPS location:** `"SiteList"="https://localhost:8080/sites.xml"` diff --git a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md index b34f9be63f..c8ef3d030c 100644 --- a/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/enterprise-mode/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -33,7 +33,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - ![group policy editor with emie setting](images/ie-emie-editpolicy.png) + ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. @@ -45,7 +45,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 3. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) + ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) Your **Value data** location can be any of the following types: diff --git a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md index 1acd936993..65fbb8eaaf 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md +++ b/browsers/internet-explorer/ie11-deploy-guide/collect-data-using-enterprise-site-discovery.md @@ -38,11 +38,11 @@ Before you start, you need to make sure you have the following: 1. Go to the [Microsoft Security Bulletin](/security-updates/) page, and change the filter to **Windows Internet Explorer 11**. - ![microsoft security bulletin techcenter](images/securitybulletin-filter.png) + ![microsoft security bulletin techcenter.](images/securitybulletin-filter.png) 2. Click the title of the latest cumulative security update, and then scroll down to the **Affected software** table. - ![affected software section](images/affectedsoftware.png) + ![affected software section.](images/affectedsoftware.png) 3. Click the link that represents both your operating system version and Internet Explorer 11, and then follow the instructions in the **How to get this update** section. @@ -284,13 +284,13 @@ You can collect your hardware inventory using the MOF Editor, while you’re con 1. From the Configuration Manager, click **Administration**, click **Client Settings**, double-click **Default Client Settings**, click **Hardware Inventory**, and then click **Set Classes**. - ![Configuration Manager, showing the hardware inventory settings for client computers](images/configmgrhardwareinventory.png) + ![Configuration Manager, showing the hardware inventory settings for client computers.](images/configmgrhardwareinventory.png) 2. Click **Add**, click **Connect**, and connect to a computer that has completed the setup process and has already existing classes. 3. Change the **WMI Namespace** to `root\cimv2\IETelemetry`, and click **Connect**. - ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box](images/ie11-inventory-addclassconnectscreen.png) + ![Configuration Manager, with the Connect to Windows Management Instrumentation (WMI) box.](images/ie11-inventory-addclassconnectscreen.png) 4. Select the check boxes next to the following classes, and then click **OK**: @@ -397,12 +397,12 @@ The sample reports, **SCCM Report Sample – ActiveX.rdl** and **SCCM Report Sam ### SCCM Report Sample – ActiveX.rdl Gives you a list of all of the ActiveX-related sites visited by the client computer. -![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer](images/configmgractivexreport.png) +![ActiveX.rdl report, lists all ActiveX-related sites visited by the client computer.](images/configmgractivexreport.png) ### SCCM Report Sample – Site Discovery.rdl Gives you a list of all of the sites visited by the client computer. -![Site Discovery.rdl report, lists all websites visited by the client computer](images/ie-site-discovery-sample-report.png) +![Site Discovery.rdl report, lists all websites visited by the client computer.](images/ie-site-discovery-sample-report.png) ## View the collected XML data After the XML files are created, you can use your own solutions to extract and parse the data. The data will look like: @@ -440,7 +440,7 @@ You can import this XML data into the correct version of the Enterprise Mode Sit 1. Open the Enterprise Mode Site List Manager, click **File**, and then click **Bulk add from file**. - ![Enterprise Mode Site List Manager with Bulk add from file option](images/bulkadd-emiesitelistmgr.png) + ![Enterprise Mode Site List Manager with Bulk add from file option.](images/bulkadd-emiesitelistmgr.png) 2. Go to your XML file to add the included sites to the tool, and then click **Open**.
Each site is validated and if successful, added to the global site list when you click **OK** to close the menu. If a site doesn’t pass validation, you can try to fix the issues or pick the site and click **Add to list** to ignore the validation problem. For more information about fixing validation problems, see [Fix validation problems using the Enterprise Mode Site List Manager](fix-validation-problems-using-the-enterprise-mode-site-list-manager.md). diff --git a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md index e8d1ec3d7d..5cfa201d18 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md +++ b/browsers/internet-explorer/ie11-deploy-guide/deprecated-document-modes.md @@ -48,7 +48,7 @@ The compatibility improvements made in IE11 lets older websites just work in the ## Document mode selection flowchart This flowchart shows how IE11 works when document modes are used. -![Flowchart detailing how document modes are chosen in IE11](images/docmode-decisions-sm.png)
+![Flowchart detailing how document modes are chosen in IE11.](images/docmode-decisions-sm.png)
[Click this link to enlarge image](img-ie11-docmode-lg.md) ## Known Issues with Internet Explorer 8 document mode in Enterprise Mode diff --git a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md index 333686dc07..9ec7ddf862 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/fix-compat-issues-with-doc-modes-and-enterprise-mode-site-list.md @@ -45,7 +45,7 @@ To see if this fix might help you, run through this process one step at a time, 1. Go to a site having compatibility problems, press **F12** to open the **F12 Developer Tools**, and go to the **Emulation** tool. - ![Emulation tool showing document mode selection](images/docmode-f12.png) + ![Emulation tool showing document mode selection.](images/docmode-f12.png) 2. Starting with the **11 (Default)** option, test your broken scenario.
If that doesn’t work, continue down to the next lowest document mode, stopping as soon as you find a document mode that fixes your problems. For more information about the Emulation tool, see [Emulate browsers, screen sizes, and GPS locations](/previous-versions/windows/internet-explorer/ie-developer/samples/dn255001(v=vs.85)). @@ -62,7 +62,7 @@ There are two versions of the Enterprise Mode site list schema and the Enterpris 1. Open the Enterprise Mode Site List Manager, and click **Add**. - ![Enterprise Mode Site List Manager, showing the available modes](images/emie-listmgr.png) + ![Enterprise Mode Site List Manager, showing the available modes.](images/emie-listmgr.png) 2. Add the **URL** and pick the document mode from the **Launch in** box. This should be the same document mode you found fixed your problems while testing the site.
Similar to Enterprise Mode, you can specify a document mode for a particular web path—such as contoso.com/ERP—or at a domain level. In the above, the entire contoso.com domain loads in Enterprise Mode, while microsoft.com is forced to load into IE8 Document Mode and bing.com loads in IE11. @@ -74,7 +74,7 @@ For more information about Enterprise Mode, see [What is Enterprise Mode?](what- ### Review your Enterprise Mode site list Take a look at your Enterprise Mode site list and make sure everything is the way you want it. The next step will be to turn the list on and start to use it in your company. The Enterprise Mode Site List Manager will look something like: -![Enterprise Mode Site List Manager, showing the different modes](images/emie-sitelistmgr.png) +![Enterprise Mode Site List Manager, showing the different modes.](images/emie-sitelistmgr.png) And the underlying XML code will look something like: diff --git a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md index 75283c1f64..4eed39657f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md +++ b/browsers/internet-explorer/ie11-deploy-guide/out-of-date-activex-control-blocking.md @@ -62,15 +62,15 @@ When IE blocks an outdated ActiveX control, you’ll see a notification bar simi **Internet Explorer 9 through Internet Explorer 11** -![Warning about outdated activex controls (ie9+)](images/outdatedcontrolwarning.png) +![Warning about outdated activex controls (ie9+).](images/outdatedcontrolwarning.png) **Windows Internet Explorer 8** -![Warning about outdated activex controls (ie8)](images/ieoutdatedcontrolwarning.png) +![Warning about outdated activex controls (ie8).](images/ieoutdatedcontrolwarning.png) Out-of-date ActiveX control blocking also gives you a security warning that tells you if a webpage tries to launch specific outdated apps, outside of IE: -![Warning about outdated activex controls outside ie](images/ieoutdatedcontroloutsideofie.png) +![Warning about outdated activex controls outside ie.](images/ieoutdatedcontroloutsideofie.png) ## How do I fix an outdated ActiveX control or app? diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md index 6edccdda73..9424e5e32f 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-the-default-browser-using-group-policy.md @@ -27,7 +27,7 @@ You can use the Group Policy setting, **Set a default associations configuration 1. Open your Group Policy editor and go to the **Computer Configuration\Administrative Templates\\Windows Components\\File Explorer\\Set a default associations configuration file** setting.

Turning this setting on also requires you to create and store a default associations configuration file, locally or on a network share. For more information about creating this file, see [Export or Import Default Application Associations]( https://go.microsoft.com/fwlink/p/?LinkId=618268). - ![set default associations group policy setting](images/setdefaultbrowsergp.png) + ![set default associations group policy setting.](images/setdefaultbrowsergp.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your default associations configuration file.

If this setting is turned on and your employee's device is domain-joined, this file is processed and default associations are applied at logon. If this setting isn't configured or is turned off, or if your employee's device isn't domain-joined, no default associations are applied at logon. diff --git a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md index dd26f8e369..b42426f1d7 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md +++ b/browsers/internet-explorer/ie11-deploy-guide/set-up-enterprise-mode-logging-and-data-collection.md @@ -31,11 +31,11 @@ ms.date: 07/27/2017 Using Group Policy, you can turn on Enterprise Mode for Internet Explorer and then you can turn on local user control using the **Let users turn on and use Enterprise Mode from the Tools menu** setting, located in the `Administrative Templates\Windows Components\Internet Explorer` category path. After you turn this setting on, your users can turn on Enterprise Mode locally, from the IE **Tools** menu. -![enterprise mode option on the tools menu](images/ie-emie-toolsmenu.png) +![enterprise mode option on the tools menu.](images/ie-emie-toolsmenu.png) The **Let users turn on and use Enterprise Mode from the Tools menu** setting also lets you decide where to send the user reports (as a URL). We recommend creating a custom HTTP port 81 to let your incoming user information go to a dedicated site. A dedicated site is important so you can quickly pick out the Enterprise Mode traffic from your other website traffic. -![group policy to turn on enterprise mode](images/ie-emie-grouppolicy.png) +![group policy to turn on enterprise mode.](images/ie-emie-grouppolicy.png) Getting these reports lets you find out about sites that aren’t working right, so you can add them to your Enterprise Mode site list, without having to locate them all yourself. For more information about creating and using a site list, see the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.2)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-2-schema-and-enterprise-mode-tool.md) or the [Add multiple sites to the Enterprise Mode site list using a file and the Enterprise Mode Site List Manager (schema v.1)](add-multiple-sites-to-enterprise-mode-site-list-using-the-version-1-schema-and-enterprise-mode-tool.md) topic, based on your operating system. @@ -51,11 +51,11 @@ When you turn logging on, you need a valid URL that points to a server that can 3. Open the Internet Information Services (IIS) Manager, click **Bindings**, highlight **Port 81**, click **Edit**, and then change the website information to point to Port 81 so it matches your custom-created port. - ![IIS Manager, editing website bindings](images/ie-emie-editbindings.png) + ![IIS Manager, editing website bindings.](images/ie-emie-editbindings.png) 4. Open the **Logging** feature, pick **W3C** for the format, and click **Select Fields** to open the **W3C Logging Fields** box. - ![IIS Manager, setting logging options](images/ie-emie-logging.png) + ![IIS Manager, setting logging options.](images/ie-emie-logging.png) 5. Change the WC3 logging fields to include only the **Date**, **Client IP**, **User Name**, and **URI Query** standard fields, and then click **OK**.

Using only these fields keeps the log file simple, giving you the date, client IP address, and the website URI information for any site changed by your users. @@ -76,7 +76,7 @@ When you turn logging on, you need a valid URL that points to a server that can ### IIS log file information This is what your log files will look like after you set everything up and at least one of your users has turned on Enterprise Mode locally from the **Tools** menu. You can see the URL of the problematic website and client IP address of the user that turned on Enterprise Mode. -![Enterprise Mode log file](images/ie-emie-logfile.png) +![Enterprise Mode log file.](images/ie-emie-logfile.png) ## Using the GitHub sample to collect your data @@ -103,14 +103,14 @@ For logging, you’re going to need a valid URL that points to a server that can 5. Right-click on the name, PhoneHomeSample, and click **Publish**. - ![Visual Studio, Publish menu](images/ie-emie-publishsolution.png) + ![Visual Studio, Publish menu.](images/ie-emie-publishsolution.png) 6. In the **Publish Web** wizard, pick the publishing target and options that work for your organization. **Important**
Make sure you have a database associated with your publishing target. Otherwise, your reports won’t be collected and you’ll have problems deploying the website.  - ![Visual Studio, Publish Web wizard](images/ie-emie-publishweb.png) + ![Visual Studio, Publish Web wizard.](images/ie-emie-publishweb.png) After you finish the publishing process, you need to test to make sure the app deployed successfully. @@ -135,7 +135,7 @@ For logging, you’re going to need a valid URL that points to a server that can - Go to `https:///List` to see the report results.

If you’re already on the webpage, you’ll need to refresh the page to see the results. - ![Enterprise Mode Result report with details](images/ie-emie-reportwdetails.png) + ![Enterprise Mode Result report with details.](images/ie-emie-reportwdetails.png) ### Troubleshooting publishing errors @@ -145,7 +145,7 @@ If you have errors while you’re publishing your project, you should try to upd 1. From the **Tools** menu of Microsoft Visual Studio, click **NuGet Package Manager**, and click **Manage NuGet Packages for Solution**. - ![Nuget Package Manager for package updates](images/ie-emie-packageupdate.png) + ![Nuget Package Manager for package updates.](images/ie-emie-packageupdate.png) 2. Click **Updates** on the left side of the tool, and click the **Update All** button.

You may need to do some additional package cleanup to remove older package versions. diff --git a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md index 14bd40e745..ec77071c73 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md +++ b/browsers/internet-explorer/ie11-deploy-guide/tips-and-tricks-to-manage-ie-compatibility.md @@ -28,7 +28,7 @@ Jump to: [Enterprise Mode for Internet Explorer 11](enterprise-mode-overview-for-ie11.md) can be very effective in providing backward compatibility for older web apps. The Enterprise Mode Site List includes the ability to put any web app in any document mode, include IE8 and IE7 Enterprise Modes, without changing a single line of code on the website. -![Internet Explorer Enterprise Modes and document modes](images/img-enterprise-mode-site-list-xml.jpg) +![Internet Explorer Enterprise Modes and document modes.](images/img-enterprise-mode-site-list-xml.jpg) Sites in the \ section can be rendered in any document mode, as shown in blue above. Some sites designed for older versions of Internet Explorer may require better backward compatibility, and these can leverage the \ section of the Enterprise Mode Site List. IE8 Enterprise Mode provides higher-fidelity emulation for Internet Explorer 8 by using, among other improvements, the original Internet Explorer 8 user agent string. IE7 Enterprise Mode further improves emulation by adding Compatibility View. @@ -84,7 +84,7 @@ To see if the site works in the Internet Explorer 5, Internet Explorer 7, Intern - Open the site in Internet Explorer 11, load the F12 tools by pressing the **F12** key or by selecting **F12 Developer Tools** from the **Tools** menu, and select the **Emulation** tab. - ![F12 Developer Tools Emulation tab](images/img-f12-developer-tools-emulation.jpg) + ![F12 Developer Tools Emulation tab.](images/img-f12-developer-tools-emulation.jpg) - Run the site in each document mode until you find the mode in which the site works. diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md index 8c84054dc3..1b32fa64ad 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-enterprise-mode-and-use-a-site-list.md @@ -39,7 +39,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi 1. Open your Group Policy editor and go to the `Administrative Templates\Windows Components\Internet Explorer\Use the Enterprise Mode IE website list` setting.

Turning this setting on also requires you to create and store a site list. For more information about creating your site list, see the [Use the Enterprise Mode Site List Manager](use-the-enterprise-mode-site-list-manager.md) topics. - ![local group policy editor for using a site list](images/ie-emie-grouppolicysitelist.png) + ![local group policy editor for using a site list.](images/ie-emie-grouppolicysitelist.png) 2. Click **Enabled**, and then in the **Options** area, type the location to your site list. @@ -51,7 +51,7 @@ Before you can use a site list with Enterprise Mode, you need to turn the functi 4. Edit the `SiteList` registry key to point to where you want to keep your Enterprise Mode site list file. For example: - ![enterprise mode with site list in the registry](images/ie-emie-registrysitelist.png) + ![enterprise mode with site list in the registry.](images/ie-emie-registrysitelist.png) - **HTTPS location**: `"SiteList"="https://localhost:8080/sites.xml"` diff --git a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md index b4db0fb7a4..897b27ceed 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md +++ b/browsers/internet-explorer/ie11-deploy-guide/turn-on-local-control-and-logging-for-enterprise-mode.md @@ -37,7 +37,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 1. Open your Group Policy editor and go to the **Administrative Templates\\Windows Components\\Internet Explorer\\Let users turn on and use Enterprise Mode from the Tools menu** setting. - ![group policy editor with emie setting](images/ie-emie-editpolicy.png) + ![group policy editor with emie setting.](images/ie-emie-editpolicy.png) 2. Click **Enabled**, and then in the **Options** area, type the location for where to receive reports about when your employees use this functionality to turn Enterprise Mode on or off from the **Tools** menu. @@ -49,7 +49,7 @@ Besides turning on this feature, you also have the option to provide a URL for E 5. Right-click the **Enable** key, click **Modify**, and then type a **Value data** to point to a server that you can listen to for updates. - ![edit registry string for data collection location](images/ie-emie-editregistrystring.png) + ![edit registry string for data collection location.](images/ie-emie-editregistrystring.png) Your **Value data** location can be any of the following types: diff --git a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md index fd6904f4a8..54ae269373 100644 --- a/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md +++ b/browsers/internet-explorer/ie11-ieak/licensing-version-and-features-ieak11.md @@ -33,32 +33,32 @@ During installation, you must pick a version of IEAK 11, either **External** or | Feature | Internal | External | |-------------------------------------------|:--------------------------------------------------------------------------------:|:------------------------------------------------------------------------------------:| -| Welcome screen | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| File locations | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Platform selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Language selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Package type selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Feature selection | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic Version Synchronization (AVS) | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Custom components | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Internal install | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| User experience | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Browser user interface | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Search providers | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Important URLs – Home page and support | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Accelerators | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Favorites, Favorites bar, and feeds | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Browsing options | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| First Run wizard and Welcome page options | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection manager | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Connection settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Automatic configuration | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Proxy settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Security and privacy settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Add a root certificate | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Programs | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | -| Additional settings | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | -| Wizard complete | ![Available](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Welcome screen | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| File locations | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Platform selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Language selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Package type selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Feature selection | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Automatic Version Synchronization (AVS) | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Custom components | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Internal install | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| User experience | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Browser user interface | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Search providers | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Important URLs – Home page and support | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Accelerators | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Favorites, Favorites bar, and feeds | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Browsing options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| First Run wizard and Welcome page options | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Connection manager | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Connection settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Automatic configuration | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Proxy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Security and privacy settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Add a root certificate | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Programs | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | +| Additional settings | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Not available](/microsoft-edge/deploy/images/148766.png) | +| Wizard complete | ![Available.](/microsoft-edge/deploy/images/148767.png) | ![Available](/microsoft-edge/deploy/images/148767.png) | --- diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index d0251e80ba..bbf1be6015 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -24,13 +24,13 @@ manager: dansimp | Tool | Description | | :---: |:--- | -| [![Connect the device to Wi-Fi](images/edu-TIB-setp-1-v3.png)](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. | -| [![Try Learning Tools Immersive Reader](images/edu-TIB-setp-2-v3.png)](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)**
Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. | -| [![Launch Microsoft Teams](images/edu-TIB-setp-3-v3.png)](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?**
Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. | -| [![Open OneNote](images/edu-TIB-setp-4-v3.png)](#edu-task4) | **Trying to expand classroom creativity and interaction between students?**
Open [OneNote](#edu-task4) and create an example group project for your class. | -| [![Try Photos app](images/edu-tib-setp-5-v4.png)](#edu-task5) | **Curious about telling stories through video?**
Try the [Photos app](#edu-task5) to make your own example video. | -| [![Play with Minecraft: Education Edition](images/edu-tib-setp-6-v4.png)](#edu-task6) | **Want to teach kids to further collaborate and problem solve?**
Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. | -| [![Do Math with Windows Ink](images/edu-tib-setp-7-v1.png)](#edu-task7) | **Want to provide a personal math tutor for your students?**
Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. | +| [![Connect the device to Wi-Fi.](images/edu-TIB-setp-1-v3.png)](#edu-task1) | [Log in](#edu-task1) to **Device A** with your Teacher credentials and connect to the school network. | +| [![Try Learning Tools Immersive Reader.](images/edu-TIB-setp-2-v3.png)](#edu-task2) | **Interested in significantly improving your students' reading speed and comprehension?[1](#footnote1)**
Try the [Learning Tools Immersive Reader](#edu-task2) to see how kids can learn to read faster, using text read aloud, and highlighting words for syntax. | +| [![Launch Microsoft Teams.](images/edu-TIB-setp-3-v3.png)](#edu-task3) | **Looking to foster collaboration, communication, and critical thinking in the classroom?**
Launch [Microsoft Teams](#edu-task3) and learn how to set up digital classroom discussions, respond to student questions, and organize class content. | +| [![Open OneNote.](images/edu-TIB-setp-4-v3.png)](#edu-task4) | **Trying to expand classroom creativity and interaction between students?**
Open [OneNote](#edu-task4) and create an example group project for your class. | +| [![Try Photos app.](images/edu-tib-setp-5-v4.png)](#edu-task5) | **Curious about telling stories through video?**
Try the [Photos app](#edu-task5) to make your own example video. | +| [![Play with Minecraft: Education Edition.](images/edu-tib-setp-6-v4.png)](#edu-task6) | **Want to teach kids to further collaborate and problem solve?**
Play with [Minecraft: Education Edition](#edu-task6) to see how it can be used as a collaborative and versatile platform across subjects to encourage 21st century skills. | +| [![Do Math with Windows Ink.](images/edu-tib-setp-7-v1.png)](#edu-task7) | **Want to provide a personal math tutor for your students?**
Use [Windows Ink and the Math Assistant feature](#edu-task7) in OneNote to give students step-by-step instructions and interactive 2D graphs for math problems. |
@@ -41,7 +41,7 @@ manager: dansimp
-![Log in to Device A and connect to the school network](images/edu-TIB-setp-1-jump.png) +![Log in to Device A and connect to the school network.](images/edu-TIB-setp-1-jump.png) ## 1. Log in and connect to the school network To try out the educator tasks, start by logging in as a teacher. @@ -55,7 +55,7 @@ To try out the educator tasks, start by logging in as a teacher.

-![Improve student reading speed and comprehension](images/edu-TIB-setp-2-jump.png) +![Improve student reading speed and comprehension.](images/edu-TIB-setp-2-jump.png) ## 2. Significantly improve student reading speed and comprehension > [!VIDEO https://www.youtube.com/embed/GCzSAslq_2Y] @@ -78,7 +78,7 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse 4. Select the **Immersive Reader** button. - ![Word's Immersive Reader](images/word_online_immersive_reader.png) + ![Word's Immersive Reader.](images/word_online_immersive_reader.png) 5. Press the **Play** button to hear text read aloud. @@ -86,14 +86,14 @@ Learning Tools and the Immersive Reader can be used in the Microsoft Edge browse | Text to Speech | Text Preferences | Grammar Options | Line Focus | | :------------: | :--------------: | :-------------: | :--------: | - | ![Word Text to Speech](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) | + | ![Word Text to Speech.](images/wordonline_tts.png) | ![Word Text Preferences](images/wordonline_text_preferences.png) | ![Word Grammar Options](images/wordonline_grammar_options.png) | ![Word Line Focus](images/wordonline_line_focus.png) |

-![Spark communication, critical thinking, and creativity with Microsoft Teams](images/edu-TIB-setp-3-jump.png) +![Spark communication, critical thinking, and creativity with Microsoft Teams.](images/edu-TIB-setp-3-jump.png) ## 3. Spark communication, critical thinking, and creativity in the classroom > [!VIDEO https://www.youtube.com/embed/riQr4Dqb8B8] @@ -114,7 +114,7 @@ Take a guided tour of Microsoft Teams and test drive this digital hub.

-![Expand classroom collaboration and interaction with OneNote](images/edu-TIB-setp-4-jump.png) +![Expand classroom collaboration and interaction with OneNote.](images/edu-TIB-setp-4-jump.png) ## 4. Expand classroom collaboration and interaction between students > [!VIDEO https://www.youtube.com/embed/dzDSWMb_fIE] @@ -135,16 +135,16 @@ When you're not using the pen, just use the magnet to stick it to the left side 3. Follow the instructions for the project. Look for the **Try this!** callouts to experiment with these engaging activities. - Discover the power of digital ink by selecting the Draw tab. Choose your pen and get scribbling. - ![OneNote Draw tab](images/onenote_draw.png) + ![OneNote Draw tab.](images/onenote_draw.png) - Type anywhere on the page! Just click your cursor where you want to place text. - Use the checkmark in the **Home** tab to keep track of completed tasks. - ![OneNote To Do Tag](images/onenote_checkmark.png) + ![OneNote To Do Tag.](images/onenote_checkmark.png) - To find information without leaving OneNote, use the Researcher tool found under the Insert tab. - ![OneNote Researcher](images/onenote_researcher.png) + ![OneNote Researcher.](images/onenote_researcher.png)

@@ -178,7 +178,7 @@ Use video to create a project summary. 8. Drag the videos to the Storyboard, one by one. Your project should look roughly like this: - ![Photos app layout showing videos added in previous steps](images/photo_app_1.png) + ![Photos app layout showing videos added in previous steps.](images/photo_app_1.png) 9. Select the first card in the Storyboard (the video of the project materials) and select **Text**, type a title in, a text style, a layout, and select **Done**. @@ -191,7 +191,7 @@ Use video to create a project summary. 4. Play back your effect. 5. Select **Done** when you have it where you want it. - ![Lighting bolt effect being added to a video clip](images/photo_app_2.png) + ![Lighting bolt effect being added to a video clip.](images/photo_app_2.png) 12. Select **Music** and select a track from the **Recommended** music collection. 1. The music will update automatically to match the length of your video project, even as you make changes. @@ -208,7 +208,7 @@ Check out this use case video of the Photos team partnering with the Bureau Of F

-![Further collaborate and problem solve with Minecraft: Education Edition](images/edu-TIB-setp-5-jump.png) +![Further collaborate and problem solve with Minecraft: Education Edition.](images/edu-TIB-setp-5-jump.png) ## 6. Get kids to further collaborate and problem solve > [!VIDEO https://www.youtube.com/embed/QI_bRNUugog] @@ -226,7 +226,7 @@ Today, we'll explore a Minecraft world through the eyes of a student. 3. Scroll down to the **Details** section and select **Download World**. - ![Select the download world link](images/mcee_downloadworld.png) + ![Select the download world link.](images/mcee_downloadworld.png) 4. When prompted, save the world. @@ -250,7 +250,7 @@ Today, we'll explore a Minecraft world through the eyes of a student. To try more advanced movements or building within Minecraft, use the Minecraft Controls Diagram. - ![Minecraft mouse and keyboard controls](images/mcee_keyboard_mouse_controls.png) + ![Minecraft mouse and keyboard controls.](images/mcee_keyboard_mouse_controls.png) 12. Access and adapt over 300 lesson plans, spanning all grades and subjects, to meet your needs. Enjoy exploring new worlds and happy crafting. @@ -260,13 +260,13 @@ Today, we'll explore a Minecraft world through the eyes of a student. 2. Click **Class Resources**. 3. Click **Find a Lesson**. - ![Access and adapt over 300 Minecraft lesson plans](images/minecraft_lesson_plans.png) + ![Access and adapt over 300 Minecraft lesson plans.](images/minecraft_lesson_plans.png)


-![Help students understand new math concepts with the Math Assistant in OneNote](images/Inking.png) +![Help students understand new math concepts with the Math Assistant in OneNote.](images/Inking.png) ## 7. Use Windows Ink to provide a personal math tutor for your students The **Math Assistant** and **Ink Replay** features available in the OneNote app give your students step-by-step instructions on how to solve their math problems and help them visualize math functions on an interactive 2D graph. @@ -275,15 +275,15 @@ The **Math Assistant** and **Ink Replay** features available in the OneNote app To get started: 1. Open the OneNote app for Windows 10 (not OneNote 2016). - ![OneNote icon](images/OneNote_logo.png) + ![OneNote icon.](images/OneNote_logo.png) 2. In the top left corner, click on the **<** arrow to access your notebooks and pages. - ![OneNote back arrow navigation button](images/left_arrow.png) + ![OneNote back arrow navigation button.](images/left_arrow.png) 3. Click **Add Page** to launch a blank work space. - ![Select add page button](images/plus-page.png) + ![Select add page button.](images/plus-page.png) 4. Make sure your pen is paired to the device. To pair, see Connect to Bluetooth devices. @@ -292,26 +292,26 @@ To solve the equation 3x+4=7, follow these instructions: 2. If you wrote the equation using digital ink, use the **Lasso tool** to circle the equation. If you typed the equation, highlight it using your mouse. - ![Lasso button](images/lasso.png) + ![Lasso button.](images/lasso.png) 3. On the **Draw** tab, click the **Math** button. - ![Math button](images/math-button.png) + ![Math button.](images/math-button.png) 4. From the drop-down menu in the **Math** pane, select the option to **Solve for x**. You can now see the final solution of the equation. - ![Solve for x menu](images/solve-for-x.png) + ![Solve for x menu.](images/solve-for-x.png) 5. From the second drop-down below, choose **Steps for Solving Linear Formula**, which shows you the step-by-step solution of this equation. 6. On the **View** tab, click the **Replay** button. Use your mouse to select the written equation and watch your text in replay. Replay is great for students to review how the teacher solved the equation and for teachers to review how students approached a problem. - ![Replay button](images/replay.png) + ![Replay button.](images/replay.png) To graph the equation 3x+4=7, follow these instructions: 1. From the drop-down menu in the **Math** pane, select the option to **Graph Both Sides in 2D**. You can play with the interactive graph of your equation - use a single finger to move the graph position or two fingers to change the **zoom** level. - ![Graph both sides in 2D](images/graph-for-x.png) + ![Graph both sides in 2D.](images/graph-for-x.png) 2. Click the **Insert on Page** button below the graph to add a screenshot of the graph to your page.
diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index f21a0ddcf4..5f1c865bce 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -16,7 +16,7 @@ ms.date: 12/11/2017 # Microsoft Education Trial in a Box -![Microsoft Education Trial in a Box - Unlock Limitless Learning](images/Unlock-Limitless-Learning.png) +![Microsoft Education Trial in a Box - Unlock Limitless Learning.](images/Unlock-Limitless-Learning.png)
@@ -28,7 +28,7 @@ Welcome to Microsoft Education Trial in a Box. We built this trial to make it ea
-| [![Get started for Educators](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | +| [![Get started for Educators.](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | | :---: | :---: | | **Educator**
Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills.
[Get started](educator-tib-get-started.md) | **IT Admin**
Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage.
[Get started](itadmin-tib-get-started.md) | diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index be9a131941..d0ba6a05b3 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -24,11 +24,11 @@ manager: dansimp |  |  | | :---: |:--- | -| [![Log in to Device A](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | -| [![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | -| [![Configure Intune for Education](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | -| [![Find and deploy apps](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | -| [![Create custom folders](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. | +| [![Log in to Device A.](images/admin-TIB-setp-1-v3.png)](#it-task1) | [Log in](#it-task1) to **Device A** with your IT Admin credentials and connect to your school's network. | +| [![Configure Device B with Set up School PCs.](images/admin-TIB-setp-2-v3.png)](#it-task2) | [Configure Device B](#it-task2) with the Set up School PCs app. | +| [![Configure Intune for Education.](images/admin-TIB-setp-3-v3.png)](#it-task3) | [Express configure Intune for Education](#it-task3) to manage devices, users, and policies. | +| [![Find and deploy apps.](images/admin-TIB-setp-4-v3.png)](#it-task4) | [Find apps from the Microsoft Store for Education](#it-task4) and deploy them to manage devices in your tenant. | +| [![Create custom folders.](images/admin-TIB-setp-5-v3.png)](#it-task5) | [Create custom folders](#it-task5) that will appear on each managed device's **Start** menu. |
@@ -42,7 +42,7 @@ If you run into any problems while following the steps in this guide, or you hav
-![Log in to Device A](images/admin-TIB-setp-1-jump.png) +![Log in to Device A.](images/admin-TIB-setp-1-jump.png) ## 1. Log in to Device A with your IT Admin credentials and connect to the school network To try out the IT admin tasks, start by logging in as an IT admin. @@ -56,7 +56,7 @@ To try out the IT admin tasks, start by logging in as an IT admin.
-![Configure Device B with Set up School PCs](images/admin-TIB-setp-2-jump.png) +![Configure Device B with Set up School PCs.](images/admin-TIB-setp-2-jump.png) ## 2. Configure Device B with Set up School PCs Now you're ready to learn how to configure a brand new device. You will start on **Device A** by downloading and running the Set up School PCs app. Then, you will configure **Device B**. @@ -66,11 +66,11 @@ If you've previously used Set up School PCs to provision student devices, you ca 1. From the **Start** menu, find and then click **Microsoft Store** to launch the Store. - ![Microsoft Store from the Start menu](images/start_microsoft_store.png) + ![Microsoft Store from the Start menu.](images/start_microsoft_store.png) 2. Search for the **Set up School PCs** app. - ![Set up School PCs on Microsoft Store](images/microsoft_store_suspc_install.png) + ![Set up School PCs on Microsoft Store.](images/microsoft_store_suspc_install.png) 3. Click **Install**. @@ -78,7 +78,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 1. On **Device A**, launch the Set up School PCs app. - ![Launch the Set up School PCs app](images/suspc_start.png) + ![Launch the Set up School PCs app.](images/suspc_start.png) 2. Click **Get started**. 3. Select **Sign-in**. @@ -95,7 +95,7 @@ If you've previously used Set up School PCs to provision student devices, you ca We recommend checking the highlighted settings below: - ![Configure student PC settings](images/suspc_configure_pcsettings_selected.png) + ![Configure student PC settings.](images/suspc_configure_pcsettings_selected.png) - **Remove apps pre-installed by the device manufacturer** - If you select this option, this will reset the machine and the provisioning process will take longer (about 30 minutes). - **Allow local storage (not recommended for shared devices)** lets students save files to the **Desktop** and **Documents** folder on the student PC. @@ -108,7 +108,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 7. **Set up the Take a Test app** configures the device for taking quizzes and high-stakes assessments by some providers like Smarter Balanced. Windows will lock down the student PC so that students can't access anything else while taking the test. - ![Configure the Take a Test app](images/suspc_takeatest.png) + ![Configure the Take a Test app.](images/suspc_takeatest.png) 1. Specify if you want to create a Take a Test button on the students' sign-in screens. 2. Select **Advanced settings** to allow keyboard text suggestions to appear and to allow teachers to monitor online tests. @@ -120,7 +120,7 @@ If you've previously used Set up School PCs to provision student devices, you ca 8. **Add recommended apps** lets you choose from a set of recommended Microsoft Store apps to provision. - ![Recommended apps in Set up School PCs package configuration](images/suspc_configure_recommendedapps_v2.png) + ![Recommended apps in Set up School PCs package configuration.](images/suspc_configure_recommendedapps_v2.png) The recommended apps include the following: * **Office 365 for Windows 10 S (Education Preview)** - Optional. This works well for the Trial in a Box PCs running Windows 10 S. However, if you try to install this app on other editions of Windows 10, setup will fail. Also note that if you select **Office 365 for Windows 10 S (Education Preview)**, it will take about 30-45 minutes longer for Set up School PCs to create the provisioning package as the app downloads Office 365 for Windows 10 S (Education Preview) from the Microsoft Store. @@ -131,7 +131,7 @@ If you've previously used Set up School PCs to provision student devices, you ca To change any of the settings, select the page or section (such as **Sign-in** or **Settings**) to go back to that page and make your changes. - ![Select the section or page name to make a change](images/suspc_review_summary.png) + ![Select the section or page name to make a change.](images/suspc_review_summary.png) 10. Accept the summary and then insert a USB drive in **Device A**. Use the USB drive that came in the Trial in a Box accessories box to save the provisioning package. 11. Select the drive and then **Save** to create the provisioning package. @@ -153,7 +153,7 @@ A provisioning package is a method for applying settings to Windows 10 without n 1. Start with **Device B** turned off or with the PC on the first-run setup screen. In Windows 10 S Fall Creators Update, the first-run setup screen says **Let's start with region. Is this right?**. - ![The first screen to set up a new PC in Windows 10 Fall Creators Update](images/win10_oobe_firstscreen.png) + ![The first screen to set up a new PC in Windows 10 Fall Creators Update.](images/win10_oobe_firstscreen.png) If you go past the region selection screen, select **Ctrl + Shift + F3** which will prompt the "System Preparation Tool." Select **Okay** in the tool to return to the region selection screen. If this doesn't work, reset the PC by going to **Settings > Update & Security > Recovery > Reset this PC.** @@ -166,20 +166,20 @@ You can complete the rest of the IT admin tasks using **Device A**.
-![Express configure Intune for Education](images/admin-TIB-setp-3-jump.png) +![Express configure Intune for Education.](images/admin-TIB-setp-3-jump.png) ## 3. Express configure Intune for Education to manage devices, users, and policies Intune for Education provides an **Express configuration** option so you can get going right away. We'll use that option here. 1. Log into the Intune for Education console. 2. On the Intune for Education dashboard, click **Launch Express Configuration** or select the **Express configuration**. - ![Intune for Education dashboard](images/i4e_dashboard_expressconfig.png) + ![Intune for Education dashboard.](images/i4e_dashboard_expressconfig.png) 3. In the **Welcome to Intune for Education** screen, click **Get started** and follow the prompts until you get to the **Choose group** screen. 4. In the **Choose group** screen, select **All Users** so that all apps and settings that we select during express setup will apply to this group. 5. In the **Choose apps** screen, you will see a selection of desktop (Win32) apps, Web apps, and Microsoft Store apps. - ![Choose apps you want to provision to the group](images/i4e_expressconfig_chooseapps.png) + ![Choose apps you want to provision to the group.](images/i4e_expressconfig_chooseapps.png) 6. Add or remove apps by clicking on them. A blue checkmark means the app is added and will be installed for all members of the group selected in step 5. @@ -197,7 +197,7 @@ Intune for Education provides an **Express configuration** option so you can get
-![Find apps from the Microsoft Store for Education](images/admin-TIB-setp-4-jump.png) +![Find apps from the Microsoft Store for Education.](images/admin-TIB-setp-4-jump.png) ## 4. Find apps from the Microsoft Store for Education and deploy them to managed devices in your tenant The Microsoft Store for Education is where you can shop for more apps for your school. @@ -205,7 +205,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s 2. In the **Store apps** section, select **+ New app** to go to the Microsoft Store for Education. 3. Select **Sign in** and start shopping for apps for your school. - ![Microsoft Store for Education site](images/msfe_portal.png) + ![Microsoft Store for Education site.](images/msfe_portal.png) 4. Check some of the categories for suggested apps or search the Store for a free educational or reference app. Find ones that you haven't already installed during express configuration for Intune for Education. For example, these apps are free: - Duolingo - Learn Languages for Free @@ -222,7 +222,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s The apps will show up in your inventory along with the apps that Microsoft automatically provisioned for your education tenant. - ![List of apps bought for the school](images/msfe_boughtapps.png) + ![List of apps bought for the school.](images/msfe_boughtapps.png) In the **Private store** column of the **Products & services** page, the status for some apps will indicate that it's "In private store" while others will say "Adding to private store" or "Not applicable". Learn more about this in Distribute apps using your private store. @@ -231,7 +231,7 @@ The Microsoft Store for Education is where you can shop for more apps for your s
-![Create custom folders that appear on managed devices](images/admin-TIB-setp-5-jump.png) +![Create custom folders that appear on managed devices.](images/admin-TIB-setp-5-jump.png) ## 5. Create custom folders that will appear on each managed device's Start menu Update settings for all devices in your tenant by adding the **Documents** and **Downloads** folders to all devices managed in Intune for Education. @@ -239,7 +239,7 @@ Update settings for all devices in your tenant by adding the **Documents** and * 2. Select **Group > All Devices > Settings** and expand **Windows interface settings**. 3. In **Choose folders that appear in the Start menu**, select **Documents** and **Downloads**. - ![Choose folders that appear in the Start menu](images/screenshot-bug.png) + ![Choose folders that appear in the Start menu.](images/screenshot-bug.png) 4. **Save** your changes. diff --git a/education/trial-in-a-box/support-options.md b/education/trial-in-a-box/support-options.md index 9cb32351de..627a78c9ef 100644 --- a/education/trial-in-a-box/support-options.md +++ b/education/trial-in-a-box/support-options.md @@ -38,7 +38,7 @@ For more information about checking for updates, and how to optionally turn on a > [!NOTE] > For the alternate email address, make sure you use a different address from your Office 365 email address. - ![Complete your contact details](images/o365_adminaccountinfo.png) + ![Complete your contact details.](images/o365_adminaccountinfo.png) 4. Click **Save**. @@ -46,17 +46,17 @@ For more information about checking for updates, and how to optionally turn on a 1. Click the **Need help?** button in the lower right-hand corner of the Office 365 console. - ![Select Need help to get support](images/o365_needhelp.png) + ![Select Need help to get support.](images/o365_needhelp.png) You will see a sidebar window open up on the right-hand side of the screen. - ![Option to have a support representative call you](images/o365_needhelp_callingoption.png) + ![Option to have a support representative call you.](images/o365_needhelp_callingoption.png) If you chose to have a support representative call you, a new support ticket will be opened and you can track these in **Support tickets**. - ![Track your support tickets](images/o365_needhelp_supporttickets.png) + ![Track your support tickets.](images/o365_needhelp_supporttickets.png) -2. Click the **question button** ![Question button](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window. +2. Click the **question button** ![Question button.](images/o365_needhelp_questionbutton.png) in the top navigation of the sidebar window. 3. In the field below **Need help?**, enter a description of your help request. 4. Click the **Get help button**. 5. In the **Let us call you** section, enter a phone number where you can be reached. @@ -69,7 +69,7 @@ Forget your password? Follow these steps to recover it. 1. Go to https://portal.office.com 2. Select **Can't access your account** and follow the prompts to get back into your account. - ![Recover your account](images/officeportal_cantaccessaccount.png) + ![Recover your account.](images/officeportal_cantaccessaccount.png) diff --git a/education/windows/autopilot-reset.md b/education/windows/autopilot-reset.md index 00b99a4c75..c0ac95e03e 100644 --- a/education/windows/autopilot-reset.md +++ b/education/windows/autopilot-reset.md @@ -61,7 +61,7 @@ You can set the policy using one of these methods: - When using [Set up School PCs](use-set-up-school-pcs-app.md), in the **Configure student PC settings** screen, select **Enable Windows 10 Autopilot Reset** among the list of settings for the student PC as shown in the following example: - ![Configure student PC settings in Set up School PCs](images/suspc_configure_pc2.jpg) + ![Configure student PC settings in Set up School PCs.](images/suspc_configure_pc2.jpg) ## Trigger Autopilot Reset Autopilot Reset is a two-step process: trigger it and then authenticate. Once you've done these two steps, you can let the process execute and once it's done, the device is again ready for use. @@ -70,7 +70,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo 1. From the Windows device lock screen, enter the keystroke: **CTRL + Windows key + R**. - ![Enter CTRL+Windows key+R on the Windows lockscreen](images/autopilot-reset-lockscreen.png) + ![Enter CTRL+Windows key+R on the Windows lockscreen.](images/autopilot-reset-lockscreen.png) This will open up a custom login screen for Autopilot Reset. The screen serves two purposes: @@ -78,7 +78,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo 2. Notify the user in case a provisioning package, created using Windows Configuration Designer or Set up School PCs, will be used as part of the process. - ![Custom login screen for Autopilot Reset](images/autopilot-reset-customlogin.png) + ![Custom login screen for Autopilot Reset.](images/autopilot-reset-customlogin.png) 2. Sign in with the admin account credentials. If you created a provisioning package, plug in the USB drive and trigger Autopilot Reset. @@ -97,7 +97,7 @@ Autopilot Reset is a two-step process: trigger it and then authenticate. Once yo - Is returned to a known good managed state, connected to Azure AD and MDM. - ![Notification that provisioning is complete](images/autopilot-reset-provisioningcomplete.png) + ![Notification that provisioning is complete.](images/autopilot-reset-provisioningcomplete.png) Once provisioning is complete, the device is again ready for use. diff --git a/education/windows/change-to-pro-education.md b/education/windows/change-to-pro-education.md index b104042dbc..ea30225b3e 100644 --- a/education/windows/change-to-pro-education.md +++ b/education/windows/change-to-pro-education.md @@ -65,7 +65,7 @@ See [change using Microsoft Store for Education](#change-using-microsoft-store-f **Figure 1** - Enter the details for the Windows edition change - ![Enter the details for the Windows edition change](images/i4e_editionupgrade.png) + ![Enter the details for the Windows edition change.](images/i4e_editionupgrade.png) 3. The change will automatically be applied to the group you selected. @@ -78,7 +78,7 @@ You can use Windows Configuration Designer to create a provisioning package that **Figure 2** - Enter the license key - ![Enter the license key to change to Windows 10 Pro Education](images/wcd_productkey.png) + ![Enter the license key to change to Windows 10 Pro Education.](images/wcd_productkey.png) 3. Complete the rest of the process for creating a provisioning package and then apply the package to the devices you want to change to Windows 10 Pro Education. @@ -123,7 +123,7 @@ Once you enable the setting to change to Windows 10 Pro Education, the change wi **Figure 3** - Check the box to confirm - ![Check the box to confirm](images/msfe_manage_benefits_checktoconfirm.png) + ![Check the box to confirm.](images/msfe_manage_benefits_checktoconfirm.png) 5. Click **Change all my devices**. @@ -169,13 +169,13 @@ If the Windows device is running Windows 10, version 1703, follow these steps. **Figure 4** - Select how you'd like to set up the device - ![Select how you'd like to set up the device](images/1_howtosetup.png) + ![Select how you'd like to set up the device.](images/1_howtosetup.png) 2. On the **Sign in with Microsoft** page, enter the username and password to use with Office 365 or other services from Microsoft, and then click **Next**. **Figure 5** - Enter the account details - ![Enter the account details you use with Office 365 or other Microsoft services](images/2_signinwithms.png) + ![Enter the account details you use with Office 365 or other Microsoft services.](images/2_signinwithms.png) 3. Go through the rest of Windows device setup. Once you're done, the device will be Azure AD joined to your school's subscription. @@ -188,21 +188,21 @@ If the Windows device is running Windows 10, version 1703, follow these steps. **Figure 6** - Go to **Access work or school** in Settings - ![Go to Access work or school in Settings](images/settings_workorschool_1.png) + ![Go to Access work or school in Settings.](images/settings_workorschool_1.png) 2. In **Access work or school**, click **Connect**. 3. In the **Set up a work or school account** window, click the **Join this device to Azure Active Directory** option at the bottom. **Figure 7** - Select the option to join the device to Azure Active Directory - ![Select the option to join the device to Azure Active Directory](images/settings_setupworkorschoolaccount_2.png) + ![Select the option to join the device to Azure Active Directory.](images/settings_setupworkorschoolaccount_2.png) 4. On the **Let's get you signed in** window, enter the Azure AD credentials (username and password) and sign in. This will join the device to the school's Azure AD. 5. To verify that the device was successfully joined to Azure AD, go back to **Settings > Accounts > Access work or school**. You should now see a connection under the **Connect to work or school** section that indicates the device is connected to Azure AD. **Figure 8** - Verify the device connected to Azure AD - ![Verify the device is connected to Azure AD](images/settings_connectedtoazuread_3.png) + ![Verify the device is connected to Azure AD.](images/settings_connectedtoazuread_3.png) #### Step 2: Sign in using Azure AD account @@ -286,7 +286,7 @@ Once the automatic change to Windows 10 Pro Education is turned off, the change **Figure 12** - Revert to Windows 10 Pro - ![Revert to Windows 10 Pro](images/msfe_manage_reverttowin10pro.png) + ![Revert to Windows 10 Pro.](images/msfe_manage_reverttowin10pro.png) 4. You will be asked if you're sure that you want to turn off automatic changes to Windows 10 Pro Education. Click **Yes**. 5. Click **Close** in the **Success** page. @@ -304,7 +304,7 @@ You need to synchronize these identities so that users will have a *single ident **Figure 13** - On-premises AD DS integrated with Azure AD -![Illustration of Azure Active Directory Connect](images/windows-ad-connect.png) +![Illustration of Azure Active Directory Connect.](images/windows-ad-connect.png) For more information about integrating on-premises AD DS domains with Azure AD, see these resources: - [Integrating your on-premises identities with Azure Active Directory](/azure/active-directory/hybrid/whatis-hybrid-identity) diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index 59da859362..d927aef072 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -118,7 +118,7 @@ At the end of this section, you should have a list of Chromebook user and device You use the Google Admin Console (as shown in Figure 1) to manage user and device settings. These settings are applied to all the Chromebook devices in your institution that are enrolled in the Google Admin Console. Review the user and device settings in the Google Admin Console and determine which settings are appropriate for your Windows devices. -![figure 1](images/chromebook-fig1-googleadmin.png) +![figure 1.](images/chromebook-fig1-googleadmin.png) Figure 1. Google Admin Console @@ -221,7 +221,7 @@ Table 3. Settings in the Security node in the Google Admin Console In addition to the settings configured in the Google Admin Console, users may have locally configured their devices based on their own personal preferences (as shown in Figure 2). Table 4 lists the Chromebook user and device settings that you can locally configure. Review the settings and determine which settings you will migrate to Windows. Some of the settings listed in Table 4 can only be seen when you click the **Show advanced settings** link (as shown in Figure 2). -![figure 2](images/fig2-locallyconfig.png) +![figure 2.](images/fig2-locallyconfig.png) Figure 2. Locally-configured settings on Chromebook diff --git a/education/windows/configure-windows-for-education.md b/education/windows/configure-windows-for-education.md index f662b8ac78..27b3806af5 100644 --- a/education/windows/configure-windows-for-education.md +++ b/education/windows/configure-windows-for-education.md @@ -94,19 +94,19 @@ Use one of these methods to set this policy. - Data type: Integer - Value: 0 - ![Create an OMA URI for AllowCortana](images/allowcortana_omauri.png) + ![Create an OMA URI for AllowCortana.](images/allowcortana_omauri.png) ### Group Policy Set **Computer Configuration > Administrative Templates > Windows Components > Search > AllowCortana** to **Disabled**. -![Set AllowCortana to disabled through Group Policy](images/allowcortana_gp.png) +![Set AllowCortana to disabled through Group Policy.](images/allowcortana_gp.png) ### Provisioning tools - [Set up School PCs](use-set-up-school-pcs-app.md) always sets this policy in provisioning packages it creates. - [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Under **Runtime settings**, click the **Policies** settings group, set **Experience > Cortana** to **No**. - ![Set AllowCortana to No in Windows Configuration Designer](images/allowcortana_wcd.png) + ![Set AllowCortana to No in Windows Configuration Designer.](images/allowcortana_wcd.png) ## SetEduPolicies **SetEduPolicies** is a policy that applies a set of configuration behaviors to Windows. It is a policy node in the [SharedPC configuration service provider](/windows/client-management/mdm/sharedpc-csp). @@ -123,7 +123,7 @@ Use one of these methods to set this policy. - Data type: Boolean - Value: true - ![Create an OMA URI for SetEduPolices](images/setedupolicies_omauri.png) + ![Create an OMA URI for SetEduPolices.](images/setedupolicies_omauri.png) ### Group Policy **SetEduPolicies** is not natively supported in Group Policy. Instead, use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to set the policy in [MDM SharedPC](/windows/win32/dmwmibridgeprov/mdm-sharedpc). @@ -147,7 +147,7 @@ For example: - [Windows Configuration Designer](/windows/configuration/provisioning-packages/provisioning-create-package) - Under **Runtime settings**, click the **SharedPC** settings group, set **PolicyCustomization > SetEduPolicies** to **True**. - ![Set SetEduPolicies to True in Windows Configuration Designer](images/setedupolicies_wcd.png) + ![Set SetEduPolicies to True in Windows Configuration Designer.](images/setedupolicies_wcd.png) ## Ad-free search with Bing Provide an ad-free experience that is a safer, more private search option for K–12 education institutions in the United States. diff --git a/education/windows/deploy-windows-10-in-a-school-district.md b/education/windows/deploy-windows-10-in-a-school-district.md index 5ca4cb7ea0..9dcdd7ca81 100644 --- a/education/windows/deploy-windows-10-in-a-school-district.md +++ b/education/windows/deploy-windows-10-in-a-school-district.md @@ -34,21 +34,21 @@ Proper preparation is essential for a successful district deployment. To avoid c As part of preparing for your district deployment, you need to plan your district configuration — the focus of this guide. Figure 1 illustrates a typical finished district configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. > [!div class="mx-imgBorder"] -> ![Typical district configuration for this guide](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") +> ![Typical district configuration for this guide.](images/edu-districtdeploy-fig1.png "Typical district configuration for this guide") *Figure 1. Typical district configuration for this guide* A *district* consists of multiple schools, typically at different physical locations. Figure 2 illustrates a typical school configuration within the district that this guide uses. > [!div class="mx-imgBorder"] -> ![Typical school configuration for this guide](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") +> ![Typical school configuration for this guide.](images/edu-districtdeploy-fig2.png "Typical school configuration for this guide") *Figure 2. Typical school configuration for this guide* Finally, each school consists of multiple classrooms. Figure 3 shows the classroom configuration this guide uses. > [!div class="mx-imgBorder"] -> ![Typical classroom configuration in a school](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") +> ![Typical classroom configuration in a school.](images/edu-districtdeploy-fig3.png "Typical classroom configuration in a school") *Figure 3. Typical classroom configuration in a school* @@ -181,7 +181,7 @@ The high-level process for deploying and configuring devices within individual c 9. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS–Azure AD integration. > [!div class="mx-imgBorder"] -> ![How district configuration works](images/edu-districtdeploy-fig4.png "How district configuration works") +> ![How district configuration works.](images/edu-districtdeploy-fig4.png "How district configuration works") *Figure 4. How district configuration works* @@ -768,7 +768,7 @@ In this method, you have an on-premises AD DS domain. As shown in Figure 5, the > Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)). > [!div class="mx-imgBorder"] -> ![Automatic synchronization between AD DS and Azure AD](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") +> ![Automatic synchronization between AD DS and Azure AD.](images/edu-districtdeploy-fig5.png "Automatic synchronization between AD DS and Azure AD") *Figure 5. Automatic synchronization between AD DS and Azure AD* @@ -779,7 +779,7 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 6, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. > [!div class="mx-imgBorder"] -> ![Bulk import into Azure AD from other sources](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") +> ![Bulk import into Azure AD from other sources.](images/edu-districtdeploy-fig6.png "Bulk import into Azure AD from other sources") *Figure 6. Bulk import into Azure AD from other sources* @@ -812,14 +812,14 @@ You can deploy the Azure AD Connect tool: - **On premises.** As shown in Figure 7, Azure AD Connect runs on premises, which has the advantage of not requiring a VPN connection to Azure. It does, however, require a virtual machine (VM) or physical server. > [!div class="mx-imgBorder"] - > ![Azure AD Connect on premises](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") + > ![Azure AD Connect on premises.](images/edu-districtdeploy-fig7.png "Azure AD Connect on premises") *Figure 7. Azure AD Connect on premises* - **In Azure.** As shown in Figure 8, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. > [!div class="mx-imgBorder"] - > ![Azure AD Connect in Azure](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") + > ![Azure AD Connect in Azure.](images/edu-districtdeploy-fig8.png "Azure AD Connect in Azure") *Figure 8. Azure AD Connect in Azure* diff --git a/education/windows/deploy-windows-10-in-a-school.md b/education/windows/deploy-windows-10-in-a-school.md index 3b464f9fa6..318b892188 100644 --- a/education/windows/deploy-windows-10-in-a-school.md +++ b/education/windows/deploy-windows-10-in-a-school.md @@ -30,13 +30,13 @@ Proper preparation is essential for a successful school deployment. To avoid com As part of preparing for your school deployment, you need to plan your configuration—the focus of this guide. Figure 1 illustrates a typical finished school configuration that you can use as a model (the blueprint in our builder analogy) for the finished state. -![fig 1](images/deploy-win-10-school-figure1.png) +![fig 1.](images/deploy-win-10-school-figure1.png) *Figure 1. Typical school configuration for this guide* Figure 2 shows the classroom configuration this guide uses. -![fig 2](images/deploy-win-10-school-figure2.png) +![fig 2.](images/deploy-win-10-school-figure2.png) *Figure 2. Typical classroom configuration in a school* @@ -112,7 +112,7 @@ The high-level process for deploying and configuring devices within individual c 6. On the student and faculty devices, deploy Windows 10 to new or existing devices, or upgrade eligible devices to Windows 10. 7. On the admin device, manage the Windows 10 devices and apps, the Office 365 subscription, and the AD DS and Azure AD integration. -![fig 3](images/deploy-win-10-school-figure3.png) +![fig 3.](images/deploy-win-10-school-figure3.png) *Figure 3. How school configuration works* @@ -346,7 +346,7 @@ In this method, you have an on-premises AD DS domain. As shown in Figure 4, the **Note**  Azure AD Connect also supports synchronization from any Lightweight Directory Access Protocol version 3 (LDAPv3)–compliant directory by using the information provided in [Generic LDAP Connector for FIM 2010 R2 Technical Reference](/previous-versions/mim/dn510997(v=ws.10)?f=255&MSPPError=-2147217396). -![fig 4](images/deploy-win-10-school-figure4.png) +![fig 4.](images/deploy-win-10-school-figure4.png) *Figure 4. Automatic synchronization between AD DS and Azure AD* @@ -356,7 +356,7 @@ For more information about how to perform this step, see the [Integrate on-premi In this method, you have no on-premises AD DS domain. As shown in Figure 5, you manually prepare a .csv file with the student information from your source, and then manually import the information directly into Azure AD. The .csv file must be in the format that Office 365 specifies. -![fig 5](images/deploy-win-10-school-figure5.png) +![fig 5.](images/deploy-win-10-school-figure5.png) *Figure 5. Bulk import into Azure AD from other sources* @@ -383,13 +383,13 @@ You can deploy the Azure AD Connect tool by using one of the following methods: - **On premises.** As shown in Figure 6, Azure AD Connect runs on premises, which has the advantage of not requiring a virtual private network (VPN) connection to Azure. It does, however, require a virtual machine (VM) or physical server. - ![fig 6](images/deploy-win-10-school-figure6.png) + ![fig 6.](images/deploy-win-10-school-figure6.png) *Figure 6. Azure AD Connect on premises* - **In Azure**. As shown in Figure 7, Azure AD Connect runs on a VM in Azure AD, which has the advantages of being faster to provision (than a physical, on-premises server), offers better site availability, and helps reduce the number of on-premises servers. The disadvantage is that you need to deploy a VPN gateway on premises. - ![fig 7](images/deploy-win-10-school-figure7.png) + ![fig 7.](images/deploy-win-10-school-figure7.png) *Figure 7. Azure AD Connect in Azure* diff --git a/education/windows/edu-deployment-recommendations.md b/education/windows/edu-deployment-recommendations.md index eaa2f7c35b..03a761c858 100644 --- a/education/windows/edu-deployment-recommendations.md +++ b/education/windows/edu-deployment-recommendations.md @@ -55,11 +55,11 @@ To turn off access to contacts for all apps on individual Windows devices: 1. On the computer, go to **Settings** and select **Privacy**. - ![Privacy settings](images/win10_settings_privacy.png) + ![Privacy settings.](images/win10_settings_privacy.png) 2. Under the list of **Privacy** areas, select **Contacts**. - ![Contacts privacy settings](images/win10_settings_privacy_contacts.png) + ![Contacts privacy settings.](images/win10_settings_privacy_contacts.png) 3. Turn off **Let apps access my contacts**. @@ -73,7 +73,7 @@ For IT-managed Windows devices, you can use a Group Policy to turn off the setti If you want to allow only certain apps to have access to contacts, you can use the switch for each app to specify which ones you want on or off. -![Choose apps with access to contacts](images/win10_settings_privacy_contacts_apps.png) +![Choose apps with access to contacts.](images/win10_settings_privacy_contacts_apps.png) The list of apps on the Windows-based device may vary from the above example. The list depends on what apps you have installed and which of these apps access contacts. @@ -83,7 +83,7 @@ To allow only certain apps to have access to contacts, you can: * Apply the Group Policy: **Computer Configuration** > **Administrative Templates** > **Windows Components** > **App Privacy** > **Let Windows apps access contacts** and then specify the default for each app by adding the app's Package Family Name under the default behavior you want to enforce. - ![App privacy Group Policy](images/gp_letwinappsaccesscontacts.png) + ![App privacy Group Policy.](images/gp_letwinappsaccesscontacts.png) ## Skype and Xbox settings @@ -109,7 +109,7 @@ Skype uses the user’s contact details to deliver important information about t To manage and edit your profile in the Skype UWP app, follow these steps: -1. In the Skype UWP app, select the user profile icon ![Skype profile icon](images/skype_uwp_userprofile_icon.png) to go to the user’s profile page. +1. In the Skype UWP app, select the user profile icon ![Skype profile icon.](images/skype_uwp_userprofile_icon.png) to go to the user’s profile page. 2. In the account page, select **Manage account** for the Skype account that you want to change. This will take you to the online Skype portal. @@ -127,7 +127,7 @@ To manage and edit your profile in the Skype UWP app, follow these steps: 6. To change the profile picture, go to the Skype app and click on the current profile picture or avatar. The **Manage Profile Picture** window pops up. - ![Skype profile icon](images/skype_uwp_manageprofilepic.png) + ![Skype profile icon.](images/skype_uwp_manageprofilepic.png) * To take a new picture, click the camera icon in the pop up window. To upload a new picture, click the three dots (**...**). diff --git a/education/windows/education-scenarios-store-for-business.md b/education/windows/education-scenarios-store-for-business.md index 586d6ea6b8..f4ea0cf4ef 100644 --- a/education/windows/education-scenarios-store-for-business.md +++ b/education/windows/education-scenarios-store-for-business.md @@ -39,7 +39,7 @@ Admins can control whether or not teachers are automatically assigned the **Basi 2. Click **Manage**, and then click **Settings**. 3. On **Shop**, select or clear **Make everyone a Basic Purchaser**. -![manage settings to control Basic Purchaser role assignment](images/sfe-make-everyone-bp.png) +![manage settings to control Basic Purchaser role assignment.](images/sfe-make-everyone-bp.png) > [!NOTE] > **Make everyone a Basic Purchaser** is on by default. @@ -52,7 +52,7 @@ When **Make everyone a Basic Purchaser** is turned off, admins can manually assi 2. Click **Manage**, and then choose **Permissions**. 3. On **Roles**, click **Assign roles**, type and select a name, choose the role you want to assign, and then click **Save**. - ![Permission page for Microsoft Store for Business](images/sfe-roles.png) + ![Permission page for Microsoft Store for Business.](images/sfe-roles.png) **Blocked Basic Purchasers** diff --git a/education/windows/get-minecraft-for-education.md b/education/windows/get-minecraft-for-education.md index 78f1759c45..a89e29de02 100644 --- a/education/windows/get-minecraft-for-education.md +++ b/education/windows/get-minecraft-for-education.md @@ -29,7 +29,7 @@ ms.topic: conceptual Teachers and IT administrators can now get early access to **Minecraft: Education Edition** and add it their Microsoft Store for Business for distribution. - + ## Prerequisites @@ -39,11 +39,11 @@ Teachers and IT administrators can now get early access to **Minecraft: Educatio - Office 365 Education, which includes online versions of Office apps plus 1 TB online storage. [Sign up your school for Office 365 Education.](https://products.office.com/academic/office-365-education-plan) - If your school has an Office 365 Education subscription, it includes a free Azure AD subscription. [Register your free Azure AD subscription.](/windows/client-management/mdm/register-your-free-azure-active-directory-subscription) - + [Learn how teachers can get and distribute **Minecraft: Education Edition**](teacher-get-minecraft.md) - + [Learn how IT administrators can get and distribute **Minecraft: Education Edition**](school-get-minecraft.md), and how to manage permissions for Minecraft. \ No newline at end of file diff --git a/education/windows/index.md b/education/windows/index.md index 81e3f97634..cf961bfe83 100644 --- a/education/windows/index.md +++ b/education/windows/index.md @@ -14,15 +14,15 @@ ms.date: 10/13/2017 # Windows 10 for Education -![Windows 10 Education and Windows 10 Pro Education](images/windows-10-for-education-banner.png) +![Windows 10 Education and Windows 10 Pro Education.](images/windows-10-for-education-banner.png) -## ![Learn more about Windows](images/education.png) Learn +## ![Learn more about Windows.](images/education.png) Learn

Windows 10 editions for education customers
Windows 10, version 1607 introduces two editions designed for the unique needs of K-12 institutions: Windows 10 Pro Education and Windows 10 Education. These editions provide education-specific default settings for the evolving landscape in K-12 education IT environments.

Compare each Windows edition
Find out more about the features and functionality we support in each edition of Windows.

Get Windows 10 Education or Windows 10 Pro Education
When you've made your decision, find out how to buy Windows for your school.

-## ![Plan for Windows 10 in your school](images/clipboard.png) Plan +## ![Plan for Windows 10 in your school.](images/clipboard.png) Plan

Windows 10 configuration recommendations for education customers
Provides guidance on ways to customize the OS diagnostic data, consumer experiences, Cortana, search, as well as some of the preinstalled apps, so that Windows is ready for your school.

Deployment recommendations for school IT administrators
Learn how to customize the OS privacy settings, Skype, and Xbox for Windows-based devices used in schools so that you can choose what information is shared with Microsoft.

@@ -30,14 +30,14 @@ ms.date: 10/13/2017

Take tests in Windows 10
Take a Test is a new app that lets you create the right environment for taking tests. Learn how to use and get it set up.

Chromebook migration guide
Find out how you can migrate a Chromebook-based learning environment to a Windows 10-based learning environment.

-## ![Deploy Windows 10 for Education](images/PCicon.png) Deploy +## ![Deploy Windows 10 for Education.](images/PCicon.png) Deploy

Set up Windows devices for education
Depending on your school's device management needs, you can use the Set up School PCs app or the Windows Configuration Designer tool to quickly set up student PCs.

Deploy Windows 10 in a school
Get step-by-step guidance to help you deploy Windows 10 in a school environment.

Deploy Windows 10 in a school district
Get step-by-step guidance on how to deploy Windows 10 to PCs and devices across a school district.

Test Windows 10 S on existing Windows 10 education devices
Test Windows 10 S on a variety of Windows 10 devices (except Windows 10 Home) in your school and share your feedback with us.

-## ![Switch to Windows 10 for Education](images/windows.png) Switch +## ![Switch to Windows 10 for Education.](images/windows.png) Switch

Switch to Windows 10 Pro Education from Windows 10 Pro or Windows 10 S
If you have an education tenant and use Windows 10 Pro or Windows 10 S in your schools, find out how you can opt-in to a free switch to Windows 10 Pro Education.

diff --git a/education/windows/school-get-minecraft.md b/education/windows/school-get-minecraft.md index e3900603b6..a728b75a41 100644 --- a/education/windows/school-get-minecraft.md +++ b/education/windows/school-get-minecraft.md @@ -50,15 +50,15 @@ If you’ve been approved and are part of the Enrollment for Education Solutions 1. Go to [https://education.minecraft.net/](https://education.minecraft.net/) and select **GET STARTED**. - + 2. Enter your email address, and select Educator, Administrator, or Student.
If your email address isn't associated to an Azure AD or Office 365 Education tenant, you'll be asked to create one. - + 3. Select **Get the app**. This will take you to the Microsoft Store for Education to download the app. You will also receive an email with instructions and a link to the Store. - + 4. Sign in to Microsoft Store for Education with your email address. @@ -66,7 +66,7 @@ If you’ve been approved and are part of the Enrollment for Education Solutions 6. **Minecraft: Education Edition** opens in the Microsoft Store for Education. Select **Get the app**. This places **Minecraft: Education Edition** in your Store inventory. - + Now that the app is in your Microsoft Store for Education inventory, you can choose how to distribute Minecraft. For more information on distribution options, see [Distribute Minecraft](#distribute-minecraft). @@ -113,11 +113,11 @@ After you've finished the purchase, you can find your invoice by checking **Mine 2. Click **Minecraft: Education Edition** in the list of apps. 3. On **Minecraft: Education Edition**, click **View Bills**. - ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-view-bills.png) + ![Minecraft: Education Edition app details page with view bills link highlighted.](images/mcee-view-bills.png) 4. On **Invoice Bills**, click the invoice number to view and download your invoice. It downloads as a .pdf. - ![Minecraft: Education Edition app details page with view bills link highlighted](images/mcee-invoice-bills.png) + ![Minecraft: Education Edition app details page with view bills link highlighted.](images/mcee-invoice-bills.png) The **Payment Instructions** section on the first page of the invoice has information on invoice amount, due date, and how to pay with electronic funds transfer, or with a check. @@ -133,11 +133,11 @@ Admins can also add Minecraft: Education Edition to the private store. This allo ### Configure automatic subscription assignment @@ -168,7 +168,7 @@ You can install the app on your PC. This gives you a chance to test the app and 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. - + 3. Click **Install**. @@ -180,33 +180,33 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. - ![Minecraft Education Edition product page](images/mc-install-for-me-teacher.png) + ![Minecraft Education Edition product page.](images/mc-install-for-me-teacher.png) 3. Click **Invite people**. 4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. You can only assign the app to students with work or school accounts. If you don't find the student, you might need to add a work or school account for the student. - ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) + ![Assign to people showing student name.](images/minecraft-assign-to-people-name.png) **To finish Minecraft install (for students)** 1. Students will receive an email with a link that will install the app on their PC.
- ![Email with Get the app link](images/minecraft-student-install-email.png) + ![Email with Get the app link.](images/minecraft-student-install-email.png) 2. Click **Get the app** to start the app install in Microsoft Store app. 3. In Microsoft Store app, click **Install**. - ![Microsoft Store app with Minecraft page](images/minecraft-in-windows-store-app.png) + ![Microsoft Store app with Minecraft page.](images/minecraft-in-windows-store-app.png) After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**. Microsoft Store app is preinstalled with Windows 10. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) When students click **My Library** they'll find apps assigned to them. - ![My Library for example student](images/minecraft-my-library.png) + ![My Library for example student.](images/minecraft-my-library.png) ### Download for others Download for others allows teachers or IT admins to download an app that they can install on PCs. This will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when: @@ -225,11 +225,11 @@ Minecraft: Education Edition will not install if there are updates pending for o 1. Start Microsoft Store app on the PC (click **Start**, and type **Store**). 2. Click the account button, and then click **Downloads and updates**. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) 3. Click **Check for updates**, and install all available updates. - ![Microsoft Store app showing access to My Library](images/mc-check-for-updates.png) + ![Microsoft Store app showing access to My Library.](images/mc-check-for-updates.png) 4. Restart the computer before installing Minecraft: Education Edition. @@ -238,7 +238,7 @@ You'll download a .zip file, extract the files, and then use one of the files to 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**. - ![Microsoft Store app showing access to My Library](images/mc-dnld-others-teacher.png) + ![Microsoft Store app showing access to My Library.](images/mc-dnld-others-teacher.png) 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. @@ -257,7 +257,7 @@ However, tenant admins can control whether or not teachers automatically sign up To prevent educators from automatically signing up for Microsoft Store for Business 1. In Microsoft Store for Business, click **Settings**, and then click **Permissions**. - ![Permission page for Microsoft Store for Business](images/minecraft-admin-permissions.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-admin-permissions.png) 2. Click **Allow educators in my organization to sign up for the Microsoft Store for Business.** @@ -269,7 +269,7 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. - Acquire and manage the app - Info on Support page (including links to documentation and access to support through customer service) - ![assign roles to manage Minecraft permissions](images/minecraft-perms.png) + ![assign roles to manage Minecraft permissions.](images/minecraft-perms.png) **To assign Basic Purchaser role** @@ -280,15 +280,15 @@ Minecraft: Education Edition adds a new role for teachers: **Basic Purchaser**. 2. Click **Settings**, and then choose **Permissions**. - ![Permission page for Microsoft Store for Business](images/minecraft-admin-permissions.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-admin-permissions.png) 3. Click **Add people**, type a name, select the correct person, choose the role you want to assign, and click **Save**. - ![Permission page for Microsoft Store for Business](images/minecraft-assign-roles.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-assign-roles.png) Microsoft Store for Business updates the list of people and permissions. - ![Permission page for Microsoft Store for Business](images/minecraft-assign-roles-2.png) + ![Permission page for Microsoft Store for Business.](images/minecraft-assign-roles-2.png) --> diff --git a/education/windows/set-up-school-pcs-azure-ad-join.md b/education/windows/set-up-school-pcs-azure-ad-join.md index 6d62b6bb55..02198518ca 100644 --- a/education/windows/set-up-school-pcs-azure-ad-join.md +++ b/education/windows/set-up-school-pcs-azure-ad-join.md @@ -48,7 +48,7 @@ Active Directory** \> **Devices** \> **Device settings**. for Azure AD by selecting **All** or **Selected**. If you choose the latter option, select the teachers and IT staff to allow them to connect to Azure AD. -![Select the users you want to let join devices to Azure AD](images/suspc-enable-shared-pc-1807.png) +![Select the users you want to let join devices to Azure AD.](images/suspc-enable-shared-pc-1807.png) You can also create an account that holds the exclusive rights to join devices. When a student PC needs to be set up, provide the account credentials to the appropriate teachers or staff. diff --git a/education/windows/set-up-students-pcs-to-join-domain.md b/education/windows/set-up-students-pcs-to-join-domain.md index 22d45b09fc..328b2f80a1 100644 --- a/education/windows/set-up-students-pcs-to-join-domain.md +++ b/education/windows/set-up-students-pcs-to-join-domain.md @@ -43,7 +43,7 @@ Follow the steps in [Provision PCs with common settings for initial deployment ( **Figure 7** - Add the account to use for test-taking - ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png) + ![Add the account to use for test-taking.](images/wcd_settings_assignedaccess.png) The account can be in one of the following formats: - username diff --git a/education/windows/set-up-students-pcs-with-apps.md b/education/windows/set-up-students-pcs-with-apps.md index 7d803777e5..f0bb65fa78 100644 --- a/education/windows/set-up-students-pcs-with-apps.md +++ b/education/windows/set-up-students-pcs-with-apps.md @@ -35,7 +35,7 @@ You can apply a provisioning package on a USB drive to off-the-shelf devices dur 2. 2. On the **Finish** page, select **Switch to advanced editor**. - ![Switch to advanced editor](images/icd-school-adv-edit.png) + ![Switch to advanced editor.](images/icd-school-adv-edit.png) **Next steps** - [Add a desktop app to your package](#add-a-desktop-app-to-your-package) @@ -52,7 +52,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options](images/icdstart-option.png) + ![ICD start options.](images/icdstart-option.png) 3. Name your project and click **Next**. @@ -89,17 +89,17 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package](images/uwp-family.png) + ![details for offline app package.](images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package](images/uwp-dependencies.png) + ![required frameworks for offline app package.](images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. In Microsoft Store for Business, you generate the license for the app on the app's download page. - ![generate license for offline app](images/uwp-license.png) + ![generate license for offline app.](images/uwp-license.png) [Learn more about distributing offline apps from the Microsoft Store for Business.](/microsoft-store/distribute-offline-apps) @@ -168,7 +168,7 @@ If your build is successful, the name of the provisioning package, output direct **During initial setup, from a USB drive** 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](images/oobe.jpg) + ![The first screen to set up a new PC.](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -176,11 +176,11 @@ If your build is successful, the name of the provisioning package, output direct 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](images/prov.jpg) + ![Provision this device.](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](images/choose-package.png) + ![Choose a package.](images/choose-package.png) 5. Select **Yes, add it**. @@ -188,11 +188,11 @@ If your build is successful, the name of the provisioning package, output direct 6. Read and accept the Microsoft Software License Terms. - ![Sign in](images/license-terms.png) + ![Sign in.](images/license-terms.png) 7. Select **Use Express settings**. - ![Get going fast](images/express-settings.png) + ![Get going fast.](images/express-settings.png) 8. If the PC doesn't use a volume license, you'll see the **Who owns this PC?** screen. Select **My work or school owns it** and tap **Next**. @@ -200,18 +200,18 @@ If your build is successful, the name of the provisioning package, output direct 9. On the **Choose how you'll connect** screen, select **Join Azure AD** or **Join a domain** and tap **Next**. - ![Connect to Azure AD](images/connect-aad.png) + ![Connect to Azure AD.](images/connect-aad.png) 10. Sign in with your domain, Azure AD, or Office 365 account and password. When you see the progress ring, you can remove the USB drive. - ![Sign in](images/sign-in-prov.png) + ![Sign in.](images/sign-in-prov.png) **After setup, from a USB drive, network folder, or SharePoint site** On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and select the package to install. -![add a package option](images/package.png) +![add a package option.](images/package.png) --> diff --git a/education/windows/set-up-windows-10.md b/education/windows/set-up-windows-10.md index b401df97ef..e1acdf9f1d 100644 --- a/education/windows/set-up-windows-10.md +++ b/education/windows/set-up-windows-10.md @@ -27,7 +27,7 @@ Choose the tool that is appropriate for how your students will sign in (Active D You can use the following diagram to compare the tools. -![Which tool to use to set up Windows 10](images/suspc_wcd_featureslist.png) +![Which tool to use to set up Windows 10.](images/suspc_wcd_featureslist.png) ## In this section diff --git a/education/windows/take-a-test-multiple-pcs.md b/education/windows/take-a-test-multiple-pcs.md index 3044c770e5..10e2d2f7e0 100644 --- a/education/windows/take-a-test-multiple-pcs.md +++ b/education/windows/take-a-test-multiple-pcs.md @@ -39,7 +39,7 @@ If you set up Take a Test, this adds a **Take a Test** button on the student PC' **Figure 1** - Configure Take a Test in the Set up School PCs app -![Configure Take a Test in the Set up School PCs app](images/suspc_choosesettings_setuptakeatest.png) +![Configure Take a Test in the Set up School PCs app.](images/suspc_choosesettings_setuptakeatest.png) ### Set up a test account in Intune for Education You can set up a test-taking account in Intune for Education. To do this, follow these steps: @@ -49,7 +49,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 2** - Add a test profile in Intune for Education - ![Add a test profile in Intune for Education](images/i4e_takeatestprofile_addnewprofile.png) + ![Add a test profile in Intune for Education.](images/i4e_takeatestprofile_addnewprofile.png) 3. In the new profile page: 1. Enter a name for the profile. @@ -60,7 +60,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 3** - Add information about the test profile - ![Add information about the test profile](images/i4e_takeatestprofile_newtestaccount.png) + ![Add information about the test profile.](images/i4e_takeatestprofile_newtestaccount.png) After you save the test profile, you will see a summary of the settings that you configured for Take a Test. Next, you'll need to assign the test profile to a group that will be using the test account. @@ -68,13 +68,13 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 4** - Assign the test account to a group - ![Assign the test account to a group](images/i4e_takeatestprofile_accountsummary.png) + ![Assign the test account to a group.](images/i4e_takeatestprofile_accountsummary.png) 5. In the **Groups** page, click **Change group assignments**. **Figure 5** - Change group assignments - ![Change group assignments](images/i4e_takeatestprofile_groups_changegroupassignments.png) + ![Change group assignments.](images/i4e_takeatestprofile_groups_changegroupassignments.png) 6. In the **Change group assignments** page: 1. Select a group from the right column and click **Add Members** to select the group and assign the test-taking account to that group. You can select more than one group. @@ -82,7 +82,7 @@ You can set up a test-taking account in Intune for Education. To do this, follow **Figure 6** - Select the group(s) that will use the test account - ![Select the groups that will use the test account](images/i4e_takeatestprofile_groupassignment_selected.png) + ![Select the groups that will use the test account.](images/i4e_takeatestprofile_groupassignment_selected.png) And that's it! When the students from the selected group sign in to the student PCs using the Take a Test user name that you selected, the PC will be locked down and Take a Test will open the assessment URL and students can start taking tests. @@ -136,7 +136,7 @@ To set up a test account through Windows Configuration Designer, follow these st **Figure 7** - Add the account to use for test-taking - ![Add the account to use for test-taking](images/wcd_settings_assignedaccess.png) + ![Add the account to use for test-taking.](images/wcd_settings_assignedaccess.png) The account can be in one of the following formats: - username diff --git a/education/windows/take-a-test-single-pc.md b/education/windows/take-a-test-single-pc.md index 1286a5aec8..9d26301975 100644 --- a/education/windows/take-a-test-single-pc.md +++ b/education/windows/take-a-test-single-pc.md @@ -30,13 +30,13 @@ To configure the assessment URL and a dedicated testing account on a single PC, **Figure 1** - Use the Settings app to set up a test-taking account - ![Use the Settings app to set up a test-taking account](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png) + ![Use the Settings app to set up a test-taking account.](images/tat_settingsapp_workorschoolaccess_setuptestaccount.png) 4. In the **Set up an account for taking tests** window, choose an existing account to use as the dedicated testing account. **Figure 2** - Choose the test-taking account - ![Choose the test-taking account](images/tat_settingsapp_setuptesttakingaccount_1703.png) + ![Choose the test-taking account.](images/tat_settingsapp_setuptesttakingaccount_1703.png) > [!NOTE] > If you don't have an account on the device, you can create a new account. To do this, go to **Settings > Accounts > Other people > Add someone else to this PC > I don’t have this person’s sign-in information > Add a user without a Microsoft account**. diff --git a/education/windows/take-tests-in-windows-10.md b/education/windows/take-tests-in-windows-10.md index 7e016c22c0..f9ba6a9479 100644 --- a/education/windows/take-tests-in-windows-10.md +++ b/education/windows/take-tests-in-windows-10.md @@ -32,7 +32,7 @@ Many schools use online testing for formative and summative assessments. It's cr ## How to use Take a Test -![Set up and user flow for the Take a Test app](images/take_a_test_flow_dark.png) +![Set up and user flow for the Take a Test app.](images/take_a_test_flow_dark.png) There are several ways to configure devices for assessments, depending on your use case: diff --git a/education/windows/teacher-get-minecraft.md b/education/windows/teacher-get-minecraft.md index 136499ee4c..6f0d1d4341 100644 --- a/education/windows/teacher-get-minecraft.md +++ b/education/windows/teacher-get-minecraft.md @@ -65,7 +65,7 @@ After Minecraft: Education Edition licenses have been purchased, either directly - You can assign the app to others. - You can download the app to distribute. - + ### Install for me You can install the app on your PC. This gives you a chance to work with the app before using it with your students. @@ -73,7 +73,7 @@ You can install the app on your PC. This gives you a chance to work with the app 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**, and then click **Install**. - + 3. Click **Install**. @@ -84,13 +84,13 @@ Enter email addresses for your students, and each student will get an email with 1. Sign in to [Microsoft Store for Education](https://educationstore.microsoft.com). 2. Click **Manage**. - + 3. Click **Invite people**. 4. Type the name, or email address of the student or group you want to assign the app to, and then click **Assign**. - ![Assign to people showing student name](images/minecraft-assign-to-people-name.png) + ![Assign to people showing student name.](images/minecraft-assign-to-people-name.png) You can assign the app to students with work or school accounts.
If you don't find the student, you can still assign the app to them if self-service sign up is supported for your domain. Students will receive an email with a link to Microsoft 365 admin center where they can create an account, and then install **Minecraft: Education Edition**. Questions about self-service sign up? Check with your admin. @@ -100,20 +100,20 @@ Enter email addresses for your students, and each student will get an email with Students will receive an email with a link that will install the app on their PC. -![Email with Get the app link](images/minecraft-student-install-email.png) +![Email with Get the app link.](images/minecraft-student-install-email.png) 1. Click **Get the app** to start the app install in Microsoft Store app. 2. In Microsoft Store app, click **Install**. - ![Microsoft Store app with Minecraft page](images/minecraft-in-windows-store-app.png) + ![Microsoft Store app with Minecraft page.](images/minecraft-in-windows-store-app.png) After installing the app, students can find Minecraft: Education Edition in Microsoft Store app under **My Library**. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) When students click **My Library** they'll find apps assigned to them. - ![My Library for example student](images/minecraft-my-library.png) + ![My Library for example student.](images/minecraft-my-library.png) ### Download for others Download for others allows teachers or IT admins to download a packages that they can install on student PCs. This will install Minecraft: Education Edition on the PC, and allows anyone with a Windows account to use the app on that PC. This option is best for students, and for shared computers. Choose this option when: @@ -132,11 +132,11 @@ Minecraft: Education Edition will not install if there are updates pending for o 1. Start Microsoft Store app on the PC (click **Start**, and type **Store**). 2. Click the account button, and then click **Downloads and updates**. - ![Microsoft Store app showing access to My Library](images/minecraft-private-store.png) + ![Microsoft Store app showing access to My Library.](images/minecraft-private-store.png) 3. Click **Check for updates**, and install all available updates. - ![Microsoft Store app showing access to My Library](images/mc-check-for-updates.png) + ![Microsoft Store app showing access to My Library.](images/mc-check-for-updates.png) 4. Restart the computer before installing Minecraft: Education Edition. @@ -145,7 +145,7 @@ You'll download a .zip file, extract the files, and then use one of the files to 1. **Download Minecraft Education Edition.zip**. From the **Minecraft: Education Edition** page, click **Download for others** tab, and then click **Download**. - ![Microsoft Store app showing access to My Library](images/mc-dnld-others-teacher.png) + ![Microsoft Store app showing access to My Library.](images/mc-dnld-others-teacher.png) 2. **Extract files**. Find the .zip file that you downloaded and extract the files. This is usually your **Downloads** folder, unless you chose to save the .zip file to a different location. Right-click the file and choose **Extract all**. 3. **Save to USB drive**. After you've extracted the files, save the Minecraft: Education Edition folder to a USB drive, or to a network location that you can access from each PC. diff --git a/education/windows/use-set-up-school-pcs-app.md b/education/windows/use-set-up-school-pcs-app.md index 3f31119391..ca36e12e5a 100644 --- a/education/windows/use-set-up-school-pcs-app.md +++ b/education/windows/use-set-up-school-pcs-app.md @@ -103,7 +103,7 @@ We strongly recommend that you avoid changing preset policies. Changes can slow The **Set up School PCs** app guides you through the configuration choices for the student PCs. To begin, open the app on your PC and click **Get started**. - ![Launch the Set up School PCs app](images/suspc_getstarted_050817.png) + ![Launch the Set up School PCs app.](images/suspc_getstarted_050817.png) ### Package name Type a unique name to help distinguish your school's provisioning packages. The name appears: diff --git a/smb/cloud-mode-business-setup.md b/smb/cloud-mode-business-setup.md index 4294d7199e..3b6a109ef3 100644 --- a/smb/cloud-mode-business-setup.md +++ b/smb/cloud-mode-business-setup.md @@ -18,7 +18,7 @@ ms.topic: conceptual # Get started: Deploy and manage a full cloud IT solution for your business -![Learn how to set up a full cloud infrastructure for your business](images/business-cloud-mode.png) +![Learn how to set up a full cloud infrastructure for your business.](images/business-cloud-mode.png) **Applies to:** @@ -61,7 +61,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 1** - Try or buy Office 365 - ![Office 365 for business sign up](images/office365_tryorbuy_now.png) + ![Office 365 for business sign up.](images/office365_tryorbuy_now.png) 2. Fill out the sign up form and provide information about you and your company. 3. Create a user ID and password to use to sign into your account. @@ -76,7 +76,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 2** - Microsoft 365 admin center - ![Microsoft 365 admin center](images/office365_portal.png) + ![Microsoft 365 admin center.](images/office365_portal.png) 6. Select the **Admin** tile to go to the admin center. @@ -86,7 +86,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 3** - Admin center - ![Microsoft 365 admin center](images/office365_admin_portal.png) + ![Microsoft 365 admin center.](images/office365_admin_portal.png) 8. Go back to the admin center to add or buy a domain. @@ -94,14 +94,14 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 4** - Option to add or buy a domain - ![Add or buy a domain in admin center](images/office365_buy_domain.png) + ![Add or buy a domain in admin center.](images/office365_buy_domain.png) 2. In the **Home > Domains** page, you will see the Microsoft-provided domain, such as *fabrikamdesign.onmicrosoft.com*. **Figure 5** - Microsoft-provided domain - ![Microsoft-provided domain](images/office365_ms_provided_domain.png) + ![Microsoft-provided domain.](images/office365_ms_provided_domain.png) - If you already have a domain, select **+ Add domain** to add your existing domain. If you select this option, you'll be required to verify that you own the domain. Follow the steps in the wizard to verify your domain. - If you don't already own a domain, select **+ Buy domain**. If you're using a trial plan, you'll be required to upgrade your trial plan in order to buy a domain. Choose the subscription plan to use for your business and provide the details to complete your order. @@ -110,7 +110,7 @@ If this is the first time you're setting this up, and you'd like to see how it's **Figure 6** - Domains - ![Verify your domains in the admin center](images/office365_additional_domain.png) + ![Verify your domains in the admin center.](images/office365_additional_domain.png) ### 1.2 Add users and assign product licenses Once you've set up Office and added your domain, it's time to add users so they have access to Office 365. People in your organization need an account before they can sign in and access Office 365. The easiest way to add users is to add them one at a time in the Microsoft 365 admin center. @@ -123,7 +123,7 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 7** - Add users - ![Add Office 365 users](images/office365_users.png) + ![Add Office 365 users.](images/office365_users.png) 2. In the **Home > Active users** page, add users individually or in bulk. - To add users one at a time, select **+ Add a user**. @@ -132,7 +132,7 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 8** - Add an individual user - ![Add an individual user](images/office365_add_individual_user.png) + ![Add an individual user.](images/office365_add_individual_user.png) - To add multiple users at once, select **More** and then choose **+ Import multiple users**. If you select this option, you'll need to create and upload a CSV file containing the list of users. @@ -140,13 +140,13 @@ When adding users, you can also assign admin privileges to certain users in your **Figure 9** - Import multiple users - ![Import multiple users](images/office365_import_multiple_users.png) + ![Import multiple users.](images/office365_import_multiple_users.png) 3. Verify that all the users you added appear in the list of **Active users**. The **Status** should indicate the product licenses that were assigned to them. **Figure 10** - List of active users - ![Verify users and assigned product licenses](images/o365_active_users.png) + ![Verify users and assigned product licenses.](images/o365_active_users.png) ### 1.3 Add Microsoft Intune Microsoft Intune provides mobile device management, app management, and PC management capabilities from the cloud. Using Intune, organizations can provide their employees with access to apps, data, and corporate resources from anywhere on almost any device while helping to keep corporate information secure. To learn more, see What is Intune? @@ -160,14 +160,14 @@ Microsoft Intune provides mobile device management, app management, and PC manag **Figure 11** - Assign Intune licenses - ![Assign Microsoft Intune licenses to users](images/o365_assign_intune_license.png) + ![Assign Microsoft Intune licenses to users.](images/o365_assign_intune_license.png) 5. In the admin center, confirm that **Intune** shows up in the list under **Admin centers**. If it doesn't, sign out and then sign back in and then check again. 6. Select **Intune**. This will take you to the Intune management portal. **Figure 12** - Microsoft Intune management portal - ![Microsoft Intune management portal](images/intune_portal_home.png) + ![Microsoft Intune management portal.](images/intune_portal_home.png) Intune should now be added to your tenant. We'll come back to Intune later when we [Configure Microsoft Store for Business for app distribution](#17-configure-microsoft-store-for-business-for-app-distribution). @@ -185,21 +185,21 @@ Microsoft Azure is an open and flexible cloud platform that enables you to quick **Figure 13** - Access to Azure AD is not available - ![Access to Azure AD not available](images/azure_ad_access_not_available.png) + ![Access to Azure AD not available.](images/azure_ad_access_not_available.png) 3. From the error message, select the country/region for your business. This should match with the location you specified when you signed up for Office 365. 4. Click **Azure subscription**. This will take you to a free trial sign up screen. **Figure 14** - Sign up for Microsoft Azure - ![Sign up for Microsoft Azure](images/azure_ad_sign_up_screen.png) + ![Sign up for Microsoft Azure.](images/azure_ad_sign_up_screen.png) 5. In the **Free trial sign up** screen, fill in the required information and then click **Sign up**. 6. After you sign up, you should see the message that your subscription is ready. Click **Start managing my service**. **Figure 15** - Start managing your Azure subscription - ![Start managing your Azure subscription](images/azure_ad_successful_signup.png) + ![Start managing your Azure subscription.](images/azure_ad_successful_signup.png) This will take you to the Microsoft Azure portal. @@ -216,26 +216,26 @@ To add Azure AD group(s), we will use the Microsoft Store for Business using the same tenant account that you used to sign into Intune. 4. Accept the EULA. @@ -312,20 +312,20 @@ In this part of the walkthrough, we'll be working on the Intune management portal, select **Admin > Mobile Device Management**, expand **Windows**, and then choose **Store for Business**. 8. In the **Microsoft Store for Business** page, select **Configure Sync** to sync your Store for Business volume-purchased apps with Intune. **Figure 26** - Configure Store for Business sync in Intune - ![Configure Store for Business sync in Intune](images/intune_admin_mdm_store_sync.png) + ![Configure Store for Business sync in Intune.](images/intune_admin_mdm_store_sync.png) 9. In the **Configure Microsoft Store for Business app sync** dialog box, check **Enable Microsoft Store for Business sync**. In the **Language** dropdown list, choose the language in which you want apps from the Store to be displayed in the Intune console and then click **OK**. **Figure 27** - Enable Microsoft Store for Business sync in Intune - ![Enable Store for Business sync in Intune](images/intune_configure_store_app_sync_dialog.png) + ![Enable Store for Business sync in Intune.](images/intune_configure_store_app_sync_dialog.png) The **Microsoft Store for Business** page will refresh and it will show the details from the sync. @@ -348,7 +348,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 28** - Shop for Store apps - ![Shop for Store apps](images/wsfb_shop_microsoft_apps.png) + ![Shop for Store apps.](images/wsfb_shop_microsoft_apps.png) 2. Click to select an app, such as **Reader**. This opens the app page. 3. In the app's Store page, click **Get the app**. You should see a dialog that confirms your order. Click **Close**. This will refresh the app's Store page. @@ -358,7 +358,7 @@ In the following example, we'll show you how to buy apps through the Microsoft S **Figure 29** - App inventory shows the purchased apps - ![Confirm that your inventory shows purchased apps](images/wsfb_manage_inventory_newapps.png) + ![Confirm that your inventory shows purchased apps.](images/wsfb_manage_inventory_newapps.png) > [!NOTE] > Sync happens automatically, but it may take up to 24 hours for your organization's private store and 12 hours for Intune to sync all your purchased apps. You can force a sync to make this process happen faster. For more info, see [To sync recently purchased apps](#forceappsync). @@ -372,7 +372,7 @@ If you need to sync your most recently purchased apps and have it appear in your **Figure 30** - Force a sync in Intune - ![Force a sync in Intune](images/intune_admin_mdm_forcesync.png) + ![Force a sync in Intune.](images/intune_admin_mdm_forcesync.png) **To view purchased apps** - In the Intune management portal, select **Apps > Apps** and then choose **Volume-Purchased Apps** to see the list of available apps. Verify that the apps you purchased were imported correctly. @@ -393,7 +393,7 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 31** - First screen in Windows device setup - ![First screen in Windows device setup](images/win10_hithere.png) + ![First screen in Windows device setup.](images/win10_hithere.png) > [!NOTE] > During setup, if you don't have a Wi-Fi network configured, make sure you connect the device to the Internet through a wired/Ethernet connection. @@ -403,13 +403,13 @@ To set up new Windows devices, go through the Windows initial device setup or fi **Figure 32** - Choose how you'll connect your Windows device - ![Choose how you'll connect the Windows device](images/win10_choosehowtoconnect.png) + ![Choose how you'll connect the Windows device.](images/win10_choosehowtoconnect.png) 4. In the **Let's get you signed in** screen, sign in using one of the user accounts you added in section [1.2 Add users and assign product licenses](#12-add-users-and-assign-product-licenses). We suggest signing in as one of the global administrators. Later, sign in on another device using one of the non-admin accounts. **Figure 33** - Sign in using one of the accounts you added - ![Sign in using one of the accounts you added](images/win10_signin_admin_account.png) + ![Sign in using one of the accounts you added.](images/win10_signin_admin_account.png) 5. If this is the first time you're signing in, you will be asked to update your password. Update the password and continue with sign-in and setup. @@ -430,7 +430,7 @@ In the Intune management **Figure 34** - Check the PC name on your device - ![Check the PC name on your device](images/win10_settings_pcname.png) + ![Check the PC name on your device.](images/win10_settings_pcname.png) 2. Log in to the Intune management portal. 3. Select **Groups** and then go to **Devices**. @@ -441,7 +441,7 @@ In the Intune management **Figure 35** - Check that the device appears in Intune - ![Check that the device appears in Intune](images/intune_groups_devices_list.png) + ![Check that the device appears in Intune.](images/intune_groups_devices_list.png) ## 3. Manage device settings and features You can use Microsoft Intune admin settings and policies to manage features on your organization's mobile devices and computers. For more info, see [Manage settings and features on your devices with Microsoft Intune policies](/intune/deploy-use/manage-settings-and-features-on-your-devices-with-microsoft-intune-policies). @@ -460,7 +460,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 36** - Reconfigure an app's deployment setting in Intune - ![Reconfigure app deployment settings in Intune](images/intune_apps_deploymentaction.png) + ![Reconfigure app deployment settings in Intune.](images/intune_apps_deploymentaction.png) 6. Click **Finish**. 7. Repeat steps 2-6 for other apps that you want to deploy to the device(s) as soon as possible. @@ -470,7 +470,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 37** - Confirm that additional apps were deployed to the device - ![Confirm that additional apps were deployed to the device](images/win10_deploy_apps_immediately.png) + ![Confirm that additional apps were deployed to the device.](images/win10_deploy_apps_immediately.png) ### 3.2 Configure other settings in Intune @@ -486,7 +486,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 38** - Add a configuration policy - ![Add a configuration policy](images/intune_policy_disablecamera.png) + ![Add a configuration policy.](images/intune_policy_disablecamera.png) 7. Click **Save Policy**. A confirmation window will pop up. 8. On the **Deploy Policy** confirmation window, select **Yes** to deploy the policy now. @@ -495,7 +495,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 39** - The new policy should appear in the **Policies** list. - ![New policy appears on the list](images/intune_policies_newpolicy_deployed.png) + ![New policy appears on the list.](images/intune_policies_newpolicy_deployed.png) **To turn off Windows Hello and PINs during device setup** 1. In the Intune management portal, select **Admin**. @@ -504,7 +504,7 @@ In some cases, if an app is missing from the device, you need to reconfigure the **Figure 40** - Policy to disable Windows Hello for Business - ![Disable Windows Hello for Business](images/intune_policy_disable_windowshello.png) + ![Disable Windows Hello for Business.](images/intune_policy_disable_windowshello.png) 4. Click **Save**. @@ -531,32 +531,32 @@ For other devices, such as those personally-owned by employees who need to conne **Figure 41** - Add an Azure AD account to the device - ![Add an Azure AD account to the device](images/win10_add_new_user_join_aad.png) + ![Add an Azure AD account to the device.](images/win10_add_new_user_join_aad.png) 4. In the **Let's get you signed in** window, enter the work credentials for the account and then click **Sign in** to authenticate the user. **Figure 42** - Enter the account details - ![Enter the account details](images/win10_add_new_user_account_aadwork.png) + ![Enter the account details.](images/win10_add_new_user_account_aadwork.png) 5. You will be asked to update the password so enter a new password. 6. Verify the details to make sure you're connecting to the right organization and then click **Join**. **Figure 43** - Make sure this is your organization - ![Make sure this is your organization](images/win10_confirm_organization_details.png) + ![Make sure this is your organization.](images/win10_confirm_organization_details.png) 7. You will see a confirmation window that says the device is now connected to your organization. Click **Done**. **Figure 44** - Confirmation that the device is now connected - ![Confirmation that the device is now connected](images/win10_confirm_device_connected_to_org.png) + ![Confirmation that the device is now connected.](images/win10_confirm_device_connected_to_org.png) 8. The **Connect to work or school** window will refresh and will now include an entry that shows you're connected to your organization's Azure AD. This means the device is now registered in Azure AD and enrolled in MDM and the account should have access to the organization's resources. **Figure 45** - Device is now enrolled in Azure AD - ![Device is enrolled in Azure AD](images/win10_device_enrolled_in_aad.png) + ![Device is enrolled in Azure AD.](images/win10_device_enrolled_in_aad.png) 9. You can confirm that the new device and user are showing up as Intune-managed by going to the Intune management portal and following the steps in [2.3 Verify the device is Azure AD joined](#23-verify-the-device-is-azure-ad-joined). It may take several minutes before the new device shows up so check again later. diff --git a/smb/index.md b/smb/index.md index cc4c596a1c..a6ae7f1200 100644 --- a/smb/index.md +++ b/smb/index.md @@ -17,16 +17,16 @@ audience: itpro # Windows 10 for SMB -![Windows 10 for SMB](images/smb_portal_banner.png) +![Windows 10 for SMB.](images/smb_portal_banner.png) -## ![Learn more about Windows and other resources for SMBs](images/learn.png) Learn +## ![Learn more about Windows and other resources for SMBs.](images/learn.png) Learn

Windows 10 for business
Learn how Windows 10 and Windows devices can help your business.

SMB blog
Read about the latest stories, technology insights, and business strategies for SMBs.

How to buy
Go here when you're ready to buy or want to learn more about Microsoft products you can use to help transform your business.

-## ![Deploy a Microsoft solution for your business](images/deploy.png) Deploy +## ![Deploy a Microsoft solution for your business.](images/deploy.png) Deploy

Get started: Deploy and manage a full cloud IT solution for your business
Find out how easy it is to deploy and manage a full cloud IT solution for your small to midsize business using Microsoft cloud services and tools.

diff --git a/store-for-business/acquire-apps-microsoft-store-for-business.md b/store-for-business/acquire-apps-microsoft-store-for-business.md index 73c2ce1f3d..882b7e57ba 100644 --- a/store-for-business/acquire-apps-microsoft-store-for-business.md +++ b/store-for-business/acquire-apps-microsoft-store-for-business.md @@ -55,7 +55,7 @@ There are a couple of things we need to know when you pay for apps. You can add 2. Select **Manage**, and then select **Settings**. 3. On **Shop**, , under **Shopping behavior**, turn on or turn off **Allow users to shop**. -![manage settings to control Basic Purchaser role assignment](images/sfb-allow-shop-setting.png) +![manage settings to control Basic Purchaser role assignment.](images/sfb-allow-shop-setting.png) ## Allow app requests diff --git a/store-for-business/billing-understand-your-invoice-msfb.md b/store-for-business/billing-understand-your-invoice-msfb.md index 26bb2598f8..bee1e82435 100644 --- a/store-for-business/billing-understand-your-invoice-msfb.md +++ b/store-for-business/billing-understand-your-invoice-msfb.md @@ -51,7 +51,7 @@ invoice and descriptions for each term. The **Invoice Summary** is on the top of the first page and shows information about your billing profile and how you pay. -![Invoice summary section](images/invoicesummary.png) +![Invoice summary section.](images/invoicesummary.png) | Term | Description | @@ -68,7 +68,7 @@ The **Invoice Summary** is on the top of the first page and shows information ab The **Billing Summary** shows the charges against the billing profile since the previous billing period, any credits that were applied, tax, and the total amount due. -![Billing summary section](images/billingsummary.png) +![Billing summary section.](images/billingsummary.png) | Term | Description | | --- | --- | @@ -91,7 +91,7 @@ The total amount due for each service family is calculated by subtracting Azure `Total = Charges/Credits - Azure Credit + Tax` -![Details by invoice section](images/invoicesectiondetails.png) +![Details by invoice section.](images/invoicesectiondetails.png) | Term |Description | | --- | --- | diff --git a/store-for-business/microsoft-store-for-business-education-powershell-module.md b/store-for-business/microsoft-store-for-business-education-powershell-module.md index bb29be21a9..3bdd7d61bc 100644 --- a/store-for-business/microsoft-store-for-business-education-powershell-module.md +++ b/store-for-business/microsoft-store-for-business-education-powershell-module.md @@ -91,7 +91,7 @@ Get-MSStoreInventory >1. Sign in to [Microsoft Store for Business](https://go.microsoft.com/fwlink/p/?LinkId=691845) or [Microsoft Store for Education](https://businessstore.microsoft.com/). >2. Click **Manage** and then choose **Apps & software**. >3. Click the line-of-business app. The URL of the page will contain the product ID and SKU as part of the URL. For example: ->![Url after apps/ is product id and next is SKU](images/lob-sku.png) +>![Url after apps/ is product id and next is SKU.](images/lob-sku.png) ## View people assigned to a product Most items in **Products and Services** in **Microsoft Store for Business and Education** need to be assigned to people in your org. You can view the people in your org assigned to a specific product by using these commands: diff --git a/store-for-business/troubleshoot-microsoft-store-for-business.md b/store-for-business/troubleshoot-microsoft-store-for-business.md index 784e422a8a..0a66d2a739 100644 --- a/store-for-business/troubleshoot-microsoft-store-for-business.md +++ b/store-for-business/troubleshoot-microsoft-store-for-business.md @@ -36,23 +36,23 @@ The private store for your organization is a page in Microsoft Store app that co 1. Click the people icon in Microsoft Store app, and click **Sign in**. - ![Sign in to Store app with a different account](images/wsfb-wsappsignin.png) + ![Sign in to Store app with a different account.](images/wsfb-wsappsignin.png) 2. Click **Add account**, and then click **Work or school account**. - ![Choose an account to use](images/wsfb-wsappaddacct.png) + ![Choose an account to use.](images/wsfb-wsappaddacct.png) 3. Type the email account and password, and click **Sign in**. - ![Sign in for work or school account](images/wsfb-wsappworkacct.png) + ![Sign in for work or school account.](images/wsfb-wsappworkacct.png) 4. You should see the private store for your organization. In our example, the page is named **Contoso publishing**. - ![Private store with name highlighted](images/wsfb-wsappprivatestore.png) + ![Private store with name highlighted.](images/wsfb-wsappprivatestore.png) Click the private store to see apps in your private store. - ![Private store for Contoso publishing](images/wsfb-privatestoreapps.png) + ![Private store for Contoso publishing.](images/wsfb-privatestoreapps.png) ## Troubleshooting Microsoft Store for Business integration with Microsoft Endpoint Configuration Manager diff --git a/store-for-business/whats-new-microsoft-store-business-education.md b/store-for-business/whats-new-microsoft-store-business-education.md index 66f34fdabe..4b0cd1e47d 100644 --- a/store-for-business/whats-new-microsoft-store-business-education.md +++ b/store-for-business/whats-new-microsoft-store-business-education.md @@ -26,7 +26,7 @@ Microsoft Store for Business and Education regularly releases new and improved f :::row::: :::column span="1"::: - ![Security groups](images/security-groups-icon.png) + ![Security groups.](images/security-groups-icon.png) :::column-end::: :::column span="1"::: **Use security groups with Private store apps**

On the details page for apps in your private store, you can set **Private store availability**. This allows you to choose which security groups can see an app in the private store.

[Get more info](./app-inventory-management-microsoft-store-for-business.md#private-store-availability)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education @@ -38,7 +38,7 @@ Microsoft Store for Business and Education regularly releases new and improved f We’ve been working on bug fixes and performance improvements to provide you a better experience. Stay tuned for new features! | | | |-----------------------|---------------------------------| -| ![Private store performance icon](images/perf-improvement-icon.png) |**Performance improvements in private store**

We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them.

[Get more info](./manage-private-store-settings.md#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | +| ![Private store performance icon.](images/perf-improvement-icon.png) |**Performance improvements in private store**

We've made it significantly faster for you to update the private store. Many changes to the private store are available immediately after you make them.

[Get more info](./manage-private-store-settings.md#private-store-performance)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | | | **Manage Windows device deployment with Windows Autopilot Deployment**

In Microsoft Store for Business, you can manage devices for your organization and apply an Autopilot deployment profile to your devices. When people in your organization run the out-of-box experience on the device, the profile configures Windows, based on the Autopilot deployment profile you applied to the device.

[Get more info](add-profile-to-devices.md)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | | ![Microsoft Store for Business Settings page, Distribute tab showing app requests setting.](images/msfb-wn-1709-app-request.png) |**Request an app**

People in your organization can request additional licenses for apps in your private store, and then Admins or Purchasers can make the purchases.

[Get more info](./acquire-apps-microsoft-store-for-business.md#request-apps)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | || ![Image showing Add a Collection.](images/msfb-add-collection.png) |**Private store collections**

You can groups of apps in your private store with **Collections**. This can help you organize apps and help people find apps for their job or classroom.

[Get more info](https://review.docs.microsoft.com/microsoft-store/manage-private-store-settings?branch=msfb-14856406#add-a-collection)

**Applies to**:
Microsoft Store for Business
Microsoft Store for Education | diff --git a/store-for-business/working-with-line-of-business-apps.md b/store-for-business/working-with-line-of-business-apps.md index 2150c9e7c3..8efc8effad 100644 --- a/store-for-business/working-with-line-of-business-apps.md +++ b/store-for-business/working-with-line-of-business-apps.md @@ -46,7 +46,7 @@ You'll need to set up: - LOB publishers need to have an app in Microsoft Store, or have an app ready to submit to the Store. The process and timing look like this: -![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer](images/lob-workflow.png) +![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer.](images/lob-workflow.png) ## Add an LOB publisher (Admin) Admins need to invite developer or ISVs to become an LOB publisher. diff --git a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md index b0bdee5283..130ad633ee 100644 --- a/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md +++ b/windows/application-management/app-v/appv-application-publishing-and-client-interaction.md @@ -423,7 +423,7 @@ The process then configures the client for package or connection group additions This completes an App-V package add for the publishing refresh process. The next step is publishing the package to a specific target (machine or user). -![Package add file and registry data](images/packageaddfileandregistrydata.png) +![Package add file and registry data.](images/packageaddfileandregistrydata.png) **Package add file and registry data** @@ -454,7 +454,7 @@ During the Publishing Refresh operation, the specific publishing operation, **Pu Publishing an App-V Package that is part of a Connection Group is very similar to the above process. For connection groups, the path that stores the specific catalog information includes PackageGroups as a child of the Catalog Directory. Review the Machine and User Catalog information in the preceding sections for details. -![package add file and registry data - global](images/packageaddfileandregistrydata-global.png) +![package add file and registry data - global.](images/packageaddfileandregistrydata-global.png) **Package add file and registry data—global** @@ -481,7 +481,7 @@ After the Publishing Refresh process, the user launches and then relaunches an A 7. The Application launches. For any missing files in the package store (sparse files), App-V will stream fault the files on an as-needed basis. - ![package add file and registry data - stream](images/packageaddfileandregistrydata-stream.png) + ![package add file and registry data - stream.](images/packageaddfileandregistrydata-stream.png) **Package add file and registry data—stream** diff --git a/windows/application-management/app-v/appv-deployment-checklist.md b/windows/application-management/app-v/appv-deployment-checklist.md index 501a6eae9f..4183212c31 100644 --- a/windows/application-management/app-v/appv-deployment-checklist.md +++ b/windows/application-management/app-v/appv-deployment-checklist.md @@ -20,9 +20,9 @@ This checklist outlines the recommended steps and items to consider when deployi |Status|Task|References|Notes| |---|---|---|---| -|![Checklist box](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Prepare the computing environment for App-V deployment during your planning phase.|[App-V planning checklist](appv-planning-checklist.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Review App-V's supported configurations.|[App-V supported configurations](appv-supported-configurations.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Run App-V Setup to deploy the required App-V features for your environment.|[How to install the sequencer](appv-install-the-sequencer.md)
[Enable the App-V desktop client](appv-enable-the-app-v-desktop-client.md)
[How to deploy the App-V server](appv-deploy-the-appv-server.md)|| >[!NOTE] >Keep track of server names and associated URLs you create during installation. You'll need this information throughout the installation process. diff --git a/windows/application-management/app-v/appv-install-the-sequencer.md b/windows/application-management/app-v/appv-install-the-sequencer.md index e8785b3d7f..9bde5d0531 100644 --- a/windows/application-management/app-v/appv-install-the-sequencer.md +++ b/windows/application-management/app-v/appv-install-the-sequencer.md @@ -28,7 +28,7 @@ The App-V Sequencer is included in the Windows 10 Assessment and Deployment Kit 1. Go to [Download the Windows ADK](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit). 2. Select the **Get Windows ADK for Windows 10** button on the page to start the ADK installer. Make sure that **Microsoft Application Virtualization (App-V) Sequencer** is selected during the installation. - ![Selecting APP-V features in ADK](images/app-v-in-adk.png) + ![Selecting APP-V features in ADK.](images/app-v-in-adk.png) 3. To open the Sequencer, go to the **Start** menu and select **Microsoft Application Virtualization (App-V) Sequencer**. See [Creating and managing virtual applications](appv-creating-and-managing-virtualized-applications.md) and the [Application Virtualization Sequencing Guide](https://download.microsoft.com/download/F/7/8/F784A197-73BE-48FF-83DA-4102C05A6D44/App-V%205.0%20Sequencing%20Guide.docx) for information about creating virtual applications with the Sequencer. diff --git a/windows/application-management/app-v/appv-planning-checklist.md b/windows/application-management/app-v/appv-planning-checklist.md index e838f04c45..50887ca724 100644 --- a/windows/application-management/app-v/appv-planning-checklist.md +++ b/windows/application-management/app-v/appv-planning-checklist.md @@ -23,12 +23,12 @@ This checklist can be used to help you plan for preparing your organization for |Status|Task|References|Notes| |---|---|---|---| -|![Checklist box](../app-v/images/checklistbox.gif)|Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning.|[Getting started with App-V](appv-getting-started.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Plan for App-V deployment prerequisites and prepare your computing environment.|[App-V prerequisites](appv-prerequisites.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|If you plan to use the App-V management server, plan for the required roles.|[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Plan for the App-V sequencer and client to create and run virtualized applications.|[Planning for the App-V Sequencer and client deployment](appv-planning-for-sequencer-and-client-deployment.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|If applicable, review the options and steps for migrating from a previous version of App-V.|[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md)|| -|![Checklist box](../app-v/images/checklistbox.gif)|Decide whether to configure App-V clients in Shared Content Store mode.|[Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Review the getting started information about App-V to gain a basic understanding of the product before beginning deployment planning.|[Getting started with App-V](appv-getting-started.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Plan for App-V deployment prerequisites and prepare your computing environment.|[App-V prerequisites](appv-prerequisites.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|If you plan to use the App-V management server, plan for the required roles.|[Planning for the App-V server deployment](appv-planning-for-appv-server-deployment.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Plan for the App-V sequencer and client to create and run virtualized applications.|[Planning for the App-V Sequencer and client deployment](appv-planning-for-sequencer-and-client-deployment.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|If applicable, review the options and steps for migrating from a previous version of App-V.|[Migrating to App-V from a previous version](appv-migrating-to-appv-from-a-previous-version.md)|| +|![Checklist box.](../app-v/images/checklistbox.gif)|Decide whether to configure App-V clients in Shared Content Store mode.|[Deploying the App-V Sequencer and configuring the client](appv-deploying-the-appv-sequencer-and-client.md)|| diff --git a/windows/application-management/enterprise-background-activity-controls.md b/windows/application-management/enterprise-background-activity-controls.md index d123957cd1..0a72c19e87 100644 --- a/windows/application-management/enterprise-background-activity-controls.md +++ b/windows/application-management/enterprise-background-activity-controls.md @@ -23,15 +23,15 @@ Enterprise users want the same ability to enable or limit background activity. I Users have the ability to control background activity for their device through two interfaces in the **Settings** app: the **Background apps** page and the **Battery usage by app** page. The **Background apps** page has a master switch to turn background activity on or off for all apps, and provides individual switches to control each app's ability to run in the background.  -![Background apps settings page](images/backgroundapps-setting.png) +![Background apps settings page.](images/backgroundapps-setting.png) The **Battery usage by app** page allows fine-grained tuning of background activity. Users have the ability to set background activity to by **Managed By Windows**, as well as turning it on or off for each app. Only devices with a battery have this page available in the **Settings** app. Here is the set of available controls on desktop:  -![Battery usage by app on desktop](images/battery-usage-by-app-desktop.png) +![Battery usage by app on desktop.](images/battery-usage-by-app-desktop.png) Here is the set of available controls for mobile devices:  -![Battery usage by app on mobile](images/battery-usage-by-app-mobile.png) +![Battery usage by app on mobile.](images/battery-usage-by-app-mobile.png) Although the user interface differs across editions of the operating system, the policy and developer interface is consistent across Windows 10. For more information about these controls, see [Optimize background activity](/windows/uwp/debug-test-perf/optimize-background-activity). diff --git a/windows/application-management/per-user-services-in-windows.md b/windows/application-management/per-user-services-in-windows.md index 0cda2dc8c9..4483687ba8 100644 --- a/windows/application-management/per-user-services-in-windows.md +++ b/windows/application-management/per-user-services-in-windows.md @@ -102,19 +102,19 @@ If a per-user service can't be disabled using a the security template, you can d 5. Right-click **Registry** > **New** > **Registry Item**. - ![Group Policy preferences disabling per-user services](media/gpp-per-user-services.png) + ![Group Policy preferences disabling per-user services.](media/gpp-per-user-services.png) 6. Make sure that HKEY_Local_Machine is selected for Hive and then click ... (the ellipses) next to Key Path. - ![Choose HKLM](media/gpp-hklm.png) + ![Choose HKLM.](media/gpp-hklm.png) 7. Browse to **System\CurrentControlSet\Services\PimIndexMaintenanceSvc**. In the list of values, highlight **Start** and click **Select**. - ![Select Start](media/gpp-svc-start.png) + ![Select Start.](media/gpp-svc-start.png) 8. Change **Value data** from **00000003** to **00000004** and click **OK**. Note setting the Value data to **4** = **Disabled**. - ![Startup Type is Disabled](media/gpp-svc-disabled.png) + ![Startup Type is Disabled.](media/gpp-svc-disabled.png) 9. To add the other services that cannot be managed with a Group Policy templates, edit the policy and repeat steps 5-8. @@ -140,14 +140,14 @@ REG.EXE ADD HKLM\System\CurrentControlSet\Services\WpnUserService /v Start /t RE If you cannot use Group Policy preferences to manage the per-user services, you can edit the registry with regedit.exe. To disable the template services, change the Startup Type for each service to 4 (disabled): -![Using Regedit to change servive Starup Type](media/regedit-change-service-startup-type.png) +![Using Regedit to change servive Starup Type.](media/regedit-change-service-startup-type.png) > [!CAUTION] > We recommend that you do not directly edit the registry unless there is no other alternative. Modifications to the registry are not validated by the Registry Editor or by the Windows operating system before they are applied. As a result, incorrect values can be stored, and this can result in unrecoverable errors in the system. When possible, instead of editing the registry directly, use Group Policy or other Windows tools such as the Microsoft Management Console (MMC) to accomplish tasks. If you must edit the registry, use extreme caution. Beginning with Windows 10, version 1709 and Windows Server, version 1709, you can prevent the per-user service from being created by setting **UserServiceFlags** to 0 under the same service configuration in the registry: -![Create per-user services in disabled state](media/user-service-flag.png) +![Create per-user services in disabled state.](media/user-service-flag.png) ### Manage template services by modifying the Windows image @@ -186,4 +186,4 @@ For example, you might see the following per-user services listed in the Service You can query the service configuration from the command line. The **Type** value indicates whether the service is a user-service template or user-service instance. -![Use sc.exe to view service type](media/cmd-type.png) \ No newline at end of file +![Use sc.exe to view service type.](media/cmd-type.png) \ No newline at end of file diff --git a/windows/application-management/svchost-service-refactoring.md b/windows/application-management/svchost-service-refactoring.md index 4130fde7e5..8482a3497c 100644 --- a/windows/application-management/svchost-service-refactoring.md +++ b/windows/application-management/svchost-service-refactoring.md @@ -48,11 +48,11 @@ Refactoring also makes it easier to view running processes in Task Manager. You For example, here are the running processes displayed in Task Manager in Windows 10 version 1607: -![Running processes in Task Manager, version 1607](media/svchost-grouped-processes.png) +![Running processes in Task Manager, version 1607.](media/svchost-grouped-processes.png) Compare that to the same view of running processes in Windows 10 version 1703: -![Running processes in Task Manager, version 1703](media/svchost-separated-processes.png) +![Running processes in Task Manager, version 1703.](media/svchost-separated-processes.png) @@ -66,7 +66,7 @@ HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services. The default value of **1** prevents the service from being split. For example, this is the registry key configuration for BFE: -![Example of a service that cannot be separated](media/svchost-separation-disabled.png) +![Example of a service that cannot be separated.](media/svchost-separation-disabled.png) ## Memory footprint @@ -77,7 +77,7 @@ Consider the following: |Grouped Services (< 3.5GB) | Split Services (3.5GB+) |--------------------------------------- | ------------------------------------------ | -|![Memory utilization for grouped services](media/svchost-grouped-utilization.png) |![Memory utilization for separated services](media/svchost-separated-utilization.png) | +|![Memory utilization for grouped services.](media/svchost-grouped-utilization.png) |![Memory utilization for separated services](media/svchost-separated-utilization.png) | > [!NOTE] > The above represents the peak observed values. diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 260944a53c..6da0fdfdb9 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -23,11 +23,11 @@ ms.topic: article Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. -![Screenshot of Control Panel](images/admin-tools.png) +![Screenshot of Control Panel.](images/admin-tools.png) The tools in the folder might vary depending on which edition of Windows you are using. -![Screenshot of folder of admin tools](images/admin-tools-folder.png) +![Screenshot of folder of admin tools.](images/admin-tools-folder.png) These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. diff --git a/windows/client-management/advanced-troubleshooting-802-authentication.md b/windows/client-management/advanced-troubleshooting-802-authentication.md index ac96c101cf..c2a8ea0c57 100644 --- a/windows/client-management/advanced-troubleshooting-802-authentication.md +++ b/windows/client-management/advanced-troubleshooting-802-authentication.md @@ -41,53 +41,53 @@ Check Windows Security Event log on the NPS Server for NPS events that correspon In the event message, scroll to the very bottom, and then check the [Reason Code](/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd197570(v%3dws.10)) field and the text that's associated with it. - ![example of an audit failure](images/auditfailure.png) + ![example of an audit failure.](images/auditfailure.png) *Example: event ID 6273 (Audit Failure)*

‎ - ![example of an audit success](images/auditsuccess.png) + ![example of an audit success.](images/auditsuccess.png) *Example: event ID 6272 (Audit Success)*
‎The WLAN AutoConfig operational log lists information and error events based on conditions detected by or reported to the WLAN AutoConfig service. The operational log contains information about the wireless network adapter, the properties of the wireless connection profile, the specified network authentication, and, in the event of connectivity problems, the reason for the failure. For wired network access, the Wired AutoConfig operational log is an equivalent one. On the client side, go to **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\WLAN-AutoConfig/Operational** for wireless issues. For wired network access issues, go to **..\Wired-AutoConfig/Operational**. See the following example: -![event viewer screenshot showing wired-autoconfig and WLAN autoconfig](images/eventviewer.png) +![event viewer screenshot showing wired-autoconfig and WLAN autoconfig.](images/eventviewer.png) Most 802.1X authentication issues are because of problems with the certificate that's used for client or server authentication. Examples include invalid certificate, expiration, chain verification failure, and revocation check failure. First, validate the type of EAP method that's used: -![eap authentication type comparison](images/comparisontable.png) +![eap authentication type comparison.](images/comparisontable.png) If a certificate is used for its authentication method, check whether the certificate is valid. For the server (NPS) side, you can confirm what certificate is being used from the EAP property menu. In **NPS snap-in**, go to **Policies** > **Network Policies**. Select and hold (or right-click) the policy, and then select **Properties**. In the pop-up window, go to the **Constraints** tab, and then select the **Authentication Methods** section. -![Constraints tab of the secure wireless connections properties](images/eappropertymenu.png) +![Constraints tab of the secure wireless connections properties.](images/eappropertymenu.png) The CAPI2 event log is useful for troubleshooting certificate-related issues. By default, this log isn't enabled. To enable this log, expand **Event Viewer (Local)\Applications and Services Logs\Microsoft\Windows\CAPI2**, select and hold (or right-click) **Operational**, and then select **Enable Log**. -![screenshot of event viewer](images/capi.png) +![screenshot of event viewer.](images/capi.png) For information about how to analyze CAPI2 event logs, see [Troubleshooting PKI Problems on Windows Vista](/previous-versions/windows/it-pro/windows-vista/cc749296%28v=ws.10%29). When troubleshooting complex 802.1X authentication issues, it's important to understand the 802.1X authentication process. Here's an example of wireless connection process with 802.1X authentication: -![authenticator flow chart](images/authenticator_flow_chart.png) +![authenticator flow chart.](images/authenticator_flow_chart.png) If you [collect a network packet capture](troubleshoot-tcpip-netmon.md) on both the client and the server (NPS) side, you can see a flow like the one below. Type **EAPOL** in the Display Filter for a client-side capture, and **EAP** for an NPS-side capture. See the following examples: -![client-side packet capture data](images/clientsidepacket_cap_data.png) +![client-side packet capture data.](images/clientsidepacket_cap_data.png) *Client-side packet capture data*

-![NPS-side packet capture data](images/NPS_sidepacket_capture_data.png) +![NPS-side packet capture data.](images/NPS_sidepacket_capture_data.png) *NPS-side packet capture data*
‎ > [!NOTE] > If you have a wireless trace, you can also [view ETL files with network monitor](/windows/desktop/ndf/using-network-monitor-to-view-etl-files) and apply the **ONEX_MicrosoftWindowsOneX** and **WLAN_MicrosoftWindowsWLANAutoConfig** Network Monitor filters. If you need to load the required [parser](/archive/blogs/netmon/parser-profiles-in-network-monitor-3-4), see the instructions under the **Help** menu in Network Monitor. Here's an example: -![ETL parse](images/etl.png) +![ETL parse.](images/etl.png) ## Audit policy diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index 646585085e..d039c10c17 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -50,7 +50,7 @@ The kernel passes control to the session manager process (Smss.exe) which initia Here is a summary of the boot sequence, what will be seen on the display, and typical boot problems at that point in the sequence. Before starting troubleshooting, you have to understand the outline of the boot process and display status to ensure that the issue is properly identified at the beginning of the engagement. -![thumbnail of boot sequence flowchart](images/boot-sequence-thumb.png)
+![thumbnail of boot sequence flowchart.](images/boot-sequence-thumb.png)
[Click to enlarge](img-boot-sequence.md)
diff --git a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md index ce4154396e..57d2cc10a8 100644 --- a/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md +++ b/windows/client-management/advanced-troubleshooting-wireless-network-connectivity.md @@ -152,7 +152,7 @@ The important components of the MSM include: - Security Manager (SecMgr) - handles all pre and post-connection security operations. - Authentication Engine (AuthMgr) – Manages 802.1x auth requests - ![MSM details](images/msmdetails.png) + ![MSM details.](images/msmdetails.png) Each of these components has their own individual state machines which follow specific transitions. Enable the **FSM transition, SecMgr Transition,** and **AuthMgr Transition** filters in TextAnalysisTool for more detail. @@ -327,4 +327,4 @@ Copy and paste all the lines below and save them into a text file named "wifi.ta In the following example, the **View** settings are configured to **Show Only Filtered Lines**. -![TAT filter example](images/tat.png) \ No newline at end of file +![TAT filter example.](images/tat.png) \ No newline at end of file diff --git a/windows/client-management/change-default-removal-policy-external-storage-media.md b/windows/client-management/change-default-removal-policy-external-storage-media.md index 69fa51d4e4..d59710d70b 100644 --- a/windows/client-management/change-default-removal-policy-external-storage-media.md +++ b/windows/client-management/change-default-removal-policy-external-storage-media.md @@ -54,4 +54,4 @@ To change the policy for an external storage device: 7. Select the policy that you want to use. - ![Policy options for disk management](./images/change-def-rem-policy-2.png) + ![Policy options for disk management.](./images/change-def-rem-policy-2.png) diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 275869bf99..4d8f35673e 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -24,7 +24,7 @@ ms.topic: article From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). -![Remote Desktop Connection client](images/rdp.png) +![Remote Desktop Connection client.](images/rdp.png) ## Set up @@ -40,7 +40,7 @@ Ensure [Remote Credential Guard](/windows/access-protection/remote-credential-gu 2. Enable **Allow remote connections to this computer** and select **Allow connections only from computers running Remote Desktop with Network Level Authentication**. - ![Allow remote connections to this computer](images/allow-rdp.png) + ![Allow remote connections to this computer.](images/allow-rdp.png) 3. If the user who joined the PC to Azure AD is the only one who is going to connect remotely, no additional configuration is needed. To allow additional users or groups to connect to the PC, you must allow remote connections for the specified users or groups. Users can be added either manually or through MDM policies: diff --git a/windows/client-management/img-boot-sequence.md b/windows/client-management/img-boot-sequence.md index b1077e5be6..6ce343dade 100644 --- a/windows/client-management/img-boot-sequence.md +++ b/windows/client-management/img-boot-sequence.md @@ -14,4 +14,4 @@ ms.prod: w10 Return to: [Advanced troubleshooting for Windows boot problems](advanced-troubleshooting-boot-problems.md)
-![Full-sized boot sequence flowchart](images/boot-sequence.png) +![Full-sized boot sequence flowchart.](images/boot-sequence.png) diff --git a/windows/client-management/introduction-page-file.md b/windows/client-management/introduction-page-file.md index 376916c1d3..9354d9c8c9 100644 --- a/windows/client-management/introduction-page-file.md +++ b/windows/client-management/introduction-page-file.md @@ -56,13 +56,13 @@ Page files extend how much "committed memory" (also known as "virtual memory") i The system commit memory limit is the sum of physical memory and all page files combined. It represents the maximum system-committed memory (also known as the "system commit charge") that the system can support. -![Task manager](images/task-manager.png) +![Task manager.](images/task-manager.png) The system commit charge is the total committed or "promised" memory of all committed virtual memory in the system. If the system commit charge reaches the system commit limit, the system and processes might not get committed memory. This condition can cause freezing, crashing, and other malfunctions. Therefore, make sure that you set the system commit limit high enough to support the system commit charge during peak usage. -![Out of memory](images/out-of-memory.png) +![Out of memory.](images/out-of-memory.png) -![Task Manager](images/task-manager-commit.png) +![Task Manager.](images/task-manager-commit.png) The system committed charge and system committed limit can be measured on the **Performance** tab in Task Manager or by using the "\Memory\Committed Bytes" and "\Memory\Commit Limit" performance counters. The \Memory\% Committed Bytes In Use counter is a ratio of \Memory\Committed Bytes to \Memory\Commit Limit values. diff --git a/windows/client-management/manage-device-installation-with-group-policy.md b/windows/client-management/manage-device-installation-with-group-policy.md index 263dd24430..db00986ab0 100644 --- a/windows/client-management/manage-device-installation-with-group-policy.md +++ b/windows/client-management/manage-device-installation-with-group-policy.md @@ -212,7 +212,7 @@ This policy setting will change the evaluation order in which Allow and Prevent Some of these policies take precedence over other policies. The flowchart shown below illustrates how Windows processes them to determine whether a user can install a device or not, as shown in Figure below. -![Device Installation policies flow chart](images/device-installation-flowchart.png)
_Device Installation policies flow chart_ +![Device Installation policies flow chart.](images/device-installation-flowchart.png)
_Device Installation policies flow chart_ @@ -261,17 +261,17 @@ To find device identification strings using Device Manager 4. Find the “Printers” section and find the target printer - ![Selecting the printer in Device Manager](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ + ![Selecting the printer in Device Manager.](images/device-installation-dm-printer-by-device.png)
_Selecting the printer in Device Manager_ 5. Double-click the printer and move to the ‘Details’ tab. - ![‘Details’ tab](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ + ![‘Details’ tab.](images/device-installation-dm-printer-details-screen.png)
_Open the ‘Details’ tab to look for the device identifiers_ 6. From the ‘Value’ window, copy the most detailed Hardware ID – we will use this in the policies. - ![HWID](images/device-installation-dm-printer-hardware-ids.png) + ![HWID.](images/device-installation-dm-printer-hardware-ids.png) - ![Compatible ID](images/device-installation-dm-printer-compatible-ids.png)
_HWID and Compatible ID_ + ![Compatible ID.](images/device-installation-dm-printer-compatible-ids.png)
_HWID and Compatible ID_ > [!TIP] > You can also determine your device identification strings by using the PnPUtil command-line utility. For more information, see [PnPUtil - Windows drivers](/windows-hardware/drivers/devtest/pnputil) in Microsoft Docs. @@ -360,7 +360,7 @@ Creating the policy to prevent all printers from being installed: 6. Enter the printer class GUID you found above with the curly braces (this is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} - ![List of prevent Class GUIDs](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ + ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ 7. Click ‘OK’. @@ -399,7 +399,7 @@ Getting the right device identifier to prevent it from being installed: 1. Get your printer’s Hardware ID – in this example we will use the identifier we found previously - ![Printer Hardware ID identifier](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ + ![Printer Hardware ID identifier.](images/device-installation-dm-printer-hardware-ids.png)
_Printer Hardware ID_ 2. Write down the device ID (in this case Hardware ID) – WSDPRINT\CanonMX920_seriesC1A0; Take the more specific identifier to make sure you block a specific printer and not a family of printers @@ -417,7 +417,7 @@ Creating the policy to prevent a single printer from being installed: 5. Enter the printer device ID you found above – WSDPRINT\CanonMX920_seriesC1A0 - ![Prevent Device ID list](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ + ![Prevent Device ID list.](images/device-installation-gpo-prevent-device-id-list-printer.png)
_Prevent Device ID list_ 6. Click ‘OK’. @@ -477,7 +477,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 6. Enter the printer class GUID you found above with the curly braces (this is important! Otherwise, it won’t work): {4d36e979-e325-11ce-bfc1-08002be10318} - ![List of prevent Class GUIDs](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ + ![List of prevent Class GUIDs.](images/device-installation-gpo-prevent-class-list.png)
_List of prevent Class GUIDs_ 7. Click ‘OK’. @@ -489,7 +489,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one ![Image of Local Group Policy Editor that shows the policies under "Device Installation Restrictions" and the policy named in this step.](images/device-installation-apply-layered_policy-1.png) - ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria."](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ + ![Image that shows the current settings of the policy named in this step, "Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria.".](images/device-installation-apply-layered-policy-2.png)
_Apply layered order of evaluation policy_ 9. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. @@ -497,7 +497,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 11. Enter the printer device ID you found above: WSDPRINT\CanonMX920_seriesC1A0. - ![Allow Printer Hardware ID](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ + ![Allow Printer Hardware ID.](images/device-installation-gpo-allow-device-id-list-printer.png)
_Allow Printer Hardware ID_ 12. Click ‘OK’. @@ -532,22 +532,22 @@ Getting the right device identifier to prevent it from being installed and its l 3. Find the USB thumb-drive and select it. - ![Selecting the usb thumb-drive in Device Manager](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ + ![Selecting the usb thumb-drive in Device Manager.](images/device-installation-dm-usb-by-device.png)
_Selecting the usb thumb-drive in Device Manager_ 4. Change View (in the top menu) to ‘Devices by connections’. This view represents the way devices are installed in the PnP tree. - ![Changing view in Device Manager to see the PnP connection tree](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ + ![Changing view in Device Manager to see the PnP connection tree.](images/device-installation-dm-usb-by-connection.png)
_Changing view in Device Manager to see the PnP connection tree_ > [!NOTE] > When blocking\Preventing a device that sits higher in the PnP tree, all the devices that sit under it will be blocked. For example: Preventing a “Generic USB Hub” from being installed, all the devices that lay below a “Generic USB Hub” will be blocked. - ![Blocking nested devices from the root](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ + ![Blocking nested devices from the root.](images/device-installation-dm-usb-by-connection-blocked.png)
_When blocking one device, all the devices that are nested below it will be blocked as well_ 5. Double-click the USB thumb-drive and move to the ‘Details’ tab. 6. From the ‘Value’ window, copy the most detailed Hardware ID—we will use this in the policies. In this case Device ID = USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![USB device hardware IDs](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ + ![USB device hardware IDs.](images/device-installation-dm-usb-hwid.png)
_USB device hardware IDs_ Creating the policy to prevent a single USB thumb-drive from being installed: @@ -563,7 +563,7 @@ Creating the policy to prevent a single USB thumb-drive from being installed: 5. Enter the USB thumb-drive device ID you found above – USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![Prevent Device IDs list](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ + ![Prevent Device IDs list.](images/device-installation-gpo-prevent-device-id-list-usb.png)
_Prevent Device IDs list_ 6. Click ‘OK’. @@ -620,7 +620,7 @@ As mentioned in scenario #4, it is not enough to enable only a single hardware I - “USB Root Hub (USB 3.0)” -> USB\ROOT_HUB30 - “Generic USB Hub” -> USB\USB20_HUB -![USB devices nested in the PnP tree](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ +![USB devices nested in the PnP tree.](images/device-installation-dm-usb-by-connection-layering.png)
_USB devices nested under each other in the PnP tree_ These devices are internal devices on the machine that define the USB port connection to the outside world. Enabling them should not enable any external/peripheral device from being installed on the machine. @@ -663,7 +663,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 9. Open the **Apply layered order of evaluation for Allow and Prevent device installation policies across all device match criteria** policy and enable it – this policy will enable you to override the wide coverage of the ‘Prevent’ policy with a specific device. - ![Apply layered order of evaluation policy](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ + ![Apply layered order of evaluation policy.](images/device-installation-apply-layered_policy-1.png)
_Apply layered order of evaluation policy_ 10. Now Open **Allow installation of devices that match any of these device IDs** policy and select the ‘Enable’ radio button. @@ -671,7 +671,7 @@ First create a ‘Prevent Class’ policy and then create ‘Allow Device’ one 12. Enter the full list of USB device IDs you found above including the specific USB Thumb-drive you would like to authorize for installation – USBSTOR\DiskGeneric_Flash_Disk______8.07 - ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs."](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ + ![Image of an example list of devices that have been configured for the policy "Allow installation of devices that match any of these Device IDs.".](images/device-installation-gpo-allow-device-id-list-usb.png)
_Allowed USB Device IDs list_ 13. Click ‘OK’. diff --git a/windows/client-management/manage-settings-app-with-group-policy.md b/windows/client-management/manage-settings-app-with-group-policy.md index a177277d07..f64ee0de0c 100644 --- a/windows/client-management/manage-settings-app-with-group-policy.md +++ b/windows/client-management/manage-settings-app-with-group-policy.md @@ -35,7 +35,7 @@ Policy paths: **User Configuration** > **Administrative Templates** > **Control Panel** > **Settings Page Visibility**. -![Settings page visibility policy](images/settings-page-visibility-gp.png) +![Settings page visibility policy.](images/settings-page-visibility-gp.png) ## Configuring the Group Policy diff --git a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md index 22ba2d74a8..0e9dd8a789 100644 --- a/windows/client-management/manage-windows-10-in-your-organization-modern-management.md +++ b/windows/client-management/manage-windows-10-in-your-organization-modern-management.md @@ -92,7 +92,7 @@ For more information about how Windows 10 and Azure AD optimize access to work r As you review the roles in your organization, you can use the following generalized decision tree to begin to identify users or devices that require domain join. Consider switching the remaining users to Azure AD. -![Decision tree for device authentication options](images/windows-10-management-cyod-byod-flow.png) +![Decision tree for device authentication options.](images/windows-10-management-cyod-byod-flow.png) ## Settings and Configuration diff --git a/windows/client-management/mandatory-user-profile.md b/windows/client-management/mandatory-user-profile.md index b5b30659d6..7b77f47742 100644 --- a/windows/client-management/mandatory-user-profile.md +++ b/windows/client-management/mandatory-user-profile.md @@ -75,7 +75,7 @@ First, you create a default user profile with the customizations that you want, > [!TIP] > If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\\System32\\Sysprep\\Panther\\setupact.log and look for an entry like the following: > - > ![Microsoft Bing Translator package error](images/sysprep-error.png) + > ![Microsoft Bing Translator package error.](images/sysprep-error.png) > > Use the [Remove-AppxProvisionedPackage](/powershell/module/dism/remove-appxprovisionedpackage?view=win10-ps&preserve-view=true) and [Remove-AppxPackage -AllUsers](/powershell/module/appx/remove-appxpackage?view=win10-ps&preserve-view=true) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. @@ -86,11 +86,11 @@ First, you create a default user profile with the customizations that you want, 1. In **User Profiles**, click **Default Profile**, and then click **Copy To**. - ![Example of User Profiles UI](images/copy-to.png) + ![Example of User Profiles UI.](images/copy-to.png) 1. In **Copy To**, under **Permitted to use**, click **Change**. - ![Example of Copy To UI](images/copy-to-change.png) + ![Example of Copy To UI.](images/copy-to-change.png) 1. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. @@ -98,11 +98,11 @@ First, you create a default user profile with the customizations that you want, - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. - ![Example of Copy profile to](images/copy-to-path.png) + ![Example of Copy profile to.](images/copy-to-path.png) - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. - ![Example of Copy To UI with UNC path](images/copy-to-path.png) + ![Example of Copy To UI with UNC path.](images/copy-to-path.png) 1. Click **OK** to copy the default user profile. @@ -139,9 +139,9 @@ When a user is configured with a mandatory profile, Windows 10 starts as though | Group Policy setting | Windows 10 | Windows Server 2016 | Windows 8.1 | Windows Server 2012 | | --- | --- | --- | --- | --- | -| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | -| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | ![supported](images/checkmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled | ![supported.](images/checkmark.png) | ![supported](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | +| Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled | ![supported.](images/checkmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | ![not supported](images/crossmark.png) | > [!NOTE] > The Group Policy settings above can be applied in Windows 10 Professional edition. diff --git a/windows/client-management/mdm/accountmanagement-csp.md b/windows/client-management/mdm/accountmanagement-csp.md index 930343209f..42722f7bd7 100644 --- a/windows/client-management/mdm/accountmanagement-csp.md +++ b/windows/client-management/mdm/accountmanagement-csp.md @@ -22,7 +22,7 @@ AccountManagement CSP is used to configure setting in the Account Manager servic The following diagram shows the AccountManagement configuration service provider in tree format. -![accountmanagement csp](images/provisioning-csp-accountmanagement.png) +![accountmanagement csp.](images/provisioning-csp-accountmanagement.png) **./Vendor/MSFT/AccountManagement** Root node for the AccountManagement configuration service provider. diff --git a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md index 34f60116f4..64394a6989 100644 --- a/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md +++ b/windows/client-management/mdm/add-an-azure-ad-tenant-and-azure-ad-subscription.md @@ -21,45 +21,45 @@ Here's a step-by-step guide to adding an Azure Active Directory tenant, adding a 1. Sign up for Azure AD tenant from [this website](https://account.windowsazure.com/organization) by creating an administrator account for your organization. - ![sign up for azure ad tenant](images/azure-ad-add-tenant1.png) + ![sign up for azure ad tenant.](images/azure-ad-add-tenant1.png) 2. Enter the information for your organization. Select **check availability** to verify that domain name that you selected is available. - ![sign up for azure ad](images/azure-ad-add-tenant2.png) + ![sign up for azure ad.](images/azure-ad-add-tenant2.png) 3. Complete the login and country information. Enter a valid phone number, then select **Send text message** or **Call me**. - ![create azure account](images/azure-ad-add-tenant3.png) + ![create azure account.](images/azure-ad-add-tenant3.png) 4. Enter the code that you receive and then select **Verify code**. After the code is verified and the continue button turns green, select **continue**. - ![add aad tenant](images/azure-ad-add-tenant3-b.png) + ![add aad tenant.](images/azure-ad-add-tenant3-b.png) 5. After you finish creating your Azure account, you can add an Azure AD subscription. If you don't have a paid subscription to any Microsoft service, you can purchase an Azure AD premium subscription. Go to the Office 356 portal at https://portal.office.com/, and then sign in using the admin account that you created in Step 4 (for example, user1@contosoltd.onmicrosoftcom). - ![login to office 365](images/azure-ad-add-tenant4.png) + ![login to office 365.](images/azure-ad-add-tenant4.png) 6. Select **Install software**. - ![login to office 365](images/azure-ad-add-tenant5.png) + ![login to office 365.](images/azure-ad-add-tenant5.png) 7. In the Microsoft 365 admin center, select **Purchase Services** from the left navigation. - ![purchase service option in admin center menu](images/azure-ad-add-tenant6.png) + ![purchase service option in admin center menu.](images/azure-ad-add-tenant6.png) 8. On the **Purchase services** page, scroll down until you see **Azure Active Directory Premium**, then select to purchase. - ![azure active directory option in purchase services page](images/azure-ad-add-tenant7.png) + ![azure active directory option in purchase services page.](images/azure-ad-add-tenant7.png) 9. Continue with your purchase. - ![azure active directory premium payment page](images/azure-ad-add-tenant8.png) + ![azure active directory premium payment page.](images/azure-ad-add-tenant8.png) 10. After the purchase is completed, you can log in to your Office 365 Admin Portal and you will see the **Azure AD** option from the Admin drop-down menu along with other services (SharePoint, Exchange, etc....). - ![admin center left navigation menu](images/azure-ad-add-tenant9.png) + ![admin center left navigation menu.](images/azure-ad-add-tenant9.png) When you choose Azure AD, it will take you to the Azure AD portal where you can manage your Azure AD applications. @@ -69,27 +69,27 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread](images/azure-ad-add-tenant10.png) + ![register azuread.](images/azure-ad-add-tenant10.png) 2. On the **Home** page, select on the Admin tools icon. - ![register azuread](images/azure-ad-add-tenant11.png) + ![register azuread.](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, hover your mouse over the Admin tools icon on the left and then click **Azure AD**. This will take you to the Azure Active Directory sign-up page and brings up your existing Office 365 organization account information. - ![register azuread](images/azure-ad-add-tenant12.png) + ![register azuread.](images/azure-ad-add-tenant12.png) 4. On the **Sign up** page, make sure to enter a valid phone number and then click **Sign up**. - ![register azuread](images/azure-ad-add-tenant13.png) + ![register azuread.](images/azure-ad-add-tenant13.png) 5. It may take a few minutes to process the request. - ![register azuread](images/azure-ad-add-tenant14.png) + ![register azuread.](images/azure-ad-add-tenant14.png) 6. You will see a welcome page when the process completes. - ![register azuread](images/azure-ad-add-tenant15.png) + ![register azuread.](images/azure-ad-add-tenant15.png) diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 3df830bda7..5669fcf0f8 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -263,16 +263,16 @@ Supported operations are Get, Add, Delete, and Replace. The **Device Portal** page opens on your browser. - ![device portal screenshot](images/applocker-screenshot1.png) + ![device portal screenshot.](images/applocker-screenshot1.png) 8. On the desktop **Device Portal** page, click **Apps** to open the **App Manager**. 9. On the **App Manager** page under **Running apps**, you will see the **Publisher** and **PackageFullName** of apps. - ![device portal app manager](images/applocker-screenshot3.png) + ![device portal app manager.](images/applocker-screenshot3.png) 10. If you do not see the app that you want, look under **Installed apps**. Using the drop- down menu, click on the application and you get the Version, Publisher, and PackageFullName displayed. - ![app manager](images/applocker-screenshot2.png) + ![app manager.](images/applocker-screenshot2.png) The following table shows the mapping of information to the AppLocker publisher rule field. diff --git a/windows/client-management/mdm/appv-deploy-and-config.md b/windows/client-management/mdm/appv-deploy-and-config.md index 157bf6f4d0..4c8f6eaecd 100644 --- a/windows/client-management/mdm/appv-deploy-and-config.md +++ b/windows/client-management/mdm/appv-deploy-and-config.md @@ -23,7 +23,7 @@ manager: dansimp [EnterpriseAppVManagement CSP reference](./enterpriseappvmanagement-csp.md) -![enterpriseappvmanagement csp](images/provisioning-csp-enterpriseappvmanagement.png) +![enterpriseappvmanagement csp.](images/provisioning-csp-enterpriseappvmanagement.png)

(./User/Vendor/MSFT/EnterpriseAppVManagement) contains the following sub-nodes.

diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 82a11f3eb6..97f22aae88 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -90,7 +90,7 @@ After the users accepts the Terms of Use, the device is registered in Azure AD a The following diagram illustrates the high-level flow involved in the actual enrollment process. The device is first registered with Azure AD. This process assigns a unique device identifier to the device and presents the device with the ability to authenticate itself with Azure AD (device authentication). Subsequently, the device is enrolled for management with the MDM. This is done by calling the enrollment endpoint and requesting enrollment for the user and device. At this point, the user has been authenticated and device has been registered and authenticated with Azure AD. This information is made available to the MDM in the form of claims within an access token presented at the enrollment endpoint. -![azure ad enrollment flow](images/azure-ad-enrollment-flow.png) +![azure ad enrollment flow.](images/azure-ad-enrollment-flow.png) The MDM is expected to use this information about the device (Device ID) when reporting device compliance back to Azure AD using the [Azure AD Graph API](/azure/active-directory/develop/active-directory-graph-api). A sample for reporting device compliance is provided later in this topic. @@ -173,7 +173,7 @@ IT administrators use the Azure AD app gallery to add an MDM for their organizat The following image illustrates how MDM applications will show up in the Azure app gallery in a category dedicated to MDM software. -![azure ad add an app for mdm](images/azure-ad-app-gallery.png) +![azure ad add an app for mdm.](images/azure-ad-app-gallery.png) ### Add cloud-based MDM to the app gallery @@ -732,7 +732,7 @@ Response: When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenrollment](images/azure-ad-unenrollment.png) +![aadj unenrollment.](images/azure-ad-unenrollment.png) ## Error codes diff --git a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md index 21499425a9..ce25592491 100644 --- a/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md +++ b/windows/client-management/mdm/azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md @@ -20,10 +20,10 @@ manager: dansimp 2. Select **Mobility (MDM and MAM)**, and find the Microsoft Intune app. 3. Select **Microsoft Intune** and configure the blade. -![How to get to the Blade](images/azure-mdm-intune.png) +![How to get to the Blade.](images/azure-mdm-intune.png) Configure the blade -![Configure the Blade](images/azure-intune-configure-scope.png) +![Configure the Blade.](images/azure-intune-configure-scope.png) You can specify settings to allow all users to enroll a device and make it Intune ready, or choose to allow some users (and then add a group of users). diff --git a/windows/client-management/mdm/bootstrap-csp.md b/windows/client-management/mdm/bootstrap-csp.md index 0bb9326924..e07354fa81 100644 --- a/windows/client-management/mdm/bootstrap-csp.md +++ b/windows/client-management/mdm/bootstrap-csp.md @@ -27,7 +27,7 @@ The BOOTSTRAP configuration service provider sets the Trusted Provisioning Serve The following image shows the BOOTSTRAP configuration service provider in tree format as used by Open Mobile Alliance (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. -![bootstrap csp (cp)](images/provisioning-csp-bootstrap-cp.png) +![bootstrap csp (cp).](images/provisioning-csp-bootstrap-cp.png) **CONTEXT-ALLOW** Optional. Specifies a context for the TPS. Only one context is supported, so this parameter is ignored and "0" is assumed for its value. diff --git a/windows/client-management/mdm/browserfavorite-csp.md b/windows/client-management/mdm/browserfavorite-csp.md index 46ee3a5e98..15a939f7eb 100644 --- a/windows/client-management/mdm/browserfavorite-csp.md +++ b/windows/client-management/mdm/browserfavorite-csp.md @@ -30,7 +30,7 @@ This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID The following diagram shows the BrowserFavorite configuration service provider in tree format as used by Open Mobile Alliance Device (OMA) Client Provisioning. The OMA Device Management protocol is not supported with this configuration service provider. -![browserfavorite csp (cp)](images/provisioning-csp-browserfavorite-cp.png) +![browserfavorite csp (cp).](images/provisioning-csp-browserfavorite-cp.png) ***favorite name*** Required. Specifies the user-friendly name of the favorite URL that is displayed in the Favorites list of Internet Explorer. diff --git a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md index 4fabdbc971..d1db6d514e 100644 --- a/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md +++ b/windows/client-management/mdm/bulk-enrollment-using-windows-provisioning-tool.md @@ -57,7 +57,7 @@ Using the WCD, create a provisioning package using the enrollment information re 1. Open the WCD tool. 2. Click **Advanced Provisioning**. - ![icd start page](images/bulk-enrollment7.png) + ![icd start page.](images/bulk-enrollment7.png) 3. Enter a project name and click **Next**. 4. Select **All Windows editions**, since Provisioning CSP is common to all Windows editions, then click **Next**. 5. Skip **Import a provisioning package (optional)** and click **Finish**. @@ -74,20 +74,20 @@ Using the WCD, create a provisioning package using the enrollment information re For detailed descriptions of these settings, see [Provisioning CSP](provisioning-csp.md). Here is the screenshot of the WCD at this point. - ![bulk enrollment screenshot](images/bulk-enrollment.png) + ![bulk enrollment screenshot.](images/bulk-enrollment.png) 9. Configure the other settings, such as the Wi-Fi connections so that the device can join a network before joining MDM (e.g., **Runtime settings** > **ConnectivityProfiles** > **WLANSetting**). 10. When you are done adding all the settings, on the **File** menu, click **Save**. 11. On the main menu click **Export** > **Provisioning package**. - ![icd menu for export](images/bulk-enrollment2.png) + ![icd menu for export.](images/bulk-enrollment2.png) 12. Enter the values for your package and specify the package output location. - ![enter package information](images/bulk-enrollment3.png) - ![enter additional information for package information](images/bulk-enrollment4.png) - ![specify file location](images/bulk-enrollment6.png) + ![enter package information.](images/bulk-enrollment3.png) + ![enter additional information for package information.](images/bulk-enrollment4.png) + ![specify file location.](images/bulk-enrollment6.png) 13. Click **Build**. - ![icb build window](images/bulk-enrollment5.png) + ![icb build window.](images/bulk-enrollment5.png) 14. Apply the package to some test devices and verify that they work. For more information, see [Apply a provisioning package](#apply-a-provisioning-package). 15. Apply the package to your devices. @@ -108,7 +108,7 @@ Using the WCD, create a provisioning package using the enrollment information re 5. Set **ExportCertificate** to False. 6. For **KeyLocation**, select **Software only**. - ![icd certificates section](images/bulk-enrollment8.png) + ![icd certificates section.](images/bulk-enrollment8.png) 7. Specify the workplace settings. 1. Got to **Workplace** > **Enrollments**. 2. Enter the **UPN** for the enrollment and then click **Add**. diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index 64372f26a8..ab4cb97c8f 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -21,7 +21,7 @@ The CellularSettings configuration service provider is used to configure cellula The following image shows the CellularSettings CSP in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. -![provisioning for cellular settings](images/provisioning-csp-cellularsettings.png) +![provisioning for cellular settings.](images/provisioning-csp-cellularsettings.png) **DataRoam**

Optional. Integer. Specifies the default roaming value. Valid values are:

diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 5063181c3f..1d42413872 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -20,7 +20,7 @@ This configuration service provider requires the ID\_CAP\_NETWORKING\_ADMIN capa The following diagram shows the CM\_CellularEntries configuration service provider management object in tree format as used by Open Mobile Alliance Client Provisioning (OMA CP). The OMA DM protocol is not supported with this configuration service provider. -![cm\-cellularentries csp](images/provisioning-csp-cm-cellularentries.png) +![cm\-cellularentries csp.](images/provisioning-csp-cm-cellularentries.png) ***entryname***

Defines the name of the connection.

diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index cce8060fe3..d4793c91e6 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2555,36 +2555,36 @@ The following list shows the CSPs supported in HoloLens devices: | Configuration service provider | HoloLens (1st gen) Development Edition | HoloLens (1st gen) Commercial Suite | HoloLens 2 | |------|--------|--------|--------| -| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) -| [Accounts CSP](accounts-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [AppLocker CSP](applocker-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | -| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [CertificateStore CSP](certificatestore-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | -| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DevDetail CSP](devdetail-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | -| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DevInfo CSP](devinfo-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMAcc CSP](dmacc-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [DMClient CSP](dmclient-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | -| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | -| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| -| [NodeCache CSP](nodecache-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -[PassportForWork CSP](passportforwork-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [RemoteFind CSP](remotefind-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | -| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | -| [Update CSP](update-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [WiFi CSP](wifi-csp.md) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | -| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AccountManagement CSP](accountmanagement-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) +| [Accounts CSP](accounts-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [ApplicationControl CSP](applicationcontrol-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [AppLocker CSP](applocker-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | +| [AssignedAccess CSP](assignedaccess-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [CertificateStore CSP](certificatestore-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png)| ![check mark](images/checkmark.png) | +| [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevDetail CSP](devdetail-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DeveloperSetup CSP](developersetup-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 2 (runtime provisioning via provisioning packages only; no MDM support)| ![check mark](images/checkmark.png) | +| [DeviceManageability CSP](devicemanageability-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [DeviceStatus CSP](devicestatus-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DevInfo CSP](devinfo-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DiagnosticLog CSP](diagnosticlog-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMAcc CSP](dmacc-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [DMClient CSP](dmclient-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [EnrollmentStatusTracking CSP](enrollmentstatustracking-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | +| [EnterpriseModernAppManagement CSP](enterprisemodernappmanagement-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [NetworkProxy CSP](networkproxy-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) | +| [NetworkQoSPolicy CSP](networkqospolicy-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 8| +| [NodeCache CSP](nodecache-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +[PassportForWork CSP](passportforwork-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [Policy CSP](policy-configuration-service-provider.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [RemoteFind CSP](remotefind-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RemoteWipe CSP](remotewipe-csp.md) (**doWipe** and **doWipePersistProvisionedData** nodes only) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) 4 | ![check mark](images/checkmark.png) | +| [RootCATrustedCertificates CSP](rootcacertificates-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [TenantLockdown CSP](tenantlockdown-csp.md) | ![cross mark.](images/crossmark.png) | ![cross mark](images/crossmark.png) | ![check mark](images/checkmark.png) 10 | +| [Update CSP](update-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [VPNv2 CSP](vpnv2-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WiFi CSP](wifi-csp.md) | ![cross mark.](images/crossmark.png) | ![check mark](images/checkmark.png) | ![check mark](images/checkmark.png) | +| [WindowsLicensing CSP](windowslicensing-csp.md) | ![check mark.](images/checkmark.png) | ![check mark](images/checkmark.png) | ![cross mark](images/crossmark.png) | ## CSPs supported in Microsoft Surface Hub diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index 8e886f3661..cc589f1f13 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -42,7 +42,7 @@ For more information about the CSPs, see [Update CSP](update-csp.md) and the upd The following diagram provides a conceptual overview of how this works: -![mobile device update management](images/mdm-update-sync.png) +![mobile device update management.](images/mdm-update-sync.png) The diagram can be roughly divided into three areas: @@ -56,7 +56,7 @@ The Microsoft Update Catalog is huge and contains many updates that are not need This section describes how this is done. The following diagram shows the server-server sync protocol process. -![mdm server-server sync](images/deviceupdateprocess2.png) +![mdm server-server sync.](images/deviceupdateprocess2.png) MSDN provides much information about the Server-Server sync protocol. In particular: @@ -140,7 +140,7 @@ The enterprise IT can configure auto-update polices via OMA DM using the [Policy The following diagram shows the Update policies in a tree format. -![update policies](images/update-policies.png) +![update policies.](images/update-policies.png) **Update/ActiveHoursEnd** > [!NOTE] @@ -676,7 +676,7 @@ Example The enterprise IT can configure the set of approved updates and get compliance status via OMA DM using the [Update CSP](update-csp.md). The following diagram shows the Update CSP in tree format.. -![provisioning csp update](images/provisioning-csp-update.png) +![provisioning csp update.](images/provisioning-csp-update.png) **Update** The root node. @@ -889,9 +889,9 @@ Here is the list of older policies that are still supported for backward compati The following screenshots of the administrator console show the list of update titles, approval status, and additional metadata fields. -![mdm update management screenshot](images/deviceupdatescreenshot1.png) +![mdm update management screenshot.](images/deviceupdatescreenshot1.png) -![mdm update management metadata screenshot](images/deviceupdatescreenshot2.png) +![mdm update management metadata screenshot.](images/deviceupdatescreenshot2.png) ## SyncML example @@ -945,5 +945,5 @@ Set auto update to notify and defer. The following diagram and screenshots show the process flow of the device update process using Windows Server Update Services and Microsoft Update Catalog. -![mdm device update management screenshot3](images/deviceupdatescreenshot3.png)![mdm device update management screenshot4](images/deviceupdatescreenshot4.png)![mdm device update management screenshot5](images/deviceupdatescreenshot5.png)![mdm device update management screenshot6](images/deviceupdatescreenshot6.png)![mdm device update management screenshot7](images/deviceupdatescreenshot7.png)![mdm device update management screenshot8](images/deviceupdatescreenshot8.png)![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) +![mdm device update management screenshot3.](images/deviceupdatescreenshot3.png)![mdm device update management screenshot4](images/deviceupdatescreenshot4.png)![mdm device update management screenshot5](images/deviceupdatescreenshot5.png)![mdm device update management screenshot6](images/deviceupdatescreenshot6.png)![mdm device update management screenshot7](images/deviceupdatescreenshot7.png)![mdm device update management screenshot8](images/deviceupdatescreenshot8.png)![mdm device update management screenshot9](images/deviceupdatescreenshot9.png) diff --git a/windows/client-management/mdm/deviceinstanceservice-csp.md b/windows/client-management/mdm/deviceinstanceservice-csp.md index f24564545c..0db22bf159 100644 --- a/windows/client-management/mdm/deviceinstanceservice-csp.md +++ b/windows/client-management/mdm/deviceinstanceservice-csp.md @@ -26,7 +26,7 @@ The DeviceInstance CSP is only supported in Windows 10 Mobile. The following diagram shows the DeviceInstanceService configuration service provider in tree format. -![provisioning\-csp\-deviceinstanceservice](images/provisioning-csp-deviceinstanceservice.png) +![provisioning\-csp\-deviceinstanceservice.](images/provisioning-csp-deviceinstanceservice.png) **Roaming** A boolean value that specifies the roaming status of the device. In dual SIM mode when the device supports two different phone numbers, querying SIM 1 explicitly with ./Vendor/MSFT/DeviceInstanceService/Identify1/Roaming is functionally equivalent to using ./Vendor/MSFT/DeviceInstanceService/Roaming. diff --git a/windows/client-management/mdm/devicelock-csp.md b/windows/client-management/mdm/devicelock-csp.md index cef65071ec..9933e58a23 100644 --- a/windows/client-management/mdm/devicelock-csp.md +++ b/windows/client-management/mdm/devicelock-csp.md @@ -32,7 +32,7 @@ The DevicePasswordEnabled setting must be set to 0 (device password is enabled) The following image shows the DeviceLock configuration service provider in tree format. -![devicelock csp](images/provisioning-csp-devicelock.png) +![devicelock csp.](images/provisioning-csp-devicelock.png) **Provider** Required. An interior node to group all policy providers. Scope is permanent. Supported operation is Get. diff --git a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md index 6043b61d8c..92ed52968c 100644 --- a/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md +++ b/windows/client-management/mdm/diagnose-mdm-failures-in-windows-10.md @@ -20,13 +20,13 @@ To help diagnose enrollment or device management issues in Windows 10 devices m 1. On your managed device go to **Settings** > **Accounts** > **Access work or school**. 1. Click your work or school account, then click **Info.** - ![Access work or school page in Settings](images/diagnose-mdm-failures15.png) + ![Access work or school page in Settings.](images/diagnose-mdm-failures15.png) 1. At the bottom of the **Settings** page, click **Create report**. - ![Access work or school page and then Create report](images/diagnose-mdm-failures16.png) + ![Access work or school page and then Create report.](images/diagnose-mdm-failures16.png) 1. A window opens that shows the path to the log files. Click **Export**. - ![Access work or school log files](images/diagnose-mdm-failures17.png) + ![Access work or school log files.](images/diagnose-mdm-failures17.png) 1. In File Explorer, navigate to c:\Users\Public\Documents\MDMDiagnostics to see the report. @@ -59,7 +59,7 @@ Starting with the Windows 10, version 1511, MDM logs are captured in the Event Here's a screenshot: -![mdm event viewer](images/diagnose-mdm-failures1.png) +![mdm event viewer.](images/diagnose-mdm-failures1.png) In this location, the **Admin** channel logs events by default. However, if you need more details logs you can enable **Debug** logs by choosing **Show Analytic and Debug** logs option in **View** menu in Event Viewer. @@ -238,26 +238,26 @@ For best results, ensure that the PC or VM on which you are viewing logs matches 1. Open eventvwr.msc. 2. Right-click on **Event Viewer(Local)** and select **Open Saved Log**. - ![event viewer screenshot](images/diagnose-mdm-failures9.png) + ![event viewer screenshot.](images/diagnose-mdm-failures9.png) 3. Navigate to the etl file that you got from the device and then open the file. 4. Click **Yes** when prompted to save it to the new log format. - ![event viewer prompt](images/diagnose-mdm-failures10.png) + ![event viewer prompt.](images/diagnose-mdm-failures10.png) - ![diagnose mdm failures](images/diagnose-mdm-failures11.png) + ![diagnose mdm failures.](images/diagnose-mdm-failures11.png) 5. The new view contains traces from the channel. Click on **Filter Current Log** from the **Actions** menu. - ![event viewer actions](images/diagnose-mdm-failures12.png) + ![event viewer actions.](images/diagnose-mdm-failures12.png) 6. Add a filter to Event sources by selecting **DeviceManagement-EnterpriseDiagnostics-Provider** and click **OK**. - ![event filter for Device Management](images/diagnose-mdm-failures13.png) + ![event filter for Device Management.](images/diagnose-mdm-failures13.png) 7. Now you are ready to start reviewing the logs. - ![event viewer review logs](images/diagnose-mdm-failures14.png) + ![event viewer review logs.](images/diagnose-mdm-failures14.png) ## Collect device state data diff --git a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md index 35fe6568b0..5f48d033a0 100644 --- a/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md +++ b/windows/client-management/mdm/disconnecting-from-mdm-unenrollment.md @@ -137,7 +137,7 @@ You can only use the Work Access page to unenroll under the following conditions When a user is enrolled into MDM through Azure Active Directory Join and then disconnects the enrollment, there is no warning that the user will lose Windows Information Protection (WIP) data. The disconnection message does not indicate the loss of WIP data. -![aadj unenerollment](images/azure-ad-unenrollment.png) +![aadj unenerollment.](images/azure-ad-unenrollment.png) When a device is enrolled into MDM through Azure Active Directory Join and then remotely unenrolled, the device may get into a state where it must be re-imaged. When devices are remotely unenrolled from MDM, the AAD association is also removed. This safeguard is in place to avoid leaving the corporated devices in unmanaged state. diff --git a/windows/client-management/mdm/eap-configuration.md b/windows/client-management/mdm/eap-configuration.md index 43882781ec..2ef69ad6c3 100644 --- a/windows/client-management/mdm/eap-configuration.md +++ b/windows/client-management/mdm/eap-configuration.md @@ -24,35 +24,35 @@ To get the EAP configuration from your desktop using the rasphone tool that is s 1. Run rasphone.exe. - ![vpnv2 rasphone](images/vpnv2-csp-rasphone.png) + ![vpnv2 rasphone.](images/vpnv2-csp-rasphone.png) 1. If you don't currently have a VPN connection and you see the following message, select **OK**. - ![vpnv2 csp network connections](images/vpnv2-csp-networkconnections.png) + ![vpnv2 csp network connections.](images/vpnv2-csp-networkconnections.png) 1. In the wizard, select **Workplace network**. - ![vpnv2 csp set up connection](images/vpnv2-csp-setupnewconnection.png) + ![vpnv2 csp set up connection.](images/vpnv2-csp-setupnewconnection.png) 1. Enter an Internet address and connection name. These can be fake since it does not impact the authentication parameters. - ![vpnv2 csp set up connection 2](images/vpnv2-csp-setupnewconnection2.png) + ![vpnv2 csp set up connection 2.](images/vpnv2-csp-setupnewconnection2.png) 1. Create a fake VPN connection. In the UI shown here, select **Properties**. - ![vpnv2 csp choose nw connection](images/vpnv2-csp-choosenetworkconnection.png) + ![vpnv2 csp choose nw connection.](images/vpnv2-csp-choosenetworkconnection.png) 1. In the **Test Properties** dialog, select the **Security** tab. - ![vpnv2 csp test props](images/vpnv2-csp-testproperties.png) + ![vpnv2 csp test props.](images/vpnv2-csp-testproperties.png) 1. On the **Security** tab, select **Use Extensible Authentication Protocol (EAP)**. - ![vpnv2 csp test props2](images/vpnv2-csp-testproperties2.png) + ![vpnv2 csp test props2.](images/vpnv2-csp-testproperties2.png) 1. From the drop-down menu, select the EAP method that you want to configure, and then select **Properties** to configure as needed. - ![vpnv2 csp test props3](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) + ![vpnv2 csp test props3.](images/vpnv2-csp-testproperties3.png)![vpnv2 csp test props4](images/vpnv2-csp-testproperties4.png) 1. Switch over to PowerShell and use the following cmdlets to retrieve the EAP configuration XML. @@ -267,7 +267,7 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Follow steps 1 through 7 in the EAP configuration article. 1. In the **Microsoft VPN SelfHost Properties** dialog box, select **Microsoft: Smart Card or other Certificate** from the drop-down menu (this selects EAP TLS). - ![vpn self host properties window](images/certfiltering1.png) + ![vpn self host properties window.](images/certfiltering1.png) > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. @@ -277,11 +277,11 @@ Alternatively, you can use the following procedure to create an EAP configuratio 1. Select the **Properties** button underneath the drop-down menu. 1. On the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - ![smart card or other certificate properties window](images/certfiltering2.png) + ![smart card or other certificate properties window.](images/certfiltering2.png) 1. On the **Configure Certificate Selection** menu, adjust the filters as needed. - ![configure certificate window](images/certfiltering3.png) + ![configure certificate window.](images/certfiltering3.png) 1. Select **OK** to close the windows and get back to the main rasphone.exe dialog box. 1. Close the rasphone dialog box. diff --git a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md index d6a0127bab..cfc9928a0b 100644 --- a/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md +++ b/windows/client-management/mdm/enable-admx-backed-policies-in-mdm.md @@ -47,19 +47,19 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( 2. Under **Best match**, click **Edit group policy** to launch it. - ![GPEdit search](images/admx-gpedit-search.png) + ![GPEdit search.](images/admx-gpedit-search.png) 3. In **Local Computer Policy** navigate to the policy you want to configure. In this example, navigate to **Administrative Templates > System > App-V**. - ![App-V policies](images/admx-appv.png) + ![App-V policies.](images/admx-appv.png) 4. Double-click **Enable App-V Client**. The **Options** section is empty, which means there are no parameters necessary to enable the policy. If the **Options** section is not empty, follow the procedure in [Enable a policy that requires parameters](#enable-a-policy-that-requires-parameters) - ![Enable App-V client](images/admx-appv-enableapp-vclient.png) + ![Enable App-V client.](images/admx-appv-enableapp-vclient.png) 3. Create the SyncML to enable the policy that does not require any parameter. @@ -99,15 +99,15 @@ See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune]( 1. Double-click **Publishing Server 2 Settings** to see the parameters you need to configure when you enable this policy. - ![Enable publishing server 2 policy](images/admx-appv-publishingserver2.png) + ![Enable publishing server 2 policy.](images/admx-appv-publishingserver2.png) - ![Enable publishing server 2 settings](images/admx-app-v-enablepublishingserver2settings.png) + ![Enable publishing server 2 settings.](images/admx-app-v-enablepublishingserver2settings.png) 2. Find the variable names of the parameters in the ADMX file. You can find the ADMX file name in the policy description in Policy CSP. In this example, the filename appv.admx is listed in [AppVirtualization/PublishingAllowServer2](policy-configuration-service-provider.md#appvirtualization-publishingallowserver2). - ![Publishing server 2 policy description](images/admx-appv-policy-description.png) + ![Publishing server 2 policy description.](images/admx-appv-policy-description.png) 3. Navigate to **C:\Windows\PolicyDefinitions** (default location of the admx files) and open appv.admx. diff --git a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md index f4c951af17..bab52cb7fd 100644 --- a/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md +++ b/windows/client-management/mdm/enable-offline-updates-for-windows-embedded-8-1-handheld-devices-to-windows-10.md @@ -84,7 +84,7 @@ After the upgrade to Windows 10 is complete, if you decide to push down a new we The following diagram shows a high-level overview of the process. -![update process for windows embedded 8.1 devices](images/windowsembedded-update.png) +![update process for windows embedded 8.1 devices.](images/windowsembedded-update.png) ## Step 1: Prepare a test device to download updates from Microsoft Update @@ -107,15 +107,15 @@ Trigger the device to check for updates either manually or using Microsoft Endpo 1. Remotely trigger a scan of the test device by deploying a Trigger Scan configuration baseline. - ![device scan using Configuration Manager](images/windowsembedded-update2.png) + ![device scan using Configuration Manager.](images/windowsembedded-update2.png) 2. Set the value of this OMA-URI by going to **Configuration Item**, and then selecting the newly created Trigger Scan settings from the previous step. - ![device scan using Configuration Manager](images/windowsembedded-update3.png) + ![device scan using Configuration Manager.](images/windowsembedded-update3.png) 3. Ensure that the value that is specified for this URI is greater than the value on the device(s), and that the **Remediate noncompliant rules when supported** option is selected. For the first time, any value that is greater than 0 will work, but for subsequent configurations, ensure that you specify an incremented value. - ![device scan using Configuration Manager](images/windowsembedded-update4.png) + ![device scan using Configuration Manager.](images/windowsembedded-update4.png) 4. Create a configuration baseline for Trigger Scan and Deploy. We recommend that this configuration baseline be deployed after the Controlled Updates baseline has been applied to the device. (The corresponding files are deployed on the device through a device sync session.) 5. Follow the prompts for downloading the updates, but do not install the updates on the device. @@ -216,11 +216,11 @@ The deployment process has three parts: 1. Create a configuration item. In the **Browse Settings** window, select **Device File** as a filter, and then select **Select**. - ![embedded device update](images/windowsembedded-update18.png) + ![embedded device update.](images/windowsembedded-update18.png) 2. Browse to the DUControlledUpdates.xml that was created from the test device, and then specify the file path and name on the device as `NonPersistent\DUControlledUpdates.xml`. - ![embedded device update](images/windowsembedded-update19.png) + ![embedded device update.](images/windowsembedded-update19.png) 3. Select **Remediate noncompliant settings**, and then select **OK**. @@ -231,7 +231,7 @@ The deployment process has three parts: 1. Create a configuration item and specify the file path and name on the device as `NonPersistent\DUCustomContentURIs.xml` 2. Select **Remediate noncompliant settings**. - ![embedded device update](images/windowsembedded-update21.png) + ![embedded device update.](images/windowsembedded-update21.png) 3. Select **OK**. @@ -242,11 +242,11 @@ The deployment process has three parts: 1. Create a configuration baseline item and give it a name (such as ControlledUpdates). 2. Add the DUControlledUpdates and DUCustomContentURIs configuration items, and then select **OK**. - ![embedded device update](images/windowsembedded-update22.png) + ![embedded device update.](images/windowsembedded-update22.png) 3. Deploy the configuration baseline to the appropriate device or device collection. - ![embedded device update](images/windowsembedded-update23.png) + ![embedded device update.](images/windowsembedded-update23.png) 4. Select **OK**. @@ -472,57 +472,57 @@ Use this procedure for pre-GDR1 devices: 2. In Microsoft Endpoint Configuration Manager, under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Items**. 3. Select **Create Configuration Item**. - ![device update using Configuration Manager](images/windowsembedded-update5.png) + ![device update using Configuration Manager.](images/windowsembedded-update5.png) 4. Enter a filename (such as GetDUReport), and then select **Mobile Device**. 5. On the **Mobile Device Settings** page, select **Configure Additional Settings that are not in the default settings group**, and then select **Next**. - ![device update using Configuration Manager](images/windowsembedded-update6.png) + ![device update using Configuration Manager.](images/windowsembedded-update6.png) 6. On the **Additional Settings** page, select **Add**. - ![device update using Configuration Manager](images/windowsembedded-update7.png) + ![device update using Configuration Manager.](images/windowsembedded-update7.png) 7. On the **Browse Settings** page, select **Create Setting**. - ![device update](images/windowsembedded-update8.png) + ![device update.](images/windowsembedded-update8.png) 8. Enter a unique **Name**. For **Setting type**, select **OMA-URI**, and for **Data type**, select **String**. 9. In the **OMA-URI** text box, enter `./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml`, and then select **OK**. - ![handheld device update](images/windowsembedded-update9.png) + ![handheld device update.](images/windowsembedded-update9.png) 10. On the **Browse Settings** page, select **Close**. 11. On the **Create Configuration Item Wizard** page, select **All Windows Embedded 8.1 Handheld** as the supported platform, and then select **Next**. - ![embedded device update](images/windowsembedded-update10.png) + ![embedded device update.](images/windowsembedded-update10.png) 12. Close the **Create Configuration Item Wizard** page. 13. Right-click on the newly create configuration item, and then select the **Compliance Rules** tab. 14. Select the new created mobile device setting (such as DUReport), and then select **Select**. 15. Enter a dummy value (such as zzz) that is different from the one on the device. - ![embedded device update](images/windowsembedded-update11.png) + ![embedded device update.](images/windowsembedded-update11.png) 16. Disable remediation by deselecting the **Remediate noncompliant rules when supported** option. 17. Select **OK** to close the **Edit Rule** page. 18. Create a new configuration baseline. Under **Assets and Compliance** > **Compliance Settings**, right-click **Configuration Baselines**. 19. Select **Create Configuration Item**. - ![embedded device update](images/windowsembedded-update12.png) + ![embedded device update.](images/windowsembedded-update12.png) 20. Enter a baseline name (such as RetrieveDUReport). 21. Add the configuration item that you just created. Select **Add**, and then select the configuration item that you just created (such as DUReport). - ![embedded device update](images/windowsembedded-update13.png) + ![embedded device update.](images/windowsembedded-update13.png) 22. Select **OK**, and then select **OK** again to complete the configuration baseline. 23. Deploy the newly created configuration baseline to the appropriate device collection. Right-click on the configuration baseline that you created, and then select **Deploy**. - ![embedded device update](images/windowsembedded-update14.png) + ![embedded device update.](images/windowsembedded-update14.png) 24. Select **Remediate noncompliant rules when supported**. 25. Select the appropriate device collection and define the schedule. - ![device update](images/windowsembedded-update15.png) + ![device update.](images/windowsembedded-update15.png) 26. To view the DUReport content, select the appropriate deployment for the configuration baseline that you created. Right-click on the deployment, and then select **View Status**. 27. Select **Run Summarization**, and then select **Refresh**. The test device(s) should be listed on the **Non-Compliant** tab. 28. Under **Asset Details**, right-click on the test device, and then select **Mode Details**. - ![device update](images/windowsembedded-update16.png) + ![device update.](images/windowsembedded-update16.png) 29. On the **Non-compliant** tab, you can see the DUReport, but you cannot retrieve the content from here. - ![device update](images/windowsembedded-update17.png) + ![device update.](images/windowsembedded-update17.png) 30. To retrieve the DUReport, open C:\\Program Files\\SMS\_CCM\\SMS\_DM.log. 31. In the log file, search from the bottom for "./Vendor/MSFT/EnterpriseExt/DeviceUpdate/UpdatesResultXml" RuleExression="Equals zzz," where zzz is the dummy value. Just above this, copy the information for UpdateData and use this information to create the DUControlledUpdates.xml. diff --git a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md index 322e4dbc40..c9f13235e0 100644 --- a/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md +++ b/windows/client-management/mdm/enroll-a-windows-10-device-automatically-using-group-policy.md @@ -46,11 +46,11 @@ To ensure that the auto-enrollment feature is working as expected, you must veri The following steps demonstrate required settings using the Intune service: 1. Verify that the user who is going to enroll the device has a valid Intune license. - ![Intune license verification](images/auto-enrollment-intune-license-verification.png) + ![Intune license verification.](images/auto-enrollment-intune-license-verification.png) 2. Verify that auto-enrollment is activated for those users who are going to enroll the devices into Intune. For additional details, see [Azure AD and Microsoft Intune: Automatic MDM enrollment in the new Portal](./azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). - ![Auto-enrollment activation verification](images/auto-enrollment-activation-verification.png) + ![Auto-enrollment activation verification.](images/auto-enrollment-activation-verification.png) > [!IMPORTANT] > For BYOD devices, the MAM user scope takes precedence if both MAM user scope and MDM user scope (automatic MDM enrollment) are enabled for all users (or the same groups of users). The device will use Windows Information Protection (WIP) Policies (if you configured them) rather than being MDM enrolled. @@ -62,23 +62,23 @@ The following steps demonstrate required settings using the Intune service: You can confirm that the device is properly hybrid-joined if both **AzureAdJoined** and **DomainJoined** are set to **YES**. - ![Auto-enrollment device status result](images/auto-enrollment-device-status-result.png) + ![Auto-enrollment device status result.](images/auto-enrollment-device-status-result.png) Additionally, verify that the SSO State section displays **AzureAdPrt** as **YES**. - ![Auto-enrollment Azure AD prt verification](images/auto-enrollment-azureadprt-verification.png) + ![Auto-enrollment Azure AD prt verification.](images/auto-enrollment-azureadprt-verification.png) This information can also be found on the Azure AD device list. - ![Azure AD device list](images/azure-ad-device-list.png) + ![Azure AD device list.](images/azure-ad-device-list.png) 5. Verify that the MDM discovery URL during auto-enrollment is https://enrollment.manage.microsoft.com/enrollmentserver/discovery.svc - ![MDM discovery URL](images/auto-enrollment-mdm-discovery-url.png) + ![MDM discovery URL.](images/auto-enrollment-mdm-discovery-url.png) 6. Some tenants might have both **Microsoft Intune** and **Microsoft Intune Enrollment** under **Mobility**. Make sure that your auto-enrollment settings are configured under **Microsoft Intune** instead of **Microsoft Intune Enrollment**. - ![Mobility setting MDM intune](images/auto-enrollment-microsoft-intune-setting.png) + ![Mobility setting MDM intune.](images/auto-enrollment-microsoft-intune-setting.png) 7. Verify that the *Enable Automatic MDM enrollment using default Azure AD credentials* group policy (**Local Group Policy Editor > Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is properly deployed to all devices which should be enrolled into Intune. You may contact your domain administrators to verify if the group policy has been deployed successfully. @@ -87,7 +87,7 @@ You may contact your domain administrators to verify if the group policy has bee 9. Verify that Microsoft Intune should allow enrollment of Windows devices. - ![Enrollment of Windows devices](images/auto-enrollment-enrollment-of-windows-devices.png) + ![Enrollment of Windows devices.](images/auto-enrollment-enrollment-of-windows-devices.png) ## Configure the auto-enrollment Group Policy for a single PC @@ -102,18 +102,18 @@ Requirements: Click Start, then in the text box type gpedit. - ![GPEdit desktop app search result](images/autoenrollment-gpedit.png) + ![GPEdit desktop app search result.](images/autoenrollment-gpedit.png) 2. Under **Best match**, click **Edit group policy** to launch it. 3. In **Local Computer Policy**, click **Administrative Templates** > **Windows Components** > **MDM**. > [!div class="mx-imgBorder"] - > ![MDM policies](images/autoenrollment-mdm-policies.png) + > ![MDM policies.](images/autoenrollment-mdm-policies.png) 4. Double-click **Enable automatic MDM enrollment using default Azure AD credentials** (previously called **Auto MDM Enrollment with AAD Token** in Windows 10, version 1709). For ADMX files in Windows 10, version 1903 and later, select **User Credential** as the Selected Credential Type to use. - ![MDM autoenrollment policy](images/autoenrollment-policy.png) + ![MDM autoenrollment policy.](images/autoenrollment-policy.png) 5. Click **Enable**, and select **User Credential** from the dropdown **Select Credential Type to Use**, then click **OK**. @@ -129,7 +129,7 @@ Requirements: If two-factor authentication is required, you will be prompted to complete the process. Here is an example screenshot. - ![Two-factor authentication notification](images/autoenrollment-2-factor-auth.png) + ![Two-factor authentication notification.](images/autoenrollment-2-factor-auth.png) > [!Tip] > You can avoid this behavior by using Conditional Access Policies in Azure AD. @@ -139,7 +139,7 @@ Requirements: 7. Click **Info** to see the MDM enrollment information. - ![Work School Settings](images/autoenrollment-settings-work-school.png) + ![Work School Settings.](images/autoenrollment-settings-work-school.png) If you do not see the **Info** button or the enrollment information, it is possible that the enrollment failed. Check the status in [Task Scheduler app](#task-scheduler-app). @@ -148,13 +148,13 @@ Requirements: 1. Click **Start**, then in the text box type **task scheduler**. - ![Task Scheduler search result](images/autoenrollment-task-schedulerapp.png) + ![Task Scheduler search result.](images/autoenrollment-task-schedulerapp.png) 2. Under **Best match**, click **Task Scheduler** to launch it. 3. In **Task Scheduler Library**, open **Microsoft > Windows** , then click **EnterpriseMgmt**. - ![Auto-enrollment scheduled task](images/autoenrollment-scheduled-task.png) + ![Auto-enrollment scheduled task.](images/autoenrollment-scheduled-task.png) To see the result of the task, move the scroll bar to the right to see the **Last Run Result**. Note that **0x80180026** is a failure message (MENROLL\_E_DEVICE\_MANAGEMENT_BLOCKED). You can see the logs in the **History** tab. @@ -239,13 +239,13 @@ To collect Event Viewer logs: 3. Search for event ID 75, which represents a successful auto-enrollment. Here is an example screenshot that shows the auto-enrollment completed successfully: - ![Event ID 75](images/auto-enrollment-troubleshooting-event-id-75.png) + ![Event ID 75.](images/auto-enrollment-troubleshooting-event-id-75.png) If you cannot find event ID 75 in the logs, it indicates that the auto-enrollment failed. This can happen because of the following reasons: - The enrollment failed with error. In this case, search for event ID 76, which represents failed auto-enrollment. Here is an example screenshot that shows that the auto-enrollment failed: - ![Event ID 76](images/auto-enrollment-troubleshooting-event-id-76.png) + ![Event ID 76.](images/auto-enrollment-troubleshooting-event-id-76.png) To troubleshoot, check the error code that appears in the event. See [Troubleshooting Windows device enrollment problems in Microsoft Intune](https://support.microsoft.com/en-ph/help/4469913/troubleshooting-windows-device-enrollment-problems-in-microsoft-intune) for more information. @@ -253,7 +253,7 @@ To collect Event Viewer logs: The auto-enrollment process is triggered by a task (**Microsoft > Windows > EnterpriseMgmt**) within the task-scheduler. This task appears if the *Enable automatic MDM enrollment using default Azure AD credentials* group policy (**Computer Configuration > Policies > Administrative Templates > Windows Components > MDM**) is successfully deployed to the target machine as shown in the following screenshot: - ![Task scheduler](images/auto-enrollment-task-scheduler.png) + ![Task scheduler.](images/auto-enrollment-task-scheduler.png) > [!Note] > This task isn't visible to standard users - run Scheduled Tasks with administrative credentials to find the task. @@ -262,24 +262,24 @@ To collect Event Viewer logs: **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational**. Look for an entry where the task scheduler created by enrollment client for automatically enrolling in MDM from AAD is triggered by event ID 107. - ![Event ID 107](images/auto-enrollment-event-id-107.png) + ![Event ID 107.](images/auto-enrollment-event-id-107.png) When the task is completed, a new event ID 102 is logged. - ![Event ID 102](images/auto-enrollment-event-id-102.png) + ![Event ID 102.](images/auto-enrollment-event-id-102.png) Note that the task scheduler log displays event ID 102 (task completed) regardless of the auto-enrollment success or failure. This means that the task scheduler log is only useful to confirm if the auto-enrollment task is triggered or not. It does not indicate the success or failure of auto-enrollment. If you cannot see from the log that task Schedule created by enrollment client for automatically enrolling in MDM from AAD is initiated, there is possibly issue with the group policy. Immediately run the command `gpupdate /force` in command prompt to get the GPO applied. If this still does not help, further troubleshooting on the Active Directory is required. One frequently seen error is related to some outdated enrollment entries in the registry on the target client device (**HKLM > Software > Microsoft > Enrollments**). If a device has been enrolled (can be any MDM solution and not only Intune), some enrollment information added into the registry is seen: - ![Outdated enrollment entries](images/auto-enrollment-outdated-enrollment-entries.png) + ![Outdated enrollment entries.](images/auto-enrollment-outdated-enrollment-entries.png) By default, these entries are removed when the device is un-enrolled, but occasionally the registry key remains even after un-enrollment. In this case, `gpupdate /force` fails to initiate the auto-enrollment task and error code 2149056522 is displayed in the **Applications and Services Logs > Microsoft > Windows > Task Scheduler > Operational** event log file under event ID 7016. A resolution to this issue is to remove the registry key manually. If you do not know which registry key to remove, go for the key which displays most entries as the screenshot above. All other keys will display fewer entries as shown in the following screenshot: - ![Manually deleted entries](images/auto-enrollment-activation-verification-less-entries.png) + ![Manually deleted entries.](images/auto-enrollment-activation-verification-less-entries.png) ### Related topics diff --git a/windows/client-management/mdm/enterprise-app-management.md b/windows/client-management/mdm/enterprise-app-management.md index b809041a65..c29e2047ad 100644 --- a/windows/client-management/mdm/enterprise-app-management.md +++ b/windows/client-management/mdm/enterprise-app-management.md @@ -41,7 +41,7 @@ These classifications are represented as nodes in the EnterpriseModernAppManagem The following diagram shows the EnterpriseModernAppManagement CSP in a tree format. -![enterprisemodernappmanagement csp diagram](images/provisioning-csp-enterprisemodernappmanagement.png) +![enterprisemodernappmanagement csp diagram.](images/provisioning-csp-enterprisemodernappmanagement.png) Each app displays one package family name and 1-n package full names for installed apps. The apps are categorized based on their origin (Store, nonStore, System). diff --git a/windows/client-management/mdm/enterpriseappmanagement-csp.md b/windows/client-management/mdm/enterpriseappmanagement-csp.md index 51c1a6581f..98249aad50 100644 --- a/windows/client-management/mdm/enterpriseappmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappmanagement-csp.md @@ -23,7 +23,7 @@ The EnterpriseAppManagement enterprise configuration service provider is used to The following diagram shows the EnterpriseAppManagement configuration service provider in tree format. -![enterpriseappmanagement csp](images/provisioning-csp-enterpriseappmanagement.png) +![enterpriseappmanagement csp.](images/provisioning-csp-enterpriseappmanagement.png) ***EnterpriseID*** Optional. A dynamic node that represents the EnterpriseID as a GUID. It is used to enroll or unenroll enterprise applications. diff --git a/windows/client-management/mdm/filesystem-csp.md b/windows/client-management/mdm/filesystem-csp.md index 12547591ba..3df7b51be2 100644 --- a/windows/client-management/mdm/filesystem-csp.md +++ b/windows/client-management/mdm/filesystem-csp.md @@ -24,7 +24,7 @@ The FileSystem configuration service provider is used to query, add, modify, and The following diagram shows the FileSystem configuration service provider management object in tree format as used by OMA DM. The OMA Client Provisioning protocol is not supported by this configuration service provider. -![filesystem csp (dm)](images/provisioning-csp-filesystem-dm.png) +![filesystem csp (dm).](images/provisioning-csp-filesystem-dm.png) **FileSystem** Required. Defines the root of the file system management object. It functions as the root directory for file system queries. diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 9f691cab8c..03fb5b432d 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -104,7 +104,7 @@ The following is a list of functions performed by the Device HealthAttestation C - Receives an encrypted blob (DHA-EncBlob) from DHA-Service, and stores it in a local cache on the device - Receives attestation requests (DHA-Requests) from a DHA-Enabled-MDM, and replies with a device health report (DHA-Report) -![healthattestation service diagram](images/healthattestation_2.png) +![healthattestation service diagram.](images/healthattestation_2.png)
diff --git a/windows/client-management/mdm/hotspot-csp.md b/windows/client-management/mdm/hotspot-csp.md index 36a979715e..af7934b674 100644 --- a/windows/client-management/mdm/hotspot-csp.md +++ b/windows/client-management/mdm/hotspot-csp.md @@ -27,7 +27,7 @@ The HotSpot configuration service provider is used to configure and enable Inter The following diagram shows the HotSpot configuration service provider management object in tree format as used by OMA Client Provisioning. The OMA DM protocol is not supported by this configuration service provider. -![hotspot csp (cp)](images/provisioning-csp-hotspot-cp.png) +![hotspot csp (cp).](images/provisioning-csp-hotspot-cp.png) **Enabled** Required. Specifies whether to enable Internet sharing on the device. The default is false. diff --git a/windows/client-management/mdm/implement-server-side-mobile-application-management.md b/windows/client-management/mdm/implement-server-side-mobile-application-management.md index 08a455f462..68633b48af 100644 --- a/windows/client-management/mdm/implement-server-side-mobile-application-management.md +++ b/windows/client-management/mdm/implement-server-side-mobile-application-management.md @@ -44,7 +44,7 @@ To make applications WIP-aware, app developers need to include the following dat MAM enrollment requires integration with Azure AD. The MAM service provider needs to publish the Management MDM app to the Azure AD app gallery. Starting with Azure AD in Windows 10, version 1703, the same cloud-based Management MDM app will support both MDM and MAM enrollments. If you have already published your MDM app, it needs to be updated to include MAM Enrollment and Terms of use URLs. The screenshot below illustrates the management app for an IT admin configuration.  -![Mobile application management app](images/implement-server-side-mobile-application-management.png) +![Mobile application management app.](images/implement-server-side-mobile-application-management.png) MAM and MDM services in an organization could be provided by different vendors. Depending on the company configuration, IT admin typically needs to add one or two Azure AD Management apps to configure MAM and MDM policies. For example, if both MAM and MDM are provided by the same vendor, then an IT Admin needs to add one Management app from this vendor that will contain both MAM and MDM policies for the organization. Alternatively, if the MAM and MDM services in an organization are provided by two different vendors, then two Management apps from the two vendors need to be configured for the company in Azure AD: one for MAM and one for MDM. Please note: if the MDM service in an organization is not integrated with Azure AD and uses auto-discovery, only one Management app for MAM needs to be configured.  diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 12e50c7af7..875c7d0ded 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -59,13 +59,13 @@ The Store for Business provides services that enable a management tool to synchr The following diagram provides an overview of app distribution from acquisition of an offline-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. -![business store offline app distribution](images/businessstoreportalservices2.png) +![business store offline app distribution.](images/businessstoreportalservices2.png) ### Online-licensed application distribution The following diagram provides an overview of app distribution from acquisition of an online-licensed application to distribution to a client. Once synchronized from the Store for Business, the management tool can use the Windows management framework to distribute applications to devices. For online-licensed applications, the management tool calls back into the Store for Business management services to assign an application prior to issuing the policy to install the application. -![business store online app distribution](images/businessstoreportalservices3.png) +![business store online app distribution.](images/businessstoreportalservices3.png) ## Integrate with Azure Active Directory @@ -105,7 +105,7 @@ After registering your management tool with Azure AD, the management tool can ca The diagram below shows the call patterns for acquiring a new or updated application. -![business store portal service flow diagram](images/businessstoreportalservicesflow.png) +![business store portal service flow diagram.](images/businessstoreportalservicesflow.png) **Here is the list of available operations**: diff --git a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md index d1e7b033f2..6dbe747d92 100644 --- a/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md +++ b/windows/client-management/mdm/mdm-enrollment-of-windows-devices.md @@ -25,7 +25,7 @@ In today’s cloud-first world, enterprise IT departments increasingly want to l You can connect corporate-owned devices to work by either joining the device to an Active Directory domain, or to an Azure Active Directory (Azure AD) domain. Windows 10 does not require a personal Microsoft account on devices joined to Azure AD or an on-premises Active Directory domain. -![active directory azure ad signin](images/unifiedenrollment-rs1-1.png) +![active directory azure ad signin.](images/unifiedenrollment-rs1-1.png) ### Connect your device to an Active Directory domain (join a domain) @@ -40,15 +40,15 @@ Joining your device to an Active Directory domain during the out-of-box-experien 1. On the **Who Owns this PC?** page, select **My work or school owns it**. - ![oobe local account creation](images/unifiedenrollment-rs1-2.png) + ![oobe local account creation.](images/unifiedenrollment-rs1-2.png) 2. Next, select **Join a domain**. - ![select domain or azure ad](images/unifiedenrollment-rs1-3.png) + ![select domain or azure ad.](images/unifiedenrollment-rs1-3.png) 3. You'll see a prompt to set up a local account on the device. Enter your local account details, and then select **Next** to continue. - ![create pc account](images/unifiedenrollment-rs1-4.png) + ![create pc account.](images/unifiedenrollment-rs1-4.png) ### Use the Settings app @@ -56,27 +56,27 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-5.png) + ![windows settings page.](images/unifiedenrollment-rs1-5.png) 2. Next, select **Accounts**. - ![windows settings accounts select](images/unifiedenrollment-rs1-6.png) + ![windows settings accounts select.](images/unifiedenrollment-rs1-6.png) 3. Navigate to **Access work or school**. - ![select access work or school](images/unifiedenrollment-rs1-7.png) + ![select access work or school.](images/unifiedenrollment-rs1-7.png) 4. Select **Connect**. - ![connect to work or school](images/unifiedenrollment-rs1-8.png) + ![connect to work or school.](images/unifiedenrollment-rs1-8.png) 5. Under **Alternate actions**, select **Join this device to a local Active Directory domain**. - ![join account to active directory domain](images/unifiedenrollment-rs1-9.png) + ![join account to active directory domain.](images/unifiedenrollment-rs1-9.png) 6. Type in your domain name, follow the instructions, and then select **Next** to continue. After you complete the flow and restart your device, it should be connected to your Active Directory domain. You can now sign in to the device using your domain credentials. - ![type in domain name](images/unifiedenrollment-rs1-10.png) + ![type in domain name.](images/unifiedenrollment-rs1-10.png) ### Help with connecting to an Active Directory domain @@ -101,11 +101,11 @@ To join a domain: 1. Select **My work or school owns it**, then select **Next.** - ![oobe local account creation](images/unifiedenrollment-rs1-11.png) + ![oobe local account creation.](images/unifiedenrollment-rs1-11.png) 2. Select **Join Azure AD**, and then select **Next.** - ![select domain or azure ad](images/unifiedenrollment-rs1-12.png) + ![select domain or azure ad.](images/unifiedenrollment-rs1-12.png) 3. Type in your Azure AD username. This is the email address you use to log into Microsoft Office 365 and similar services. @@ -113,7 +113,7 @@ To join a domain: Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. If your Azure AD tenant has auto-enrollment configured, your device will also be enrolled into MDM during this flow. For more information, see [these steps](azure-ad-and-microsoft-intune-automatic-mdm-enrollment-in-the-new-portal.md). If your tenant is not configured for auto-enrollment, you will have to go through the enrollment flow a second time to connect your device to MDM. After you complete the flow, your device will be connected to your organization’s Azure AD domain. - ![azure ad signin](images/unifiedenrollment-rs1-13.png) + ![azure ad signin.](images/unifiedenrollment-rs1-13.png) ### Use the Settings app @@ -121,27 +121,27 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-14.png) + ![windows settings page.](images/unifiedenrollment-rs1-14.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts select](images/unifiedenrollment-rs1-15.png) + ![windows settings accounts select.](images/unifiedenrollment-rs1-15.png) 3. Navigate to **Access work or school**. - ![select access work or school](images/unifiedenrollment-rs1-16.png) + ![select access work or school.](images/unifiedenrollment-rs1-16.png) 4. Select **Connect**. - ![connect to work or school](images/unifiedenrollment-rs1-17.png) + ![connect to work or school.](images/unifiedenrollment-rs1-17.png) 5. Under **Alternate Actions**, selct **Join this device to Azure Active Directory**. - ![join work or school account to azure ad](images/unifiedenrollment-rs1-18.png) + ![join work or school account to azure ad.](images/unifiedenrollment-rs1-18.png) 6. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![azure ad sign in](images/unifiedenrollment-rs1-19.png) + ![azure ad sign in.](images/unifiedenrollment-rs1-19.png) 7. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and you can enter your password directly on this page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -151,7 +151,7 @@ To create a local account and connect the device: After you reach the end of the flow, your device should be connected to your organization’s Azure AD domain. You may now log out of your current account and sign in using your Azure AD username. - ![corporate sign in](images/unifiedenrollment-rs1-20.png) + ![corporate sign in.](images/unifiedenrollment-rs1-20.png) ### Help with connecting to an Azure AD domain @@ -183,19 +183,19 @@ To create a local account and connect the device: 1. Launch the Settings app, and then select **Accounts** >**Start** > **Settings** > **Accounts**. - ![windows settings page](images/unifiedenrollment-rs1-21-b.png) + ![windows settings page.](images/unifiedenrollment-rs1-21-b.png) 2. Navigate to **Access work or school**. - ![select access work or school](images/unifiedenrollment-rs1-23-b.png) + ![select access work or school.](images/unifiedenrollment-rs1-23-b.png) 3. Select **Connect**. - ![connect to work or school](images/unifiedenrollment-rs1-24-b.png) + ![connect to work or school.](images/unifiedenrollment-rs1-24-b.png) 4. Type in your Azure AD username. This is the email address you use to log into Office 365 and similar services. - ![join work or school account to azure ad](images/unifiedenrollment-rs1-25-b.png) + ![join work or school account to azure ad.](images/unifiedenrollment-rs1-25-b.png) 5. If the tenant is a cloud-only, password hash sync, or pass-through authentication tenant, this page changes to show the organization's custom branding, and can enter your password directly into the page. If the tenant is part of a federated domain, you are redirected to the organization's on-premises federation server, such as AD FS, for authentication. @@ -205,11 +205,11 @@ To create a local account and connect the device: Starting in Windows 10, version 1709, you will see the status page that shows the progress of your device being set up. - ![corporate sign in](images/unifiedenrollment-rs1-26.png) + ![corporate sign in.](images/unifiedenrollment-rs1-26.png) 6. After you complete the flow, your Microsoft account will be connected to your work or school account. - ![account successfully added](images/unifiedenrollment-rs1-27.png) + ![account successfully added.](images/unifiedenrollment-rs1-27.png) ### Connect to MDM on a desktop (enrolling in device management) @@ -221,29 +221,29 @@ To create a local account and connect the device: 1. Launch the Settings app. - ![windows settings page](images/unifiedenrollment-rs1-28.png) + ![windows settings page.](images/unifiedenrollment-rs1-28.png) 2. Next, navigate to **Accounts**. - ![windows settings accounts page](images/unifiedenrollment-rs1-29.png) + ![windows settings accounts page.](images/unifiedenrollment-rs1-29.png) 3. Navigate to **Access work or school**. - ![access work or school](images/unifiedenrollment-rs1-30.png) + ![access work or school.](images/unifiedenrollment-rs1-30.png) 4. Select the **Enroll only in device management** link (available in servicing build 14393.82, KB3176934). For older builds, see [Connect your Windows 10-based device to work using a deep link](mdm-enrollment-of-windows-devices.md#connect-your-windows-10-based-device-to-work-using-a-deep-link). - ![connect to work or school](images/unifiedenrollment-rs1-31.png) + ![connect to work or school.](images/unifiedenrollment-rs1-31.png) 5. Type in your work email address. - ![set up work or school account](images/unifiedenrollment-rs1-32.png) + ![set up work or school account.](images/unifiedenrollment-rs1-32.png) 6. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. Starting in Windows 10, version 1709, you will see the enrollment progress on screen. - ![corporate sign in](images/unifiedenrollment-rs1-33-b.png) + ![corporate sign in.](images/unifiedenrollment-rs1-33-b.png) After you complete the flow, your device will be connected to your organization’s MDM. @@ -300,7 +300,7 @@ To connect your devices to MDM using deep links: - IT admins can add this link to a welcome email that users can select to enroll into MDM. - ![using enrollment deeplink in email](images/deeplinkenrollment1.png) + ![using enrollment deeplink in email.](images/deeplinkenrollment1.png) - IT admins can also add this link to an internal web page that users refer to enrollment instructions. @@ -308,20 +308,20 @@ To connect your devices to MDM using deep links: Type in your work email address. - ![set up work or school account](images/deeplinkenrollment3.png) + ![set up work or school account.](images/deeplinkenrollment3.png) 3. If the device finds an endpoint that only supports on-premises authentication, this page will change and ask you for your password. If the device finds an MDM endpoint that supports federated authentication, you’ll be presented with a new window that will ask you for additional authentication information. Based on IT policy, you may also be prompted to provide a second factor of authentication at this point. After you complete the flow, your device will be connected to your organization's MDM. - ![corporate sign in](images/deeplinkenrollment4.png) + ![corporate sign in.](images/deeplinkenrollment4.png) ## Manage connections To manage your work or school connections, select **Settings** > **Accounts** > **Access work or school**. Your connections will show on this page and selecting one will expand options for that connection. -![managing work or school account](images/unifiedenrollment-rs1-34-b.png) +![managing work or school account.](images/unifiedenrollment-rs1-34-b.png) ### Info @@ -335,7 +335,7 @@ Selecting the **Info** button will open a new page in the Settings app that prov Starting in Windows 10, version 1709, selecting the **Info** button will show a list of policies and line-of-business apps installed by your organization. Here is an example screenshot. -![work or school info](images/unifiedenrollment-rs1-35-b.png) +![work or school info.](images/unifiedenrollment-rs1-35-b.png) > [!NOTE] > Starting in Windows 10, version 1709, the **Manage** button is no longer available. @@ -357,7 +357,7 @@ You can collect diagnostic logs around your work connections by going to **Setti Starting in Windows 10, version 1709, you can get the advanced diagnostic report by going to **Settings** > **Accounts** > **Access work or school**, and selecting the **Info** button. At the bottom of the Settings page, you will see the button to create a report, as shown here. -![collecting enrollment management log files](images/unifiedenrollment-rs1-37-c.png) +![collecting enrollment management log files.](images/unifiedenrollment-rs1-37-c.png) diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index e9383e871f..ad2d4edddc 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -17,7 +17,7 @@ The Messaging configuration service provider is used to configure the ability to The following diagram shows the Messaging configuration service provider in tree format. -![messaging csp](images/provisioning-csp-messaging.png) +![messaging csp.](images/provisioning-csp-messaging.png) **./User/Vendor/MSFT/Messaging** diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 32f9b5ee66..6c898afe02 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -68,7 +68,7 @@ Devices that are joined to an on-premises Active Directory can enroll into MDM v Starting in Windows 10, version 1607, IT admin can disable MDM enrollments for domain-joined PCs using Group Policy. Using the GP editor, the path is **Computer configuration** > **Administrative Templates** > **Windows Components** > **MDM** > **Disable MDM Enrollment**. -![Disable MDM enrollment policy in GP Editor](images/mdm-enrollment-disable-policy.png) +![Disable MDM enrollment policy in GP Editor.](images/mdm-enrollment-disable-policy.png) Here is the corresponding registry key: diff --git a/windows/client-management/mdm/napdef-csp.md b/windows/client-management/mdm/napdef-csp.md index 1b5f5ecdd4..0b715c1a53 100644 --- a/windows/client-management/mdm/napdef-csp.md +++ b/windows/client-management/mdm/napdef-csp.md @@ -27,11 +27,11 @@ The NAPDEF configuration service provider is used to add, modify, or delete WAP The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **initial bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. -![napdef csp (cp) (initial bootstrapping)](images/provisioning-csp-napdef-cp.png) +![napdef csp (cp) (initial bootstrapping).](images/provisioning-csp-napdef-cp.png) The following diagram shows the NAPDEF configuration service provider management object in tree format as used by OMA Client Provisioning for **updating the bootstrapping of the phone**. The OMA DM protocol is not supported by this configuration service provider. -![napdef csp (cp) (update bootstrapping)](images/provisioning-csp-napdef-cp-2.png) +![napdef csp (cp) (update bootstrapping).](images/provisioning-csp-napdef-cp-2.png) **NAPAUTHINFO** Defines a group of authentication settings. diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index ce79fdb702..272489e4a8 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -240,7 +240,7 @@ Passing CDATA in data in SyncML to ConfigManager and CSPs does not work in Windo The certificate setting under "SSL Settings" in the IIS server for SCEP must be set to "Ignore" in Windows 10. In Windows Phone 8.1, when you set the client certificate to "Accept," it works fine. -![ssl settings](images/ssl-settings.png) +![ssl settings.](images/ssl-settings.png) ### MDM enrollment fails on the mobile device when traffic is going through proxy @@ -439,7 +439,7 @@ Alternatively you can use the following procedure to create an EAP Configuration 1. Follow steps 1 through 7 in the [EAP configuration](eap-configuration.md) article. 2. In the Microsoft VPN SelfHost Properties dialog box, select **Microsoft : Smart Card or other Certificate** from the drop down (this selects EAP TLS.) - ![vpn selfhost properties window](images/certfiltering1.png) + ![vpn selfhost properties window.](images/certfiltering1.png) > [!NOTE] > For PEAP or TTLS, select the appropriate method and continue following this procedure. @@ -447,10 +447,10 @@ Alternatively you can use the following procedure to create an EAP Configuration 3. Click the **Properties** button underneath the drop down menu. 4. In the **Smart Card or other Certificate Properties** menu, select the **Advanced** button. - ![smart card or other certificate properties window](images/certfiltering2.png) + ![smart card or other certificate properties window.](images/certfiltering2.png) 5. In the **Configure Certificate Selection** menu, adjust the filters as needed. - ![configure certificate selection window](images/certfiltering3.png) + ![configure certificate selection window.](images/certfiltering3.png) 6. Click **OK** to close the windows to get back to the main rasphone.exe dialog box. 7. Close the rasphone dialog box. 8. Continue following the procedure in the [EAP configuration](eap-configuration.md) article from Step 9 to get an EAP TLS profile with appropriate filtering. @@ -492,7 +492,7 @@ No. Only one MDM is allowed. 4. Click **Configure**. 5. Set quota to unlimited. - ![aad maximum joined devices](images/faq-max-devices.png) + ![aad maximum joined devices.](images/faq-max-devices.png) ### **What is dmwappushsvc?** diff --git a/windows/client-management/mdm/passportforwork-csp.md b/windows/client-management/mdm/passportforwork-csp.md index c73d5fdc8d..84ff8f5e34 100644 --- a/windows/client-management/mdm/passportforwork-csp.md +++ b/windows/client-management/mdm/passportforwork-csp.md @@ -23,13 +23,13 @@ The PassportForWork configuration service provider is used to provision Windows The following diagram shows the PassportForWork configuration service provider in tree format. -![passportforwork csp](images/provisioning-csp-passportforwork.png) +![passportforwork csp.](images/provisioning-csp-passportforwork.png) ### Device configuration diagram The following diagram shows the PassportForWork configuration service provider in tree format. -![passportforwork diagram](images/provisioning-csp-passportforwork2.png) +![passportforwork diagram.](images/provisioning-csp-passportforwork2.png) **PassportForWork** Root node for PassportForWork configuration service provider. diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index ddeb61f84a..da0f0543dc 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -44,7 +44,7 @@ The Policy configuration service provider has the following sub-categories: The following diagram shows the Policy configuration service provider in tree format as used by both Open Mobile Alliance Device Management (OMA DM) and OMA Client Provisioning. -![policy csp diagram](images/provisioning-csp-policy.png) +![policy csp diagram.](images/provisioning-csp-policy.png) **./Vendor/MSFT/Policy** diff --git a/windows/client-management/mdm/policy-csp-deviceinstallation.md b/windows/client-management/mdm/policy-csp-deviceinstallation.md index 9d7aa06011..013edacaec 100644 --- a/windows/client-management/mdm/policy-csp-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-deviceinstallation.md @@ -549,7 +549,7 @@ To verify that the policy is applied, check C:\windows\INF\setupapi.dev.log and ``` You can also change the evaluation order of device installation policy settings by using a custom profile in Intune. -:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image"::: +:::image type="content" source="images/edit-row.png" alt-text="This is a edit row image."::: @@ -743,7 +743,7 @@ To verify the policy is applied, check C:\windows\INF\setupapi.dev.log and see i You can also block installation by using a custom profile in Intune. -![Custom profile prevent devices](images/custom-profile-prevent-other-devices.png) +![Custom profile prevent devices.](images/custom-profile-prevent-other-devices.png) @@ -863,7 +863,7 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile blocks installation and usage of USB devices with hardware IDs "USB\Composite" and "USB\Class_FF", and applies to USB devices with matching hardware IDs that are already installed. -![Custom profile prevent device ids](images/custom-profile-prevent-device-ids.png) +![Custom profile prevent device ids.](images/custom-profile-prevent-device-ids.png) @@ -977,7 +977,7 @@ You can also block installation and usage of prohibited peripherals by using a c For example, this custom profile prevents installation of devices with matching device instance IDs. -![Custom profile](images/custom-profile-prevent-device-instance-ids.png) +![Custom profile.](images/custom-profile-prevent-device-instance-ids.png) To prevent installation of devices with matching device instance IDs by using custom profile in Intune: 1. Locate the device instance ID. diff --git a/windows/client-management/mdm/policy-csp-mixedreality.md b/windows/client-management/mdm/policy-csp-mixedreality.md index cdf909411f..7f7e8ae961 100644 --- a/windows/client-management/mdm/policy-csp-mixedreality.md +++ b/windows/client-management/mdm/policy-csp-mixedreality.md @@ -40,20 +40,6 @@ manager: dansimp -Steps to use this policy correctly: - -1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). -1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). - 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays - 1. The value can be between min / max allowed. -1. Enroll HoloLens devices and verify both configurations get applied to the device. -1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. -1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. -1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. - -> [!NOTE] -> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. -
@@ -79,6 +65,20 @@ Steps to use this policy correctly:
+Steps to use this policy correctly: + +1. Create a device configuration profile for kiosk targeting Azure AD groups and assign it to HoloLens device(s). +1. Create a custom OMA URI based device configuration that sets this policy value to desired number of days (> 0) and assign it to HoloLens device(s). + 1. The URI value should be entered in OMA-URI text box as ./Vendor/MSFT/Policy/Config/MixedReality/AADGroupMembershipCacheValidityInDays + 1. The value can be between min / max allowed. +1. Enroll HoloLens devices and verify both configurations get applied to the device. +1. Let Azure AD user 1 sign-in when internet is available. Once the user signs-in and Azure AD group membership is confirmed successfully, cache will be created. +1. Now Azure AD user 1 can take HoloLens offline and use it for kiosk mode as long as policy value allows for X number of days. +1. Steps 4 and 5 can be repeated for any other Azure AD user N. The key point here is that any Azure AD user must sign-in to device using Internet at least once. Then we can determine that they are member of Azure AD group to which Kiosk configuration is targeted. + +> [!NOTE] +> Until step 4 is performed for a Azure AD user will experience failure behavior mentioned similar to “disconnected” environments. +


diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index b02ba826b4..d627137d97 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -7,7 +7,7 @@ ms.prod: w10 ms.technology: windows author: manikadhiman ms.localizationpriority: medium -ms.date: 10/14/2020 +ms.date: 08/26/2021 ms.reviewer: manager: dansimp --- @@ -62,7 +62,7 @@ manager: dansimp System/AllowUserToResetPhone
- System/AllowWuFBCloudProcessing + System/AllowWUfBCloudProcessing
System/BootStartDriverInitialization @@ -964,7 +964,7 @@ The following list shows the supported values:
-**System/AllowWuFBCloudProcessing** +**System/AllowWUfBCloudProcessing**
@@ -985,6 +985,15 @@ If you disable or do not configure this policy setting, devices enrolled to the
+ + +The following list shows the supported values: + +- 0 - Disabled. +- 8 - Enabled. + + + **System/BootStartDriverInitialization** diff --git a/windows/client-management/mdm/push-notification-windows-mdm.md b/windows/client-management/mdm/push-notification-windows-mdm.md index a0a34ee244..92df20eba2 100644 --- a/windows/client-management/mdm/push-notification-windows-mdm.md +++ b/windows/client-management/mdm/push-notification-windows-mdm.md @@ -52,34 +52,34 @@ To get a PFN and WNS credentials, you must create an Microsoft Store app. 1. Go to the Windows [Dashboard](https://dev.windows.com/en-US/dashboard) and sign in with your developer account. - ![mdm push notification1](images/push-notification1.png) + ![mdm push notification1.](images/push-notification1.png) 2. Create a new app. - ![mdm push notification2](images/push-notification2.png) + ![mdm push notification2.](images/push-notification2.png) 3. Reserve an app name. - ![mdm push notification3](images/push-notification3.png) + ![mdm push notification3.](images/push-notification3.png) 4. Click **Services**. - ![mdm push notification4](images/push-notification4.png) + ![mdm push notification4.](images/push-notification4.png) 5. Click **Push notifications**. - ![mdm push notification5](images/push-notification5.png) + ![mdm push notification5.](images/push-notification5.png) 6. Click **Live Services site**. A new window opens for the **Application Registration Portal** page. - ![mdm push notification6](images/push-notification6.png) + ![mdm push notification6.](images/push-notification6.png) 7. In the **Application Registration Portal** page, you will see the properties for the app that you created, such as: - Application Id - Application Secrets - Microsoft Store Package SID, Application Identity, and Publisher. - ![mdm push notification7](images/push-notification7.png) + ![mdm push notification7.](images/push-notification7.png) 8. Click **Save**. 9. Close the **Application Registration Portal** window and go back to the Windows Dev Center Dashboard. 10. Select your app from the list on the left. 11. From the left nav, expand **App management** and then click **App identity**. - ![mdm push notification10](images/push-notification10.png) + ![mdm push notification10.](images/push-notification10.png) 12. In the **App identity** page, you will see the **Package Family Name (PFN)** of your app.   diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 48baff3fe8..e2d40a822a 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -23,11 +23,11 @@ The PXLOGICAL configuration service provider is used to add, remove, or modify W The following diagram shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for initial bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. -![pxlogical csp (cp) (initial bootstrapping)](images/provisioning-csp-pxlogical-cp.png) +![pxlogical csp (cp) (initial bootstrapping).](images/provisioning-csp-pxlogical-cp.png) The following diagram shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for updating the bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. -![pxlogical csp (cp) (update bootstrapping)](images/provisioning-csp-pxlogical-cp-2.png) +![pxlogical csp (cp) (update bootstrapping).](images/provisioning-csp-pxlogical-cp-2.png) **PXPHYSICAL** Defines a group of logical proxy settings. diff --git a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md index be9c8a5339..28e198aa1f 100644 --- a/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md +++ b/windows/client-management/mdm/register-your-free-azure-active-directory-subscription.md @@ -23,15 +23,15 @@ If you have paid subscriptions to Office 365, Microsoft Dynamics CRM Online, Ent 1. Sign in to the Microsoft 365 admin center at using your organization's account. - ![register azuread](images/azure-ad-add-tenant10.png) + ![register azuread.](images/azure-ad-add-tenant10.png) 2. On the **Home** page, click on the Admin tools icon. - ![register azuread](images/azure-ad-add-tenant11.png) + ![register azuread.](images/azure-ad-add-tenant11.png) 3. On the **Admin center** page, under Admin Centers on the left, click **Azure Active Directory**. This will take you to the Azure Active Directory portal. - ![Azure-AD-updated](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) + ![Azure-AD-updated.](https://user-images.githubusercontent.com/41186174/71594506-e4845300-2b40-11ea-9a08-c21c824e12a4.png) diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index 9e203d4d39..4ffdbad557 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -25,7 +25,7 @@ For the SecurityPolicy CSP, you cannot use the Replace command unless the node a The following diagram shows the SecurityPolicy configuration service provider management object in tree format as used by both OMA DM and OMA Client Provisioning. -![securitypolicy csp (dm,cp)](images/provisioning-csp-securitypolicy-dmandcp.png) +![securitypolicy csp (dm,cp).](images/provisioning-csp-securitypolicy-dmandcp.png) ***PolicyID*** Defines the security policy identifier as a decimal value. diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index 5b211a0f55..21f39c4389 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -56,11 +56,11 @@ Group Policy option button setting: The following diagram shows the main display for the Group Policy Editor. -![Group Policy editor](images/group-policy-editor.png) +![Group Policy editor.](images/group-policy-editor.png) The following diagram shows the settings for the "Publishing Server 2 Settings" Group Policy in the Group Policy Editor. -![Group Policy publisher server 2 settings](images/group-policy-publisher-server-2-settings.png) +![Group Policy publisher server 2 settings.](images/group-policy-publisher-server-2-settings.png) Note that most Group Policies are a simple Boolean type. For a Boolean Group Policy, if you select **Enabled**, the options panel contains no data input fields and the payload of the SyncML is simply ``. However, if there are data input fields in the options panel, the MDM server must supply this data. The following *Enabling a Group Policy* example illustrates this complexity. In this example, 10 name-value pairs are described by `` tags in the payload, which correspond to the 10 data input fields in the Group Policy Editor options panel for the "Publishing Server 2 Settings" Group Policy. The ADMX file, which defines the Group Policies, is consumed by the MDM server, similarly to how the Group Policy Editor consumes it. The Group Policy Editor displays a UI to receive the complete Group Policy instance data, which the MDM server's IT administrator console must also do. For every `` element and id attribute in the ADMX policy definition, there must be a corresponding `` element and id attribute in the payload. The ADMX file drives the policy definition and is required by the MDM server via the SyncML protocol. diff --git a/windows/client-management/mdm/unifiedwritefilter-csp.md b/windows/client-management/mdm/unifiedwritefilter-csp.md index 7916778bec..00d2b86cd5 100644 --- a/windows/client-management/mdm/unifiedwritefilter-csp.md +++ b/windows/client-management/mdm/unifiedwritefilter-csp.md @@ -119,7 +119,7 @@ Currently SwapfileSize should not be relied for determining or controlling the o **CurrentSession/MaximumOverlaySize** or **NextSession/MaximumOverlaySize** should be used for that purpose. -:::image type="content" source="images/overlaysetting.png" alt-text="This is the overlay setting"::: +:::image type="content" source="images/overlaysetting.png" alt-text="This is the overlay setting."::: > [!NOTE] > Only single swapfile is supported in current implementation and creating swapfile on specific volume will disable any other swapfile created on other volumes. diff --git a/windows/client-management/mdm/vpn-csp.md b/windows/client-management/mdm/vpn-csp.md index 3f6badf192..42a6882673 100644 --- a/windows/client-management/mdm/vpn-csp.md +++ b/windows/client-management/mdm/vpn-csp.md @@ -33,7 +33,7 @@ Important considerations: The following diagram shows the VPN configuration service provider in tree format. -![provisioning\-csp\-vpnimg](images/provisioning-csp-vpn.png) +![provisioning\-csp\-vpnimg.](images/provisioning-csp-vpn.png) ***ProfileName*** Unique alpha numeric Identifier for the profile. The profile name must not include a forward slash (/). diff --git a/windows/client-management/mdm/w4-application-csp.md b/windows/client-management/mdm/w4-application-csp.md index d6b9110b32..e7321b1888 100644 --- a/windows/client-management/mdm/w4-application-csp.md +++ b/windows/client-management/mdm/w4-application-csp.md @@ -25,7 +25,7 @@ The default security roles are defined in the root characteristic, and map to ea The following diagram shows the configuration service provider in tree format as used by OMA Client Provisioning. -![w4 application csp (cp)](images/provisioning-csp-w4-application-cp.png) +![w4 application csp (cp).](images/provisioning-csp-w4-application-cp.png) **APPID** Required. This parameter takes a string value. The only supported value for configuring MMS is "w4". diff --git a/windows/client-management/mdm/w7-application-csp.md b/windows/client-management/mdm/w7-application-csp.md index 20f21f79bc..7aaa801796 100644 --- a/windows/client-management/mdm/w7-application-csp.md +++ b/windows/client-management/mdm/w7-application-csp.md @@ -23,7 +23,7 @@ The APPLICATION configuration service provider that has an APPID of w7 is used f The following image shows the configuration service provider in tree format as used by OMA Client Provisioning. -![w7 application csp (dm)](images/provisioning-csp-w7-application-dm.png) +![w7 application csp (dm).](images/provisioning-csp-w7-application-dm.png) > **Note**   All parm names and characteristic types are case sensitive and must use all uppercase. Both APPSRV and CLIENT credentials must be provided in provisioning XML. diff --git a/windows/client-management/mdm/wifi-csp.md b/windows/client-management/mdm/wifi-csp.md index 125bbfb687..e867ae66ef 100644 --- a/windows/client-management/mdm/wifi-csp.md +++ b/windows/client-management/mdm/wifi-csp.md @@ -31,7 +31,7 @@ Programming considerations: The following image shows the WiFi configuration service provider in tree format. -![wi-fi csp diagram](images/provisioning-csp-wifi.png) +![wi-fi csp diagram.](images/provisioning-csp-wifi.png) The following list shows the characteristics and parameters. diff --git a/windows/client-management/mdm/windows-mdm-enterprise-settings.md b/windows/client-management/mdm/windows-mdm-enterprise-settings.md index a8be6bba9c..e5e7511669 100644 --- a/windows/client-management/mdm/windows-mdm-enterprise-settings.md +++ b/windows/client-management/mdm/windows-mdm-enterprise-settings.md @@ -25,7 +25,7 @@ The DM client is configured during the enrollment process to be invoked by the t The following diagram shows the work flow between server and client. -![windows client and server mdm diagram](images/enterprise-workflow.png) +![windows client and server mdm diagram.](images/enterprise-workflow.png) ## Management workflow diff --git a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md index c68424cd04..fc13fd3034 100644 --- a/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md +++ b/windows/client-management/mdm/windowsadvancedthreatprotection-csp.md @@ -19,7 +19,7 @@ The Windows Defender Advanced Threat Protection (WDATP) configuration service pr The following diagram shows the WDATP configuration service provider in tree format as used by the Open Mobile Alliance (OMA) Device Management (DM). -![windowsadvancedthreatprotection csp diagram](images/provisioning-csp-watp.png) +![windowsadvancedthreatprotection csp diagram.](images/provisioning-csp-watp.png) The following list describes the characteristics and parameters. diff --git a/windows/client-management/mdm/wmi-providers-supported-in-windows.md b/windows/client-management/mdm/wmi-providers-supported-in-windows.md index 2f3cdf7fc7..2fe71b5e76 100644 --- a/windows/client-management/mdm/wmi-providers-supported-in-windows.md +++ b/windows/client-management/mdm/wmi-providers-supported-in-windows.md @@ -213,16 +213,16 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw | Class | Test completed in Windows 10 for desktop | |--------------------------------------------------------------------------|------------------------------------------| -| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcappoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcgameoverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcgamessettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcrating**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | | [**wpcRatingsDescriptor**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | | -| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | -| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark](images/checkmark.png) | +| [**wpcratingssystem**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcsystemsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcurloverride**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcusersettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | +| [**wpcwebsettings**](/windows/win32/parcon/parental-controls-wmi-provider-schema) | ![cross mark.](images/checkmark.png) | @@ -232,17 +232,17 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw |--------------------------------------------------------------------------|------------------------------------------| [**Win32\_1394Controller**](/windows/win32/cimwin32prov/win32-1394controller) | [**Win32\_BaseBoard**](/windows/win32/cimwin32prov/win32-baseboard) | -[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | ![cross mark](images/checkmark.png) -[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | ![cross mark](images/checkmark.png) +[**Win32\_Battery**](/windows/win32/cimwin32prov/win32-battery) | ![cross mark.](images/checkmark.png) +[**Win32\_BIOS**](/windows/win32/cimwin32prov/win32-bios) | ![cross mark.](images/checkmark.png) [**Win32\_CDROMDrive**](/windows/win32/cimwin32prov/win32-cdromdrive) | -[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | ![cross mark](images/checkmark.png) -[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | ![cross mark](images/checkmark.png) -[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | ![cross mark](images/checkmark.png) +[**Win32\_ComputerSystem**](/windows/win32/cimwin32prov/win32-computersystem) | ![cross mark.](images/checkmark.png) +[**Win32\_ComputerSystemProduct**](/windows/win32/cimwin32prov/win32-computersystemproduct) | ![cross mark.](images/checkmark.png) +[**Win32\_CurrentTime**](/previous-versions/windows/desktop/wmitimepprov/win32-currenttime) | ![cross mark.](images/checkmark.png) [**Win32\_Desktop**](/windows/win32/cimwin32prov/win32-desktop) | -[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |![cross mark](images/checkmark.png) -[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | ![cross mark](images/checkmark.png) +[**Win32\_DesktopMonitor**](/windows/win32/cimwin32prov/win32-desktopmonitor) |![cross mark.](images/checkmark.png) +[**Win32\_DiskDrive**](/windows/win32/cimwin32prov/win32-diskdrive) | ![cross mark.](images/checkmark.png) [**Win32\_DiskPartition**](/windows/win32/cimwin32prov/win32-diskpartition) | -[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | ![cross mark](images/checkmark.png) +[**Win32\_DisplayConfiguration**](/previous-versions//aa394137(v=vs.85)) | ![cross mark.](images/checkmark.png) [**Win32\_DMAChannel**](/windows/win32/cimwin32prov/win32-dmachannel) | [**Win32\_DriverVXD**](/previous-versions//aa394141(v=vs.85)) | [**Win32\_EncryptableVolume**](/windows/win32/secprov/win32-encryptablevolume) | @@ -252,23 +252,23 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_IRQResource**](/windows/win32/cimwin32prov/win32-irqresource) | [**Win32\_Keyboard**](/windows/win32/cimwin32prov/win32-keyboard) | [**Win32\_LoadOrderGroup**](/windows/win32/cimwin32prov/win32-loadordergroup) | -[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | ![cross mark](images/checkmark.png) +[**Win32\_LocalTime**](/previous-versions/windows/desktop/wmitimepprov/win32-localtime) | ![cross mark.](images/checkmark.png) [**Win32\_LoggedOnUser**](/windows/win32/cimwin32prov/win32-loggedonuser) | -[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | ![cross mark](images/checkmark.png) +[**Win32\_LogicalDisk**](/windows/win32/cimwin32prov/win32-logicaldisk) | ![cross mark.](images/checkmark.png) [**Win32\_MotherboardDevice**](/windows/win32/cimwin32prov/win32-motherboarddevice) | -[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | ![cross mark](images/checkmark.png) +[**Win32\_NetworkAdapter**](/windows/win32/cimwin32prov/win32-networkadapter) | ![cross mark.](images/checkmark.png) [**Win32\_NetworkAdapterConfiguration**](/windows/win32/cimwin32prov/win32-networkadapterconfiguration) | [**Win32\_NetworkClient**](/windows/win32/cimwin32prov/win32-networkclient) | [**Win32\_NetworkLoginProfile**](/windows/win32/cimwin32prov/win32-networkloginprofile) | [**Win32\_NetworkProtocol**](/windows/win32/cimwin32prov/win32-networkprotocol) | [**Win32\_NTEventlogFile**](/previous-versions/windows/desktop/legacy/aa394225(v=vs.85)) | -[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | ![cross mark](images/checkmark.png) +[**Win32\_OperatingSystem**](/windows/win32/cimwin32prov/win32-operatingsystem) | ![cross mark.](images/checkmark.png) [**Win32\_OSRecoveryConfiguration**](/windows/win32/cimwin32prov/win32-osrecoveryconfiguration) | [**Win32\_PageFileSetting**](/windows/win32/cimwin32prov/win32-pagefilesetting) | [**Win32\_ParallelPort**](/windows/win32/cimwin32prov/win32-parallelport) | [**Win32\_PCMCIAController**](/windows/win32/cimwin32prov/win32-pcmciacontroller) | [**Win32\_PhysicalMedia**](/previous-versions/windows/desktop/cimwin32a/win32-physicalmedia) | -[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | ![cross mark](images/checkmark.png) +[**Win32\_PhysicalMemory**](/windows/win32/cimwin32prov/win32-physicalmemory) | ![cross mark.](images/checkmark.png) [**Win32\_PnPDevice**](/windows/win32/cimwin32prov/win32-pnpdevice) | [**Win32\_PnPEntity**](/windows/win32/cimwin32prov/win32-pnpentity) | [**Win32\_PointingDevice**](/windows/win32/cimwin32prov/win32-pointingdevice) | @@ -277,25 +277,25 @@ For links to these classes, see [**MDM Bridge WMI Provider**](/windows/win32/dmw [**Win32\_POTSModem**](/windows/win32/cimwin32prov/win32-potsmodem) | [**Win32\_Printer**](/windows/win32/cimwin32prov/win32-printer) | [**Win32\_PrinterConfiguration**](/windows/win32/cimwin32prov/win32-printerconfiguration) | -[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | ![cross mark](images/checkmark.png) -[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | ![cross mark](images/checkmark.png) +[**Win32\_Processor**](/windows/win32/cimwin32prov/win32-processor) | ![cross mark.](images/checkmark.png) +[**Win32\_QuickFixEngineering**](/windows/win32/cimwin32prov/win32-quickfixengineering) | ![cross mark.](images/checkmark.png) [**Win32\_Registry**](/windows/win32/cimwin32prov/win32-registry) | [**Win32\_SCSIController**](/windows/win32/cimwin32prov/win32-scsicontroller) | [**Win32\_SerialPort**](/windows/win32/cimwin32prov/win32-serialport) | [**Win32\_SerialPortConfiguration**](/windows/win32/cimwin32prov/win32-serialportconfiguration) | [**Win32\_ServerFeature**](/windows/win32/wmisdk/win32-serverfeature) | -[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | ![cross mark](images/checkmark.png) -[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | ![cross mark](images/checkmark.png) +[**Win32\_Service**](/windows/win32/cimwin32prov/win32-service) | ![cross mark.](images/checkmark.png) +[**Win32\_Share**](/windows/win32/cimwin32prov/win32-share) | ![cross mark.](images/checkmark.png) [**Win32\_SoundDevice**](/windows/win32/cimwin32prov/win32-sounddevice) | [**Win32\_SystemAccount**](/windows/win32/cimwin32prov/win32-systemaccount) | -[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | ![cross mark](images/checkmark.png) +[**Win32\_SystemBIOS**](/windows/win32/cimwin32prov/win32-systembios) | ![cross mark.](images/checkmark.png) [**Win32\_SystemDriver**](/windows/win32/cimwin32prov/win32-systemdriver) | -[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | ![cross mark](images/checkmark.png) +[**Win32\_SystemEnclosure**](/windows/win32/cimwin32prov/win32-systemenclosure) | ![cross mark.](images/checkmark.png) [**Win32\_TapeDrive**](/windows/win32/cimwin32prov/win32-tapedrive) | -[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | ![cross mark](images/checkmark.png) +[**Win32\_TimeZone**](/windows/win32/cimwin32prov/win32-timezone) | ![cross mark.](images/checkmark.png) [**Win32\_UninterruptiblePowerSupply**](/previous-versions//aa394503(v=vs.85)) | [**Win32\_USBController**](/windows/win32/cimwin32prov/win32-usbcontroller) | -[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | ![cross mark](images/checkmark.png) +[**Win32\_UTCTime**](/previous-versions/windows/desktop/wmitimepprov/win32-utctime) | ![cross mark.](images/checkmark.png) [**Win32\_VideoController**](/windows/win32/cimwin32prov/win32-videocontroller) | **Win32\_WindowsUpdateAgentVersion** | diff --git a/windows/client-management/quick-assist.md b/windows/client-management/quick-assist.md index 6a50151342..acdcd2d268 100644 --- a/windows/client-management/quick-assist.md +++ b/windows/client-management/quick-assist.md @@ -57,7 +57,7 @@ Both the helper and sharer must be able to reach these endpoints over port 443: 7. RDP shares the video to the helper over https (port 443) through the RDP relay service to the helper's RDP control. Input is shared from the helper to the sharer through the RDP relay service. -:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established"::: +:::image type="content" source="images/quick-assist-flow.png" lightbox="images/quick-assist-flow.png" alt-text="Schematic flow of connections when a Quick Assist session is established."::: ### Data and privacy diff --git a/windows/client-management/troubleshoot-inaccessible-boot-device.md b/windows/client-management/troubleshoot-inaccessible-boot-device.md index e0afd3d480..490b24075a 100644 --- a/windows/client-management/troubleshoot-inaccessible-boot-device.md +++ b/windows/client-management/troubleshoot-inaccessible-boot-device.md @@ -119,7 +119,7 @@ To verify the BCD entries: > [!NOTE] > If the computer is UEFI-based, the file path value that's specified in the **path** parameter of **{bootmgr}** and **{default}** contains an **.efi** extension. - ![bcdedit](images/screenshot1.png) + ![bcdedit.](images/screenshot1.png) If any of the information is wrong or missing, we recommend that you create a backup of the BCD store. To do this, run `bcdedit /export C:\temp\bcdbackup`. This command creates a backup in **C:\\temp\\** that's named **bcdbackup**. To restore the backup, run `bcdedit /import C:\temp\bcdbackup`. This command overwrites all BCD settings by using the settings in **bcdbackup**. @@ -179,11 +179,11 @@ Dism /Image:: /Get-packages After you run this command, you'll see the **Install pending** and **Uninstall Pending** packages: -![Dism output pending update](images/pendingupdate.png) +![Dism output pending update.](images/pendingupdate.png) 1. Run the `dism /Image:C:\ /Cleanup-Image /RevertPendingActions` command. Replace **C:** with the system partition for your computer. - ![Dism output revert pending](images/revertpending.png) + ![Dism output revert pending.](images/revertpending.png) 2. Navigate to ***OSdriveLetter*:\Windows\WinSxS**, and then check whether the **pending.xml** file exists. If it does, rename it to **pending.xml.old**. @@ -193,14 +193,14 @@ After you run this command, you'll see the **Install pending** and **Uninstall P 5. Navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **COMPONENT** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineComponentHive** for the new hive. - ![Load Hive](images/loadhive.png) + ![Load Hive.](images/loadhive.png) 6. Expand **HKEY_LOCAL_MACHINE\OfflineComponentHive**, and check whether the **PendingXmlIdentifier** key exists. Create a backup of the **OfflineComponentHive** key, and then delete the **PendingXmlIdentifier** key. 7. Unload the hive. To do this, highlight **OfflineComponentHive**, and then select **File** > **Unload hive**. > [!div class="mx-imgBorder"] - > ![Unload Hive](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) + > ![Unload Hive.](images/unloadhive.png)![Unload Hive](images/unloadhive1.png) 8. Select **HKEY_LOCAL_MACHINE**, go to **File** > **Load Hive**, navigate to ***OSdriveLetter*:\Windows\System32\config**, select the file that's named **SYSTEM** (with no extension), and then select **Open**. When you're prompted, enter the name **OfflineSystemHive** for the new hive. @@ -256,7 +256,7 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the \Control\Class\\{71A27CDD-812A-11D0-BEC7-08002BE2092F} > [!div class="mx-imgBorder"] - > ![Registry](images/controlset.png) + > ![Registry.](images/controlset.png) If an **UpperFilters** or **LowerFilters** entry is non-standard (for example, it's not a Windows default filter driver, such as PartMgr), remove the entry. To remove it, double-click it in the right pane, and then delete only that value. @@ -274,8 +274,8 @@ Check whether there are any non-Microsoft upper and lower filter drivers on the * `chkdsk /f /r OsDrive:` - ![Check disk](images/check-disk.png) + ![Check disk.](images/check-disk.png) * `sfc /scannow /offbootdir=OsDrive:\ /offwindir=OsDrive:\Windows` - ![SFC scannow](images/sfc-scannow.png) + ![SFC scannow.](images/sfc-scannow.png) diff --git a/windows/client-management/troubleshoot-stop-errors.md b/windows/client-management/troubleshoot-stop-errors.md index 454101462a..390add3169 100644 --- a/windows/client-management/troubleshoot-stop-errors.md +++ b/windows/client-management/troubleshoot-stop-errors.md @@ -165,13 +165,13 @@ You can use the tools such as Windows Software Development KIT (SDK) and Symbols 6. Click on **Open Crash Dump**, and then open the memory.dmp file that you copied. See the example below. - ![WinDbg img](images/windbg.png) + ![WinDbg img.](images/windbg.png) 7. There should be a link that says **!analyze -v** under **Bugcheck Analysis**. Click that link. This will enter the command !analyze -v in the prompt at the bottom of the page. 8. A detailed bugcheck analysis will appear. See the example below. - ![Bugcheck analysis](images/bugcheck-analysis.png) + ![Bugcheck analysis.](images/bugcheck-analysis.png) 9. Scroll down to the section where it says **STACK_TEXT**. There will be rows of numbers with each row followed by a colon and some text. That text should tell you what DLL is causing the crash and if applicable what service is crashing the DLL. diff --git a/windows/client-management/troubleshoot-tcpip-connectivity.md b/windows/client-management/troubleshoot-tcpip-connectivity.md index 77e524634d..10ae554304 100644 --- a/windows/client-management/troubleshoot-tcpip-connectivity.md +++ b/windows/client-management/troubleshoot-tcpip-connectivity.md @@ -44,17 +44,17 @@ If the initial TCP handshake is failing because of packet drops, then you would Source side connecting on port 445: -![Screenshot of frame summary in Network Monitor](images/tcp-ts-6.png) +![Screenshot of frame summary in Network Monitor.](images/tcp-ts-6.png) Destination side: applying the same filter, you do not see any packets. -![Screenshot of frame summary with filter in Network Monitor](images/tcp-ts-7.png) +![Screenshot of frame summary with filter in Network Monitor.](images/tcp-ts-7.png) For the rest of the data, TCP will retransmit the packets five times. **Source 192.168.1.62 side trace:** -![Screenshot showing packet side trace](images/tcp-ts-8.png) +![Screenshot showing packet side trace.](images/tcp-ts-8.png) **Destination 192.168.1.2 side trace:** @@ -79,15 +79,15 @@ In the below screenshots, you see that the packets seen on the source and the de **Source Side** -![Screenshot of packets on source side in Network Monitor](images/tcp-ts-9.png) +![Screenshot of packets on source side in Network Monitor.](images/tcp-ts-9.png) **On the destination-side trace** -![Screenshot of packets on destination side in Network Monitor](images/tcp-ts-10.png) +![Screenshot of packets on destination side in Network Monitor.](images/tcp-ts-10.png) You also see an ACK+RST flag packet in a case when the TCP establishment packet SYN is sent out. The TCP SYN packet is sent when the client wants to connect on a particular port, but if the destination/server for some reason does not want to accept the packet, it would send an ACK+RST packet. -![Screenshot of packet flag](images/tcp-ts-11.png) +![Screenshot of packet flag.](images/tcp-ts-11.png) The application that's causing the reset (identified by port numbers) should be investigated to understand what is causing it to reset the connection. @@ -110,8 +110,8 @@ auditpol /set /subcategory:"Filtering Platform Packet Drop" /success:enable /fai You can then review the Security event logs to see for a packet drop on a particular port-IP and a filter ID associated with it. -![Screenshot of Event Properties](images/tcp-ts-12.png) +![Screenshot of Event Properties.](images/tcp-ts-12.png) Now, run the command `netsh wfp show state`, this will generate a wfpstate.xml file. After you open this file and filter for the ID that you find in the above event (2944008), you'll be able to see a firewall rule name that's associated with this ID that's blocking the connection. -![Screenshot of wfpstate.xml file](images/tcp-ts-13.png) +![Screenshot of wfpstate.xml file.](images/tcp-ts-13.png) diff --git a/windows/client-management/troubleshoot-tcpip-netmon.md b/windows/client-management/troubleshoot-tcpip-netmon.md index b432191920..daa23de8b1 100644 --- a/windows/client-management/troubleshoot-tcpip-netmon.md +++ b/windows/client-management/troubleshoot-tcpip-netmon.md @@ -21,7 +21,7 @@ In this topic, you will learn how to use Microsoft Network Monitor 3.4, which is To get started, [download Network Monitor tool](https://www.microsoft.com/download/details.aspx?id=4865). When you install Network Monitor, it installs its driver and hooks it to all the network adapters installed on the device. You can see the same on the adapter properties, as shown in the following image: -![Adapters](images/nm-adapters.png) +![Adapters.](images/nm-adapters.png) When the driver gets hooked to the network interface card (NIC) during installation, the NIC is reinitialized, which might cause a brief network glitch. @@ -29,15 +29,15 @@ When the driver gets hooked to the network interface card (NIC) during installat 1. Run netmon in an elevated status by choosing Run as Administrator. - ![Image of Start search results for Netmon](images/nm-start.png) + ![Image of Start search results for Netmon.](images/nm-start.png) 2. Network Monitor opens with all network adapters displayed. Select the network adapters where you want to capture traffic, click **New Capture**, and then click **Start**. - ![Image of the New Capture option on menu](images/tcp-ts-4.png) + ![Image of the New Capture option on menu.](images/tcp-ts-4.png) 3. Reproduce the issue, and you will see that Network Monitor grabs the packets on the wire. - ![Frame summary of network packets](images/tcp-ts-5.png) + ![Frame summary of network packets.](images/tcp-ts-5.png) 4. Select **Stop**, and go to **File > Save as** to save the results. By default, the file will be saved as a ".cap" file. diff --git a/windows/client-management/troubleshoot-tcpip-port-exhaust.md b/windows/client-management/troubleshoot-tcpip-port-exhaust.md index ca8551b1dd..4c1e8b1b7f 100644 --- a/windows/client-management/troubleshoot-tcpip-port-exhaust.md +++ b/windows/client-management/troubleshoot-tcpip-port-exhaust.md @@ -58,19 +58,19 @@ Since outbound connections start to fail, you will see a lot of the below behavi - Unable to sign in to the machine with domain credentials, however sign-in with local account works. Domain sign-in will require you to contact the DC for authentication which is again an outbound connection. If you have cache credentials set, then domain sign-in might still work. - ![Screenshot of error for NETLOGON in Event Viewer](images/tcp-ts-14.png) + ![Screenshot of error for NETLOGON in Event Viewer.](images/tcp-ts-14.png) - Group Policy update failures: - ![Screenshot of event properties for Group Policy failure](images/tcp-ts-15.png) + ![Screenshot of event properties for Group Policy failure.](images/tcp-ts-15.png) - File shares are inaccessible: - ![Screenshot of error message "Windows cannot access"](images/tcp-ts-16.png) + ![Screenshot of error message "Windows cannot access."](images/tcp-ts-16.png) - RDP from the affected server fails: - ![Screenshot of error when Remote Desktop is unable to connect](images/tcp-ts-17.png) + ![Screenshot of error when Remote Desktop is unable to connect.](images/tcp-ts-17.png) - Any other application running on the machine will start to give out errors @@ -84,15 +84,15 @@ If you suspect that the machine is in a state of port exhaustion: a. **Event ID 4227** - ![Screenshot of event id 4227 in Event Viewer](images/tcp-ts-18.png) + ![Screenshot of event id 4227 in Event Viewer.](images/tcp-ts-18.png) b. **Event ID 4231** - ![Screenshot of event id 4231 in Event Viewer](images/tcp-ts-19.png) + ![Screenshot of event id 4231 in Event Viewer.](images/tcp-ts-19.png) 3. Collect a `netstat -anob` output from the server. The netstat output will show you a huge number of entries for TIME_WAIT state for a single PID. - ![Screenshot of netstate command output](images/tcp-ts-20.png) + ![Screenshot of netstate command output.](images/tcp-ts-20.png) After a graceful closure or an abrupt closure of a session, after a period of 4 minutes (default), the port used the process or application would be released back to the available pool. During this 4 minutes, the TCP connection state will be TIME_WAIT state. In a situation where you suspect port exhaustion, an application or process will not be able to release all the ports that it has consumed and will remain in the TIME_WAIT state. @@ -136,7 +136,7 @@ If method 1 does not help you identify the process (prior to Windows 10 and Wind 1. Add a column called “handles” under details/processes. 2. Sort the column handles to identify the process with the highest number of handles. Usually the process with handles greater than 3000 could be the culprit except for processes like System, lsass.exe, store.exe, sqlsvr.exe. - ![Screenshot of handles column in Windows Task Maner](images/tcp-ts-21.png) + ![Screenshot of handles column in Windows Task Maner.](images/tcp-ts-21.png) 3. If any other process than these has a higher number, stop that process and then try to login using domain credentials and see if it succeeds. @@ -157,7 +157,7 @@ Steps to use Process explorer: File \Device\AFD - ![Screenshot of Process Explorer](images/tcp-ts-22.png) + ![Screenshot of Process Explorer.](images/tcp-ts-22.png) 10. Some are normal, but large numbers of them are not (hundreds to thousands). Close the process in question. If that restores outbound connectivity, then you have further proven that the app is the cause. Contact the vendor of that app. diff --git a/windows/client-management/troubleshoot-tcpip-rpc-errors.md b/windows/client-management/troubleshoot-tcpip-rpc-errors.md index 37b4dfa002..ba02501c81 100644 --- a/windows/client-management/troubleshoot-tcpip-rpc-errors.md +++ b/windows/client-management/troubleshoot-tcpip-rpc-errors.md @@ -16,7 +16,7 @@ manager: dansimp You might encounter an **RPC server unavailable** error when connecting to Windows Management Instrumentation (WMI), SQL Server, during a remote connection, or for some Microsoft Management Console (MMC) snap-ins. The following image is an example of an RPC error. -![The following error has occurred: the RPC server is unavailable](images/rpc-error.png) +![The following error has occurred: the RPC server is unavailable.](images/rpc-error.png) This is a commonly encountered error message in the networking world and one can lose hope very fast without trying to understand much, as to what is happening ‘under the hood’. @@ -37,7 +37,7 @@ Before getting in to troubleshooting the *RPC server unavailable- error Client A wants to execute some functions or wants to make use of a service running on the remote server, will first establish the connection with the Remote Server by doing a three-way handshake. -![Diagram illustrating connection to remote server](images/rpc-flow.png) +![Diagram illustrating connection to remote server.](images/rpc-flow.png) RPC ports can be given from a specific range as well. ### Configure RPC dynamic port allocation @@ -162,13 +162,13 @@ Open the traces in [Microsoft Network Monitor 3.4](troubleshoot-tcpip-netmon.md) - Now check if you are getting a response from the server. If you get a response, note the dynamic port number that you have been allocated to use. - ![Screenshot of Network Monitor with dynamic port highlighted](images/tcp-ts-23.png) + ![Screenshot of Network Monitor with dynamic port highlighted.](images/tcp-ts-23.png) - Check if we are connecting successfully to this Dynamic port successfully. - The filter should be something like this: `tcp.port==` and `ipv4.address==` - ![Screenshot of Network Monitor with filter applied](images/tcp-ts-24.png) + ![Screenshot of Network Monitor with filter applied.](images/tcp-ts-24.png) This should help you verify the connectivity and isolate if any network issues are seen. @@ -177,7 +177,7 @@ This should help you verify the connectivity and isolate if any network issues a The most common reason why we would see the RPC server unavailable is when the dynamic port that the client tries to connect is not reachable. The client side trace would then show TCP SYN retransmits for the dynamic port. -![Screenshot of Network Monitor with TCP SYN retransmits](images/tcp-ts-25.png) +![Screenshot of Network Monitor with TCP SYN retransmits.](images/tcp-ts-25.png) The port cannot be reachable due to one of the following reasons: diff --git a/windows/client-management/windows-version-search.md b/windows/client-management/windows-version-search.md index 29a781be98..16c416a9cd 100644 --- a/windows/client-management/windows-version-search.md +++ b/windows/client-management/windows-version-search.md @@ -22,27 +22,27 @@ Click **Start** > **Settings** > **System** > click **About** from the bottom of You'll now see **Edition**, **Version**, and **OS Build** information. Something like this: -![screenshot of the system properties window for a device running Windows 10](images/systemcollage.png) +![screenshot of the system properties window for a device running Windows 10.](images/systemcollage.png) ## Using Keyword Search You can simply type the following in the search bar and press **ENTER** to see version details for your device. **“winver”** -![screenshot of the About Windows display text](images/winver.png) +![screenshot of the About Windows display text.](images/winver.png) **“msinfo”** or **"msinfo32"** to open **System Information**: -![screenshot of the System Information display text](images/msinfo32.png) +![screenshot of the System Information display text.](images/msinfo32.png) ## Using Command Prompt or PowerShell At the Command Prompt or PowerShell interface, type **"systeminfo | findstr /B /C:"OS Name" /B /C:"OS Version"** and then press **ENTER** -![screenshot of system information display text](images/refcmd.png) +![screenshot of system information display text.](images/refcmd.png) At the Command Prompt or PowerShell, type **"slmgr /dlv"**, and then press ENTER. The /dlv command displays the detailed licensing information. Notice the output displays "EnterpriseS" as seen in the image below: -![screenshot of software licensing manager](images/slmgr_dlv.png) +![screenshot of software licensing manager.](images/slmgr_dlv.png) ## What does it all mean? diff --git a/windows/configuration/configure-windows-10-taskbar.md b/windows/configuration/configure-windows-10-taskbar.md index 15407ebc50..5f433844ac 100644 --- a/windows/configuration/configure-windows-10-taskbar.md +++ b/windows/configuration/configure-windows-10-taskbar.md @@ -31,7 +31,7 @@ The order of apps in the XML file dictates the order of pinned apps on the taskb The following example shows how apps will be pinned: Windows default apps to the left (blue circle), apps pinned by the user in the center (orange triangle), and apps that you pin using the XML file to the right (green square). -![Windows left, user center, enterprise to the right](images/taskbar-generic.png) +![Windows left, user center, enterprise to the right.](images/taskbar-generic.png) ## Configure taskbar (general) @@ -142,11 +142,11 @@ The `` section will append listed apps to the tas ``` **Before:** -![default apps pinned to taskbar](images/taskbar-default.png) +![default apps pinned to taskbar.](images/taskbar-default.png) **After:** - ![additional apps pinned to taskbar](images/taskbar-default-plus.png) + ![additional apps pinned to taskbar.](images/taskbar-default-plus.png) ## Remove default apps and add your own @@ -175,11 +175,11 @@ If you only want to remove some of the default pinned apps, you would use this m ``` **Before:** -![Taskbar with default apps](images/taskbar-default.png) +![Taskbar with default apps.](images/taskbar-default.png) **After:** -![Taskbar with default apps removed](images/taskbar-default-removed.png) +![Taskbar with default apps removed.](images/taskbar-default-removed.png) ## Remove default apps @@ -250,15 +250,15 @@ The following example shows you how to configure taskbars by country or region. When the preceding example XML file is applied, the resulting taskbar for computers in the US or UK: -![taskbar for US and UK locale](images/taskbar-region-usuk.png) +![taskbar for US and UK locale.](images/taskbar-region-usuk.png) The resulting taskbar for computers in Germany or France: -![taskbar for DE and FR locale](images/taskbar-region-defr.png) +![taskbar for DE and FR locale.](images/taskbar-region-defr.png) The resulting taskbar for computers in any other country region: -![taskbar for all other regions](images/taskbar-region-other.png) +![taskbar for all other regions.](images/taskbar-region-other.png) > [!NOTE] diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index e8a0cdee55..1190119050 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -19,7 +19,7 @@ Cortana integration is a Preview feature that's available for your test or dev e >[!NOTE] >For more info about Dynamics CRM integration, how to turn on Cortana, and how to provide feedback, see [Preview feature: Set up Cortana integration](https://go.microsoft.com/fwlink/p/?LinkId=746819). -![Cortana at work, showing the sales data pulled from Dynamics CRM](../images/cortana-crm-screen.png) +![Cortana at work, showing the sales data pulled from Dynamics CRM.](../images/cortana-crm-screen.png) ## Turn on Cortana with Dynamics CRM in your organization You must be a CRM administrator to turn on and use Preview features. For more info about what Preview features are and how to use them, see [What are Preview features and how do I enable them](https://go.microsoft.com/fwlink/p/?LinkId=746817)? @@ -43,7 +43,7 @@ You must tell your employees to turn on Cortana, before they’ll be able to use 2. Click on **Connected Services**, click **Dynamics CRM**, and then click **Connect**. - ![Cotana at work, showing how to turn on the connected services for Dynamics CRM](../images/cortana-connect-crm.png) + ![Cotana at work, showing how to turn on the connected services for Dynamics CRM.](../images/cortana-connect-crm.png) The employee can also disconnect by clicking **Disconnect** from the **Dynamics CRM** screen. diff --git a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md index 65919eb8e8..481cb27659 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-powerbi.md @@ -48,35 +48,35 @@ Before you can start this testing scenario, you must first set up your test envi 2. Expand the left rail by clicking the **Show the navigation pane** icon. - ![Cortana at work, showing the navigation expand icon in Power BI](../images/cortana-powerbi-expand-nav.png) + ![Cortana at work, showing the navigation expand icon in Power BI.](../images/cortana-powerbi-expand-nav.png) 3. Click **Get Data** from the left-hand navigation in Power BI. - ![Cortana at work, showing the Get Data link](../images/cortana-powerbi-getdata.png) + ![Cortana at work, showing the Get Data link.](../images/cortana-powerbi-getdata.png) 4. Click **Samples** from the **Content Pack Library** area of the **Get Data** screen. - ![Cortana at work, showing the Samples link](../images/cortana-powerbi-getdata-samples.png) + ![Cortana at work, showing the Samples link.](../images/cortana-powerbi-getdata-samples.png) 5. Click **Retail Analysis Sample**, and then click **Connect**. - ![Cortana at work, showing the Samples link](../images/cortana-powerbi-retail-analysis-sample.png) + ![Cortana at work, showing the Samples link.](../images/cortana-powerbi-retail-analysis-sample.png) The sample data is imported and you’re returned to the **Power BI** screen. 6. Click **Dashboards** from the left pane of the **Power BI** screen, and then click **Retail Analysis Sample**. - ![Cortana at work, showing a dashboard view of the sample data](../images/cortana-powerbi-retail-analysis-dashboard.png) + ![Cortana at work, showing a dashboard view of the sample data.](../images/cortana-powerbi-retail-analysis-dashboard.png) 7. In the upper right-hand menu, click the **Settings** icon, and then click **Settings**. - ![Cortana at work, showing where to find the Settings option](../images/cortana-powerbi-settings.png) + ![Cortana at work, showing where to find the Settings option.](../images/cortana-powerbi-settings.png) 8. Click the **Datasets** tab, and then pick the **Retail Analysis Sample** dataset from the list. 9. Click **Q&A and Cortana**, check the **Allow Cortana to access this dataset** box, and then click **Apply**. - ![Cortana at work, showing where to find the dataset options](../images/cortana-powerbi-retail-analysis-dataset.png) + ![Cortana at work, showing where to find the dataset options.](../images/cortana-powerbi-retail-analysis-dataset.png) >[!NOTE] >It can take up to 30 minutes for a new dataset to appear for Power BI and Cortana. Logging in and out of Windows 10, or otherwise restarting Cortana, causes the new content to appear immediately.

If you enable a dataset for Cortana, and that dataset is part of a content pack you own, you’ll need to re-publish for your colleagues to also use it with Cortana. @@ -92,7 +92,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu **To create a custom sales data Answer Page for Cortana** 1. In Power BI, click **My Workspace**, click **Create**, and then click **Report**. - ![Cortana at work, showing where to create the new report](../images/cortana-powerbi-create-report.png) + ![Cortana at work, showing where to create the new report.](../images/cortana-powerbi-create-report.png) 2. In the **Create Report** screen, click the **Retail Analysis Sample**, and then click **Create**. @@ -100,11 +100,11 @@ After you’ve finished creating your Answer Page, you can continue to the inclu 3. In the **Visualizations** pane, click the paint roller icon, expand **Page Size**, and then pick **Cortana** from the **Type** drop-down list. - ![Cortana at work, showing the Visualizations options](../images/cortana-powerbi-pagesize.png) + ![Cortana at work, showing the Visualizations options.](../images/cortana-powerbi-pagesize.png) 4. In the **Fields** pane, click to expand **Sales**, expand **This year sales**, and then add both **Value** and **Goal**. - ![Cortana at work, showing the Field options](../images/cortana-powerbi-field-selection.png) + ![Cortana at work, showing the Field options.](../images/cortana-powerbi-field-selection.png) The automatically generated graph is added to your blank report. You have the option to change colors, add borders, add additional visualizations, and modify this page so that it answers the question about sales data as precisely, and in as custom a way, as you want. You just need to make sure that it all stays within the page borders. @@ -112,7 +112,7 @@ After you’ve finished creating your Answer Page, you can continue to the inclu The alternate names help Cortana to know what questions to look for and when to show this report. To also improve your results, you should avoid using the names of your report columns. - ![Cortana at work, showing the page info for your specific report](../images/cortana-powerbi-report-qna.png) + ![Cortana at work, showing the page info for your specific report.](../images/cortana-powerbi-report-qna.png) 6. Click **File**, click **Save as**, and save the report as _Sales data 2016_. @@ -128,13 +128,13 @@ Now that you’ve set up your device, you can use Cortana to show your info from Cortana shows you the available results. - ![Cortana at work, showing the best matches based on the Power BI data](../images/cortana-powerbi-search.png) + ![Cortana at work, showing the best matches based on the Power BI data.](../images/cortana-powerbi-search.png) 3. In the **Power BI** area, click **This year in sales – in Retail Analysis Sample**. Cortana returns your custom report. - ![Cortana at work, showing your custom report from Power BI](../images/cortana-powerbi-myreport.png) + ![Cortana at work, showing your custom report from Power BI.](../images/cortana-powerbi-myreport.png) >[!NOTE] >For more info about how to connect your own data, build your own custom Power BI cards and Answer Pages for Cortana, and how to share the cards with everyone in your organization, see [Use Power BI to create a custom Answer Page for Cortana](https://powerbi.microsoft.com/documentation/powerbi-service-cortana-desktop-entity-cards/). diff --git a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md index 478aeb7938..c701623a88 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-voice-commands.md @@ -49,7 +49,7 @@ While these aren't line-of-business apps, we've worked to make sure to implement 2. Click on **Connected Services**, click **Uber**, and then click **Connect**. - ![Cortana at work, showing where to connect the Uber service to Cortana](../images/cortana-connect-uber.png) + ![Cortana at work, showing where to connect the Uber service to Cortana.](../images/cortana-connect-uber.png) **To use the voice-enabled commands with Cortana** 1. Click on the **Cortana** icon in the taskbar, and then click the **Microphone** icon (to the right of the **Search** box). diff --git a/windows/configuration/customize-and-export-start-layout.md b/windows/configuration/customize-and-export-start-layout.md index 601ad70810..f50e213ce8 100644 --- a/windows/configuration/customize-and-export-start-layout.md +++ b/windows/configuration/customize-and-export-start-layout.md @@ -161,7 +161,7 @@ When you have the Start layout that you want your users to see, use the [Export- A partial Start layout enables you to add one or more customized tile groups to users' Start screens or menus, while still allowing users to make changes to other parts of the Start layout. All groups that you add are *locked*, meaning users cannot change the contents of those tile groups, however users can change the location of those groups. Locked groups are identified with an icon, as shown in the following image. -![locked tile group](images/start-pinned-app.png) +![locked tile group.](images/start-pinned-app.png) When a partial Start layout is applied for the first time, the new groups are added to the users' existing Start layouts. If an app tile is in both an existing group and in a new locked group, the duplicate app tile is removed from the existing (unlocked) group. diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md index 12f62c8444..7b7dcaed64 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-group-policy.md @@ -92,13 +92,13 @@ This procedure adds the customized Start and taskbar layout to the user configur 2. Go to **User Configuration** or **Computer Configuration** > **Administrative Templates** >**Start Menu and Taskbar**. - ![start screen layout policy settings](images/starttemplate.jpg) + ![start screen layout policy settings.](images/starttemplate.jpg) 3. Right-click **Start Layout** in the right pane, and click **Edit**. This opens the **Start Layout** policy settings. - ![policy settings for start screen layout](images/startlayoutpolicy.jpg) + ![policy settings for start screen layout.](images/startlayoutpolicy.jpg) 4. Enter the following settings, and then click **OK**: diff --git a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md index ea856b24cd..42b70e6248 100644 --- a/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md +++ b/windows/configuration/customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md @@ -87,7 +87,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted](images/customization-start.png) + ![Customizations file with the placeholder text to replace highlighted.](images/customization-start.png) 7. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). diff --git a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md index aa195fb89f..f5540c6ddd 100644 --- a/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md +++ b/windows/configuration/find-the-application-user-model-id-of-an-installed-app.md @@ -50,7 +50,7 @@ To get the names and AUMIDs for all apps installed for the current user, perform 3. In the **Choose Details** window, select **AppUserModelId**, and then select **OK**. (You might need to change the **View** setting from **Tiles** to **Details**.) -![Image of the Choose Details options](images/aumid-file-explorer.png) +![Image of the Choose Details options.](images/aumid-file-explorer.png) ## To find the AUMID of an installed app for the current user by using the registry diff --git a/windows/configuration/kiosk-methods.md b/windows/configuration/kiosk-methods.md index bd502511d7..9efa2b652d 100644 --- a/windows/configuration/kiosk-methods.md +++ b/windows/configuration/kiosk-methods.md @@ -24,13 +24,13 @@ Some desktop devices in an enterprise serve a special purpose, such as a PC in t A single-app kiosk is ideal for public use. Using [Shell Launcher](kiosk-shelllauncher.md), you can configure a kiosk device that runs a Windows desktop application as the user interface. The application that you specify replaces the default shell (explorer.exe) that usually runs when a user logs on. This type of single-app kiosk does not run above the lockscreen. - ![Illustration of a full-screen kiosk experience](images/kiosk-fullscreen.png) + ![Illustration of a full-screen kiosk experience.](images/kiosk-fullscreen.png) - **A multi-app kiosk**, which runs one or more apps from the desktop. People using the kiosk see a customized Start that shows only the tiles for the apps that are allowed. With this approach, you can configure a locked-down experience for different account types. A multi-app kiosk is appropriate for devices that are shared by multiple people. When you configure a multi-app kiosk, [specific policies are enforced](kiosk-policies.md) that will affect **all** non-administrator users on the device. - ![Illustration of a kiosk Start screen](images/kiosk-desktop.png) + ![Illustration of a kiosk Start screen.](images/kiosk-desktop.png) Kiosk configurations are based on **Assigned Access**, a feature in Windows 10 that allows an administrator to manage the user's experience by limiting the application entry points exposed to the user. @@ -38,25 +38,25 @@ There are several kiosk configuration methods that you can choose from, dependin - **Which type of app will your kiosk run?** - ![icon that represents apps](images/office-logo.png) + ![icon that represents apps.](images/office-logo.png) Your kiosk can run a Universal Windows Platform (UWP) app or a Windows desktop application. For [digital signage](setup-digital-signage.md), simply select a digital sign player as your kiosk app. [Check out the guidelines for kiosk apps.](guidelines-for-assigned-access-app.md) - **Which type of kiosk do you need?** - ![icon that represents a kiosk](images/kiosk.png) + ![icon that represents a kiosk.](images/kiosk.png) If you want your kiosk to run a single app for anyone to see or use, consider a single-app kiosk that runs either a [Universal Windows Platform (UWP) app](#uwp) or a [Windows desktop application](#classic). For a kiosk that people can sign in to with their accounts or that runs more than one app, choose [a multi-app kiosk](#desktop). - **Which edition of Windows 10 will the kiosk run?** - ![icon that represents Windows](images/windows.png) + ![icon that represents Windows.](images/windows.png) All of the configuration methods work for Windows 10 Enterprise and Education; some of the methods work for Windows 10 Pro. Kiosk mode is not available on Windows 10 Home. - **Which type of user account will be the kiosk account?** - ![icon that represents a user account](images/user.png) + ![icon that represents a user account.](images/user.png) The kiosk account can be a local standard user account, a local administrator account, a domain account, or an Azure Active Directory (Azure AD) account, depending on the method that you use to configure the kiosk. If you want people to sign in and authenticate on the device, you should use a multi-app kiosk configuration. The single-app kiosk configuration doesn't require people to sign in to the device, although they can sign in to the kiosk app if you select an app that has a sign-in method. diff --git a/windows/configuration/kiosk-prepare.md b/windows/configuration/kiosk-prepare.md index 154b35c3d0..ba1aaa2b58 100644 --- a/windows/configuration/kiosk-prepare.md +++ b/windows/configuration/kiosk-prepare.md @@ -54,7 +54,7 @@ Disable removable media. | Go to **Group Policy Editor** > **Computer Con Logs can help you [troubleshoot issues](./kiosk-troubleshoot.md) kiosk issues. Logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. -![Event Viewer, right-click Operational, select enable log](images/enable-assigned-access-log.png) +![Event Viewer, right-click Operational, select enable log.](images/enable-assigned-access-log.png) ## Automatic logon @@ -257,7 +257,7 @@ A single-app kiosk configuration runs an app above the lock screen. It doesn't w When you connect to a VM configured as a single-app kiosk, you need a *basic* session rather than an enhanced session. In the following image, notice that **Enhanced session** is not selected in the **View** menu; that means it's a basic session. -![VM windows, View menu, Extended session is not selected](images/vm-kiosk.png) +![VM windows, View menu, Extended session is not selected.](images/vm-kiosk.png) To connect to a VM in a basic session, do not select **Connect** in the connection dialog, as shown in the following image, but instead, select the **X** button in the upper-right corner to cancel the dialog. diff --git a/windows/configuration/kiosk-shelllauncher.md b/windows/configuration/kiosk-shelllauncher.md index f510b637bd..73e724bd75 100644 --- a/windows/configuration/kiosk-shelllauncher.md +++ b/windows/configuration/kiosk-shelllauncher.md @@ -137,7 +137,7 @@ The OMA-URI path is `./Device/Vendor/MSFT/AssignedAccess/ShellLauncher`. For the value, you can select data type `String` and paste the desired configuration file content into the value box. If you wish to upload the xml instead of pasting the content, choose data type `String (XML file)`. -![Screenshot of custom OMA-URI settings](images/slv2-oma-uri.png) +![Screenshot of custom OMA-URI settings.](images/slv2-oma-uri.png) After you configure the profile containing the custom Shell Launcher setting, select **All Devices** or selected groups of devices to apply the profile to. Don't assign the profile to users or user groups. diff --git a/windows/configuration/kiosk-single-app.md b/windows/configuration/kiosk-single-app.md index 8baee6a466..eac49be093 100644 --- a/windows/configuration/kiosk-single-app.md +++ b/windows/configuration/kiosk-single-app.md @@ -24,7 +24,7 @@ ms.topic: article A single-app kiosk uses the Assigned Access feature to run a single app above the lockscreen. When the kiosk account signs in, the app is launched automatically. The person using the kiosk cannot do anything on the device outside of the kiosk app. -![Illustration of a single-app kiosk experience](images/kiosk-fullscreen-sm.png) +![Illustration of a single-app kiosk experience.](images/kiosk-fullscreen-sm.png) >[!IMPORTANT] >[User account control (UAC)](/windows/security/identity-protection/user-account-control/user-account-control-overview) must be turned on to enable kiosk mode. @@ -66,7 +66,7 @@ When your kiosk is a local device that is not managed by Active Directory or Azu - If you do not want the kiosk account signed in automatically when the device restarts, you must change the default setting before you configure the device as a kiosk. Sign in with the account that you will assign as the kiosk account, go to **Settings** > **Accounts** > **Sign-in options**, and toggle the **Use my sign-in info to automatically finish setting up my device after an update or restart** setting to **Off**. After you change the setting, you can apply the kiosk configuration to the device. -![Screenshot of automatic sign-in setting](images/auto-signin.png) +![Screenshot of automatic sign-in setting.](images/auto-signin.png) ### Instructions for Windows 10, version 1809 @@ -98,7 +98,7 @@ To remove assigned access, select the account tile on the **Set up a kiosk** pag When you set up a kiosk (also known as *assigned access*) in **Settings** for Windows 10, version 1803 and earlier, you must select an existing local standard user account. [Learn how to create a local standard user account.](https://support.microsoft.com/help/4026923/windows-create-a-local-user-or-administrator-account-in-windows-10) -![The Set up assigned access page in Settings](images/kiosk-settings.png) +![The Set up assigned access page in Settings.](images/kiosk-settings.png) **To set up assigned access in PC settings** @@ -131,7 +131,7 @@ To remove assigned access, choose **Turn off assigned access and sign out of the > >Account type: Local standard user -![PowerShell windows displaying Set-AssignedAccess cmdlet](images/set-assignedaccess.png) +![PowerShell windows displaying Set-AssignedAccess cmdlet.](images/set-assignedaccess.png) You can use any of the following PowerShell cmdlets to set up assigned access on multiple devices. @@ -191,7 +191,7 @@ Clear-AssignedAccess > >Account type: Local standard user, Active Directory -![Kiosk wizard option in Windows Configuration Designer](images/kiosk-wizard.png) +![Kiosk wizard option in Windows Configuration Designer.](images/kiosk-wizard.png) >[!IMPORTANT] diff --git a/windows/configuration/kiosk-troubleshoot.md b/windows/configuration/kiosk-troubleshoot.md index 75781737fb..e34bee8204 100644 --- a/windows/configuration/kiosk-troubleshoot.md +++ b/windows/configuration/kiosk-troubleshoot.md @@ -53,7 +53,7 @@ For example: 3. Verify that the configuration XML file is authored and formatted correctly. Correct any configuration errors, then create and apply a new provisioning package. Sign out and sign in again to check the new configuration. 4. Additional logs about configuration and runtime issues can be obtained by enabling the **Applications and Services Logs\Microsoft\Windows\AssignedAccess\Operational** channel, which is disabled by default. -![Event Viewer, right-click Operational, select enable log](images/enable-assigned-access-log.png) +![Event Viewer, right-click Operational, select enable log.](images/enable-assigned-access-log.png) ### Automatic logon issues diff --git a/windows/configuration/lock-down-windows-10-applocker.md b/windows/configuration/lock-down-windows-10-applocker.md index c2221b549a..5c2cfa795b 100644 --- a/windows/configuration/lock-down-windows-10-applocker.md +++ b/windows/configuration/lock-down-windows-10-applocker.md @@ -34,7 +34,7 @@ AppLocker rules are organized into collections based on file format. If no AppLo This topic describes how to lock down apps on a local device. You can also use AppLocker to set rules for applications in a domain by using Group Policy. -![install create lockdown customize](images/lockdownapps.png) +![install create lockdown customize.](images/lockdownapps.png) ## Install apps @@ -50,13 +50,13 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 2. Go to **Security Settings** > **Application Control Policies** > **AppLocker**, and select **Configure rule enforcement**. - ![configure rule enforcement](images/apprule.png) + ![configure rule enforcement.](images/apprule.png) 3. Check **Configured** under **Executable rules**, and then click **OK**. 4. Right-click **Executable Rules** and then click **Automatically generate rules**. - ![automatically generate rules](images/genrule.png) + ![automatically generate rules.](images/genrule.png) 5. Select the folder that contains the apps that you want to permit, or select C:\\ to analyze all apps. @@ -68,7 +68,7 @@ After you install the desired apps, set up AppLocker rules to only allow specifi 9. Read the message and click **Yes**. - ![default rules warning](images/appwarning.png) + ![default rules warning.](images/appwarning.png) 10. (optional) If you want a rule to apply to a specific set of users, right-click on the rule and select **Properties**. Then use the dialog to choose a different user or group of users. diff --git a/windows/configuration/lock-down-windows-10-to-specific-apps.md b/windows/configuration/lock-down-windows-10-to-specific-apps.md index 702221c085..2bbcd7f1a3 100644 --- a/windows/configuration/lock-down-windows-10-to-specific-apps.md +++ b/windows/configuration/lock-down-windows-10-to-specific-apps.md @@ -81,7 +81,7 @@ Let's start by looking at the basic structure of the XML file. - A profile has no effect if it’s not associated to a config section. - ![profile = app and config = account](images/profile-config.png) + ![profile = app and config = account.](images/profile-config.png) You can start your file by pasting the following XML (or any other examples in this topic) into a XML editor, and saving the file as *filename*.xml. Each section of this XML is explained in this topic. You can see a full sample version in the [Assigned access XML reference.](kiosk-xml.md) @@ -271,7 +271,7 @@ This example pins Groove Music, Movies & TV, Photos, Weather, Calculator, Paint, >[!NOTE] >If an app is not installed for the user but is included in the Start layout XML, the app will not be shown on the Start screen. -![What the Start screen looks like when the XML sample is applied](images/sample-start.png) +![What the Start screen looks like when the XML sample is applied.](images/sample-start.png) ##### Taskbar @@ -494,7 +494,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 7. In the center pane, click **Browse** to locate and select the assigned access configuration XML file that you created. - ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer](images/multiappassignedaccesssettings.png) + ![Screenshot of the MultiAppAssignedAccessSettings field in Windows Configuration Designer.](images/multiappassignedaccesssettings.png) 8. (**Optional**: If you want to apply the provisioning package after device initial setup and there is an admin user already available on the kiosk device, skip this step.) Create an admin user account in **Runtime settings** > **Accounts** > **Users**. Provide a **UserName** and **Password**, and select **UserGroup** as **Administrators**. With this account, you can view the provisioning status and logs if needed. @@ -544,7 +544,7 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](images/oobe.jpg) + ![The first screen to set up a new PC.](images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -552,11 +552,11 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](images/prov.jpg) + ![Provision this device.](images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](images/choose-package.png) + ![Choose a package.](images/choose-package.png) 5. Select **Yes, add it**. @@ -570,7 +570,7 @@ Provisioning packages can be applied to a device during the first-run experience >[!NOTE] >if your provisioning package doesn’t include the assigned access user account creation, make sure the account you specified in the multi-app configuration XML exists on the device. -![add a package option](images/package.png) +![add a package option.](images/package.png) ### Use MDM to deploy the multi-app configuration diff --git a/windows/configuration/manage-wifi-sense-in-enterprise.md b/windows/configuration/manage-wifi-sense-in-enterprise.md index d577b69cff..6dc4c73ddb 100644 --- a/windows/configuration/manage-wifi-sense-in-enterprise.md +++ b/windows/configuration/manage-wifi-sense-in-enterprise.md @@ -46,7 +46,7 @@ You can manage your Wi-Fi Sense settings by using Group Policy and your Group Po 1. Open your Group Policy editor and go to the `Computer Configuration\Administrative Templates\Network\WLAN Service\WLAN Settings\Allow Windows to automatically connect to suggested open hotspots, to networks shared by contacts, and to hotspots offering paid services` setting. - ![Group Policy Editor, showing the Wi-Fi Sense setting](images/wifisense-grouppolicy.png) + ![Group Policy Editor, showing the Wi-Fi Sense setting.](images/wifisense-grouppolicy.png) 2. Turn Wi-Fi Sense on (enabled) or off (disabled), based on your company's environment. @@ -60,7 +60,7 @@ You can manage your Wi-Fi Sense settings by using registry keys and the Registry 2. Create and set a new **DWORD (32-bit) Value** named, **AutoConnectAllowedOEM**, with a **Value data** of **0 (zero)**.

Setting this value to 0 turns off Wi-Fi Sense and all Wi-Fi sense features. When turned off, the Wi-Fi Sense settings still appear on the Wi-Fi Settings screen, but can't be controlled by the employee and all of the Wi-Fi Sense features are turned off. For more info, see How to configure Wi-Fi Sense on Windows 10 in an enterprise. - ![Registry Editor, showing the creation of a new DWORD value](images/wifisense-registry.png) + ![Registry Editor, showing the creation of a new DWORD value.](images/wifisense-registry.png) ### Using the Windows Provisioning settings You can manage your Wi-Fi Sense settings by changing the Windows provisioning setting, **WiFISenseAllowed**. @@ -81,7 +81,7 @@ If your company still uses Unattend, you can manage your Wi-Fi Sense settings by ### How employees can change their own Wi-Fi Sense settings If you don’t turn off the ability for your employees to use Wi-Fi Sense, they can turn it on locally by selecting **Settings > Network & Internet > Wi-Fi > Manage Wi-Fi settings**, and then turning on **Connect to suggested open hotspots**. -![Wi-Fi Sense options shown to employees if it's not turned off](images/wifisense-settingscreens.png) +![Wi-Fi Sense options shown to employees if it's not turned off.](images/wifisense-settingscreens.png) **Important**
The service that was used to share networks with Facebook friends, Outlook.com contacts, or Skype contacts is no longer available. This means: diff --git a/windows/configuration/mobile-devices/lockdown-xml.md b/windows/configuration/mobile-devices/lockdown-xml.md index ecf485cb1d..87f2b7b7cf 100644 --- a/windows/configuration/mobile-devices/lockdown-xml.md +++ b/windows/configuration/mobile-devices/lockdown-xml.md @@ -62,7 +62,7 @@ The settings for the Default role and other roles must be listed in your XML fil ## Action Center -![XML for Action Center](../images/ActionCenterXML.jpg) +![XML for Action Center.](../images/ActionCenterXML.jpg) The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. @@ -92,7 +92,7 @@ The following example is a complete lockdown XML file that disables Action Cente ## Apps -![XML for Apps](../images/AppsXML.png) +![XML for Apps.](../images/AppsXML.png) The Apps setting serves as an allow list and specifies the applications that will be available in the All apps list. Apps that are not included in this setting are hidden from the user and blocked from running. @@ -110,7 +110,7 @@ The following example makes Outlook Calendar available on the device. When you list an app, you can also set the app to be pinned to the Start screen by specifying the tile size and location. Tip: draw a grid and mark your app tiles on it to make sure you get the result you want. The width (X axis) in the following example is the limit for Windows 10 Mobile, but the length (Y axis) is unlimited. The number of columns available to you depends on the value for [StartScreenSize](#start-screen-size). -![Grid to lay out tiles for Start](../images/StartGrid.jpg) +![Grid to lay out tiles for Start.](../images/StartGrid.jpg) Tile sizes are: * Small: 1x1 @@ -152,7 +152,7 @@ In the following example, Outlook Calendar and Outlook Mail are pinned to the St That layout would appear on a device like this: -![Example of the layout on a Start screen](../images/StartGridPinnedApps.jpg) +![Example of the layout on a Start screen.](../images/StartGridPinnedApps.jpg) You can create and pin folders to Start by using the Apps setting. Each folder requires a **folderId**, which must be a consecutive positive integer starting with `1`. You can also specify a **folderName** (optional) which will be displayed on Start. @@ -203,7 +203,7 @@ When an app is contained in a folder, its **PinToStart** configuration (tile siz ## Buttons -![XML for buttons](../images/ButtonsXML.jpg) +![XML for buttons.](../images/ButtonsXML.jpg) In the Buttons setting, you use ButtonLockdownList to disable hardware buttons and ButtonRemapList to change button events to open an app that you specify. @@ -213,11 +213,11 @@ When a user taps a button that is in the lockdown list, nothing will happen. The Button | Press | PressAndHold | All ---|:---:|:---:|:--:|- -Start | ![no](../images/crossmark.png) | ![yes](../images/checkmark.png) | ![no](../images/crossmark.png) -Back | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Search | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Camera | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) -Custom 1, 2, and 3 | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Start | ![no.](../images/crossmark.png) | ![yes](../images/checkmark.png) | ![no](../images/crossmark.png) +Back | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Search | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Camera | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) +Custom 1, 2, and 3 | ![yes.](../images/checkmark.png) | ![yes](../images/checkmark.png) | ![yes](../images/checkmark.png) > [!NOTE] > Custom buttons are hardware buttons that can be added to devices by OEMs. @@ -270,7 +270,7 @@ In the following example, when a user presses the Search button, the phone diale ## CSPRunner -![XML for CSP Runner](../images/CSPRunnerXML.jpg) +![XML for CSP Runner.](../images/CSPRunnerXML.jpg) You can use CSPRunner to include settings that are not defined in AssignedAccessXML. For example, you can include settings from other sections of EnterpriseAssignedAccess CSP, such as lockscreen, theme, and time zone. You can also include settings from other CSPs, such as [Wi-Fi CSP](/windows/client-management/mdm/wifi-csp) or [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). @@ -317,7 +317,7 @@ SyncML entry | Description ## Menu items -![XML for menu items](../images/MenuItemsXML.png) +![XML for menu items.](../images/MenuItemsXML.png) Use DisableMenuItems to prevent use of the context menu, which is displayed when a user presses and holds an application in the All Apps list. You can include this entry in the default profile and in any additional user role profiles that you create. @@ -329,7 +329,7 @@ Use DisableMenuItems to prevent use of the context menu, which is displayed when ## Settings -![XML for settings](../images/SettingsXML.png) +![XML for settings.](../images/SettingsXML.png) The **Settings** section contains an `allow` list of pages in the Settings app and quick actions. The following example allows all settings. @@ -363,7 +363,7 @@ For a list of the settings and quick actions that you can allow or block, see [S ## Tiles - ![XML for tiles](../images/TilesXML.png) + ![XML for tiles.](../images/TilesXML.png) By default, under Assigned Access, tile manipulation is turned off (blocked) and only available if enabled in the user’s profile. If tile manipulation is enabled in the user’s profile, they can pin/unpin, move, and resize tiles based on their preferences. When multiple people use one device and you want to enable tile manipulation for multiple users, you must enable it for each user in their user profile. @@ -446,7 +446,7 @@ Use the Windows ICD tool included in the Windows Assessment and Deployment Kit ( 3. In the center pane, click **Browse** to locate and select the lockdown XML file that you created. - ![browse button](../images/icdbrowse.png) + ![browse button.](../images/icdbrowse.png) 4. On the **File** menu, select **Save.** diff --git a/windows/configuration/mobile-devices/mobile-lockdown-designer.md b/windows/configuration/mobile-devices/mobile-lockdown-designer.md index 68774e0da5..a7d82f6088 100644 --- a/windows/configuration/mobile-devices/mobile-lockdown-designer.md +++ b/windows/configuration/mobile-devices/mobile-lockdown-designer.md @@ -16,7 +16,7 @@ manager: dansimp # Use the Lockdown Designer app to create a Lockdown XML file -![Lockdown Designer in the Store](../images/ldstore.png) +![Lockdown Designer in the Store.](../images/ldstore.png) Windows 10 Mobile allows enterprises to lock down a device, define multiple user roles, and configure custom layouts on a device. For example, the enterprise can lock down a device so that only applications and settings in an allow list are available. This is accomplished using Lockdown XML, an XML file that contains settings for Windows 10 Mobile. @@ -55,7 +55,7 @@ Perform these steps on the device running Windows 10 Mobile that you will use to >[!IMPORTANT] >Check **Settings > Personalization > Start > Show more tiles** on the test mobile device. If **Show more tiles** is **On**, you must select **Large** on the [**Start screen** page](#start) in Lockdown Designer. If you want to apply a **Small** layout, set **Show more tiles** on the test mobile device to **Off**. > ->![turn off show more tiles for small start screen size](../images/show-more-tiles.png) +>![turn off show more tiles for small start screen size.](../images/show-more-tiles.png) ## Prepare the PC @@ -89,7 +89,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 3. Click **Pair**. - ![Pair](../images/ld-pair.png) + ![Pair.](../images/ld-pair.png) **Connect to remote device** appears. @@ -99,7 +99,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 6. Next, click **Sync** to pull information from the device in to Lockdown Designer. - ![Sync](../images/ld-sync.png) + ![Sync.](../images/ld-sync.png) 7. Click the **Save** icon and enter a name for your project. @@ -113,7 +113,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 3. On the **Project setting** > **General settings** page, click **Pair**. - ![Pair](../images/ld-pair.png) + ![Pair.](../images/ld-pair.png) **Connect to remote device** appears. @@ -123,7 +123,7 @@ If you want to connect the PC and the test mobile device using a USB cable, perf 6. Next, click **Sync** to pull information from the device in to Lockdown Designer. - ![Sync](../images/ld-sync.png) + ![Sync.](../images/ld-sync.png) 7. Click the **Save** icon and enter a name for your project. @@ -134,13 +134,13 @@ The apps and settings available in the pages of Lockdown Designer should now be | Page | Description | | --- | --- | -| ![Applications](../images/ld-apps.png) | Each app from the test mobile device is listed. Select the apps that you want visible to users.

You can select an app to run automatically when a user signs in to the device. The **Select Auto-Run** menu is populated by the apps that you select to allow on the device. | -| ![CSP Runner](../images/ld-csp.png) | CSPRunner enables you to include settings and policies that are not defined in other sections of the app. To make use of CSPRunner, you must create the SyncML block that contains the settings, and then import the SyncML in Lockdown Designer. [Learn how to use CSPRunner and author SyncML.](lockdown-xml.md#csprunner) | -| ![Settings](../images/ld-settings.png) | On this page, you select the settings that you want visible to users. See the [ms settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to see which Settings page maps to a URI. | -| ![Quick actions](../images/ld-quick.png) | On this page, you select the settings that you want visible to users. | -| ![Buttons](../images/ld-buttons.png) | Each hardware button on a mobile device has different actions that can be disabled. In addition, the behavior for **Search** button can be changed to open an app other than **Search**.

Some devices may have additional hardware buttons provided by the OEM. These are listed as Custom1, Custom2, and Custom3. If your device has custom hardware buttons, contact your equipment provider to identify how their custom buttons are defined. | -| ![Other settings](../images/ld-other.png) | This page contains several settings that you can configure:

- The context menu is displayed when a user presses and holds an application in the All Apps list. You can enable or disable the context menu.

- Tile manipulation allows users to pin, unpin, move, and resize tiles on the Start screen. You can enable or disable tile manipulation.

- The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. | -| ![Start screen](../images/ld-start.png) | On this page, you can start a remote simulation session with the test mobile device. Click **Start remote simulation**. You will see a **Start screen remote simulation in progress** message on the PC. (If the **Start remote simulation** button is not active, [pair the mobile device with the PC again](#pair).)

On the test mobile device, tiles for the apps that you allowed on the **Applications** page are displayed on the screen. You can move, resize, or unpin these tiles to achieve the desired layout.

When you are done changing the layout on the test mobile device, click **Accept** on the PC. | +| ![Applications.](../images/ld-apps.png) | Each app from the test mobile device is listed. Select the apps that you want visible to users.

You can select an app to run automatically when a user signs in to the device. The **Select Auto-Run** menu is populated by the apps that you select to allow on the device. | +| ![CSP Runner.](../images/ld-csp.png) | CSPRunner enables you to include settings and policies that are not defined in other sections of the app. To make use of CSPRunner, you must create the SyncML block that contains the settings, and then import the SyncML in Lockdown Designer. [Learn how to use CSPRunner and author SyncML.](lockdown-xml.md#csprunner) | +| ![Settings.](../images/ld-settings.png) | On this page, you select the settings that you want visible to users. See the [ms settings: URI scheme reference](/windows/uwp/launch-resume/launch-settings-app#ms-settings-uri-scheme-reference) to see which Settings page maps to a URI. | +| ![Quick actions.](../images/ld-quick.png) | On this page, you select the settings that you want visible to users. | +| ![Buttons.](../images/ld-buttons.png) | Each hardware button on a mobile device has different actions that can be disabled. In addition, the behavior for **Search** button can be changed to open an app other than **Search**.

Some devices may have additional hardware buttons provided by the OEM. These are listed as Custom1, Custom2, and Custom3. If your device has custom hardware buttons, contact your equipment provider to identify how their custom buttons are defined. | +| ![Other settings.](../images/ld-other.png) | This page contains several settings that you can configure:

- The context menu is displayed when a user presses and holds an application in the All Apps list. You can enable or disable the context menu.

- Tile manipulation allows users to pin, unpin, move, and resize tiles on the Start screen. You can enable or disable tile manipulation.

- The Action Center setting controls whether the user can open the Action Center on the device. When the Action Center is disabled, notifications on the lockscreen and toasts are also disabled. You can use optional attributes with the Action Center element to change that behavior for either notifications, toasts, or both. | +| ![Start screen.](../images/ld-start.png) | On this page, you can start a remote simulation session with the test mobile device. Click **Start remote simulation**. You will see a **Start screen remote simulation in progress** message on the PC. (If the **Start remote simulation** button is not active, [pair the mobile device with the PC again](#pair).)

On the test mobile device, tiles for the apps that you allowed on the **Applications** page are displayed on the screen. You can move, resize, or unpin these tiles to achieve the desired layout.

When you are done changing the layout on the test mobile device, click **Accept** on the PC. | ## Validate and export @@ -169,4 +169,4 @@ You can create additional roles for the device and have unique configurations fo 4. Configure the settings for the role as above, but make sure on each page that you select the correct role. - ![Current role selection box](../images/ld-role.png) \ No newline at end of file + ![Current role selection box.](../images/ld-role.png) \ No newline at end of file diff --git a/windows/configuration/mobile-devices/provisioning-configure-mobile.md b/windows/configuration/mobile-devices/provisioning-configure-mobile.md index 1d321fd9cb..ebd4218503 100644 --- a/windows/configuration/mobile-devices/provisioning-configure-mobile.md +++ b/windows/configuration/mobile-devices/provisioning-configure-mobile.md @@ -66,13 +66,13 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us 1. Insert an SD card containing the provisioning package into the device. 2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. - ![add a package option](../images/packages-mobile.png) + ![add a package option.](../images/packages-mobile.png) 3. Click **Add**. 4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) ### Copying the provisioning package to the device @@ -82,7 +82,7 @@ You can apply a provisioning package to a device running Windows 10 Mobile by us 3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) ## Related topics diff --git a/windows/configuration/mobile-devices/provisioning-nfc.md b/windows/configuration/mobile-devices/provisioning-nfc.md index 571a1488af..42ff3ff229 100644 --- a/windows/configuration/mobile-devices/provisioning-nfc.md +++ b/windows/configuration/mobile-devices/provisioning-nfc.md @@ -31,7 +31,7 @@ All Windows 10 Mobile Enterprise and Windows 10 Mobile images have the NFC provi On all Windows devices, device provisioning during OOBE can be triggered by 5 fast taps on the Windows hardware key, which shows the **Provision this device** screen. In the **Provision this device** screen, select **NFC** for NFC-based provisioning. -![Example of Provision this device screen](../images/nfc.png) +![Example of Provision this device screen.](../images/nfc.png) If there is an error during NFC provisioning, the device will show a message if any of the following errors occur: diff --git a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md index 711f3cfc4e..a265a544e3 100644 --- a/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md +++ b/windows/configuration/mobile-devices/set-up-a-kiosk-for-windows-10-for-mobile-edition.md @@ -168,28 +168,28 @@ Apps Corner lets you set up a custom Start screen on your Windows 10 Mobile or **To set up Apps Corner** -1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner**. +1. On Start ![start.](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner**. -2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon](images/doneicon.png). +2. Tap **Apps**, tap to select the app that you want people to use in the kiosk mode, and then tap done ![done icon.](images/doneicon.png). -3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back](../images/backicon.png) to the Apps Corner settings. +3. If your phone doesn't already have a lock screen password, you can set one now to ensure that people can't get to your Start screen from Apps Corner. Tap **Protect my phone with a password**, click **Add**, type a PIN in the **New PIN** box, type it again in the **Confirm PIN** box, and then tap **OK**. Press **Back** ![back.](../images/backicon.png) to the Apps Corner settings. 4. Turn **Action center** on or off, depending on whether you want people to be able to use these features when using the device in kiosk mode. 5. Tap **advanced**, and then turn features on or off, depending on whether you want people to be able to use them. -6. Press **Back** ![back](../images/backicon.png) when you're done. +6. Press **Back** ![back.](../images/backicon.png) when you're done. **To use Apps Corner** -1. On Start ![start](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). +1. On Start ![start.](../images/starticon.png), swipe over to the App list, then tap **Settings** ![settings](../images/settingsicon.png) > **Accounts** > **Apps Corner** > launch ![launch](../images/launchicon.png). >[!TIP] >Want to get to Apps Corner with one tap? In **Settings**, tap **Apps Corner** > **pin** to pin the Apps Corner tile to your Start screen. 2. Give the device to someone else, so they can use the device and only the one app you chose. -3. When they're done and you get the device back, press and hold Power ![power](../images/powericon.png), and then swipe right to exit Apps Corner. +3. When they're done and you get the device back, press and hold Power ![power.](../images/powericon.png), and then swipe right to exit Apps Corner. ## Related topics diff --git a/windows/configuration/mobile-devices/start-layout-xml-mobile.md b/windows/configuration/mobile-devices/start-layout-xml-mobile.md index 41fc17fe04..858de39174 100644 --- a/windows/configuration/mobile-devices/start-layout-xml-mobile.md +++ b/windows/configuration/mobile-devices/start-layout-xml-mobile.md @@ -36,7 +36,7 @@ On Windows 10 Mobile, the customized Start works by: The following diagrams show the default Windows 10, version 1607 Start layouts for single SIM and dual SIM devices with Cortana support, and single SIM and dual SIM devices with no Cortana support. -![Start layout for Windows 10 Mobile](../images/mobile-start-layout.png) +![Start layout for Windows 10 Mobile.](../images/mobile-start-layout.png) The diagrams show: diff --git a/windows/configuration/provisioning-apn.md b/windows/configuration/provisioning-apn.md index 326ea5b8b8..a8d47b38e2 100644 --- a/windows/configuration/provisioning-apn.md +++ b/windows/configuration/provisioning-apn.md @@ -53,11 +53,11 @@ For users who work in different locations, you can configure one APN to connect 5. Enter a name for the connection, and then click **Add**. - ![Example of APN connection name](images/apn-add.png) + ![Example of APN connection name.](images/apn-add.png) 6. The connection appears in the **Available customizations** pane. Select it to view the settings that you can configure for the connection. - ![settings for new connection](images/apn-add-details.png) + ![settings for new connection.](images/apn-add-details.png) 7. The following table describes the settings available for the connection. diff --git a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md index 67c28a8b90..38d6791423 100644 --- a/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md +++ b/windows/configuration/provisioning-packages/how-it-pros-can-use-configuration-service-providers.md @@ -38,7 +38,7 @@ Each CSP provides access to specific settings. For example, the [Wi-Fi CSP](/win CSPs are behind many of the management tasks and policies for Windows 10, both in Microsoft Intune and in non-Microsoft MDM service providers. For example, in Intune, the policy to allow search suggestions in the Microsoft Edge address bar uses **Browser/AllowSearchSuggestionsinAddressBar** in the [Policy CSP](/windows/client-management/mdm/policy-configuration-service-provider). -![how intune maps to csp](../images/policytocsp.png) +![how intune maps to csp.](../images/policytocsp.png) CSPs receive configuration policies in the XML-based Synchronization Markup Language (SyncML) format, pushed from an MDM-compliant management server, such as Microsoft Intune. Traditional enterprise management systems, such as Microsoft Endpoint Configuration Manager, can also target CSPs, by using a client-side Windows Management Instrumentation (WMI)-to-CSP Bridge. @@ -66,7 +66,7 @@ You can use Windows Configuration Designer to create [provisioning packages](./p Many settings in Windows Configuration Designer will display documentation for that setting in the center pane, and will include a reference to the CSP if the setting uses one, as shown in the following image. -![how help content appears in icd](../images/cspinicd.png) +![how help content appears in icd.](../images/cspinicd.png) [Provisioning packages in Windows 10](provisioning-packages.md) explains how to use the Windows Configuration Designer tool to create a runtime provisioning package. @@ -86,7 +86,7 @@ All CSPs in Windows 10 are documented in the [Configuration service provider ref The [main CSP topic](/windows/client-management/mdm/configuration-service-provider-reference) tells you which CSPs are supported on each edition of Windows 10, and links to the documentation for each individual CSP. -![csp per windows edition](../images/csptable.png) +![csp per windows edition.](../images/csptable.png) The documentation for each CSP follows the same structure. After an introduction that explains the purpose of the CSP, a diagram shows the parts of the CSP in tree format. @@ -94,7 +94,7 @@ The full path to a specific configuration setting is represented by its Open Mob The following example shows the diagram for the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). The diagram maps to the XML for that CSP. Notice the different shapes in the diagram: rounded elements are nodes, and rectangular elements are settings or policies for which a value must be supplied. -![assigned access csp tree](../images/provisioning-csp-assignedaccess.png) +![assigned access csp tree.](../images/provisioning-csp-assignedaccess.png) The element in the tree diagram after the root node tells you the name of the CSP. Knowing this structure, you would recognize in XML the parts of the URI path for that CSP and, if you saw it in XML, you would know which CSP reference to look up. For example, in the following OMS-URI path for the kiosk mode app settings, you can see that it uses the [AssignedAccess CSP](/windows/client-management/mdm/assignedaccess-csp). @@ -104,7 +104,7 @@ The element in the tree diagram after the root node tells you the name of the CS When an element in the diagram uses _italic_ font, it indicates a placeholder for specific information, such as the tenant ID in the following example. -![placeholder in csp tree](../images/csp-placeholder.png) +![placeholder in csp tree.](../images/csp-placeholder.png) After the diagram, the documentation describes each element. For each policy or setting, the valid values are listed. diff --git a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md index 38b7e01c09..818a935488 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md +++ b/windows/configuration/provisioning-packages/provision-pcs-for-initial-deployment.md @@ -58,7 +58,7 @@ Provisioning packages can include management instructions and policies, installa > [!TIP] > Use the desktop wizard to create a package with the common settings, then switch to the advanced editor to add other settings, apps, policies, etc. > ->![open advanced editor](../images/icd-simple-edit.png) +>![open advanced editor.](../images/icd-simple-edit.png) ## Create the provisioning package @@ -68,11 +68,11 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 2. Click **Provision desktop devices**. - ![ICD start options](../images/icd-create-options-1703.png) + ![ICD start options.](../images/icd-create-options-1703.png) 3. Name your project and click **Finish**. The pages for desktop provisioning will walk you through the following steps. - ![ICD desktop provisioning](../images/icd-desktop-1703.png) + ![ICD desktop provisioning.](../images/icd-desktop-1703.png) > [!IMPORTANT] > When you build a provisioning package, you may include sensitive information in the project files and in the provisioning package (.ppkg) file. Although you have the option to encrypt the .ppkg file, project files are not encrypted. You should store the project files in a secure location and delete the project files when they are no longer needed. diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md index a71916bfab..68cfcc37af 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps-and-certificates.md @@ -46,7 +46,7 @@ Use the Windows Imaging and Configuration Designer (ICD) tool included in the Wi 2. Click **Advanced provisioning**. - ![ICD start options](../images/icdstart-option.png) + ![ICD start options.](../images/icdstart-option.png) 3. Name your project and click **Next**. @@ -73,19 +73,19 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package](../images/uwp-family.png) + ![details for offline app package.](../images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package](../images/uwp-dependencies.png) + ![required frameworks for offline app package.](../images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page, and change the extension of the license file from **.xml** to **.ms-windows-store-license**. - ![generate license for offline app](../images/uwp-license.png) + ![generate license for offline app.](../images/uwp-license.png) - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**. diff --git a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md index cca8b46be8..f6f7f9876b 100644 --- a/windows/configuration/provisioning-packages/provision-pcs-with-apps.md +++ b/windows/configuration/provisioning-packages/provision-pcs-with-apps.md @@ -74,11 +74,11 @@ When you add an app in a Windows Configuration Designer wizard, the appropriate 2. Enter a name for the first app, and then click **Add**. - ![enter name for first app](../images/wcd-app-name.png) + ![enter name for first app.](../images/wcd-app-name.png) 3. Configure the settings for the appropriate installer type. - ![enter settings for first app](../images/wcd-app-commands.png) + ![enter settings for first app.](../images/wcd-app-commands.png) ## Add a universal app to your package @@ -88,19 +88,19 @@ Universal apps that you can distribute in the provisioning package can be line-o 2. For **DeviceContextApp**, specify the **PackageFamilyName** for the app. In Microsoft Store for Business, the package family name is listed in the **Package details** section of the download page. - ![details for offline app package](../images/uwp-family.png) + ![details for offline app package.](../images/uwp-family.png) 3. For **ApplicationFile**, click **Browse** to find and select the target app (either an \*.appx or \*.appxbundle). 4. For **DependencyAppxFiles**, click **Browse** to find and add any dependencies for the app. In Microsoft Store for Business, any dependencies for the app are listed in the **Required frameworks** section of the download page. - ![required frameworks for offline app package](../images/uwp-dependencies.png) + ![required frameworks for offline app package.](../images/uwp-dependencies.png) 5. For **DeviceContextAppLicense**, enter the **LicenseProductID**. - In Microsoft Store for Business, generate the unencoded license for the app on the app's download page. - ![generate license for offline app](../images/uwp-license.png) + ![generate license for offline app.](../images/uwp-license.png) - Open the license file and search for **LicenseID=** to get the GUID, enter the GUID in the **LicenseProductID** field and click **Add**. diff --git a/windows/configuration/provisioning-packages/provisioning-apply-package.md b/windows/configuration/provisioning-packages/provisioning-apply-package.md index 4a1bb159ac..4a9381ab1c 100644 --- a/windows/configuration/provisioning-packages/provisioning-apply-package.md +++ b/windows/configuration/provisioning-packages/provisioning-apply-package.md @@ -35,7 +35,7 @@ Provisioning packages can be applied to a device during the first-run experience 1. Start with a computer on the first-run setup screen. If the PC has gone past this screen, reset the PC to start over. To reset the PC, go to **Settings** > **Update & security** > **Recovery** > **Reset this PC**. - ![The first screen to set up a new PC](../images/oobe.jpg) + ![The first screen to set up a new PC.](../images/oobe.jpg) 2. Insert the USB drive. Windows Setup will recognize the drive and ask if you want to set up the device. Select **Set up**. @@ -43,11 +43,11 @@ Provisioning packages can be applied to a device during the first-run experience 3. The next screen asks you to select a provisioning source. Select **Removable Media** and tap **Next**. - ![Provision this device](../images/prov.jpg) + ![Provision this device.](../images/prov.jpg) 4. Select the provisioning package (\*.ppkg) that you want to apply, and tap **Next**. - ![Choose a package](../images/choose-package.png) + ![Choose a package.](../images/choose-package.png) 5. Select **Yes, add it**. @@ -59,7 +59,7 @@ Provisioning packages can be applied to a device during the first-run experience Insert the USB drive to a desktop computer, navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. For a provisioning package stored on a network folder or on a SharePoint site, navigate to the provisioning package and double-click it to begin installation. -![add a package option](../images/package.png) +![add a package option.](../images/package.png) ## Mobile editions @@ -68,13 +68,13 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account 1. Insert an SD card containing the provisioning package into the device. 2. Navigate to **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** > **Add a package**, and select the package to install. - ![add a package option](../images/packages-mobile.png) + ![add a package option.](../images/packages-mobile.png) 3. Click **Add**. 4. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) ### Copying the provisioning package to the device @@ -84,7 +84,7 @@ Insert the USB drive to a desktop computer, navigate to **Settings** > **Account 3. On the device, the **Is this package from a source you trust?** message will appear. Tap **Yes, add it**. - ![Is this package from a source you trust](../images/package-trust.png) + ![Is this package from a source you trust.](../images/package-trust.png) diff --git a/windows/configuration/provisioning-packages/provisioning-create-package.md b/windows/configuration/provisioning-packages/provisioning-create-package.md index b67e28b34d..0aa10c16b5 100644 --- a/windows/configuration/provisioning-packages/provisioning-create-package.md +++ b/windows/configuration/provisioning-packages/provisioning-create-package.md @@ -39,7 +39,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp 2. Select your desired option on the **Start** page, which offers multiple options for creating a provisioning package, as shown in the following image: - ![Configuration Designer wizards](../images/icd-create-options-1703.png) + ![Configuration Designer wizards.](../images/icd-create-options-1703.png) - The following wizard options provide a simple interface for configuring common settings for desktop, mobile, and kiosk devices: @@ -56,7 +56,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp >[!TIP] > You can start a project in the simple wizard editor and then switch the project to the advanced editor. > - > ![Switch to advanced editor](../images/icd-switch.png) + > ![Switch to advanced editor.](../images/icd-switch.png) 3. Enter a name for your project, and then select **Next**. @@ -87,7 +87,7 @@ You can use Windows Configuration Designer to create a provisioning package (.pp For an advanced provisioning project, Windows Configuration Designer opens the **Available customizations** pane. The example in the following image is based on **All Windows desktop editions** settings. -![What the ICD interface looks like](../images/icd-runtime.png) +![What the ICD interface looks like.](../images/icd-runtime.png) The settings in Windows Configuration Designer are based on Windows 10 configuration service providers (CSPs). To learn more about CSPs, see [Introduction to configuration service providers (CSPs) for IT pros](./how-it-pros-can-use-configuration-service-providers.md). @@ -103,14 +103,14 @@ The process for configuring settings is similar for all settings. The following For details on each specific setting, see [Windows Provisioning settings reference](../wcd/wcd.md). The reference topic for a setting is also displayed in Windows Configuration Designer when you select the setting, as shown in the following image. -![Windows Configuration Designer opens the reference topic when you select a setting](../images/icd-setting-help.png) +![Windows Configuration Designer opens the reference topic when you select a setting.](../images/icd-setting-help.png) ## Build package 1. After you're done configuring your customizations, select **Export**, and then select **Provisioning Package**. - ![Export on top bar](../images/icd-export-menu.png) + ![Export on top bar.](../images/icd-export-menu.png) 2. In the **Describe the provisioning package** window, enter the following information, and then select **Next**: - **Name** - This field is pre-populated with the project name. You can change this value by entering a different name in the **Name** field. diff --git a/windows/configuration/provisioning-packages/provisioning-install-icd.md b/windows/configuration/provisioning-packages/provisioning-install-icd.md index 8a7b9c464d..1a467d4e6d 100644 --- a/windows/configuration/provisioning-packages/provisioning-install-icd.md +++ b/windows/configuration/provisioning-packages/provisioning-install-icd.md @@ -66,7 +66,7 @@ On devices running Windows 10, you can install [the Windows Configuration Design 6. On the **Select the features you want to install** page, clear all selections except **Configuration Designer**, and then click **Install**. - ![Only Configuration Designer selected for installation](../images/icd-install.png) + ![Only Configuration Designer selected for installation.](../images/icd-install.png) ## Current Windows Configuration Designer limitations diff --git a/windows/configuration/provisioning-packages/provisioning-multivariant.md b/windows/configuration/provisioning-packages/provisioning-multivariant.md index e5d60aba7f..6e54b39009 100644 --- a/windows/configuration/provisioning-packages/provisioning-multivariant.md +++ b/windows/configuration/provisioning-packages/provisioning-multivariant.md @@ -35,7 +35,7 @@ In the XML file, you provide an **Id**, or friendly name, for each **Target**. E A **Target** can have more than one **TargetState**, and a **TargetState** can have more than one **Condition**. -![Target with multiple target states and conditions](../images/multi-target.png) +![Target with multiple target states and conditions.](../images/multi-target.png) The following table describes the logic for the target definition. diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index 2313b0e929..a3b4e25f84 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -124,7 +124,7 @@ For details about the settings you can customize in provisioning packages, see [ Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios. -![Configuration Designer options](../images/icd.png) +![Configuration Designer options.](../images/icd.png) Windows ICD in Windows 10, version 1607, supported the following scenarios for IT administrators: diff --git a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md index a616731808..6e01640c44 100644 --- a/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md +++ b/windows/configuration/provisioning-packages/provisioning-script-to-install-app.md @@ -189,13 +189,13 @@ cmd /c InstallMyApp.bat In Windows Configuration Designer, this looks like: -![Command line in Selected customizations](../images/icd-script1.png) +![Command line in Selected customizations.](../images/icd-script1.png) You also need to add the relevant assets for that command line including the orchestrator script and any other assets it references such as installers or .cab files. In Windows Configuration Designer, that is done by adding files under the `ProvisioningCommands/DeviceContext/CommandFiles` setting. -![Command files in Selected customizations](../images/icd-script2.png) +![Command files in Selected customizations.](../images/icd-script2.png) When you are done, [build the package](provisioning-create-package.md#build-package). diff --git a/windows/configuration/set-up-shared-or-guest-pc.md b/windows/configuration/set-up-shared-or-guest-pc.md index e4327a7b35..ed5c4ee3a3 100644 --- a/windows/configuration/set-up-shared-or-guest-pc.md +++ b/windows/configuration/set-up-shared-or-guest-pc.md @@ -108,13 +108,13 @@ You can configure Windows to be in shared PC mode in a couple different ways: 8. On the **Configuration settings** page, set the ‘Shared PC Mode’ value to **Enabled**. > [!div class="mx-imgBorder"] - > ![Shared PC mode in the Configuration settings page](images/shared_pc_3.png) + > ![Shared PC mode in the Configuration settings page.](images/shared_pc_3.png) 11. From this point on, you can configure any additional settings you’d like to be part of this policy, and then follow the rest of the set-up flow to its completion by selecting **Create** after **Step 6**. - A provisioning package created with the Windows Configuration Designer: You can apply a provisioning package when you initially set up the PC (also known as the out-of-box-experience or OOBE), or you can apply the provisioning package to a Windows 10 PC that is already in use. The provisioning package is created in Windows Configuration Designer. Shared PC mode is enabled by the [SharedPC configuration service provider (CSP)](/windows/client-management/mdm/sharedpc-csp), exposed in Windows Configuration Designer as **SharedPC**. - ![Shared PC settings in ICD](images/icd-adv-shared-pc.png) + ![Shared PC settings in ICD.](images/icd-adv-shared-pc.png) - WMI bridge: Environments that use Group Policy can use the [MDM Bridge WMI Provider](/windows/win32/dmwmibridgeprov/mdm-bridge-wmi-provider-portal) to configure the [MDM_SharedPC class](/windows/win32/dmwmibridgeprov/mdm-sharedpc). For all device settings, the WMI Bridge client must be executed under local system user; for more information, see [Using PowerShell scripting with the WMI Bridge Provider](/windows/client-management/mdm/using-powershell-scripting-with-the-wmi-bridge-provider). For example, open PowerShell as an administrator and enter the following: @@ -189,7 +189,7 @@ You can apply the provisioning package to a PC during initial setup or to a PC t 1. Start with a PC on the setup screen. - ![The first screen to set up a new PC](images/oobe.jpg) + ![The first screen to set up a new PC.](images/oobe.jpg) 2. Insert the USB drive. If nothing happens when you insert the USB drive, press the Windows key five times. @@ -206,7 +206,7 @@ You can apply the provisioning package to a PC during initial setup or to a PC t On a desktop computer, navigate to **Settings** > **Accounts** > **Work access** > **Add or remove a management package** > **Add a package**, and selects the package to install. -![add a package option](images/package.png) +![add a package option.](images/package.png) > [!NOTE] > If you apply the setup file to a computer that has already been set up, existing accounts and data might be lost. diff --git a/windows/configuration/start-layout-troubleshoot.md b/windows/configuration/start-layout-troubleshoot.md index 24dbcd1b32..5a39031455 100644 --- a/windows/configuration/start-layout-troubleshoot.md +++ b/windows/configuration/start-layout-troubleshoot.md @@ -42,7 +42,7 @@ When troubleshooting basic Start issues (and for the most part, all other Window - `get-AppXPackage -Name Microsoft.Windows.ShellExperienceHost` - `get-AppXPackage -Name Microsoft.Windows.Cortana` - ![Example of output from cmdlets](images/start-ts-1.png) + ![Example of output from cmdlets.](images/start-ts-1.png) Failure messages will appear if they aren't installed @@ -188,7 +188,7 @@ Events for both PDC and Background Tasks Infrastructure Service will be recorded ### Symptom: Application tiles like Alarm, Calculator, and Edge are missing from Start menu and the Settings app fails to open on Windows 10, version 1709 when a local user profile is deleted -![Screenshots that show download icons on app tiles and missing app tiles](images/start-ts-2.png) +![Screenshots that show download icons on app tiles and missing app tiles.](images/start-ts-2.png) **Cause**: This issue is known. The first-time sign-in experience is not detected and does not trigger the install of some apps. @@ -236,11 +236,11 @@ Specifically, behaviors include - If a new roaming user is created, the first sign-in appears normal, but on subsequent sign-ins, tiles are missing. -![Example of a working layout](images/start-ts-3.png) +![Example of a working layout.](images/start-ts-3.png) *Working layout on first sign-in of a new roaming user profile* -![Example of a failing layout](images/start-ts-4.png) +![Example of a failing layout.](images/start-ts-4.png) *Failing layout on subsequent sign-ins* @@ -256,15 +256,15 @@ Specifically, behaviors include Before the upgrade: - ![Example of Start screen with customizations applied](images/start-ts-5.jpg) + ![Example of Start screen with customizations applied.](images/start-ts-5.jpg) After the upgrade the user pinned tiles are missing: - ![Example of Start screen with previously pinned tiles missing](images/start-ts-6.png) + ![Example of Start screen with previously pinned tiles missing.](images/start-ts-6.png) Additionally, users may see blank tiles if sign-in was attempted without network connectivity. - ![Example of blank tiles](images/start-ts-7.png) + ![Example of blank tiles.](images/start-ts-7.png) **Resolution**: This issue was fixed in the [October 2017 update](https://support.microsoft.com/en-us/help/4041676). diff --git a/windows/configuration/start-secondary-tiles.md b/windows/configuration/start-secondary-tiles.md index d988f11531..351f09ce8e 100644 --- a/windows/configuration/start-secondary-tiles.md +++ b/windows/configuration/start-secondary-tiles.md @@ -31,15 +31,15 @@ In a Start layout for Windows 10, version 1703, you can include secondary tiles Suppose that the [Start layout that you export](customize-and-export-start-layout.md) had two secondary tiles, such as in the following image: -![tile for MSN and for a SharePoint site](images/edge-with-logo.png) +![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) In prior versions of Windows 10, when you applied the Start layout to a device, the tiles would display as shown in the following image: -![tile for MSN and for a SharePoint site with no logos](images/edge-without-logo.png) +![tile for MSN and for a SharePoint site with no logos.](images/edge-without-logo.png) In Windows 10, version 1703, by using the PowerShell cmdlet `export-StartLayoutEdgeAssets` and the policy setting `ImportEdgeAssets`, the tiles will now display the same as they did on the device from which you exported the Start layout. -![tile for MSN and for a SharePoint site](images/edge-with-logo.png) +![tile for MSN and for a SharePoint site.](images/edge-with-logo.png) **Example of secondary tiles in XML generated by Export-StartLayout** @@ -156,7 +156,7 @@ Use the Windows Configuration Designer tool to create a provisioning package. [L 12. Open the customizations.xml file in a text editor. The **<Customizations>** section will look like this: - ![Customizations file with the placeholder text to replace highlighted](images/customization-start-edge.png) + ![Customizations file with the placeholder text to replace highlighted.](images/customization-start-edge.png) 13. Replace **layout.xml** with the text from the layout.xml file, [with markup characters replaced with escape characters](#escape). diff --git a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md index 83744db2ca..75fcbcdad0 100644 --- a/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md +++ b/windows/configuration/ue-v/uev-deploy-uev-for-custom-applications.md @@ -121,7 +121,7 @@ UE-V for Windows 10, version 1607 includes a new template generator. If you are --> -![Selecting UE-V features in ADK](images/uev-adk-select-uev-feature.png) +![Selecting UE-V features in ADK.](images/uev-adk-select-uev-feature.png) 3. To open the generator, select **Microsoft Application Virtualization Generator** from the **Start** menu. diff --git a/windows/configuration/ue-v/uev-for-windows.md b/windows/configuration/ue-v/uev-for-windows.md index bb6d70d870..0d091fe1bb 100644 --- a/windows/configuration/ue-v/uev-for-windows.md +++ b/windows/configuration/ue-v/uev-for-windows.md @@ -41,7 +41,7 @@ The diagram below illustrates how UE-V components work together to synchronize u UE-V architecture, with server share, desktop, and UE-V service | **Component** | **Function** | @@ -65,7 +65,7 @@ Use these UE-V components to create and manage custom templates for your third-p --> -![UE-V template generator process](images/uev-generator-process.png) +![UE-V template generator process.](images/uev-generator-process.png) ## Settings synchronized by default diff --git a/windows/configuration/ue-v/uev-prepare-for-deployment.md b/windows/configuration/ue-v/uev-prepare-for-deployment.md index bfc7cfa6f3..08853f5b22 100644 --- a/windows/configuration/ue-v/uev-prepare-for-deployment.md +++ b/windows/configuration/ue-v/uev-prepare-for-deployment.md @@ -44,7 +44,7 @@ If you want to use UE-V to synchronize user-defined settings for custom applicat The workflow diagram below illustrates a typical UE-V deployment and the decisions you need to be prepared to make. -![UE-V deployment preparation](images/uev-deployment-preparation.png) +![UE-V deployment preparation.](images/uev-deployment-preparation.png) Update & Security --> Windows Update**. - **Update Session Orchestrator (USO)**- A Windows OS component that orchestrates the sequence of downloading and installing various update types from Windows Update. diff --git a/windows/deployment/update/wufb-compliancedeadlines.md b/windows/deployment/update/wufb-compliancedeadlines.md index f822925011..e56e7a3b5b 100644 --- a/windows/deployment/update/wufb-compliancedeadlines.md +++ b/windows/deployment/update/wufb-compliancedeadlines.md @@ -93,11 +93,11 @@ Once the device is in the pending restart state, it will attempt to restart the Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline](images/wufb-quality-notification.png) +![The notification users get for an impending quality update deadline.](images/wufb-quality-notification.png) Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline](images/wufb-feature-notification.png) +![The notification users get for an impending feature update deadline.](images/wufb-feature-notification.png) ### Deadline with user engagement @@ -130,17 +130,17 @@ Before the deadline the device will be in two states: auto-restart period and en Notification users get for quality update engaged deadline: -![The notification users get for an impending engaged quality update deadline example](images/wufb-quality-engaged-notification.png) +![The notification users get for an impending engaged quality update deadline example.](images/wufb-quality-engaged-notification.png) Notification users get for a quality update deadline: -![The notification users get for an impending quality update deadline example](images/wufb-quality-notification.png) +![The notification users get for an impending quality update deadline example.](images/wufb-quality-notification.png) Notification users get for a feature update engaged deadline: -![The notification users get for an impending feature update engaged deadline example](images/wufb-feature-update-engaged-notification.png) +![The notification users get for an impending feature update engaged deadline example.](images/wufb-feature-update-engaged-notification.png) Notification users get for a feature update deadline: -![The notification users get for an impending feature update deadline example](images/wufb-feature-update-deadline-notification.png) +![The notification users get for an impending feature update deadline example.](images/wufb-feature-update-deadline-notification.png) diff --git a/windows/deployment/update/wufb-manageupdate.md b/windows/deployment/update/wufb-manageupdate.md index 93a5ab27b7..8589495141 100644 --- a/windows/deployment/update/wufb-manageupdate.md +++ b/windows/deployment/update/wufb-manageupdate.md @@ -40,7 +40,7 @@ If you don't need a wave deployment and have a small set of devices to manage, w |Do not allow update deferral policies to cause scans against Windows Update|GPO: Computer Configuration > Administrative Templates > Windows Components > Windows Update > Do not allow update deferral policies to cause scans against Windows Update|State: Disabled| ## Suggested configuration for a wave deployment -![Graphic showing a deployment divided into rings for a wave deployment](images/wufb-wave-deployment.png) +![Graphic showing a deployment divided into rings for a wave deployment.](images/wufb-wave-deployment.png) ## Early validation and testing Depending on your organizational size and requirements you might be able to test feature updates earlier to identify if there are impacts to Line of Business applications. Our recommendation is to enroll a set of devices that are a good representation of your device ecosystem (for example, devices with accounting software or engineering software). Learn more about [different deployment rings](https://insider.windows.com/how-to-pc/#working-with-rings). diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index e044463423..8aafc8f67d 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -174,7 +174,7 @@ To check your system for unsigned drivers: 5. Type **sigverif** and press ENTER. 6. The File Signature Verification tool will open. Click **Start**. - ![File Signature Verification](../images/sigverif.png) + ![File Signature Verification.](../images/sigverif.png) 7. After the scanning process is complete, if you see **Your files have been scanned and verified as digitally signed** then you have no unsigned drivers. Otherwise, you will see **The following files have not been digitally signed** and a list will be provided with name, location, and version of all unsigned drivers. 8. To view and save a log file, click **Advanced**, and then click **View Log**. Save the log file if desired. @@ -268,7 +268,7 @@ To obtain the proper firmware drivers, search for the most updated driver versio When you begin a Windows Update, the setup process will ask you to **Get important updates**. Answer **Yes** if the computer you are updating is connected to the Internet. See the following example: -![Get important updates](../images/update.jpg) +![Get important updates.](../images/update.jpg) ### Verify disk space @@ -280,13 +280,13 @@ In File Explorer, click on **Computer** or **This PC** on the left, then look un The amount of space available on the system drive will be displayed under the drive. See the following example: -![System drive](../images/drive.png) +![System drive.](../images/drive.png) In the previous example, there is 703 GB of available free space on the system drive (C:). To free up additional space on the system drive, begin by running Disk Cleanup. You can access Disk Cleanup by right-clicking the hard drive icon and then clicking Properties. See the following example: -![Disk cleanup](../images/cleanup.png) +![Disk cleanup.](../images/cleanup.png) For instructions to run Disk Cleanup and other suggestions to free up hard drive space, see [Tips to free up drive space on your PC](https://support.microsoft.com/help/17421/windows-free-up-drive-space). diff --git a/windows/deployment/upgrade/setupdiag.md b/windows/deployment/upgrade/setupdiag.md index 9e7a29631c..1e87d9bff7 100644 --- a/windows/deployment/upgrade/setupdiag.md +++ b/windows/deployment/upgrade/setupdiag.md @@ -25,14 +25,14 @@ ms.topic: article >This is a 300 level topic (moderate advanced).
>See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article.
- [![Download SetupDiag](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) + [![Download SetupDiag.](../images/download.png)](https://go.microsoft.com/fwlink/?linkid=870142) ## About SetupDiag -Current downloadable version of SetupDiag: 1.6.2107.27002 ->Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. +Current downloadable version of SetupDiag: 1.6.2107.27002. +> Always be sure to run the most recent version of SetupDiag, so that can access new functionality and fixes to known issues. -SetupDiag is a standalone diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. +SetupDiag is a diagnostic tool that can be used to obtain details about why a Windows 10 upgrade was unsuccessful. SetupDiag works by examining Windows Setup log files. It attempts to parse these log files to determine the root cause of a failure to update or upgrade the computer to Windows 10. SetupDiag can be run on the computer that failed to update, or you can export logs from the computer to another location and run SetupDiag in offline mode. @@ -344,6 +344,10 @@ Each rule name and its associated unique rule identifier are listed with a descr ## Release notes +07/27/2021 - SetupDiag v1.6.2107.27002 is released with 61 rules, as a standalone tool available in the Download Center. +- This version contains compliance updates and minor bug fixes. +- With this release and subsequent releases, the version number of the downloadable SetupDiag tool is different from the one included with Windows Setup. + 05/06/2021 - SetupDiag v1.6.1.0 is released with 61 rules, as a standalone tool available in the Download Center. - This version of SetupDiag is included with Windows 10, version 21H1. - A new rule is added: UserProfileSuffixMismatch. @@ -563,7 +567,7 @@ Refer to "https://docs.microsoft.com/windows/desktop/Debug/system-error-codes" f ## Sample registry key -![Example of Addreg](./../images/addreg.png) +![Example of Addreg.](./../images/addreg.png) ## Related topics diff --git a/windows/deployment/upgrade/submit-errors.md b/windows/deployment/upgrade/submit-errors.md index 580a08b67c..1cde13e1eb 100644 --- a/windows/deployment/upgrade/submit-errors.md +++ b/windows/deployment/upgrade/submit-errors.md @@ -61,7 +61,7 @@ Click **Submit** to send your feedback. See the following example: -![feedback example](../images/feedback.png) +![feedback example.](../images/feedback.png) After you click Submit, that's all you need to do. Microsoft will receive your feedback and begin analyzing the issue. You can check on your feedback periodically to see what solutions have been provided. @@ -69,7 +69,7 @@ After you click Submit, that's all you need to do. Microsoft will receive your f After your feedback is submitted, you can email or post links to it by opening the Feedback Hub, clicking My feedback at the top, clicking the feedback item you submitted, clicking **Share**, then copying the short link that is displayed. -![share link](../images/share.jpg) +![share.](../images/share.jpg) ## Related topics diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index 842e478dcf..bdb7e4814a 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -59,31 +59,31 @@ When performing an operating system upgrade, Windows Setup uses phases described 1. **Downlevel phase**: The downlevel phase is run within the previous operating system. Windows files are copied and installation components are gathered. - ![downlevel phase](../images/downlevel.png) + ![downlevel phase.](../images/downlevel.png) 2. **Safe OS phase**: A recovery partition is configured, Windows files are expanded, and updates are installed. An OS rollback is prepared if needed. Example error codes: 0x2000C, 0x20017. - ![safeOS phase](../images/safeos.png) + ![safeOS phase.](../images/safeos.png) 3. **First boot phase**: Initial settings are applied. Example error codes: 0x30018, 0x3000D. - ![first boot phase](../images/firstboot.png) + ![first boot phase.](../images/firstboot.png) 4. **Second boot phase**: Final settings are applied. This is also called the **OOBE boot phase**. Example error codes: 0x4000D, 0x40017. At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. - ![second boot phase](../images/secondboot.png) + ![second boot phase.](../images/secondboot.png) - ![second boot phase](../images/secondboot2.png) + ![second boot phase.](../images/secondboot2.png) - ![second boot phase](../images/secondboot3.png) + ![second boot phase.](../images/secondboot3.png) 5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. **Figure 1**: Phases of a successful Windows 10 upgrade (uninstall is not shown): -![Upgrade process](../images/upgrade-process.png) +![Upgrade process.](../images/upgrade-process.png) DU = Driver/device updates.
OOBE = Out of box experience.
diff --git a/windows/deployment/upgrade/windows-10-edition-upgrades.md b/windows/deployment/upgrade/windows-10-edition-upgrades.md index 57307ee3d0..c8a2c54c5a 100644 --- a/windows/deployment/upgrade/windows-10-edition-upgrades.md +++ b/windows/deployment/upgrade/windows-10-edition-upgrades.md @@ -33,9 +33,9 @@ The following table shows the methods and paths available to change the edition > [!TIP] > Although it isn't displayed yet in the table, edition upgrade is also possible using [edition upgrade policy](/configmgr/compliance/deploy-use/upgrade-windows-version) in Microsoft Endpoint Configuration Manager. -![not supported](../images/x_blk.png) (X) = not supported
-![supported, reboot required](../images/check_grn.png) (green checkmark) = supported, reboot required
-![supported, no reboot](../images/check_blu.png) (blue checkmark) = supported, no reboot required
+![not supported.](../images/x_blk.png) (X) = not supported
+![supported, reboot required.](../images/check_grn.png) (green checkmark) = supported, reboot required
+![supported, no reboot.](../images/check_blu.png) (blue checkmark) = supported, no reboot required
| Edition upgrade | Using mobile device management (MDM) | Using a provisioning package | Using a command-line tool | Using Microsoft Store for Business or PC | Entering a product key manually | Purchasing a license from the Microsoft Store | |-----------------| ------------------------------------ | --------------------------- | ------------------------- | -------------------------------------- | ----------------------------------- | --------------------------------------------- | -| **Home > Pro** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro for Workstations** | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | -| **Home > Pro Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Home > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Pro for Workstations** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | -| **Pro > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Pro Education** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Pro for Workstations > Enterprise** | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | -| **Pro Education > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | -| **Enterprise > Education** | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Pro** | ![not supported.](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro for Workstations** | ![not supported.](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | +| **Home > Pro Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Home > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Pro for Workstations** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | +| **Pro > Pro Education** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro > Enterprise** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Pro Education** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Pro for Workstations > Enterprise** | ![supported, no reboot.](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png) | ![supported, no reboot](../images/check_blu.png)
(1703 - PC)
(1709 - MSfB) | ![supported, no reboot](../images/check_blu.png) | ![not supported](../images/x_blk.png) | +| **Pro Education > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | +| **Enterprise > Education** | ![supported, reboot required.](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png) | ![supported, reboot required](../images/check_grn.png)
(MSfB) | ![supported, reboot required](../images/check_grn.png) | ![not supported](../images/x_blk.png) | > [!NOTE] > - For information about upgrade paths in Windows 10 in S mode (for Pro or Education), check out [Windows 10 Pro/Enterprise in S mode](../windows-10-pro-in-s-mode.md) diff --git a/windows/deployment/upgrade/windows-error-reporting.md b/windows/deployment/upgrade/windows-error-reporting.md index 08c4982f9c..50aad1782d 100644 --- a/windows/deployment/upgrade/windows-error-reporting.md +++ b/windows/deployment/upgrade/windows-error-reporting.md @@ -63,7 +63,7 @@ Ten parameters are listed in the event: The event will also contain links to log files that can be used to perform a detailed diagnosis of the error. An example of this event from a successful upgrade is shown below. -![Windows Error Reporting](../images/event.png) +![Windows Error Reporting.](../images/event.png) ## Related topics diff --git a/windows/deployment/usmt/migration-store-types-overview.md b/windows/deployment/usmt/migration-store-types-overview.md index 84a87a0aac..52b489720f 100644 --- a/windows/deployment/usmt/migration-store-types-overview.md +++ b/windows/deployment/usmt/migration-store-types-overview.md @@ -49,7 +49,7 @@ You use a command-line option,**/hardlink** , to create a hard-link migration st The following flowchart illustrates the procedural differences between a local migration store and a remote migration store. In this example, a hard-link migration store is used for the local store. -![migration store comparison](images/dep-win8-l-usmt-migrationcomparemigstores.gif) +![migration store comparison.](images/dep-win8-l-usmt-migrationcomparemigstores.gif) ## Local Store vs. Remote Store diff --git a/windows/deployment/usmt/usmt-common-migration-scenarios.md b/windows/deployment/usmt/usmt-common-migration-scenarios.md index 30930ac481..b94bc3041b 100644 --- a/windows/deployment/usmt/usmt-common-migration-scenarios.md +++ b/windows/deployment/usmt/usmt-common-migration-scenarios.md @@ -49,7 +49,7 @@ The following diagram shows a PC-refresh migration, also known as a computer ref   -![usmt pc refresh scenario](images/dep-win8-l-usmt-pcrefresh.jpg) +![usmt pc refresh scenario.](images/dep-win8-l-usmt-pcrefresh.jpg)   @@ -100,7 +100,7 @@ The following diagram shows a PC-replacement migration. First, the administrator   -![usmt pc replace scenario](images/dep-win8-l-usmt-pcreplace.jpg) +![usmt pc replace scenario.](images/dep-win8-l-usmt-pcreplace.jpg)   diff --git a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md index f32ee0d61e..10e7c2e418 100644 --- a/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md +++ b/windows/deployment/volume-activation/activate-using-active-directory-based-activation-client.md @@ -55,7 +55,7 @@ The process proceeds as follows: 3. Client computers are activated by receiving the activation object from a domain controller during startup. > [!div class="mx-imgBorder"] - > ![Active Directory-based activation flow](../images/volumeactivationforwindows81-10.jpg) + > ![Active Directory-based activation flow.](../images/volumeactivationforwindows81-10.jpg) **Figure 10**. The Active Directory-based activation flow @@ -80,31 +80,31 @@ When a reactivation event occurs, the client queries AD DS for the activation o 3. Add the Volume Activation Services role, as shown in Figure 11. - ![Adding the Volume Activation Services role](../images/volumeactivationforwindows81-11.jpg) + ![Adding the Volume Activation Services role.](../images/volumeactivationforwindows81-11.jpg) **Figure 11**. Adding the Volume Activation Services role 4. Click the link to launch the Volume Activation Tools (Figure 12). - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-12.jpg) + ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-12.jpg) **Figure 12**. Launching the Volume Activation Tools 5. Select the **Active Directory-Based Activation** option (Figure 13). - ![Selecting Active Directory-Based Activation](../images/volumeactivationforwindows81-13.jpg) + ![Selecting Active Directory-Based Activation.](../images/volumeactivationforwindows81-13.jpg) **Figure 13**. Selecting Active Directory-Based Activation 6. Enter your KMS host key and (optionally) a display name (Figure 14). - ![Choosing how to activate your product](../images/volumeactivationforwindows81-15.jpg) + ![Choosing how to activate your product.](../images/volumeactivationforwindows81-15.jpg) **Figure 14**. Entering your KMS host key 7. Activate your KMS host key by phone or online (Figure 15). - ![Entering your KMS host key](../images/volumeactivationforwindows81-14.jpg) + ![Entering your KMS host key.](../images/volumeactivationforwindows81-14.jpg) **Figure 15**. Choosing how to activate your product diff --git a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md index f9cfcf33ac..5fa4723874 100644 --- a/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md +++ b/windows/deployment/volume-activation/activate-using-key-management-service-vamt.md @@ -80,39 +80,39 @@ This scenario is commonly used in larger organizations that do not find the over 2. Launch Server Manager. 3. Add the Volume Activation Services role, as shown in Figure 4. - ![Adding the Volume Activation Services role in Server Manager](../images/volumeactivationforwindows81-04.jpg) + ![Adding the Volume Activation Services role in Server Manager.](../images/volumeactivationforwindows81-04.jpg) **Figure 4**. Adding the Volume Activation Services role in Server Manager 4. When the role installation is complete, click the link to launch the Volume Activation Tools (Figure 5). - ![Launching the Volume Activation Tools](../images/volumeactivationforwindows81-05.jpg) + ![Launching the Volume Activation Tools.](../images/volumeactivationforwindows81-05.jpg) **Figure 5**. Launching the Volume Activation Tools 5. Select the **Key Management Service (KMS)** option, and specify the computer that will act as the KMS host (Figure 6). This can be the same computer on which you installed the role or another computer. For example, it can be a client computer running Windows 10. - ![Configuring the computer as a KMS host](../images/volumeactivationforwindows81-06.jpg) + ![Configuring the computer as a KMS host.](../images/volumeactivationforwindows81-06.jpg) **Figure 6**. Configuring the computer as a KMS host 6. Install your KMS host key by typing it in the text box, and then click **Commit** (Figure 7). - ![Installing your KMS host key](../images/volumeactivationforwindows81-07.jpg) + ![Installing your KMS host key.](../images/volumeactivationforwindows81-07.jpg) **Figure 7**. Installing your KMS host key 7. If asked to confirm replacement of an existing key, click **Yes**. 8. After the product key is installed, you must activate it. Click **Next** (Figure 8). - ![Activating the software](../images/volumeactivationforwindows81-08.jpg) + ![Activating the software.](../images/volumeactivationforwindows81-08.jpg) **Figure 8**. Activating the software The KMS key can be activated online or by phone. See Figure 9. - ![Choosing to activate online](../images/volumeactivationforwindows81-09.jpg) + ![Choosing to activate online.](../images/volumeactivationforwindows81-09.jpg) **Figure 9**. Choosing to activate online diff --git a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md index b88d65def4..728b60519b 100644 --- a/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md +++ b/windows/deployment/volume-activation/activate-windows-10-clients-vamt.md @@ -99,12 +99,12 @@ A MAK is used for one-time activation with Microsoft’s hosted activation servi You can activate computers by using a MAK in two ways: - **MAK independent activation**. Each computer independently connects and is activated with Microsoft over the Internet or by telephone. MAK independent activation is best suited to computers within an organization that do not maintain a connection to the corporate network. MAK independent activation is shown in Figure 16. - ![MAK independent activation](../images/volumeactivationforwindows81-16.jpg) + ![MAK independent activation.](../images/volumeactivationforwindows81-16.jpg) **Figure 16**. MAK independent activation - **MAK proxy activation**. MAK proxy activation enables a centralized activation request on behalf of multiple computers with one connection to Microsoft. You configure MAK proxy activation by using the VAMT. MAK proxy activation is appropriate for environments in which security concerns restrict direct access to the Internet or the corporate network. It is also suited for development and test labs that lack this connectivity. MAK proxy activation with the VAMT is shown in Figure 17. - ![MAK proxy activation with the VAMT](../images/volumeactivationforwindows81-17.jpg) + ![MAK proxy activation with the VAMT.](../images/volumeactivationforwindows81-17.jpg) **Figure 17**. MAK proxy activation with the VAMT diff --git a/windows/deployment/volume-activation/add-remove-computers-vamt.md b/windows/deployment/volume-activation/add-remove-computers-vamt.md index 4e2248db96..e671e92d02 100644 --- a/windows/deployment/volume-activation/add-remove-computers-vamt.md +++ b/windows/deployment/volume-activation/add-remove-computers-vamt.md @@ -34,7 +34,7 @@ Before adding computers, ensure that the Windows Management Instrumentation (WMI 5. VAMT searches for the specified computers and adds them to the VAMT database. During the search, VAMT displays the **Finding computers** message shown below. To cancel the search, click **Cancel**. When the search is complete the names of the newly-discovered computers appear in the product list view in the center pane. - ![VAMT, Finding computers dialog box](images/dep-win8-l-vamt-findingcomputerdialog.gif) + ![VAMT, Finding computers dialog box.](images/dep-win8-l-vamt-findingcomputerdialog.gif) **Important**   This step adds only the computers to the VAMT database, and not the products that are installed on the computers. To add the products, you need to run the **Update license status** function. diff --git a/windows/deployment/volume-activation/configure-client-computers-vamt.md b/windows/deployment/volume-activation/configure-client-computers-vamt.md index 87cb8d7b0f..5cbd41f410 100644 --- a/windows/deployment/volume-activation/configure-client-computers-vamt.md +++ b/windows/deployment/volume-activation/configure-client-computers-vamt.md @@ -45,7 +45,7 @@ Enable the VAMT to access client computers using the **Windows Firewall** Contro Enable the VAMT to access client computers across multiple subnets using the **Windows Firewall with Advanced Security** Control Panel: -![VAMT Firewall configuration for multiple subnets](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) +![VAMT Firewall configuration for multiple subnets.](images/dep-win8-l-vamt-firewallconfigurationformultiplesubnets.gif) 1. Open the Control Panel and double-click **Administrative Tools**. 2. Click **Windows Firewall with Advanced Security**. diff --git a/windows/deployment/volume-activation/install-vamt.md b/windows/deployment/volume-activation/install-vamt.md index f462f8655f..0b67293d6a 100644 --- a/windows/deployment/volume-activation/install-vamt.md +++ b/windows/deployment/volume-activation/install-vamt.md @@ -49,7 +49,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 5. On the completion page, note the instance name for your installation, select **Close**, and then select **Yes**. - ![In this example, the instance name is SQLEXPRESS01](images/sql-instance.png) + ![In this example, the instance name is SQLEXPRESS01.](images/sql-instance.png) ### Install VAMT using the ADK @@ -73,7 +73,7 @@ You install VAMT as part of the Windows Assessment and Deployment Kit (ADK) for 2. Enter the server instance name (for a remote SQL use the FQDN) and a name for the database, select **Connect**, and then select **Yes** to create the database. See the following image for an example for SQL. - ![Server name is .\SQLEXPRESS and database name is VAMT](images/vamt-db.png) + ![Server name is .\SQLEXPRESS and database name is VAMT.](images/vamt-db.png) For remote SQL Server, use `servername.yourdomain.com`. diff --git a/windows/deployment/volume-activation/introduction-vamt.md b/windows/deployment/volume-activation/introduction-vamt.md index 45619726e9..91d2d8540b 100644 --- a/windows/deployment/volume-activation/introduction-vamt.md +++ b/windows/deployment/volume-activation/introduction-vamt.md @@ -45,7 +45,7 @@ VAMT treats a KMS Host key (CSVLK) product key identically to a retail-type prod VAMT is commonly implemented in enterprise environments. The following illustrates three common environments—Core Network, Secure Zone, and Isolated Lab. -![VAMT in the enterprise](images/dep-win8-l-vamt-image001-enterprise.jpg) +![VAMT in the enterprise.](images/dep-win8-l-vamt-image001-enterprise.jpg) In the Core Network environment, all computers are within a common network managed by Active Directory® Domain Services (AD DS). The Secure Zone represents higher-security Core Network computers that have additional firewall protection. The Isolated Lab environment is a workgroup that is physically separate from the Core Network, and its computers do not have Internet access. The network security policy states that no information that could identify a specific computer or user may be transferred out of the Isolated Lab. @@ -54,7 +54,7 @@ The Isolated Lab environment is a workgroup that is physically separate from the The following screenshot shows the VAMT graphical user interface. -![VAMT user interface](images/vamtuserinterfaceupdated.jpg) +![VAMT user interface.](images/vamtuserinterfaceupdated.jpg) VAMT provides a single, graphical user interface for managing activations, and for performing other activation-related tasks such as: diff --git a/windows/deployment/volume-activation/plan-for-volume-activation-client.md b/windows/deployment/volume-activation/plan-for-volume-activation-client.md index 443e1e417b..71d990f500 100644 --- a/windows/deployment/volume-activation/plan-for-volume-activation-client.md +++ b/windows/deployment/volume-activation/plan-for-volume-activation-client.md @@ -120,7 +120,7 @@ In the core network, a centralized KMS solution is recommended. You can also use A typical core network that includes a KMS host is shown in Figure 1. -![Typical core network](../images/volumeactivationforwindows81-01.jpg) +![Typical core network.](../images/volumeactivationforwindows81-01.jpg) **Figure 1**. Typical core network @@ -140,7 +140,7 @@ If the isolated network cannot communicate with the core network’s KMS server, If the network is fully isolated, MAK-independent activation would be the recommended choice, perhaps using the telephone option. But VAMT proxy activation may also be possible. You can also use MAKs to activate new computers during setup, before they are placed in the isolated network. -![New KMS host in an isolated network](../images/volumeactivationforwindows81-02.jpg) +![New KMS host in an isolated network.](../images/volumeactivationforwindows81-02.jpg) **Figure 2**. New KMS host in an isolated network @@ -222,7 +222,7 @@ The flow of KMS activation is shown in Figure 3, and it follows this sequence: 7. If the KMS host has a KMS host key that matches the products in the GVLK, the KMS host sends a single packet back to the client. This packet contains a count of the number of computers that have requested activation from this KMS host. 8. If the count exceeds the activation threshold for the product that is being activated, the client is activated. If the activation threshold has not yet been met, the client will try again. -![KMS activation flow](../images/volumeactivationforwindows81-03.jpg) +![KMS activation flow.](../images/volumeactivationforwindows81-03.jpg) **Figure 3**. KMS activation flow diff --git a/windows/deployment/volume-activation/scenario-online-activation-vamt.md b/windows/deployment/volume-activation/scenario-online-activation-vamt.md index 2716a475b8..118a656e49 100644 --- a/windows/deployment/volume-activation/scenario-online-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-online-activation-vamt.md @@ -25,7 +25,7 @@ In this scenario, the Volume Activation Management Tool (VAMT) is deployed in th - Retail The Secure Zone represents higher-security Core Network computers that have additional firewall protection. -![VAMT firewall configuration for multiple subnets](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) +![VAMT firewall configuration for multiple subnets.](images/dep-win8-l-vamt-makindependentactivationscenario.jpg) ## In This Topic - [Install and start VAMT on a networked host computer](#bkmk-partone) diff --git a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md index 84e0a8ea19..d3b906680d 100644 --- a/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md +++ b/windows/deployment/volume-activation/scenario-proxy-activation-vamt.md @@ -19,7 +19,7 @@ ms.topic: article In this scenario, the Volume Activation Management Tool (VAMT) is used to activate products that are installed on workgroup computers in an isolated lab environment. For workgroups which are isolated from the larger network, you can perform proxy activation of Multiple Activation Keys (MAKs), KMS Host keys (CSVLKs), Generic Volume License Keys (GVLKs) (or KMS client keys), or retail keys. Proxy activation is performed by installing a second instance of VAMT on a computer in the isolated workgroup. You can then use removable media to transfer VAMT Computer Information Lists (CILXs) between the instance of VAMT in the isolated workgroup and another VAMT host that has Internet access. The following diagram shows a Multiple Activation Key (MAK) proxy activation scenario: -![VAMT MAK proxy activation scenario](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) +![VAMT MAK proxy activation scenario.](images/dep-win8-l-vamt-makproxyactivationscenario.jpg) ## Step 1: Install VAMT on a Workgroup Computer in the Isolated Lab diff --git a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md index c8e7913ed2..562251c0a9 100644 --- a/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md +++ b/windows/deployment/volume-activation/use-the-volume-activation-management-tool-client.md @@ -51,7 +51,7 @@ You can use the VAMT to complete the activation process in products by using MAK The VAMT provides an overview of the activation and licensing status of computers across your network, as shown in Figure 18. Several prebuilt reports are also available to help you proactively manage licensing. -![VAMT showing the licensing status of multiple computers](../images/volumeactivationforwindows81-18.jpg) +![VAMT showing the licensing status of multiple computers.](../images/volumeactivationforwindows81-18.jpg) **Figure 18**. The VAMT showing the licensing status of multiple computers @@ -59,7 +59,7 @@ The VAMT provides an overview of the activation and licensing status of computer The VAMT makes it easier to track the various keys that are issued to your organization. You can enter each key into VAMT, and then the VAMT can use those keys for online or proxy activation of clients. The tool can also describe what type of key it is and to which product group it belongs. The VAMT is the most convenient way to quickly determine how many activations remain on a MAK. Figure 19 shows an example of key types and usage. -![VAMT showing key types and usage](../images/volumeactivationforwindows81-19.jpg) +![VAMT showing key types and usage.](../images/volumeactivationforwindows81-19.jpg) **Figure 19**. The VAMT showing key types and usage diff --git a/windows/deployment/volume-activation/vamt-known-issues.md b/windows/deployment/volume-activation/vamt-known-issues.md index 844c46ba14..55fd4c1684 100644 --- a/windows/deployment/volume-activation/vamt-known-issues.md +++ b/windows/deployment/volume-activation/vamt-known-issues.md @@ -30,7 +30,7 @@ The current known issues with the Volume Activation Management Tool (VAMT), vers Another known issue is that when you try to add a Windows 10 Key Management Service (KMS) Host key (CSVLK) or a Windows Server 2012 R2 for Windows 10 CSVLK into VAMT 3.1 (version 10.0.10240.0), you receive the error message shown here. -![VAMT error message](./images/vamt-known-issue-message.png) +![VAMT error message.](./images/vamt-known-issue-message.png) This issue occurs because VAMT 3.1 does not contain the correct Pkconfig files to recognize this kind of key. To work around this issue, use one of the following methods. diff --git a/windows/deployment/windows-10-deployment-posters.md b/windows/deployment/windows-10-deployment-posters.md index 3bda096ca5..2a0f0da2a9 100644 --- a/windows/deployment/windows-10-deployment-posters.md +++ b/windows/deployment/windows-10-deployment-posters.md @@ -26,13 +26,13 @@ The following posters step through various options for deploying Windows 10 with The Windows Autopilot poster is two pages in portrait mode (11x17). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10AutopilotFlowchart.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10Autopilotflowchart.vsdx) format. -[![Deploy Windows 10 with Autopilot](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) +[![Deploy Windows 10 with Autopilot.](./media/windows10-autopilot-flowchart.png)](./media/Windows10AutopilotFlowchart.pdf) ## Deploy Windows 10 with Microsoft Endpoint Configuration Manager The Configuration Manager poster is one page in landscape mode (17x11). Click the image to view a PDF in your browser. You can also download this poster in [PDF](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.pdf) or [Visio](https://github.com/MicrosoftDocs/windows-itpro-docs/raw/public/windows/deployment/media/Windows10DeploymentConfigManager.vsdx) format. -[![Deploy Windows 10 with Configuration Manager](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) +[![Deploy Windows 10 with Configuration Manager.](./media/windows10-deployment-config-manager.png)](./media/Windows10DeploymentConfigManager.pdf) ## See also diff --git a/windows/deployment/windows-10-media.md b/windows/deployment/windows-10-media.md index a90baefd20..0e160f2943 100644 --- a/windows/deployment/windows-10-media.md +++ b/windows/deployment/windows-10-media.md @@ -42,7 +42,7 @@ Windows 10, version 1709 is available starting on 10/17/2017 in all relevant dis For ISOs that you download from the VLSC or Visual Studio Subscriptions, you can still search for the individual Windows editions. However, each of these editions (Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education) will point to the same ISO file, so you only need to download the ISO once. A single Windows image (WIM) file is included in the ISO that contains all the volume licensing images: -![Images](images/table01.png) +![Images.](images/table01.png) When using the contents of these ISOs with tools such as the Microsoft Deployment Toolkit or Microsoft Endpoint Configuration Manager, make sure you select the appropriate image index in any task sequences that you create or update. @@ -69,7 +69,7 @@ This Semi-Annual Channel release of Windows 10 continues the Windows as a servic See the following example for Windows 10, version 1709: -![Windows 10, version 1709 lang pack](images/lang-pack-1709.png) +![Windows 10, version 1709 lang pack.](images/lang-pack-1709.png) ### Features on demand diff --git a/windows/deployment/windows-10-poc-mdt.md b/windows/deployment/windows-10-poc-mdt.md index 7e6d238721..9d18e1af46 100644 --- a/windows/deployment/windows-10-poc-mdt.md +++ b/windows/deployment/windows-10-poc-mdt.md @@ -284,7 +284,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 10. In the **Operating Systems** > **Windows 10** node, double-click the operating system that was added to view its properties. Change the operating system name to **Windows 10 Enterprise x64 Custom Image** and then click **OK**. See the following example: - ![custom image](images/image.png) + ![custom image.](images/image.png) ### Create the deployment task sequence @@ -459,7 +459,7 @@ This procedure will demonstrate how to deploy the reference image to the PoC env 7. On SRV1, in the Deployment Workbench console, click on **Monitoring** and view the status of installation. Right-click **Monitoring** and click **Refresh** if no data is displayed. 8. OS installation requires about 10 minutes. When the installation is complete, the system will reboot automatically, configure devices, and install updates, requiring another 10-20 minutes. When the new client computer is finished updating, click **Finish**. You will be automatically signed in to the local computer as administrator. - ![finish](images/deploy-finish.png) + ![finish.](images/deploy-finish.png) This completes the demonstration of how to deploy a reference image to the network. To conserve resources, turn off the PC2 VM before starting the next section. diff --git a/windows/deployment/windows-10-poc-sc-config-mgr.md b/windows/deployment/windows-10-poc-sc-config-mgr.md index 603113f920..d69cc3b5db 100644 --- a/windows/deployment/windows-10-poc-sc-config-mgr.md +++ b/windows/deployment/windows-10-poc-sc-config-mgr.md @@ -331,7 +331,7 @@ WDSUTIL /Set-Server /AnswerClients:None - **Respond to PXE requests on specific network interfaces**: Click the yellow starburst and then enter the MAC address determined in the first step of this procedure. See the following example: - ![Config Mgr PXE](images/configmgr-pxe.png) + ![Config Mgr PXE.](images/configmgr-pxe.png) 5. Click **OK**. 6. Wait for a minute, then type the following command at an elevated Windows PowerShell prompt on SRV1, and verify that the files displayed are present: @@ -803,7 +803,7 @@ In this first deployment scenario, we will deploy Windows 10 using PXE. This sce >Before starting this section, you can delete computer objects from Active Directory that were created as part of previous deployment procedures. Use the Active Directory Users and Computers console on DC1 to remove stale entries under contoso.com\Computers, but do not delete the computer account (hostname) for PC1. There should be at least two computer accounts present in the contoso.com\Computers container: one for SRV1, and one for the hostname of PC1. It is not required to delete the stale entries, this is only done to remove clutter. -![contoso.com\Computers](images/poc-computers.png) +![contoso.com\Computers.](images/poc-computers.png) In the replace procedure, PC1 will not be migrated to a new operating system. It is simplest to perform this procedure before performing the refresh procedure. After refreshing PC1, the operating system will be new. The next (replace) procedure does not install a new operating system on PC1 but rather performs a side-by-side migration of PC1 and another computer (PC4), to copy users and settings from PC1 to the new computer. @@ -907,7 +907,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 14. Click the **Site** tab, click **Configure Settings**, and click **Find Site**. The client will report that it has found the PS1 site. See the following example: - ![site](images/configmgr-site.png) + ![site.](images/configmgr-site.png) If the client is not able to find the PS1 site, review any error messages that are displayed in **C:\Windows\CCM\Logs\ClientIDManagerStartup.log** and **LocationServices.log**. A common reason the site code is not located is because a previous configuration exists. For example, if a previous site code is configured at **HKLM\SOFTWARE\Microsoft\SMS\Mobile Client\GPRequestedSiteAssignmentCode** this must be deleted or updated. @@ -915,7 +915,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 16. Click **All Desktop and Server Clients** and verify that the computer account for PC1 is displayed here with **Yes** and **Active** in the **Client** and **Client Activity** columns, respectively. You might have to refresh the view and wait few minutes for the client to appear here. See the following example: - ![client](images/configmgr-client.png) + ![client.](images/configmgr-client.png) >It might take several minutes for the client to fully register with the site and complete a client check. When it is complete you will see a green check mark over the client icon as shown above. To refresh the client, click it and then press **F5** or right-click the client and click **Refresh**. @@ -976,7 +976,7 @@ The **Client** column indicates that the Configuration Manager client is not cur 11. Click **Device Collections** and then double-click **Install Windows 10 Enterprise x64**. Verify that **PC4** is displayed in the collection. You might have to update and refresh the collection, or wait a few minutes, but do not proceed until PC4 is available. See the following example: - ![collection](images/configmgr-collection.png) + ![collection.](images/configmgr-collection.png) ### Create a device collection for PC1 @@ -1026,7 +1026,7 @@ In the Configuration Manager console, in the Software Library workspace under Op 4. In the Software Center , click **Available Software** and then select the **Replace Task Sequence** checkbox. See the following example: - ![software](images/configmgr-software-cntr.png) + ![software.](images/configmgr-software-cntr.png) >If you do not see any available software, try running step #2 again to start the Machine Policy Retrieval & Evaluation Cycle. You should see an alert that new software is available. @@ -1064,17 +1064,17 @@ In the Configuration Manager console, in the Software Library workspace under Op 3. On PC1, in the notification area, click **New software is available** and then click **Open Software Center**. 4. In the Software Center, click **Operating Systems**, click **Windows 10 Enterprise x64**, click **Install** and then click **INSTALL OPERATING SYSTEM**. See the following example: - ![installOS](images/configmgr-install-os.png) + ![installOS.](images/configmgr-install-os.png) The computer will restart several times during the installation process. Installation includes downloading updates, reinstalling the Configuration Manager Client Agent, and restoring the user state. You can view status of the installation in the Configuration Manager console by accessing the Monitoring workspace, clicking **Deployments**, and then double-clicking the deployment associated with the **Install Windows 10 Enterprise x64** collection. Under **Asset Details**, right-click the device and then click **More Details**. Click the **Status** tab to see a list of tasks that have been performed. See the following example: - ![asset](images/configmgr-asset.png) + ![asset.](images/configmgr-asset.png) You can also monitor progress of the installation by using the MDT deployment workbench and viewing the **Monitoring** node under **Deployment Shares\MDT Production**. When installation has completed, sign in using the contoso\administrator account or the contoso\user1 account and verify that applications and settings have been successfully backed up and restored to your new Windows 10 Enterprise operating system. - ![post-refresh](images/configmgr-post-refresh.png) + ![post-refresh.](images/configmgr-post-refresh.png) ## Related Topics diff --git a/windows/deployment/windows-10-poc.md b/windows/deployment/windows-10-poc.md index 319121950d..d4a667a65b 100644 --- a/windows/deployment/windows-10-poc.md +++ b/windows/deployment/windows-10-poc.md @@ -150,7 +150,7 @@ Hardware requirements are displayed below: The lab architecture is summarized in the following diagram: -![PoC diagram](images/poc.png) +![PoC diagram.](images/poc.png) - Computer 1 is configured to host four VMs on a private, PoC network. - Two VMs are running Windows Server 2012 R2 with required network services and tools installed. @@ -224,9 +224,9 @@ Starting with Windows 8, the host computer’s microprocessor must support secon >Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![hyper-v features](images/hyper-v-feature.png) + ![hyper-v features.](images/hyper-v-feature.png) - ![hyper-v](images/svr_mgr2.png) + ![hyper-v.](images/svr_mgr2.png)

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -449,7 +449,7 @@ Notes:
3. Select the checkboxes next to the **C:\\** and the **system reserved** (BIOS/MBR) volumes. The system volume is not assigned a drive letter, but will be displayed in the Disk2VHD tool with a volume label similar to **\\?\Volume{**. See the following example. **Important**: You must include the system volume in order to create a bootable VHD. If this volume is not displayed in the disk2vhd tool, then the computer is likely to be using the GPT partition style. For more information, see [Determine VM generation](#determine-vm-generation). 4. Specify a location to save the resulting VHD or VHDX file (F:\VHD\w7.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd 1](images/disk2vhd.png) + ![disk2vhd 1.](images/disk2vhd.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -482,7 +482,7 @@ Notes:
5. Specify a location to save the resulting VHD or VHDX file (F:\VHD\PC1.vhdx in the following example) and click **Create**. See the following example: - ![disk2vhd 2](images/disk2vhd-gen2.png) + ![disk2vhd 2.](images/disk2vhd-gen2.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -506,7 +506,7 @@ Notes:
3. Select the checkbox next to the **C:\\** volume and clear the checkbox next to **Use Vhdx**. Note: the system volume is not copied in this scenario, it will be added later. 4. Specify a location to save the resulting VHD file (F:\VHD\w7.vhd in the following example) and click **Create**. See the following example: - ![disk2vhd 3](images/disk2vhd4.png) + ![disk2vhd 3.](images/disk2vhd4.png) >Disk2vhd can save VHDs to local hard drives, even if they are the same as the volumes being converted. Performance is better however when the VHD is saved on a disk different than those being converted, such as a flash drive. @@ -821,7 +821,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to 15. After signing in, the operating system detects that it is running in a new environment. New drivers will be automatically installed, including the network adapter driver. The network adapter driver must be updated before you can proceed, so that you will be able to join the contoso.com domain. Depending on the resources allocated to PC1, installing the network adapter driver might take a few minutes. You can monitor device driver installation by clicking **Show hidden icons** in the notification area. - ![PoC 1](images/installing-drivers.png) + ![PoC 1.](images/installing-drivers.png) >If the client was configured with a static address, you must change this to a dynamic one so that it can obtain a DHCP lease. @@ -879,7 +879,7 @@ The second Windows Server 2012 R2 VHD needs to be expanded in size from 40GB to See the following example: - ![ISE 1](images/ISE.png) + ![ISE 1.](images/ISE.png) 19. Click **File**, click **Save As**, and save the commands as **c:\VHD\pc1.ps1** on the Hyper-V host. 20. In the (lower) terminal input window, type the following commands to enable Guest Service Interface on PC1 and then use this service to copy the script to PC1: diff --git a/windows/deployment/windows-10-subscription-activation.md b/windows/deployment/windows-10-subscription-activation.md index 447ea81cfb..16e8c70c2a 100644 --- a/windows/deployment/windows-10-subscription-activation.md +++ b/windows/deployment/windows-10-subscription-activation.md @@ -65,7 +65,7 @@ To support Inherited Activation, both the host computer and the VM must be runni The following figure illustrates how deploying Windows 10 has evolved with each release. With this release, deployment is automatic. -![Illustration of how Windows 10 deployment has evolved](images/sa-evolution.png) +![Illustration of how Windows 10 deployment has evolved.](images/sa-evolution.png) - **Windows 7** required you to redeploy the operating system using a full wipe-and-load process if you wanted to change from Windows 7 Professional to Windows 10 Enterprise.
@@ -117,11 +117,11 @@ If the device is running Windows 10, version 1809 or later: - When the user signs in on a Hybrid Azure AD joined device with MFA enabled, a notification will indicate that there is a problem. Click the notification and then click **Fix now** to step through the subscription activation process. See the example below: - ![Subscription Activation with MFA example 1](images/sa-mfa1.png)
+ ![Subscription Activation with MFA example 1.](images/sa-mfa1.png)
- ![Subscription Activation with MFA example 2](images/sa-mfa2.png)
+ ![Subscription Activation with MFA example 2.](images/sa-mfa2.png)
- ![Subscription Activation with MFA example 3](images/sa-mfa3.png) + ![Subscription Activation with MFA example 3.](images/sa-mfa3.png) ### Windows 10 Education requirements @@ -162,7 +162,7 @@ The device is AAD joined from **Settings > Accounts > Access work or school**. The IT administrator assigns Windows 10 Enterprise to a user. See the following figure. -![Windows 10 Enterprise](images/ent.png) +![Windows 10 Enterprise.](images/ent.png) When a licensed user signs in to a device that meets requirements using their Azure AD credentials, the operating system steps up from Windows 10 Pro to Windows 10 Enterprise (or Windows 10 Pro Education to Windows 10 Education) and all the appropriate Windows 10 Enterprise/Education features are unlocked. When a user’s subscription expires or is transferred to another user, the device reverts seamlessly to Windows 10 Pro / Windows 10 Pro Education edition, once current subscription validity expires. @@ -171,10 +171,10 @@ Devices running Windows 10 Pro, version 1703 or Windows 10 Pro Education, versio The following figures summarize how the Subscription Activation model works: Before Windows 10, version 1903:
-![1703](images/before.png) +![1703.](images/before.png) After Windows 10, version 1903:
-![1903](images/after.png) +![1903.](images/after.png) > [!NOTE] > diff --git a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md index d132aa99a6..74e099fc82 100644 --- a/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md +++ b/windows/deployment/windows-autopilot/demonstrate-deployment-on-vm.md @@ -115,9 +115,9 @@ When you are prompted to restart the computer, choose **Yes**. The computer migh Alternatively, you can install Hyper-V using the Control Panel in Windows under **Turn Windows features on or off** for a client operating system, or using Server Manager's **Add Roles and Features Wizard** on a server operating system, as shown below: - ![Hyper-V feature](images/hyper-v-feature.png) + ![Hyper-V feature.](images/hyper-v-feature.png) - ![Hyper-V](images/svr_mgr2.png) + ![Hyper-V.](images/svr_mgr2.png)

If you choose to install Hyper-V using Server Manager, accept all default selections. Also be sure to install both items under Role Administration Tools\Hyper-V Management Tools. @@ -232,21 +232,21 @@ PS C:\autopilot> Ensure the VM booted from the installation ISO, click **Next** then click **Install now** and complete the Windows installation process. See the following examples: - ![Windows setup example 1](images/winsetup1.png) - ![Windows setup example 2](images/winsetup2.png) - ![Windows setup example 3](images/winsetup3.png) - ![Windows setup example 4](images/winsetup4.png) - ![Windows setup example 5](images/winsetup5.png) - ![Windows setup example 6](images/winsetup6.png) + ![Windows setup example 1.](images/winsetup1.png) + ![Windows setup example 2.](images/winsetup2.png) + ![Windows setup example 3.](images/winsetup3.png) + ![Windows setup example 4.](images/winsetup4.png) + ![Windows setup example 5.](images/winsetup5.png) + ![Windows setup example 6.](images/winsetup6.png) After the VM restarts, during OOBE, it's fine to select **Set up for personal use** or **Domain join instead** and then choose an offline account on the **Sign in** screen. This will offer the fastest way to the desktop. For example: - ![Windows setup example 7](images/winsetup7.png) + ![Windows setup example 7.](images/winsetup7.png) Once the installation is complete, sign in and verify that you are at the Windows 10 desktop, then create your first Hyper-V checkpoint. Checkpoints are used to restore the VM to a previous state. > [!div class="mx-imgBorder"] - > ![Windows setup example 8](images/winsetup8.png) + > ![Windows setup example 8.](images/winsetup8.png) To create a checkpoint, open an elevated Windows PowerShell prompt on the computer running Hyper-V (not on the VM) and run the following: @@ -322,7 +322,7 @@ Follow these steps to run the PowerShell script: > [!NOTE] > Although the .csv extension might be associated with Microsoft Excel, you cannot view the file properly by double-clicking it. To correctly parse the comma delimiters and view the file in Excel, you must use the **Data** > **From Text/CSV** function in Excel to import the appropriate data columns. You don't need to view the file in Excel unless you are curious. The file format will be validated when it is imported into Autopilot. An example of the data in this file is shown below. - ![Serial number and hardware hash](images/hwid.png) + ![Serial number and hardware hash.](images/hwid.png) You will need to upload this data into Intune to register your device for Autopilot, so the next step is to transfer this file to the computer you will use to access the Azure portal. If you are using a physical device instead of a VM, you can copy the file to a USB stick. If you’re using a VM, you can right-click the AutopilotHWID.csv file and copy it, then right-click and paste the file to your desktop (outside the VM). @@ -338,11 +338,11 @@ With the hardware ID captured in a file, prepare your Virtual Machine for Window On the Virtual Machine, go to **Settings > Update & Security > Recovery** and click on **Get started** under **Reset this PC**. Select **Remove everything** and **Just remove my files**. If you are asked **How would you like to reinstall Windows**, select Local reinstall. Finally, click on **Reset**. -![Reset this PC final prompt](images/autopilot-reset-prompt.jpg) +![Reset this PC final prompt.](images/autopilot-reset-prompt.jpg) Resetting the VM or device can take a while. Proceed to the next step (verify subscription level) during the reset process. -![Reset this PC screen capture](images/autopilot-reset-progress.jpg) +![Reset this PC screen capture.](images/autopilot-reset-progress.jpg) ## Verify subscription level @@ -350,13 +350,13 @@ For this lab, you need an AAD Premium subscription. You can tell if you have a **Azure Active Directory** > **Mobility (MDM and MAM)** > **Microsoft Intune** -![MDM and Intune](images/mdm-intune2.png) +![MDM and Intune.](images/mdm-intune2.png) If the configuration blade shown above does not appear, it's likely that you don't have a **Premium** subscription. Auto-enrollment is a feature only available in AAD Premium. To convert your Intune trial account to a free Premium trial account, navigate to **Azure Active Directory** > **Licenses** > **All products** > **Try / Buy** and select **Free trial** for Azure AD Premium, or EMS E5. -![License conversion option](images/aad-lic1.png) +![License conversion option.](images/aad-lic1.png) ## Configure company branding @@ -367,7 +367,7 @@ If you already have company branding configured in Azure Active Directory, you c Navigate to [Company branding in Azure Active Directory](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/LoginTenantBranding), click on **Configure** and configure any type of company branding you'd like to see during the OOBE. -![Configure company branding](images/branding.png) +![Configure company branding.](images/branding.png) When you are finished, click **Save**. @@ -382,7 +382,7 @@ Open [Mobility (MDM and MAM) in Azure Active Directory](https://portal.azure.com For the purposes of this demo, select **All** under the **MDM user scope** and click **Save**. -![MDM user scope in the Mobility blade](images/ap-aad-mdm.png) +![MDM user scope in the Mobility blade.](images/ap-aad-mdm.png) ## Register your VM @@ -392,14 +392,14 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B 1. In the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/), choose **Devices** > **Device enrollment | Enroll devices** > **Windows enrollment** > **Windows Autopilot Deployment Program | Devices** and then on the **Windows Autopilot devices** page, choose **Import**. - ![Intune device import](images/enroll1.png) + ![Intune device import.](images/enroll1.png) > [!NOTE] > If menu items like **Windows enrollment** are not active for you, then look to the far-right blade in the UI. You might need to provide Intune configuration privileges in a challenge window that appeared. 2. Under **Add Windows Autopilot devices** in the far right pane, browse to the **AutopilotHWID.csv** file you previously copied to your local computer. The file should contain the serial number and 4K HH of your VM (or device). It's okay if other fields (Windows Product ID) are left blank. - ![HWID CSV](images/enroll2.png) + ![HWID CSV.](images/enroll2.png) You should receive confirmation that the file is formatted correctly before uploading it, as shown above. @@ -407,7 +407,7 @@ Your VM (or device) can be registered either via Intune or Microsoft Store for B 4. Click **Refresh** to verify your VM or device has been added. See the following example. - ![Import HWID](images/enroll3.png) + ![Import HWID.](images/enroll3.png) ### Autopilot registration using MSfB @@ -426,11 +426,11 @@ Next, sign in to [Microsoft Store for Business](https://businessstore.microsoft. Select **Manage** from the top menu, then click the **Windows Autopilot Deployment Program** link under the **Devices** card. See the following example: -![Microsoft Store for Business](images/msfb.png) +![Microsoft Store for Business.](images/msfb.png) Click the **Add devices** link to upload your CSV file. A message will appear indicating your request is being processed. Wait a few moments before refreshing to see your new device has been added. -![Microsoft Store for Business Devices](images/msfb-device.png) +![Microsoft Store for Business Devices.](images/msfb-device.png) ## Create and assign a Windows Autopilot deployment profile @@ -446,7 +446,7 @@ Pick one: > [!NOTE] > Even if you registered your device in MSfB, it will still appear in Intune, though you might have to **sync** and then **refresh** your device list. -![Devices](images/enroll4.png) +![Devices.](images/enroll4.png) #### Create a device group @@ -463,7 +463,7 @@ The Autopilot deployment profile wizard will ask for a device group, so we must 3. Click **Members** and add the Autopilot VM to the group. See the following example: > [!div class="mx-imgBorder"] - > ![add members](images/group1.png) + > ![add members.](images/group1.png) 4. Click **Create**. @@ -472,12 +472,12 @@ The Autopilot deployment profile wizard will ask for a device group, so we must To create a Windows Autopilot profile, scroll back to the left hand pane and click **Devices**, then under **Enroll devices | Windows enrollment** select **Deployment Profiles**. > [!div class="mx-imgBorder"] -> ![Deployment profiles](images/dp.png) +> ![Deployment profiles.](images/dp.png) Click on **Create profile** and then select **Windows PC**. > [!div class="mx-imgBorder"] -> ![Create deployment profile](images/create-profile.png) +> ![Create deployment profile.](images/create-profile.png) On the **Create profile** blade, use the following values: @@ -512,7 +512,7 @@ Click **Next** to continue with the **Assignments** settings: 2. Click the **Autopilot Lab** group, and then click **Select**. 3. Click **Next** to continue and then click **Create**. See the following example: -![Deployment profile](images/profile.png) +![Deployment profile.](images/profile.png) Click on **OK** and then click on **Create**. @@ -529,7 +529,7 @@ First, sign in to the [Microsoft Store for Business](https://businessstore.micro Click **Manage** from the top menu, then click **Devices** from the left navigation tree. -![MSfB manage](images/msfb-manage.png) +![MSfB manage.](images/msfb-manage.png) Click the **Windows Autopilot Deployment Program** link in the **Devices** tile. @@ -538,17 +538,17 @@ To CREATE the profile: Select your device from the **Devices** list: > [!div class="mx-imgBorder"] -> ![MSfB create step 1](images/msfb-create1.png) +> ![MSfB create step 1.](images/msfb-create1.png) On the Autopilot deployment dropdown menu, select **Create new profile**: > [!div class="mx-imgBorder"] -> ![MSfB create step 2](images/msfb-create2.png) +> ![MSfB create step 2.](images/msfb-create2.png) Name the profile, choose your desired settings, and then click **Create**: > [!div class="mx-imgBorder"] -> ![MSfB create step 3](images/msfb-create3.png) +> ![MSfB create step 3.](images/msfb-create3.png) The new profile is added to the Autopilot deployment list. @@ -557,12 +557,12 @@ To ASSIGN the profile: To assign (or reassign) the profile to a device, select the checkboxes next to the device you registered for this lab, then select the profile you want to assign from the **Autopilot deployment** dropdown menu as shown: > [!div class="mx-imgBorder"] -> ![MSfB assign step 1](images/msfb-assign1.png) +> ![MSfB assign step 1.](images/msfb-assign1.png) Confirm the profile was successfully assigned to the intended device by checking the contents of the **Profile** column: > [!div class="mx-imgBorder"] -> ![MSfB assign step 2](images/msfb-assign2.png) +> ![MSfB assign step 2.](images/msfb-assign2.png) > [!IMPORTANT] > The new profile will only be applied if the device has not been started, and gone through OOBE. Settings from a different profile can't be applied when another profile has been applied. Windows would need to be reinstalled on the device for the second profile to be applied to the device. @@ -572,7 +572,7 @@ Confirm the profile was successfully assigned to the intended device by checking If you shut down your VM after the last reset, it's time to start it back up again, so it can progress through the Autopilot OOBE experience but do not attempt to start your device again until the **PROFILE STATUS** for your device in Intune has changed from **Not assigned** to **Assigning** and finally **Assigned**: > [!div class="mx-imgBorder"] -> ![Device status](images/device-status.png) +> ![Device status.](images/device-status.png) Also, make sure to wait at least 30 minutes from the time you've [configured company branding](#configure-company-branding), otherwise these changes might not show up. @@ -583,12 +583,12 @@ Also, make sure to wait at least 30 minutes from the time you've [configured com - Turn on the device - Verify that the appropriate OOBE screens (with appropriate Company Branding) appear. You should see the region selection screen, the keyboard selection screen, and the second keyboard selection screen (which you can skip). -![OOBE sign-in page](images/autopilot-oobe.png) +![OOBE sign-in page.](images/autopilot-oobe.png) Soon after reaching the desktop, the device should show up in Intune as an **enabled** Autopilot device. Go into the Intune Azure portal, and select **Devices > All devices**, then **Refresh** the data to verify that your device has changed from disabled to enabled, and the name of the device is updated. > [!div class="mx-imgBorder"] -> ![Device enabled](images/devices1.png) +> ![Device enabled.](images/devices1.png) Once you select a language and a keyboard layout, your company branded sign-in screen should appear. Provide your Azure Active Directory credentials and you're all done. @@ -606,7 +606,7 @@ To use the device (or VM) for other purposes after completion of this lab, you w You need to delete (or retire, or factory reset) the device from Intune before deregistering the device from Autopilot. To delete the device from Intune (not Azure Active Directory), log into the MEM admin center, then navigate to **Intune > Devices > All Devices**. Select the device you want to delete, then click the Delete button along the top menu. > [!div class="mx-imgBorder"] -> ![Delete device step 1](images/delete-device1.png) +> ![Delete device step 1.](images/delete-device1.png) This will remove the device from Intune management, and it will disappear from **Intune > Devices > All devices**. But this does not yet deregister the device from Autopilot, so the device should still appear under **Intune > Device Enrollment > Windows Enrollment > Windows Autopilot Deployment Program > Devices**. @@ -618,7 +618,7 @@ The **Intune > Devices > All Devices** list and the **Intune > Device Enrollment To remove the device from the Autopilot program, select the device and click **Delete**. You will get a popup dialog box to confirm deletion. > [!div class="mx-imgBorder"] -> ![Delete device](images/delete-device2.png) +> ![Delete device.](images/delete-device2.png) At this point, your device has been unenrolled from Intune and also deregistered from Autopilot. After several minutes, click the **Sync** button, followed by the **Refresh** button to confirm the device is no longer listed in the Autopilot program: @@ -686,7 +686,7 @@ Download the Notepad++ msi package [here](https://www.hass.de/content/notepad-ms Run the IntuneWinAppUtil tool, supplying answers to the three questions, for example: > [!div class="mx-imgBorder"] -> ![Add app example](images/app01.png) +> ![Add app example.](images/app01.png) After the tool finishes running, you should have an .intunewin file in the Output folder, which you can now upload into Intune using the following steps. @@ -696,20 +696,20 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Add app step 1](images/app02.png) +![Add app step 1.](images/app02.png) Under **App Type**, select **Windows app (Win32)**: -![Add app step 2](images/app03.png) +![Add app step 2.](images/app03.png) On the **App package file** blade, browse to the **npp.7.6.3.installer.x64.intunewin** file in your output folder, open it, then click **OK**: > [!div class="mx-imgBorder"] -> ![Add app step 3](images/app04.png) +> ![Add app step 3.](images/app04.png) On the **App Information Configure** blade, provide a friendly name, description, and publisher, such as: -![Add app step 4](images/app05.png) +![Add app step 4.](images/app05.png) On the **Program Configuration** blade, supply the install and uninstall commands: @@ -721,7 +721,7 @@ Uninstall: msiexec /x "{F188A506-C3C6-4411-BE3A-DA5BF1EA6737}" /q > [!NOTE] > Likely, you do not have to write the install and uninstall commands yourself because the [IntuneWinAppUtil.exe command-line tool](https://github.com/Microsoft/Microsoft-Win32-Content-Prep-Tool) automatically generated them when it converted the .msi file into a .intunewin file. -![Add app step 5](images/app06.png) +![Add app step 5.](images/app06.png) Simply using an install command like "notepad++.exe /S" will not actually install Notepad++; it will only launch the app. To actually install the program, we need to use the .msi file instead. Notepad++ doesn't actually have an .msi version of their program, but we got an .msi version from a [third party provider](https://www.hass.de/content/notepad-msi-package-enterprise-deployment-available). @@ -730,23 +730,23 @@ Click **OK** to save your input and activate the **Requirements** blade. On the **Requirements Configuration** blade, specify the **OS architecture** and the **Minimum OS version**: > [!div class="mx-imgBorder"] -> ![Add app step 6](images/app07.png) +> ![Add app step 6.](images/app07.png) Next, configure the **Detection rules**. For our purposes, we will select manual format: > [!div class="mx-imgBorder"] -> ![Add app step 7](images/app08.png) +> ![Add app step 7.](images/app08.png) Click **Add** to define the rule properties. For **Rule type**, select **MSI**, which will automatically import the right MSI product code into the rule: -![Add app step 8](images/app09.png) +![Add app step 8.](images/app09.png) Click **OK** twice to save, as you back out to the main **Add app** blade again for the final configuration. **Return codes**: For our purposes, leave the return codes at their default values: > [!div class="mx-imgBorder"] -> ![Add app step 9](images/app10.png) +> ![Add app step 9.](images/app10.png) Click **OK** to exit. @@ -757,12 +757,12 @@ Click the **Add** button to finalize and save your app package. Once the indicator message says the addition has completed. > [!div class="mx-imgBorder"] -> ![Add app step 10](images/app11.png) +> ![Add app step 10.](images/app11.png) You will be able to find your app in your app list: > [!div class="mx-imgBorder"] -> ![Add app step 11](images/app12.png) +> ![Add app step 11.](images/app12.png) #### Assign the app to your Intune profile @@ -772,7 +772,7 @@ You will be able to find your app in your app list: In the **Intune > Client Apps > Apps** pane, select the app package you already created to reveal its properties blade. Then click **Assignments** from the menu: > [!div class="mx-imgBorder"] -> ![Assign app step 1](images/app13.png) +> ![Assign app step 1.](images/app13.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -783,10 +783,10 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Assign app step 2](images/app14.png) +![Assign app step 2.](images/app14.png) > [!div class="mx-imgBorder"] -> ![Assign app step 3](images/app15.png) +> ![Assign app step 3.](images/app15.png) In the **Select groups** pane, click the **Select** button. @@ -797,7 +797,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. > [!div class="mx-imgBorder"] -> ![Assign app step 4](images/app16.png) +> ![Assign app step 4.](images/app16.png) At this point, you have completed steps to add a Win32 app to Intune. @@ -811,16 +811,16 @@ Log into the Azure portal and select **Intune**. Navigate to **Intune > Clients apps > Apps**, and then click the **Add** button to create a new app package. -![Create app step 1](images/app17.png) +![Create app step 1.](images/app17.png) Under **App Type**, select **Office 365 Suite > Windows 10**: -![Create app step 2](images/app18.png) +![Create app step 2.](images/app18.png) Under the **Configure App Suite** pane, select the Office apps you want to install. For the purposes of this labe we have only selected Excel: > [!div class="mx-imgBorder"] -> ![Create app step 3](images/app19.png) +> ![Create app step 3.](images/app19.png) Click **OK**. @@ -829,13 +829,13 @@ In the **App Suite Information** pane, enter a unique suite name, and a s Enter the name of the app suite as it is displayed in the company portal. Make sure that all suite names that you use are unique. If the same app suite name exists twice, only one of the apps is displayed to users in the company portal. > [!div class="mx-imgBorder"] -> ![Create app step 4](images/app20.png) +> ![Create app step 4.](images/app20.png) Click **OK**. In the **App Suite Settings** pane, select **Monthly** for the **Update channel** (any selection would be fine for the purposes of this lab). Also select **Yes** for **Automatically accept the app end user license agreement**: -![Create app step 5](images/app21.png) +![Create app step 5.](images/app21.png) Click **OK** and then click **Add**. @@ -847,7 +847,7 @@ Click **OK** and then click **Add**. In the **Intune > Client Apps > Apps** pane, select the Office package you already created to reveal its properties blade. Then click **Assignments** from the menu: > [!div class="mx-imgBorder"] -> ![Create app step 6](images/app22.png) +> ![Create app step 6.](images/app22.png) Select **Add Group** to open the **Add group** pane that is related to the app. @@ -857,10 +857,10 @@ For our purposes, select **Required** from the **Assignment type** dropdown menu Select **Included Groups** and assign the groups you previously created that will use this app: -![Create app step 7](images/app23.png) +![Create app step 7.](images/app23.png) > [!div class="mx-imgBorder"] -> ![Create app step 8](images/app24.png) +> ![Create app step 8.](images/app24.png) In the **Select groups** pane, click the **Select** button. @@ -870,7 +870,7 @@ In the **Add group** pane, select **OK**. In the app **Assignments** pane, select **Save**. -![Create app step 9](images/app25.png) +![Create app step 9.](images/app25.png) At this point, you have completed steps to add Office to Intune. @@ -878,7 +878,7 @@ For more information on adding Office apps to Intune, see [Assign Office 365 app If you installed both the win32 app (Notepad++) and Office (just Excel) per the instructions in this lab, your VM will show them in the apps list, although it could take several minutes to populate: -![Create app step 10](images/app26.png) +![Create app step 10.](images/app26.png) ## Glossary diff --git a/windows/deployment/windows-deployment-scenarios-and-tools.md b/windows/deployment/windows-deployment-scenarios-and-tools.md index 0d04abd1e0..04f798b127 100644 --- a/windows/deployment/windows-deployment-scenarios-and-tools.md +++ b/windows/deployment/windows-deployment-scenarios-and-tools.md @@ -29,7 +29,7 @@ In this topic, you also learn about different types of reference images that you Windows ADK contains core assessment and deployment tools and technologies, including Deployment Image Servicing and Management (DISM), Windows Imaging and Configuration Designer (Windows ICD), Windows System Image Manager (Windows SIM), User State Migration Tool (USMT), Volume Activation Management Tool (VAMT), Windows Preinstallation Environment (Windows PE), Windows Assessment Services, Windows Performance Toolkit (WPT), Application Compatibility Toolkit (ACT), and Microsoft SQL Server 2012 Express. For more details, see [Windows ADK for Windows 10](/windows-hardware/get-started/adk-install) or [Windows ADK for Windows 10 scenarios for IT Pros](windows-adk-scenarios-for-it-pros.md). -![figure 1](images/win-10-adk-select.png) +![figure 1.](images/win-10-adk-select.png) The Windows 10 ADK feature selection page. @@ -50,7 +50,7 @@ Enable-WindowsOptionalFeature -Online -FeatureName NetFx3 -All -Source D:\Sources\SxS -LimitAccess ``` -![figure 2](images/mdt-11-fig05.png) +![figure 2.](images/mdt-11-fig05.png) Using DISM functions in PowerShell. @@ -77,7 +77,7 @@ In addition to these tools, there are also XML templates that manage which data - **Custom templates.** Custom templates that you create. - **Config template.** An optional template, called Config.xml, which you can use to exclude or include components in a migration without modifying the other standard XML templates. -![figure 3](images/mdt-11-fig06.png) +![figure 3.](images/mdt-11-fig06.png) A sample USMT migration file that will exclude .MP3 files on all local drives and include the folder C:\\Data and all its files, including its subdirectories and their files. @@ -100,7 +100,7 @@ These are the settings migrated by the default MigUser.xml and MigApp.xml templa Windows Imaging and Configuration Designer (Windows ICD) is a tool designed to assist with the creation of provisioning packages that can be used to dynamically configure a Windows device (PCs, tablets, and phones). This is particularly useful for setting up new devices, without the need for re-imaging the device with a custom image. -![figure 4](images/windows-icd.png) +![figure 4.](images/windows-icd.png) Windows Imaging and Configuration Designer. @@ -110,7 +110,7 @@ For more information, see [Windows Imaging and Configuration Designer](/windows/ Windows SIM is an authoring tool for Unattend.xml files. When using MDT and/or Configuration Manager, you don’t need Windows SIM very often because those systems automatically update the Unattend.xml file during the deployment, greatly simplifying the process overall. -![figure 7](images/mdt-11-fig07.png) +![figure 7.](images/mdt-11-fig07.png) Windows answer file opened in Windows SIM. @@ -120,7 +120,7 @@ For more information, see [Windows System Image Manager Technical Reference]( ht If you don’t use KMS, you can still manage your MAKs centrally with the Volume Activation Management Tool (VAMT). With this tool, you can install and manage product keys throughout the organization. VAMT also can activate on behalf of clients without Internet access, acting as a MAK proxy. -![figure 6](images/mdt-11-fig08.png) +![figure 6.](images/mdt-11-fig08.png) The updated Volume Activation Management Tool. @@ -138,7 +138,7 @@ Windows PE is a “Lite” version of Windows 10 and was created to act as a dep The key thing to know about Windows PE is that, like the operating system, it needs drivers for at least network and storage devices in each PC. Luckily Windows PE includes the same drivers as the full Windows 10 operating system, which means much of your hardware will work out of the box. -![figure 7](images/mdt-11-fig09.png) +![figure 7.](images/mdt-11-fig09.png) A machine booted with the Windows ADK default Windows PE boot image. @@ -149,7 +149,7 @@ For more details on Windows PE, see [Windows PE (WinPE)](/windows-hardware/manuf Windows Recovery Environment (Windows RE) is a diagnostics and recovery toolset included in Windows Vista and later operating systems. The latest version of Windows RE is based on Windows PE. You can also extend Windows RE and add your own tools if needed. If a Windows installation fails to start and Windows RE is installed, you will see an automatic failover into Windows RE. -![figure 8](images/mdt-11-fig10.png) +![figure 8.](images/mdt-11-fig10.png) A Windows 10 client booted into Windows RE, showing Advanced options. @@ -160,7 +160,7 @@ For more information on Windows RE, see [Windows Recovery Environment](/windows- Windows Deployment Services (WDS) has been updated and improved in several ways starting with Windows 8. Remember that the two main functions you will use are the PXE boot support and multicast. Most of the changes are related to management and increased performance. In Windows Server 2012 R2, WDS also can be used for the Network Unlock feature in BitLocker. -![figure 9](images/mdt-11-fig11.png) +![figure 9.](images/mdt-11-fig11.png) Windows Deployment Services using multicast to deploy three machines. @@ -176,7 +176,7 @@ Also, there are a few new features related to TFTP performance: - **Scalable port management.** Provides the capability to service clients with shared UDP port allocation, increasing scalability. - **Variable-size transmission window (Variable Windows Extension).** Improves TFTP performance by allowing the client and server to determine the largest workable window size. -![figure 10](images/mdt-11-fig12.png) +![figure 10.](images/mdt-11-fig12.png) TFTP changes are now easy to perform. @@ -192,7 +192,7 @@ Lite Touch and Zero Touch are marketing names for the two solutions that MDT sup -![figure 11](images/mdt-11-fig13.png) +![figure 11.](images/mdt-11-fig13.png) The Deployment Workbench in, showing a task sequence. @@ -203,7 +203,7 @@ For more information on MDT, see the [Microsoft Deployment Toolkit](/mem/configm [Microsoft SCM](https://go.microsoft.com/fwlink/p/?LinkId=619246) is a free utility used to create baseline security settings for the Windows client and server environment. The baselines can be exported and then deployed via Group Policy, local policies, MDT, or Configuration Manager. The current version of Security Compliance Manager includes baselines for Windows 8.1 and several earlier versions of Windows, Windows Server, and Internet Explorer. -![figure 12](images/mdt-11-fig14.png) +![figure 12.](images/mdt-11-fig14.png) The SCM console showing a baseline configuration for a fictional client's computer security compliance. @@ -228,7 +228,7 @@ For more information on the benefits of an MDOP subscription, see [Microsoft Des There has been a version of IEAK for every version of Internet Explorer since 3.0. It gives you the capability to customize Internet Explorer as you would like. The end result of using IEAK is an Internet Explorer package that can be deployed unattended. The wizard creates one .exe file and one .msi file. -![figure 13](images/mdt-11-fig15.png) +![figure 13.](images/mdt-11-fig15.png) The User Experience selection screen in IEAK 11. @@ -239,7 +239,7 @@ To download IEAK 11, see the [Internet Explorer Administration Kit (IEAK) Inform WSUS is a server role in Windows Server 2012 R2 that enables you to maintain a local repository of Microsoft updates and then distribute them to machines on your network. WSUS offers approval control and reporting of update status in your environment. -![figure 14](images/mdt-11-fig16.png) +![figure 14.](images/mdt-11-fig16.png) The Windows Server Update Services console. diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index 930819c367..5852e85928 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -64,7 +64,7 @@ Note that this setting does not control whether your device sends diagnostic dat 2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn on data viewing](images/ddv-data-viewing.png) + ![Location to turn on data viewing.](images/ddv-data-viewing.png) **To turn on data viewing through PowerShell** @@ -134,7 +134,7 @@ When you're done reviewing your diagnostic data, we recommend turning off data v 2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn off data viewing](images/ddv-settings-off.png) + ![Location to turn off data viewing.](images/ddv-settings-off.png) **To turn off data viewing through PowerShell** diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 3b40651ee2..dc9a127179 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -38,7 +38,7 @@ Before you can use this tool for viewing Windows diagnostic data, you must turn 2. Under **Diagnostic data**, turn on the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn on data viewing](images/ddv-data-viewing.png) + ![Location to turn on data viewing.](images/ddv-data-viewing.png) ### Download the Diagnostic Data Viewer Download the app from the [Microsoft Store Diagnostic Data Viewer](https://www.microsoft.com/store/p/diagnostic-data-viewer/9n8wtrrsq8f7?rtc=1) page. @@ -54,7 +54,7 @@ You can start this app from the **Settings** panel. 2. Under **Diagnostic data**, select the **Diagnostic Data Viewer** button. - ![Location to turn on the Diagnostic Data Viewer](images/ddv-settings-launch.png)

-OR-

+ ![Location to turn on the Diagnostic Data Viewer.](images/ddv-settings-launch.png)

-OR-

Go to **Start** and search for _Diagnostic Data Viewer_. @@ -73,7 +73,7 @@ The Diagnostic Data Viewer provides you with the following features to view and >[!Important] >Seeing an event does not necessarily mean it has been uploaded yet. It’s possible that some events are still queued and will be uploaded at a later time. - ![View your diagnostic events](images/ddv-event-view.jpg) + ![View your diagnostic events.](images/ddv-event-view.jpg) - **Search your diagnostic events.** The **Search** box at the top of the screen lets you search amongst all of the diagnostic event details. The returned search results include any diagnostic event that contains the matching text. @@ -83,7 +83,7 @@ The Diagnostic Data Viewer provides you with the following features to view and - **Help to make your Windows experience better.** Microsoft only needs diagnostic data from a small amount of devices to make big improvements to the Windows operating system and ultimately, your experience. If you’re a part of this small device group and you experience issues, Microsoft will collect the associated event diagnostic data, allowing your info to potentially help fix the issue for others. - To signify your contribution, you’ll see this icon (![Icon to review the device-level sampling](images/ddv-device-sample.png)) if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon (![Icon to review the event-level sampling](images/ddv-event-sample.png)). + To signify your contribution, you’ll see this icon (![Icon to review the device-level sampling.](images/ddv-device-sample.png)) if your device is part of the group. In addition, if any of your diagnostic data events are sent from your device to Microsoft to help make improvements, you’ll see this icon (![Icon to review the event-level sampling](images/ddv-event-sample.png)). - **Provide diagnostic event feedback.** The **Feedback** icon in the upper right corner of the window opens the Feedback Hub app, letting you provide feedback about the Diagnostic Data Viewer and the diagnostic events. @@ -99,7 +99,7 @@ The Diagnostic Data Viewer provides you with the following features to view and >[!Important] >This content is a reflection of the history of Windows data the app has stored. If you'd like to have extended analyses, please modify the storage capacity of Diagnostic Data Viewer. - ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer](images/ddv-analytics.png) + ![Look at an overview of what data you've shared with Microsoft through the 'About my data' page in Diagnostic Data Viewer.](images/ddv-analytics.png) ## View Office Diagnostic Data By default, Diagnostic Data Viewer shows you Windows data. You can also view Office diagnostic data by enabling the feature in the app settings page. To learn more about how to view Office diagnostic data, please visit this [page](https://go.microsoft.com/fwlink/?linkid=2023830). @@ -112,7 +112,7 @@ When you're done reviewing your diagnostic data, you should turn of data viewing 2. Under **Diagnostic data**, turn off the **If data viewing is enabled, you can see your diagnostics data** option. - ![Location to turn off data viewing](images/ddv-settings-off.png) + ![Location to turn off data viewing.](images/ddv-settings-off.png) ## Modifying the size of your data history By default, Diagnostic Data Viewer shows you up to 1GB or 30 days of data (whichever comes first) for Windows diagnostic data. Once either the time or space limit is reached, the data is incrementally dropped with the oldest data points dropped first. @@ -139,7 +139,7 @@ You can also use the Windows Error Reporting tool available in the Control Panel Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer. -![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer](images/ddv-problem-reports.png) +![Starting with Windows 1809 and higher, you can review Windows Error Reporting diagnostic data in the Diagnostic Data Viewer.](images/ddv-problem-reports.png) **To view your Windows Error Reporting diagnostic data using the Control Panel** @@ -147,7 +147,7 @@ Go to **Start**, select **Control Panel** > **All Control Panel Items** > **Secu Go to **Start** and search for _Problem Reports_. The **Review problem reports** tool opens, showing you your Windows Error Reporting reports, along with a status about whether it was sent to Microsoft. -![View problem reports tool with report statuses](images/control-panel-problem-reports-screen.png) +![View problem reports tool with report statuses.](images/control-panel-problem-reports-screen.png) ## Known Issues with Diagnostic Data Viewer diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index aad2616468..f1f0d9469a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -57,60 +57,60 @@ The following table lists management options for each setting, beginning with Wi | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [9. License Manager](#bkmk-licmgr) | | | ![Check mark](images/checkmark.png) | -| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [5. Find My Device](#find-my-device) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [6. Font streaming](#font-streaming) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [9. License Manager](#bkmk-licmgr) | | | ![Check mark.](images/checkmark.png) | +| [10. Live Tiles](#live-tiles) | | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | +| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark.](images/checkmark.png) | | ![Check mark.](images/checkmark.png) | +| [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark.](images/checkmark.png) | +| [13. Microsoft Edge](#bkmk-edge) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [16. OneDrive](#bkmk-onedrive) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.1 General](#bkmk-general) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.22 Activity History](#bkmk-act-history) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [20. Storage Health](#bkmk-storage-health) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Teredo](#bkmk-teredo) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [29. Windows Update](#bkmk-wu) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | -| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [31. Services Configuration](#bkmk-svccfg) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ### Settings for Windows Server 2016 with Desktop Experience @@ -119,20 +119,20 @@ See the following table for a summary of the management settings for Windows Ser | Setting | UI | Group Policy | Registry | | - | :-: | :-: | :-: | -| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [2. Cortana and Search](#bkmk-cortana) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [6. Font streaming](#font-streaming) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [8. Internet Explorer](#bkmk-ie) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [10. Live Tiles](#live-tiles) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | -| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [16. OneDrive](#bkmk-onedrive) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [19. Software Protection Platform](#bkmk-spp) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [22. Teredo](#bkmk-teredo) | | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | @@ -172,54 +172,54 @@ See the following table for a summary of the management settings for Windows Ser | - | :-: | :-: | :-: | | [1. Automatic Root Certificates Update](#automatic-root-certificates-update) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [2. Cortana and Search](#bkmk-cortana) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [3. Date & Time](#bkmk-datetime) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [3. Date & Time](#bkmk-datetime) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [4. Device metadata retrieval](#bkmk-devinst) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [5. Find My Device](#find-my-device) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [5. Find My Device](#find-my-device) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [6. Font streaming](#font-streaming) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [7. Insider Preview builds](#bkmk-previewbuilds) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [8. Internet Explorer](#bkmk-ie) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [10. Live Tiles](#live-tiles) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +| [11. Mail synchronization](#bkmk-mailsync) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | | [12. Microsoft Account](#bkmk-microsoft-account) | | | ![Check mark](images/checkmark.png) | | [13. Microsoft Edge](#bkmk-edge) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [14. Network Connection Status Indicator](#bkmk-ncsi) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [15. Offline maps](#bkmk-offlinemaps) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [16. OneDrive](#bkmk-onedrive) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [17. Preinstalled apps](#bkmk-preinstalledapps) | ![Check mark](images/checkmark.png) | | | | [18. Settings > Privacy](#bkmk-settingssection) | | | | -|     [18.1 General](#bkmk-general) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.2 Location](#bkmk-priv-location) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| -|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.11 Email](#bkmk-priv-email) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark](images/checkmark.png) | | ![Check mark](images/checkmark.png) | -|     [18.22 Activity History](#bkmk-act-history) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.1 General](#bkmk-general) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.2 Location](#bkmk-priv-location) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.3 Camera](#bkmk-priv-camera) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.4 Microphone](#bkmk-priv-microphone) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.5 Notifications](#bkmk-priv-notifications) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png)| +|     [18.6 Speech](#bkmk-priv-speech) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.7 Account info](#bkmk-priv-accounts) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.8 Contacts](#bkmk-priv-contacts) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.9 Calendar](#bkmk-priv-calendar) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.10 Call history](#bkmk-priv-callhistory) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.11 Email](#bkmk-priv-email) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.12 Messaging](#bkmk-priv-messaging) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.13 Phone calls](#bkmk-priv-phone-calls) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.14 Radios](#bkmk-priv-radios) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.15 Other devices](#bkmk-priv-other-devices) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.16 Feedback & diagnostics](#bkmk-priv-feedback) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.17 Background apps](#bkmk-priv-background) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.18 Motion](#bkmk-priv-motion) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.19 Tasks](#bkmk-priv-tasks) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.20 App Diagnostics](#bkmk-priv-diag) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.21 Inking & Typing](#bkmk-priv-ink) | ![Check mark.](images/checkmark.png) | | ![Check mark](images/checkmark.png) | +|     [18.22 Activity History](#bkmk-act-history) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +|     [18.23 Voice Activation](#bkmk-voice-act) | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [19. Software Protection Platform](#bkmk-spp) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [20. Storage Health](#bkmk-storage-health) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [21. Sync your settings](#bkmk-syncsettings) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [22. Teredo](#bkmk-teredo) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [23. Wi-Fi Sense](#bkmk-wifisense) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [24. Microsoft Defender Antivirus](#bkmk-defender) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [25. Windows Spotlight](#bkmk-spotlight) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [26. Microsoft Store](#bkmk-windowsstore) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | -| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark](images/checkmark.png) |![Check mark](images/checkmark.png) | -| [28. Delivery Optimization](#bkmk-updates) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | +| [27. Apps for websites](#bkmk-apps-for-websites) | | ![Check mark.](images/checkmark.png) |![Check mark](images/checkmark.png) | +| [28. Delivery Optimization](#bkmk-updates) | ![Check mark.](images/checkmark.png) | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [29. Windows Update](#bkmk-wu) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | | [30. Cloud Clipboard](#bkmk-clcp) | | ![Check mark](images/checkmark.png) | | | [31. Services Configuration](#bkmk-svccfg) | | ![Check mark](images/checkmark.png) | ![Check mark](images/checkmark.png) | diff --git a/windows/security/identity-protection/access-control/active-directory-accounts.md b/windows/security/identity-protection/access-control/active-directory-accounts.md index 8ac3729427..69dba47679 100644 --- a/windows/security/identity-protection/access-control/active-directory-accounts.md +++ b/windows/security/identity-protection/access-control/active-directory-accounts.md @@ -592,7 +592,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s > **Note**  You might have to delegate permissions to join computers to the domain if the account that joins the workstations to the domain does not already have them. For more information, see [Delegation of Administration in Active Directory](https://social.technet.microsoft.com/wiki/contents/articles/20292.delegation-of-administration-in-active-directory.aspx). - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample1.gif) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample1.gif) 3. Close Active Directory Users and Computers. @@ -600,13 +600,13 @@ In this procedure, the workstations are dedicated to domain administrators. By s 5. Right-click the new OU, and > **Create a GPO in this domain, and Link it here**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample2.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample2.png) 6. Name the GPO, and > **OK**. 7. Expand the GPO, right-click the new GPO, and > **Edit**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample3.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample3.png) 8. Configure which members of accounts can log on locally to these administrative workstations as follows: @@ -625,7 +625,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s 5. Click **Add User or Group**, type **Administrators**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample4.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample4.png) 9. Configure the proxy configuration: @@ -633,7 +633,7 @@ In this procedure, the workstations are dedicated to domain administrators. By s 2. Double-click **Proxy Settings**, select the **Enable proxy settings** check box, type **127.0.0.1** (the network Loopback IP address) as the proxy address, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample5.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample5.png) 10. Configure the loopback processing mode to enable the user Group Policy proxy setting to apply to all users on the computer as follows: @@ -696,11 +696,11 @@ In this procedure, the workstations are dedicated to domain administrators. By s 1. Right-click **Windows Firewall with Advanced Security LDAP://path**, and > **Properties**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample6.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample6.png) 2. On each profile, ensure that the firewall is enabled and that inbound connections are set to **Block all connections**. - ![Active Directory local accounts](images/adlocalaccounts-proc1-sample7.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc1-sample7.png) 3. Click **OK** to complete the configuration. @@ -738,11 +738,11 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Right-click **Group Policy Objects**, and > **New**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample1.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample1.png) 4. In the **New GPO** dialog box, name the GPO that restricts administrators from signing in to workstations, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample2.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample2.png) 5. Right-click **New GPO**, and > **Edit**. @@ -756,7 +756,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Click **Add User or Group**, click **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample3.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample3.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -778,7 +778,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 3. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample4.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample4.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -791,7 +791,7 @@ For this procedure, do not link accounts to the OU that contain workstations for 6. Click **Add User or Group** > **Browse**, type **Domain Admins**, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample5.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample5.png) **Note** You can optionally add any groups that contain server administrators who you want to restrict from signing in to workstations. @@ -804,11 +804,11 @@ For this procedure, do not link accounts to the OU that contain workstations for 1. Right-click the workstation OU, and then > **Link an Existing GPO**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample6.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample6.png) 2. Select the GPO that you just created, and > **OK**. - ![Active Directory local accounts](images/adlocalaccounts-proc2-sample7.png) + ![Active Directory local accounts.](images/adlocalaccounts-proc2-sample7.png) 10. Test the functionality of enterprise applications on workstations in the first OU and resolve any issues caused by the new policy. @@ -831,7 +831,7 @@ It is a best practice to configure the user objects for all sensitive accounts i As with any configuration change, test this enabled setting fully to ensure that it performs correctly before you implement it. -![Active Directory local accounts](images/adlocalaccounts-proc3-sample1.png) +![Active Directory local accounts.](images/adlocalaccounts-proc3-sample1.png) ## Secure and manage domain controllers diff --git a/windows/security/identity-protection/access-control/local-accounts.md b/windows/security/identity-protection/access-control/local-accounts.md index d67808e585..6ad17afded 100644 --- a/windows/security/identity-protection/access-control/local-accounts.md +++ b/windows/security/identity-protection/access-control/local-accounts.md @@ -367,15 +367,15 @@ The following table shows the Group Policy and registry settings that are used t 3. In the console tree, right-click **Group Policy Objects**, and > **New**. - ![local accounts 1](images/localaccounts-proc1-sample1.png) + ![local accounts 1.](images/localaccounts-proc1-sample1.png) 4. In the **New GPO** dialog box, type <**gpo\_name**>, and > **OK** where *gpo\_name* is the name of the new GPO. The GPO name indicates that the GPO is used to restrict local administrator rights from being carried over to another computer. - ![local accounts 2](images/localaccounts-proc1-sample2.png) + ![local accounts 2.](images/localaccounts-proc1-sample2.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 3](images/localaccounts-proc1-sample3.png) + ![local accounts 3.](images/localaccounts-proc1-sample3.png) 6. Ensure that UAC is enabled and that UAC restrictions apply to the default Administrator account by doing the following: @@ -391,7 +391,7 @@ The following table shows the Group Policy and registry settings that are used t 2. Right-click **Registry**, and > **New** > **Registry Item**. - ![local accounts 4](images/localaccounts-proc1-sample4.png) + ![local accounts 4.](images/localaccounts-proc1-sample4.png) 3. In the **New Registry Properties** dialog box, on the **General** tab, change the setting in the **Action** box to **Replace**. @@ -407,7 +407,7 @@ The following table shows the Group Policy and registry settings that are used t 9. Verify this configuration, and > **OK**. - ![local accounts 5](images/localaccounts-proc1-sample5.png) + ![local accounts 5.](images/localaccounts-proc1-sample5.png) 8. Link the GPO to the first **Workstations** organizational unit (OU) by doing the following: @@ -415,7 +415,7 @@ The following table shows the Group Policy and registry settings that are used t 2. Right-click the **Workstations** OU, and > **Link an existing GPO**. - ![local accounts 6](images/localaccounts-proc1-sample6.png) + ![local accounts 6.](images/localaccounts-proc1-sample6.png) 3. Select the GPO that you just created, and > **OK**. @@ -495,11 +495,11 @@ The following table shows the Group Policy settings that are used to deny networ 4. In the **New GPO** dialog box, type <**gpo\_name**>, and then > **OK** where *gpo\_name* is the name of the new GPO indicates that it is being used to restrict the local administrative accounts from interactively signing in to the computer. - ![local accounts 7](images/localaccounts-proc2-sample1.png) + ![local accounts 7.](images/localaccounts-proc2-sample1.png) 5. In the details pane, right-click <**gpo\_name**>, and > **Edit**. - ![local accounts 8](images/localaccounts-proc2-sample2.png) + ![local accounts 8.](images/localaccounts-proc2-sample2.png) 6. Configure the user rights to deny network logons for administrative local accounts as follows: diff --git a/windows/security/identity-protection/access-control/security-identifiers.md b/windows/security/identity-protection/access-control/security-identifiers.md index e770d29de4..be0a573f71 100644 --- a/windows/security/identity-protection/access-control/security-identifiers.md +++ b/windows/security/identity-protection/access-control/security-identifiers.md @@ -52,7 +52,7 @@ SIDs always remain unique. Security authorities never issue the same SID twice, A security identifier is a data structure in binary format that contains a variable number of values. The first values in the structure contain information about the SID structure. The remaining values are arranged in a hierarchy (similar to a telephone number), and they identify the SID-issuing authority (for example, “NT Authority”), the SID-issuing domain, and a particular security principal or group. The following image illustrates the structure of a SID. -![Security identifier architecture](images/security-identifider-architecture.jpg) +![Security identifier architecture.](images/security-identifider-architecture.jpg) The individual values of a SID are described in the following table. diff --git a/windows/security/identity-protection/access-control/security-principals.md b/windows/security/identity-protection/access-control/security-principals.md index 26564af45a..293acd13c9 100644 --- a/windows/security/identity-protection/access-control/security-principals.md +++ b/windows/security/identity-protection/access-control/security-principals.md @@ -42,7 +42,7 @@ The following diagram illustrates the Windows authorization and access control **Authorization and access control process** -![authorization and access control process](images/authorizationandaccesscontrolprocess.gif) +![authorization and access control process.](images/authorizationandaccesscontrolprocess.gif) Security principals are closely related to the following components and technologies: diff --git a/windows/security/identity-protection/configure-s-mime.md b/windows/security/identity-protection/configure-s-mime.md index f055141697..9423de2923 100644 --- a/windows/security/identity-protection/configure-s-mime.md +++ b/windows/security/identity-protection/configure-s-mime.md @@ -52,11 +52,11 @@ On the device, perform the following steps: (add select certificate) 2. Open **Settings** by tapping the gear icon on a PC, or the ellipsis (...) and then the gear icon on a phone. - :::image type="content" alt-text="settings icon in mail app" source="images/mailsettings.png"::: + :::image type="content" alt-text="settings icon in mail app." source="images/mailsettings.png"::: 3. Tap **Email security**. - :::image type="content" alt-text="email security settings" source="images/emailsecurity.png"::: + :::image type="content" alt-text="email security settings." source="images/emailsecurity.png"::: 4. In **Select an account**, select the account for which you want to configure S/MIME options. @@ -77,7 +77,7 @@ On the device, perform the following steps: (add select certificate) 2. Use **Sign** and **Encrypt** icons to turn on digital signature and encryption for this message. - :::image type="content" alt-text="sign or encrypt message" source="images/signencrypt.png"::: + :::image type="content" alt-text="sign or encrypt message." source="images/signencrypt.png"::: ## Read signed or encrypted messages @@ -93,5 +93,5 @@ When you receive a signed email, the app provide feature to install correspondin 3. Tap **Install.** - :::image type="content" alt-text="message security information" source="images/installcert.png"::: + :::image type="content" alt-text="message security information." source="images/installcert.png":::   \ No newline at end of file diff --git a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md index 8d0219c5dd..b122158529 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-how-it-works.md @@ -33,7 +33,7 @@ When Windows Defender Credential Guard is enabled, Kerberos does not allow uncon Here's a high-level overview on how the LSA is isolated by using virtualization-based security: -![Windows Defender Credential Guard overview](images/credguard.png) +![Windows Defender Credential Guard overview.](images/credguard.png) ## See also diff --git a/windows/security/identity-protection/credential-guard/credential-guard-manage.md b/windows/security/identity-protection/credential-guard/credential-guard-manage.md index c737034fd5..936172770d 100644 --- a/windows/security/identity-protection/credential-guard/credential-guard-manage.md +++ b/windows/security/identity-protection/credential-guard/credential-guard-manage.md @@ -45,7 +45,7 @@ You can use Group Policy to enable Windows Defender Credential Guard. This will 5. In the **Secure Launch Configuration** box, choose **Not Configured**, **Enabled** or **Disabled**. Check [this article](../../threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md) for more details. - ![Windows Defender Credential Guard Group Policy setting](images/credguard-gp-2.png) + ![Windows Defender Credential Guard Group Policy setting.](images/credguard-gp-2.png) 6. Close the Group Policy Management Console. @@ -168,7 +168,7 @@ You can view System Information to check that Windows Defender Credential Guard Here's an example: > [!div class="mx-imgBorder"] - > ![System Information](images/credguard-msinfo32.png) + > ![System Information.](images/credguard-msinfo32.png) You can also check that Windows Defender Credential Guard is running by using the [HVCI and Windows Defender Credential Guard hardware readiness tool](dg-readiness-tool.md). diff --git a/windows/security/identity-protection/enterprise-certificate-pinning.md b/windows/security/identity-protection/enterprise-certificate-pinning.md index 8a678b6ff4..fea29a3fc3 100644 --- a/windows/security/identity-protection/enterprise-certificate-pinning.md +++ b/windows/security/identity-protection/enterprise-certificate-pinning.md @@ -176,7 +176,7 @@ Certutil writes the binary information to the following registration location: | Value | Binary contents from the certificate pin rules certificate trust list file | | Data type | REG_BINARY | -![Registry binary information](images/enterprise-pinning-registry-binary-information.png) +![Registry binary information.](images/enterprise-pinning-registry-binary-information.png) ### Deploying Enterprise Pin Rule Settings using Group Policy @@ -203,7 +203,7 @@ Sign-in to the reference computer using domain administrator equivalent credenti 11. The **Key Path** should contain the selected registry key. The **Value name** configuration should contain the registry value name **_PinRules_**. **Value type** should read **_REG\_BINARY_** and **Value data** should contain a long series of numbers from 0-9 and letters ranging from A-F (hexadecimal). Click **OK** to save your settings and close the dialog box. - ![PinRules Properties](images/enterprise-certificate-pinning-pinrules-properties.png) + ![PinRules Properties.](images/enterprise-certificate-pinning-pinrules-properties.png) 12. Close the **Group Policy Management Editor** to save your settings. 13. Link the **Enterprise Certificate Pinning Rules** Group Policy object to apply to computers that run Windows 10, version 1703 in your enterprise. When these domain-joined computers apply Group Policy, the registry information configured in the Group Policy object is applied to the computer. @@ -258,7 +258,7 @@ These dates must be properly formatted and represented in UTC. You can use Windows PowerShell to format these dates. You can then copy and paste the output of the cmdlet into the XML file. -![Representing a date](images/enterprise-certificate-pinning-representing-a-date.png) +![Representing a date.](images/enterprise-certificate-pinning-representing-a-date.png) For simplicity, you can truncate decimal point (.) and the numbers after it. However, be certain to append the uppercase “Z” to the end of the XML date string. @@ -272,7 +272,7 @@ However, be certain to append the uppercase “Z” to the end of the XML date s You can also use Windows PowerShell to validate convert an XML date into a human readable date to validate it’s the correct date. -![Converting an XML date](images/enterprise-certificate-pinning-converting-an-xml-date.png) +![Converting an XML date.](images/enterprise-certificate-pinning-converting-an-xml-date.png) ## Representing a Duration in XML @@ -280,13 +280,13 @@ Some elements may be configured to use a duration rather than a date. You must represent the duration as an XML timespan data type. You can use Windows PowerShell to properly format and validate durations (timespans) and copy and paste them into your XML file. -![Representing a duration](images/enterprise-certificate-pinning-representing-a-duration.png) +![Representing a duration.](images/enterprise-certificate-pinning-representing-a-duration.png) ## Converting an XML Duration You can convert a XML formatted timespan into a timespan variable that you can read. -![Converting an XML duration](images/enterprise-certificate-pinning-converting-a-duration.png) +![Converting an XML duration.](images/enterprise-certificate-pinning-converting-a-duration.png) ## Certificate Trust List XML Schema Definition (XSD) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index b7018e4477..f80ffec25c 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -372,11 +372,11 @@ The Group Policy object contains the policy settings needed to trigger Windows H 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**. - ![Group Policy Editor](images/multifactorUnlock/gpme.png) + ![Group Policy Editor.](images/multifactorUnlock/gpme.png) 8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values. - ![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) + ![Multifactor Policy Setting.](images/multifactorUnlock/gp-setting.png) 9. Configure first and second unlock factors using the information in [Configure Unlock Factors](#configuring-unlock-factors). diff --git a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md index 16be1aa6bc..25d27e28d3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md +++ b/windows/security/identity-protection/hello-for-business/hello-adequate-domain-controllers.md @@ -38,23 +38,23 @@ Determining an adequate number of Windows Server domain controllers is important Consider a controlled environment where there are 1000 client computers and the authentication load of these 1000 client computers is evenly distributed across 10 domain controllers in the environment. The Kerberos AS requests load would look something like the following: -![dc-chart1](images/plan/dc-chart1.png) +![dc-chart1.](images/plan/dc-chart1.png) The environment changes. The first change includes DC1 upgraded to Windows Server 2016 or later to support Windows Hello for Business key-trust authentication. Next, 100 clients enroll for Windows Hello for Business using the public key trust deployment. Given all other factors stay constant, the authentication would now look like the following: -![dc-chart2](images/plan/dc-chart2.png) +![dc-chart2.](images/plan/dc-chart2.png) The Windows Server 2016 or later domain controller is handling 100 percent of all public key trust authentication. However, it is also handling 10 percent of password authentication. Why? This behavior occurs because domain controllers 2 - 10 only support password and certificate trust authentication; only a Windows Server 2016 and above domain controller supports public key trust authentication. The Windows Server 2016 and above domain controller still understands how to authenticate password and certificate trust authentication and will continue to share the load of authenticating those clients. Because DC1 can handle all forms of authentication, it will bear more of the authentication load, and easily become overloaded. What if another Windows Server 2016 or later domain controller is added, but without deploying Windows Hello for Business to any more clients? -![dc-chart3](images/plan/dc-chart3.png) +![dc-chart3.](images/plan/dc-chart3.png) Upgrading another domain controller to Windows Server 2016 or later distributes the public key trust authentication across two domain controllers - each supporting 50 percent of the load. But it doesn't change the distribution of password and certificate trust authentication. Both Windows Server 2019 domain controllers still share 10 percent of this load. Now look at the scenario when half of the domain controllers are upgraded to Windows Server 2016 or later, but the number of WHFB clients remains the same. -![dc-chart4](images/plan/dc-chart4.png) +![dc-chart4.](images/plan/dc-chart4.png) Domain controllers 1 through 5 now share the public key trust authentication load where each domain controller handles 20 percent of the public key trust load but they each still handle 10 percent of the password and certificate trust authentication. These domain controllers still have a heavier load than domain controllers 6 through 10; however, the load is adequately distributed. Now look the scenario when half of the client computers are upgraded to Windows Hello for Business using a key-trust deployment. -![dc-chart5](images/plan/dc-chart5.png) +![dc-chart5.](images/plan/dc-chart5.png) You'll notice the distribution did not change. Each Windows Server 2016 or later domain controller handles 20 percent of the public key trust authentication. However, increasing the volume of authentication (by increasing the number of clients) increases the amount of work that is represented by the same 20 percent. In the previous example, 20 percent of public key trust authentication equated to a volume of 20 authentications per domain controller capable of public key trust authentication. However, with upgraded clients, that same 20 percent represents a volume of 100 public key trust authentications per public key trust capable domain controller. Also, the distribution of non-public key trust authentication remained at 10 percent, but the volume of password and certificate trust authentications decreased across the older domain controllers. diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md index ab73eab4f9..f354ae19d4 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-adfs.md @@ -91,7 +91,7 @@ Sign-in the federation server with domain administrator equivalent credentials. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Repeat the same to add device registration service name (*enterpriseregistration.contoso.com*) as another alternative name. Click **OK** when finished. 10. Click **Enroll**. @@ -184,7 +184,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. -![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) +![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. 5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as *fs.corp.contoso.com* or *fs.contoso.com*. @@ -204,7 +204,7 @@ Sign-in the federation server with _domain administrator_ equivalent credentials 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. -![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) +![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. 5. On the **Specify Service Properties** page, select the recently enrolled or imported certificate from the **SSL Certificate** list. The certificate is likely named after your federation service, such as fs.corp.mstepdemo.net or fs.mstepdemo.net. @@ -456,7 +456,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. 8. Click **Install** to start the feature installation. - ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) + ![Feature selection screen with NLB selected.](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -465,25 +465,25 @@ Before you can load balance all the nodes in the AD FS farm, you must first crea Sign-in a node of the federation farm with _Admin_ equivalent credentials. 1. Open **Network Load Balancing Manager** from **Administrative Tools**. - ![NLB Manager user interface](images/hello-nlb-manager.png) + ![NLB Manager user interface.](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. 3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. - ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) + ![NLB Manager - Connect to new Cluster screen.](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. 6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. - ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) + ![NLB Manager - Add IP to New Cluster screen.](images/hello-nlb-add-ip.png) 7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. - ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) + ![NLB Manager - Cluster IP Configuration screen.](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. 9. In Port Rules, click Edit to modify the default port rules to use port 443. - ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) + ![NLB Manager - Add\Edit Port Rule screen.](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. 2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. - ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) + ![NLB Manager - Cluster with nodes.](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md index 0686de8a9a..57f12a0692 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-validate-ad-prereq.md @@ -34,7 +34,7 @@ To locate the schema master role holder, open and command prompt and type: ```Netdom query fsmo | findstr -i “schema”``` -![Netdom example output](images/hello-cmd-netdom.png) +![Netdom example output.](images/hello-cmd-netdom.png) The command should return the name of the domain controller where you need to adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md index bafde6afc2..0bbce98b00 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-rdp-certs.md @@ -51,7 +51,7 @@ Three approaches are documented here: 1. Right-click the **Smartcard Logon** template and click **Duplicate Template** - ![Duplicating Smartcard Template](images/rdpcert/duplicatetemplate.png) + ![Duplicating Smartcard Template.](images/rdpcert/duplicatetemplate.png) 1. On the **Compatibility** tab: 1. Clear the **Show resulting changes** check box @@ -109,7 +109,7 @@ Three approaches are documented here: 1. In the Certificate Authority console, right-click **Certificate Templates**, select **New**, and select **Certificate Template to Issue** - ![Selecting Certificate Template to Issue](images/rdpcert/certificatetemplatetoissue.png) + ![Selecting Certificate Template to Issue.](images/rdpcert/certificatetemplatetoissue.png) 1. From the list of templates, select the template you previously created (**WHFB Certificate Authentication**) and click **OK**. It can take some time for the template to replicate to all servers and become available in this list. @@ -123,7 +123,7 @@ Three approaches are documented here: 1. In the left pane of the MMC, right-click **Personal**, click **All Tasks**, and then click **Request New Certificate…** - ![Request a new certificate](images/rdpcert/requestnewcertificate.png) + ![Request a new certificate.](images/rdpcert/requestnewcertificate.png) 1. On the Certificate Enrollment screen, click **Next**. diff --git a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md index 476aed7683..48a0d130df 100644 --- a/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md +++ b/windows/security/identity-protection/hello-for-business/hello-errors-during-pin-creation.md @@ -29,7 +29,7 @@ When you set up Windows Hello in Windows 10, you may get an error during the ** The following image shows an example of an error during **Create a PIN**. -![PIN error](images/pinerror.png) +![PIN error.](images/pinerror.png) ## Error mitigations diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md index 0ecc622ba4..2fbed0b012 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-pin-reset.md @@ -97,20 +97,20 @@ Before you can remotely reset PINs, you must on-board the Microsoft PIN reset se 1. After you have logged in, choose **Accept** to give consent for the PIN reset service to access your account. - ![PIN reset service application in Azure](images/pinreset/pin-reset-service-prompt.png) + ![PIN reset service application in Azure.](images/pinreset/pin-reset-service-prompt.png) 1. Go to the [Microsoft PIN Reset Client Production website](https://login.windows.net/common/oauth2/authorize?response_type=code&client_id=9115dd05-fad5-4f9c-acc7-305d08b1b04e&resource=https%3A%2F%2Fcred.microsoft.com%2F&redirect_uri=ms-appx-web%3A%2F%2FMicrosoft.AAD.BrokerPlugin%2F9115dd05-fad5-4f9c-acc7-305d08b1b04e&state=6765f8c5-f4a7-4029-b667-46a6776ad611&prompt=admin_consent), and sign in using the Global administrator account you use to manage your Azure Active Directory tenant. 1. After you have logged in, choose **Accept** to give consent for the PIN reset client to access your account. - ![PIN reset client application in Azure](images/pinreset/pin-reset-client-prompt.png) + ![PIN reset client application in Azure.](images/pinreset/pin-reset-client-prompt.png) > [!NOTE] > After you have accepted the PIN reset service and client requests, you will land on a page that states "You do not have permission to view this directory or page." This behavior is expected. Be sure to confirm that the two PIN reset applications are listed for your tenant. 1. In the [Azure portal](https://portal.azure.com), verify that the Microsoft PIN Reset Service and Microsoft PIN Reset Client are integrated from the **Enterprise applications** blade. Filter to application status "Enabled" and both Microsoft Pin Reset Service Production and Microsoft Pin Reset Client Production will show up in your tenant. - :::image type="content" alt-text="PIN reset service permissions page" source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: + :::image type="content" alt-text="PIN reset service permissions page." source="images/pinreset/pin-reset-applications.png" lightbox="images/pinreset/pin-reset-applications.png"::: ### Configure Windows devices to use PIN reset using Group Policy @@ -210,7 +210,7 @@ The [ConfigureWebSignInAllowedUrls](/windows/client-management/mdm/policy-csp-au - **Data type:** String - **Value**: Provide a semicolon delimited list of domains needed for authentication during the PIN reset scenario. An example value would be _signin.contoso.com;portal.contoso.com_ (without quotation marks) - :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy" source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: + :::image type="content" alt-text="Custom Configuration for ConfigureWebSignInAllowedUrls policy." source="images/pinreset/allowlist.png" lightbox="images/pinreset/allowlist.png"::: 1. Click the Save button to save the custom configuration. diff --git a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md index 30dc6c78e6..b5361a656c 100644 --- a/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md +++ b/windows/security/identity-protection/hello-for-business/hello-feature-remote-desktop.md @@ -55,7 +55,7 @@ Windows Hello for Business emulates a smart card for application compatibility. Users appreciate convenience of biometrics and administrators value the security however, you may experience compatibility issues with your applications and Windows Hello for Business certificates. You can relax knowing a Group Policy setting and a [MDM URI](/windows/client-management/mdm/passportforwork-csp) exist to help you revert to the previous behavior for those users who need it. > [!div class="mx-imgBorder"] -> ![WHFB Certificate GP Setting](images/rdpbio/rdpbiopolicysetting.png) +> ![WHFB Certificate GP Setting.](images/rdpbio/rdpbiopolicysetting.png) > [!IMPORTANT] > The remote desktop with biometric feature does not work with [Dual Enrollment](hello-feature-dual-enrollment.md) feature or scenarios where the user provides alternative credentials. Microsoft continues to investigate supporting the feature. diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md index a90f1587c2..1efcc90b24 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-authentication.md @@ -31,7 +31,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Azure AD join authentication to Azure Active Directory -![Azure AD join authentication to Azure Active Directory](images/howitworks/auth-aadj-cloud.png) +![Azure AD join authentication to Azure Active Directory.](images/howitworks/auth-aadj-cloud.png) | Phase | Description | | :----: | :----------- | @@ -42,7 +42,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c |E | The Cloud AP provider returns a successful authentication response to lsass. Lsass caches the PRT, and informs winlogon of the success authentication. Winlogon creates a logon session, loads the user's profile, and starts explorer.exe.| ## Azure AD join authentication to Active Directory using a Key -![Azure AD join authentication to Active Directory using a Key](images/howitworks/auth-aadj-keytrust-kerb.png) +![Azure AD join authentication to Active Directory using a Key.](images/howitworks/auth-aadj-keytrust-kerb.png) | Phase | Description | @@ -56,7 +56,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Azure AD join authentication to Active Directory using a Certificate -![Azure AD join authentication to Active Directory using a Certificate](images/howitworks/auth-aadj-certtrust-kerb.png) +![Azure AD join authentication to Active Directory using a Certificate.](images/howitworks/auth-aadj-certtrust-kerb.png) | Phase | Description | | :----: | :----------- | @@ -69,7 +69,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c ## Hybrid Azure AD join authentication using a Key -![Hybrid Azure AD join authentication using a Key](images/howitworks/auth-haadj-keytrust.png) +![Hybrid Azure AD join authentication using a Key.](images/howitworks/auth-haadj-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -85,7 +85,7 @@ Azure Active Directory joined devices authenticate to Azure during sign-in and c > In the above deployment model, a newly provisioned user will not be able to sign in using Windows Hello for Business until (a) Azure AD Connect successfully synchronizes the public key to the on-premises Active Directory and (b) device has line of sight to the domain controller for the first time. ## Hybrid Azure AD join authentication using a Certificate -![Hybrid Azure AD join authentication using a Certificate](images/howitworks/auth-haadj-certtrust.png) +![Hybrid Azure AD join authentication using a Certificate.](images/howitworks/auth-haadj-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md index 0fb161ccb5..20008e7565 100644 --- a/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md +++ b/windows/security/identity-protection/hello-for-business/hello-how-it-works-provisioning.md @@ -37,7 +37,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, ## Azure AD joined provisioning in a Managed environment -![Azure AD joined provisioning in a Managed environment](images/howitworks/prov-aadj-managed.png) +![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-managed.png) | Phase | Description | | :----: | :----------- | @@ -48,7 +48,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Azure AD joined provisioning in a Federated environment -![Azure AD joined provisioning in a Managed environment](images/howitworks/prov-aadj-federated.png) +![Azure AD joined provisioning in a Managed environment.](images/howitworks/prov-aadj-federated.png) | Phase | Description | | :----: | :----------- | @@ -58,7 +58,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment -![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment](images/howitworks/prov-haadj-keytrust-managed.png) +![Hybrid Azure AD joined provisioning in a Key Trust deployment in a Managed environment.](images/howitworks/prov-haadj-keytrust-managed.png) | Phase | Description | @@ -76,7 +76,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment -![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment](images/howitworks/prov-haadj-instant-certtrust-federated.png) +![Hybrid Azure AD joined provisioning in a synchronous Certificate Trust deployment in a Federated environment.](images/howitworks/prov-haadj-instant-certtrust-federated.png) | Phase | Description | @@ -94,7 +94,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Key Trust deployment -![Domain joined provisioning in an On-premises Key Trust deployment](images/howitworks/prov-onprem-keytrust.png) +![Domain joined provisioning in an On-premises Key Trust deployment.](images/howitworks/prov-onprem-keytrust.png) | Phase | Description | | :----: | :----------- | @@ -105,7 +105,7 @@ Windows Hello for Business provisioning enables a user to enroll a new, strong, [Return to top](#windows-hello-for-business-provisioning) ## Domain joined provisioning in an On-premises Certificate Trust deployment -![Domain joined provisioning in an On-premises Certificate Trust deployment](images/howitworks/prov-onprem-certtrust.png) +![Domain joined provisioning in an On-premises Certificate Trust deployment.](images/howitworks/prov-onprem-certtrust.png) | Phase | Description | | :----: | :----------- | diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md index 8e0a208a86..13246cec6f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-base.md @@ -40,19 +40,19 @@ Before adding Azure Active Directory (Azure AD) joined devices to your existing Azure AD join, as well as hybrid Azure AD join devices register the user's Windows Hello for Business credential with Azure. To enable on-premises authentication, the credential must be synchronized to the on-premises Active Directory, regardless whether you are using a key or a certificate. Ensure you have Azure AD Connect installed and functioning properly. To learn more about Azure AD Connect, read [Integrate your on-premises directories with Azure Active Directory](/azure/active-directory/connect/active-directory-aadconnect). If you upgraded your Active Directory schema to the Windows Server 2016 schema after installing Azure AD Connect, run Azure AD Connect and run **Refresh directory schema** from the list of tasks. -![Azure AD Connect Schema Refresh](images/aadj/aadconnectschema.png) +![Azure AD Connect Schema Refresh.](images/aadj/aadconnectschema.png) ### Azure Active Directory Device Registration A fundamental prerequisite of all cloud and hybrid Windows Hello for Business deployments is device registration. A user cannot provision Windows Hello for Business unless the device from which they are trying to provision has registered with Azure Active Directory. For more information about device registration, read [Introduction to device management in Azure Active Directory](/azure/active-directory/devices/overview). You can use the **dsregcmd.exe** command to determine if your device is registered to Azure Active Directory. -![dsregcmd output](images/aadj/dsregcmd.png) +![dsregcmd output.](images/aadj/dsregcmd.png) ### CRL Distribution Point (CDP) Certificates issued by a certificate authority can be revoked. When a certificate authority revokes as certificate, it writes information about the certificate into a revocation list. During certificate validation, Windows 10 consults the CRL distribution point within the certificate to get a list of revoked certificates. Validation compares the current certificate with information in the certificate revocation list to determine if the certificate remains valid. -![Domain Controller Certificate with LDAP CDP](images/aadj/Certificate-CDP.png) +![Domain Controller Certificate with LDAP CDP.](images/aadj/Certificate-CDP.png) The preceding domain controller certificate shows a CRL distribution path (CDP) using Active Directory. You can determine this because the value in the URL begins with **ldap**. Using Active Directory for domain joined devices provides a highly available CRL distribution point. However, Azure Active Directory joined devices and users on Azure Active Directory joined devices cannot read data from Active Directory, and certificate validation does not provide an opportunity to authenticate prior to reading the certificate revocation list. This becomes a circular problem as the user is attempting to authenticate, but must read Active Directory to complete the authentication, but the user cannot read Active Directory because they have not authenticated. @@ -122,16 +122,16 @@ You need to host your new certificate revocation list of a web server so Azure A 1. From **Windows Administrative Tools**, Open **Internet Information Services (IIS) Manager**. 2. Expand the navigation pane to show **Default Web Site**. Select and then right-click **Default Web site** and click **Add Virtual Directory...**. 3. In the **Add Virtual Directory** dialog box, type **cdp** in **alias**. For physical path, type or browse for the physical file location where you will host the certificate revocation list. For this example, the path **c:\cdp** is used. Click **OK**. - ![Add Virtual Directory](images/aadj/iis-add-virtual-directory.png) + ![Add Virtual Directory.](images/aadj/iis-add-virtual-directory.png) > [!NOTE] > Make note of this path as you will use it later to configure share and file permissions. 4. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Directory Browsing** in the content pane. Click **Enable** in the details pane. 5. Select **CDP** under **Default Web Site** in the navigation pane. Double-click **Configuration Editor**. 6. In the **Section** list, navigate to **system.webServer/security/requestFiltering**. - ![IIS Configuration Editor requestFiltering](images/aadj/iis-config-editor-requestFiltering.png) + ![IIS Configuration Editor requestFiltering.](images/aadj/iis-config-editor-requestFiltering.png) In the list of named value-pairs in the content pane, configure **allowDoubleEscaping** to **True**. Click **Apply** in the actions pane. - ![IIS Configuration Editor double escaping](images/aadj/iis-config-editor-allowDoubleEscaping.png) + ![IIS Configuration Editor double escaping.](images/aadj/iis-config-editor-allowDoubleEscaping.png) 7. Close **Internet Information Services (IIS) Manager**. #### Create a DNS resource record for the CRL distribution point URL @@ -139,7 +139,7 @@ You need to host your new certificate revocation list of a web server so Azure A 1. On your DNS server or from an administrative workstation, open **DNS Manager** from **Administrative Tools**. 2. Expand **Forward Lookup Zones** to show the DNS zone for your domain. Right-click your domain name in the navigation pane and click **New Host (A or AAAA)...**. 3. In the **New Host** dialog box, type **crl** in **Name**. Type the IP address of the web server you configured in **IP Address**. Click **Add Host**. Click **OK** to close the **DNS** dialog box. Click **Done**. -![Create DNS host record](images/aadj/dns-new-host-dialog.png) +![Create DNS host record.](images/aadj/dns-new-host-dialog.png) 4. Close the **DNS Manager**. ### Prepare a file share to host the certificate revocation list @@ -151,12 +151,12 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. 3. Select **Share this folder**. Type **cdp$** in **Share name**. Click **Permissions**. -![cdp sharing](images/aadj/cdp-sharing.png) +![cdp sharing.](images/aadj/cdp-sharing.png) 4. In the **Permissions for cdp$** dialog box, click **Add**. 5. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**, and then click **OK**. 7. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, in **Enter the object names to select**, type the name of the server running the certificate authority issuing the certificate revocation list, and then click **Check Names**. Click **OK**. 8. In the **Permissions for cdp$** dialog box, select the certificate authority from the **Group or user names list**. In the **Permissions for** section, select **Allow** for **Full control**. Click **OK**. -![CDP Share Permissions](images/aadj/cdp-share-permissions.png) +![CDP Share Permissions.](images/aadj/cdp-share-permissions.png) 9. In the **Advanced Sharing** dialog box, click **OK**. > [!Tip] @@ -166,7 +166,7 @@ These procedures configure NTFS and share permissions on the web server to allow 1. On the web server, open **Windows Explorer** and navigate to the **cdp** folder you created in step 3 of [Configure the Web Server](#configure-the-web-server). 2. Right-click the **cdp** folder and click **Properties**. Click the **Sharing** tab. Click **Advanced Sharing**. 3. Click **Caching**. Select **No files or programs from the shared folder are available offline**. -![CDP disable caching](images/aadj/cdp-disable-caching.png) +![CDP disable caching.](images/aadj/cdp-disable-caching.png) 4. Click **OK**. #### Configure NTFS permission for the CDP folder @@ -175,7 +175,7 @@ These procedures configure NTFS and share permissions on the web server to allow 2. Right-click the **cdp** folder and click **Properties**. Click the **Security** tab. 3. On the **Security** tab, click Edit. 5. In the **Permissions for cdp** dialog box, click **Add**. -![CDP NTFS Permissions](images/aadj/cdp-ntfs-permissions.png) +![CDP NTFS Permissions.](images/aadj/cdp-ntfs-permissions.png) 6. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, click **Object Types**. In the **Object Types** dialog box, select **Computers**. Click **OK**. 7. In the **Select Users, Computers, Service Accounts, or Groups** dialog box, in **Enter the object names to select**, type the name of the certificate authority, and then click **Check Names**. Click **OK**. 8. In the **Permissions for cdp** dialog box, select the name of the certificate authority from the **Group or user names** list. In the **Permissions for** section, select **Allow** for **Full control**. Click **OK**. @@ -192,11 +192,11 @@ The web server is ready to host the CRL distribution point. Now, configure the 2. In the navigation pane, right-click the name of the certificate authority and click **Properties** 3. Click **Extensions**. On the **Extensions** tab, select **CRL Distribution Point (CDP)** from the **Select extension** list. 4. On the **Extensions** tab, click **Add**. Type http://crl.[domainname]/cdp/ in **location**. For example, ** or ** (do not forget the trailing forward slash). - ![CDP New Location dialog box](images/aadj/cdp-extension-new-location.png) + ![CDP New Location dialog box.](images/aadj/cdp-extension-new-location.png) 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. - ![CDP complete http](images/aadj/cdp-extension-complete-http.png) + ![CDP complete http.](images/aadj/cdp-extension-complete-http.png) 8. Select **Include in CRLs. Clients use this to find Delta CRL locations**. 9. Select **Include in the CDP extension of issued certificates**. 10. Click **Apply** save your selections. Click **No** when ask to restart the service. @@ -213,7 +213,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 5. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. Select **\** from the **Variable** list and click **Insert**. 6. Type **.crl** at the end of the text in **Location**. Click **OK**. 7. Select the CDP you just created. - ![CDP publishing location](images/aadj/cdp-extension-complete-unc.png) + ![CDP publishing location.](images/aadj/cdp-extension-complete-unc.png) 8. Select **Publish CRLs to this location**. 9. Select **Publish Delta CRLs to this location**. 10. Click **Apply** save your selections. Click **Yes** when ask to restart the service. Click **OK** to close the properties dialog box. @@ -222,7 +222,7 @@ The web server is ready to host the CRL distribution point. Now, configure the 1. On the issuing certificate authority, sign-in as a local administrator. Start the **Certificate Authority** console from **Administrative Tools**. 2. In the navigation pane, right-click **Revoked Certificates**, hover over **All Tasks**, and click **Publish** -![Publish a New CRL](images/aadj/publish-new-crl.png) +![Publish a New CRL.](images/aadj/publish-new-crl.png) 3. In the **Publish CRL** dialog box, select **New CRL** and click **OK**. #### Validate CDP Publishing @@ -230,7 +230,7 @@ The web server is ready to host the CRL distribution point. Now, configure the Validate your new CRL distribution point is working. 1. Open a web browser. Navigate to http://crl.[yourdomain].com/cdp. You should see two files created from publishing your new CRL. - ![Validate the new CRL](images/aadj/validate-cdp-using-browser.png) + ![Validate the new CRL.](images/aadj/validate-cdp-using-browser.png) ### Reissue domain controller certificates @@ -239,9 +239,9 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 1. Sign-in a domain controller using administrative credentials. 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, select the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. -![Certificate Manager Personal store](images/aadj/certlm-personal-store.png) +![Certificate Manager Personal store.](images/aadj/certlm-personal-store.png) 4. Right-click the selected certificate. Hover over **All Tasks** and then select **Renew Certificate with New Key...**. In the **Certificate Enrollment** wizard, click **Next**. -![Renew with New key](images/aadj/certlm-renew-with-new-key.png) +![Renew with New key.](images/aadj/certlm-renew-with-new-key.png) 5. In the **Request Certificates** page of the wizard, verify the selected certificate has the correct certificate template and ensure the status is available. Click **Enroll**. 6. After the enrollment completes, click **Finish** to close the wizard. 7. Repeat this procedure on all your domain controllers. @@ -259,7 +259,7 @@ With the CA properly configured with a valid HTTP-based CRL distribution point, 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. 4. Click the **Details** tab. Scroll down the list until **CRL Distribution Points** is visible in the **Field** column of the list. Select **CRL Distribution Point**. 5. Review the information below the list of fields to confirm the new URL for the CRL distribution point is present in the certificate. Click **OK**.
-![New Certificate with updated CDP](images/aadj/dc-cert-with-new-cdp.png) +![New Certificate with updated CDP.](images/aadj/dc-cert-with-new-cdp.png) ## Configure and Assign a Trusted Certificate Device Configuration Profile @@ -276,13 +276,13 @@ Steps you will perform include: 2. Open the **Run** dialog box. Type **certlm.msc** to open the **Certificate Manager** for the local computer. 3. In the navigation pane, expand **Personal**. Click **Certificates**. In the details pane, double-click the existing domain controller certificate includes **KDC Authentication** in the list of **Intended Purposes**. 4. Click the **Certification Path** tab. In the **Certification path** view, select the top most node and click **View Certificate**. -![Certificate Path](images/aadj/certlm-cert-path-tab.png) +![Certificate Path.](images/aadj/certlm-cert-path-tab.png) 5. In the new **Certificate** dialog box, click the **Details** tab. Click **Copy to File**. -![Details tab and copy to file](images/aadj/certlm-root-cert-details-tab.png) +![Details tab and copy to file.](images/aadj/certlm-root-cert-details-tab.png) 6. In the **Certificate Export Wizard**, click **Next**. 7. On the **Export File Format** page of the wizard, click **Next**. 8. On the **File to Export** page in the wizard, type the name and location of the root certificate and click **Next**. Click **Finish** and then click **OK** to close the success dialog box. -![Export root certificate](images/aadj/certlm-export-root-certificate.png) +![Export root certificate.](images/aadj/certlm-export-root-certificate.png) 9. Click **OK** two times to return to the **Certificate Manager** for the local computer. Close the **Certificate Manager**. ### Create and Assign a Trust Certificate Device Configuration Profile @@ -291,12 +291,12 @@ A **Trusted Certificate** device configuration profile is how you deploy trusted 1. Sign-in to the [Microsoft Azure Portal](https://portal.azure.com) and select **Microsoft Intune**. 2. Click **Device configuration**. In the **Device Configuration** blade, click **Create profile**. -![Intune Create Profile](images/aadj/intune-create-device-config-profile.png) +![Intune Create Profile.](images/aadj/intune-create-device-config-profile.png) 3. In the **Create profile** blade, type **Enterprise Root Certificate** in **Name**. Provide a description. Select **Windows 10 and later** from the **Platform** list. Select **Trusted certificate** from the **Profile type** list. Click **Configure**. 4. In the **Trusted Certificate** blade, use the folder icon to browse for the location of the enterprise root certificate file you created in step 8 of [Export Enterprise Root certificate](#export-enterprise-root-certificate). Click **OK**. Click **Create**. -![Intune Trusted Certificate Profile](images/aadj/intune-create-trusted-certificate-profile.png) +![Intune Trusted Certificate Profile.](images/aadj/intune-create-trusted-certificate-profile.png) 5. In the **Enterprise Root Certificate** blade, click **Assignments**. In the **Include** tab, select **All Devices** from the **Assign to** list. Click **Save**. -![Intune Profile assignment](images/aadj/intune-device-config-enterprise-root-assignment.png) +![Intune Profile assignment.](images/aadj/intune-device-config-enterprise-root-assignment.png) 6. Sign out of the Microsoft Azure Portal. > [!NOTE] > After the creation, the **supported platform** parameter of the profile will contain the value "Windows 8.1 and later", as the certificate configuration for Windows 8.1 and Windows 10 is the same. @@ -310,7 +310,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Choose **Enroll devices**. 4. Select **Windows enrollment**. 5. Under **Windows enrollment**, select **Windows Hello for Business**. - ![Create Windows Hello for Business Policy](images/aadj/MEM.png) + ![Create Windows Hello for Business Policy.](images/aadj/MEM.png) 6. Select **Enabled** from the **Configure Windows Hello for Business** list. 7. Select **Required** next to **Use a Trusted Platform Module (TPM)**. By default, Windows Hello for Business prefers TPM 2.0 or falls backs to software. Choosing **Required** forces Windows Hello for Business to only use TPM 2.0 or TPM 1.2 and does not allow fall back to software-based keys. 8. Enter the desired **Minimum PIN length** and **Maximum PIN length**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md index b8ce7af3da..e4ada9da90 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-aadj-sso-cert.md @@ -82,7 +82,7 @@ The easiest way to verify the onPremisesDistingushedNamne attribute is synchroni 2. Click **Login** and provide Azure credentials 3. In the Azure AD Graph Explorer URL, type https://graph.windows.net/myorganization/users/[userid], where **[userid]** is the user principal name of user in Azure Active Directory. Click **Go** 4. In the returned results, review the JSON data for the **onPremisesDistinguishedName** attribute. Ensure the attribute has a value and the value is accurate for the given user. - ![Azure AD Connect On-Prem DN Attribute](images/aadjcert/aadconnectonpremdn.png) + ![Azure AD Connect On-Prem DN Attribute.](images/aadjcert/aadconnectonpremdn.png) ## Prepare the Network Device Enrollment Services (NDES) Service Account @@ -259,15 +259,15 @@ Sign-in to the certificate authority or management workstations with an _Enterpr 1. Open **Server Manager** on the NDES server. 2. Click **Manage**. Click **Add Roles and Features**. 3. In the **Add Roles and Features Wizard**, on the **Before you begin** page, click **Next**. Select **Role-based or feature-based installation** on the **Select installation type** page. Click **Next**. Click **Select a server from the server pool**. Select the local server from the **Server Pool** list. Click **Next**. - ![Server Manager destination server](images/aadjCert/servermanager-destination-server-ndes.png) + ![Server Manager destination server.](images/aadjCert/servermanager-destination-server-ndes.png) 4. On the **Select server roles** page, select **Active Directory Certificate Services** from the **Roles** list. - ![Server Manager AD CS Role](images/aadjCert/servermanager-adcs-role.png) + ![Server Manager AD CS Role.](images/aadjCert/servermanager-adcs-role.png) Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. - ![Server Manager Add Features](images/aadjcert/serverManager-adcs-add-features.png) + ![Server Manager Add Features.](images/aadjcert/serverManager-adcs-add-features.png) 5. On the **Features** page, expand **.NET Framework 3.5 Features**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Expand **.NET Framework 4.5 Features**. Expand **WCF Services**. Select **HTTP Activation**. Click **Add Features** on the **Add Roles and Feature Wizard** dialog box. Click **Next**. - ![Server Manager Feature HTTP Activation](images/aadjcert/servermanager-adcs-http-activation.png) + ![Server Manager Feature HTTP Activation.](images/aadjcert/servermanager-adcs-http-activation.png) 6. On the **Select role services** page, clear the **Certificate Authority** check box. Select the **Network Device Enrollment Service**. Click **Add Features** on the **Add Roles and Features Wizard** dialog box. Click **Next**. - ![Server Manager ADCS NDES Role](images/aadjcert/servermanager-adcs-ndes-role-checked.png) + ![Server Manager ADCS NDES Role.](images/aadjcert/servermanager-adcs-ndes-role-checked.png) 7. Click **Next** on the **Web Server Role (IIS)** page. 8. On the **Select role services** page for the Web Serve role, Select the following additional services if they are not already selected and then click **Next**. * **Web Server > Security > Request Filtering** @@ -275,11 +275,11 @@ Sign-in to the certificate authority or management workstations with an _Enterpr * **Web Server > Application Development > ASP.NET 4.5**. . * **Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility** * **Management Tools > IIS 6 Management Compatibility > IIS 6 WMI Compatibility** - ![Server Manager Web Server Role](images/aadjcert/servermanager-adcs-webserver-role.png) + ![Server Manager Web Server Role.](images/aadjcert/servermanager-adcs-webserver-role.png) 9. Click **Install**. When the installation completes, continue with the next procedure. **Do not click Close**. > [!IMPORTANT] > .NET Framework 3.5 is not included in the typical installation. If the server is connected to the Internet, the installation attempts to get the files using Windows Update. If the server is not connected to the Internet, you need to **Specify an alternate source path** such as \:\\Sources\SxS\ - ![.NET Side by Side](images/aadjcert/dotNet35sidebyside.png) + ![.NET Side by Side.](images/aadjcert/dotNet35sidebyside.png) ### Configure the NDES service account This task adds the NDES service account to the local IIS_USRS group. The task also configures the NDES service account for Kerberos authentication and delegation @@ -308,7 +308,7 @@ Sign-in the NDES server with access equivalent to _Domain Admins_. > [!NOTE] > If you use the same service account for multiple NDES Servers, repeat the following task for each NDES server under which the NDES service runs. -![Set SPN command prompt](images/aadjcert/setspn-commandprompt.png) +![Set SPN command prompt.](images/aadjcert/setspn-commandprompt.png) #### Configure the NDES Service account for delegation The NDES service enrolls certificates on behalf of users. Therefore, you want to limit the actions it can perform on behalf of the user. You do this through delegation. @@ -317,16 +317,16 @@ Sign-in a domain controller with a minimum access equivalent to _Domain Admins_. 1. Open **Active Directory Users and Computers** 2. Locate the NDES Service account (NDESSvc). Right-click and select **Properties**. Click the **Delegation** tab. - ![NDES Delegation Tab](images/aadjcert/ndessvcdelegationtab.png) + ![NDES Delegation Tab.](images/aadjcert/ndessvcdelegationtab.png) 3. Select **Trust this user for delegation to specified services only**. 4. Select **Use any authentication protocol**. 5. Click **Add**. 6. Click **Users or Computers...** Type the name of the _NDES Server_ you use to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Avaiable services** list, select **HOST**. Click **OK**. - ![NDES Service delegation to NDES host](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) + ![NDES Service delegation to NDES host.](images/aadjcert/ndessvcdelegation-host-ndes-spn.png) 7. Repeat steps 5 and 6 for each NDES server using this service account. Click **Add**. 8. Click **Users or computers...** Type the name of the issuing certificate authority this NDES service account uses to issue Windows Hello for Business authentication certificates to Azure AD joined devices. From the **Available services** list, select **dcom**. Hold the **CTRL** key and select **HOST**. Click **OK**. 9. Repeat steps 8 and 9 for each issuing certificate authority from which one or more NDES servers request certificates. - ![NDES Service delegation complete](images/aadjcert/ndessvcdelegation-host-ca-spn.png) + ![NDES Service delegation complete.](images/aadjcert/ndessvcdelegation-host-ca-spn.png) 10. Click **OK**. Close **Active Directory Users and Computers**. ### Configure the NDES Role and Certificate Templates @@ -338,21 +338,21 @@ Sign-in to the certificate authority or management workstations with an _Enterpr > [!NOTE] > If you closed Server Manger from the last set of tasks, start Server Manager and click the action flag that shows a yellow exclamation point. -![Server Manager Post-Install Yellow flag](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) +![Server Manager Post-Install Yellow flag.](images/aadjcert/servermanager-post-ndes-yellowactionflag.png) 1. Click the **Configure Active Directory Certificate Services on the destination server** link. 2. On the **Credentials** page, click **Next**. - ![NDES Installation Credentials](images/aadjcert/ndesconfig01.png) + ![NDES Installation Credentials.](images/aadjcert/ndesconfig01.png) 3. On the **Role Services** page, select **Network Device Enrollment Service** and then click **Next** - ![NDES Role Services](images/aadjcert/ndesconfig02.png) + ![NDES Role Services.](images/aadjcert/ndesconfig02.png) 4. On the **Service Account for NDES** page, select **Specify service account (recommended)**. Click **Select...**. Type the user name and password for the NDES service account in the **Windows Security** dialog box. Click **Next**. - ![NDES Service Account for NDES](images/aadjcert/ndesconfig03b.png) + ![NDES Service Account for NDES.](images/aadjcert/ndesconfig03b.png) 5. On the **CA for NDES** page, select **CA name**. Click **Select...**. Select the issuing certificate authority from which the NDES server requests certificates. Click **Next**. - ![NDES CA selection](images/aadjcert/ndesconfig04.png) + ![NDES CA selection.](images/aadjcert/ndesconfig04.png) 6. On the **RA Information**, click **Next**. 7. On the **Cryptography for NDES** page, click **Next**. 8. Review the **Confirmation** page. Click **Configure**. - ![NDES Confirmation](images/aadjcert/ndesconfig05.png) + ![NDES Confirmation.](images/aadjcert/ndesconfig05.png) 8. Click **Close** after the configuration completes. #### Configure Certificate Templates on NDES @@ -407,18 +407,18 @@ Sign-in a workstation with access equivalent to a _domain user_. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. 4. Click **Download connector service**. Click **Accept terms & Download**. Save the file (AADApplicationProxyConnectorInstaller.exe) in a location accessible by others on the domain. - ![Azure Application Proxy Connectors](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) + ![Azure Application Proxy Connectors.](images/aadjcert/azureconsole-applicationproxy-connectors-empty.png) 5. Sign-in the computer that will run the connector with access equivalent to a _domain user_. > [!IMPORTANT] > Install a minimum of two Azure Active Directory Proxy connectors for each NDES Application Proxy. Strategically locate Azure AD application proxy connectors throughout your organization to ensure maximum availability. Remember, devices running the connector must be able to communicate with Azure and the on-premises NDES servers. 6. Start **AADApplicationProxyConnectorInstaller.exe**. 7. Read the license terms and then select **I agree to the license terms and conditions**. Click **Install**. - ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-01.png) + ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-01.png) 8. Sign-in to Microsoft Azure with access equivalent to **Global Administrator**. - ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-02.png) + ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-02.png) 9. When the installation completes. Read the information regarding outbound proxy servers. Click **Close**. - ![Azure Application Proxy Connector](images/aadjcert/azureappproxyconnectorinstall-03.png) + ![Azure Application Proxy Connector.](images/aadjcert/azureappproxyconnectorinstall-03.png) 10. Repeat steps 5 - 10 for each device that will run the Azure AD Application Proxy connector for Windows Hello for Business certificate deployments. #### Create a Connector Group @@ -427,9 +427,9 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Azure Portal](https://portal.azure.com/) with access equivalent to **Global Administrator**. 2. Select **All Services**. Type **Azure Active Directory** to filter the list of services. Under **SERVICES**, Click **Azure Active Directory**. 3. Under **MANAGE**, click **Application proxy**. - ![Azure Application Proxy Connector groups](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) + ![Azure Application Proxy Connector groups.](images/aadjcert/azureconsole-applicationproxy-connectors-default.png) 4. Click **New Connector Group**. Under **Name**, type **NDES WHFB Connectors**. - ![Azure Application New Connector Group](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) + ![Azure Application New Connector Group.](images/aadjcert/azureconsole-applicationproxy-connectors-newconnectorgroup.png) 5. Select each connector agent in the **Connectors** list that will service Windows Hello for Business certificate enrollment requests. 6. Click **Save**. @@ -443,7 +443,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Basic Settings** next to **Name**, type **WHFB NDES 01**. Choose a name that correlates this Azure AD Application Proxy setting with the on-premises NDES server. Each NDES server must have its own Azure AD Application Proxy as two NDES servers cannot share the same internal URL. 6. Next to **Internal URL**, type the internal, fully qualified DNS name of the NDES server associated with this Azure AD Application Proxy. For example, https://ndes.corp.mstepdemo.net). You need to match the primary host name (AD Computer Account name) of the NDES server, and prefix the URL with **https**. 7. Under **Internal URL**, select **https://** from the first list. In the text box next to **https://**, type the hostname you want to use as your external hostname for the Azure AD Application Proxy. In the list next to the hostname you typed, select a DNS suffix you want to use externally for the Azure AD Application Proxy. It is recommended to use the default, -[tenantName].msapproxy.net where **[tenantName]** is your current Azure Active Directory tenant name (-mstephendemo.msappproxy.net). - ![Azure NDES Application Proxy Configuration](images/aadjcert/azureconsole-appproxyconfig.png) + ![Azure NDES Application Proxy Configuration.](images/aadjcert/azureconsole-appproxyconfig.png) 8. Select **Passthrough** from the **Pre Authentication** list. 9. Select **NDES WHFB Connectors** from the **Connector Group** list. 10. Under **Additional Settings**, select **Default** from **Backend Application Timeout**. Under the **Translate URLs In** section, select **Yes** next to **Headers** and select **No** next to **Application Body**. @@ -465,7 +465,7 @@ Sign-in the NDES server with access equivalent to _local administrators_. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **NDES-Intune Authentication** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/aadjcert/ndes-TLS-Cert-Enroll-subjectNameWithExternalName.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**) and then click **Add**. 9. Under **Alternative name**, select **DNS** from the **Type** list. Type the internal URL used in the previous task (without the https://, for example **ndes.corp.mstepdemo.net**). Click **Add**. Type the external URL used in the previous task (without the https://, for example **ndes-mstephendemo.msappproxy.net**). Click **Add**. Click **OK** when finished. 9. Click **Enroll** @@ -478,12 +478,12 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. - ![NDES IIS Console](images/aadjcert/ndes-iis-console.png) + ![NDES IIS Console.](images/aadjcert/ndes-iis-console.png) 3. Click **Bindings...*** under **Actions**. Click **Add**. - ![NDES IIS Console](images/aadjcert/ndes-iis-bindings.png) + ![NDES IIS Console.](images/aadjcert/ndes-iis-bindings.png) 4. Select **https** from **Type**. Confirm the value for **Port** is **443**. 5. Select the certificate you previously enrolled from the **SSL certificate** list. Select **OK**. - ![NDES IIS Console](images/aadjcert/ndes-iis-bindings-add-443.png) + ![NDES IIS Console.](images/aadjcert/ndes-iis-bindings-add-443.png) 6. Select **http** from the **Site Bindings** list. Click **Remove**. 7. Click **Close** on the **Site Bindings** dialog box. 8. Close **Internet Information Services (IIS) Manager**. @@ -509,10 +509,10 @@ Sign-in the NDES server with access equivalent to _local administrator_. A web page similar to the following should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. -![NDES IIS Console](images/aadjcert/ndes-https-website-test-01.png) +![NDES IIS Console.](images/aadjcert/ndes-https-website-test-01.png) Confirm the web site uses the server authentication certificate. -![NDES IIS Console](images/aadjcert/ndes-https-website-test-01-show-cert.png) +![NDES IIS Console.](images/aadjcert/ndes-https-website-test-01-show-cert.png) ## Configure Network Device Enrollment Services to work with Microsoft Intune @@ -527,7 +527,7 @@ Sign-in the NDES server with access equivalent to _local administrator_. 1. Start **Internet Information Services (IIS) Manager** from **Administrative Tools**. 2. Expand the node that has the name of the NDES server. Expand **Sites** and select **Default Web Site**. 3. In the content pane, double-click **Request Filtering**. Click **Edit Feature Settings...** in the action pane. - ![Intune NDES Request filtering](images/aadjcert/NDES-IIS-RequestFiltering.png) + ![Intune NDES Request filtering.](images/aadjcert/NDES-IIS-RequestFiltering.png) 4. Select **Allow unlisted file name extensions**. 5. Select **Allow unlisted verbs**. 6. Select **Allow high-bit characters**. @@ -554,7 +554,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Tenant administration** > **Connectors and tokens** > **Certificate connectors** > **Add**. 3. Click **Download the certificate connector software** under the **Install Certificate Connectors** section. - ![Intune Certificate Authority](images/aadjcert/profile01.png) + ![Intune Certificate Authority.](images/aadjcert/profile01.png) 4. Save the downloaded file (NDESConnectorSetup.exe) to a location accessible from the NDES server. 5. Sign-out of the Microsoft Endpoint Manager admin center. @@ -564,26 +564,26 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Copy the Intune Certificate Connector Setup (NDESConnectorSetup.exe) downloaded in the previous task locally to the NDES server. 2. Run **NDESConnectorSetup.exe** as an administrator. If the setup shows a dialog that reads **Microsoft Intune NDES Connector requires HTTP Activation**, ensure you started the application as an administrator, then check HTTP Activation is enabled on the NDES server. 3. On the **Microsoft Intune** page, click **Next**. - ![Intune Connector Install 01](images/aadjcert/intunecertconnectorinstall-01.png) + ![Intune Connector Install 01.](images/aadjcert/intunecertconnectorinstall-01.png) 4. Read the **End User License Agreement**. Click **Next** to accept the agreement and to proceed with the installation. 5. On the **Destination Folder** page, click **Next**. 6. On the **Installation Options** page, select **SCEP and PFX Profile Distribution** and click **Next**. - ![Intune Connector Install 03](images/aadjcert/intunecertconnectorinstall-03.png) + ![Intune Connector Install 03.](images/aadjcert/intunecertconnectorinstall-03.png) 7. On the **Client certificate for Microsoft Intune** page, Click **Select**. Select the certificate previously enrolled for the NDES server. Click **Next**. - ![Intune Connector Install 05](images/aadjcert/intunecertconnectorinstall-05.png) + ![Intune Connector Install 05.](images/aadjcert/intunecertconnectorinstall-05.png) > [!NOTE] > The **Client certificate for Microsoft Intune** page does not update after selecting the client authentication certificate. However, the application rembers the selection and shows it in the next page. 8. On the **Client certificate for the NDES Policy Module** page, verify the certificate information and then click **Next**. 9. ON the **Ready to install Microsoft Intune Connector** page. Click **Install**. - ![Intune Connector Install 06](images/aadjcert/intunecertconnectorinstall-06.png) + ![Intune Connector Install 06.](images/aadjcert/intunecertconnectorinstall-06.png) > [!NOTE] > You can review the results of the install using the **SetupMsi.log** file located in the **C:\\NDESConnectorSetupMsi** folder. 10. When the installation completes, select **Launch Intune Connector** and click Finish. Proceed to the Configure the Intune Certificate Connector task. - ![Intune Connector install 07](images/aadjcert/intunecertconnectorinstall-07.png) + ![Intune Connector install 07.](images/aadjcert/intunecertconnectorinstall-07.png) ### Configure the Intune Certificate Connector Sign-in the NDES server with access equivalent to _domain administrator_. @@ -594,10 +594,10 @@ Sign-in the NDES server with access equivalent to _domain administrator_. > If the **NDES Connector** user interface is not open, you can start it from **\\NDESConnectorUI\NDESConnectorUI.exe**. 2. If your organization uses a proxy server and the proxy is needed for the NDES server to access the Internet, select **Use proxy server**, and then enter the proxy server name, port, and credentials to connect. Click **Apply** - ![Intune Certificate Connector Configuration 01](images/aadjcert/intunecertconnectorconfig-01.png) + ![Intune Certificate Connector Configuration 01.](images/aadjcert/intunecertconnectorconfig-01.png) 3. Click **Sign-in**. Type credentials for your Intune administrator, or tenant administrator that has the **Global Administrator** directory role. - ![Intune Certificate Connector Configuration 02](images/aadjcert/intunecertconnectorconfig-02.png) + ![Intune Certificate Connector Configuration 02.](images/aadjcert/intunecertconnectorconfig-02.png) > [!IMPORTANT] > The user account must have a valid Intune license assigned. If the user account does not have a valid Intune license, the sign-in fails. @@ -614,7 +614,7 @@ Sign-in the certificate authority used by the NDES Connector with access equival 1. Start the **Certification Authority** management console. 2. In the navigation pane, right-click the name of the certificate authority and select **Properties**. 3. Click the **Security** tab. Click **Add**. In **Enter the object names to select** box, type **NDESSvc** (or the name you gave the NDES Service account). Click *Check Names*. Click **OK**. Select the NDES Service account from the **Group or user names** list. Select **Allow** for the **Issue and Manage Certificates** permission. Click **OK**. - ![Configure Intune certificate revocation 02](images/aadjcert/intuneconfigcertrevocation-02.png) + ![Configure Intune certificate revocation 02.](images/aadjcert/intuneconfigcertrevocation-02.png) 4. Close the **Certification Authority** #### Enable the NDES Connector for certificate revocation @@ -622,7 +622,7 @@ Sign-in the NDES server with access equivalent to _domain administrator_. 1. Open the **NDES Connector** user interface (**\\NDESConnectorUI\NDESConnectorUI.exe**). 2. Click the **Advanced** tab. Select **Specify a different account username and password**. Type the NDES service account username and password. Click **Apply**. Click **OK** to close the confirmation dialog box. Click **Close**. - ![Intune Connector cert revocation configuration 04](images/aadjcert/intunecertconnectorconfig-04.png) + ![Intune Connector cert revocation configuration 04.](images/aadjcert/intunecertconnectorconfig-04.png) 3. Restart the **Intune Connector Service** and the **World Wide Web Publishing Service**. ### Test the NDES Connector @@ -641,7 +641,7 @@ Sign-in the NDES server with access equivalent to _domain admin_. ``` where **[fqdnHostName]** is the fully qualified internal DNS host name of the NDES server. A web page showing a 403 error (similar to the following) should appear in your web browser. If you do not see a similar page, or you get a **503 Service unavailable** message, ensure the NDES Service account has the proper user rights. You can also review the application event log for events with the **NetworkDeviceEnrollmentSerice** source. - ![NDES web site test after Intune Certificate Connector](images/aadjcert/ndes-https-website-test-after-intune-connector.png) + ![NDES web site test after Intune Certificate Connector.](images/aadjcert/ndes-https-website-test-after-intune-connector.png) 6. Using **Server Manager**, enable **Internet Explorer Enhanced Security Configuration**. ## Create and Assign a Simple Certificate Enrollment Protocol (SCEP) Certificate Profile @@ -656,7 +656,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 5. Under **Group Name**, type the name of the group. For example, **AADJ WHFB Certificate Users**. 6. Provide a **Group description**, if applicable. 7. Select **Assigned** from the **Membership type** list. - ![Azure AD new group creation](images/aadjcert/azureadcreatewhfbcertgroup.png) + ![Azure AD new group creation.](images/aadjcert/azureadcreatewhfbcertgroup.png) 8. Click **Members**. Use the **Select members** pane to add members to this group. When finished click **Select**. 9. Click **Create**. @@ -666,7 +666,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 1. Sign-in to the [Microsoft Endpoint Manager admin center](https://endpoint.microsoft.com/). 2. Select **Devices**, and then click **Configuration Profiles**. 3. Select **Create Profile**. - ![Intune Device Configuration Create Profile](images/aadjcert/profile02.png) + ![Intune Device Configuration Create Profile.](images/aadjcert/profile02.png) 4. Select **Windows 10 and later** from the **Platform** list. 5. Choose **SCEP certificate** from the **Profile** list, and select **Create**. 6. The **SCEP Certificate** wizard should open. Next to **Name**, type **WHFB Certificate Enrollment**. @@ -689,7 +689,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 14. Select a previously configured **Trusted certificate** profile that matches the root certificate of the issuing certificate authority as a root certificate for the profile. 15. Under **Extended key usage**, type **Smart Card Logon** under **Name**. Type **1.3.6.1.4.1.311.20.2.2** under **Object identifier**. Click **Add**. 16. Type a percentage (without the percent sign) next to **Renewal Threshold** to determine when the certificate should attempt to renew. The recommended value is **20**. - ![WHFB SCEP certificate Profile EKUs](images/aadjcert/profile03.png) + ![WHFB SCEP certificate Profile EKUs.](images/aadjcert/profile03.png) 17. Under **SCEP Server URLs**, type the fully qualified external name of the Azure AD Application proxy you configured. Append to the name **/certsrv/mscep/mscep.dll**. For example, https://ndes-mtephendemo.msappproxy.net/certsrv/mscep/mscep.dll. Click **Add**. Repeat this step for each additional NDES Azure AD Application Proxy you configured to issue Windows Hello for Business certificates. Microsoft Intune round-robin load balances requests among the URLs listed in the SCEP certificate profile. 18. Click **Next**. 19. Click **Next** several times to skip the **Scope tags**, **Assignments**, and **Applicability Rules** steps of the wizard and click **Create**. @@ -702,7 +702,7 @@ Sign-in a workstation with access equivalent to a _domain user_. 3. Click **WHFB Certificate Enrollment**. 4. Select **Properties**, and then click **Edit** next to the **Assignments** section. 5. In the **Assignments** pane, select **Selected Groups** from the **Assign to** list. Click **Select groups to include**. - ![WHFB SCEP Profile Assignment](images/aadjcert/profile04.png) + ![WHFB SCEP Profile Assignment.](images/aadjcert/profile04.png) 6. Select the **AADJ WHFB Certificate Users** group. Click **Select**. 7. Click **Review + Save**, and then **Save**. diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index e80dc75f72..9e100bc146 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -70,7 +70,7 @@ To locate the schema master role holder, open and command prompt and type: ```Netdom query fsmo | findstr -i schema``` -![Netdom example output](images/hello-cmd-netdom.png) +![Netdom example output.](images/hello-cmd-netdom.png) The command should return the name of the domain controller where you need to run adprep.exe. Update the schema locally on the domain controller hosting the Schema master role. @@ -114,14 +114,14 @@ When you are ready to install, follow the **Configuring federation with AD FS** ### Create AD objects for AD FS Device Authentication If your AD FS farm is not already configured for Device Authentication (you can see this in the AD FS Management console under Service -> Device Registration), use the following steps to create the correct AD DS objects and configuration. -![Device Registration](images/hybridct/device1.png) +![Device Registration.](images/hybridct/device1.png) > [!NOTE] > The below commands require Active Directory administration tools, so if your federation server is not also a domain controller, first install the tools using step 1 below. Otherwise you can skip step 1. 1. Run the **Add Roles & Features** wizard and select feature **Remote Server Administration Tools** -> **Role Administration Tools** -> **AD DS and AD LDS Tools** -> Choose both the **Active Directory module for Windows PowerShell** and the **AD DS Tools**. -![Device Registration](images/hybridct/device2.png) +![Device Registration.](images/hybridct/device2.png) 2. On your AD FS primary server, ensure you are logged in as AD DS user with enterprise administrator privileges and open an elevated Windows PowerShell prompt. Then, run the following commands: @@ -132,7 +132,7 @@ If your AD FS farm is not already configured for Device Authentication (you can > [!NOTE] > If your AD FS service is configured to use a GMSA account, enter the account name in the format "domain\accountname$" -![Device Registration](images/hybridct/device3.png) +![Device Registration.](images/hybridct/device3.png) The above PSH creates the following objects: @@ -140,11 +140,11 @@ The above PSH creates the following objects: - Device Registration Service container and object under Configuration --> Services --> Device Registration Configuration - Device Registration Service DKM container and object under Configuration --> Services --> Device Registration Configuration -![Device Registration](images/hybridct/device4.png) +![Device Registration.](images/hybridct/device4.png) 4. Once this is done, you will see a successful completion message. -![Device Registration](images/hybridct/device5.png) +![Device Registration.](images/hybridct/device5.png) ### Create Service Connection Point (SCP) in Active Directory If you plan to use Windows 10 domain join (with automatic registration to Azure AD) as described here, execute the following commands to create a service connection point in AD DS @@ -155,13 +155,13 @@ If you plan to use Windows 10 domain join (with automatic registration to Azure > [!NOTE] > If necessary, copy the AdSyncPrep.psm1 file from your Azure AD Connect server. This file is located in Program Files\Microsoft Azure Active Directory Connect\AdPrep -![Device Registration](images/hybridct/device6.png) +![Device Registration.](images/hybridct/device6.png) 2. Provide your Azure AD global administrator credentials `PS C:>$aadAdminCred = Get-Credential` -![Device Registration](images/hybridct/device7.png) +![Device Registration.](images/hybridct/device7.png) 3. Run the following PowerShell command @@ -517,7 +517,7 @@ For your reference, below is a comprehensive list of the AD DS devices, containe - Container CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - Container Device Registration Service DKM under the above container -![Device Registration](images/hybridct/device8.png) +![Device Registration.](images/hybridct/device8.png) - object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - read/write access to the specified AD connector account name on the new object diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md index cfaf049efd..35bd16ed3e 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-provision.md @@ -27,22 +27,22 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358 from User Device Registration log showing Windows Hello for Business prerequisite check result](images/Event358.png) +![Event358 from User Device Registration log showing Windows Hello for Business prerequisite check result.](images/Event358.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. -![Setup a PIN Provisioning](images/setupapin.png) +![Setup a PIN Provisioning.](images/setupapin.png) The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. -![MFA prompt during provisioning](images/mfa.png) +![MFA prompt during provisioning.](images/mfa.png) After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. -![Create a PIN during provisioning](images/createPin.png) +![Create a PIN during provisioning.](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md index 9caf362da6..e60e0b15f0 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-key-whfb-provision.md @@ -27,22 +27,22 @@ ms.reviewer: ## Provisioning The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. -![Event358](images/Event358-2.png) +![Event358.](images/Event358-2.png) The first thing to validate is the computer has processed device registration. You can view this from the User device registration logs where the check **Device is AAD joined (AADJ or DJ++): Yes** appears. Additionally, you can validate this using the **dsregcmd /status** command from a console prompt where the value for **AzureADJoined** reads **Yes**. Windows Hello for Business provisioning begins with a full screen page with the title **Setup a PIN** and button with the same name. The user clicks **Setup a PIN**. -![Setup a PIN Provisioning](images/setupapin.png) +![Setup a PIN Provisioning.](images/setupapin.png) The provisioning flow proceeds to the Multi-Factor authentication portion of the enrollment. Provisioning informs the user that it is actively attempting to contact the user through their configured form of MFA. The provisioning process does not proceed until authentication succeeds, fails or times out. A failed or timeout MFA results in an error and asks the user to retry. -![MFA prompt during provisioning](images/mfa.png) +![MFA prompt during provisioning.](images/mfa.png) After a successful MFA, the provisioning flow asks the user to create and validate a PIN. This PIN must observe any PIN complexity requirements that you deployed to the environment. -![Create a PIN during provisioning](images/createPin.png) +![Create a PIN during provisioning.](images/createPin.png) The provisioning flow has all the information it needs to complete the Windows Hello for Business enrollment. * A successful single factor authentication (username and password at sign-in) diff --git a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md index 99491fb5c3..4e83f31ec3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md +++ b/windows/security/identity-protection/hello-for-business/hello-key-trust-adfs.md @@ -73,7 +73,7 @@ Sign-in the federation server with domain administrator equivalent credentials. 5. Click **Next** on the **Select Certificate Enrollment Policy** page. 6. On the **Request Certificates** page, Select the **Internal Web Server** check box. 7. Click the **More information is required to enroll for this certificate. Click here to configure settings** link - ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link](images/hello-internal-web-server-cert.png) + ![Example of Certificate Properties Subject Tab - This is what shows when you click the above link.](images/hello-internal-web-server-cert.png) 8. Under **Subject name**, select **Common Name** from the **Type** list. Type the FQDN of the computer hosting the Active Directory Federation Services role and then click **Add**. Under **Alternative name**, select **DNS** from the **Type** list. Type the FQDN of the name you will use for your federation services (fs.corp.contoso.com). The name you use here MUST match the name you use when configuring the Active Directory Federation Services server role. Click **Add**. Click **OK** when finished. 9. Click **Enroll**. @@ -155,7 +155,7 @@ Use the following procedures to configure AD FS when your environment uses **Win Sign-in the federation server with _Domain Admin_ equivalent credentials. These procedures assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) + ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. @@ -175,7 +175,7 @@ Use the following procedures to configure AD FS when your environment uses **Win Sign-in the federation server with _Domain Admin_ equivalent credentials. These instructions assume you are configuring the first federation server in a federation server farm. 1. Start **Server Manager**. 2. Click the notification flag in the upper right corner. Click **Configure federation services on this server**. - ![Example of pop-up notification as described above](images/hello-adfs-configure-2012r2.png) + ![Example of pop-up notification as described above.](images/hello-adfs-configure-2012r2.png) 3. On the **Welcome** page, click **Create the first federation server farm** and click **Next**. 4. Click **Next** on the **Connect to Active Directory Domain Services** page. @@ -262,7 +262,7 @@ Sign-in the federation server with _Enterprise Admin_ equivalent credentials. 6. On the **Select server roles** page, click **Next**. 7. Select **Network Load Balancing** on the **Select features** page. 8. Click **Install** to start the feature installation - ![Feature selection screen with NLB selected](images/hello-nlb-feature-install.png) + ![Feature selection screen with NLB selected.](images/hello-nlb-feature-install.png) ### Configure Network Load Balancing for AD FS @@ -270,25 +270,25 @@ Before you can load balance all the nodes in the AD FS farm, you must first crea Sign-in a node of the federation farm with _Admin_ equivalent credentials. 1. Open **Network Load Balancing Manager** from **Administrative Tools**. - ![NLB Manager user interface](images/hello-nlb-manager.png) + ![NLB Manager user interface.](images/hello-nlb-manager.png) 2. Right-click **Network Load Balancing Clusters**, and then click **New Cluster**. 3. To connect to the host that is to be a part of the new cluster, in the **Host** text box, type the name of the host, and then click **Connect**. - ![NLB Manager - Connect to new Cluster screen](images/hello-nlb-connect.png) + ![NLB Manager - Connect to new Cluster screen.](images/hello-nlb-connect.png) 4. Select the interface that you want to use with the cluster, and then click **Next**. (The interface hosts the virtual IP address and receives the client traffic to load balance.) 5. In **Host Parameters**, select a value in **Priority (Unique host identifier)**. This parameter specifies a unique ID for each host. The host with the lowest numerical priority among the current members of the cluster handles all of the cluster's network traffic that is not covered by a port rule. Click **Next**. 6. In **Cluster IP Addresses**, click **Add** and type the cluster IP address that is shared by every host in the cluster. NLB adds this IP address to the TCP/IP stack on the selected interface of all hosts that are chosen to be part of the cluster. Click **Next**. - ![NLB Manager - Add IP to New Cluster screen](images/hello-nlb-add-ip.png) + ![NLB Manager - Add IP to New Cluster screen.](images/hello-nlb-add-ip.png) 7. In **Cluster Parameters**, select values in **IP Address** and **Subnet mask** (for IPv6 addresses, a subnet mask value is not needed). Type the full Internet name that users will use to access this NLB cluster. - ![NLB Manager - Cluster IP Configuration screen](images/hello-nlb-cluster-ip-config.png) + ![NLB Manager - Cluster IP Configuration screen.](images/hello-nlb-cluster-ip-config.png) 8. In **Cluster operation mode**, click **Unicast** to specify that a unicast media access control (MAC) address should be used for cluster operations. In unicast mode, the MAC address of the cluster is assigned to the network adapter of the computer, and the built-in MAC address of the network adapter is not used. We recommend that you accept the unicast default settings. Click **Next**. 9. In Port Rules, click Edit to modify the default port rules to use port 443. - ![NLB Manager - Add\Edit Port Rule screen](images/hello-nlb-cluster-port-rule.png) + ![NLB Manager - Add\Edit Port Rule screen.](images/hello-nlb-cluster-port-rule.png) ### Additional AD FS Servers 1. To add more hosts to the cluster, right-click the new cluster, and then click **Add Host to Cluster**. 2. Configure the host parameters (including host priority, dedicated IP addresses, and load weight) for the additional hosts by following the same instructions that you used to configure the initial host. Because you are adding hosts to an already configured cluster, all the cluster-wide parameters remain the same. - ![NLB Manager - Cluster with nodes](images/hello-nlb-cluster.png) + ![NLB Manager - Cluster with nodes.](images/hello-nlb-cluster.png) ## Configure DNS for Device Registration diff --git a/windows/security/identity-protection/hello-for-business/hello-overview.md b/windows/security/identity-protection/hello-for-business/hello-overview.md index 00fa16c254..1a2b17c308 100644 --- a/windows/security/identity-protection/hello-for-business/hello-overview.md +++ b/windows/security/identity-protection/hello-for-business/hello-overview.md @@ -69,7 +69,7 @@ In Windows 10, Windows Hello replaces passwords. When the identity provider sup >[!NOTE] >Windows Hello as a convenience sign-in uses regular user name and password authentication, without the user entering the password. -![How authentication works in Windows Hello](images/authflow.png) +![How authentication works in Windows Hello.](images/authflow.png) Imagine that someone is looking over your shoulder as you get money from an ATM and sees the PIN that you enter. Having that PIN won't help them access your account because they don't have your ATM card. In the same way, learning your PIN for your device doesn't allow that attacker to access your account because the PIN is local to your specific device and doesn't enable any type of authentication from any other device. diff --git a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md index 3ff85f511f..e7d6a0cea8 100644 --- a/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md +++ b/windows/security/identity-protection/hello-for-business/hello-prepare-people-to-use.md @@ -35,11 +35,11 @@ People who are currently using virtual or physical smart cards for authenticatio When someone sets up a new device, they are prompted to choose who owns the device. For corporate devices, they select **This device belongs to my organization**. -![who owns this pc](images/corpown.png) +![who owns this pc.](images/corpown.png) Next, they select a way to connect. Tell the people in your enterprise which option they should pick here. -![choose how you'll connect](images/connect.png) +![choose how you'll connect.](images/connect.png) They sign in, and are then asked to verify their identity. People have options to choose from a text message, phone call, or the authentication application. After verification, they create their PIN. The **Create a PIN** screen displays any complexity requirements that you have set, such as minimum length. @@ -55,7 +55,7 @@ People can go to **Settings** > **Accounts** > **Work or school**, select If your policy allows it, people can use biometrics (fingerprint, iris, and facial recognition) with Windows Hello for Business, if the hardware supports it. -![sign in to windows, apps, and services using fingerprint or face](images/hellosettings.png) +![sign in to windows, apps, and services using fingerprint or face.](images/hellosettings.png) diff --git a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md index 87e71bc747..2b1c101fc0 100644 --- a/windows/security/identity-protection/hello-for-business/passwordless-strategy.md +++ b/windows/security/identity-protection/hello-for-business/passwordless-strategy.md @@ -21,7 +21,7 @@ ms.reviewer: ## Four steps to password freedom Over the past few years, Microsoft has continued their commitment to enabling a world without passwords. At Microsoft Ignite 2017, we shared our four-step approach to password freedom. -![Passwordless approach](images/four-steps-passwordless.png) +![Passwordless approach.](images/four-steps-passwordless.png) ### 1. Develop a password replacement offering @@ -203,24 +203,24 @@ Windows provides two ways to prevent your users from using passwords. You can us ##### Security Policy You can use Group Policy to deploy an interactive logon security policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Windows Settings > Local Policy > Security Options**. The name of the policy setting depends on the version of the operating systems you use to configure Group Policy. -![securityPolicyLocation](images/passwordless/00-securityPolicy.png) +![securityPolicyLocation.](images/passwordless/00-securityPolicy.png) **Windows Server 2016 and earlier** The policy name for these operating systems is **Interactive logon: Require smart card**. -![securityPolicyBefore2016](images/passwordless/00-securitypolicy-2016.png) +![securityPolicyBefore2016.](images/passwordless/00-securitypolicy-2016.png) **Windows 10, version 1703 or later using Remote Server Administrator Tools** The policy name for these operating systems is **Interactive logon: Require Windows Hello for Business or smart card**. -![securityPolicyRSAT](images/passwordless/00-updatedsecuritypolicytext.png) +![securityPolicyRSAT.](images/passwordless/00-updatedsecuritypolicytext.png) When you enable this security policy setting, Windows prevents users from signing in or unlocking with a password. The password credential provider remains visible to the user. If a user tries to use a password, Windows informs the user they must use Windows Hello for Business or a smart card. #### Excluding the password credential provider You can use Group Policy to deploy an administrative template policy setting to the computer. This policy setting is found under **Computer Configuration > Policies > Administrative Templates > System > Logon** -![HideCredProvPolicy](images/passwordless/00-hidecredprov.png) +![HideCredProvPolicy.](images/passwordless/00-hidecredprov.png) The name of the policy setting is **Exclude credential providers**. The value to enter in the policy to hide the password credential provider is **60b78e88-ead8-445c-9cfd-0b87f74ea6cd**. -![HideCredProvPolicy2](images/passwordless/01-hidecredprov.png) +![HideCredProvPolicy2.](images/passwordless/01-hidecredprov.png) Excluding the password credential provider hides the password credential provider from Windows and any application that attempts to load it. This prevents the user from entering a password using the credential provider. However, this does not prevent applications from creating their own password collection dialogs and prompting the user for a password using custom dialogs. @@ -261,7 +261,7 @@ The account options on a user account includes an option -- **Smart card is requ > [!NOTE] > Do not confuse the Interactive Logon security policy for SCRIL. Security policies are enforced on the client (locally). A user account configured for SCRIL is enforced at the domain controller. -![SCRIL setting on AD Users and Computers](images/passwordless/00-scril-dsa.png) +![SCRIL setting on AD Users and Computers.](images/passwordless/00-scril-dsa.png) **SCRIL setting for a user on Active Directory Users and Computers.** When you configure a user account for SCRIL, Active Directory changes the affected user's password to a random 128 bits of data. Additionally, domain controllers hosting the user account do not allow the user to sign-in interactively with a password. Also, users will no longer be troubled with needing to change their password when it expires, because passwords for SCRIL users in domains with a Windows Server 2012 R2 or early domain functional level do not expire. The users are effectively passwordless because: @@ -270,13 +270,13 @@ When you configure a user account for SCRIL, Active Directory changes the affect - the user is not asked to change their password - domain controllers do not allow passwords for interactive authentication -![SCRIL setting from ADAC on Windows Server 2012](images/passwordless/01-scril-adac-2012.png) +![SCRIL setting from ADAC on Windows Server 2012.](images/passwordless/01-scril-adac-2012.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2012.** > [!NOTE] > Although a SCRIL user's password never expires in early domains, you can toggle the SCRIL configuration on a user account (clear the check box, save the settings, select the check box and save the settings) to generate a new random 128 bit password. However, you should consider upgrading the domain to Windows Server 2016 domain forest functional level and allow the domain controller to do this for you automatically. -![SCRIL setting from ADAC on Windows Server 2016](images/passwordless/01-scril-adac-2016.png) +![SCRIL setting from ADAC on Windows Server 2016.](images/passwordless/01-scril-adac-2016.png) **SCRIL setting for a user in Active Directory Administrative Center on Windows Server 2016.** > [!NOTE] @@ -286,7 +286,7 @@ When you configure a user account for SCRIL, Active Directory changes the affect Domains configured for Windows Server 2016 domain functional level can further secure the unknown password for SCRIL-enabled users by configuring the domain to automatically change the password for SCRIL users. In this configuration, passwords for SCRIL-configured users expire based on Active Directory password policy settings. When the SCRIL user authenticates from a domain controller, the domain controller recognizes the password has expired, and automatically generates a new random 128 bit password for the user as part of the authentication. What is great about this feature is your users do not experience any change password notifications or any authentication outages. -![Rotate Password 2016](images/passwordless/02-rotate-scril-2016.png) +![Rotate Password 2016.](images/passwordless/02-rotate-scril-2016.png) > [!NOTE] > Some components within Windows 10, such as Data Protection APIs and NTLM authentication, still need artifacts of a user possessing a password. This configuration provides interoperability by reducing the usage surface while Microsoft continues to close the gaps to remove the password completely. diff --git a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md index 5e24e71b64..2ad3bb1f3b 100644 --- a/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md +++ b/windows/security/identity-protection/hello-for-business/retired/hello-how-it-works.md @@ -54,7 +54,7 @@ It’s important to keep in mind that there are no physical containers on disk, The container actually contains a set of keys, some of which are used to protect other keys. The following image shows an example: the protector key is used to encrypt the authentication key, and the authentication key is used to encrypt the individual keys stored in the container. -![Each logical container holds one or more sets of keys](../images/passport-fig3-logicalcontainer.png) +![Each logical container holds one or more sets of keys.](../images/passport-fig3-logicalcontainer.png) Containers can contain several types of key material: diff --git a/windows/security/identity-protection/remote-credential-guard.md b/windows/security/identity-protection/remote-credential-guard.md index 57bbf194fc..65fa656745 100644 --- a/windows/security/identity-protection/remote-credential-guard.md +++ b/windows/security/identity-protection/remote-credential-guard.md @@ -34,13 +34,13 @@ Administrator credentials are highly privileged and must be protected. By using The following diagram helps you to understand how a standard Remote Desktop session to a server without Windows Defender Remote Credential Guard works: -![RDP connection to a server without Windows Defender Remote Credential Guard.png](images/rdp-to-a-server-without-windows-defender-remote-credential-guard.png) +![RDP connection to a server without Windows Defender Remote Credential Guard.png.](images/rdp-to-a-server-without-windows-defender-remote-credential-guard.png)
The following diagram helps you to understand how Windows Defender Remote Credential Guard works, what it helps to protect against, and compares it with the [Restricted Admin mode](https://social.technet.microsoft.com/wiki/contents/articles/32905.how-to-enable-restricted-admin-mode-for-remote-desktop.aspx) option: -![Windows Defender Remote Credential Guard](images/windows-defender-remote-credential-guard-with-remote-admin-mode.png) +![Windows Defender Remote Credential Guard.](images/windows-defender-remote-credential-guard-with-remote-admin-mode.png)
As illustrated, Windows Defender Remote Credential Guard blocks NTLM (allowing only Kerberos), prevents Pass-the-Hash (PtH) attacks, and also prevents use of credentials after disconnection. @@ -152,7 +152,7 @@ Beginning with Windows 10 version 1703, you can enable Windows Defender Remote C 2. Double-click **Restrict delegation of credentials to remote servers**. - ![Windows Defender Remote Credential Guard Group Policy](images/remote-credential-guard-gp.png) + ![Windows Defender Remote Credential Guard Group Policy.](images/remote-credential-guard-gp.png) 3. Under **Use the following restricted mode**: diff --git a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md index 635a9631d6..d5c9651f0f 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md +++ b/windows/security/identity-protection/smart-cards/smart-card-and-remote-desktop-services.md @@ -34,7 +34,7 @@ Smart card support is required to enable many Remote Desktop Services scenarios. In a Remote Desktop scenario, a user is using a remote server for running services, and the smart card is local to the computer that the user is using. In a smart card sign-in scenario, the smart card service on the remote server redirects to the smart card reader that is connected to the local computer where the user is trying to sign in. -![Smart card service redirects to smart card reader](images/sc-image101.png) +![Smart card service redirects to smart card reader.](images/sc-image101.png) **Remote Desktop redirection** diff --git a/windows/security/identity-protection/smart-cards/smart-card-architecture.md b/windows/security/identity-protection/smart-cards/smart-card-architecture.md index 0663f9a479..63cbad9b26 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-architecture.md +++ b/windows/security/identity-protection/smart-cards/smart-card-architecture.md @@ -52,7 +52,7 @@ Interactive sign-in in Windows begins when the user presses CTRL+ALT+DEL. The CT After receiving the SAS, the UI then generates the sign-in tile from the information received from the registered credential providers. The following graphic shows the architecture for credential providers in the Windows operating system. -![Credential provider architecture](images/sc-image201.gif) +![Credential provider architecture.](images/sc-image201.gif) **Figure 1**  **Credential provider architecture** @@ -88,7 +88,7 @@ Vendors provide smart cards and smart card readers, and in many cases the vendor Figure 2 illustrates the relationship between the CryptoAPI, CSPs, the Smart Card Base Cryptographic Service Provider (Base CSP), and smart card minidrivers. -![Base CSP and smart card minidriver architecture](images/sc-image203.gif) +![Base CSP and smart card minidriver architecture.](images/sc-image203.gif) **Figure 2**  **Base CSP and smart card minidriver architecture** @@ -236,7 +236,7 @@ Applications can call the Base CSP with CRYPT\_DEFAULT\_CONTAINER\_OPTIONAL, set In some of the following scenarios, the user can be prompted to insert a smart card. If the user context is silent, this operation fails and no UI is displayed. Otherwise, in response to the UI, the user can insert a smart card or click **Cancel**. If the user cancels the operation, the operation fails. The flow chart in Figure 3 shows the selection steps performed by the Windows operating system. -![Smart card selection process](images/sc-image205.png) +![Smart card selection process.](images/sc-image205.png) **Figure 3**  **Smart card selection behavior** @@ -314,7 +314,7 @@ For other operations, the caller may be able to acquire a "verify" context again Figure 4 shows the Cryptography architecture that is used by the Windows operating system. -![Cryptography architecture](images/sc-image206.gif) +![Cryptography architecture.](images/sc-image206.gif) **Figure 4**  **Cryptography architecture** diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md index ae671b4ace..dbcf86ee67 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-propagation-service.md @@ -38,7 +38,7 @@ The following figure shows the flow of the certificate propagation service. The **Certificate propagation service** -![Certificate propagation service](images/sc-image302.gif) +![Certificate propagation service.](images/sc-image302.gif) 1. A signed-in user inserts a smart card. diff --git a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md index ef209588b9..a220e7e658 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md +++ b/windows/security/identity-protection/smart-cards/smart-card-certificate-requirements-and-enumeration.md @@ -89,7 +89,7 @@ If you enable the **Allow signature keys valid for Logon** credential provider p The following diagram illustrates how smart card sign-in works in the supported versions of Windows. -![Smart card sign-in flow](images/sc-image402.png) +![Smart card sign-in flow.](images/sc-image402.png) **Smart card sign-in flow** @@ -206,21 +206,21 @@ SSL/TLS can map certificates that do not have SAN, and the mapping is done by us **Certificate revocation list distribution points** -![Certificate revocation list distribution points](images/sc-image403.png) +![Certificate revocation list distribution points.](images/sc-image403.png) **UPN in Subject Alternative Name field** -![UPN in Subject Alternative Name field](images/sc-image404.png) +![UPN in Subject Alternative Name field.](images/sc-image404.png) **Subject and Issuer fields** -![Subject and Issuer fields](images/sc-image405.png) +![Subject and Issuer fields.](images/sc-image405.png) This account mapping is supported by the KDC in addition to six other mapping methods. The following figure demonstrates a flow of user account mapping logic that is used by the KDC. **High-level flow of certificate processing for sign-in** -![High-level flow of certificate processing for sign-in](images/sc-image406.png) +![High-level flow of certificate processing for sign-in.](images/sc-image406.png) The certificate object is parsed to look for content to perform user account mapping. @@ -236,7 +236,7 @@ The following figure illustrates the process of mapping user accounts for sign-i **Certificate processing logic** -![Certificate processing logic](images/sc-image407.png) +![Certificate processing logic.](images/sc-image407.png) NT\_AUTH policy is best described in the CERT\_CHAIN\_POLICY\_NT\_AUTH parameter section of the CertVerifyCertificateChainPolicy function. For more information, see [CertVerifyCertificateChainPolicy](/windows/win32/api/wincrypt/nf-wincrypt-certverifycertificatechainpolicy). diff --git a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md index fa36cf563f..3f72307e25 100644 --- a/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md +++ b/windows/security/identity-protection/smart-cards/smart-card-removal-policy-service.md @@ -26,7 +26,7 @@ The smart card removal policy service is applicable when a user has signed in wi **Smart card removal policy service** -![Smart card removal policy service](images/sc-image501.gif) +![Smart card removal policy service.](images/sc-image501.gif) The numbers in the previous figure represent the following actions: diff --git a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md index 10ffd31a84..76159c664d 100644 --- a/windows/security/identity-protection/user-account-control/how-user-account-control-works.md +++ b/windows/security/identity-protection/user-account-control/how-user-account-control-works.md @@ -34,7 +34,7 @@ In order to better understand how this process happens, let's look at the Window The following shows how the logon process for an administrator differs from the logon process for a standard user. -![uac windows logon process](images/uacwindowslogonprocess.gif) +![uac windows logon process.](images/uacwindowslogonprocess.gif) By default, standard users and administrators access resources and run apps in the security context of standard users. When a user logs on to a computer, the system creates an access token for that user. The access token contains information about the level of access that the user is granted, including specific security identifiers (SIDs) and Windows privileges. @@ -56,7 +56,7 @@ With UAC enabled, Windows 10 prompts for consent or prompts for credentials of The consent prompt is presented when a user attempts to perform a task that requires a user's administrative access token. The following is an example of the UAC consent prompt. -![uac consent prompt](images/uacconsentprompt.gif) +![uac consent prompt.](images/uacconsentprompt.gif) **The credential prompt** @@ -64,7 +64,7 @@ The credential prompt is presented when a standard user attempts to perform a ta The following is an example of the UAC credential prompt. -![uac credential prompt](images/uaccredentialprompt.gif) +![uac credential prompt.](images/uaccredentialprompt.gif) **UAC elevation prompts** @@ -81,7 +81,7 @@ The elevation prompt color-coding is as follows: Some Control Panel items, such as **Date and Time Properties**, contain a combination of administrator and standard user operations. Standard users can view the clock and change the time zone, but a full administrator access token is required to change the local system time. The following is a screen shot of the **Date and Time Properties** Control Panel item. -![uac shield icon](images/uacshieldicon.png) +![uac shield icon.](images/uacshieldicon.png) The shield icon on the **Change date and time** button indicates that the process requires a full administrator access token and will display a UAC elevation prompt. @@ -99,7 +99,7 @@ While malware could present an imitation of the secure desktop, this issue canno The following diagram details the UAC architecture. -![uac architecture](images/uacarchitecture.gif) +![uac architecture.](images/uacarchitecture.gif) To better understand each component, review the table below: diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md index badf574468..4468785ff0 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-deploy-virtual-smart-cards.md @@ -24,7 +24,7 @@ This topic for the IT professional discusses the factors to consider when you de Traditional identity devices, such as physical smart cards, follow a predictable lifecycle in any deployment, as shown in the following diagram. -![Diagram of physical smart card lifecycle](images/vsc-physical-smart-card-lifecycle.png) +![Diagram of physical smart card lifecycle.](images/vsc-physical-smart-card-lifecycle.png) Physical devices are created by a dedicated manufacturer and then purchased by the corporation that will ultimately deploy it. The device passes through the personalization stage, where its unique properties are set. In smart cards, these properties are the administrator key, Personal Identification Number (PIN), PIN Unlock Key (PUK), and its physical appearance. To provision the device, it is loaded with the required certificates, such as a sign-in certificate. After you provision the device, it is ready for use. The device must simply be maintained. For example, you must replace cards when they are lost or stolen and reset PINs when users forget them. Finally, you’ll retire devices when they exceed their intended lifetime or when employees leave the company. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md index 6fb462eb81..044f7c1fe1 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-evaluate-security.md @@ -28,7 +28,7 @@ A crucial aspect of TPM virtual smart cards is their ability to securely store a The following diagram illustrates the secure key hierarchy and the process of accessing the user key. -![Diagram of the process of accessing the user key](images/vsc-process-of-accessing-user-key.png) +![Diagram of the process of accessing the user key.](images/vsc-process-of-accessing-user-key.png) The following keys are stored on the hard disk: diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md index 6810a79d95..c6ad4e0710 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started.md @@ -62,21 +62,21 @@ On your domain server, you need to create a template for the certificate that yo 2. Click **File**, and then click **Add/Remove Snap-in**. - ![Add or remove snap-in](images/vsc-02-mmc-add-snap-in.png) + ![Add or remove snap-in.](images/vsc-02-mmc-add-snap-in.png) 3. In the available snap-ins list, click **Certificate Templates**, and then click **Add**. - ![Add Certificate Templates snap-in](images/vsc-03-add-certificate-templates-snap-in.png) + ![Add Certificate Templates snap-in.](images/vsc-03-add-certificate-templates-snap-in.png) 4. Certificate Templates is now located under **Console Root** in the MMC. Double-click it to view all the available certificate templates. 5. Right-click the **Smartcard Logon** template, and click **Duplicate Template**. - ![Duplicating the Smartcard Logon template](images/vsc-04-right-click-smartcard-logon-template.png) + ![Duplicating the Smartcard Logon template.](images/vsc-04-right-click-smartcard-logon-template.png) 6. On the **Compatibility** tab, under **Certification Authority**, review the selection, and change it if needed. - ![Compatibility tab, certification authority setting](images/vsc-05-certificate-template-compatibility.png) + ![Compatibility tab, certification authority setting.](images/vsc-05-certificate-template-compatibility.png) 7. On the **General** tab: @@ -102,23 +102,23 @@ On your domain server, you need to create a template for the certificate that yo 12. Select **File**, then click **Add/Remove Snap-in** to add the Certification Authority snap-in to your MMC console. When asked which computer you want to manage, select the computer on which the CA is located, probably **Local Computer**. - ![Add Certification Authority snap-in](images/vsc-06-add-certification-authority-snap-in.png) + ![Add Certification Authority snap-in.](images/vsc-06-add-certification-authority-snap-in.png) 13. In the left pane of the MMC, expand **Certification Authority (Local)**, and then expand your CA within the Certification Authority list. 14. Right-click **Certificate Templates**, click **New**, and then click **Certificate Template to Issue**. - ![Right-click menu for Certificate Templates](images/vsc-07-right-click-certificate-templates.png) + ![Right-click menu for Certificate Templates.](images/vsc-07-right-click-certificate-templates.png) 15. From the list, select the new template that you just created (**TPM Virtual Smart Card Logon**), and then click **OK**. > **Note**  It can take some time for your template to replicate to all servers and become available in this list. - ![Selecting a certificate template](images/vsc-08-enable-certificate-template.png) + ![Selecting a certificate template.](images/vsc-08-enable-certificate-template.png) 16. After the template replicates, in the MMC, right-click in the Certification Authority list, click **All Tasks**, and then click **Stop Service**. Then, right-click the name of the CA again, click **All Tasks**, and then click **Start Service**. - ![Stopping and starting the service](images/vsc-09-stop-service-start-service.png) + ![Stopping and starting the service.](images/vsc-09-stop-service-start-service.png) ## Step 2: Create the TPM virtual smart card @@ -128,7 +128,7 @@ In this step, you will create the virtual smart card on the client computer by u 1. On a domain-joined computer, open a Command Prompt window with Administrative credentials. - ![Cmd prompt, Run as administrator](images/vsc-10-cmd-run-as-administrator.png) + ![Cmd prompt, Run as administrator.](images/vsc-10-cmd-run-as-administrator.png) 2. At the command prompt, type the following, and then press ENTER: @@ -150,11 +150,11 @@ The virtual smart card must be provisioned with a sign-in certificate for it to 2. Right-click **Personal**, click **All Tasks**, and then click **Request New Certificate**. - ![Request New Certificate](images/vsc-11-certificates-request-new-certificate.png) + ![Request New Certificate.](images/vsc-11-certificates-request-new-certificate.png) 3. Follow the prompts and when offered a list of templates, select the **TPM Virtual Smart Card Logon** check box (or whatever you named the template in Step 1). - ![Certificate enrollment, select certificate](images/vsc-12-certificate-enrollment-select-certificate.png) + ![Certificate enrollment, select certificate.](images/vsc-12-certificate-enrollment-select-certificate.png) 4. If prompted for a device, select the Microsoft virtual smart card that corresponds to the one you created in the previous section. It displays as **Identity Device (Microsoft Profile)**. diff --git a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md index 789da743aa..4d3f59ff0a 100644 --- a/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md +++ b/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-use-virtual-smart-cards.md @@ -74,7 +74,7 @@ For more information about these Windows APIs, see: To help users visually distinguish a Trusted Platform Module (TPM)-based virtual smart card from physical smart cards, the virtual smart card has a different icon. The following icon is displayed during sign in, and on other screens that require the user to enter the PIN for a virtual smart card. -![Icon for a virtual smart card](images/vsc-virtual-smart-card-icon.png) +![Icon for a virtual smart card.](images/vsc-virtual-smart-card-icon.png) A TPM-based virtual smart card is labeled **Security Device** in the user interface. diff --git a/windows/security/identity-protection/vpn/vpn-authentication.md b/windows/security/identity-protection/vpn/vpn-authentication.md index 9665848076..2c0a581e8d 100644 --- a/windows/security/identity-protection/vpn/vpn-authentication.md +++ b/windows/security/identity-protection/vpn/vpn-authentication.md @@ -51,7 +51,7 @@ See [EAP configuration](/windows/client-management/mdm/eap-configuration) for EA The following image shows the field for EAP XML in a Microsoft Intune VPN profile. The EAP XML field only appears when you select a built-in connection type (automatic, IKEv2, L2TP, PPTP). -![EAP XML configuration in Intune profile](images/vpn-eap-xml.png) +![EAP XML configuration in Intune profile.](images/vpn-eap-xml.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md index 2c1405d9e0..44b05da541 100644 --- a/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md +++ b/windows/security/identity-protection/vpn/vpn-auto-trigger-profile.md @@ -89,11 +89,11 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows associating an app to a VPN connection in a VPN Profile configuration policy using Microsoft Intune. -![Add an app for the VPN connection](images/vpn-app-trigger.png) +![Add an app for the VPN connection.](images/vpn-app-trigger.png) After you add an associated app, if you select the **Only these apps can use this VPN connection (per-app VPN)** checkbox, the app becomes available in **Corporate Boundaries**, where you can configure rules for the app. See [Traffic filters](vpn-security-features.md#traffic-filters) for more details. -![Configure rules for the app](images/vpn-app-rules.png) +![Configure rules for the app.](images/vpn-app-rules.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-conditional-access.md b/windows/security/identity-protection/vpn/vpn-conditional-access.md index 393bf3b90b..66baa88e46 100644 --- a/windows/security/identity-protection/vpn/vpn-conditional-access.md +++ b/windows/security/identity-protection/vpn/vpn-conditional-access.md @@ -87,7 +87,7 @@ Two client-side configuration service providers are leveraged for VPN device com The VPN client side connection flow works as follows: > [!div class="mx-imgBorder"] -> ![Device compliance workflow when VPN client attempts to connect](images/vpn-device-compliance.png) +> ![Device compliance workflow when VPN client attempts to connect.](images/vpn-device-compliance.png) When a VPNv2 Profile is configured with \ \true<\/Enabled> the VPN client uses this connection flow: diff --git a/windows/security/identity-protection/vpn/vpn-connection-type.md b/windows/security/identity-protection/vpn/vpn-connection-type.md index e65b9b6d8b..465f79924f 100644 --- a/windows/security/identity-protection/vpn/vpn-connection-type.md +++ b/windows/security/identity-protection/vpn/vpn-connection-type.md @@ -23,7 +23,7 @@ Virtual private networks (VPNs) are point-to-point connections across a private There are many options for VPN clients. In Windows 10, the built-in plug-in and the Universal Windows Platform (UWP) VPN plug-in platform are built on top of the Windows VPN platform. This guide focuses on the Windows VPN platform clients and the features that can be configured. -![VPN connection types](images/vpn-connection.png) +![VPN connection types.](images/vpn-connection.png) ## Built-in VPN client @@ -67,12 +67,12 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows connection options in a VPN Profile configuration policy using Microsoft Intune: > [!div class="mx-imgBorder"] -> ![Available connection types](images/vpn-connection-intune.png) +> ![Available connection types.](images/vpn-connection-intune.png) In Intune, you can also include custom XML for third-party plug-in profiles: > [!div class="mx-imgBorder"] -> ![Custom XML](images/vpn-custom-xml-intune.png) +> ![Custom XML.](images/vpn-custom-xml-intune.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-name-resolution.md b/windows/security/identity-protection/vpn/vpn-name-resolution.md index fcc360257b..70cec8d554 100644 --- a/windows/security/identity-protection/vpn/vpn-name-resolution.md +++ b/windows/security/identity-protection/vpn/vpn-name-resolution.md @@ -64,7 +64,7 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows name resolution options in a VPN Profile configuration policy using Microsoft Intune. -![Add DNS rule](images/vpn-name-intune.png) +![Add DNS rule.](images/vpn-name-intune.png) The fields in **Add or edit DNS rule** in the Intune profile correspond to the XML settings shown in the following table. diff --git a/windows/security/identity-protection/vpn/vpn-profile-options.md b/windows/security/identity-protection/vpn/vpn-profile-options.md index 69940276c8..96eae8c6ac 100644 --- a/windows/security/identity-protection/vpn/vpn-profile-options.md +++ b/windows/security/identity-protection/vpn/vpn-profile-options.md @@ -312,7 +312,7 @@ After you configure the settings that you want using ProfileXML, you can apply i 10. Set Data type to **String (XML file)**. 11. Upload the profile XML file. 12. Click **OK**. - ![Custom VPN profile](images/custom-vpn-profile.png) + ![Custom VPN profile.](images/custom-vpn-profile.png) 13. Click **OK**, then **Create**. 14. Assign the profile. diff --git a/windows/security/identity-protection/vpn/vpn-routing.md b/windows/security/identity-protection/vpn/vpn-routing.md index a33e2b0f3f..ea0cb1c3ae 100644 --- a/windows/security/identity-protection/vpn/vpn-routing.md +++ b/windows/security/identity-protection/vpn/vpn-routing.md @@ -53,11 +53,11 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien When you configure a VPN profile in Microsoft Intune, you select a checkbox to enable split tunnel configuration. -![split tunnel](images/vpn-split.png) +![split tunnel.](images/vpn-split.png) Next, in **Corporate Boundaries**, you add the routes that should use the VPN connection. -![add route for split tunnel](images/vpn-split-route.png) +![add route for split tunnel.](images/vpn-split-route.png) ## Related topics diff --git a/windows/security/identity-protection/vpn/vpn-security-features.md b/windows/security/identity-protection/vpn/vpn-security-features.md index bd1a32dde4..c84ab32cb0 100644 --- a/windows/security/identity-protection/vpn/vpn-security-features.md +++ b/windows/security/identity-protection/vpn/vpn-security-features.md @@ -59,7 +59,7 @@ See [VPN profile options](vpn-profile-options.md) and [VPNv2 CSP](/windows/clien The following image shows the interface to configure traffic rules in a VPN Profile configuration policy, using Microsoft Intune. -![Add a traffic rule](images/vpn-traffic-rules.png) +![Add a traffic rule.](images/vpn-traffic-rules.png) ## LockDown VPN diff --git a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md index 2c1a02b8db..62a4cf6cf0 100644 --- a/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md +++ b/windows/security/identity-protection/windows-credential-theft-mitigation-guide-abstract.md @@ -31,7 +31,7 @@ This guide explains how credential theft attacks occur and the strategies and co - Respond to suspicious activity - Recover from a breach -![Security stages](images/security-stages.png) +![Security stages.](images/security-stages.png) ## Attacks that steal credentials diff --git a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md index fc9b15fdef..23b9d93073 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md +++ b/windows/security/information-protection/bitlocker/bitlocker-countermeasures.md @@ -89,7 +89,7 @@ On computers with a compatible TPM, operating system drives that are BitLocker-p In the following Group Policy example, TPM + PIN is required to unlock an operating system drive: -![Pre-boot authentication setting in Group Policy](images/pre-boot-authentication-group-policy.png) +![Pre-boot authentication setting in Group Policy.](images/pre-boot-authentication-group-policy.png) Pre-boot authentication with a PIN can mitigate an attack vector for devices that use a bootable eDrive because an exposed eDrive bus can allow an attacker to capture the BitLocker encryption key during startup. Pre-boot authentication with a PIN can also mitigate DMA port attacks during the window of time between when BitLocker unlocks the drive and Windows boots to the point that Windows can set any port-related policies that have been configured. @@ -110,7 +110,7 @@ This Kernel DMA Protection is available only for new systems beginning with Wind You can use the System Information desktop app (MSINFO32) to check if a device has kernel DMA protection enabled: -![Kernel DMA protection](images/kernel-dma-protection.png) +![Kernel DMA protection.](images/kernel-dma-protection.png) If kernel DMA protection *not* enabled, follow these steps to protect Thunderbolt™ 3 enabled ports: diff --git a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md index 4864bdf4d4..cd0b6543e6 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md +++ b/windows/security/information-protection/bitlocker/bitlocker-deployment-comparison.md @@ -34,31 +34,31 @@ This article depicts the BitLocker deployment comparison chart. |Supported domain-joined status | Microsoft Azure Active Directory (Azure AD) joined, hybrid Azure AD joined | Active Directory joined, hybrid Azure AD joined | Active Directory joined | |Permissions required to manage policies | Endpoint security manager or custom | Full administrator or custom | Domain Admin or Delegated GPO access | |Cloud or on premises | Cloud | On premises | On premises | -|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Server components required? | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | |Additional agent required? | No (device enrollment only) | Configuration Manager client | MBAM client | |Administrative plane | Microsoft Endpoint Manager admin center | Configuration Manager console | Group Policy Management Console and MBAM sites | -|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | -|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Administrative portal installation required | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Compliance reporting capabilities | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Force encryption | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Encryption for storage cards (mobile) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | +|Allow recovery password | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Manage startup authentication | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Select cipher strength and algorithms for fixed drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Select cipher strength and algorithms for removable drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Select cipher strength and algorithms for operating environment drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | |Standard recovery password storage location | Azure AD or Active Directory | Configuration Manager site database | MBAM database | |Store recovery password for operating system and fixed drives to Azure AD or Active Directory | Yes (Active Directory and Azure AD) | Yes (Active Directory only) | Yes (Active Directory only) | -|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | -|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | | | -|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | -|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | :::image type="content" source="images/yes-icon.png" alt-text="supported"::: | +|Customize preboot message and recovery link | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Allow/deny key file creation | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Deny Write permission to unprotected drives | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Can be administered outside company network | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | +|Support for organization unique IDs | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Self-service recovery | Yes (through Azure AD or Company Portal app) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Recovery password rotation for fixed and operating environment drives | Yes (Windows 10, version 1909 and later) | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Wait to complete encryption until recovery information is backed up to Azure AD | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | | | +|Wait to complete encryption until recovery information is backed up to Active Directory | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Allow or deny Data Recovery Agent | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Unlock a volume using certificate with custom object identifier | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Prevent memory overwrite on restart | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Configure custom Trusted Platform Module Platform Configuration Register profiles | | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | +|Manage auto-unlock functionality | | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | :::image type="content" source="images/yes-icon.png" alt-text="supported."::: | diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index eaccfb9c9f..a72324edf4 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -298,18 +298,18 @@ This policy can be configured using GPO under **Computer Configuration** > **Adm It can also be configured using Intune mobile device management (MDM) in the BitLocker CSP: *\./Device/Vendor/MSFT/BitLocker/SystemDrivesRecoveryMessage\* -![Custom URL](./images/bl-intune-custom-url.png) +![Custom URL.](./images/bl-intune-custom-url.png) Example of customized recovery screen: -![Customized BitLocker Recovery Screen](./images/bl-password-hint1.png) +![Customized BitLocker Recovery Screen.](./images/bl-password-hint1.png) ### BitLocker recovery key hints BitLocker metadata has been enhanced in Windows 10, version 1903 to include information about when and where the BitLocker recovery key was backed up. This information is not exposed through the UI or any public API. It is used solely by the BitLocker recovery screen in the form of hints to help a user locate a volume's recovery key. Hints are displayed on the recovery screen and refer to the location where the key has been saved. Hints are displayed on both the modern (blue) and legacy (black) recovery screen. This applies to both the boot manager recovery screen and the WinRE unlock screen. -![Customized BitLocker recovery screen](./images/bl-password-hint2.png) +![Customized BitLocker recovery screen.](./images/bl-password-hint2.png) > [!IMPORTANT] > We don't recommend printing recovery keys or saving them to a file. Instead, use Active Directory backup or a cloud-based backup. Cloud-based backup includes Azure Active Directory (Azure AD) and Microsoft Account. @@ -339,7 +339,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** The hint for the Microsoft Account and the custom URL are displayed. -![Example 1 of Customized BitLocker recovery screen](./images/rp-example1.png) +![Example 1 of Customized BitLocker recovery screen.](./images/rp-example1.png) #### Example 2 (single recovery key with single backup) @@ -354,7 +354,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the custom URL is displayed. -![Example 2 of customized BitLocker recovery screen](./images/rp-example2.png) +![Example 2 of customized BitLocker recovery screen.](./images/rp-example2.png) #### Example 3 (single recovery key with multiple backups) @@ -369,7 +369,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the Microsoft Account hint is displayed. -![Example 3 of customized BitLocker recovery screen](./images/rp-example3.png) +![Example 3 of customized BitLocker recovery screen.](./images/rp-example3.png) #### Example 4 (multiple recovery passwords) @@ -399,7 +399,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** Only the hint for a successfully backed up key is displayed, even if it isn't the most recent key. -![Example 4 of customized BitLocker recovery screen](./images/rp-example4.png) +![Example 4 of customized BitLocker recovery screen.](./images/rp-example4.png) #### Example 5 (multiple recovery passwords) @@ -429,7 +429,7 @@ There are rules governing which hint is shown during the recovery (in order of p **Result:** The hint for the most recent key is displayed. -![Example 5 of customized BitLocker recovery screen](./images/rp-example5.png) +![Example 5 of customized BitLocker recovery screen.](./images/rp-example5.png) ## Using additional recovery information diff --git a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md index c6483a8057..e8045e225c 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md +++ b/windows/security/information-protection/bitlocker/bitlocker-use-bitlocker-drive-encryption-tools-to-manage-bitlocker.md @@ -52,7 +52,7 @@ manage-bde -status ``` This command returns the volumes on the target, current encryption status, encryption method, and volume type (operating system or data) for each volume: -![Using manage-bde to check encryption status](images/manage-bde-status.png) +![Using manage-bde to check encryption status.](images/manage-bde-status.png) The following example illustrates enabling BitLocker on a computer without a TPM chip. Before beginning the encryption process, you must create the startup key needed for BitLocker and save it to the USB drive. When BitLocker is enabled for the operating system volume, the BitLocker will need to access the USB flash drive to obtain the encryption key (in this example, the drive letter E represents the USB drive). You will be prompted to reboot to complete the encryption process. diff --git a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md index 2a08e910d0..664fb40db0 100644 --- a/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md +++ b/windows/security/information-protection/bitlocker/troubleshoot-bitlocker.md @@ -58,7 +58,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in The output of such a command resembles the following. - ![Display of events that is produced by using Get-WinEvent and a BitLocker filter](./images/psget-winevent-1.png) + ![Display of events that is produced by using Get-WinEvent and a BitLocker filter.](./images/psget-winevent-1.png) - To export BitLocker-related information: ```ps @@ -77,7 +77,7 @@ You can use Get-WinEvent in an elevated PowerShell window to display filtered in The output of such a command resembles the following. - ![Display of events that is produced by using Get-WinEvent and a TPM filter](./images/psget-winevent-2.png) + ![Display of events that is produced by using Get-WinEvent and a TPM filter.](./images/psget-winevent-2.png) > [!NOTE] > If you intend to contact Microsoft Support, we recommend that you export the logs listed in this section. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md index d41b2c7bf1..6268e09343 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-cannot-encrypt-issues.md @@ -82,11 +82,11 @@ To verify that this issue has occurred, follow these steps: 1. Copy this output, and use it as part of the [**ConvertFrom-SddlString**](/powershell/module/microsoft.powershell.utility/convertfrom-sddlstring?view=powershell-6) command in the PowerShell window, as follows. - ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE](./images/ts-bitlocker-usb-sddl.png) + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\INTERACTIVE.](./images/ts-bitlocker-usb-sddl.png) If you see NT AUTHORITY\INTERACTIVE (as highlighted), in the output of this command, this is the cause of the issue. Under typical conditions, the output should resemble the following: - ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users](./images/ts-bitlocker-usb-default-sddl.png) + ![Output of the ConvertFrom-SddlString command, showing NT AUTHORITY\\Authenticated Users.](./images/ts-bitlocker-usb-default-sddl.png) > [!NOTE] > GPOs that change the security descriptors of services have been known to cause this issue. diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md index bab9c21e3e..1def746b1f 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-decode-measured-boot-logs.md @@ -45,11 +45,11 @@ To install the tool, follow these steps: 1. Accept the default installation path. - ![Specify Location page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-1.png) + ![Specify Location page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-1.png) 1. Under **Select the features you want to install**, select **Windows Hardware Lab Kit—Controller + Studio**. - ![Select features page of the Windows Hardware Lab Kit installation wizard](./images/ts-tpm-2.png) + ![Select features page of the Windows Hardware Lab Kit installation wizard.](./images/ts-tpm-2.png) 1. Finish the installation. @@ -60,7 +60,7 @@ To use TBSLogGenerator, follow these steps: This folder contains the TBSLogGenerator.exe file. - ![Properties and location of the TBSLogGenerator.exe file](./images/ts-tpm-3.png) + ![Properties and location of the TBSLogGenerator.exe file.](./images/ts-tpm-3.png) 1. Run the following command: ```cmd @@ -78,19 +78,19 @@ To use TBSLogGenerator, follow these steps: TBSLogGenerator.exe -LF C:\MeasuredBoot\0000000005-0000000000.log > C:\MeasuredBoot\0000000005-0000000000.txt ``` - ![Command Prompt window that shows an example of how to use TBSLogGenerator](./images/ts-tpm-4.png) + ![Command Prompt window that shows an example of how to use TBSLogGenerator.](./images/ts-tpm-4.png) The command produces a text file that uses the specified name. In the case of the example, the file is **0000000005-0000000000.txt**. The file is located in the same folder as the original .log file. - ![Windows Explorer window that shows the text file that TBSLogGenerator produces](./images/ts-tpm-5.png) + ![Windows Explorer window that shows the text file that TBSLogGenerator produces.](./images/ts-tpm-5.png) The content of this text file resembles the following. -![Contents of the text file, as shown in NotePad](./images/ts-tpm-6.png) +![Contents of the text file, as shown in NotePad.](./images/ts-tpm-6.png) To find the PCR information, go to the end of the file. - ![View of NotePad that shows the PCR information at the end of the text file](./images/ts-tpm-7.png) + ![View of NotePad that shows the PCR information at the end of the text file.](./images/ts-tpm-7.png) ## Use PCPTool to decode Measured Boot logs @@ -114,4 +114,4 @@ where the variables represent the following values: The content of the XML file resembles the following. -![Command Prompt window that shows an example of how to use PCPTool](./images/pcptool-output.jpg) +![Command Prompt window that shows an example of how to use PCPTool.](./images/pcptool-output.jpg) diff --git a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md index 60c34a7bb6..611dc64098 100644 --- a/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md +++ b/windows/security/information-protection/bitlocker/ts-bitlocker-intune-issues.md @@ -20,7 +20,7 @@ ms.custom: bitlocker This article helps you troubleshoot issues that you may experience if you use Microsoft Intune policy to manage silent BitLocker encryption on devices. The Intune portal indicates whether BitLocker has failed to encrypt one or more managed devices. -![The BitLocker status indictors on the Intune portal](./images/4509189-en-1.png) +![The BitLocker status indictors on the Intune portal.](./images/4509189-en-1.png) To start narrowing down the cause of the problem, review the event logs as described in [Troubleshoot BitLocker](troubleshoot-bitlocker.md). Concentrate on the Management and Operations logs in the **Applications and Services logs\\Microsoft\\Windows\\BitLocker-API** folder. The following sections provide more information about how to resolve the indicated events and error messages: @@ -43,7 +43,7 @@ For information about how to verify that Intune policies are enforcing BitLocker Event ID 853 can carry different error messages, depending on the context. In this case, the Event ID 853 error message indicates that the device does not appear to have a TPM. The event information resembles the following: -![Details of event ID 853 (TPM is not available, cannot find TPM)](./images/4509190-en-1.png) +![Details of event ID 853 (TPM is not available, cannot find TPM).](./images/4509190-en-1.png) ### Cause @@ -64,7 +64,7 @@ For more information, see [Troubleshoot the TPM](../tpm/initialize-and-configure In this case, you see event ID 853, and the error message in the event indicates that bootable media is available to the device. The event information resembles the following. -![Details of event ID 853 (TPM is not available, bootable media found)](./images/4509191-en-1.png) +![Details of event ID 853 (TPM is not available, bootable media found).](./images/4509191-en-1.png) ### Cause @@ -100,7 +100,7 @@ You can resolve this issue by verifying the configuration of the disk partitions The procedures described in this section depend on the default disk partitions that Windows configures during installation. Windows 10 automatically creates a recovery partition that contains the Winre.wim file. The partition configuration resembles the following. -![Default disk partitions, including the recovery partition](./images/4509194-en-1.png) +![Default disk partitions, including the recovery partition.](./images/4509194-en-1.png) To verify the configuration of the disk partitions, open an elevated Command Prompt window, and run the following commands: @@ -108,11 +108,11 @@ To verify the configuration of the disk partitions, open an elevated Command Pro diskpart list volume ``` -![Output of the list volume command in the Diskpart app](./images/4509195-en-1.png) +![Output of the list volume command in the Diskpart app.](./images/4509195-en-1.png) If the status of any of the volumes is not healthy or if the recovery partition is missing, you may have to reinstall Windows. Before you do this, check the configuration of the Windows image that you are using for provisioning. Make sure that the image uses the correct disk configuration. The image configuration should resemble the following (this example is from Microsoft Endpoint Configuration Manager). -![Windows image configuration in Microsoft Endpoint Configuration Manager](./images/configmgr-imageconfig.jpg) +![Windows image configuration in Microsoft Endpoint Configuration Manager.](./images/configmgr-imageconfig.jpg) #### Step 2: Verify the status of WinRE @@ -123,7 +123,7 @@ reagentc /info ``` The output of this command resembles the following. -![Output of the reagentc /info command](./images/4509193-en-1.png) +![Output of the reagentc /info command.](./images/4509193-en-1.png) If the **Windows RE status** is not **Enabled**, run the following command to enable it: @@ -141,7 +141,7 @@ bcdedit /enum all The output of this command resembles the following. -![Output of the bcdedit /enum all command](./images/4509196-en-1.png) +![Output of the bcdedit /enum all command.](./images/4509196-en-1.png) In the output, locate the **Windows Boot Loader** section that includes the line **identifier={current}**. In that section, locate the **recoverysequence** attribute. The value of this attribute should be a GUID value, not a string of zeros. @@ -163,7 +163,7 @@ To verify the BIOS mode, use the System Information app. To do this, follow thes 1. Select **Start**, and enter **msinfo32** in the **Search** box. 1. Verify that the **BIOS Mode** setting is **UEFI** and not **Legacy**. - ![System Information app, showing the BIOS Mode setting](./images/4509198-en-1.png) + ![System Information app, showing the BIOS Mode setting.](./images/4509198-en-1.png) 1. If the **BIOS Mode** setting is **Legacy**, you have to switch the BIOS into **UEFI** or **EFI** mode. The steps for doing this are specific to the device. > [!NOTE] > If the device supports only Legacy mode, you cannot use Intune to manage BitLocker Device Encryption on the device. @@ -192,11 +192,11 @@ Manage-bde -protectors -get %systemdrive% In the TPM section of the output of this command, verify that the **PCR Validation Profile** setting includes **7**, as follows. -![Output of the manage-bde command](./images/4509199-en-1.png) +![Output of the manage-bde command.](./images/4509199-en-1.png) If **PCR Validation Profile** doesn't include **7** (for example, the values include **0**, **2**, **4**, and **11**, but not **7**), then Secure Boot is not turned on. -![Output of the manage-bde command when PCR 7 is not present](./images/4509200-en-1.png) +![Output of the manage-bde command when PCR 7 is not present.](./images/4509200-en-1.png) #### 2. Verify the Secure Boot state @@ -204,9 +204,9 @@ To verify the Secure Boot state, use the System Information app. To do this, fol 1. Select **Start**, and enter **msinfo32** in the **Search** box. 1. Verify that the **Secure Boot State** setting is **On**, as follows: - ![System Information app, showing a supported Secure Boot State](./images/4509201-en-1.png) + ![System Information app, showing a supported Secure Boot State.](./images/4509201-en-1.png) 1. If the **Secure Boot State** setting is **Unsupported**, you cannot use Silent BitLocker Encryption on this device. - ![System Information app, showing a unsupported Secure Boot State](./images/4509202-en-1.png) + ![System Information app, showing a unsupported Secure Boot State.](./images/4509202-en-1.png) > [!NOTE] > You can also use the [Confirm-SecureBootUEFI](/powershell/module/secureboot/confirm-securebootuefi?view=win10-ps) cmdlet to verify the Secure Boot state. To do this, open an elevated PowerShell window and run the following command: @@ -290,7 +290,7 @@ If your device runs Windows 10 version 1703 or later, supports Modern Standby (a If your device is HSTI-compliant but does not support Modern Standby, you have to configure an endpoint protection policy to enforce silent BitLocker Drive Encryption. The settings for this policy should resemble the following: -![Intune policy settings](./images/4509186-en-1.png) +![Intune policy settings.](./images/4509186-en-1.png) The OMA-URI references for these settings are as follows: @@ -316,7 +316,7 @@ The Intune 1901 release provides settings that you can use to configure automati - Support Modern Standby - Use Windows 10 version 1803 or later -![Intune policy setting](./images/4509188-en-1.png) +![Intune policy setting.](./images/4509188-en-1.png) The OMA-URI references for these settings are as follows: @@ -331,17 +331,17 @@ The OMA-URI references for these settings are as follows: During regular operations, BitLocker Drive Encryption generates events such as Event ID 796 and Event ID 845. -![Event ID 796, as shown in Event Viewer](./images/4509203-en-1.png) +![Event ID 796, as shown in Event Viewer.](./images/4509203-en-1.png) -![Event ID 845, as shown in Event Viewer](./images/4509204-en-1.png) +![Event ID 845, as shown in Event Viewer.](./images/4509204-en-1.png) You can also determine whether the BitLocker recovery password has been uploaded to Azure AD by checking the device details in the Azure AD Devices section. -![BitLocker recovery information as viewed in Azure AD](./images/4509205-en-1.png) +![BitLocker recovery information as viewed in Azure AD.](./images/4509205-en-1.png) On the device, check the Registry Editor to verify the policy settings on the device. Verify the entries under the following subkeys: - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device\\BitLocker** - **HKEY\_LOCAL\_MACHINE\\SOFTWARE\\Microsoft\\PolicyManager\\current\\device** -![Registry subkeys that relate to Intune policy](./images/4509206-en-1.png) \ No newline at end of file +![Registry subkeys that relate to Intune policy.](./images/4509206-en-1.png) \ No newline at end of file diff --git a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md index 31fc1097a4..768d8cdd75 100644 --- a/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md +++ b/windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md @@ -53,7 +53,7 @@ By default, peripherals with DMA Remapping incompatible drivers will be blocked ## User experience -![Kernel DMA protection user experience](images/kernel-dma-protection-user-experience.png) +![Kernel DMA protection user experience.](images/kernel-dma-protection-user-experience.png) By default, peripherals with DMA remapping compatible device drivers will be automatically enumerated and started. Peripherals with DMA Remapping incompatible drivers will be blocked from starting if the peripheral was plugged in before an authorized user logs in, or while the screen is locked. Once the system is unlocked, the peripheral driver will be started by the OS, and the peripheral will continue to function normally until the system is rebooted, or the peripheral is unplugged. The peripheral will continue to function normally if the user locks the screen or logs out of the system. @@ -77,7 +77,7 @@ Systems running Windows 10 version 1803 that do support Kernel DMA Protection do Beginning with Windows 10 version 1809, you can use Security Center to check if Kernel DMA Protection is enabled. Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation details** > **Memory access protection**. -![Kernel DMA protection in Security Center](bitlocker/images/kernel-dma-protection-security-center.png) +![Kernel DMA protection in Security Center.](bitlocker/images/kernel-dma-protection-security-center.png) ### Using System information @@ -85,7 +85,7 @@ Beginning with Windows 10 version 1809, you can use Security Center to check if 2. Check the value of **Kernel DMA Protection**. - ![Kernel DMA protection in System Information](bitlocker/images/kernel-dma-protection.png) + ![Kernel DMA protection in System Information.](bitlocker/images/kernel-dma-protection.png) 3. If the current state of **Kernel DMA Protection** is OFF and **Hyper-V - Virtualization Enabled in Firmware** is NO: @@ -113,11 +113,11 @@ No, Kernel DMA Protection only protects against drive-by DMA attacks after the O DMA-remapping is supported for specific device drivers, and is not universally supported by all devices and drivers on a platform. To check if a specific driver is opted into DMA-remapping, check the values corresponding to the DMA Remapping Policy property in the Details tab of a device in Device Manager*. A value of 0 or 1 means that the device driver does not support DMA-remapping. A value of 2 means that the device driver supports DMA-remapping. If the property is not available, then the policy is not set by the device driver (i.e. the device driver does not support DMA-remapping). Please check the driver instance for the device you are testing. Some drivers may have varying values depending on the location of the device (internal vs. external). -![Kernel DMA protection user experience](images/device_details_tab_1903.png) +![Kernel DMA protection user experience.](images/device_details_tab_1903.png) *For Windows 10 versions 1803 and 1809, the property field in Device Manager uses a GUID, as highlighted in the following image. -![Kernel DMA protection user experience](images/device-details-tab.png) +![Kernel DMA protection user experience.](images/device-details-tab.png) ### What should I do if the drivers for my PCI or Thunderbolt™ 3 peripherals do not support DMA-remapping? diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 721ae1e1e3..3d8754473d 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -55,7 +55,7 @@ Windows 10 supports four features to help prevent rootkits and bootkits from lo Figure 1 shows the Windows 10 startup process. -![Windows 10 startup process](./images/dn168167.boot_process(en-us,MSDN.10).png) +![Windows 10 startup process.](./images/dn168167.boot_process(en-us,MSDN.10).png) **Figure 1. Secure Boot, Trusted Boot, and Measured Boot block malware at every stage** @@ -115,7 +115,7 @@ Depending on the implementation and configuration, the server can now determine Figure 2 illustrates the Measured Boot and remote attestation process. -![Measured Boot and remote attestation process](./images/dn168167.measure_boot(en-us,MSDN.10).png) +![Measured Boot and remote attestation process.](./images/dn168167.measure_boot(en-us,MSDN.10).png) **Figure 2. Measured Boot proves the PC’s health to a remote server** diff --git a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md index 06d8c54066..dd9e12558e 100644 --- a/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md +++ b/windows/security/information-protection/tpm/how-windows-uses-the-tpm.md @@ -84,7 +84,7 @@ Identity providers have flexibility in how they provision credentials on client • **Attestation identity key**. To protect privacy, most TPM scenarios do not directly use an actual endorsement key. Instead, they use attestation identity keys, and an identity certificate authority (CA) uses the endorsement key and its certificate to prove that one or more attestation identity keys actually exist in a real TPM. The identity CA issues attestation identity key certificates. More than one identity CA will generally see the same endorsement key certificate that can uniquely identify the TPM, but any number of attestation identity key certificates can be created to limit the information shared in other scenarios. -![TPM Capabilities](images/tpm-capabilities.png) +![TPM Capabilities.](images/tpm-capabilities.png) *Figure 1: TPM Cryptographic Key Management* @@ -126,7 +126,7 @@ The TPM provides the following way for scenarios to use the measurements recorde When new security features are added to Windows, Measured Boot adds security-relevant configuration information to the measurements recorded in the TPM. Measured Boot enables remote attestation scenarios that reflect the system firmware and the Windows initialization state. -![Process to Create Evidence of Boot Software and Configuration Using TPM](images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png) +![Process to Create Evidence of Boot Software and Configuration Using TPM.](images/process-to-create-evidence-of-boot-software-and-configuration-using-tpm.png) *Figure 2: Process used to create evidence of boot software and configuration using a TPM* diff --git a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md index 4a5ddd2df2..5a5e12feb9 100644 --- a/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md +++ b/windows/security/information-protection/windows-information-protection/create-and-verify-an-efs-dra-certificate.md @@ -91,7 +91,7 @@ It's possible that you might revoke data from an unenrolled device only to later To start Robocopy in S mode, open Task Manager. Click **File** > **Run new task**, type the command, and click **Create this task with administrative privileges**. - ![Robocopy in S mode](images/robocopy-s-mode.png) + ![Robocopy in S mode.](images/robocopy-s-mode.png) If the employee performed a clean installation and there is no user profile, you need to recover the keys from the System Volume folder in each drive. Type: diff --git a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md index a605d96688..909073181d 100644 --- a/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-vpn-and-wip-policy-using-intune-azure.md @@ -34,11 +34,11 @@ Follow these steps to associate your WIP policy with your organization's existin 2. Open the Microsoft Intune mobile application management console, click **Device configuration**, and then click **Create Profile**. - ![Microsoft Intune, Create a new policy using the portal](images/wip-azure-vpn-device-policy.png) + ![Microsoft Intune, Create a new policy using the portal.](images/wip-azure-vpn-device-policy.png) 3. In the **Create Profile** blade, type a name for your profile, such as *Contoso_VPN_Win10*, into the **Name** box, add an optional description for your policy into the **Description** box, select **Windows 10 and later** from the **Platform** dropdown box, select **Custom** from the **Profile type** dropdown box, and then click **Configure**. - ![Microsoft Intune, Create a new policy using the Create Profile blade](images/wip-azure-vpn-configure-policy.png) + ![Microsoft Intune, Create a new policy using the Create Profile blade.](images/wip-azure-vpn-configure-policy.png) 4. In the **Custom OMA-URI Settings** blade, click **Add**. @@ -54,7 +54,7 @@ Follow these steps to associate your WIP policy with your organization's existin - **Value.** Type your fully-qualified domain that should be used by the OMA-URI setting. For example, _corp.contoso.com_. - ![Microsoft Intune, Add your OMA-URI settings](images/wip-azure-vpn-custom-omauri.png) + ![Microsoft Intune, Add your OMA-URI settings.](images/wip-azure-vpn-custom-omauri.png) 6. Click **OK** to save your setting info in the **Add Row** blade, and then click **OK** in the **Custom OMA-URI Settings** blade to save the setting with your policy. @@ -73,7 +73,7 @@ After you’ve created your VPN policy, you'll need to deploy it to the same gro The policy is deployed to the selected users' devices. - ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) + ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed.](images/wip-azure-add-user-groups.png) >[!NOTE] >Help to make this topic better by providing us with edits, additions, and feedback. For info about how to contribute to this topic, see [Editing Windows IT professional documentation](https://github.com/Microsoft/windows-itpro-docs/blob/master/CONTRIBUTING.md). \ No newline at end of file diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md index f13e30a044..32511b9cd5 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-configmgr.md @@ -36,12 +36,12 @@ After you've installed and set up Configuration Manager for your organization, y 1. Open the Configuration Manager console, click the **Assets and Compliance** node, expand the **Overview** node, expand the **Compliance Settings** node, and then expand the **Configuration Items** node. - ![Configuration Manager, Configuration Items screen](images/wip-configmgr-addpolicy.png) + ![Configuration Manager, Configuration Items screen.](images/wip-configmgr-addpolicy.png) 2. Click the **Create Configuration Item** button.

The **Create Configuration Item Wizard** starts. - ![Create Configuration Item wizard, define the configuration item and choose the configuration type](images/wip-configmgr-generalscreen.png) + ![Create Configuration Item wizard, define the configuration item and choose the configuration type.](images/wip-configmgr-generalscreen.png) 3. On the **General Information screen**, type a name (required) and an optional description for your policy into the **Name** and **Description** boxes. @@ -55,11 +55,11 @@ The **Create Configuration Item Wizard** starts. 5. On the **Supported Platforms** screen, click the **Windows 10** box, and then click **Next**. - ![Create Configuration Item wizard, choose the supported platforms for the policy](images/wip-configmgr-supportedplat.png) + ![Create Configuration Item wizard, choose the supported platforms for the policy.](images/wip-configmgr-supportedplat.png) 6. On the **Device Settings** screen, click **Windows Information Protection**, and then click **Next**. - ![Create Configuration Item wizard, choose the Windows Information Protection settings](images/wip-configmgr-devicesettings.png) + ![Create Configuration Item wizard, choose the Windows Information Protection settings.](images/wip-configmgr-devicesettings.png) The **Configure Windows Information Protection settings** page appears, where you'll configure your policy for your organization. @@ -81,7 +81,7 @@ For this example, we're going to add Microsoft OneNote, a store app, to the **Ap The **Add app rule** box appears. - ![Create Configuration Item wizard, add a universal store app](images/wip-configmgr-adduniversalapp.png) + ![Create Configuration Item wizard, add a universal store app.](images/wip-configmgr-adduniversalapp.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Microsoft OneNote*. @@ -141,7 +141,7 @@ For this example, we're going to add Internet Explorer, a desktop app, to the ** The **Add app rule** box appears. - ![Create Configuration Item wizard, add a classic desktop app](images/wip-configmgr-adddesktopapp.png) + ![Create Configuration Item wizard, add a classic desktop app.](images/wip-configmgr-adddesktopapp.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Internet Explorer*. @@ -218,7 +218,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** 2. In the left pane, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules](images/intune-local-security-snapin.png) + ![Local security snap-in, showing the Packaged app Rules.](images/intune-local-security-snapin.png) 3. Right-click in the right-hand pane, and then click **Create New Rule**. @@ -226,33 +226,33 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** 4. On the **Before You Begin** page, click **Next**. - ![Create a Packaged app Rules wizard and showing the Before You Begin page](images/intune-applocker-before-begin.png) + ![Create a Packaged app Rules wizard and showing the Before You Begin page.](images/intune-applocker-before-begin.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. - ![Create Packaged app Rules wizard, set action to Allow](images/intune-applocker-permissions.png) + ![Create Packaged app Rules wizard, set action to Allow.](images/intune-applocker-permissions.png) 6. On the **Publisher** page, click **Select** from the **Use an installed packaged app as a reference** area. - ![Create Packaged app Rules wizard, select use an installed packaged app](images/intune-applocker-publisher.png) + ![Create Packaged app Rules wizard, select use an installed packaged app.](images/intune-applocker-publisher.png) 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we're using Microsoft Photos. - ![Create Packaged app Rules wizard, select application and click ok](images/intune-applocker-select-apps.png) + ![Create Packaged app Rules wizard, select application and click ok.](images/intune-applocker-select-apps.png) 8. On the updated **Publisher** page, click **Create**. - ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page](images/intune-applocker-publisher-with-app.png) + ![Create Packaged app Rules wizard, showing the Microsoft Photos on the Publisher page.](images/intune-applocker-publisher-with-app.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule](images/intune-local-security-snapin-updated.png) + ![Local security snap-in, showing the new rule.](images/intune-local-security-snapin-updated.png) 10. In the left pane, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option](images/intune-local-security-export.png) + ![Local security snap-in, showing the Export Policy option.](images/intune-local-security-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. @@ -286,7 +286,7 @@ For this example, we're going to add an AppLocker XML file to the **App Rules** The **Add app rule** box appears. - ![Create Configuration Item wizard, add an AppLocker policy](images/wip-configmgr-addapplockerfile.png) + ![Create Configuration Item wizard, add an AppLocker policy.](images/wip-configmgr-addapplockerfile.png) 2. Add a friendly name for your app into the **Title** box. In this example, it's *Allowed app list*. @@ -353,7 +353,7 @@ You can specify multiple domains owned by your enterprise by separating them wit - Type the name of your corporate identity into the **Corporate identity** field. For example, `contoso.com` or `contoso.com|newcontoso.com`. - ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity](images/wip-configmgr-corp-identity.png) + ![Create Configuration Item wizard, Add the primary Internet domain for your enterprise identity.](images/wip-configmgr-corp-identity.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. @@ -372,7 +372,7 @@ There are no default locations included with WIP, you must add each of your netw 2. Type a name for your corporate network element into the **Name** box, and then pick what type of network element it is, from the **Network element** drop-down box. This can include any of the options in the following table. - ![Add or edit corporate network definition box, Add your enterprise network locations](images/wip-configmgr-add-network-domain.png) + ![Add or edit corporate network definition box, Add your enterprise network locations.](images/wip-configmgr-add-network-domain.png) @@ -431,7 +431,7 @@ There are no default locations included with WIP, you must add each of your netw 5. In the required **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate](images/wip-configmgr-dra.png) + ![Create Configuration Item wizard, Add a data recovery agent (DRA) certificate.](images/wip-configmgr-dra.png) After you create and deploy your WIP policy to your employees, Windows will begin to encrypt your corporate data on the employees' local device drive. If somehow the employees' local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the DRA certificate lets Windows use an included public key to encrypt the local data, while you maintain the private key that can unencrypt the data. @@ -440,7 +440,7 @@ There are no default locations included with WIP, you must add each of your netw ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you'll be asked to decide if you want to add any optional WIP settings. -![Create Configuration Item wizard, Choose any additional, optional settings](images/wip-configmgr-additionalsettings.png) +![Create Configuration Item wizard, Choose any additional, optional settings.](images/wip-configmgr-additionalsettings.png) **To set your optional settings** 1. Choose to set any or all of the optional settings: @@ -467,7 +467,7 @@ After you've finished configuring your policy, you can review all of your info o **To view the Summary screen** - Click the **Summary** button to review your policy choices, and then click **Next** to finish and to save your policy. - ![Create Configuration Item wizard, Summary screen for all of your policy choices](images/wip-configmgr-summaryscreen.png) + ![Create Configuration Item wizard, Summary screen for all of your policy choices.](images/wip-configmgr-summaryscreen.png) A progress bar appears, showing you progress for your policy. After it's done, click **Close** to return to the **Configuration Items** page. diff --git a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md index 17dcaff4f3..0442c3778a 100644 --- a/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/create-wip-policy-using-intune-azure.md @@ -50,7 +50,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 3. Click **Restore Default URLs** or enter the settings for MDM or MAM user scope and click **Save**: - ![Configure MDM or MAM provider](images/mobility-provider.png) + ![Configure MDM or MAM provider.](images/mobility-provider.png) ## Create a WIP policy @@ -58,7 +58,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or 2. Open Microsoft Intune and click **Apps** > **App protection policies** > **Create policy**. - ![Open Client apps](images/create-app-protection-policy.png) + ![Open Client apps.](images/create-app-protection-policy.png) 3. In the **App policy** screen, click **Add a policy**, and then fill out the fields: @@ -70,11 +70,11 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or - **Enrollment state.** Choose **Without enrollment** for MAM or **With enrollment** for MDM. - ![Add a mobile app policy](images/add-a-mobile-app-policy.png) + ![Add a mobile app policy.](images/add-a-mobile-app-policy.png) 4. Click **Protected apps** and then click **Add apps**. - ![Add protected apps](images/add-protected-apps.png) + ![Add protected apps.](images/add-protected-apps.png) You can add these types of apps: @@ -89,7 +89,7 @@ Before you can create a WIP policy using Intune, you need to configure an MDM or Select **Recommended apps** and select each app you want to access your enterprise data or select them all, and click **OK**. -![Microsoft Intune management console: Recommended apps](images/recommended-apps.png) +![Microsoft Intune management console: Recommended apps.](images/recommended-apps.png) ### Add Store apps @@ -99,7 +99,7 @@ Select **Store apps**, type the app product name and publisher, and click **OK** - **Publisher**: `CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US` - **Product Name**: `Microsoft.MicrosoftPowerBIForWindows` -![Add Store app](images/add-a-protected-store-app.png) +![Add Store app.](images/add-a-protected-store-app.png) To add multiple Store apps, click the ellipsis **…**. @@ -201,7 +201,7 @@ To add **Desktop apps**, complete the following fields, based on what results yo To add another Desktop app, click the ellipsis **…**. After you’ve entered the info into the fields, click **OK**. -![Microsoft Intune management console: Adding Desktop app info](images/wip-azure-add-desktop-apps.png) +![Microsoft Intune management console: Adding Desktop app info.](images/wip-azure-add-desktop-apps.png) If you’re unsure about what to include for the publisher, you can run this PowerShell command: @@ -242,7 +242,7 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 2. In the left blade, expand **Application Control Policies**, expand **AppLocker**, and then click **Packaged App Rules**. - ![Local security snap-in, showing the Packaged app Rules](images/wip-applocker-secpol-1.png) + ![Local security snap-in, showing the Packaged app Rules.](images/wip-applocker-secpol-1.png) 3. Right-click in the right-hand blade, and then click **Create New Rule**. @@ -250,7 +250,7 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 4. On the **Before You Begin** page, click **Next**. - ![Screenshot of the Before You Begin tab](images/wip-applocker-secpol-wizard-1.png) + ![Screenshot of the Before You Begin tab.](images/wip-applocker-secpol-wizard-1.png) 5. On the **Permissions** page, make sure the **Action** is set to **Allow** and the **User or group** is set to **Everyone**, and then click **Next**. @@ -262,25 +262,25 @@ For more info about AppLocker, see the [AppLocker](../../threat-protection/windo 7. In the **Select applications** box, pick the app that you want to use as the reference for your rule, and then click **OK**. For this example, we’re using Microsoft Dynamics 365. - ![Screenshot of the Select applications list](images/wip-applocker-secpol-wizard-4.png) + ![Screenshot of the Select applications list.](images/wip-applocker-secpol-wizard-4.png) 8. On the updated **Publisher** page, click **Create**. - ![Screenshot of the Publisher tab](images/wip-applocker-secpol-wizard-5.png) + ![Screenshot of the Publisher tab.](images/wip-applocker-secpol-wizard-5.png) 9. Click **No** in the dialog box that appears, asking if you want to create the default rules. You must not create default rules for your WIP policy. - ![Screenshot of AppLocker warning](images/wip-applocker-default-rule-warning.png) + ![Screenshot of AppLocker warning.](images/wip-applocker-default-rule-warning.png) 9. Review the Local Security Policy snap-in to make sure your rule is correct. - ![Local security snap-in, showing the new rule](images/wip-applocker-secpol-create.png) + ![Local security snap-in, showing the new rule.](images/wip-applocker-secpol-create.png) 10. In the left blade, right-click on **AppLocker**, and then click **Export policy**. The **Export policy** box opens, letting you export and save your new policy as XML. - ![Local security snap-in, showing the Export Policy option](images/wip-applocker-secpol-export.png) + ![Local security snap-in, showing the Export Policy option.](images/wip-applocker-secpol-export.png) 11. In the **Export policy** box, browse to where the policy should be stored, give the policy a name, and then click **Save**. @@ -320,7 +320,7 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 3. Right-click **Executable Rules** > **Create New Rule**. - ![Local security snap-in, showing the Executable Rules](images/create-new-path-rule.png) + ![Local security snap-in, showing the Executable Rules.](images/create-new-path-rule.png) 4. On the **Before You Begin** page, click **Next**. @@ -328,11 +328,11 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 6. On the **Conditions** page, click **Path** and then click **Next**. - ![Screenshot with Path conditions selected in the Create Executable Rules wizard](images/path-condition.png) + ![Screenshot with Path conditions selected in the Create Executable Rules wizard.](images/path-condition.png) 7. Click **Browse Folders...** and select the path for the unsigned apps. For this example, we’re using "C:\Program Files". - ![Screenshot of the Path field of the Create Executable Rules wizard](images/select-path.png) + ![Screenshot of the Path field of the Create Executable Rules wizard.](images/select-path.png) 8. On the **Exceptions** page, add any exceptions and then click **Next**. @@ -351,11 +351,11 @@ The executable rule helps to create an AppLocker rule to sign any unsigned apps. 1. In **Protected apps**, click **Import apps**. - ![Import protected apps](images/import-protected-apps.png) + ![Import protected apps.](images/import-protected-apps.png) Then import your file. - ![Microsoft Intune, Importing your AppLocker policy file using Intune](images/wip-azure-import-apps.png) + ![Microsoft Intune, Importing your AppLocker policy file using Intune.](images/wip-azure-import-apps.png) 2. Browse to your exported AppLocker policy file, and then click **Open**. @@ -366,7 +366,7 @@ If your app is incompatible with WIP, but still needs to be used with enterprise 1. In **Client apps - App protection policies**, click **Exempt apps**. - ![Exempt apps](images/exempt-apps.png) + ![Exempt apps.](images/exempt-apps.png) 2. In **Exempt apps**, click **Add apps**. @@ -391,7 +391,7 @@ We recommend that you start with **Silent** or **Allow Overrides** while verifyi 1. From the **App protection policy** blade, click the name of your policy, and then click **Required settings**. - ![Microsoft Intune, Required settings blade showing Windows Information Protection mode](images/wip-azure-required-settings-protection-mode.png) + ![Microsoft Intune, Required settings blade showing Windows Information Protection mode.](images/wip-azure-required-settings-protection-mode.png) |Mode |Description | |-----|------------| @@ -413,11 +413,11 @@ Starting with Windows 10, version 1703, Intune automatically determines your cor 2. If the auto-defined identity isn’t correct, you can change the info in the **Corporate identity** field. - ![Microsoft Intune, Set your corporate identity for your organization](images/wip-azure-required-settings-corp-identity.png) + ![Microsoft Intune, Set your corporate identity for your organization.](images/wip-azure-required-settings-corp-identity.png) 3. To add domains, such your email domain names, click **Configure Advanced settings** > **Add network boundary** and select **Protected domains**. - ![Add protected domains](images/add-protected-domains.png) + ![Add protected domains.](images/add-protected-domains.png) ## Choose where apps can access enterprise data After you've added a protection mode to your apps, you'll need to decide where those apps can access enterprise data on your network. Every WIP policy should include your enterprise network locations. @@ -426,7 +426,7 @@ There are no default locations included with WIP, you must add each of your netw To define the network boundaries, click **App policy** > the name of your policy > **Advanced settings** > **Add network boundary**. -![Microsoft Intune, Set where your apps can access enterprise data on your network](images/wip-azure-advanced-settings-network.png) +![Microsoft Intune, Set where your apps can access enterprise data on your network.](images/wip-azure-advanced-settings-network.png) Select the type of network boundary to add from the **Boundary type** box. Type a name for your boundary into the **Name** box, add your values to the **Value** box, based on the options covered in the following subsections, and then click **OK**. @@ -558,7 +558,7 @@ Decide if you want Windows to look for additional network settings: - **Enterprise IP Ranges list is authoritative (do not auto-detect).** Turn on if you want Windows to treat the IP ranges you specified in the network boundary definition as the complete list of IP ranges available on your network. If you turn this off, Windows will search for additional IP ranges on any domain-joined devices connected to your network. -![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise](images/wip-azure-advanced-settings-network-autodetect.png) +![Microsoft Intune, Choose if you want Windows to search for additional proxy servers or IP ranges in your enterprise.](images/wip-azure-advanced-settings-network-autodetect.png) ## Upload your Data Recovery Agent (DRA) certificate After you create and deploy your WIP policy to your employees, Windows begins to encrypt your corporate data on the employees’ local device drive. If somehow the employees’ local encryption keys get lost or revoked, the encrypted data can become unrecoverable. To help avoid this possibility, the Data Recovery Agent (DRA) certificate lets Windows use an included public key to encrypt the local data while you maintain the private key that can unencrypt the data. @@ -573,12 +573,12 @@ After you create and deploy your WIP policy to your employees, Windows begins to 2. In the **Upload a Data Recovery Agent (DRA) certificate to allow recovery of encrypted data** box, click **Browse** to add a data recovery certificate for your policy. - ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate](images/wip-azure-advanced-settings-efsdra.png) + ![Microsoft Intune, Upload your Data Recovery Agent (DRA) certificate.](images/wip-azure-advanced-settings-efsdra.png) ## Choose your optional WIP-related settings After you've decided where your protected apps can access enterprise data on your network, you can choose optional settings. -![Advanced optional settings](images/wip-azure-advanced-settings-optional.png) +![Advanced optional settings.](images/wip-azure-advanced-settings-optional.png) **Revoke encryption keys on unenroll.** Determines whether to revoke a user’s local encryption keys from a device when it’s unenrolled from Windows Information Protection. If the encryption keys are revoked, a user no longer has access to encrypted corporate data. The options are: @@ -613,7 +613,7 @@ After you've decided where your protected apps can access enterprise data on you You can restrict which files are protected by WIP when they are downloaded from an SMB share within your enterprise network locations. If this setting is configured, only files with the extensions in the list will be encrypted. If this setting is not specified, the existing auto-encryption behavior is applied. -![WIP encrypted file extensions](images/wip-encrypted-file-extensions.png) +![WIP encrypted file extensions.](images/wip-encrypted-file-extensions.png) ## Related topics diff --git a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md index 524199cf73..8d929e1db4 100644 --- a/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md +++ b/windows/security/information-protection/windows-information-protection/deploy-wip-policy-using-intune-azure.md @@ -34,7 +34,7 @@ After you’ve created your Windows Information Protection (WIP) policy, you'll The policy is deployed to the selected users' devices. - ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed](images/wip-azure-add-user-groups.png) + ![Microsoft Intune: Pick your user groups that should get the policy when it's deployed.](images/wip-azure-add-user-groups.png) >[!NOTE] diff --git a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md index b54cc7cbe1..dd3fb2529e 100644 --- a/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md +++ b/windows/security/information-protection/windows-information-protection/wip-app-enterprise-context.md @@ -36,13 +36,13 @@ You need to add the Enterprise Context column to the **Details** tab of the Task The **Select columns** box appears. - ![Task Manager, Select column box with Enterprise Context option selected](images/wip-select-column.png) + ![Task Manager, Select column box with Enterprise Context option selected.](images/wip-select-column.png) 3. Scroll down and check the **Enterprise Context** option, and then click **OK** to close the box. The **Enterprise Context** column should now be available in Task Manager. - ![Task Manager, Enterprise Context column highlighted](images/wip-taskmgr.png) + ![Task Manager, Enterprise Context column highlighted.](images/wip-taskmgr.png) ## Review the Enterprise Context The **Enterprise Context** column shows you what each app can do with your enterprise data: diff --git a/windows/security/information-protection/windows-information-protection/wip-learning.md b/windows/security/information-protection/windows-information-protection/wip-learning.md index 1e97616ee8..e2f9ce0a1f 100644 --- a/windows/security/information-protection/windows-information-protection/wip-learning.md +++ b/windows/security/information-protection/windows-information-protection/wip-learning.md @@ -38,11 +38,11 @@ In the **Website learning report**, you can view a summary of the devices that h 1. Click **Intune** > **Client apps** > **App protection status** > **Reports**. - ![Image showing the UI path to the WIP report](images/access-wip-learning-report.png) + ![Image showing the UI path to the WIP report.](images/access-wip-learning-report.png) 1. Select either **App learning report for Windows Information Protection** or **Website learning report for Windows Information Protection**. - ![Image showing the UI with for app and website learning reports](images/wip-learning-select-report.png) + ![Image showing the UI with for app and website learning reports.](images/wip-learning-select-report.png) Once you have the apps and websites showing up in the WIP Learning logging reports, you can decide whether to add them to your app protection policies. @@ -75,7 +75,7 @@ The information needed for the following steps can be found using Device Health, 4. In the **Recommended apps** drop down menu, choose either **Store apps** or **Desktop apps**, depending on the app you've chosen (for example, an executable (EXE) is a desktop app). - ![View of drop down menu for Store or desktop apps](images/wip-learning-choose-store-or-desktop-app.png) + ![View of drop down menu for Store or desktop apps.](images/wip-learning-choose-store-or-desktop-app.png) 5. In **NAME** (optional), type the name of the app, and then in **PUBLISHER** (required), paste the publisher information that you copied in step 1 above. @@ -87,7 +87,7 @@ The information needed for the following steps can be found using Device Health, `O=GOOGLE LLC, L=MOUNTAIN VIEW, S=CA, C=US` - ![View of Add Apps app info entry boxes](images/wip-learning-app-info.png) + ![View of Add Apps app info entry boxes.](images/wip-learning-app-info.png) 6. Type the name of the product in **PRODUCT NAME** (required) (this will probably be the same as what you typed for **NAME**). diff --git a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md index 1ede3ef4ed..ea4b252a30 100644 --- a/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md +++ b/windows/security/threat-protection/device-guard/enable-virtualization-based-protection-of-code-integrity.md @@ -58,7 +58,7 @@ Enabling in Intune requires using the Code Integrity node in the [AppLocker CSP] 3. Double-click **Turn on Virtualization Based Security**. 4. Click **Enabled** and under **Virtualization Based Protection of Code Integrity**, select **Enabled with UEFI lock** to ensure HVCI cannot be disabled remotely or select **Enabled without UEFI lock**. - ![Enable HVCI using Group Policy](../images/enable-hvci-gp.png) + ![Enable HVCI using Group Policy.](../images/enable-hvci-gp.png) 5. Click **Ok** to close the editor. @@ -279,7 +279,7 @@ This field lists the computer name. All valid values for computer name. Another method to determine the available and enabled Windows Defender Device Guard features is to run msinfo32.exe from an elevated PowerShell session. When you run this program, the Windows Defender Device Guard properties are displayed at the bottom of the **System Summary** section. -![Windows Defender Device Guard properties in the System Summary](../images/dg-fig11-dgproperties.png) +![Windows Defender Device Guard properties in the System Summary.](../images/dg-fig11-dgproperties.png) ## Troubleshooting diff --git a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md index 6e6173e36d..def1ec0b93 100644 --- a/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md +++ b/windows/security/threat-protection/intelligence/coordinated-malware-eradication.md @@ -17,7 +17,7 @@ ms.technology: mde --- # Coordinated Malware Eradication -![coordinated-malware-eradication](images/CoordinatedMalware.png) +![coordinated-malware-eradication.](images/CoordinatedMalware.png) Coordinated Malware Eradication (CME) aims to bring organizations in cybersecurity and in other industries together to change the game against malware. While the cybersecurity industry today is effective at disrupting malware families through individual efforts, those disruptions rarely lead to eradication since malware authors quickly adapt their tactics to survive. diff --git a/windows/security/threat-protection/intelligence/fileless-threats.md b/windows/security/threat-protection/intelligence/fileless-threats.md index e2029f3c2c..b125773d18 100644 --- a/windows/security/threat-protection/intelligence/fileless-threats.md +++ b/windows/security/threat-protection/intelligence/fileless-threats.md @@ -25,7 +25,7 @@ Attacks involve [several stages](https://attack.mitre.org/wiki/ATT&CK_Matrix) fo For clarity, fileless threats are grouped into different categories. -![Comprehensive diagram of fileless malware](images/fileless-malware.png)
+![Comprehensive diagram of fileless malware.](images/fileless-malware.png)
*Figure 1. Comprehensive diagram of fileless malware* Fileless threats can be classified by their entry point, which indicates how fileless malware can arrive on a machine. They can arrive via an exploit, through compromised hardware, or via regular execution of applications and scripts. @@ -56,7 +56,7 @@ It’s possible to carry out such installation via command line without requirin Some malware can have a sort of fileless persistence, but not without using files to operate. An example for this scenario is Kovter, which creates a shell open verb handler in the registry for a random file extension. Opening a file with such extension will lead to the execution of a script through the legitimate tool mshta.exe. -![Image of Kovter's registry key](images/kovter-reg-key.png)
+![Image of Kovter's registry key.](images/kovter-reg-key.png)
*Figure 2. Kovter’s registry key* When the open verb is invoked, the associated command from the registry is launched, which results in the execution of a small script. This script reads data from a further registry key and executes it, in turn leading to the loading of the final payload. However, to trigger the open verb in the first place, Kovter has to drop a file with the same extension targeted by the verb (in the example above, the extension is .bbf5590fd). It also has to set an autorun key configured to open such file when the machine starts. diff --git a/windows/security/threat-protection/intelligence/malware-naming.md b/windows/security/threat-protection/intelligence/malware-naming.md index ef4a133061..3b37bdf391 100644 --- a/windows/security/threat-protection/intelligence/malware-naming.md +++ b/windows/security/threat-protection/intelligence/malware-naming.md @@ -20,7 +20,7 @@ ms.technology: mde We name the malware and unwanted software that we detect according to the Computer Antivirus Research Organization (CARO) malware naming scheme. The scheme uses the following format: -![coordinated-malware-eradication](images/NamingMalware1.png) +![coordinated-malware-eradication.](images/NamingMalware1.png) When our analysts research a particular threat, they'll determine what each of the components of the name will be. diff --git a/windows/security/threat-protection/intelligence/phishing.md b/windows/security/threat-protection/intelligence/phishing.md index 1f997dac95..01c216b8fe 100644 --- a/windows/security/threat-protection/intelligence/phishing.md +++ b/windows/security/threat-protection/intelligence/phishing.md @@ -35,7 +35,7 @@ Here are several telltale signs of a phishing scam: * The links or URLs provided in emails are **not pointing to the correct location** or are pointing to a third-party site not affiliated with the sender of the email. For example, in the image below the URL provided doesn't match the URL that you'll be taken to. - ![example of how exploit kits work](./images/URLhover.png) + ![example of how exploit kits work.](./images/URLhover.png) * There's a **request for personal information** such as social security numbers or bank or financial information. Official communications won't generally request personal information from you in the form of an email. diff --git a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md index 00eafc82ce..ae7c0e8363 100644 --- a/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md +++ b/windows/security/threat-protection/intelligence/portal-submission-troubleshooting.md @@ -33,7 +33,7 @@ This process requires a global or application admin in the tenant. 2. Select **Grant admin consent for organization**. 3. If you're able to do so, review the API permissions required for this application, as the following image shows. Provide consent for the tenant. - ![grant consent image](images/msi-grant-admin-consent.jpg) + ![grant consent image.](images/msi-grant-admin-consent.jpg) 4. If the administrator receives an error while attempting to provide consent manually, try either [Option 1](#option-1-approve-enterprise-application-permissions-by-user-request) or [Option 2](#option-2-provide-admin-consent-by-authenticating-the-application-as-an-admin) as possible workarounds.   @@ -43,13 +43,13 @@ This process requires a global or application admin in the tenant. Azure Active Directory admins will need to allow for users to request admin consent to apps. Verify the setting is configured to **Yes** in [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/UserSettings/menuId/). -![Enterprise applications user settings](images/msi-enterprise-app-user-setting.jpg) +![Enterprise applications user settings.](images/msi-enterprise-app-user-setting.jpg) More information is available in [Configure Admin consent workflow](/azure/active-directory/manage-apps/configure-admin-consent-workflow). Once this setting is verified, users can go through the enterprise customer sign-in at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission), and submit a request for admin consent, including justification. -![Contoso sign in flow](images/msi-contoso-approval-required.png) +![Contoso sign in flow.](images/msi-contoso-approval-required.png) Admin will be able to review and approve the application permissions [Azure admin consent requests](https://portal.azure.com/#blade/Microsoft_AAD_IAM/StartboardApplicationsMenuBlade/AccessRequests/menuId/). @@ -58,7 +58,7 @@ After providing consent, all users in the tenant will be able to use the applica ## Option 2 Provide admin consent by authenticating the application as an admin This process requires that global admins go through the Enterprise customer sign-in flow at [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission). -![Consent sign in flow](images/msi-microsoft-permission-required.jpg) +![Consent sign in flow.](images/msi-microsoft-permission-required.jpg) Then, admins review the permissions and make sure to select **Consent on behalf of your organization**, and then select **Accept**. @@ -70,20 +70,20 @@ If neither of these options resolve the issue, try the following steps (as an ad 1. Remove previous configurations for the application. Go to [Enterprise applications](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Properties/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/982e94b2-fea9-4d1f-9fca-318cda92f90b) and select **delete**. - ![Delete app permissions](images/msi-properties.png) + ![Delete app permissions.](images/msi-properties.png) 2. Capture TenantID from [Properties](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ActiveDirectoryMenuBlade/Properties). 3. Replace {tenant-id} with the specific tenant that needs to grant consent to this application in the URL below. Copy this URL into browser. The rest of the parameters are already completed. ``https://login.microsoftonline.com/{tenant-id}/v2.0/adminconsent?client_id=f0cf43e5-8a9b-451c-b2d5-7285c785684d&state=12345&redirect_uri=https%3a%2f%2fwww.microsoft.com%2fwdsi%2ffilesubmission&scope=openid+profile+email+offline_access`` - ![Permissions needed](images/msi-microsoft-permission-requested-your-organization.png) + ![Permissions needed.](images/msi-microsoft-permission-requested-your-organization.png) 4. Review the permissions required by the application, and then select **Accept**. 5. Confirm the permissions are applied in the [Azure portal](https://portal.azure.com/#blade/Microsoft_AAD_IAM/ManagedAppMenuBlade/Permissions/appId/f0cf43e5-8a9b-451c-b2d5-7285c785684d/objectId/ce60a464-5fca-4819-8423-bcb46796b051). - ![Review that permissions are applied](images/msi-permissions.jpg) + ![Review that permissions are applied.](images/msi-permissions.jpg) 6. Sign in to [Microsoft security intelligence](https://www.microsoft.com/wdsi/filesubmission) as an enterprise user with a non-admin account to see if you have access. diff --git a/windows/security/threat-protection/intelligence/worms-malware.md b/windows/security/threat-protection/intelligence/worms-malware.md index ed4e5aaf84..2aa32ed8f6 100644 --- a/windows/security/threat-protection/intelligence/worms-malware.md +++ b/windows/security/threat-protection/intelligence/worms-malware.md @@ -39,7 +39,7 @@ Both Bondat and Gamarue have clever ways of obscuring themselves to evade detect This image shows how a worm can quickly spread through a shared USB drive. -![Worm example](./images/WormUSB-flight.png) +![Worm example.](./images/WormUSB-flight.png) ### *Figure worm spreading from a shared USB drive* diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index f0c6938382..83a6f5e00b 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -29,8 +29,8 @@ For a PowerShell alternative, see [Using WUA to Scan for Updates Offline with Po For example: -[![VBS script](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) -[![PowerShell script](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) +[![VBS script.](images/vbs-example.png)](/windows/desktop/wua_sdk/using-wua-to-scan-for-updates-offline) +[![PowerShell script.](images/powershell-example.png)](https://www.powershellgallery.com/packages/Scan-UpdatesOffline/1.0) The preceding scripts use the [WSUS offline scan file](https://support.microsoft.com/help/927745/detailed-information-for-developers-who-use-the-windows-update-offline) (wsusscn2.cab) to perform a scan and get the same information on missing updates as MBSA supplied. MBSA also relied on the wsusscn2.cab to determine which updates were missing from a given system without connecting to any online service or server. The wsusscn2.cab file is still available and there are currently no plans to remove or replace it. The wsusscn2.cab file contains the metadata of only security updates, update rollups and service packs available from Microsoft Update; it does not contain any information on non-security updates, tools or drivers. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md index 994ade09de..3b18ab25d3 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/install-md-app-guard.md @@ -45,7 +45,7 @@ Applies to: You and your security department can define your corporate boundaries by explicitly adding trusted domains and by customizing the Application Guard experience to meet and enforce your needs on employee devices. Enterprise-managed mode also automatically redirects any browser requests to add non-enterprise domain(s) in the container. The following diagram shows the flow between the host PC and the isolated container. -![Flowchart for movement between Microsoft Edge and Application Guard](images/application-guard-container-v-host.png) +![Flowchart for movement between Microsoft Edge and Application Guard.](images/application-guard-container-v-host.png) ## Install Application Guard @@ -55,7 +55,7 @@ Application Guard functionality is turned off by default. However, you can quick 1. Open the **Control Panel**, click **Programs,** and then click **Turn Windows features on or off**. - ![Windows Features, turning on Microsoft Defender Application Guard](images/turn-windows-features-on-off.png) + ![Windows Features, turning on Microsoft Defender Application Guard.](images/turn-windows-features-on-off.png) 2. Select the check box next to **Microsoft Defender Application Guard** and then click **OK**. @@ -86,7 +86,7 @@ Application Guard functionality is turned off by default. However, you can quick > [!IMPORTANT] > Make sure your organization's devices meet [requirements](reqs-md-app-guard.md) and are [enrolled in Intune](/mem/intune/enrollment/device-enrollment). -:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune"::: +:::image type="content" source="images/MDAG-EndpointMgr-newprofile.jpg" alt-text="Enroll devices in Intune."::: 1. Go to [https://endpoint.microsoft.com](https://endpoint.microsoft.com) and sign in. diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md index de798293db..4ad66674a9 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/md-app-guard-overview.md @@ -29,7 +29,7 @@ For Microsoft Edge, Application Guard helps to isolate enterprise-defined untrus For Microsoft Office, Application Guard helps prevents untrusted Word, PowerPoint and Excel files from accessing trusted resources. Application Guard opens untrusted files in an isolated Hyper-V-enabled container. The isolated Hyper-V container is separate from the host operating system. This container isolation means that if the untrusted site or file turns out to be malicious, the host device is protected, and the attacker can't get to your enterprise data. For example, this approach makes the isolated container anonymous, so an attacker can't get to your employee's enterprise credentials. -![Hardware isolation diagram](images/appguard-hardware-isolation.png) +![Hardware isolation diagram.](images/appguard-hardware-isolation.png) ### What types of devices should use Application Guard? diff --git a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md index 74525211f8..d8ff39f397 100644 --- a/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md +++ b/windows/security/threat-protection/microsoft-defender-application-guard/test-scenarios-md-app-guard.md @@ -33,7 +33,7 @@ You can see how an employee would use standalone mode with Application Guard. 2. Restart the device, start Microsoft Edge, and then select **New Application Guard window** from the menu. - ![New Application Guard window setting option](images/appguard-new-window.png) + ![New Application Guard window setting option.](images/appguard-new-window.png) 3. Wait for Application Guard to set up the isolated environment. @@ -42,7 +42,7 @@ You can see how an employee would use standalone mode with Application Guard. 4. Go to an untrusted, but safe URL (for this example, we used msn.com) and view the new Microsoft Edge window, making sure you see the Application Guard visual cues. - ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) + ![Untrusted website running in Application Guard.](images/appguard-visual-cues.png) ## Application Guard in Enterprise-managed mode @@ -64,19 +64,19 @@ Before you can use Application Guard in managed mode, you must install Windows 1 c. For the purposes of this scenario, type `.microsoft.com` into the **Enterprise cloud resources** box. - ![Group Policy editor with Enterprise cloud resources setting](images/appguard-gp-network-isolation.png) + ![Group Policy editor with Enterprise cloud resources setting.](images/appguard-gp-network-isolation.png) d. Go to the **Administrative Templates\Network\Network Isolation\Domains categorized as both work and personal** setting. e. For the purposes of this scenario, type `bing.com` into the **Neutral resources** box. - ![Group Policy editor with Neutral resources setting](images/appguard-gp-network-isolation-neutral.png) + ![Group Policy editor with Neutral resources setting.](images/appguard-gp-network-isolation-neutral.png) 4. Go to the **Computer Configuration\Administrative Templates\Windows Components\Microsoft Defender Application Guard\Turn on Microsoft Defender Application Guard in Managed Mode** setting. 5. Click **Enabled**, choose Option **1**, and click **OK**. - ![Group Policy editor with Turn On/Off setting](images/appguard-gp-turn-on.png) + ![Group Policy editor with Turn On/Off setting.](images/appguard-gp-turn-on.png) >[!NOTE] >Enabling this setting verifies that all the necessary settings are properly configured on your employee devices, including the network isolation settings set earlier in this scenario. @@ -85,13 +85,13 @@ Before you can use Application Guard in managed mode, you must install Windows 1 After you submit the URL, Application Guard determines the URL is trusted because it uses the domain you've marked as trusted and shows the site directly on the host PC instead of in Application Guard. - ![Trusted website running on Microsoft Edge](images/appguard-turned-on-with-trusted-site.png) + ![Trusted website running on Microsoft Edge.](images/appguard-turned-on-with-trusted-site.png) 7. In the same Microsoft Edge browser, type any URL that isn't part of your trusted or neutral site lists. After you submit the URL, Application Guard determines the URL is untrusted and redirects the request to the hardware-isolated environment. - ![Untrusted website running in Application Guard](images/appguard-visual-cues.png) + ![Untrusted website running in Application Guard.](images/appguard-visual-cues.png) ### Customize Application Guard @@ -118,7 +118,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor clipboard options](images/appguard-gp-clipboard.png) + ![Group Policy editor clipboard options.](images/appguard-gp-clipboard.png) 3. Choose how the clipboard works: @@ -144,7 +144,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Print options](images/appguard-gp-print.png) + ![Group Policy editor Print options.](images/appguard-gp-print.png) 3. Based on the list provided in the setting, choose the number that best represents what type of printing should be available to your employees. You can allow any combination of local, network, PDF, and XPS printing. @@ -156,7 +156,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Data Persistence options](images/appguard-gp-persistence.png) + ![Group Policy editor Data Persistence options.](images/appguard-gp-persistence.png) 3. Open Microsoft Edge and browse to an untrusted, but safe URL. @@ -186,7 +186,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Download options](images/appguard-gp-download.png) + ![Group Policy editor Download options.](images/appguard-gp-download.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -200,7 +200,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor hardware acceleration options](images/appguard-gp-vgpu.png) + ![Group Policy editor hardware acceleration options.](images/appguard-gp-vgpu.png) 3. Once you have enabled this feature, open Microsoft Edge and browse to an untrusted, but safe URL with video, 3D, or other graphics-intensive content. The website opens in an isolated session. @@ -217,7 +217,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled**, set **Options** to 2, and click **OK**. - ![Group Policy editor File trust options](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) + ![Group Policy editor File trust options.](images/appguard-gp-allow-users-to-trust-files-that-open-in-appguard.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -231,7 +231,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled** and click **OK**. - ![Group Policy editor Camera and microphone options](images/appguard-gp-allow-camera-and-mic.png) + ![Group Policy editor Camera and microphone options.](images/appguard-gp-allow-camera-and-mic.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -245,7 +245,7 @@ You have the option to change each of these settings to work with your enterpris 2. Click **Enabled**, copy the thumbprint of each certificate to share, separated by a comma, and click **OK**. - ![Group Policy editor Root certificate options](images/appguard-gp-allow-root-certificates.png) + ![Group Policy editor Root certificate options.](images/appguard-gp-allow-root-certificates.png) 3. Log out and back on to your device, opening Microsoft Edge in Application Guard again. @@ -258,10 +258,10 @@ Once a user has the extension and its companion app installed on their enterpris 1. Open either Firefox or Chrome — whichever browser you have the extension installed on. 2. Navigate to an enterprise website, i.e. an internal website maintained by your organization. You might see this evaluation page for an instant before the site is fully loaded. - ![The evaluation page displayed while the page is being loaded, explaining that the user must wait](images/app-guard-chrome-extension-evaluation-page.png) + ![The evaluation page displayed while the page is being loaded, explaining that the user must wait.](images/app-guard-chrome-extension-evaluation-page.png) 3. Navigate to a non-enterprise, external website site, such as [www.bing.com](https://www.bing.com). The site should be redirected to Microsoft Defender Application Guard Edge. - ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge](images/app-guard-chrome-extension-launchIng-edge.png) + ![A non-enterprise website being redirected to an Application Guard container -- the text displayed explains that the page is being opened in Application Guard for Microsoft Edge.](images/app-guard-chrome-extension-launchIng-edge.png) 4. Open a new Application Guard window, by select the Microsoft Defender Application Guard icon, then **New Application Guard Window** ![The "New Application Guard Window" option is highlighted in red](images/app-guard-chrome-extension-new-app-guard-page.png) \ No newline at end of file diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md index 80486846fb..146b20c787 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-overview.md @@ -61,7 +61,7 @@ If you believe a warning or block was incorrectly shown for a file or applicatio When submitting Microsoft Defender SmartScreen products, make sure to select **Microsoft Defender SmartScreen** from the product menu. -![Windows Security, Microsoft Defender SmartScreen controls](images/Microsoft-defender-smartscreen-submission.png) +![Windows Security, Microsoft Defender SmartScreen controls.](images/Microsoft-defender-smartscreen-submission.png) ## Viewing Microsoft Defender SmartScreen anti-phishing events diff --git a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md index 85c404a314..89c036958f 100644 --- a/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md +++ b/windows/security/threat-protection/microsoft-defender-smartscreen/microsoft-defender-smartscreen-set-individual-device.md @@ -60,7 +60,7 @@ Starting with Windows 10, version 1703, users can use Windows Security to set up - **Off.** Turns off Microsoft Defender SmartScreen, so a user isn't alerted or stopped from visiting sites or from downloading potentially malicious apps and files. - ![Windows Security, Microsoft Defender SmartScreen controls](images/windows-defender-smartscreen-control-2020.png) + ![Windows Security, Microsoft Defender SmartScreen controls.](images/windows-defender-smartscreen-control-2020.png) ## How Microsoft Defender SmartScreen works when a user tries to run an app Microsoft Defender SmartScreen checks the reputation of any web-based app the first time it's run from the Internet, checking digital signatures and other factors against a Microsoft-maintained service. If an app has no reputation or is known to be malicious, Microsoft Defender SmartScreen can warn the user or block the app from running entirely, depending on how you've configured the feature to run in your organization. diff --git a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md index c792222c8a..c2a1d31b98 100644 --- a/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md +++ b/windows/security/threat-protection/override-mitigation-options-for-app-related-security-policies.md @@ -41,7 +41,7 @@ The following procedure describes how to use Group Policy to override individual 1. Open your Group Policy editor and go to the **Administrative Templates\System\Mitigation Options\Process Mitigation Options** setting. - ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active](images/gp-process-mitigation-options.png) + ![Group Policy editor: Process Mitigation Options with setting enabled and Show button active.](images/gp-process-mitigation-options.png) 2. Click **Enabled**, and then in the **Options** area, click **Show** to open the **Show Contents** box, where you’ll be able to add your apps and the appropriate bit flag values, as shown in the [Setting the bit field](#setting-the-bit-field) and [Example](#example) sections of this topic. @@ -52,12 +52,12 @@ The following procedure describes how to use Group Policy to override individual **Note**
Setting bit flags in positions not specified here to anything other than ? might cause undefined behavior. - ![Group Policy editor: Process Mitigation Options with Show Contents box and example text](images/gp-process-mitigation-options-show.png) + ![Group Policy editor: Process Mitigation Options with Show Contents box and example text.](images/gp-process-mitigation-options-show.png) ## Setting the bit field Here’s a visual representation of the bit flag locations for the various Process Mitigation Options settings: -![Visual representation of the bit flag locations for the Process Mitigation Options settings](images/gp-process-mitigation-options-bit-flag-image.png) +![Visual representation of the bit flag locations for the Process Mitigation Options settings.](images/gp-process-mitigation-options-bit-flag-image.png) Where the bit flags are read from right to left and are defined as: diff --git a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md index f98634584d..0a9058b91d 100644 --- a/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md +++ b/windows/security/threat-protection/overview-of-threat-mitigations-in-windows-10.md @@ -130,7 +130,7 @@ You can now see which processes have DEP enabled. -![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png) +![Processes with DEP enabled in Windows 10.](images/security-fig5-dep.png) *Figure 2.  Processes on which DEP has been enabled in Windows 10* @@ -168,7 +168,7 @@ One of the most common techniques used to gain access to a system is to find a v Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 3 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. -![ASLR at work](images/security-fig4-aslr.png) +![ASLR at work.](images/security-fig4-aslr.png) **Figure 3.  ASLR at work** diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 220c774696..e24bb48367 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -56,13 +56,13 @@ Because mobile devices are increasingly being used to access corporate informati Devices that are used to access corporate resources must be trusted. An efficient end-to-end security approach is able to evaluate device health and use the current security state when granting access to a high-value asset. -:::image type="content" alt-text="figure 1" source="images/hva-fig1-endtoend1.png"::: +:::image type="content" alt-text="figure 1." source="images/hva-fig1-endtoend1.png"::: A robust design needs to establish the user’s identity, strengthen the authentication method if needed, and learn behavior like the network location the user regularly connects from. Also, a modern approach must be able to release sensitive content only if user devices are determined to be healthy and secure. The following figure shows a solution built to assess device health from the cloud. The device authenticates the user through a connection to an identity provider in the cloud. If the managed asset contains highly confidential information, the conditional access engine of the identity provider may elect to verify the security compliance of the mobile device before access is granted. The user’s device is able to prove its health status that can be sent at any time or when mobile device management (MDM) requests it. -:::image type="content" alt-text="figure 2" source="images/hva-fig2-assessfromcloud2.png"::: +:::image type="content" alt-text="figure 2." source="images/hva-fig2-assessfromcloud2.png"::: Windows devices can be protected from low-level rootkits and bootkits by using low-level hardware technologies such as Unified Extensible Firmware Interface (UEFI) Secure Boot. @@ -94,7 +94,7 @@ In Windows 10, there are three pillars of investments: This section is an overview that describes different parts of the end-to-end security solution that helps protect high-value assets and information from attackers and malware. -:::image type="content" alt-text="figure 3" source="images/hva-fig3-endtoendoverview3.png"::: +:::image type="content" alt-text="figure 3." source="images/hva-fig3-endtoendoverview3.png"::: | Number | Part of the solution | Description | | - | - | - | @@ -115,7 +115,7 @@ This section describes what Windows 10 offers in terms of security defenses and The most aggressive forms of malware try to insert themselves into the boot process as early as possible so that they can take control of the operating system early and prevent protection mechanisms and antimalware software from working. This type of malicious code is often called a rootkit or bootkit. The best way to avoid having to deal with low-level malware is to secure the boot process so that the device is protected from the very start. Windows 10 supports multiple layers of boot protection. Some of these features are available only if specific types of hardware are installed. For more information, see the [Hardware requirements](#hardware-req) section. -:::image type="content" alt-text="figure 4" source="images/hva-fig4-hardware.png"::: +:::image type="content" alt-text="figure 4." source="images/hva-fig4-hardware.png"::: Windows 10 supports features to help prevent sophisticated low-level malware like rootkits and bootkits from loading during the startup process: @@ -230,7 +230,7 @@ The following Windows 10 services are protected with virtualization-based securi The schema below is a high-level view of Windows 10 with virtualization-based security. -:::image type="content" alt-text="figure 5" source="images/hva-fig5-virtualbasedsecurity.png"::: +:::image type="content" alt-text="figure 5." source="images/hva-fig5-virtualbasedsecurity.png"::: ### Credential Guard @@ -425,11 +425,11 @@ The antimalware software can search to determine whether the boot sequence conta Health attestation logs the measurements in various TPM Platform Configuration Registers (PCRs) and TCG logs during the boot process. -:::image type="content" alt-text="figure 6" source="images/hva-fig6-logs.png"::: +:::image type="content" alt-text="figure 6." source="images/hva-fig6-logs.png"::: When starting a device equipped with TPM, a measurement of different components is performed. This includes firmware, UEFI drivers, CPU microcode, and also all the Windows 10 drivers whose type is Boot Start. The raw measurements are stored in the TPM PCR registers while the details of all events (executable path, authority certification, and so on) are available in the TCG log. -:::image type="content" alt-text="figure 7" source="images/hva-fig7-measurement.png"::: +:::image type="content" alt-text="figure 7." source="images/hva-fig7-measurement.png"::: The health attestation process works as follows: @@ -459,7 +459,7 @@ The following process describes how health boot measurements are sent to the hea 4. The client stores the health encrypted blob in its local store. The device health token contains device health status, a device ID (the Windows AIK), and the boot counter. -:::image type="content" alt-text="figure 8" source="images/hva-fig8a-healthattest8a.png"::: +:::image type="content" alt-text="figure 8." source="images/hva-fig8a-healthattest8a.png"::: ### Device health attestation components @@ -632,7 +632,7 @@ A solution that leverages MDM and the Health Attestation Service consists of thr 2. After this is enabled, and every boot thereafter, the device will send health measurements to the Health Attestation Service hosted by Microsoft, and it will receive a health attestation blob in return. 3. At any point after this, an MDM server can request the health attestation blob from the device and ask Health Attestation Service to decrypt the content and validate that it’s been attested. - :::image type="content" alt-text="figure 9" source="images/hva-fig8-evaldevicehealth8.png"::: + :::image type="content" alt-text="figure 9." source="images/hva-fig8-evaldevicehealth8.png"::: Interaction between a Windows 10-based device, the Health Attestation Service, and MDM can be performed as follows: @@ -671,7 +671,7 @@ The remote device health attestation process uses measured boot data to verify t The figure below shows how the Health Attestation Service is expected to work with Microsoft’s cloud-based Intune MDM service. -:::image type="content" alt-text="figure 10" source="images/hva-fig9-intune.png"::: +:::image type="content" alt-text="figure 10." source="images/hva-fig9-intune.png"::: An MDM solution can then leverage health state statements and take them to the next level by coupling with client policies that will enable conditional access to be granted based on the device’s ability to prove that it’s malware free, its antimalware system is functional and up to date, the firewall is running, and the devices patch state is compliant. @@ -705,7 +705,7 @@ If the device is not registered, the user will get a message with instructions o **Azure AD** authenticates the user and the device, **MDM** manages the compliance and conditional access policies, and the **Health Attestation Service** reports about the health of the device in an attested way. -:::image type="content" alt-text="figure 11" source="images/hva-fig10-conditionalaccesscontrol.png"::: +:::image type="content" alt-text="figure 11." source="images/hva-fig10-conditionalaccesscontrol.png"::: ### Office 365 conditional access control @@ -725,7 +725,7 @@ The user will be denied access to services when sign-in credentials are changed, Depending on the type of email application that employees use to access Exchange online, the path to establish secured access to email can be slightly different. However, the key components: Azure AD, Office 365/Exchange Online, and Intune, are the same. The IT experience and end-user experience also are similar. -:::image type="content" alt-text="figure 12" source="images/hva-fig11-office365.png"::: +:::image type="content" alt-text="figure 12." source="images/hva-fig11-office365.png"::: Clients that attempt to access Office 365 will be evaluated for the following properties: @@ -758,7 +758,7 @@ For on-premises applications there are two options to enable conditional access - For on-premises applications that are published through the Azure AD Application Proxy, you can configure conditional access control policies as you would for cloud applications. For more details, see the [Azure AD Conditional Access preview updated: Now supports On-Premises and Custom LOB apps](https://go.microsoft.com/fwlink/p/?LinkId=691618) blog post. - Additionally, Azure AD Connect will sync device compliance information from Azure AD to on-premises AD. ADFS on Windows Server 2016 will support conditional access control based on a device's compliance state. IT pros will configure conditional access control policies in ADFS that use the device's compliance state reported by a compatible MDM solution to secure on-premises applications. -:::image type="content" alt-text="figure 13" source="images/hva-fig12-conditionalaccess12.png"::: +:::image type="content" alt-text="figure 13." source="images/hva-fig12-conditionalaccess12.png"::: The following process describes how Azure AD conditional access works: diff --git a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md index eb88a41772..ce251bc758 100644 --- a/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md +++ b/windows/security/threat-protection/security-policy-settings/interactive-logon-display-user-information-when-the-session-is-locked.md @@ -36,7 +36,7 @@ Beginning with Windows 10 version 1607, new functionality was added to Windows 1 This functionality is controlled by a new **Privacy** setting in **Settings** > **Accounts** > **Sign-in options**. The Privacy setting is off by default, which hides the details. -![Privacy setting](images/privacy-setting-in-sign-in-options.png) +![Privacy setting.](images/privacy-setting-in-sign-in-options.png) The **Interactive logon: Display user information when the session is locked** Group Policy setting controls the same functionality. diff --git a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md index 426d291c10..7a58b942a4 100644 --- a/windows/security/threat-protection/security-policy-settings/security-policy-settings.md +++ b/windows/security/threat-protection/security-policy-settings/security-policy-settings.md @@ -157,7 +157,7 @@ The following diagram shows Security Settings and related features. #### Security Settings Policies and Related Features -![components related to security policies](images/secpol-components.gif) +![components related to security policies.](images/secpol-components.gif) - **Scesrv.dll** @@ -181,7 +181,7 @@ The Security Settings extension of the Local Group Policy Editor is part of the **Security Settings Architecture** -![architecture of security policy settings](images/secpol-architecture.gif) +![architecture of security policy settings.](images/secpol-architecture.gif) The security settings configuration and analysis tools include a security configuration engine, which provides local computer (non-domain member) and Group Policy−based configuration and analysis of security settings policies. The security configuration engine also supports the creation of security policy files. The primary features of the security configuration engine are scecli.dll and scesrv.dll. @@ -321,7 +321,7 @@ In the context of Group Policy processing, security settings policy is processed **Multiple GPOs and Merging of Security Policy** - ![multiple gpos and merging of security policy](images/secpol-multigpomerge.gif) + ![multiple gpos and merging of security policy.](images/secpol-multigpomerge.gif) 1. The resultant security policies are stored in secedit.sdb, the security settings database. The security engine gets the security template files and imports them to secedit.sdb. 1. The security settings policies are applied to devices. @@ -329,7 +329,7 @@ The following figure illustrates the security settings policy processing. **Security Settings Policy Processing** -![process and interactions of security policy settings](images/secpol-processes.gif) +![process and interactions of security policy settings.](images/secpol-processes.gif) ### Merging of security policies on domain controllers diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 277bc347d1..a8362c5bda 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -380,9 +380,9 @@ This can easily be extended to other Auto-Execution Start Points keys in the reg Use the following figures to see how you can configure those registry keys. -![default acl for run key](images/runkey.png) +![default acl for run key.](images/runkey.png) -![default acl for runonce key](images/runoncekey.png) +![default acl for runonce key.](images/runoncekey.png) ## Appendix C - Event channel settings (enable and channel access) methods @@ -399,7 +399,7 @@ The following GPO snippet performs the following: - Enables the **Microsoft-Windows-DriverFrameworks-UserMode/Operational** event channel. - Sets the maximum file size for **Microsoft-Windows-DriverFrameworks-UserMode/Operational** to 50MB. -![configure event channels](images/capi-gpo.png) +![configure event channels.](images/capi-gpo.png) ## Appendix D - Minimum GPO for WEF Client configuration @@ -409,7 +409,7 @@ Here are the minimum steps for WEF to operate: 2. Start the WinRM service. 3. Add the Network Service account to the built-in Event Log Readers security group. This allows reading from secured event channel, such as the security event channel. -![configure the wef client](images/wef-client-config.png) +![configure the wef client.](images/wef-client-config.png) ## Appendix E – Annotated baseline subscription event query diff --git a/windows/security/threat-protection/windows-10-mobile-security-guide.md b/windows/security/threat-protection/windows-10-mobile-security-guide.md index 9b1eb730a6..11b4c1a58b 100644 --- a/windows/security/threat-protection/windows-10-mobile-security-guide.md +++ b/windows/security/threat-protection/windows-10-mobile-security-guide.md @@ -299,7 +299,7 @@ One of the most common techniques used by attackers to gain access to a system i Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. The below diagram illustrates how ASLR works, showing how the locations of different critical Windows components can change in memory between restarts. -![figure 3](images/mobile-security-guide-figure3.png) +![figure 3.](images/mobile-security-guide-figure3.png) Microsoft has substantively improved the ASLR implementation in Windows 10 Mobile over previous versions, applying it across the entire system rather than only in specific apps. With 64bit system and application processes that can take advantage of a vastly increased memory space, it is even more difficult for malware to predict where Windows 10 Mobile stores vital data. When used on systems that have TPMs, ASLR memory randomization becomes increasingly unique across devices, adding additional degrees of difficulty for repurposing successful exploits to another system. diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index ab40f94622..582297f71b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -37,7 +37,7 @@ Refer to the below video for an overview and brief demo. > [!VIDEO https://www.microsoft.com/videoplayer/embed/RE4mlcp] ## Policy Authorization Process -![Policy Authorization](images/wdac-intune-policy-authorization.png) +![Policy Authorization.](images/wdac-intune-policy-authorization.png) The general steps for expanding the S mode base policy on your Intune-managed devices are to generate a supplemental policy, sign that policy, and then upload the signed policy to Intune and assign it to user or device groups. Because you need access to WDAC PowerShell cmdlets to generate your supplemental policy, you should create and manage your policies on a non-S mode device. Once the policy has been uploaded to Intune, we recommend assigning it to a single test S-mode device to verify expected functioning before deploying the policy more broadly. 1. Generate a supplemental policy with WDAC tooling @@ -89,11 +89,11 @@ The general steps for expanding the S mode base policy on your Intune-managed de > When updating your supplemental policy, ensure that the new version number is strictly greater than the previous one. Using the same version number is not allowed by Intune. Refer to [Set-CIPolicyVersion](/powershell/module/configci/set-cipolicyversion?view=win10-ps&preserve-view=true) for information on setting the version number. ## Standard Process for Deploying Apps through Intune -![Deploying Apps through Intune](images/wdac-intune-app-deployment.png) +![Deploying Apps through Intune.](images/wdac-intune-app-deployment.png) Refer to [Intune Standalone - Win32 app management](/intune/apps-win32-app-management) for guidance on the existing procedure of packaging signed catalogs and app deployment. ## Optional: Process for Deploying Apps using Catalogs -![Deploying Apps using Catalogs](images/wdac-intune-app-catalogs.png) +![Deploying Apps using Catalogs.](images/wdac-intune-app-catalogs.png) Your supplemental policy can be used to significantly relax the S mode base policy, but there are security trade-offs you must consider in doing so. For example, you can use a signer rule to trust an external signer, but that will authorize all apps signed by that certificate, which may include apps you don't want to allow as well. Instead of authorizing signers external to your organization, Intune has added new functionality to make it easier to authorize existing applications (without requiring repackaging or access to the source code) through the use of signed catalogs. This works for apps which may be unsigned or even signed apps when you don't want to trust all apps that may share the same signing certificate. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md index f197b8f4b2..af49d0b081 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/plan-for-applocker-policy-management.md @@ -61,7 +61,7 @@ AppLocker can be configured to display the default message but with a custom URL The following image shows an example of the error message for a blocked app. You can use the **Set a support web link** policy setting to customize the **More information** link. -![applocker blocked application error message](images/blockedappmsg.gif) +![applocker blocked application error message.](images/blockedappmsg.gif) For steps to display a custom URL for the message, see [Display a custom URL message when users try to run a blocked app](display-a-custom-url-message-when-users-try-to-run-a-blocked-application.md). diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md index 5350f5c843..9ffaf2b82c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-applocker-rules-and-enforcement-setting-inheritance-in-group-policy.md @@ -44,7 +44,7 @@ Because a computer's effective policy includes rules from each linked GPO, dupli The following figure demonstrates how AppLocker rule enforcement is applied through linked GPOs. -![applocker rule enforcement inheritance chart](images/applocker-plan-inheritance.gif) +![applocker rule enforcement inheritance chart.](images/applocker-plan-inheritance.gif) In the preceding illustration, note that all GPOs linked to Contoso are applied in order as configured. The rules that are not configured are also applied. For example, the result of the Contoso and Human Resources GPOs is 33 rules enforced, as shown in the client HR-Term1. The Human Resources GPO contains 10 non-configured rules. When the rule collection is configured for **Audit only**, no rules are enforced. diff --git a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md index 0f909bdf3d..a51539d046 100644 --- a/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md +++ b/windows/security/threat-protection/windows-defender-application-control/applocker/understand-the-applocker-policy-deployment-process.md @@ -30,7 +30,7 @@ To successfully deploy AppLocker policies, you need to identify your application The following diagram shows the main points in the design, planning, and deployment process for AppLocker. -![applocker quick reference guide](images/applocker-plandeploy-quickreference.gif) +![applocker quick reference guide.](images/applocker-plandeploy-quickreference.gif) ## Resources to support the deployment process diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md index bc1218b82c..671bd29bf1 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-and-enforce-windows-defender-application-control-policies.md @@ -46,7 +46,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these **Figure 1. Exceptions to the deployed WDAC policy**
- ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) + ![Event showing exception to WDAC policy.](images/dg-fig23-exceptionstocode.png) 3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. diff --git a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md index cb94565bff..706f2e6d6a 100644 --- a/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/audit-windows-defender-application-control-policies.md @@ -45,7 +45,7 @@ To familiarize yourself with creating WDAC rules from audit events, follow these 2. Review the **CodeIntegrity - Operational** and **AppLocker - MSI and Script** event logs to confirm events, like those shown in Figure 1, are generated related to the application. For information about the types of events you should see, refer to [Understanding Application Control events](event-id-explanations.md). **Figure 1. Exceptions to the deployed WDAC policy** - ![Event showing exception to WDAC policy](images/dg-fig23-exceptionstocode.png) + ![Event showing exception to WDAC policy.](images/dg-fig23-exceptionstocode.png) 3. In an elevated PowerShell session, run the following commands to initialize variables used by this procedure. This procedure builds upon the **Lamna_FullyManagedClients_Audit.xml** policy introduced in [Create a WDAC policy for fully managed devices](create-wdac-policy-for-fully-managed-devices.md) and will produce a new policy called **EventsPolicy.xml**. diff --git a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md index b9ca84a296..761ea31822 100644 --- a/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/create-code-signing-cert-for-windows-defender-application-control.md @@ -39,7 +39,7 @@ ECDSA is not supported. 2. When connected, right-click **Certificate Templates**, and then click **Manage** to open the Certification Templates Console. - ![CA snap-in showing Certificate Templates](images/dg-fig27-managecerttemp.png) + ![CA snap-in showing Certificate Templates.](images/dg-fig27-managecerttemp.png) Figure 1. Manage the certificate templates @@ -55,7 +55,7 @@ ECDSA is not supported. 8. In the **Edit Basic Constraints Extension** dialog box, select **Enable this extension**, as shown in Figure 2. - ![Edit Basic Constraints Extension](images/dg-fig29-enableconstraints.png) + ![Edit Basic Constraints Extension.](images/dg-fig29-enableconstraints.png) Figure 2. Select constraints on the new template @@ -71,7 +71,7 @@ When this certificate template has been created, you must publish it to the CA p 1. In the Certification Authority MMC snap-in, right-click **Certification Templates**, point to **New**, and then click **Certificate Template to Issue**, as shown in Figure 3. - ![Select Certificate Template to Issue](images/dg-fig30-selectnewcert.png) + ![Select Certificate Template to Issue.](images/dg-fig30-selectnewcert.png) Figure 3. Select the new certificate template to issue @@ -89,7 +89,7 @@ Now that the template is available to be issued, you must request one from the c 4. In the **Request Certificate** list, select your newly created code signing certificate, and then select the blue text that requests additional information, as shown in Figure 4. - ![Request Certificates: more information required](images/dg-fig31-getmoreinfo.png) + ![Request Certificates: more information required.](images/dg-fig31-getmoreinfo.png) Figure 4. Get more information for your code signing certificate diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md index 52cac752d2..bdb0bb25f6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-catalog-files-to-support-windows-defender-application-control.md @@ -142,7 +142,7 @@ To sign the existing catalog file, copy each of the following commands into an e 4. Verify the catalog file digital signature. Right-click the catalog file, and then click **Properties**. On the **Digital Signatures** tab, verify that your signing certificate exists with a **sha256** algorithm, as shown in Figure 1. - ![Digital Signature list in file Properties](images/dg-fig12-verifysigning.png) + ![Digital Signature list in file Properties.](images/dg-fig12-verifysigning.png) Figure 1. Verify that the signing certificate exists @@ -182,7 +182,7 @@ To simplify the management of catalog files, you can use Group Policy preference > [!NOTE] > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate). - ![Group Policy Management, create a GPO](images/dg-fig13-createnewgpo.png) + ![Group Policy Management, create a GPO.](images/dg-fig13-createnewgpo.png) Figure 2. Create a new GPO @@ -192,7 +192,7 @@ To simplify the management of catalog files, you can use Group Policy preference 5. Within the selected GPO, navigate to Computer Configuration\\Preferences\\Windows Settings\\Files. Right-click **Files**, point to **New**, and then click **File**, as shown in Figure 3. - ![Group Policy Management Editor, New File](images/dg-fig14-createnewfile.png) + ![Group Policy Management Editor, New File.](images/dg-fig14-createnewfile.png) Figure 3. Create a new file @@ -202,7 +202,7 @@ To simplify the management of catalog files, you can use Group Policy preference 7. To keep versions consistent, in the **New File Properties** dialog box (Figure 4), select **Replace** from the **Action** list so that the newest version is always used. - ![File Properties, Replace option](images/dg-fig15-setnewfileprops.png) + ![File Properties, Replace option.](images/dg-fig15-setnewfileprops.png) Figure 4. Set the new file properties @@ -235,7 +235,7 @@ As an alternative to Group Policy, you can use Configuration Manager to deploy c 3. Name the package, set your organization as the manufacturer, and select an appropriate version number. - ![Create Package and Program Wizard](images/dg-fig16-specifyinfo.png) + ![Create Package and Program Wizard.](images/dg-fig16-specifyinfo.png) Figure 5. Specify information about the new package @@ -257,7 +257,7 @@ As an alternative to Group Policy, you can use Configuration Manager to deploy c - From the **Drive mode** list, select **Runs with UNC name**. - ![Standard Program page of wizard](images/dg-fig17-specifyinfo.png) + ![Standard Program page of wizard.](images/dg-fig17-specifyinfo.png) Figure 6. Specify information about the standard program @@ -285,7 +285,7 @@ After you create the deployment package, deploy it to a collection so that the c - Select the **Commit changes at deadline or during a maintenance window (requires restarts)** check box. - ![Deploy Software Wizard, User Experience page](images/dg-fig18-specifyux.png) + ![Deploy Software Wizard, User Experience page.](images/dg-fig18-specifyux.png) Figure 7. Specify the user experience @@ -310,13 +310,13 @@ When catalog files have been deployed to the computers within your environment, 3. Name the new policy, and under **Select and then configure the custom settings for client devices**, select the **Software Inventory** check box, as shown in Figure 8. - ![Create Custom Client Device Settings](images/dg-fig19-customsettings.png) + ![Create Custom Client Device Settings.](images/dg-fig19-customsettings.png) Figure 8. Select custom settings 4. In the navigation pane, click **Software Inventory**, and then click **Set Types**, as shown in Figure 9. - ![Software Inventory settings for devices](images/dg-fig20-setsoftwareinv.png) + ![Software Inventory settings for devices.](images/dg-fig20-setsoftwareinv.png) Figure 9. Set the software inventory @@ -329,7 +329,7 @@ When catalog files have been deployed to the computers within your environment, 7. In the **Path Properties** dialog box, select **Variable or path name**, and then type **C:\\Windows\\System32\\catroot\\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}** in the box, as shown in Figure 10. - ![Path Properties, specifying a path](images/dg-fig21-pathproperties.png) + ![Path Properties, specifying a path.](images/dg-fig21-pathproperties.png) Figure 10. Set the path properties diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md index d20e96958f..dea3b62b33 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-group-policy.md @@ -43,7 +43,7 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > You can use any OU name. Also, security group filtering is an option when you consider different ways of combining WDAC policies (or keeping them separate), as discussed in [Plan for Windows Defender Application Control policy management](plan-windows-defender-application-control-management.md). - ![Group Policy Management, create a GPO](images/dg-fig24-creategpo.png) + ![Group Policy Management, create a GPO.](images/dg-fig24-creategpo.png) 3. Name the new GPO. You can choose any name. @@ -51,7 +51,7 @@ To deploy and manage a WDAC policy with Group Policy: 5. In the selected GPO, navigate to Computer Configuration\\Administrative Templates\\System\\Device Guard. Right-click **Deploy Windows Defender Application Control** and then click **Edit**. - ![Edit the Group Policy for Windows Defender Application Control](images/wdac-edit-gp.png) + ![Edit the Group Policy for Windows Defender Application Control.](images/wdac-edit-gp.png) 6. In the **Deploy Windows Defender Application Control** dialog box, select the **Enabled** option, and then specify the WDAC policy deployment path. @@ -60,7 +60,7 @@ To deploy and manage a WDAC policy with Group Policy: > [!NOTE] > This policy file does not need to be copied to every computer. You can instead copy the WDAC policies to a file share to which all computer accounts have access. Any policy selected here is converted to SIPolicy.p7b when it is deployed to the individual client computers. - ![Group Policy called Deploy Windows Defender Application Control](images/dg-fig26-enablecode.png) + ![Group Policy called Deploy Windows Defender Application Control.](images/dg-fig26-enablecode.png) > [!NOTE] > You may have noticed that the GPO setting references a .p7b file and this example uses a .bin file for the policy. Regardless of the type of policy you deploy (.bin, .p7b, or .p7), they are all converted to SIPolicy.p7b when dropped on the client computer running Windows 10. Give your WDAC policies friendly names and allow the system to convert the policy names for you to ensure that the policies are easily distinguishable when viewed in a share or any other central repository. diff --git a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md index 250600e081..29fbbe9431 100644 --- a/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md +++ b/windows/security/threat-protection/windows-defender-application-control/deploy-windows-defender-application-control-policies-using-intune.md @@ -71,7 +71,7 @@ The steps to use Intune's custom OMA-URI functionality are: - **Certificate file**: upload your binary format policy file. You do not need to upload a Base64 file, as Intune will convert the uploaded .bin file to Base64 on your behalf. > [!div class="mx-imgBorder"] - > ![Configure custom WDAC](images/wdac-intune-custom-oma-uri.png) + > ![Configure custom WDAC.](images/wdac-intune-custom-oma-uri.png) > [!NOTE] > For the _Policy GUID_ value, do not include the curly brackets. diff --git a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md index 848bfe1e62..0c319af7e6 100644 --- a/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md +++ b/windows/security/threat-protection/windows-defender-application-control/plan-windows-defender-application-control-management.md @@ -45,7 +45,7 @@ Most WDAC policies will evolve over time and proceed through a set of identifiab 6. Deploy the enforced mode policy to intended devices. We recommend using staged rollouts for enforced policies to detect and respond to issues before deploying the policy broadly. 7. Repeat steps 1-6 anytime the desired "circle-of-trust" changes. -![Recommended WDAC policy deployment process](images/policyflow.png) +![Recommended WDAC policy deployment process.](images/policyflow.png) ### Keep WDAC policies in a source control or document management solution diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md index 2c5382e43b..4915d3faea 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-base-policy.md @@ -43,7 +43,7 @@ Each of the template policies has a unique set of policy allow list rules that w More information about the Default Windows Mode and Allow Microsoft Mode policies can be accessed through the [Example WDAC base policies article](example-wdac-base-policies.md). -![Selecting a base template for the policy](images/wdac-wizard-template-selection.png) +![Selecting a base template for the policy.](images/wdac-wizard-template-selection.png) Once the base template is selected, give the policy a name and choose where to save the application control policy on disk. @@ -69,7 +69,7 @@ A description of each policy rule, beginning with the left-most column, is provi | **User Mode Code Integrity** | WDAC policies restrict both kernel-mode and user-mode binaries. By default, only kernel-mode binaries are restricted. Enabling this rule option validates user mode executables and scripts. | > [!div class="mx-imgBorder"] -> ![Rule options UI for Windows Allowed mode policy](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) +> ![Rule options UI for Windows Allowed mode policy.](images/wdac-wizard-rule-options-UI-advanced-collapsed.png) ### Advanced Policy Rules Description @@ -84,7 +84,7 @@ Selecting the **+ Advanced Options** label will show another column of policy ru | **Invalidate EAs on Reboot** | When the Intelligent Security Graph option (14) is used, WDAC sets an extended file attribute that indicates that the file was authorized to run. This option will cause WDAC to periodically revalidate the reputation for files that were authorized by the ISG.| | **Require EV Signers** | In addition to being WHQL signed, this rule requires that drivers must have been submitted by a partner that has an Extended Verification (EV) certificate. All Windows 10 and later drivers will meet this requirement. | -![Rule options UI for Windows Allowed mode](images/wdac-wizard-rule-options-UI.png) +![Rule options UI for Windows Allowed mode.](images/wdac-wizard-rule-options-UI.png) > [!NOTE] > We recommend that you **enable Audit Mode** initially because it allows you to test new WDAC policies before you enforce them. With audit mode, no application is blocked—instead the policy logs an event whenever an application outside the policy is started. For this reason, all templates have Audit Mode enabled by default. @@ -105,7 +105,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate as well as a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | -![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) +![Custom filepublisher file rule creation.](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules @@ -123,7 +123,7 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Internal name** | Specifies the internal name of the binary. | > [!div class="mx-imgBorder"] -> ![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) +> ![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md index bca81708e6..5f96c11702 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-create-supplemental-policy.md @@ -33,15 +33,15 @@ Prerequisite information about application control can be accessed through the [ Once the Supplemental Policy type is chosen on the New Policy page, policy name and file dialog fields can be used to name and save the supplemental policy. The next step requires selecting a base policy to expand. To expand a base policy, the base must allow supplemental policies. The WDAC Wizard will verify if the base policy allows supplementals and will show the following confirmation. -![Base policy allows supplemental policies](images/wdac-wizard-supplemental-expandable.png) +![Base policy allows supplemental policies.](images/wdac-wizard-supplemental-expandable.png) If the base policy is not configured for supplemental policies, the Wizard will attempt to convert the policy to one that can be supplemented. Once successful, the Wizard will show a dialog demonstrating that the addition of the Allow Supplemental Policy rule was completed. -![Wizard confirms modification of base policy](images/wdac-wizard-confirm-base-policy-modification.png) +![Wizard confirms modification of base policy.](images/wdac-wizard-confirm-base-policy-modification.png) Policies that cannot be supplemented, for instance, a supplemental policy, will be detected by the Wizard and will show the following error. Only a base policy can be supplemented. More information on supplemental policies can be found on our [Multiple Policies article](deploy-multiple-windows-defender-application-control-policies.md). -![Wizard detects a bad base policy](images/wdac-wizard-supplemental-not-base.png) +![Wizard detects a bad base policy.](images/wdac-wizard-supplemental-not-base.png) ## Configuring Policy Rules @@ -60,7 +60,7 @@ There are only three policy rules that can be configured by the supplemental pol | **Managed Installer** | Use this option to automatically allow applications installed by a software distribution solution, such as Microsoft Endpoint Configuration Manager, that has been defined as a managed installer. | | **Disable Runtime FilePath Rule Protection** | Disable default FilePath rule protection (apps and executables allowed based on file path rules must come from a file path that’s only writable by an administrator) for any FileRule that allows a file based on FilePath. | -![Rule options UI for Windows Allowed mode](images/wdac-wizard-supplemental-policy-rule-options-UI.png) +![Rule options UI for Windows Allowed mode.](images/wdac-wizard-supplemental-policy-rule-options-UI.png) ## Creating custom file rules @@ -78,7 +78,7 @@ The Publisher file rule type uses properties in the code signing certificate cha | **File name** | FilePublisher | Most specific. Combination of the file name, publisher, and PCA certificate and a minimum version number. Files from the publisher with the specified name and greater or equal to the specified version are affected. | -![Custom filepublisher file rule creation](images/wdac-wizard-custom-publisher-rule.png) +![Custom filepublisher file rule creation.](images/wdac-wizard-custom-publisher-rule.png) ### Filepath Rules @@ -96,7 +96,7 @@ The Wizard supports the creation of [file name rules](select-types-of-rules-to-c | **Internal name** | Specifies the internal name of the binary. | -![Custom file attributes rule](images/wdac-wizard-custom-file-attribute-rule.png) +![Custom file attributes rule.](images/wdac-wizard-custom-file-attribute-rule.png) ### File Hash Rules diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md index 2b94c7f004..09c88d84aa 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-editing-policy.md @@ -36,7 +36,7 @@ The WDAC Wizard makes editing and viewing WDAC policies easier than the PowerShe The `Policy Rules` page will load with the in-edit policy rules configured per the set rules. Selecting the `+ Advanced Options` button will reveal the advanced policy rule options panel. This grouping of rules contains additional policy rule options that are less common to the majority of users. To edit any of the rules, flip the corresponding policy rule state. For instance, to disable Audit Mode and enable Enforcement Mode in the figure below, the button beside the `Audit Mode` label needs only to be pressed. Once the policy rules are configured, select the Next button to continue the next stage of editing: [Adding File Rules](#adding-file-rules). -![Configuring the policy rules](images/wdac-wizard-edit-policy-rules.png) +![Configuring the policy rules.](images/wdac-wizard-edit-policy-rules.png) A description of the policy rule is shown at the bottom of the page when the cursor is placed over the rule title. For a complete list of the policy rules and their capabilities, see the [Windows Defender Application Control policy rules table](select-types-of-rules-to-create.md#windows-defender-application-control-policy-rules). @@ -50,7 +50,7 @@ Selecting the `+ Custom Rules` button will open the Custom Rules panel. For more The WDAC Wizard makes deleting file rules from an existing policy quick and easy. To remove any type of file rule: publisher rule, path rule, filename rule, or a hash rule, select the rule in the `Policy Signing Rules List` table on the left-hand side of the page. Selecting the rule will highlight the entire row. Once the row is highlighted, select the remove icon underneath the table. The Wizard will prompt for user confirmation before removing the file rule. Once removed, the rule will no longer appear in the policy or the table. -![Removing file rule from policy during edit](images/wdac-wizard-edit-remove-file-rule.png) +![Removing file rule from policy during edit.](images/wdac-wizard-edit-remove-file-rule.png) **Note:** removing a publisher rule will also remove the associated File Attribute rules. For instance, in the xml block below, removing ID_SIGNER_CONTOSO_PUBLISHER would also remove the rules ID_FILEATTRIB_LOB_APP_1 and ID_FILEATTRIB_LOB_APP_2. diff --git a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md index ec6e988048..66ad01329f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md +++ b/windows/security/threat-protection/windows-defender-application-control/wdac-wizard-merging-policies.md @@ -30,4 +30,4 @@ Select the policies you wish to merge into one policy using the `+ Add Policy` b Lastly, select a filepath save location for the final merged policy using the `Browse` button. If a minimum of two policies are selected, and the save location is specified, select the `Next` button to build the policy. -![Merging WDAC policies into a final WDAC policy](images/wdac-wizard-merge.png) +![Merging WDAC policies into a final WDAC policy.](images/wdac-wizard-merge.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md index 6da28ad681..ed1a7fe460 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-account-protection.md @@ -57,4 +57,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md index 80d025f7ac..544e90142e 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-app-browser-control.md @@ -76,4 +76,4 @@ This can only be done in Group Policy. > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md index 1bfddcc3f2..969d80c8bf 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-customize-contact-information.md @@ -32,11 +32,11 @@ ms.technology: mde You can add information about your organization in a contact card to the Windows Security app. You can include a link to a support site, a phone number for a help desk, and an email address for email-based support. -![The security center custom fly-out](images/security-center-custom-flyout.png) +![The security center custom fly-out.](images/security-center-custom-flyout.png) This information will also be shown in some enterprise-specific notifications (including notifications for the [Block at first sight feature](/windows/threat-protection/microsoft-defender-antivirus/configure-block-at-first-sight-microsoft-defender-antivirus), and [potentially unwanted applications](/windows/threat-protection/microsoft-defender-antivirus/detect-block-potentially-unwanted-apps-microsoft-defender-antivirus)). -![A security center notification](images/security-center-custom-notif.png) +![A security center notification.](images/security-center-custom-notif.png) Users can select the displayed information to initiate a support request: diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md index 919f2cb7a2..13fce0f2d5 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-performance-health.md @@ -56,4 +56,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md index f0627d2869..f4d3053cd9 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-device-security.md @@ -50,7 +50,7 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Disable the Clear TPM button If you don't want users to be able to click the **Clear TPM** button in the Windows Security app, you can disable it. diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md index c7d0fb4944..274c66bd66 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-family-options.md @@ -55,4 +55,4 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) \ No newline at end of file +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) \ No newline at end of file diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md index 5cf74d9fdf..3a14dc7c26 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-firewall-network-protection.md @@ -52,5 +52,5 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md index 762e9c7402..87960171d1 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection.md @@ -63,7 +63,7 @@ This can only be done in Group Policy. >[!NOTE] >If you hide all sections then the app will show a restricted interface, as in the following screenshot: > ->![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +>![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Hide the Ransomware protection area diff --git a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md index 146bdcc78e..30cc06c3d0 100644 --- a/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md +++ b/windows/security/threat-protection/windows-defender-security-center/wdsc-windows-10-in-s-mode.md @@ -34,7 +34,7 @@ Windows 10 in S mode is streamlined for tighter security and superior performanc The Windows Security interface is a little different in Windows 10 in S mode. The **Virus & threat protection** area has fewer options, because the built-in security of Windows 10 in S mode prevents viruses and other threats from running on devices in your organization. In addition, devices running Windows 10 in S mode receive security updates automatically. -![Screen shot of the Windows Security app Virus & threat protection area in Windows 10 in S mode](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) +![Screen shot of the Windows Security app Virus & threat protection area in Windows 10 in S mode.](images/security-center-virus-and-threat-protection-windows-10-in-s-mode.png) For more information about Windows 10 in S mode, including how to switch out of S mode, see [Windows 10 Pro/Enterprise in S mode](/windows/deployment/windows-10-pro-in-s-mode). diff --git a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md index 17eb0a98fd..fe03727f33 100644 --- a/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md +++ b/windows/security/threat-protection/windows-defender-security-center/windows-defender-security-center.md @@ -31,7 +31,7 @@ In Windows 10, version 1709 and later, the app also shows information from third In Windows 10, version 1803, the app has two new areas, **Account protection** and **Device security**. -![Screenshot of the Windows Security app showing that the device is protected and five icons for each of the features](images/security-center-home.png) +![Screenshot of the Windows Security app showing that the device is protected and five icons for each of the features.](images/security-center-home.png) > [!NOTE] > The Windows Security app is a client interface on Windows 10, version 1703 and later. It is not the Microsoft Defender Security Center web portal console that is used to review and manage [Microsoft Defender for Endpoint](/windows/threat-protection/windows-defender-atp/windows-defender-advanced-threat-protection). @@ -55,19 +55,19 @@ You can find more information about each section, including options for configur > [!NOTE] > If you hide all sections then the app will show a restricted interface, as in the following screenshot: > -> ![Windows Security app with all sections hidden by Group Policy](images/wdsc-all-hide.png) +> ![Windows Security app with all sections hidden by Group Policy.](images/wdsc-all-hide.png) ## Open the Windows Security app - Click the icon in the notification area on the taskbar. - ![Screenshot of the icon for the Windows Security app on the Windows task bar](images/security-center-taskbar.png) + ![Screenshot of the icon for the Windows Security app on the Windows task bar.](images/security-center-taskbar.png) - Search the Start menu for **Windows Security**. - ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected](images/security-center-start-menu.png) + ![Screenshot of the Start menu showing the results of a search for the Windows Security app, the first option with a large shield symbol is selected.](images/security-center-start-menu.png) - Open an area from Windows **Settings**. - ![Screenshot of Windows Settings showing the different areas available in the Windows Security](images/settings-windows-defender-security-center-areas.png) + ![Screenshot of Windows Settings showing the different areas available in the Windows Security.](images/settings-windows-defender-security-center-areas.png) > [!NOTE] > Settings configured with management tools, such as Group Policy, Microsoft Intune, or Microsoft Endpoint Configuration Manager, will generally take precedence over the settings in the Windows Security. See the topics for each of the sections for links to configuring the associated features or products. diff --git a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md index 8b55c05b3e..848345ef8b 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -52,7 +52,7 @@ DRTM lets the system freely boot into untrusted code initially, but shortly afte This has the benefit of allowing untrusted early UEFI code to boot the system, but then being able to securely transition into a trusted and measured state. -![System Guard Secure Launch](images/system-guard-secure-launch.png) +![System Guard Secure Launch.](images/system-guard-secure-launch.png) Secure Launch simplifies management of SRTM measurements because the launch code is now unrelated to a specific hardware configuration. This means the number of valid code measurements is small, and future updates can be deployed more widely and quickly. @@ -82,7 +82,7 @@ While Windows Defender System Guard provides advanced protection that will help As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch will not support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. -![Boot time integrity](images/windows-defender-system-guard-boot-time-integrity.png) +![Boot time integrity.](images/windows-defender-system-guard-boot-time-integrity.png) After the system boots, Windows Defender System Guard signs and seals these measurements using the TPM. Upon request, a management system like Intune or Microsoft Endpoint Configuration Manager can acquire them for remote analysis. If Windows Defender System Guard indicates that the device lacks integrity, the management system can take a series of actions, such as denying the device access to resources. diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 14695d80d0..55321967df 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -38,13 +38,13 @@ System Guard Secure Launch can be configured for Mobile Device Management (MDM) 2. Click **Computer Configuration** > **Administrative Templates** > **System** > **Device Guard** > **Turn On Virtualization Based Security** > **Secure Launch Configuration**. - ![Secure Launch Configuration](images/secure-launch-group-policy.png) + ![Secure Launch Configuration.](images/secure-launch-group-policy.png) ### Windows Security Center Click **Start** > **Settings** > **Update & Security** > **Windows Security** > **Open Windows Security** > **Device security** > **Core isolation** > **Firmware protection**. - ![Windows Security Center](images/secure-launch-security-app.png) + ![Windows Security Center.](images/secure-launch-security-app.png) ### Registry @@ -58,13 +58,13 @@ Click **Start** > **Settings** > **Update & Security** > **Windows Security** > 5. Double-click **Enabled**, change the value to **1**, and click **OK**. - ![Secure Launch Registry](images/secure-launch-registry.png) + ![Secure Launch Registry.](images/secure-launch-registry.png) ## How to verify System Guard Secure Launch is configured and running To verify that Secure Launch is running, use System Information (MSInfo32). Click **Start**, search for **System Information**, and look under **Virtualization-based Security Services Running** and **Virtualization-based Security Services Configured**. -![Verifying Secure Launch is running in the Windows Security Center](images/secure-launch-msinfo.png) +![Verifying Secure Launch is running in the Windows Security Center.](images/secure-launch-msinfo.png) > [!NOTE] > To enable System Guard Secure launch, the platform must meet all the baseline requirements for [Device Guard](../device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control.md), [Credential Guard](../../identity-protection/credential-guard/credential-guard-requirements.md), and [Virtualization Based Security](/windows-hardware/design/device-experiences/oem-vbs). diff --git a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md index 71f0392376..5819f886fd 100644 --- a/windows/security/threat-protection/windows-firewall/best-practices-configuring.md +++ b/windows/security/threat-protection/windows-firewall/best-practices-configuring.md @@ -38,7 +38,7 @@ type **WF.msc**, and then select **OK**. See also [Open Windows Firewall](./op When you open the Windows Defender Firewall for the first time, you can see the default settings applicable to the local computer. The Overview panel displays security settings for each type of network to which the device can connect. -![Windows Defender Firewall with Advanced Security first time opening](images/fw01-profiles.png) +![Windows Defender Firewall with Advanced Security first time opening.](images/fw01-profiles.png) *Figure 1: Windows Defender Firewall* @@ -55,7 +55,7 @@ View detailed settings for each profile by right-clicking the top-level **Window Maintain the default settings in Windows Defender Firewall whenever possible. These settings have been designed to secure your device for use in most network scenarios. One key example is the default Block behavior for Inbound connections. -![A screenshot of a cell phone Description automatically generated](images/fw03-defaults.png) +![A screenshot of a cell phone Description automatically generated.](images/fw03-defaults.png) *Figure 2: Default inbound/outbound settings* @@ -70,7 +70,7 @@ In many cases, a next step for administrators will be to customize these profile This can be accomplished by right-clicking either **Inbound Rules** or **Outbound Rules**, and selecting **New Rule**. The interface for adding a new rule looks like this: -![Rule creation wizard](images/fw02-createrule.png) +![Rule creation wizard.](images/fw02-createrule.png) *Figure 3: Rule Creation Wizard* @@ -131,7 +131,7 @@ To determine why some applications are blocked from communicating in the network Creation of application rules at runtime can also be prohibited by administrators using the Settings app or Group Policy. -![Windows Firewall prompt](images/fw04-userquery.png) +![Windows Firewall prompt.](images/fw04-userquery.png) *Figure 4: Dialog box to allow access* @@ -148,7 +148,7 @@ Rule merging settings control how rules from different policy sources can be com The rule merging settings either allow or prevent local admins from creating their own firewall rules in addition to those obtained from Group Policy. -![Customize settings](images/fw05-rulemerge.png) +![Customize settings.](images/fw05-rulemerge.png) *Figure 5: Rule merging setting* @@ -180,11 +180,11 @@ An important firewall feature you can use to mitigate damage during an active at Shields up can be achieved by checking **Block all incoming connections, including those in the list of allowed apps** setting found in either the Windows Settings app or the legacy file *firewall.cpl*. -![Incoming connections](images/fw06-block.png) +![Incoming connections.](images/fw06-block.png) *Figure 6: Windows settings App/Windows Security/Firewall Protection/Network Type* -![Firewall cpl](images/fw07-legacy.png) +![Firewall cpl.](images/fw07-legacy.png) *Figure 7: Legacy firewall.cpl* diff --git a/windows/security/threat-protection/windows-firewall/boundary-zone.md b/windows/security/threat-protection/windows-firewall/boundary-zone.md index 0e67454be2..37d7edb647 100644 --- a/windows/security/threat-protection/windows-firewall/boundary-zone.md +++ b/windows/security/threat-protection/windows-firewall/boundary-zone.md @@ -32,7 +32,7 @@ The GPOs you build for the boundary zone include IPsec or connection security ru Because these boundary zone devices can receive unsolicited inbound communications from untrusted devices that use plaintext, they must be carefully managed and secured in other ways. Mitigating this additional risk is an important part of deciding whether to add a device to the boundary zone. For example, completing a formal business justification process before adding each device to the boundary zone can help ensure that the additional risk is minimized. The following illustration shows a sample process that can help make such a decision. -![design flowchart](images/wfas-designflowchart1.gif) +![design flowchart.](images/wfas-designflowchart1.gif) The goal of this process is to determine whether the risk of adding a device to a boundary zone can be mitigated to a level that makes it acceptable to the organization. Ultimately, if the risk cannot be mitigated, membership must be denied. diff --git a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md index bf9a3f7d47..479b2e67af 100644 --- a/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md +++ b/windows/security/threat-protection/windows-firewall/create-windows-firewall-rules-in-intune.md @@ -28,7 +28,7 @@ ms.technology: mde To get started, open Device Configuration in Intune, then create a new profile. Choose Windows 10 as the platform, and Endpoint Protection as the profile type. Select Windows Defender Firewall. -![Windows Defender Firewall in Intune](images/windows-firewall-intune.png) +![Windows Defender Firewall in Intune.](images/windows-firewall-intune.png) >[!IMPORTANT] >A single Endpoint Protection profile may contain up to a maximum of 150 firewall rules. If a client device requires more than 150 rules, then multiple profiles must be assigned to it. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md index 0e7f47576b..8f27c49ab5 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design-example.md @@ -32,7 +32,7 @@ In addition to the basic protection provided by the firewall rules in the previo The following illustration shows the traffic protection needed for this design example. -![domain isolation policy design](images/wfas-design2example1.gif) +![domain isolation policy design.](images/wfas-design2example1.gif) 1. All devices on the Woodgrove Bank corporate network that are Active Directory domain members must authenticate inbound network traffic as coming from another computer that is a member of the domain. Unless otherwise specified in this section, Woodgrove Bank's devices reject all unsolicited inbound network traffic that is not authenticated. If the basic firewall design is also implemented, even authenticated inbound network traffic is dropped unless it matches an inbound firewall rule. diff --git a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md index 6c13157e59..659827d1c6 100644 --- a/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/domain-isolation-policy-design.md @@ -34,7 +34,7 @@ By using connection security rules based on IPsec, you provide a logical barrier The design is shown in the following illustration, with the arrows that show the permitted communication paths. -![isolated domain boundary zone](images/wfasdomainisoboundary.gif) +![isolated domain boundary zone.](images/wfasdomainisoboundary.gif) Characteristics of this design, as shown in the diagram, include the following: diff --git a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md index 90d5fd2514..718505a9d7 100644 --- a/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md +++ b/windows/security/threat-protection/windows-firewall/filter-origin-documentation.md @@ -22,7 +22,7 @@ Debugging packet drops is a continuous issue to Windows customers. In the past, Typically, when investigating packet drop events, a customer would use the field `Filter Run-Time ID` from Windows Filtering Platform (WFP) audits 5157 or 5152. -![Event properties](images/event-properties-5157.png) +![Event properties.](images/event-properties-5157.png) The filter ID uniquely identifies the filter that caused the packet drop. The filter ID can be searched in the WFP state dump output to trace back to the Firewall rule where the filter originated from. @@ -73,7 +73,7 @@ To enable a specific audit event, run the corresponding command in an administra As the audit surfaces `Filter Origin` and `Interface Index`, the network admin can determine the root cause of the network packet drop and the interface it happened on. -![Event audit](images/event-audit-5157.png) +![Event audit.](images/event-audit-5157.png) The next sections are divided by `Filter Origin` type, the value is either a rule name or the name of one of the default block filters. If the filter origin is one of the default block filters, skip to the section, **Firewall default block filters**. Otherwise, continue to the section **Firewall rules**. @@ -86,7 +86,7 @@ Get-NetFirewallRule -Name “” Get-NetFirewallRule -Name " {A549B7CF-0542-4B67-93F9-EEBCDD584377} " ``` -![Firewall rule](images/firewallrule.png) +![Firewall rule.](images/firewallrule.png) After identifying the rule that caused the drop, the network admin can now modify/disable the rule to allow the traffic they want through command prompt or using the Windows Defender UI. The network admin can find the rule in the UI with the rule’s `DisplayName`. @@ -118,7 +118,7 @@ Get-NetIPInterface –InterfaceIndex Get-NetIPInterface –InterfaceIndex 5 ``` -![Quarantine default block filter](images/quarantine-default-block-filter.png) +![Quarantine default block filter.](images/quarantine-default-block-filter.png) To learn more about the quarantine feature, see [Quarantine behavior](quarantine.md). @@ -139,7 +139,7 @@ To generate a list of all the query user block rules, you can run the following Get-NetFirewallRule | Where {$_.Name -like "*Query User*"} ``` -![Query user default block filter](images/query-user-default-block-filters.png) +![Query user default block filter.](images/query-user-default-block-filters.png) The query user pop-up feature is enabled by default. diff --git a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md index 8c8fb36ee5..5a6acfea96 100644 --- a/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/firewall-policy-design-example.md @@ -38,7 +38,7 @@ The network administrators want to implement Windows Defender Firewall with Adva The following illustration shows the traffic protection needs for this design example. -![design example 1](images/wfas-designexample1.gif) +![design example 1.](images/wfas-designexample1.gif) 1. The network infrastructure servers that are running services, such as Active Directory, DNS, DHCP, or WINS, can receive unsolicited inbound requests from network clients. The network clients can receive the responses from the infrastructure servers. diff --git a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md index 7b95852c3d..265019f489 100644 --- a/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md +++ b/windows/security/threat-protection/windows-firewall/implementing-your-windows-firewall-with-advanced-security-design-plan.md @@ -41,7 +41,7 @@ The following are important factors in the implementation of your Windows Defend The next step in implementing your design is to determine in what order each of the deployment steps must be performed. This guide uses checklists to help you accomplish the various deployment tasks that are required to implement your design plan. As the following diagram shows, checklists and subchecklists are used as necessary to provide the end-to-end procedure for deploying a design. -![wfas implementation](images/wfas-implement.gif) +![wfas implementation.](images/wfas-implement.gif) Use the following parent checklists in this section of the guide to become familiar with the deployment tasks for implementing your organization's Windows Defender Firewall with Advanced Security design. diff --git a/windows/security/threat-protection/windows-firewall/quarantine.md b/windows/security/threat-protection/windows-firewall/quarantine.md index 87bab115a6..bd087a2124 100644 --- a/windows/security/threat-protection/windows-firewall/quarantine.md +++ b/windows/security/threat-protection/windows-firewall/quarantine.md @@ -196,7 +196,7 @@ Auditpol /set /category:"System" /SubCategory:"Filtering Platform Connection" /s Sample drop audit with `filterOrigin` as `Quarantine Default`. -![Quarantine default](images/quarantine-default1.png) +![Quarantine default.](images/quarantine-default1.png) Once the drop’s filter origin has been identified as the quarantine default inbound block filter, the interface should be further investigated. To find the relevant interface, use the `InterfaceIndex` value from the `netEvent` or event audit in the following PowerShell command to generate more information about the interface: @@ -205,7 +205,7 @@ Get-NetIPInterface –InterfaceIndex Get-NetIPInterface –InterfaceIndex 5 ``` -![Quarantine Interfaceindex](images/quarantine-interfaceindex1.png) +![Quarantine Interfaceindex.](images/quarantine-interfaceindex1.png) Using the interface name, event viewer can be searched for any interface related changes. diff --git a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md index 81a548b4ee..8fbeb35412 100644 --- a/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md +++ b/windows/security/threat-protection/windows-firewall/require-encryption-when-accessing-sensitive-network-resources.md @@ -30,7 +30,7 @@ For devices that share sensitive information over the network, Windows Defender The following illustration shows an encryption zone in an isolated domain. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. -![encryption zone in an isolated domain](images/wfas-domainisoencrypt.gif) +![encryption zone in an isolated domain.](images/wfas-domainisoencrypt.gif) This goal provides the following benefits: diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md index a50232fe28..1a7c288575 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-specified-users-or-devices.md @@ -34,7 +34,7 @@ You can restrict access by specifying either computer or user credentials. The following illustration shows an isolated server, and examples of devices that can and cannot communicate with it. Devices that are outside the Woodgrove corporate network, or computers that are in the isolated domain but are not members of the required NAG, cannot communicate with the isolated server. -![isolated domain with network access groups](images/wfas-domainnag.gif) +![isolated domain with network access groups.](images/wfas-domainnag.gif) This goal, which corresponds to [Server Isolation Policy Design](server-isolation-policy-design.md), provides the following features: diff --git a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md index d7de7d8963..5285e56ad9 100644 --- a/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md +++ b/windows/security/threat-protection/windows-firewall/restrict-access-to-only-trusted-devices.md @@ -35,7 +35,7 @@ The protection provided by domain isolation can help you comply with regulatory The following illustration shows an isolated domain, with one of the zones that are optionally part of the design. The rules that implement both the isolated domain and the different zones are deployed by using Group Policy and Active Directory. -![domain isolation](images/wfas-domainiso.gif) +![domain isolation.](images/wfas-domainiso.gif) These goals, which correspond to [Domain Isolation Policy Design](domain-isolation-policy-design.md) and [Certificate-based Isolation Policy Design](certificate-based-isolation-policy-design.md), provide the following benefits: diff --git a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md index 4c6f3f4fb7..8cb2a35d50 100644 --- a/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md +++ b/windows/security/threat-protection/windows-firewall/securing-end-to-end-ipsec-connections-by-using-ikev2.md @@ -59,7 +59,7 @@ These procedures assume that you already have a public key infrastructure (PKI) The following Windows PowerShell script establishes a connection security rule that uses IKEv2 for communication between two computers (CLIENT1 and SERVER1) that are joined to the corp.contoso.com domain as shown in Figure 1. -![the contoso corporate network](images/corpnet.gif) +![the contoso corporate network.](images/corpnet.gif) **Figure 1** The Contoso corporate network @@ -77,7 +77,7 @@ This script does the following: - Creates the IKEv2 connection security rule called **My IKEv2 Rule**. -![powershell logo](images/powershelllogosmall.gif)**Windows PowerShell commands** +![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. @@ -117,7 +117,7 @@ Use a Windows PowerShell script similar to the following to create a local IPsec >**Important:**  The certificate parameters that you specify for the certificate are case sensitive, so make sure that you type them exactly as specified in the certificate, and place the parameters in the exact order that you see in the following example. Failure to do so will result in connection errors. -![powershell logo](images/powershelllogosmall.gif)**Windows PowerShell commands** +![powershell logo.](images/powershelllogosmall.gif)**Windows PowerShell commands** Type each cmdlet on a single line, even though they may appear to wrap across several lines because of formatting constraints. diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md index 0e2b6ce11e..a0070cf114 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design-example.md @@ -46,7 +46,7 @@ In addition to the protection provided by the firewall rules and domain isolatio The following illustration shows the traffic protection needs for this design example. -![isolated server example](images/wfas-design3example1.gif) +![isolated server example.](images/wfas-design3example1.gif) 1. Access to the SQL Server devices must be restricted to only those computer or user accounts that have a business requirement to access the data. This includes the service accounts that are used by the WGBank front-end servers, and administrators of the SQL Server devices. In addition, access is only granted when it is sent from an authorized computer. Authorization is determined by membership in a network access group (NAG). diff --git a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md index f4d452b4cf..7d44e7c17c 100644 --- a/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md +++ b/windows/security/threat-protection/windows-firewall/server-isolation-policy-design.md @@ -32,7 +32,7 @@ You can implement a server isolation design without using domain isolation. To d The design is shown in the following illustration, with arrows that show the permitted communication paths. -![isolated domain with isolated server](images/wfas-domainisohighsec.gif) +![isolated domain with isolated server.](images/wfas-domainisohighsec.gif) Characteristics of this design include the following: diff --git a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md index 3e383743a4..bf70a3a3b7 100644 --- a/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md +++ b/windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security-administration-with-windows-powershell.md @@ -328,7 +328,7 @@ Windows PowerShell can create powerful, complex IPsec policies like in Netsh and In Netsh, the authentication and cryptographic sets were specified as a list of comma-separated tokens in a specific format. In Windows PowerShell, rather than using default settings, you first create your desired authentication or cryptographic proposal objects and bundle them into lists in your preferred order. Then, you create one or more IPsec rules that reference these sets. The benefit of this model is that programmatic access to the information in the rules is much easier. See the following sections for clarifying examples. -![object model for creating a single ipsec rule](images/createipsecrule.gif) +![object model for creating a single ipsec rule.](images/createipsecrule.gif) ### Create IPsec rules @@ -353,7 +353,7 @@ If you want to create a custom set of quick-mode proposals that includes both AH You can then use the newly created custom quick-mode policies when you create IPsec rules. The cryptography set object is linked to an IPsec rule object. -![crypto set object](images/qmcryptoset.gif) +![crypto set object.](images/qmcryptoset.gif) In this example, we build on the previously created IPsec rule by specifying a custom quick-mode crypto set. The final IPsec rule requires outbound traffic to be authenticated by the specified cryptography method. diff --git a/windows/security/threat-protection/windows-security-baselines.md b/windows/security/threat-protection/windows-security-baselines.md index f18a5180db..8e719f1364 100644 --- a/windows/security/threat-protection/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-baselines.md @@ -61,12 +61,12 @@ You can download the security baselines from the [Microsoft Download Center](htt The security baselines are included in the [Security Compliance Toolkit (SCT)](security-compliance-toolkit-10.md), which can be downloaded from the Microsoft Download Center. The SCT also includes tools to help admins manage the security baselines. -[![Security Compliance Toolkit](images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) -[![Get Support](images/get-support.png)](get-support-for-security-baselines.md) +[![Security Compliance Toolkit.](images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) +[![Get Support.](images/get-support.png)](get-support-for-security-baselines.md) ## Community -[![Microsoft Security Guidance Blog](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) +[![Microsoft Security Guidance Blog.](images/community.png)](https://techcommunity.microsoft.com/t5/microsoft-security-baselines/bd-p/Security-Baselines) ## Related Videos diff --git a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md index cfb7427cbc..170918a4fa 100644 --- a/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md +++ b/windows/security/threat-protection/windows-security-configuration-framework/windows-security-baselines.md @@ -60,12 +60,12 @@ You can download the security baselines from the [Microsoft Download Center](htt The security baselines are included in the [Security Compliance Toolkit (SCT)](security-compliance-toolkit-10.md), which can be downloaded from the Microsoft Download Center. The SCT also includes tools to help admins manage the security baselines. -[![Security Compliance Toolkit](./../images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) -[![Get Support](./../images/get-support.png)](get-support-for-security-baselines.md) +[![Security Compliance Toolkit.](./../images/security-compliance-toolkit-1.png)](security-compliance-toolkit-10.md) +[![Get Support.](./../images/get-support.png)](get-support-for-security-baselines.md) ## Community -[![Microsoft Security Guidance Blog](./../images/community.png)](/archive/blogs/secguide/) +[![Microsoft Security Guidance Blog.](./../images/community.png)](/archive/blogs/secguide/) ## Related Videos diff --git a/windows/whats-new/contribute-to-a-topic.md b/windows/whats-new/contribute-to-a-topic.md index 1387997652..b99b7a48ad 100644 --- a/windows/whats-new/contribute-to-a-topic.md +++ b/windows/whats-new/contribute-to-a-topic.md @@ -38,7 +38,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 1. Go to the article that you want to update, and then click **Edit**. - ![GitHub Web, showing the Edit link](images/contribute-link.png) + ![GitHub Web, showing the Edit link.](images/contribute-link.png) 2. Sign into (or sign up for) a GitHub account. @@ -46,7 +46,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 3. Click the **Pencil** icon (in the red box) to edit the content. - ![GitHub Web, showing the Pencil icon in the red box](images/pencil-icon.png) + ![GitHub Web, showing the Pencil icon in the red box.](images/pencil-icon.png) 4. Using Markdown language, make your changes to the topic. For info about how to edit content using Markdown, see: - **If you're linked to the Microsoft organization in GitHub:** [Windows authoring guide](https://aka.ms/WindowsAuthoring) @@ -55,11 +55,11 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner 5. Make your suggested change, and then click **Preview Changes** to make sure it looks correct. - ![GitHub Web, showing the Preview Changes tab](images/preview-changes.png) + ![GitHub Web, showing the Preview Changes tab.](images/preview-changes.png) 6. When you’re done editing the topic, scroll to the bottom of the page, and then click **Propose file change**. - ![GitHub Web, showing the Propose file change button](images/propose-file-change.png) + ![GitHub Web, showing the Propose file change button.](images/propose-file-change.png) The **Comparing changes** screen shows the changes between your version of the article and the original content. @@ -67,7 +67,7 @@ Across the docs.microsoft.com site, if you see **Edit** in the right-hand corner If there are no problems, you’ll see the message, **Able to merge**. - ![GitHub Web, showing the Comparing changes screen](images/compare-changes.png) + ![GitHub Web, showing the Comparing changes screen.](images/compare-changes.png) 8. Click **Create pull request**. diff --git a/windows/whats-new/ltsc/whats-new-windows-10-2019.md b/windows/whats-new/ltsc/whats-new-windows-10-2019.md index 83e1c6b032..256dad7a3a 100644 --- a/windows/whats-new/ltsc/whats-new-windows-10-2019.md +++ b/windows/whats-new/ltsc/whats-new-windows-10-2019.md @@ -48,7 +48,7 @@ This version of Window 10 includes security improvements for threat protection, The [Microsoft Defender for Endpoint](/windows/security/threat-protection/index) platform includes the security pillars shown in the following diagram. In this version of Windows, Defender for Endpoint includes powerful analytics, security stack integration, and centralized management for better detection, prevention, investigation, response, and management. -![Microsoft Defender for Endpoint](../images/wdatp.png) +![Microsoft Defender for Endpoint.](../images/wdatp.png) ##### Attack surface reduction @@ -275,7 +275,7 @@ The WSC service now requires antivirus products to run as a protected process to WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. -![Security at a glance](../images/defender.png "Windows Security Center") +![Security at a glance.](../images/defender.png "Windows Security Center") #### Group Policy Security Options @@ -288,7 +288,7 @@ A new security policy setting We’ve continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: -![S mode settings](../images/virus-and-threat-protection.png "Virus & threat protection settings") +![S mode settings.](../images/virus-and-threat-protection.png "Virus & threat protection settings") ## Deployment @@ -387,7 +387,7 @@ If you have shared devices deployed in your work place, **Fast sign-in** enables 3. Sign-in to a shared PC with your account. You'll notice the difference! - ![fast sign-in](../images/fastsignin.png "fast sign-in") + ![fast sign-in.](../images/fastsignin.png "fast sign-in") ### Web sign-in to Windows 10 @@ -402,7 +402,7 @@ Until now, Windows logon only supported the use of identities federated to ADFS 3. On the lock screen, select web sign-in under sign-in options. 4. Click the “Sign in” button to continue. -![Sign-in option](../images/websignin.png "web sign-in") +![Sign-in option.](../images/websignin.png "web sign-in") ## Windows Analytics @@ -470,7 +470,7 @@ The OS uninstall period is a length of time that users are given when they can o Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. -![get bulk token action in wizard](../images/bulk-token.png) +![get bulk token action in wizard.](../images/bulk-token.png) ### Windows Spotlight @@ -636,7 +636,7 @@ If you have a device that has been updated to Windows 10 Enterprise LTSC 2019, t We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -![Reg editor](../images/regeditor.png "Registry editor dropdown") +![Reg editor.](../images/regeditor.png "Registry editor dropdown") ## Remote Desktop with Biometrics @@ -650,9 +650,9 @@ To get started, sign into your device using Windows Hello for Business. Bring up See the following example: -![Enter your credentials](../images/RDPwBioTime.png "Windows Hello") -![Provide credentials](../images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016](../images/hyper-v.png "Microsoft Hyper-V Server 2016") +![Enter your credentials.](../images/RDPwBioTime.png "Windows Hello") +![Provide credentials.](../images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016.](../images/hyper-v.png "Microsoft Hyper-V Server 2016") ## See Also diff --git a/windows/whats-new/whats-new-windows-10-version-1703.md b/windows/whats-new/whats-new-windows-10-version-1703.md index b05bba2289..48bf6b509b 100644 --- a/windows/whats-new/whats-new-windows-10-version-1703.md +++ b/windows/whats-new/whats-new-windows-10-version-1703.md @@ -31,11 +31,11 @@ Previously known as *Windows Imaging and Configuration Designer (ICD)*, the tool Windows Configuration Designer in Windows 10, version 1703, includes several new wizards to make it easier to create provisioning packages. -![wizards for desktop, mobile, kiosk, Surface Hub](images/wcd-options.png) +![wizards for desktop, mobile, kiosk, Surface Hub.](images/wcd-options.png) Both the desktop and kiosk wizards include an option to remove pre-installed software, based on the new [CleanPC configuration service provider (CSP)](/windows/client-management/mdm/cleanpc-csp). -![remove pre-installed software option](images/wcd-cleanpc.png) +![remove pre-installed software option.](images/wcd-cleanpc.png) [Learn more about Windows Configuration Designer.](/windows/configuration/provisioning-packages/provisioning-packages) @@ -44,7 +44,7 @@ Both the desktop and kiosk wizards include an option to remove pre-installed sof Using the new wizards in Windows Configuration Designer, you can [create provisioning packages to enroll devices in Azure Active Directory](/windows/configuration/provisioning-packages/provisioning-packages#configuration-designer-wizards). Azure AD join in bulk is available in the desktop, mobile, kiosk, and Surface Hub wizards. -![get bulk token action in wizard](images/bulk-token.png) +![get bulk token action in wizard.](images/bulk-token.png) ### Windows Spotlight @@ -279,7 +279,7 @@ Learn about the new Group Policies that were added in Windows 10, version 1703. The Lockdown Designer app helps you configure and create a lockdown XML file to apply to devices running Windows 10 Mobile, and includes a remote simulation to help you determine the layout for tiles on the Start screen. Using Lockdown Designer is easier than [manually creating a lockdown XML file](/windows/configuration/mobile-devices/lockdown-xml). -![Lockdown Designer app in Store](images/ldstore.png) +![Lockdown Designer app in Store.](images/ldstore.png) [Learn more about the Lockdown Designer app.](/windows/configuration/mobile-devices/mobile-lockdown-designer) diff --git a/windows/whats-new/whats-new-windows-10-version-1809.md b/windows/whats-new/whats-new-windows-10-version-1809.md index e73c5af9bc..6410248ff6 100644 --- a/windows/whats-new/whats-new-windows-10-version-1809.md +++ b/windows/whats-new/whats-new-windows-10-version-1809.md @@ -46,7 +46,7 @@ To learn more about Autopilot self-deploying mode and to see step-by-step instru We’ve continued to work on the **Current threats** area in [Virus & threat protection](/windows/security/threat-protection/windows-defender-security-center/wdsc-virus-threat-protection), which now displays all threats that need action. You can quickly take action on threats from this screen: > [!div class="mx-imgBorder"] -> ![Virus & threat protection settings](images/virus-and-threat-protection.png "Virus & threat protection settings") +> ![Virus & threat protection settings.](images/virus-and-threat-protection.png "Virus & threat protection settings") With controlled folder access you can help prevent ransomware and other destructive malware from changing your personal files. In some cases, apps that you normally use might be blocked from making changes to common folders like **Documents** and **Pictures**. We’ve made it easier for you to add apps that were recently blocked so you can keep using your device without turning off the feature altogether. @@ -109,16 +109,16 @@ To try this: See the following example: > [!div class="mx-imgBorder"] -> ![Security at a glance](images/1_AppBrowser.png "app and browser control") +> ![Security at a glance.](images/1_AppBrowser.png "app and browser control") > [!div class="mx-imgBorder"] -> ![Isolated browser](images/2_InstallWDAG.png "isolated browsing") +> ![Isolated browser.](images/2_InstallWDAG.png "isolated browsing") > [!div class="mx-imgBorder"] -> ![change WDAG settings](images/3_ChangeSettings.png "change settings") +> ![change WDAG settings.](images/3_ChangeSettings.png "change settings") > [!div class="mx-imgBorder"] -> ![view WDAG settings](images/4_ViewSettings.jpg "view settings") +> ![view WDAG settings.](images/4_ViewSettings.jpg "view settings") ### Windows Security Center @@ -130,7 +130,7 @@ The WSC service now requires antivirus products to run as a protected process to WSC now includes the Fluent Design System elements you know and love. You’ll also notice we’ve adjusted the spacing and padding around the app. It will now dynamically size the categories on the main page if more room is needed for extra info. We also updated the title bar so that it will use your accent color if you have enabled that option in **Color Settings**. -![alt text](images/defender.png "Windows Security Center") +![alt text.](images/defender.png "Windows Security Center") ### Windows Defender Firewall now supports Windows Subsystem for Linux (WSL) processes @@ -195,7 +195,7 @@ We introduced a simplified assigned access configuration experience in **Setting To use this feature, go to **Settings**, search for **assigned access**, and open the **Set up a kiosk** page. -![set up a kiosk](images/kiosk-mode.png "set up a kiosk") +![set up a kiosk.](images/kiosk-mode.png "set up a kiosk") Microsoft Edge kiosk mode running in single-app assigned access has two kiosk types. @@ -203,7 +203,7 @@ Microsoft Edge kiosk mode running in single-app assigned access has two kiosk ty 2. **Public browsing** supports multi-tab browsing and runs InPrivate mode with minimal features available. Users cannot minimize, close, or open new Microsoft Edge windows or customize them using Microsoft Edge Settings. Users can clear browsing data and downloads, and restart Microsoft Edge by clicking **End session**. Administrators can configure Microsoft Edge to restart after a period of inactivity. -![single app assigned access](images/SingleApp_contosoHotel_inFrame@2x.png "single app assigned access") +![single app assigned access.](images/SingleApp_contosoHotel_inFrame@2x.png "single app assigned access") Microsoft Edge kiosk mode running in multi-app assigned access has two kiosk types. @@ -212,11 +212,11 @@ Microsoft Edge kiosk mode running in multi-app assigned access has two kiosk typ **Public browsing** supports multi-tab browsing and runs InPrivate mode with minimal features available. In this configuration, Microsoft Edge can be one of many apps available. Users can close and open multiple InPrivate mode windows. -![multi-app assigned access](images/Multi-app_kiosk_inFrame.png "multi-app assigned access") +![multi-app assigned access.](images/Multi-app_kiosk_inFrame.png "multi-app assigned access") **Normal mode** runs a full version of Microsoft Edge, although some features may not work depending on what apps are configured in assigned access. For example, if the Microsoft Store is not set up, users cannot get books. -![normal mode](images/Normal_inFrame.png "normal mode") +![normal mode.](images/Normal_inFrame.png "normal mode") Learn more about [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-edge-kiosk-mode-deploy). @@ -224,7 +224,7 @@ Learn more about [Microsoft Edge kiosk mode](/microsoft-edge/deploy/microsoft-ed We added a dropdown that displays as you type to help complete the next part of the path. You can also press **Ctrl + Backspace** to delete the last word, and **Ctrl + Delete** to delete the next word. -![Registry editor dropdown](images/regeditor.png "Registry editor dropdown") +![Registry editor dropdown.](images/regeditor.png "Registry editor dropdown") ## Faster sign-in to a Windows 10 shared pc @@ -237,7 +237,7 @@ Do you have shared devices deployed in your work place? **Fast sign-in** enables 3. Sign-in to a shared PC with your account. You'll notice the difference! - ![fast sign-in](images/fastsignin.png "fast sign-in") + ![fast sign-in.](images/fastsignin.png "fast sign-in") >[!NOTE] >This is a private preview feature and therefore not meant or recommended for production purposes. @@ -259,7 +259,7 @@ Until now, Windows logon only supported the use of identities federated to ADFS 4. Click the **Sign in** button to continue. > [!div class="mx-imgBorder"] - > ![Web sign-in](images/websignin.png "web sign-in") + > ![Web sign-in.](images/websignin.png "web sign-in") >[!NOTE] >This is a private preview feature and therefore not meant or recommended for production purposes. @@ -271,7 +271,7 @@ Android phone users, you can finally stop emailing yourself photos. With Your Ph For iPhone users, **Your Phone** app also helps you to link your phone to your PC. Surf the web on your phone, then send the webpage instantly to your computer to continue what you’re doing–-read, watch, or browse-- with all the benefits of a bigger screen. > [!div class="mx-imgBorder"] -> ![your phone](images/your-phone.png "your phone") +> ![your phone.](images/your-phone.png "your phone") The desktop pin takes you directly to the **Your Phone** app for quicker access to your phone’s content. You can also go through the all apps list in Start, or use the Windows key and search for **Your Phone**. @@ -283,7 +283,7 @@ One of the things we’ve heard from you is that it’s hard to know when you’ * Video mode increases the screen-to-screen latency to ensure the video on the big screen plays back smoothly * Productivity modes strikes a balance between game mode and video mode; the screen-to screen-latency is responsive enough that typing feels natural, while ensuring videos don’t glitch as often. -![wireless projection banner](images/beaming.png "wireless projection banner") +![wireless projection banner.](images/beaming.png "wireless projection banner") ## Remote Desktop with Biometrics @@ -293,6 +293,6 @@ To get started, sign into your device using Windows Hello for Business. Bring up See the following example: -![Enter your credentials](images/RDPwBioTime.png "Windows Hello") -![Enter your credentials](images/RDPwBio2.png "Windows Hello personal") -![Microsoft Hyper-V Server 2016](images/hyper-v.png "Microsoft Hyper-V Server 2016") +![Enter your credentials.](images/RDPwBioTime.png "Windows Hello") +![Enter your credentials.](images/RDPwBio2.png "Windows Hello personal") +![Microsoft Hyper-V Server 2016.](images/hyper-v.png "Microsoft Hyper-V Server 2016") diff --git a/windows/whats-new/whats-new-windows-10-version-1903.md b/windows/whats-new/whats-new-windows-10-version-1903.md index 371bf97c95..74eb1725e2 100644 --- a/windows/whats-new/whats-new-windows-10-version-1903.md +++ b/windows/whats-new/whats-new-windows-10-version-1903.md @@ -125,7 +125,7 @@ The draft release of the [security configuration baseline settings](/archive/blo This new feature is displayed under the Device Security page with the string “Your device exceeds the requirements for enhanced hardware security” if configured properly: -![System Guard](images/system-guard.png "SMM Firmware Measurement") +![System Guard.](images/system-guard.png "SMM Firmware Measurement") ### Identity Protection diff --git a/windows/whats-new/whats-new-windows-10-version-2004.md b/windows/whats-new/whats-new-windows-10-version-2004.md index ac0d4984f2..692871b1c3 100644 --- a/windows/whats-new/whats-new-windows-10-version-2004.md +++ b/windows/whats-new/whats-new-windows-10-version-2004.md @@ -43,7 +43,7 @@ In this release, [Windows Defender System Guard](/windows/security/threat-prote With this improvement, the OS can detect a higher level of SMM compliance, enabling devices to be even more hardened against SMM exploits and vulnerabilities. This feature is forward-looking and currently requires new hardware available soon. - ![System Guard](images/system-guard2.png) + ![System Guard.](images/system-guard2.png) ### Windows Defender Application Guard From 211e1eb553c1e1f0ab815612fd6ee081ead7da7a Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 27 Aug 2021 10:16:06 -0700 Subject: [PATCH 0127/1214] Update policy-csp-settings.md --- windows/client-management/mdm/policy-csp-settings.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 4a109d3361..75491097c1 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -177,6 +177,9 @@ The following list shows the supported values: Allows the user to change Data Sense settings. +> [!NOTE] +> This policy is not supported on Windows 10, version 2004 and later. + The following list shows the supported values: From cabc06b7e02f04c2b5084b17f0ef8d70ae064c06 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 27 Aug 2021 10:18:43 -0700 Subject: [PATCH 0128/1214] Update policy-csp-settings.md --- windows/client-management/mdm/policy-csp-settings.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 75491097c1..7152934f2d 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -178,7 +178,7 @@ The following list shows the supported values: Allows the user to change Data Sense settings. > [!NOTE] -> This policy is not supported on Windows 10, version 2004 and later. +> The **AllowDataSense** policy is not supported on Windows 10, version 2004 and later. From 075cbe27a52e03b16f96d6b0c27e22bb2645ebc6 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 27 Aug 2021 11:34:25 -0700 Subject: [PATCH 0129/1214] Update quick-fixes.md --- windows/deployment/upgrade/quick-fixes.md | 71 ----------------------- 1 file changed, 71 deletions(-) diff --git a/windows/deployment/upgrade/quick-fixes.md b/windows/deployment/upgrade/quick-fixes.md index 8aafc8f67d..d9c4e34fd7 100644 --- a/windows/deployment/upgrade/quick-fixes.md +++ b/windows/deployment/upgrade/quick-fixes.md @@ -39,7 +39,6 @@ The Microsoft Virtual Agent provided by [Microsoft Support](https://support.micr
  • Check the system drive for errors and attempt repairs. More information.
  • Run the Windows Update troubleshooter. More information.
  • Attempt to restore and repair system files. More information.
  • -
  • Check for unsigned drivers and update or repair them. More information.
  • Update Windows so that all available recommended updates are installed, and ensure the computer is rebooted if this is necessary to complete installation of an update. More information.
  • Temporarily uninstall non-Microsoft antivirus software. More information.
  • @@ -156,76 +155,6 @@ To check and repair system files: > [!NOTE] > It may take several minutes for the command operations to be completed. For more information, see [Repair a Windows Image](/windows-hardware/manufacture/desktop/repair-a-windows-image) and [Use the System File Checker tool](https://support.microsoft.com/help/929833/use-the-system-file-checker-tool-to-repair-missing-or-corrupted-system). - -### Repair unsigned drivers - -[Drivers](/windows-hardware/drivers/gettingstarted/what-is-a-driver-) are files ending in *.dll or *.sys that are used to communicate with hardware components. Because drivers are so important, they are cryptographically signed to ensure they are genuine. Drivers with a *.sys extension that are not properly signed frequently block the upgrade process. Drivers might not be properly signed if you: -- Disabled driver signature verification (highly not recommended). -- A catalog file used to sign a driver is corrupt or missing. - - Catalog files (files with a *.cat extension) are used to sign drivers. If a catalog file is corrupt or missing, the driver will appear to be unsigned, even though it should be signed. To restore the catalog file, reinstall the driver or copy the catalog file from another device. You might need to analyze another device to determine the catalog file that is associated with the unsigned driver. All drivers should be signed to ensure the upgrade process works. - -To check your system for unsigned drivers: - -1. Click **Start**. -2. Type **command**. -3. Right-click **Command Prompt** and then left-click **Run as administrator**. -4. If you are prompted by UAC, click **Yes**. -5. Type **sigverif** and press ENTER. -6. The File Signature Verification tool will open. Click **Start**. - - ![File Signature Verification.](../images/sigverif.png) - -7. After the scanning process is complete, if you see **Your files have been scanned and verified as digitally signed** then you have no unsigned drivers. Otherwise, you will see **The following files have not been digitally signed** and a list will be provided with name, location, and version of all unsigned drivers. -8. To view and save a log file, click **Advanced**, and then click **View Log**. Save the log file if desired. -9. Locate drivers in the log file that are unsigned, write down the location and file names. Also write down the catalog that is associated to the driver if it is provided. If the name of a catalog file is not provided you might need to analyze another device that has the same driver with sigverif and sigcheck (described below). -10. The next step is to check that the driver reported as unsigned by sigverif.exe has a problem. In some cases, sigverif.exe might not be successful at locating the catalog file used to sign a driver, even though the catalog file exists. To perform a detailed driver check, download [sigcheck.zip](https://download.sysinternals.com/files/Sigcheck.zip) and extract the tool to a directory on your computer, for example: **C:\sigcheck**. - - [Sigcheck](/sysinternals/downloads/sigcheck) is a tool that you can download and use to review digital signature details of a file. To use sigcheck: - -11. In the command window, use the **cd** command to switch to the directory where you extracted sigcheck, for example **cd c:\sigcheck**. -12. Using the list of unsigned drivers and their associated paths that you obtained from the File Signature Verification tool, run sigcheck to obtain details about the driver, including the catalog file used for signing. Type **sigcheck64 -i \** and press ENTER (or sigcheck -i for a 32 bit OS). See the following example: - ``` - C:\Sigcheck>sigcheck64.exe -i c:\windows\system32\drivers\afd.sys - - Sigcheck v2.80 - File version and signature viewer - Copyright (C) 2004-2020 Mark Russinovich - Sysinternals - www.sysinternals.com - - c:\windows\system32\drivers\afd.sys: - Verified: Signed - Signing date: 6:18 PM 11/29/2017 - Signing date: 6:18 PM 11/29/2017 - Catalog: C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Package_163_for_KB4054518~31bf3856ad364e35~x86~~6.1.1.2.cat - Signers: - Microsoft Windows - Cert Status: This certificate or one of the certificates in the certificate chain is not time valid. - Valid Usage: NT5 Crypto, Code Signing - Cert Issuer: Microsoft Windows Verification PCA - Serial Number: 33 00 00 00 4B 76 63 2D 24 A2 39 9A 8B 00 01 00 00 00 4B - Thumbprint: B8037C46D0DB7A8CEE502407469B0EE3234D3365 - Algorithm: sha1RSA - Valid from: 11:46 AM 3/1/2017 - Valid to: 11:46 AM 5/9/2018 - (output truncated) - ``` - In the example above, the afd.sys driver is properly signed by the catalog file Package_163_for_KB4054518~31bf3856ad364e35~x86~~6.1.1.2.cat. - - -13. Optionally, you can generate a list of drivers using driverquery.exe, which is included with Windows. To save a list of signed and unsigned drivers with driverquery, type **driverquery /si > c:\drivers.txt** and press ENTER. See the following example: - - ```cmd - C:\>Driverquery /si - - DeviceName InfName IsSigned Manufacturer - ============================== ============= ======== ========================= - Microsoft ISATAP Adapter nettun.inf TRUE Microsoft - Generic volume shadow copy volsnap.inf TRUE Microsoft - Generic volume volume.inf TRUE Microsoft - (truncated) - ``` - For more information about using driverquery, see [Two Minute Drill: DriverQuery.exe](https://techcommunity.microsoft.com/t5/ask-the-performance-team/two-minute-drill-driverquery-exe/ba-p/374977) and [driverquery](/windows-server/administration/windows-commands/driverquery). - ### Update Windows You should ensure that all important updates are installed before attempting to upgrade. This includes updates to hardware drivers on your computer. From 6e52b7eeecd44c49dc03fab2bd3c0b842d68e7ab Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 27 Aug 2021 11:41:32 -0700 Subject: [PATCH 0130/1214] remove link --- windows/deployment/upgrade/resolution-procedures.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/upgrade/resolution-procedures.md b/windows/deployment/upgrade/resolution-procedures.md index 926355e4cc..9752ac670c 100644 --- a/windows/deployment/upgrade/resolution-procedures.md +++ b/windows/deployment/upgrade/resolution-procedures.md @@ -36,7 +36,7 @@ A frequently observed [result code](upgrade-error-codes.md#result-codes) is 0xC1 The device install log is particularly helpful if rollback occurs during the sysprep operation (extend code 0x30018). -To resolve a rollback that was caused by driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/kb/929135) before initiating the upgrade process. Also check to be sure that your drivers are properly signed. For more information, see [Remove unsigned drivers](quick-fixes.md#repair-unsigned-drivers). +To resolve a rollback that was caused by driver conflicts, try running setup using a minimal set of drivers and startup programs by performing a [clean boot](https://support.microsoft.com/kb/929135) before initiating the upgrade process. See the following general troubleshooting procedures associated with a result code of 0xC1900101:

    @@ -49,7 +49,7 @@ See the following general troubleshooting procedures associated with a result co | 0xC1900101 - 0x30018 | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Contact your hardware vendor to obtain updated device drivers.
    Ensure that "Download and install updates (recommended)" is accepted at the start of the upgrade process. | A device driver has stopped responding to setup.exe during the upgrade process. | | 0xC1900101 - 0x3000D | Disconnect all peripheral devices that are connected to the system, except for the mouse, keyboard and display.
    Update or uninstall the display driver. | Installation failed during the FIRST_BOOT phase while attempting the MIGRATE_DATA operation.
    This can occur due to a problem with a display driver. | | 0xC1900101 - 0x4000D | Check supplemental rollback logs for a setupmem.dmp file, or event logs for any unexpected reboots or errors.
    Review the rollback log and determine the stop code.
    The rollback log is located in the $Windows.~BT\Sources\Rollback folder. An example analysis is shown below. This example is not representative of all cases:
     
    Info SP Crash 0x0000007E detected
    Info SP Module name :
    Info SP Bugcheck parameter 1 : 0xFFFFFFFFC0000005
    Info SP Bugcheck parameter 2 : 0xFFFFF8015BC0036A
    Info SP Bugcheck parameter 3 : 0xFFFFD000E5D23728
    Info SP Bugcheck parameter 4 : 0xFFFFD000E5D22F40
    Info SP Cannot recover the system.
    Info SP Rollback: Showing splash window with restoring text: Restoring your previous version of Windows.
     
    Typically, there is a dump file for the crash to analyze. If you are not equipped to debug the dump, then attempt the following basic troubleshooting procedures:
     
    1. Make sure you have enough disk space.
    2. If a driver is identified in the bug check message, disable the driver or check with the manufacturer for driver updates.
    3. Try changing video adapters.
    4. Check with your hardware vendor for any BIOS updates.
    5. Disable BIOS memory options such as caching or shadowing. | A rollback occurred due to a driver configuration issue.
    Installation failed during the second boot phase while attempting the MIGRATE_DATA operation.
    This can occur because of incompatible drivers. | -| 0xC1900101 - 0x40017 | Clean boot into Windows, and then attempt the upgrade to Windows 10. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135).
     
    Ensure that you select the option to "Download and install updates (recommended)." Also be sure to [remove unsigned drivers](quick-fixes.md#repair-unsigned-drivers).
     
    Computers that run Citrix VDA
    You may see this message after you upgrade a computer from Windows 10, version 1511 to Windows 10, version 1607. After the second system restart, the system generates this error and then rolls back to the previous version. This problem has also been observed in upgrades to Windows 8.1 and Windows 8.
     
    This problem occurs because the computer has Citrix Virtual Delivery Agent (VDA) installed. Citrix VDA installs device drivers and a file system filter driver (CtxMcsWbc). This Citrix filter driver prevents the upgrade from writing changes to the disk, so the upgrade cannot complete and the system rolls back.
     
    **Resolution**
     
    To resolve this problem, install [Cumulative update for Windows 10 Version 1607 and Windows Server 2016: November 8, 2016](https://support.microsoft.com/help/3200970/cumulative-update-for-windows-10-version-1607-and-windows-server-2016).
     
    You can work around this problem in two ways:
     
    **Workaround 1**
     
    1. Use the VDA setup application (VDAWorkstationSetup_7.11) to uninstall Citrix VDA.
    2. Run the Windows upgrade again.
    3. Reinstall Citrix VDA.
     
    **Workaround 2**
     
    If you cannot uninstall Citrix VDA, follow these steps to work around this problem:
     
    1. In Registry Editor, go to the following subkey:
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\CtxMcsWbc**
    2. Change the value of the **Start** entry from **0** to **4**. This change disables the Citrix MCS cache service.
    3. Go to the following subkey:
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}**
    4. Delete the **CtxMcsWbc** entry.
    5. Restart the computer, and then try the upgrade again.
     
    **Non-Microsoft information disclaimer**
    The non-Microsoft products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. | Windows 10 upgrade failed after the second reboot.
    This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. | +| 0xC1900101 - 0x40017 | Clean boot into Windows, and then attempt the upgrade to Windows 10. For more information, see [How to perform a clean boot in Windows](https://support.microsoft.com/kb/929135).
    Ensure that you select the option to "Download and install updates (recommended)."
     
    Computers that run Citrix VDA
    You may see this message after you upgrade a computer from Windows 10, version 1511 to Windows 10, version 1607. After the second system restart, the system generates this error and then rolls back to the previous version. This problem has also been observed in upgrades to Windows 8.1 and Windows 8.
     
    This problem occurs because the computer has Citrix Virtual Delivery Agent (VDA) installed. Citrix VDA installs device drivers and a file system filter driver (CtxMcsWbc). This Citrix filter driver prevents the upgrade from writing changes to the disk, so the upgrade cannot complete and the system rolls back.
     
    **Resolution**
     
    To resolve this problem, install [Cumulative update for Windows 10 Version 1607 and Windows Server 2016: November 8, 2016](https://support.microsoft.com/help/3200970/cumulative-update-for-windows-10-version-1607-and-windows-server-2016).
     
    You can work around this problem in two ways:
     
    **Workaround 1**
     
    1. Use the VDA setup application (VDAWorkstationSetup_7.11) to uninstall Citrix VDA.
    2. Run the Windows upgrade again.
    3. Reinstall Citrix VDA.
     
    **Workaround 2**
     
    If you cannot uninstall Citrix VDA, follow these steps to work around this problem:
     
    1. In Registry Editor, go to the following subkey:
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}\CtxMcsWbc**
    2. Change the value of the **Start** entry from **0** to **4**. This change disables the Citrix MCS cache service.
    3. Go to the following subkey:
    **HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Class\{4d36e967-e325-11ce-bfc1-08002be10318}**
    4. Delete the **CtxMcsWbc** entry.
    5. Restart the computer, and then try the upgrade again.
     
    **Non-Microsoft information disclaimer**
    The non-Microsoft products that this article discusses are manufactured by companies that are independent of Microsoft. Microsoft makes no warranty, implied or otherwise, about the performance or reliability of these products. | Windows 10 upgrade failed after the second reboot.
    This is usually caused by a faulty driver. For example: antivirus filter drivers or encryption drivers. | ## 0x800xxxxx From e290767023c698f17082d5fdda56953c4d7fd112 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 27 Aug 2021 12:01:19 -0700 Subject: [PATCH 0131/1214] tweaks --- .../upgrade/resolve-windows-10-upgrade-errors.md | 2 +- .../deployment/upgrade/troubleshoot-upgrade-errors.md | 9 ++++++--- 2 files changed, 7 insertions(+), 4 deletions(-) diff --git a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md index b22dd3682c..24ed5c4e2b 100644 --- a/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md +++ b/windows/deployment/upgrade/resolve-windows-10-upgrade-errors.md @@ -25,7 +25,7 @@ ms.topic: article This article contains a brief introduction to Windows 10 installation processes, and provides resolution procedures that IT administrators can use to resolve issues with Windows 10 upgrade. -The article was originally one page, but has been divided into sub-topics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. +The article has been divided into sub-topics of different technical levels. Basic level provides common procedures that can resolve several types of upgrade errors. Advanced level requires some experience with detailed troubleshooting methods. The following four levels are assigned: diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index bdb7e4814a..aa3ccead81 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -20,12 +20,15 @@ ms.topic: article **Applies to** - Windows 10 ->[!NOTE] ->This is a 300 level topic (moderately advanced).
    ->See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. +> [!NOTE] +> This is a 300 level topic (moderately advanced).
    +> See [Resolve Windows 10 upgrade errors](resolve-windows-10-upgrade-errors.md) for a full list of topics in this article. If a Windows 10 upgrade is not successful, it can be very helpful to understand *when* an error occurred in the upgrade process. +> [!IMPORTANT] +> Use the [SetupDiag](setupdiag.md) tool before you begin manually troubleshooting an upgrade error. SetupDiag automates log file analysis, detecting and reporting details on many different types of known upgrade issues. + Briefly, the upgrade process consists of four phases that are controlled by [Windows Setup](/windows-hardware/manufacture/desktop/windows-setup-technical-reference): **Downlevel**, **SafeOS**, **First boot**, and **Second boot**. The computer will reboot once between each phase. Note: Progress is tracked in the registry during the upgrade process using the following key: **HKLM\System\Setup\mosetup\volatile\SetupProgress**. This key is volatile and only present during the upgrade process; it contains a binary value in the range 0-100. These phases are explained in greater detail [below](#the-windows-10-upgrade-process). First, let's summarize the actions performed during each phase because this affects the type of errors that can be encountered. From ccda6e6778f7ad2a143995ff58cd58798d418273 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 27 Aug 2021 12:05:07 -0700 Subject: [PATCH 0132/1214] alt text --- windows/deployment/upgrade/troubleshoot-upgrade-errors.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md index aa3ccead81..d8183e1f62 100644 --- a/windows/deployment/upgrade/troubleshoot-upgrade-errors.md +++ b/windows/deployment/upgrade/troubleshoot-upgrade-errors.md @@ -76,11 +76,11 @@ When performing an operating system upgrade, Windows Setup uses phases described At the end of the second boot phase, the **Welcome to Windows 10** screen is displayed, preferences are configured, and the Windows 10 sign-in prompt is displayed. - ![second boot phase.](../images/secondboot.png) + ![second boot phase 1](../images/secondboot.png) - ![second boot phase.](../images/secondboot2.png) + ![second boot phase 2](../images/secondboot2.png) - ![second boot phase.](../images/secondboot3.png) + ![second boot phase 3](../images/secondboot3.png) 5. **Uninstall phase**: This phase occurs if upgrade is unsuccessful (image not shown). Example error codes: 0x50000, 0x50015. From 7c48aa5062c1c8c73e0d1f79034975a7d86de068 Mon Sep 17 00:00:00 2001 From: David Strome Date: Fri, 27 Aug 2021 15:09:49 -0700 Subject: [PATCH 0133/1214] remove disallowed html attributes --- .../ie11-deploy-guide/img-ie11-docmode-lg.md | 2 +- .../educator-tib-get-started.md | 2 +- education/trial-in-a-box/index.md | 2 +- .../trial-in-a-box/itadmin-tib-get-started.md | 2 +- .../windows/chromebook-migration-guide.md | 2 +- ...e-active-directory-integration-with-mdm.md | 440 +++++++-------- .../mdm/cellularsettings-csp.md | 4 +- .../change-history-for-mdm-documentation.md | 304 +++++------ windows/client-management/mdm/cleanpc-csp.md | 10 +- .../mdm/cm-cellularentries-csp.md | 78 +-- .../mdm/developersetup-csp.md | 34 +- .../mdm/device-update-management.md | 266 +++++----- .../mdm/dmprocessconfigxmlfiltered.md | 52 +- .../mdm/dmsessionactions-csp.md | 34 +- .../mdm/dynamicmanagement-csp.md | 44 +- .../mdm/enterpriseapn-csp.md | 70 +-- .../mdm/enterpriseappvmanagement-csp.md | 80 +-- .../mdm/enterpriseextfilessystem-csp.md | 20 +- windows/client-management/mdm/firewall-csp.md | 260 ++++----- .../mdm/healthattestation-csp.md | 500 +++++++++--------- ...ent-tool-for-windows-store-for-business.md | 8 +- .../client-management/mdm/messaging-csp.md | 28 +- .../mdm/mobile-device-enrollment.md | 126 ++--- .../mdm/networkqospolicy-csp.md | 56 +- .../mdm/oma-dm-protocol-support.md | 138 ++--- .../mdm/personalization-csp.md | 18 +- .../policy-configuration-service-provider.md | 58 +- .../mdm/policy-csp-devicelock.md | 26 +- .../mdm/policy-csp-system.md | 18 +- .../mdm/policy-csp-update.md | 26 +- windows/client-management/mdm/reboot-csp.md | 22 +- .../client-management/mdm/remotelock-csp.md | 2 +- .../client-management/mdm/surfacehub-csp.md | 214 ++++---- .../client-management/mdm/tpmpolicy-csp.md | 4 +- windows/client-management/mdm/update-csp.md | 96 ++-- .../windowsadvancedthreatprotection-csp.md | 68 +-- windows/configuration/kiosk-single-app.md | 16 +- .../provisioning-configure-mobile.md | 8 +- .../provision-pcs-for-initial-deployment.md | 12 +- ...anging-the-frequency-of-scheduled-tasks.md | 2 +- windows/deployment/mbr-to-gpt.md | 2 +- windows/deployment/upgrade/log-files.md | 8 +- .../deployment/upgrade/upgrade-error-codes.md | 84 +-- .../usmt/offline-migration-reference.md | 4 +- .../usmt/understanding-migration-xml-files.md | 6 +- .../usmt/usmt-conflicts-and-precedence.md | 6 +- .../usmt/usmt-custom-xml-examples.md | 14 +- .../usmt/usmt-xml-elements-library.md | 2 +- .../windows-10-deployment-scenarios.md | 58 +- windows/deployment/windows-10-poc-mdt.md | 6 +- windows/deployment/windows-10-poc.md | 122 ++--- .../demonstrate-deployment-on-vm.md | 2 +- .../threat-protection/fips-140-validation.md | 288 +++++----- .../document-your-applocker-rules.md | 2 +- .../plan-for-applocker-policy-management.md | 2 +- ...ements-for-deploying-applocker-policies.md | 2 +- 56 files changed, 1880 insertions(+), 1880 deletions(-) diff --git a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md index 30de0a2c97..a285c99103 100644 --- a/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md +++ b/browsers/internet-explorer/ie11-deploy-guide/img-ie11-docmode-lg.md @@ -16,7 +16,7 @@ ms.author: dansimp Return to: [Deprecated document modes and Internet Explorer 11](deprecated-document-modes.md)
    -

    +

    Full-sized flowchart detailing how document modes are chosen in IE11

    diff --git a/education/trial-in-a-box/educator-tib-get-started.md b/education/trial-in-a-box/educator-tib-get-started.md index bbf1be6015..92cf989109 100644 --- a/education/trial-in-a-box/educator-tib-get-started.md +++ b/education/trial-in-a-box/educator-tib-get-started.md @@ -20,7 +20,7 @@ manager: dansimp ![Welcome, Educators!](images/Welocme-Educators.png) -This guide shows you how to quickly and easily try a few transformational tools from Microsoft Education in 5 quick steps. +This guide shows you how to quickly and easily try a few transformational tools from Microsoft Education in 5 quick steps. | Tool | Description | | :---: |:--- | diff --git a/education/trial-in-a-box/index.md b/education/trial-in-a-box/index.md index 5f1c865bce..2ea43581c9 100644 --- a/education/trial-in-a-box/index.md +++ b/education/trial-in-a-box/index.md @@ -30,7 +30,7 @@ Welcome to Microsoft Education Trial in a Box. We built this trial to make it ea | [![Get started for Educators.](images/teacher_rotated_resized.png)](educator-tib-get-started.md) | [![Get started for IT Admins](images/itadmin_rotated_resized.png)](itadmin-tib-get-started.md) | | :---: | :---: | -| **Educator**
    Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills.
    [Get started](educator-tib-get-started.md) | **IT Admin**
    Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage.
    [Get started](itadmin-tib-get-started.md) | +| **Educator**
    Enhance students of all abilities by unleashing their creativity, collaboration, and improving problem-solving skills.
    [Get started](educator-tib-get-started.md) | **IT Admin**
    Quickly implement and deploy a full cloud infrastructure that's secure and easy to manage.
    [Get started](itadmin-tib-get-started.md) | diff --git a/education/trial-in-a-box/itadmin-tib-get-started.md b/education/trial-in-a-box/itadmin-tib-get-started.md index d0ba6a05b3..911f893986 100644 --- a/education/trial-in-a-box/itadmin-tib-get-started.md +++ b/education/trial-in-a-box/itadmin-tib-get-started.md @@ -20,7 +20,7 @@ manager: dansimp ![Welcome, IT Admins!](images/Welcome-IT-Admins.png) -Learn how to quickly deploy and manage devices for your school in 5 quick steps. +Learn how to quickly deploy and manage devices for your school in 5 quick steps. |  |  | | :---: |:--- | diff --git a/education/windows/chromebook-migration-guide.md b/education/windows/chromebook-migration-guide.md index d927aef072..2fb2324ddc 100644 --- a/education/windows/chromebook-migration-guide.md +++ b/education/windows/chromebook-migration-guide.md @@ -497,7 +497,7 @@ Table 6 is a decision matrix that lists the device, user, and app management pro Table 6. Device, user, and app management products and technologies -
    +
    diff --git a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md index 97f22aae88..a65935c948 100644 --- a/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md +++ b/windows/client-management/mdm/azure-active-directory-integration-with-mdm.md @@ -195,24 +195,24 @@ The following table shows the required information to create an entry in the Azu - - + + - - + + - - + + - - + + - - + +

    Application ID

    The client ID of your MDM app that is configured within your tenant. This is the unique identifier for your multi-tenant app.

    Application ID

    The client ID of your MDM app that is configured within your tenant. This is the unique identifier for your multi-tenant app.

    Publisher

    A string that identifies the publisher of the app.

    Publisher

    A string that identifies the publisher of the app.

    Application URL

    A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL is not used for the actual enrollment.

    Application URL

    A URL to the landing page of your app where your administrators can get more information about the MDM app and contains a link to the landing page of your app. This URL is not used for the actual enrollment.

    Description

    A brief description of your MDM app, which must be under 255 characters.

    Description

    A brief description of your MDM app, which must be under 255 characters.

    Icons

    A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215

    Icons

    A set of logo icons for the MDM app. Dimensions: 45 X 45, 150 X 122, 214 X 215

    @@ -261,19 +261,19 @@ An MDM page must adhere to a predefined theme depending on the scenario that is -FRX -OOBE -Dark theme + blue background color -Filename: Ui-dark.css -Filename: oobe-dekstop.css +FRX +OOBE +Dark theme + blue background color +Filename: Ui-dark.css +Filename: oobe-dekstop.css -MOSET -Settings/ +MOSET +Settings/

    Post OOBE

    -Light theme -Filename: Ui-light.css -Filename: settings-desktop.css +Light theme +Filename: Ui-light.css +Filename: settings-desktop.css @@ -302,20 +302,20 @@ The following parameters are passed in the query string: -

    redirect_uri

    -

    After the user accepts or rejects the Terms of Use, the user is redirected to this URL.

    +

    redirect_uri

    +

    After the user accepts or rejects the Terms of Use, the user is redirected to this URL.

    -

    client-request-id

    -

    A GUID that is used to correlate logs for diagnostic and debugging purposes. You use this parameter to log or trace the state of the enrollment request to help find the root cause in case of failures.

    +

    client-request-id

    +

    A GUID that is used to correlate logs for diagnostic and debugging purposes. You use this parameter to log or trace the state of the enrollment request to help find the root cause in case of failures.

    -

    api-version

    -

    Specifies the version of the protocol requested by the client. This provides a mechanism to support version revisions of the protocol.

    +

    api-version

    +

    Specifies the version of the protocol requested by the client. This provides a mechanism to support version revisions of the protocol.

    -

    mode

    -

    Specifies that the device is corporate owned when mode=azureadjoin. This parameter is not present for BYOD devices.

    +

    mode

    +

    Specifies that the device is corporate owned when mode=azureadjoin. This parameter is not present for BYOD devices.

    @@ -342,20 +342,20 @@ The following claims are expected in the access token passed by Windows to the T -

    Object ID

    -

    Identifier of the user object corresponding to the authenticated user.

    +

    Object ID

    +

    Identifier of the user object corresponding to the authenticated user.

    -

    UPN

    -

    A claim containing the user principal name (UPN) of the authenticated user.

    +

    UPN

    +

    A claim containing the user principal name (UPN) of the authenticated user.

    -

    TID

    -

    A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.

    +

    TID

    +

    A claim representing the tenant ID of the tenant. In the example above, it's Fabrikam.

    -

    Resource

    -

    A sanitized URL representing the MDM application. Example, https://fabrikam.contosomdm.com.

    +

    Resource

    +

    A sanitized URL representing the MDM application. Example, https://fabrikam.contosomdm.com.

    @@ -438,28 +438,28 @@ The following table shows the error codes. -

    api-version

    -

    302

    -

    invalid_request

    -

    unsupported version

    +

    api-version

    +

    302

    +

    invalid_request

    +

    unsupported version

    -

    Tenant or user data are missing or other required prerequisites for device enrollment are not met

    -

    302

    -

    unauthorized_client

    -

    unauthorized user or tenant

    +

    Tenant or user data are missing or other required prerequisites for device enrollment are not met

    +

    302

    +

    unauthorized_client

    +

    unauthorized user or tenant

    -

    Azure AD token validation failed

    -

    302

    -

    unauthorized_client

    -

    unauthorized_client

    +

    Azure AD token validation failed

    +

    302

    +

    unauthorized_client

    +

    unauthorized_client

    -

    internal service error

    -

    302

    -

    server_error

    -

    internal service error

    +

    internal service error

    +

    302

    +

    server_error

    +

    internal service error

    @@ -486,104 +486,104 @@ With Azure integrated MDM enrollment, there is no discovery phase and the discov -

    MDM auto-discovery using email address to retrieve MDM discovery URL

    -

    Enrollment

    -

    Not applicable

    +

    MDM auto-discovery using email address to retrieve MDM discovery URL

    +

    Enrollment

    +

    Not applicable

    Discovery URL provisioned in Azure

    -

    +

    -

    Uses MDM discovery URL

    -

    Enrollment

    +

    Uses MDM discovery URL

    +

    Enrollment

    Enrollment renewal

    ROBO

    -

    Enrollment

    +

    Enrollment

    Enrollment renewal

    ROBO

    -

    Enrollment

    +

    Enrollment

    Enrollment renewal

    ROBO

    -

    Is MDM enrollment required?

    -

    Yes

    -

    Yes

    -

    No

    +

    Is MDM enrollment required?

    +

    Yes

    +

    Yes

    +

    No

    User can decline.

    -

    Authentication type

    -

    OnPremise

    +

    Authentication type

    +

    OnPremise

    Federated

    Certificate

    -

    Federated

    -

    Federated

    +

    Federated

    +

    Federated

    -

    EnrollmentPolicyServiceURL

    -

    Optional (all auth)

    -

    Optional (all auth)

    +

    EnrollmentPolicyServiceURL

    +

    Optional (all auth)

    +

    Optional (all auth)

    -

    Optional (all auth)

    +

    Optional (all auth)

    -

    EnrollmentServiceURL

    -

    Required (all auth)

    -

    Used (all auth)

    -

    Used (all auth)

    +

    EnrollmentServiceURL

    +

    Required (all auth)

    +

    Used (all auth)

    +

    Used (all auth)

    -

    EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL

    -

    Highly recommended

    -

    Highly recommended

    -

    Highly recommended

    +

    EnrollmentServiceURL includes OS Version, OS Platform, and other attributes provided by MDM discovery URL

    +

    Highly recommended

    +

    Highly recommended

    +

    Highly recommended

    -

    AuthenticationServiceURL used

    -

    Used (Federated auth)

    -

    Skipped

    -

    Skipped

    +

    AuthenticationServiceURL used

    +

    Used (Federated auth)

    +

    Skipped

    +

    Skipped

    -

    BinarySecurityToken

    -

    Custom per MDM

    -

    Azure AD issued token

    -

    Azure AD issued token

    +

    BinarySecurityToken

    +

    Custom per MDM

    +

    Azure AD issued token

    +

    Azure AD issued token

    -

    EnrollmentType

    -

    Full

    -

    Device

    -

    Full

    +

    EnrollmentType

    +

    Full

    +

    Device

    +

    Full

    -

    Enrolled certificate type

    -

    User certificate

    -

    Device certificate

    -

    User certificate

    +

    Enrolled certificate type

    +

    User certificate

    +

    Device certificate

    +

    User certificate

    -

    Enrolled certificate store

    -

    My/User

    -

    My/System

    -

    My/User

    +

    Enrolled certificate store

    +

    My/User

    +

    My/System

    +

    My/User

    -

    CSR subject name

    -

    User Principal Name

    -

    Device ID

    -

    User Principal Name

    +

    CSR subject name

    +

    User Principal Name

    +

    Device ID

    +

    User Principal Name

    -

    EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL

    -

    Not supported

    -

    Supported

    -

    Supported

    +

    EnrollmentData Terms of Use binary blob as AdditionalContext for EnrollmentServiceURL

    +

    Not supported

    +

    Supported

    +

    Supported

    -

    CSPs accessible during enrollment

    -

    Windows 10 support:

    +

    CSPs accessible during enrollment

    +

    Windows 10 support:

    • DMClient
    • CertificateStore
    • @@ -598,8 +598,8 @@ With Azure integrated MDM enrollment, there is no discovery phase and the discov
      • EnterpriseAppManagement (Windows Phone 8.1)
      -

      same as traditional MDM enrollment

      -

      same as traditional MDM enrollment

      +

      same as traditional MDM enrollment

      +

      same as traditional MDM enrollment

      @@ -751,184 +751,184 @@ When a user is enrolled into MDM through Azure Active Directory Join and then di -0x80180001 -"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x80180001 +"idErrorServerConnectivity", // MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x80180002 -"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180002 +"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_AUTHENTICATION_ERROR +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180003 -"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR -

      This user is not authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180003 +"idErrorAuthorizationFailure", // MENROLL_E_DEVICE_AUTHORIZATION_ERROR +

      This user is not authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180004 -"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR -

      There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180004 +"idErrorMDMCertificateError", // MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR +

      There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180005 -"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x80180005 +"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x80180006 -"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x80180006 +"idErrorServerConnectivity", // MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x80180007 -"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180007 +"idErrorAuthenticationFailure", // MENROLL_E_DEVICE_INVALIDSECURITY_ERROR +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180008 -"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x80180008 +"idErrorServerConnectivity", // MENROLL_E_DEVICE_UNKNOWN_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x80180009 -"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS -

      Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180009 +"idErrorAlreadyInProgress", // MENROLL_E_ENROLLMENT_IN_PROGRESS +

      Another enrollment is in progress. You can try to do this again or contact your system administrator with the error code {0}.

      -0x8018000A -"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED -

      This device is already enrolled. You can contact your system administrator with the error code {0}.

      +0x8018000A +"idErrorMDMAlreadyEnrolled", // MENROLL_E_DEVICE_ALREADY_ENROLLED +

      This device is already enrolled. You can contact your system administrator with the error code {0}.

      -0x8018000D -"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID -

      There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.

      +0x8018000D +"idErrorMDMCertificateError", // MENROLL_E_DISCOVERY_SEC_CERT_DATE_INVALID +

      There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.

      -0x8018000E -"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x8018000E +"idErrorAuthenticationFailure", // MENROLL_E_PASSWORD_NEEDED +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x8018000F -"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x8018000F +"idErrorAuthenticationFailure", // MENROLL_E_WAB_ERROR +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180010 -"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x80180010 +"idErrorServerConnectivity", // MENROLL_E_CONNECTIVITY +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x80180012 -"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT -

      There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180012 +"idErrorMDMCertificateError", // MENROLL_E_INVALIDSSLCERT +

      There was a certificate error. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180013 -"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED -

      Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.

      +0x80180013 +"idErrorDeviceLimit", // MENROLL_E_DEVICECAPREACHED +

      Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.

      -0x80180014 -"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED -

      This feature is not supported. Contact your system administrator with the error code {0}.

      +0x80180014 +"idErrorMDMNotSupported", // MENROLL_E_DEVICENOTSUPPORTED +

      This feature is not supported. Contact your system administrator with the error code {0}.

      -0x80180015 -"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED -

      This feature is not supported. Contact your system administrator with the error code {0}.

      +0x80180015 +"idErrorMDMNotSupported", // MENROLL_E_NOTSUPPORTED +

      This feature is not supported. Contact your system administrator with the error code {0}.

      -0x80180016 -"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW -

      The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180016 +"idErrorMDMRenewalRejected", // MENROLL_E_NOTELIGIBLETORENEW +

      The server did not accept the request. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180017 -"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE -

      The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.

      +0x80180017 +"idErrorMDMAccountMaintenance", // MENROLL_E_INMAINTENANCE +

      The service is in maintenance. You can try to do this again later or contact your system administrator with the error code {0}.

      -0x80180018 -"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE -

      There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180018 +"idErrorMDMLicenseError", // MENROLL_E_USERLICENSE +

      There was an error with your license. You can try to do this again or contact your system administrator with the error code {0}.

      -0x80180019 -"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID -

      Looks like the server is not correctly configured. You can try to do this again or contact your system administrator with the error code {0}.

      +0x80180019 +"idErrorInvalidServerConfig", // MENROLL_E_ENROLLMENTDATAINVALID +

      Looks like the server is not correctly configured. You can try to do this again or contact your system administrator with the error code {0}.

      -"rejectedTermsOfUse" -"idErrorRejectedTermsOfUse" -

      Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.

      +"rejectedTermsOfUse" +"idErrorRejectedTermsOfUse" +

      Your organization requires that you agree to the Terms of Use. Please try again or ask your support person for more information.

      -0x801c0001 -"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x801c0001 +"idErrorServerConnectivity", // DSREG_E_DEVICE_MESSAGE_FORMAT_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x801c0002 -"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x801c0002 +"idErrorAuthenticationFailure", // DSREG_E_DEVICE_AUTHENTICATION_ERROR +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x801c0003 -"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR -

      This user is not authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.

      +0x801c0003 +"idErrorAuthorizationFailure", // DSREG_E_DEVICE_AUTHORIZATION_ERROR +

      This user is not authorized to enroll. You can try to do this again or contact your system administrator with the error code {0}.

      -0x801c0006 -"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x801c0006 +"idErrorServerConnectivity", // DSREG_E_DEVICE_INTERNALSERVICE_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x801c000B -"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED -The server being contacted is not trusted. Contact your system administrator with the error code {0}. +0x801c000B +"idErrorUntrustedServer", // DSREG_E_DISCOVERY_REDIRECTION_NOT_TRUSTED +The server being contacted is not trusted. Contact your system administrator with the error code {0}. -0x801c000C -"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x801c000C +"idErrorServerConnectivity", // DSREG_E_DISCOVERY_FAILED +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x801c000E -"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED -

      Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.

      +0x801c000E +"idErrorDeviceLimit", // DSREG_E_DEVICE_REGISTRATION_QUOTA_EXCCEEDED +

      Looks like there are too many devices or users for this account. Contact your system administrator with the error code {0}.

      -0x801c000F -"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT -

      A reboot is required to complete device registration.

      +0x801c000F +"idErrorDeviceRequiresReboot", // DSREG_E_DEVICE_REQUIRES_REBOOT +

      A reboot is required to complete device registration.

      -0x801c0010 -"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR -

      Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.

      +0x801c0010 +"idErrorInvalidCertificate", // DSREG_E_DEVICE_AIK_VALIDATION_ERROR +

      Looks like you have an invalid certificate. Contact your system administrator with the error code {0}.

      -0x801c0011 -"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x801c0011 +"idErrorAuthenticationFailure", // DSREG_E_DEVICE_ATTESTATION_ERROR +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x801c0012 -"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR -

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      +0x801c0012 +"idErrorServerConnectivity", // DSREG_E_DISCOVERY_BAD_MESSAGE_ERROR +

      There was an error communicating with the server. You can try to do this again or contact your system administrator with the error code {0}

      -0x801c0013 -"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x801c0013 +"idErrorAuthenticationFailure", // DSREG_E_TENANTID_NOT_FOUND +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      -0x801c0014 -"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND -

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      +0x801c0014 +"idErrorAuthenticationFailure", // DSREG_E_USERSID_NOT_FOUND +

      There was a problem authenticating your account or device. You can try to do this again or contact your system administrator with the error code {0}.

      diff --git a/windows/client-management/mdm/cellularsettings-csp.md b/windows/client-management/mdm/cellularsettings-csp.md index ab4cb97c8f..e493bf16e1 100644 --- a/windows/client-management/mdm/cellularsettings-csp.md +++ b/windows/client-management/mdm/cellularsettings-csp.md @@ -24,9 +24,9 @@ The following image shows the CellularSettings CSP in tree format as used by Ope ![provisioning for cellular settings.](images/provisioning-csp-cellularsettings.png) **DataRoam** -

      Optional. Integer. Specifies the default roaming value. Valid values are:

      +

      Optional. Integer. Specifies the default roaming value. Valid values are:

      -
      +
      diff --git a/windows/client-management/mdm/change-history-for-mdm-documentation.md b/windows/client-management/mdm/change-history-for-mdm-documentation.md index 5f319c9900..9a5f7e4425 100644 --- a/windows/client-management/mdm/change-history-for-mdm-documentation.md +++ b/windows/client-management/mdm/change-history-for-mdm-documentation.md @@ -192,32 +192,32 @@ This article lists new and updated articles for the Mobile Device Management (MD - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - + - - +
      BitLocker CSP

      Added support for Windows 10 Pro starting in the version 1809.

      +
      BitLocker CSP

      Added support for Windows 10 Pro starting in the version 1809.

      Office CSP

      Added FinalStatus setting in Windows 10, version 1809.

      +
      Office CSP

      Added FinalStatus setting in Windows 10, version 1809.

      RemoteWipe CSP

      Added new settings in Windows 10, version 1809.

      +
      RemoteWipe CSP

      Added new settings in Windows 10, version 1809.

      TenantLockdown CSP

      Added new CSP in Windows 10, version 1809.

      +
      TenantLockdown CSP

      Added new CSP in Windows 10, version 1809.

      WindowsDefenderApplicationGuard CSP

      Added new settings in Windows 10, version 1809.

      +
      WindowsDefenderApplicationGuard CSP

      Added new settings in Windows 10, version 1809.

      Policy DDF file

      Posted an updated version of the Policy DDF for Windows 10, version 1809.

      +
      Policy DDF file

      Posted an updated version of the Policy DDF for Windows 10, version 1809.

      Policy CSP

      Added the following new policies in Windows 10, version 1809:

      +
      Policy CSP

      Added the following new policies in Windows 10, version 1809:

      • Browser/AllowFullScreenMode
      • Browser/AllowPrelaunch
      • @@ -270,47 +270,47 @@ This article lists new and updated articles for the Mobile Device Management (MD
      AssignedAccess CSP

      Added the following note:

      +
      AssignedAccess CSP

      Added the following note:

      • You can only assign one single app kiosk profile to an individual user account on a device. The single app profile does not support domain groups.
      PassportForWork CSP

      Added new settings in Windows 10, version 1809.

      +
      PassportForWork CSP

      Added new settings in Windows 10, version 1809.

      EnterpriseModernAppManagement CSP

      Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

      +
      EnterpriseModernAppManagement CSP

      Added NonRemovable setting under AppManagement node in Windows 10, version 1809.

      Win32CompatibilityAppraiser CSP

      Added new configuration service provider in Windows 10, version 1809.

      +
      Win32CompatibilityAppraiser CSP

      Added new configuration service provider in Windows 10, version 1809.

      WindowsLicensing CSP

      Added S mode settings and SyncML examples in Windows 10, version 1809.

      +
      WindowsLicensing CSP

      Added S mode settings and SyncML examples in Windows 10, version 1809.

      SUPL CSP

      Added 3 new certificate nodes in Windows 10, version 1809.

      +
      SUPL CSP

      Added 3 new certificate nodes in Windows 10, version 1809.

      Defender CSP

      Added a new node Health/ProductStatus in Windows 10, version 1809.

      +
      Defender CSP

      Added a new node Health/ProductStatus in Windows 10, version 1809.

      BitLocker CSP

      Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

      +
      BitLocker CSP

      Added a new node AllowStandardUserEncryption in Windows 10, version 1809.

      DevDetail CSP

      Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

      +
      DevDetail CSP

      Added a new node SMBIOSSerialNumber in Windows 10, version 1809.

      Policy CSP

      Added the following new policies in Windows 10, version 1809:

      +
      Policy CSP

      Added the following new policies in Windows 10, version 1809:

      • ApplicationManagement/LaunchAppAfterLogOn
      • ApplicationManagement/ScheduleForceRestartForUpdateFailures
      • @@ -360,24 +360,24 @@ This article lists new and updated articles for the Mobile Device Management (MD
      Wifi CSP

      Added a new node WifiCost in Windows 10, version 1809.

      +
      Wifi CSP

      Added a new node WifiCost in Windows 10, version 1809.

      Diagnose MDM failures in Windows 10

      Recent changes:

      +
      Diagnose MDM failures in Windows 10

      Recent changes:

      • Added procedure for collecting logs remotely from Windows 10 Holographic.
      • Added procedure for downloading the MDM Diagnostic Information log.
      BitLocker CSP

      Added new node AllowStandardUserEncryption in Windows 10, version 1809.

      +
      BitLocker CSP

      Added new node AllowStandardUserEncryption in Windows 10, version 1809.

      Policy CSP

      Recent changes:

      +
      Policy CSP

      Recent changes:

      • AccountPoliciesAccountLockoutPolicy/AccountLockoutDuration - removed from docs. Not supported.
      • AccountPoliciesAccountLockoutPolicy/AccountLockoutThreshold - removed from docs. Not supported.
      • @@ -398,8 +398,8 @@ This article lists new and updated articles for the Mobile Device Management (MD
      WiredNetwork CSPNew CSP added in Windows 10, version 1809. +WiredNetwork CSPNew CSP added in Windows 10, version 1809.
      @@ -419,8 +419,8 @@ This article lists new and updated articles for the Mobile Device Management (MD -Policy DDF file -

      Updated the DDF files in the Windows 10 version 1703 and 1709.

      +Policy DDF file +

      Updated the DDF files in the Windows 10 version 1703 and 1709.

      • Download the Policy DDF file for Windows 10, version 1709
      • Download the Policy DDF file for Windows 10, version 1703
      • @@ -444,35 +444,35 @@ This article lists new and updated articles for the Mobile Device Management (MD -WindowsDefenderApplicationGuard CSP -

        Added the following node in Windows 10, version 1803:

        +WindowsDefenderApplicationGuard CSP +

        Added the following node in Windows 10, version 1803:

        • Settings/AllowVirtualGPU
        • Settings/SaveFilesToHost
        -NetworkProxy CSP -

        Added the following node in Windows 10, version 1803:

        +NetworkProxy CSP +

        Added the following node in Windows 10, version 1803:

        • ProxySettingsPerUser
        -Accounts CSP -

        Added a new CSP in Windows 10, version 1803.

        +Accounts CSP +

        Added a new CSP in Windows 10, version 1803.

        -MDM Migration Analysis Tool (MMAT) -

        Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

        +MDM Migration Analysis Tool (MMAT) +

        Updated version available. MMAT is a tool you can use to determine which Group Policies are set on a target user/computer and cross-reference them against the list of supported MDM policies.

        -CSP DDF files download -

        Added the DDF download of Windows 10, version 1803 configuration service providers.

        +CSP DDF files download +

        Added the DDF download of Windows 10, version 1803 configuration service providers.

        -Policy CSP -

        Added the following new policies for Windows 10, version 1803:

        +Policy CSP +

        Added the following new policies for Windows 10, version 1803:

        • Bluetooth/AllowPromptedProximalConnections
        • KioskBrowser/EnableEndSessionButton
        • @@ -500,41 +500,41 @@ This article lists new and updated articles for the Mobile Device Management (MD -eUICCs CSP -

          Added the following node in Windows 10, version 1803:

          +eUICCs CSP +

          Added the following node in Windows 10, version 1803:

          • IsEnabled
          -DeviceStatus CSP -

          Added the following node in Windows 10, version 1803:

          +DeviceStatus CSP +

          Added the following node in Windows 10, version 1803:

          • OS/Mode
          -Understanding ADMX-backed policies -

          Added the following videos:

          +Understanding ADMX-backed policies +

          Added the following videos:

          -AccountManagement CSP -

          Added a new CSP in Windows 10, version 1803.

          +AccountManagement CSP +

          Added a new CSP in Windows 10, version 1803.

          -RootCATrustedCertificates CSP -

          Added the following node in Windows 10, version 1803:

          +RootCATrustedCertificates CSP +

          Added the following node in Windows 10, version 1803:

          • UntrustedCertificates
          -Policy CSP -

          Added the following new policies for Windows 10, version 1803:

          +Policy CSP +

          Added the following new policies for Windows 10, version 1803:

          • ApplicationDefaults/EnableAppUriHandlers
          • ApplicationManagement/MSIAllowUserControlOverInstall
          • @@ -556,16 +556,16 @@ This article lists new and updated articles for the Mobile Device Management (MD
          -Policy CSP - Bluetooth -

          Added new section ServicesAllowedList usage guide.

          +Policy CSP - Bluetooth +

          Added new section ServicesAllowedList usage guide.

          -MultiSIM CSP -

          Added SyncML examples and updated the settings descriptions.

          +MultiSIM CSP +

          Added SyncML examples and updated the settings descriptions.

          -RemoteWipe CSP -

          Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

          +RemoteWipe CSP +

          Reverted back to Windows 10, version 1709. Removed previous draft documentation for version 1803.

          @@ -585,8 +585,8 @@ This article lists new and updated articles for the Mobile Device Management (MD -Policy CSP -

          Added the following new policies for Windows 10, version 1803:

          +Policy CSP +

          Added the following new policies for Windows 10, version 1803:

          • Display/DisablePerProcessDpiForApps
          • Display/EnablePerProcessDpi
          • @@ -603,12 +603,12 @@ This article lists new and updated articles for the Mobile Device Management (MD
              -VPNv2 ProfileXML XSD -

              Updated the XSD and Plug-in profile example for VPNv2 CSP.

              +VPNv2 ProfileXML XSD +

              Updated the XSD and Plug-in profile example for VPNv2 CSP.

              -AssignedAccess CSP -

              Added the following nodes in Windows 10, version 1803:

              +AssignedAccess CSP +

              Added the following nodes in Windows 10, version 1803:

              • Status
              • ShellLauncher
              • @@ -617,12 +617,12 @@ This article lists new and updated articles for the Mobile Device Management (MD

                Updated the AssigneAccessConfiguration schema. Starting in Windows 10, version 1803 AssignedAccess CSP is supported in HoloLens (1st gen) Commercial Suite. Added example for HoloLens (1st gen) Commercial Suite.

                -MultiSIM CSP -

                Added a new CSP in Windows 10, version 1803.

                +MultiSIM CSP +

                Added a new CSP in Windows 10, version 1803.

                -EnterpriseModernAppManagement CSP -

                Added the following node in Windows 10, version 1803:

                +EnterpriseModernAppManagement CSP +

                Added the following node in Windows 10, version 1803:

                • MaintainProcessorArchitectureOnUpdate
                @@ -645,8 +645,8 @@ This article lists new and updated articles for the Mobile Device Management (MD -Policy CSP -

                Added the following new policies for Windows 10, version 1803:

                +Policy CSP +

                Added the following new policies for Windows 10, version 1803:

                • Browser/AllowConfigurationUpdateForBooksLibrary
                • Browser/AlwaysEnableBooksLibrary
                • @@ -744,16 +744,16 @@ This article lists new and updated articles for the Mobile Device Management (MD

                  Security/RequireDeviceEncryption - updated to show it is supported in desktop.

                  -BitLocker CSP -

                  Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

                  +BitLocker CSP +

                  Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, version 1803.

                  -EnterpriseModernAppManagement CSP -

                  Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

                  +EnterpriseModernAppManagement CSP +

                  Added new node MaintainProcessorArchitectureOnUpdate in Windows 10, next major update.

                  -DMClient CSP -

                  Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

                  +DMClient CSP +

                  Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, version 1803:

                  • AADSendDeviceToken
                  • BlockInStatusPage
                  • @@ -764,16 +764,16 @@ This article lists new and updated articles for the Mobile Device Management (MD
                  -Defender CSP -

                  Added new node (OfflineScan) in Windows 10, version 1803.

                  +Defender CSP +

                  Added new node (OfflineScan) in Windows 10, version 1803.

                  -UEFI CSP -

                  Added a new CSP in Windows 10, version 1803.

                  +UEFI CSP +

                  Added a new CSP in Windows 10, version 1803.

                  -Update CSP -

                  Added the following nodes in Windows 10, version 1803:

                  +Update CSP +

                  Added the following nodes in Windows 10, version 1803:

                  • Rollback
                  • Rollback/FeatureUpdate
                  • @@ -799,8 +799,8 @@ This article lists new and updated articles for the Mobile Device Management (MD -Configuration service provider reference -

                    Added new section CSP DDF files download

                    +Configuration service provider reference +

                    Added new section CSP DDF files download

                    @@ -820,8 +820,8 @@ This article lists new and updated articles for the Mobile Device Management (MD -Policy CSP -

                    Added the following policies for Windows 10, version 1709:

                    +Policy CSP +

                    Added the following policies for Windows 10, version 1709:

                    • Authentication/AllowFidoDeviceSignon
                    • Cellular/LetAppsAccessCellularData
                    • @@ -858,28 +858,28 @@ This article lists new and updated articles for the Mobile Device Management (MD -Policy DDF file -

                      Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

                      +Policy DDF file +

                      Updated the DDF content for Windows 10 version 1709. Added a link to the download of Policy DDF for Windows 10, version 1709.

                      -Policy CSP -

                      Updated the following policies:

                      +Policy CSP +

                      Updated the following policies:

                      • Defender/ControlledFolderAccessAllowedApplications - string separator is |.
                      • Defender/ControlledFolderAccessProtectedFolders - string separator is |.
                      -eUICCs CSP -

                      Added new CSP in Windows 10, version 1709.

                      +eUICCs CSP +

                      Added new CSP in Windows 10, version 1709.

                      -AssignedAccess CSP -

                      Added SyncML examples for the new Configuration node.

                      +AssignedAccess CSP +

                      Added SyncML examples for the new Configuration node.

                      -DMClient CSP -

                      Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

                      +DMClient CSP +

                      Added new nodes to the DMClient CSP in Windows 10, version 1709. Updated the CSP and DDF topics.

                      @@ -899,8 +899,8 @@ This article lists new and updated articles for the Mobile Device Management (MD -Policy CSP -

                      Added the following new policies for Windows 10, version 1709:

                      +Policy CSP +

                      Added the following new policies for Windows 10, version 1709:

                      • Authentication/AllowAadPasswordReset
                      • Handwriting/PanelDefaultModeDocked
                      • @@ -910,16 +910,16 @@ This article lists new and updated articles for the Mobile Device Management (MD

                        Added new settings to Update/BranchReadinessLevel policy in Windows 10 version 1709.

                        -AssignedAccess CSP -

                        Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

                        +AssignedAccess CSP +

                        Starting in Windows 10, version 1709, AssignedAccess CSP is also supported in Windows 10 Pro.

                        -Microsoft Store for Business and Microsoft Store -

                        Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

                        +Microsoft Store for Business and Microsoft Store +

                        Windows Store for Business name changed to Microsoft Store for Business. Windows Store name changed to Microsoft Store.

                        -The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2 -

                        The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

                        +The [MS-MDE2]: Mobile Device Enrollment Protocol Version 2 +

                        The Windows 10 enrollment protocol was updated. The following elements were added to the RequestSecurityToken message:

                        • UXInitiated - boolean value that indicates whether the enrollment is user initiated from the Settings page.
                        • ExternalMgmtAgentHint - a string the agent uses to give hints the enrollment server may need.
                        • @@ -928,20 +928,20 @@ This article lists new and updated articles for the Mobile Device Management (MD

                          For examples, see section 4.3.1 RequestSecurityToken of the MS-MDE2 protocol documentation.

                          -EnterpriseAPN CSP -

                          Added a SyncML example.

                          +EnterpriseAPN CSP +

                          Added a SyncML example.

                          -VPNv2 CSP -

                          Added RegisterDNS setting in Windows 10, version 1709.

                          +VPNv2 CSP +

                          Added RegisterDNS setting in Windows 10, version 1709.

                          -Enroll a Windows 10 device automatically using Group Policy -

                          Added new topic to introduce a new Group Policy for automatic MDM enrollment.

                          +Enroll a Windows 10 device automatically using Group Policy +

                          Added new topic to introduce a new Group Policy for automatic MDM enrollment.

                          -MDM enrollment of Windows-based devices -

                          New features in the Settings app:

                          +MDM enrollment of Windows-based devices +

                          New features in the Settings app:

                          • User sees installation progress of critical policies during MDM enrollment.
                          • User knows what policies, profiles, apps MDM has configured
                          • @@ -967,23 +967,23 @@ This article lists new and updated articles for the Mobile Device Management (MD -Enable ADMX-backed policies in MDM -

                            Added new step-by-step guide to enable ADMX-backed policies.

                            +Enable ADMX-backed policies in MDM +

                            Added new step-by-step guide to enable ADMX-backed policies.

                            -Mobile device enrollment -

                            Added the following statement:

                            +Mobile device enrollment +

                            Added the following statement:

                            • Devices that are joined to an on-premises Active Directory can enroll into MDM via the Work access page in Settings. However, the enrollment can only target the user enrolled with user-specific policies. Device targeted policies will continue to impact all users of the device.
                            -CM_CellularEntries CSP -

                            Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

                            +CM_CellularEntries CSP +

                            Updated the description of the PuposeGroups node to add the GUID for applications. This node is required instead of optional.

                            -EnterpriseDataProtection CSP -

                            Updated the Settings/EDPEnforcementLevel values to the following:

                            +EnterpriseDataProtection CSP +

                            Updated the Settings/EDPEnforcementLevel values to the following:

                            • 0 (default) – Off / No protection (decrypts previously protected data).
                            • 1 – Silent mode (encrypt and audit only).
                            • @@ -992,31 +992,31 @@ This article lists new and updated articles for the Mobile Device Management (MD
                            -AppLocker CSP -

                            Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

                            +AppLocker CSP +

                            Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in Allow list examples.

                            -DeviceManageability CSP -

                            Added the following settings in Windows 10, version 1709:

                            +DeviceManageability CSP +

                            Added the following settings in Windows 10, version 1709:

                            • Provider/ProviderID/ConfigInfo
                            • Provider/ProviderID/EnrollmentInfo
                            -Office CSP -

                            Added the following setting in Windows 10, version 1709:

                            +Office CSP +

                            Added the following setting in Windows 10, version 1709:

                            • Installation/CurrentStatus
                            -BitLocker CSP -Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. +BitLocker CSP +Added information to the ADMX-backed policies. Changed the minimum personal identification number (PIN) length to 4 digits in SystemDrivesRequireStartupAuthentication and SystemDrivesMinimumPINLength in Windows 10, version 1709. -Firewall CSP -Updated the CSP and DDF topics. Here are the changes: +Firewall CSP +Updated the CSP and DDF topics. Here are the changes:
                            • Removed the two settings - FirewallRules/FirewallRuleName/FriendlyName and FirewallRules/FirewallRuleName/IcmpTypesAndCodes.
                            • Changed some data types from integer to bool.
                            • @@ -1025,8 +1025,8 @@ This article lists new and updated articles for the Mobile Device Management (MD
                            -Policy DDF file -Added another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies: +Policy DDF file +Added another Policy DDF file download for the 8C release of Windows 10, version 1607, which added the following policies:
                            • Browser/AllowMicrosoftCompatibilityList
                            • Update/DisableDualScan
                            • @@ -1034,8 +1034,8 @@ This article lists new and updated articles for the Mobile Device Management (MD
                            -Policy CSP -

                            Added the following new policies for Windows 10, version 1709:

                            +Policy CSP +

                            Added the following new policies for Windows 10, version 1709:

                            • Browser/ProvisionFavorites
                            • Browser/LockdownFavorites
                            • diff --git a/windows/client-management/mdm/cleanpc-csp.md b/windows/client-management/mdm/cleanpc-csp.md index a4433c6dcf..437a1a48c2 100644 --- a/windows/client-management/mdm/cleanpc-csp.md +++ b/windows/client-management/mdm/cleanpc-csp.md @@ -23,14 +23,14 @@ CleanPC ----CleanPCRetainingUserData ``` **./Device/Vendor/MSFT/CleanPC** -

                              The root node for the CleanPC configuration service provider.

                              +

                              The root node for the CleanPC configuration service provider.

                              **CleanPCWithoutRetainingUserData** -

                              An integer specifying a CleanPC operation without any retention of user data. +

                              An integer specifying a CleanPC operation without any retention of user data. -

                              The only supported operation is Execute. +

                              The only supported operation is Execute. **CleanPCRetainingUserData** -

                              An integer specifying a CleanPC operation with retention of user data. +

                              An integer specifying a CleanPC operation with retention of user data. -

                              The only supported operation is Execute. +

                              The only supported operation is Execute. diff --git a/windows/client-management/mdm/cm-cellularentries-csp.md b/windows/client-management/mdm/cm-cellularentries-csp.md index 1d42413872..44886adee0 100644 --- a/windows/client-management/mdm/cm-cellularentries-csp.md +++ b/windows/client-management/mdm/cm-cellularentries-csp.md @@ -23,28 +23,28 @@ The following diagram shows the CM\_CellularEntries configuration service provid ![cm\-cellularentries csp.](images/provisioning-csp-cm-cellularentries.png) ***entryname*** -

                              Defines the name of the connection.

                              +

                              Defines the name of the connection.

                              -

                              The CMPolicy configuration service provider uses the value of entryname to identify the connection that is associated with a policy and CM_ProxyEntries configuration service provider uses the value of entryname to identify the connection that is associated with a proxy.

                              +

                              The CMPolicy configuration service provider uses the value of entryname to identify the connection that is associated with a policy and CM_ProxyEntries configuration service provider uses the value of entryname to identify the connection that is associated with a proxy.

                              **AlwaysOn** -

                              Type: Int. Specifies if the Connection Manager will automatically attempt to connect to the APN when a connection is available. +

                              Type: Int. Specifies if the Connection Manager will automatically attempt to connect to the APN when a connection is available. -

                              A value of "0" specifies that AlwaysOn is not supported, and the Connection Manager will only attempt to connect to the APN when an application requests the connection. This setting is recommended for applications that use a connection occasionally, for example, an APN that only controls MMS. +

                              A value of "0" specifies that AlwaysOn is not supported, and the Connection Manager will only attempt to connect to the APN when an application requests the connection. This setting is recommended for applications that use a connection occasionally, for example, an APN that only controls MMS. -

                              A value of "1" specifies that AlwaysOn is supported, and the Connection Manager will automatically attempt to connect to the APN when it is available. This setting is recommended for general purpose Internet APNs. +

                              A value of "1" specifies that AlwaysOn is supported, and the Connection Manager will automatically attempt to connect to the APN when it is available. This setting is recommended for general purpose Internet APNs. -

                              There must be at least one AlwaysOn Internet connection provisioned for the mobile operator. +

                              There must be at least one AlwaysOn Internet connection provisioned for the mobile operator. **AuthType** -

                              Optional. Type: String. Specifies the method of authentication used for a connection. +

                              Optional. Type: String. Specifies the method of authentication used for a connection. -

                              A value of "CHAP" specifies the Challenge Handshake Application Protocol. A value of "PAP" specifies the Password Authentication Protocol. A value of "None" specifies that the UserName and Password parameters are ignored. The default value is "None". +

                              A value of "CHAP" specifies the Challenge Handshake Application Protocol. A value of "PAP" specifies the Password Authentication Protocol. A value of "None" specifies that the UserName and Password parameters are ignored. The default value is "None". **ConnectionType** -

                              Optional. Type: String. Specifies the type of connection used for the APN. The following connection types are available: +

                              Optional. Type: String. Specifies the type of connection used for the APN. The following connection types are available: -
                              +
                              @@ -80,48 +80,48 @@ The following diagram shows the CM\_CellularEntries configuration service provid **Desc.langid** -

                              Optional. Specifies the UI display string used by the defined language ID. +

                              Optional. Specifies the UI display string used by the defined language ID. -

                              A parameter name in the format of Desc.langid will be used as the language-specific identifier for the specified entry. For example, a parameter defined as Desc.0409 with a value of "GPRS Connection" will force "GPRS Connection" to be displayed in the UI to represent this connection when the device is set to English language (language ID 0409). Descriptions for multiple languages may be provisioned using this mechanism, and the system will automatically switch among them if the user changes language preferences on the device. If no Desc parameter is provisioned for a given language, the system will default to the name used to create the entry. +

                              A parameter name in the format of Desc.langid will be used as the language-specific identifier for the specified entry. For example, a parameter defined as Desc.0409 with a value of "GPRS Connection" will force "GPRS Connection" to be displayed in the UI to represent this connection when the device is set to English language (language ID 0409). Descriptions for multiple languages may be provisioned using this mechanism, and the system will automatically switch among them if the user changes language preferences on the device. If no Desc parameter is provisioned for a given language, the system will default to the name used to create the entry. **Enabled** -

                              Specifies if the connection is enabled. +

                              Specifies if the connection is enabled. -

                              A value of "0" specifies that the connection is disabled. A value of "1" specifies that the connection is enabled. +

                              A value of "0" specifies that the connection is disabled. A value of "1" specifies that the connection is enabled. **IpHeaderCompression** -

                              Optional. Specifies if IP header compression is enabled. +

                              Optional. Specifies if IP header compression is enabled. -

                              A value of "0" specifies that IP header compression for the connection is disabled. A value of "1" specifies that IP header compression for the connection is enabled. +

                              A value of "0" specifies that IP header compression for the connection is disabled. A value of "1" specifies that IP header compression for the connection is enabled. **Password** -

                              Required if AuthType is set to a value other than "None". Specifies the password used to connect to the APN. +

                              Required if AuthType is set to a value other than "None". Specifies the password used to connect to the APN. **SwCompression** -

                              Optional. Specifies if software compression is enabled. +

                              Optional. Specifies if software compression is enabled. -

                              A value of "0" specifies that software compression for the connection is disabled. A value of "1" specifies that software compression for the connection is enabled. +

                              A value of "0" specifies that software compression for the connection is disabled. A value of "1" specifies that software compression for the connection is enabled. **UserName** -

                              Required if AuthType is set to a value other than "None". Specifies the user name used to connect to the APN. +

                              Required if AuthType is set to a value other than "None". Specifies the user name used to connect to the APN. **UseRequiresMappingsPolicy** -

                              Optional. Specifies if the connection requires a corresponding mappings policy. +

                              Optional. Specifies if the connection requires a corresponding mappings policy. -

                              A value of "0" specifies that the connection can be used for any general Internet communications. A value of "1" specifies that the connection is only used if a mapping policy is present. +

                              A value of "0" specifies that the connection can be used for any general Internet communications. A value of "1" specifies that the connection is only used if a mapping policy is present. -

                              For example, if the multimedia messaging service (MMS) APN should not have any other traffic except MMS, you can configure a mapping policy that sends MMS traffic to this connection. Then, you set the value of UseRequiresMappingsPolicy to be equal to "1" and Connection Manager will only use the connection for MMS traffic. Without this, Connection Manager will try to use the connection for any general purpose Internet traffic. +

                              For example, if the multimedia messaging service (MMS) APN should not have any other traffic except MMS, you can configure a mapping policy that sends MMS traffic to this connection. Then, you set the value of UseRequiresMappingsPolicy to be equal to "1" and Connection Manager will only use the connection for MMS traffic. Without this, Connection Manager will try to use the connection for any general purpose Internet traffic. **Version** -

                              Type: Int. Specifies the XML version number and is used to verify that the XML is supported by Connection Manager's configuration service provider. +

                              Type: Int. Specifies the XML version number and is used to verify that the XML is supported by Connection Manager's configuration service provider. -

                              This value must be "1" if included. +

                              This value must be "1" if included. **GPRSInfoAccessPointName** -

                              Specifies the logical name to select the GPRS gateway. For more information about allowable values, see GSM specification 07.07 "10.1.1 Define PDP Context +CGDCONT". +

                              Specifies the logical name to select the GPRS gateway. For more information about allowable values, see GSM specification 07.07 "10.1.1 Define PDP Context +CGDCONT". **Roaming** -

                              Optional. Type: Int. This parameter specifies the roaming conditions under which the connection should be activated. The following conditions are available: +

                              Optional. Type: Int. This parameter specifies the roaming conditions under which the connection should be activated. The following conditions are available: - 0 - Home network only. - 1 (default)- All roaming conditions (home and roaming). @@ -131,13 +131,13 @@ The following diagram shows the CM\_CellularEntries configuration service provid - 5 - Roaming only. **OEMConnectionID** -

                              Optional. Type: GUID. Specifies a GUID to use to identify a specific connection in the modem. If a value is not specified, the default value is 00000000-0000-0000-0000-000000000000. This parameter is only used on LTE devices. +

                              Optional. Type: GUID. Specifies a GUID to use to identify a specific connection in the modem. If a value is not specified, the default value is 00000000-0000-0000-0000-000000000000. This parameter is only used on LTE devices. **ApnId** -

                              Optional. Type: Int. Specifies the purpose of the APN. If a value is not specified, the default value is "0" (none). This parameter is only used on LTE devices. +

                              Optional. Type: Int. Specifies the purpose of the APN. If a value is not specified, the default value is "0" (none). This parameter is only used on LTE devices. **IPType** -

                              Optional. Type: String. Specifies the network protocol of the connection. Available values are "IPv4", "IPv6", "IPv4v6", and "IPv4v6xlat". If a value is not specified, the default value is "IPv4". +

                              Optional. Type: String. Specifies the network protocol of the connection. Available values are "IPv4", "IPv6", "IPv4v6", and "IPv4v6xlat". If a value is not specified, the default value is "IPv4". > [!WARNING] > Do not use IPv6 or IPv4v6xlat on a device or network that does not support IPv6. Data functionality will not work. In addition, the device will not be able to connect to a roaming network that does not support IPv6 unless you configure roaming connections with an IPType of IPv4v6. @@ -145,14 +145,14 @@ The following diagram shows the CM\_CellularEntries configuration service provid **ExemptFromDisablePolicy** -

                              Added back in Windows 10, version 1511. Optional. Type: Int. This should only be specified for special purpose connections whose applications directly manage their disable state (such as MMS). A value of "0" specifies that the connection is subject to the disable policy used by general purpose connections (not exempt). A value of "1" specifies that the connection is exempt. If a value is not specified, the default value is "0" (not exempt). +

                              Added back in Windows 10, version 1511. Optional. Type: Int. This should only be specified for special purpose connections whose applications directly manage their disable state (such as MMS). A value of "0" specifies that the connection is subject to the disable policy used by general purpose connections (not exempt). A value of "1" specifies that the connection is exempt. If a value is not specified, the default value is "0" (not exempt). -

                              To allow MMS when data is set to OFF, set both ExemptFromDisablePolicy and UseRequiresMappingsPolicy to "1". This indicates that the connection is a dedicated MMS connection and that it should not be disabled when all other connections are disabled. As a result, MMS can be sent and received when data is set to OFF. Note that sending MMS while roaming is still not allowed. +

                              To allow MMS when data is set to OFF, set both ExemptFromDisablePolicy and UseRequiresMappingsPolicy to "1". This indicates that the connection is a dedicated MMS connection and that it should not be disabled when all other connections are disabled. As a result, MMS can be sent and received when data is set to OFF. Note that sending MMS while roaming is still not allowed. > [!IMPORTANT] > Do not set ExemptFromDisablePolicy to "1", ExemptFromRoaming to "1", or UseRequiresMappingsPolicy to "1" for general purpose connections. -

                              To avoid UX inconsistency with certain value combinations of ExemptFromDisablePolicy and AllowMmsIfDataIsOff, when you do not set ExemptFromDisablePolicy to 1 (default is 0), you should: +

                              To avoid UX inconsistency with certain value combinations of ExemptFromDisablePolicy and AllowMmsIfDataIsOff, when you do not set ExemptFromDisablePolicy to 1 (default is 0), you should: - Hide the toggle for AllowMmsIfDataIsOff by setting AllowMmsIfDataIsOffEnabled to 0 (default is 1) - Set AllowMMSIfDataIsOff to 1 (default is 0) @@ -160,16 +160,16 @@ The following diagram shows the CM\_CellularEntries configuration service provid **ExemptFromRoaming** -

                              Added back in Windows 10, version 1511. Optional. Type: Int. This should be specified only for special purpose connections whose applications directly manage their roaming state. It should never be used with general purpose connections. A value of "0" specifies that the connection is subject to the roaming policy (not exempt). A value of "1" specifies that the connection is exempt (unaffected by the roaming policy). If a value is not specified, the default value is "0" (not exempt). +

                              Added back in Windows 10, version 1511. Optional. Type: Int. This should be specified only for special purpose connections whose applications directly manage their roaming state. It should never be used with general purpose connections. A value of "0" specifies that the connection is subject to the roaming policy (not exempt). A value of "1" specifies that the connection is exempt (unaffected by the roaming policy). If a value is not specified, the default value is "0" (not exempt). **TetheringNAI** -

                              Optional. Type: Int. CDMA only. Specifies if the connection is a tethering connection. A value of "0" specifies that the connection is not a tethering connection. A value of "1" specifies that the connection is a tethering connection. If a value is not specified, the default value is "0". +

                              Optional. Type: Int. CDMA only. Specifies if the connection is a tethering connection. A value of "0" specifies that the connection is not a tethering connection. A value of "1" specifies that the connection is a tethering connection. If a value is not specified, the default value is "0". **IdleDisconnectTimeout** -

                              Optional. Type: Int. Specifies how long an on-demand connection can be unused before Connection Manager tears the connection down. This value is specified in seconds. Valid value range is 5 to 60 seconds. If not specified, the default is 30 seconds. +

                              Optional. Type: Int. Specifies how long an on-demand connection can be unused before Connection Manager tears the connection down. This value is specified in seconds. Valid value range is 5 to 60 seconds. If not specified, the default is 30 seconds. > [!IMPORTANT] ->

                              You must specify the IdleDisconnectTimeout value when updating an on-demand connection to ensure that the desired value is still configured. If it is not specified, the default value of 30 seconds may be used. +>

                              You must specify the IdleDisconnectTimeout value when updating an on-demand connection to ensure that the desired value is still configured. If it is not specified, the default value of 30 seconds may be used. > [!NOTE] @@ -178,10 +178,10 @@ The following diagram shows the CM\_CellularEntries configuration service provid **SimIccId** -

                              For single SIM phones, this parm is optional. However, it is highly recommended to include this value when creating future updates. For dual SIM phones, this parm is required. Type: String. Specifies the SIM ICCID that services the connection. +

                              For single SIM phones, this parm is optional. However, it is highly recommended to include this value when creating future updates. For dual SIM phones, this parm is required. Type: String. Specifies the SIM ICCID that services the connection. **PurposeGroups** -

                              Required. Type: String. Specifies the purposes of the connection by a comma-separated list of GUIDs representing purpose values. The following purpose values are available: +

                              Required. Type: String. Specifies the purposes of the connection by a comma-separated list of GUIDs representing purpose values. The following purpose values are available: - Internet - 3E5545D2-1137-4DC8-A198-33F1C657515F - LTE attach - 11A6FE68-5B47-4859-9CB6-1EAC96A8F0BD diff --git a/windows/client-management/mdm/developersetup-csp.md b/windows/client-management/mdm/developersetup-csp.md index 2f1ccdb53c..f36f744684 100644 --- a/windows/client-management/mdm/developersetup-csp.md +++ b/windows/client-management/mdm/developersetup-csp.md @@ -35,48 +35,48 @@ DeveloperSetup ------------HttpsPort ``` **DeveloperSetup** -

                              The root node for the DeveloperSetup configuration service provider. +

                              The root node for the DeveloperSetup configuration service provider. **EnableDeveloperMode** -

                              A Boolean value that is used to enable Developer Mode on the device. The default value is false. +

                              A Boolean value that is used to enable Developer Mode on the device. The default value is false. -

                              The only supported operation is Replace. +

                              The only supported operation is Replace. **DevicePortal** -

                              The node for the Windows Device Portal. +

                              The node for the Windows Device Portal. **DevicePortal/Authentication** -

                              The node that describes the characteristics of the authentication mechanism that is used for the Windows Device Portal. +

                              The node that describes the characteristics of the authentication mechanism that is used for the Windows Device Portal. **DevicePortal/Authentication/Mode** -

                              An integer value that specifies the mode of authentication that is used when making requests to the Windows Device Portal. +

                              An integer value that specifies the mode of authentication that is used when making requests to the Windows Device Portal. -

                              The only supported operation is Replace. +

                              The only supported operation is Replace. **DevicePortal/Authentication/BasicAuth** -

                              The node that describes the credentials that are used for basic authentication with the Windows Device Portal. +

                              The node that describes the credentials that are used for basic authentication with the Windows Device Portal. **DevicePortal/Authentication/BasicAuth/Username** -

                              A string value that specifies the user name to use when performing basic authentication with the Windows Device Portal. +

                              A string value that specifies the user name to use when performing basic authentication with the Windows Device Portal. The user name must contain only ASCII characters and cannot contain a colon (:). -

                              The only supported operation is Replace. +

                              The only supported operation is Replace. **DevicePortal/Authentication/BasicAuth/Password** -

                              A string value that specifies the password to use when authenticating requests against the Windows Device Portal. +

                              A string value that specifies the password to use when authenticating requests against the Windows Device Portal. -

                              The only supported operation is Replace. +

                              The only supported operation is Replace. **DevicePortal/Connection** -

                              The node for configuring connections to the Windows Device Portal service. +

                              The node for configuring connections to the Windows Device Portal service. **DevicePortal/Connection/HttpPort** -

                              An integer value that is used to configure the HTTP port for incoming connections to the Windows Device Portal service. +

                              An integer value that is used to configure the HTTP port for incoming connections to the Windows Device Portal service. If authentication is enabled, HttpPort will redirect the user to the (required) HttpsPort. -

                              The only supported operation is Replace. +

                              The only supported operation is Replace. **DevicePortal/Connection/HttpsPort** -

                              An integer value that is used to configure the HTTPS port for incoming connections to the Windows Device Portal service. +

                              An integer value that is used to configure the HTTPS port for incoming connections to the Windows Device Portal service. -

                              The only supported operation is Replace. \ No newline at end of file +

                              The only supported operation is Replace. \ No newline at end of file diff --git a/windows/client-management/mdm/device-update-management.md b/windows/client-management/mdm/device-update-management.md index cc589f1f13..bd80931f74 100644 --- a/windows/client-management/mdm/device-update-management.md +++ b/windows/client-management/mdm/device-update-management.md @@ -147,49 +147,49 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. +

                              Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursStart) to manage a range of active hours where update reboots are not scheduled. This value sets the end time. There is a 12 hour maximum from start time. > [!NOTE] > The default maximum difference from start time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** below for more information. -

                              Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. +

                              Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. -

                              The default is 17 (5 PM). +

                              The default is 17 (5 PM). **Update/ActiveHoursMaxRange** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. -

                              Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time. +

                              Added in Windows 10, version 1703. Allows the IT admin to specify the max active hours range. This value sets max number of active hours from start time. -

                              Supported values are 8-18. +

                              Supported values are 8-18. -

                              The default value is 18 (hours). +

                              The default value is 18 (hours). **Update/ActiveHoursStart** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. -

                              Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. +

                              Added in Windows 10, version 1607. Allows the IT admin (when used with Update/ActiveHoursEnd) to manage a range of hours where update reboots are not scheduled. This value sets the start time. There is a 12 hour maximum from end time. > [!NOTE] > The default maximum difference from end time has been increased to 18 in Windows 10, version 1703. In this version of Windows 10, the maximum range of active hours can now be configured. See **Update/ActiveHoursMaxRange** above for more information. -

                              Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. +

                              Supported values are 0-23, where 0 is 12 AM, 1 is 1 AM, etc. -

                              The default value is 8 (8 AM). +

                              The default value is 8 (8 AM). **Update/AllowAutoUpdate** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. -

                              Enables the IT admin to manage automatic update behavior to scan, download, and install updates. +

                              Enables the IT admin to manage automatic update behavior to scan, download, and install updates. -

                              Supported operations are Get and Replace. +

                              Supported operations are Get and Replace. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 – Notify the user before downloading the update. This policy is used by the enterprise who wants to enable the end-users to manage data usage. With this option users are notified when there are updates that apply to the device and are ready for download. Users can download and install the updates from the Windows Update control panel. - 1 – Auto install the update and then notify the user to schedule a device restart. Updates are downloaded automatically on non-metered networks and installed during "Automatic Maintenance" when the device is not in use and is not running on battery power. If automatic maintenance is unable to install updates for two days, Windows Update will install updates immediately. If the installation requires a restart, the end-user is prompted to schedule the restart time. The end-user has up to seven days to schedule the restart and after that, a restart of the device is forced. Enabling the end-user to control the start time reduces the risk of accidental data loss caused by applications that do not shutdown properly on restart. @@ -202,16 +202,16 @@ The following diagram shows the Update policies in a tree format. > This option should be used only for systems under regulatory compliance, as you will not get security updates as well. -

                              If the policy is not configured, end-users get the default behavior (Auto install and restart). +

                              If the policy is not configured, end-users get the default behavior (Auto install and restart). **Update/AllowMUUpdateService** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update. +

                              Added in Windows 10, version 1607. Allows the IT admin to manage whether to scan for app updates from Microsoft Update. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 – Not allowed or not configured. - 1 – Allowed. Accepts updates received through Microsoft Update. @@ -221,29 +221,29 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise and Windows 10 Education. -

                              Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third party software and patch distribution. +

                              Allows the IT admin to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found at the UpdateServiceUrl location. This policy supports using WSUS for third party software and patch distribution. -

                              Supported operations are Get and Replace. +

                              Supported operations are Get and Replace. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 – Not allowed or not configured. Updates from an intranet Microsoft update service location must be signed by Microsoft. - 1 – Allowed. Accepts updates received through an intranet Microsoft update service location, if they are signed by a certificate found in the "Trusted Publishers" certificate store of the local computer. -

                              This policy is specific to desktop and local publishing via WSUS for third party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. +

                              This policy is specific to desktop and local publishing via WSUS for third party updates (binaries and updates not hosted on Microsoft Update) and allows IT to manage whether Automatic Updates accepts updates signed by entities other than Microsoft when the update is found on an intranet Microsoft update service location. **Update/AllowUpdateService** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft. +

                              Specifies whether the device could use Microsoft Update, Windows Server Update Services (WSUS), or Microsoft. -

                              Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft +

                              Even when Windows Update is configured to receive updates from an intranet update service, it will periodically retrieve information from the public Windows Update service to enable future connections to Windows Update, and other services like Microsoft Update or the Microsoft -

                              Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft to stop working. +

                              Enabling this policy will disable that functionality, and may cause connection to public services such as the Microsoft to stop working. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 – Update service is not allowed. - 1 (default) – Update service is allowed. @@ -257,20 +257,20 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications. +

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart reminder notifications. -

                              Supported values are 15, 30, 60, 120, and 240 (minutes). +

                              Supported values are 15, 30, 60, 120, and 240 (minutes). -

                              The default value is 15 (minutes). +

                              The default value is 15 (minutes). **Update/AutoRestartRequiredNotificationDismissal** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. +

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the method by which the auto restart required notification is dismissed. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 1 (default) – Auto Dismissal. - 2 – User Dismissal. @@ -280,9 +280,9 @@ The following diagram shows the Update policies in a tree format. > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. +

                              Added in Windows 10, version 1607. Allows the IT admin to set which branch a device receives their updates from. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 16 (default) – User gets all applicable upgrades from Current Branch (CB). - 32 – User gets upgrades from Current Branch for Business (CBB). @@ -291,18 +291,18 @@ The following diagram shows the Update policies in a tree format. > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -

                              Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days. +

                              Added in Windows 10, version 1607. Defers Feature Updates for the specified number of days. -

                              Supported values are 0-180. +

                              Supported values are 0-180. **Update/DeferQualityUpdatesPeriodInDays** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days. +

                              Added in Windows 10, version 1607. Defers Quality Updates for the specified number of days. -

                              Supported values are 0-30. +

                              Supported values are 0-30. **Update/DeferUpdatePeriod** > [!NOTE] @@ -311,15 +311,15 @@ The following diagram shows the Update policies in a tree format. > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpdatePeriod for Windows 10, version 1511 devices. -

                              Allows IT Admins to specify update delays for up to four weeks. +

                              Allows IT Admins to specify update delays for up to four weeks. -

                              Supported values are 0-4, which refers to the number of weeks to defer updates. +

                              Supported values are 0-4, which refers to the number of weeks to defer updates. -

                              If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

                              If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

                              If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

                              If the Allow Telemetry policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

                              +
                              @@ -336,16 +336,16 @@ The following diagram shows the Update policies in a tree format. - - - - + + + + - - - - + + + - - - - + + + @@ -380,71 +380,71 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use DeferUpgradePeriod for Windows 10, version 1511 devices. -

                              Allows IT Admins to specify additional upgrade delays for up to eight months. +

                              Allows IT Admins to specify additional upgrade delays for up to eight months. -

                              Supported values are 0-8, which refers to the number of months to defer upgrades. +

                              Supported values are 0-8, which refers to the number of months to defer upgrades. -

                              If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

                              If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

                              If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

                              If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. **Update/EngagedRestartDeadline** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (pending user scheduling). +

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the deadline in days before automatically scheduling and executing a pending restart outside of active hours. The deadline can be set between 2 and 30 days from the time the restart becomes pending. If configured, the pending restart will transition from Auto-restart to Engaged restart (pending user schedule) to be automatically executed within the specified period. If no deadline is specified or deadline is set to 0, the restart will not be automatically executed and will remain Engaged restart (pending user scheduling). -

                              Supported values are 2-30 days. +

                              Supported values are 2-30 days. -

                              The default value is 0 days (not specified). +

                              The default value is 0 days (not specified). **Update/EngagedRestartSnoozeSchedule** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications. +

                              Added in Windows 10, version 1703. Allows the IT Admin to control the number of days a user can snooze Engaged restart reminder notifications. -

                              Supported values are 1-3 days. +

                              Supported values are 1-3 days. -

                              The default value is three days. +

                              The default value is three days. **Update/EngagedRestartTransitionSchedule** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. +

                              Added in Windows 10, version 1703. Allows the IT Admin to control the timing before transitioning from Auto restarts scheduled outside of active hours to Engaged restart, which requires the user to schedule. The period can be set between 2 and 30 days from the time the restart becomes pending. -

                              Supported values are 2-30 days. +

                              Supported values are 2-30 days. -

                              The default value is seven days. +

                              The default value is seven days. **Update/ExcludeWUDriversInQualityUpdate** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. > Since this policy is not blocked, you will not get a failure message when you use it to configure a Windows 10 Mobile device. However, the policy will not take effect. -

                              Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates. +

                              Added in Windows 10, version 1607. Allows IT Admins to exclude Windows Update (WU) drivers during updates. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Allow Windows Update drivers. - 1 – Exclude Windows Update drivers. **Update/IgnoreMOAppDownloadLimit** -

                              Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +

                              Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for apps and their updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Do not ignore MO download limit for apps and their updates. - 1 – Ignore MO download limit (allow unlimited downloading) for apps and their updates. -

                              To validate this policy: +

                              To validate this policy: 1. Enable the policy ensure the device is on a cellular network. 2. Run the scheduled task on your device to check for app updates in the background. For example, on a mobile device, run the following commands in TShell: @@ -456,17 +456,17 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego **Update/IgnoreMOUpdateDownloadLimit** -

                              Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. +

                              Added in Windows 10, version 1703. Specifies whether to ignore the MO download limit (allow unlimited downloading) over a cellular network for OS updates. If lower-level limits (for example, mobile caps) are required, those limits are controlled by external policies. > [!WARNING] > Setting this policy might cause devices to incur costs from MO operators. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Do not ignore MO download limit for OS updates. - 1 – Ignore MO download limit (allow unlimited downloading) for OS updates. -

                              To validate this policy: +

                              To validate this policy: 1. Enable the policy and ensure the device is on a cellular network. 2. Run the scheduled task on phone to check for OS updates in the background. For example, on a mobile device, run the following commands in TShell: @@ -482,24 +482,24 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use PauseDeferrals for Windows 10, version 1511 devices. -

                              Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. +

                              Allows IT Admins to pause updates and upgrades for up to five weeks. Paused deferrals will be reset after five weeks. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Deferrals are not paused. - 1 – Deferrals are paused. -

                              If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

                              If the "Specify intranet Microsoft update service location" policy is enabled, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. -

                              If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. +

                              If the "Allow Telemetry" policy is enabled and the Options value is set to 0, then the "Defer upgrades by", "Defer updates by" and "Pause Updates and Upgrades" settings have no effect. **Update/PauseFeatureUpdates** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education. -

                              Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. +

                              Added in Windows 10, version 1607. Allows IT Admins to pause Feature Updates for up to 60 days. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Feature Updates are not paused. - 1 – Feature Updates are paused for 60 days or until value set to back to 0, whichever is sooner. @@ -509,9 +509,9 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. +

                              Added in Windows 10, version 1607. Allows IT Admins to pause Quality Updates. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Quality Updates are not paused. - 1 – Quality Updates are paused for 35 days or until value set back to 0, whichever is sooner. @@ -523,9 +523,9 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > Don't use this policy in Windows 10, version 1607 devices, instead use the new policies listed in [Changes in Windows 10, version 1607 for update management](device-update-management.md#windows10version1607forupdatemanagement). You can continue to use RequireDeferUpgrade for Windows 10, version 1511 devices. -

                              Allows the IT admin to set a device to CBB train. +

                              Allows the IT admin to set a device to CBB train. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – User gets upgrades from Current Branch. - 1 – User gets upgrades from Current Branch for Business. @@ -541,11 +541,11 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > If you previously used the **Update/PhoneUpdateRestrictions** policy in previous versions of Windows, it has been deprecated. Please use this policy instead. -

                              Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. +

                              Allows the IT admin to restrict the updates that are installed on a device to only those on an update approval list. It enables IT to accept the End User License Agreement (EULA) associated with the approved update on behalf of the end-user. EULAs are approved once an update is approved. -

                              Supported operations are Get and Replace. +

                              Supported operations are Get and Replace. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 – Not configured. The device installs all applicable updates. - 1 – The device only installs updates that are both applicable and on the Approved Updates list. Set this policy to 1 if IT wants to control the deployment of updates on devices, such as when testing is required prior to deployment. @@ -555,24 +555,24 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications. +

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto-restart imminent warning notifications. -

                              Supported values are 15, 30, or 60 (minutes). +

                              Supported values are 15, 30, or 60 (minutes). -

                              The default value is 15 (minutes). +

                              The default value is 15 (minutes). **Update/ScheduledInstallDay** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Enables the IT admin to schedule the day of the update installation. +

                              Enables the IT admin to schedule the day of the update installation. -

                              The data type is a string. +

                              The data type is a string. -

                              Supported operations are Add, Delete, Get, and Replace. +

                              Supported operations are Add, Delete, Get, and Replace. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Every day - 1 – Sunday @@ -588,35 +588,35 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Enables the IT admin to schedule the time of the update installation. +

                              Enables the IT admin to schedule the time of the update installation. -

                              The data type is a string. +

                              The data type is a string. -

                              Supported operations are Add, Delete, Get, and Replace. +

                              Supported operations are Add, Delete, Get, and Replace. -

                              Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. +

                              Supported values are 0-23, where 0 = 12 AM and 23 = 11 PM. -

                              The default value is 3. +

                              The default value is 3. **Update/ScheduleRestartWarning** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto restart warning reminder notifications. +

                              Added in Windows 10, version 1703. Allows the IT Admin to specify the period for auto restart warning reminder notifications. -

                              Supported values are 2, 4, 8, 12, or 24 (hours). +

                              Supported values are 2, 4, 8, 12, or 24 (hours). -

                              The default value is 4 (hours). +

                              The default value is 4 (hours). **Update/SetAutoRestartNotificationDisable** > [!NOTE] > This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education -

                              Added in Windows 10, version 1703. Allows the IT Admin to disable auto restart notifications for update installations. +

                              Added in Windows 10, version 1703. Allows the IT Admin to disable auto restart notifications for update installations. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - 0 (default) – Enabled - 1 – Disabled @@ -628,11 +628,11 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego > [!Important] > Starting in Windows 10, version 1703 this policy is not supported in IoT Enterprise. -

                              Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. +

                              Allows the device to check for updates from a WSUS server instead of Microsoft Update. This is useful for on-premises MDMs that need to update devices that cannot connect to the Internet. -

                              Supported operations are Get and Replace. +

                              Supported operations are Get and Replace. -

                              The following list shows the supported values: +

                              The following list shows the supported values: - Not configured. The device checks for updates from Microsoft Update. - Set to a URL, such as `http://abcd-srv:8530`. The device checks for updates from the WSUS server at the specified URL. @@ -659,13 +659,13 @@ Example > **Note**  This policy is available on Windows 10 Pro, Windows 10 Enterprise, and Windows 10 Education. -

                              Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. +

                              Added in the January service release of Windows 10, version 1607. Specifies an alternate intranet server to host updates from Microsoft Update. You can then use this update service to automatically update computers on your network. -

                              This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. +

                              This setting lets you specify a server on your network to function as an internal update service. The Automatic Updates client will search this service for updates that apply to the computers on your network. -

                              To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. +

                              To use this setting, you must set two server name values: the server from which the Automatic Updates client detects and downloads updates, and the server to which updated workstations upload statistics. You can set both values to be the same server. An optional server name value can be specified to configure Windows Update agent, and download updates from an alternate download server instead of WSUS Server. -

                              Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. +

                              Value type is string and the default value is an empty string, "". If the setting is not configured, and if Automatic Updates is not disabled by policy or user preference, the Automatic Updates client connects directly to the Windows Update site on the Internet. > [!Note] > If the "Configure Automatic Updates" Group Policy is disabled, then this policy has no effect. @@ -827,50 +827,50 @@ Here's the list of corresponding Group Policy settings in HKLM\\Software\\Polici

                              - - - + + - - - + + - - - + + + - - - + + - - - + + - - - + + + - - - + + - - - + + diff --git a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md index 46dd29b427..8290fa7eea 100644 --- a/windows/client-management/mdm/dmprocessconfigxmlfiltered.md +++ b/windows/client-management/mdm/dmprocessconfigxmlfiltered.md @@ -62,25 +62,25 @@ HRESULT STDAPICALLTYPE DMProcessConfigXMLFiltered( ## Parameters *pszXmlIn* -
                                +
                                • [in] The null–terminated input XML buffer containing the configuration data. The parameter holds the XML that will be used to configure the phone. DMProcessConfigXMLFiltered accepts only OMA Client Provisioning XML (also known as WAP provisioning). It does not accept OMA DM SyncML XML (also known as SyncML).

                                *rgszAllowedCspNode* -
                                  +
                                  • [in] Array of WCHAR\* that specify which configuration service provider nodes are allowed to be invoked.

                                  *dwNumAllowedCspNodes* -
                                    +
                                    • [in] Number of elements passed in rgszAllowedCspNode.

                                    *pbstrXmlOut* -
                                      +
                                      • [out] The resulting null–terminated XML from configuration. The caller of DMProcessConfigXMLFiltered is responsible for cleanup of the output buffer that the pbstrXmlOut parameter references. Use SysFreeString to free the memory.

                                      @@ -104,24 +104,24 @@ Returns the standard **HRESULT** value **S\_OK** to indicate success. The follow
                              - - + + - - + + - - + + - - + + - - + +

                              OS upgrade

                              8 months

                              1 month

                              Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5

                              OS upgrade

                              8 months

                              1 month

                              Upgrade - 3689BDC8-B205-4AF4-8D4A-A63924C5E9D5

                              Update

                              1 month

                              1 week

                              +

                              Update

                              1 month

                              1 week

                              Note If a machine has Microsoft Update enabled, any Microsoft Updates in these categories will also observe Defer / Pause logic.
                              @@ -361,10 +361,10 @@ If a machine has Microsoft Update enabled, any Microsoft Updates in these catego

                              Other/cannot defer

                              No deferral

                              No deferral

                              Any update category not enumerated above falls into this category.

                              +

                              Other/cannot defer

                              No deferral

                              No deferral

                              Any update category not enumerated above falls into this category.

                              Definition Update - E0789628-CE08-4437-BE74-2495B842F43B

                              BranchReadinessLevel

                              REG_DWORD

                              16: systems take Feature Updates on the Current Branch (CB) train

                              +

                              BranchReadinessLevel

                              REG_DWORD

                              16: systems take Feature Updates on the Current Branch (CB) train

                              32: systems take Feature Updates on the Current Branch for Business

                              Other value or absent: receive all applicable updates (CB)

                              DeferQualityUpdates

                              REG_DWORD

                              1: defer quality updates

                              +

                              DeferQualityUpdates

                              REG_DWORD

                              1: defer quality updates

                              Other value or absent: don’t defer quality updates

                              DeferQualityUpdatesPeriodInDays

                              REG_DWORD

                              0-30: days to defer quality updates

                              DeferQualityUpdatesPeriodInDays

                              REG_DWORD

                              0-30: days to defer quality updates

                              PauseQualityUpdates

                              REG_DWORD

                              1: pause quality updates

                              +

                              PauseQualityUpdates

                              REG_DWORD

                              1: pause quality updates

                              Other value or absent: don’t pause quality updates

                              DeferFeatureUpdates

                              REG_DWORD

                              1: defer feature updates

                              +

                              DeferFeatureUpdates

                              REG_DWORD

                              1: defer feature updates

                              Other value or absent: don’t defer feature updates

                              DeferFeatureUpdatesPeriodInDays

                              REG_DWORD

                              0-180: days to defer feature updates

                              DeferFeatureUpdatesPeriodInDays

                              REG_DWORD

                              0-180: days to defer feature updates

                              PauseFeatureUpdates

                              REG_DWORD

                              1: pause feature updates

                              +

                              PauseFeatureUpdates

                              REG_DWORD

                              1: pause feature updates

                              Other value or absent: don’t pause feature updates

                              ExcludeWUDriversInQualityUpdate

                              REG_DWORD

                              1: exclude WU drivers

                              +

                              ExcludeWUDriversInQualityUpdate

                              REG_DWORD

                              1: exclude WU drivers

                              Other value or absent: offer WU drivers

                              CONFIG_E_OBJECTBUSY

                              Another instance of the configuration management service is currently running.

                              CONFIG_E_OBJECTBUSY

                              Another instance of the configuration management service is currently running.

                              CONFIG_E_ENTRYNOTFOUND

                              No metabase entry was found.

                              CONFIG_E_ENTRYNOTFOUND

                              No metabase entry was found.

                              CONFIG_E_CSPEXCEPTION

                              An exception occurred in one of the configuration service providers.

                              CONFIG_E_CSPEXCEPTION

                              An exception occurred in one of the configuration service providers.

                              CONFIG_E_TRANSACTIONINGFAILURE

                              A configuration service provider failed to roll back properly. The affected settings might be in an unknown state.

                              CONFIG_E_TRANSACTIONINGFAILURE

                              A configuration service provider failed to roll back properly. The affected settings might be in an unknown state.

                              CONFIG_E_BAD_XML

                              The XML input is invalid or malformed.

                              CONFIG_E_BAD_XML

                              The XML input is invalid or malformed.

                              @@ -196,28 +196,28 @@ if ( bstr != NULL ) -

                              Minimum supported client

                              -

                              None supported

                              +

                              Minimum supported client

                              +

                              None supported

                              -

                              Minimum supported server

                              -

                              None supported

                              +

                              Minimum supported server

                              +

                              None supported

                              -

                              Minimum supported phone

                              -

                              Windows Phone 8.1

                              +

                              Minimum supported phone

                              +

                              Windows Phone 8.1

                              -

                              Header

                              -

                              Dmprocessxmlfiltered.h

                              +

                              Header

                              +

                              Dmprocessxmlfiltered.h

                              -

                              Library

                              -

                              Dmprocessxmlfiltered.lib

                              +

                              Library

                              +

                              Dmprocessxmlfiltered.lib

                              -

                              DLL

                              -

                              Dmprocessxmlfiltered.dll

                              +

                              DLL

                              +

                              Dmprocessxmlfiltered.dll

                              diff --git a/windows/client-management/mdm/dmsessionactions-csp.md b/windows/client-management/mdm/dmsessionactions-csp.md index 8c5772b29c..ffdfc3e2b7 100644 --- a/windows/client-management/mdm/dmsessionactions-csp.md +++ b/windows/client-management/mdm/dmsessionactions-csp.md @@ -63,41 +63,41 @@ DMSessionActions ------------MaxTimeSessionsSkippedInLowPowerState ``` **./Device/Vendor/MSFT/DMSessionActions or ./User/Vendor/MSFT/DMSessionActions** -

                              Defines the root node for the DMSessionActions configuration service provider.

                              +

                              Defines the root node for the DMSessionActions configuration service provider.

                              ***ProviderID*** -

                              Group settings per device management (DM) server. Each group of settings is distinguished by the Provider ID of the server. It must be the same DM server Provider ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. Only one enterprise management server is supported, which means there should be only one ProviderID node under NodeCache.

                              +

                              Group settings per device management (DM) server. Each group of settings is distinguished by the Provider ID of the server. It must be the same DM server Provider ID value that was supplied through the w7 APPLICATION configuration service provider XML during the enrollment process. Only one enterprise management server is supported, which means there should be only one ProviderID node under NodeCache.

                              -

                              Scope is dynamic. Supported operations are Get, Add, and Delete.

                              +

                              Scope is dynamic. Supported operations are Get, Add, and Delete.

                              ***ProviderID*/CheckinAlertConfiguration** -

                              Node for the custom configuration of alerts to be sent during MDM sync session.

                              +

                              Node for the custom configuration of alerts to be sent during MDM sync session.

                              ***ProviderID*/CheckinAlertConfiguration/Nodes** -

                              Required. Root node for URIs to be queried. Scope is dynamic.

                              +

                              Required. Root node for URIs to be queried. Scope is dynamic.

                              -

                              Supported operation is Get.

                              +

                              Supported operation is Get.

                              ***ProviderID*/CheckinAlertConfiguration/Nodes/*NodeID*** -

                              Required. Information about each node is stored under NodeID as specified by the server. This value must not contain a comma. Scope is dynamic.

                              +

                              Required. Information about each node is stored under NodeID as specified by the server. This value must not contain a comma. Scope is dynamic.

                              -

                              Supported operations are Get, Add, and Delete.

                              +

                              Supported operations are Get, Add, and Delete.

                              ***ProviderID*/CheckinAlertConfiguration/Nodes/*NodeID*/NodeURI** -

                              Required. The value is a complete OMA DM node URI. It can specify either an interior node or a leaf node in the device management tree. Scope is dynamic.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Required. The value is a complete OMA DM node URI. It can specify either an interior node or a leaf node in the device management tree. Scope is dynamic.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **AlertData** -

                              Node to query the custom alert per server configuration

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Node to query the custom alert per server configuration

                              +

                              Value type is string. Supported operation is Get.

                              **PowerSettings** -

                              Node for power-related configrations

                              +

                              Node for power-related configrations

                              **PowerSettings/MaxSkippedSessionsInLowPowerState** -

                              Maximum number of continuous skipped sync sessions when the device is in low-power state.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Maximum number of continuous skipped sync sessions when the device is in low-power state.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **PowerSettings/MaxTimeSessionsSkippedInLowPowerState** -

                              Maximum time in minutes when the device can skip the check-in with the server if the device is in low-power state.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Maximum time in minutes when the device can skip the check-in with the server if the device is in low-power state.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              diff --git a/windows/client-management/mdm/dynamicmanagement-csp.md b/windows/client-management/mdm/dynamicmanagement-csp.md index 3716a1c54a..3b59ea0c12 100644 --- a/windows/client-management/mdm/dynamicmanagement-csp.md +++ b/windows/client-management/mdm/dynamicmanagement-csp.md @@ -33,12 +33,12 @@ DynamicManagement ----AlertsEnabled ``` **DynamicManagement** -

                              The root node for the DynamicManagement configuration service provider.

                              +

                              The root node for the DynamicManagement configuration service provider.

                              **NotificationsEnabled** -

                              Boolean value for sending notification to the user of a context change.

                              -

                              Default value is False. Supported operations are Get and Replace.

                              -

                              Example to turn on NotificationsEnabled:

                              +

                              Boolean value for sending notification to the user of a context change.

                              +

                              Default value is False. Supported operations are Get and Replace.

                              +

                              Example to turn on NotificationsEnabled:

                              ```xml @@ -56,40 +56,40 @@ DynamicManagement ``` **ActiveList** -

                              A string containing the list of all active ContextIDs on the device. Delimeter is unicode character 0xF000..

                              -

                              Supported operation is Get.

                              +

                              A string containing the list of all active ContextIDs on the device. Delimeter is unicode character 0xF000..

                              +

                              Supported operation is Get.

                              **Contexts** -

                              Node for context information.

                              -

                              Supported operation is Get.

                              +

                              Node for context information.

                              +

                              Supported operation is Get.

                              ***ContextID*** -

                              Node created by the server to define a context. Maximum number of characters allowed is 38.

                              -

                              Supported operations are Add, Get, and Delete.

                              +

                              Node created by the server to define a context. Maximum number of characters allowed is 38.

                              +

                              Supported operations are Add, Get, and Delete.

                              **SignalDefinition** -

                              Signal Definition XML.

                              -

                              Value type is string. Supported operations are Add, Get, Delete, and Replace.

                              +

                              Signal Definition XML.

                              +

                              Value type is string. Supported operations are Add, Get, Delete, and Replace.

                              **SettingsPack** -

                              Settings that get applied when the Context is active.

                              -

                              Value type is string. Supported operations are Add, Get, Delete, and Replace.

                              +

                              Settings that get applied when the Context is active.

                              +

                              Value type is string. Supported operations are Add, Get, Delete, and Replace.

                              **SettingsPackResponse** -

                              Response from applying a Settings Pack that contains information on each individual action.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Response from applying a Settings Pack that contains information on each individual action.

                              +

                              Value type is string. Supported operation is Get.

                              **ContextStatus** -

                              Reports status of the context. If there was a failure, SettingsPackResponse should be checked for what exactly failed.

                              -

                              Value type is integer. Supported operation is Get.

                              +

                              Reports status of the context. If there was a failure, SettingsPackResponse should be checked for what exactly failed.

                              +

                              Value type is integer. Supported operation is Get.

                              **Altitude** -

                              A value that determines how to handle conflict resolution of applying multiple contexts on the device. This is required and must be distinct of other priorities.

                              -

                              Value type is integer. Supported operations are Add, Get, Delete, and Replace.

                              +

                              A value that determines how to handle conflict resolution of applying multiple contexts on the device. This is required and must be distinct of other priorities.

                              +

                              Value type is integer. Supported operations are Add, Get, Delete, and Replace.

                              **AlertsEnabled** -

                              A Boolean value for sending an alert to the server when a context fails.

                              -

                              Supported operations are Get and Replace.

                              +

                              A Boolean value for sending an alert to the server when a context fails.

                              +

                              Supported operations are Get and Replace.

                              ## Examples diff --git a/windows/client-management/mdm/enterpriseapn-csp.md b/windows/client-management/mdm/enterpriseapn-csp.md index c271c1dbe6..f82e763f75 100644 --- a/windows/client-management/mdm/enterpriseapn-csp.md +++ b/windows/client-management/mdm/enterpriseapn-csp.md @@ -39,40 +39,40 @@ EnterpriseAPN --------HideView ``` **EnterpriseAPN** -

                              The root node for the EnterpriseAPN configuration service provider.

                              +

                              The root node for the EnterpriseAPN configuration service provider.

                              **EnterpriseAPN/***ConnectionName* -

                              Name of the connection as seen by Windows Connection Manager.

                              +

                              Name of the connection as seen by Windows Connection Manager.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/APNName** -

                              Enterprise APN name.

                              +

                              Enterprise APN name.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/IPType** -

                              This value can be one of the following:

                              +

                              This value can be one of the following:

                              - IPv4 - only IPV4 connection type - IPv6 - only IPv6 connection type - IPv4v6 (default)- IPv4 and IPv6 concurrently. - IPv4v6xlat - IPv6 with IPv4 provided by 46xlat -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/IsAttachAPN** -

                              Boolean value that indicates whether this APN should be requested as part of an LTE Attach. Default value is false.

                              +

                              Boolean value that indicates whether this APN should be requested as part of an LTE Attach. Default value is false.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/ClassId** -

                              GUID that defines the APN class to the modem. This is the same as the OEMConnectionId in CM_CellularEntries CSP. Normally this setting is not present. It is only required when IsAttachAPN is true and the attach APN is not only used as the Internet APN.

                              +

                              GUID that defines the APN class to the modem. This is the same as the OEMConnectionId in CM_CellularEntries CSP. Normally this setting is not present. It is only required when IsAttachAPN is true and the attach APN is not only used as the Internet APN.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/AuthType** -

                              Authentication type. This value can be one of the following:

                              +

                              Authentication type. This value can be one of the following:

                              - None (default) - Auto @@ -80,39 +80,39 @@ EnterpriseAPN - CHAP - MSCHAPv2 -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/UserName** -

                              User name for use with PAP, CHAP, or MSCHAPv2 authentication.

                              +

                              User name for use with PAP, CHAP, or MSCHAPv2 authentication.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/Password** -

                              Password corresponding to the username.

                              +

                              Password corresponding to the username.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/IccId** -

                              Integrated Circuit Card ID (ICCID) associated with the cellular connection profile. If this node is not present, the connection is created on a single-slot device using the ICCID of the UICC and on a dual-slot device using the ICCID of the UICC that is active for data.

                              +

                              Integrated Circuit Card ID (ICCID) associated with the cellular connection profile. If this node is not present, the connection is created on a single-slot device using the ICCID of the UICC and on a dual-slot device using the ICCID of the UICC that is active for data.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/AlwaysOn** -

                              Added in Windows 10, version 1607. Boolean value that specifies whether the CM will automatically attempt to connect to the APN when a connection is available.

                              +

                              Added in Windows 10, version 1607. Boolean value that specifies whether the CM will automatically attempt to connect to the APN when a connection is available.

                              -

                              The default value is true.

                              +

                              The default value is true.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/Enabled** -

                              Added in Windows 10, version 1607. Boolean that specifies whether the connection is enabled.

                              +

                              Added in Windows 10, version 1607. Boolean that specifies whether the connection is enabled.

                              -

                              The default value is true.

                              +

                              The default value is true.

                              -

                              Supported operations are Add, Get, Delete, and Replace.

                              +

                              Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/*ConnectionName*/Roaming** -

                              Added in Windows 10, version 1703. Specifies whether the connection should be activated when the device is roaming. Valid values:

                              +

                              Added in Windows 10, version 1703. Specifies whether the connection should be activated when the device is roaming. Valid values:

                              • 0 - Disallowed
                              • @@ -123,27 +123,27 @@ EnterpriseAPN
                              • 5 - UseOnlyForRoaming
                              -

                              Default is 1 (all roaming allowed).

                              +

                              Default is 1 (all roaming allowed).

                              -

                              Value type is string. Supported operations are Add, Get, Delete, and Replace.

                              +

                              Value type is string. Supported operations are Add, Get, Delete, and Replace.

                              **EnterpriseAPN/Settings** -

                              Added in Windows 10, version 1607. Node that contains global settings.

                              +

                              Added in Windows 10, version 1607. Node that contains global settings.

                              **EnterpriseAPN/Settings/AllowUserControl** -

                              Added in Windows 10, version 1607. Boolean value that specifies whether the cellular UX will allow users to connect with other APNs other than the Enterprise APN.

                              +

                              Added in Windows 10, version 1607. Boolean value that specifies whether the cellular UX will allow users to connect with other APNs other than the Enterprise APN.

                              -

                              The default value is false.

                              +

                              The default value is false.

                              -

                              Supported operations are Get and Replace.

                              +

                              Supported operations are Get and Replace.

                              **EnterpriseAPN/Settings/HideView** -

                              Added in Windows 10, version 1607. Boolean that specifies whether the cellular UX will allow the user to view enterprise APNs. Only applicable if AllowUserControl is true.

                              +

                              Added in Windows 10, version 1607. Boolean that specifies whether the cellular UX will allow the user to view enterprise APNs. Only applicable if AllowUserControl is true.

                              -

                              The default value is false.

                              +

                              The default value is false.

                              -

                              Supported operations are Get and Replace.

                              +

                              Supported operations are Get and Replace.

                              ## Examples diff --git a/windows/client-management/mdm/enterpriseappvmanagement-csp.md b/windows/client-management/mdm/enterpriseappvmanagement-csp.md index 9a0893f98e..cb948488da 100644 --- a/windows/client-management/mdm/enterpriseappvmanagement-csp.md +++ b/windows/client-management/mdm/enterpriseappvmanagement-csp.md @@ -45,68 +45,68 @@ EnterpriseAppVManagement ------------Policy ``` **./Vendor/MSFT/EnterpriseAppVManagement** -

                              Root node for the EnterpriseAppVManagement configuration service provider.

                              +

                              Root node for the EnterpriseAppVManagement configuration service provider.

                              **AppVPackageManagement** -

                              Used to query App-V package information (post-publish).

                              +

                              Used to query App-V package information (post-publish).

                              **AppVPackageManagement/EnterpriseID** -

                              Used to query package information. Value is always "HostedInstall".

                              +

                              Used to query package information. Value is always "HostedInstall".

                              **AppVPackageManagement/EnterpriseID/PackageFamilyName** -

                              Package ID of the published App-V package.

                              +

                              Package ID of the published App-V package.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*** -

                              Version ID of the published App-V package.

                              +

                              Version ID of the published App-V package.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/Name** -

                              Name specified in the published AppV package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Name specified in the published AppV package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/Version** -

                              Version specified in the published AppV package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Version specified in the published AppV package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/Publisher** -

                              Publisher as specified in the published asset information of the AppV package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Publisher as specified in the published asset information of the AppV package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/InstallLocation** -

                              Local package path specified in the published asset information of the AppV package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Local package path specified in the published asset information of the AppV package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/InstallDate** -

                              Date the app was installed, as specified in the published asset information of the AppV package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Date the app was installed, as specified in the published asset information of the AppV package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/Users** -

                              Registered users for app, as specified in the published asset information of the AppV package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Registered users for app, as specified in the published asset information of the AppV package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/AppVPackageId** -

                              Package ID of the published App-V package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Package ID of the published App-V package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/AppVVersionId** -

                              Version ID of the published App-V package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Version ID of the published App-V package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPackageManagement/*EnterpriseID*/*PackageFamilyName*/*PackageFullName*/AppVPackageUri** -

                              Package URI of the published App-V package.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Package URI of the published App-V package.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPublishing** -

                              Used to monitor publishing operations on App-V.

                              +

                              Used to monitor publishing operations on App-V.

                              **AppVPublishing/LastSync** -

                              Used to monitor publishing status of last sync operation.

                              +

                              Used to monitor publishing status of last sync operation.

                              **AppVPublishing/LastSync/LastError** -

                              Error code and error description of last sync operation.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Error code and error description of last sync operation.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPublishing/LastSync/LastErrorDescription** -

                              Last sync error status. One of the following values may be returned:

                              +

                              Last sync error status. One of the following values may be returned:

                              - SYNC\_ERR_NONE (0) - No errors during publish. - SYNC\_ERR\_UNPUBLISH_GROUPS (1) - Unpublish groups failed during publish. @@ -116,10 +116,10 @@ EnterpriseAppVManagement - SYNC\_ERR\_NEW_POLICY_WRITE (5) - New policy write failed during publish. - SYNC\_ERR\_MULTIPLE\_DURING_PUBLISH (6) - Multiple non-fatal errors occurred during publish. -

                              Value type is string. Supported operation is Get.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPublishing/LastSync/SyncStatusDescription** -

                              Latest sync in-progress stage. One of the following values may be returned:

                              +

                              Latest sync in-progress stage. One of the following values may be returned:

                              - SYNC\_PROGRESS_IDLE (0) - App-V publishing is idle. - SYNC\_PROGRESS\_UNPUBLISH_GROUPS (1) - App-V connection groups publish in progress. @@ -127,9 +127,9 @@ EnterpriseAppVManagement - SYNC\_PROGRESS\_PUBLISH\_GROUP_PACKAGES (3) - App-V packages (connection group) publish in progress. - SYN\C_PROGRESS_UNPUBLISH_PACKAGES (4) - App-V packages unpublish in progress. -

                              Value type is string. Supported operation is Get.

                              +

                              Value type is string. Supported operation is Get.

                              -AppVPublishing/LastSync/SyncProgress

                              Latest sync state. One of the following values may be returned:

                              +AppVPublishing/LastSync/SyncProgress

                              Latest sync state. One of the following values may be returned:

                              - SYNC\_STATUS_IDLE (0) - App-V Sync is idle. - SYNC\_STATUS\_PUBLISH_STARTED (1) - App-V Sync is initializing. @@ -137,22 +137,22 @@ EnterpriseAppVManagement - SYNC\_STATUS\_PUBLISH\_COMPLETED (3) - App-V Sync is complete. - SYNC\_STATUS\_PUBLISH\_REBOOT_REQUIRED (4) - App-V Sync requires device reboot. -

                              Value type is string. Supported operation is Get.

                              +

                              Value type is string. Supported operation is Get.

                              **AppVPublishing/Sync** -

                              Used to perform App-V synchronization.

                              +

                              Used to perform App-V synchronization.

                              **AppVPublishing/Sync/PublishXML** -

                              Used to execute the App-V synchronization using the Publishing protocol. For more information about the protocol see [MS-VAPR]: Virtual Application Publishing and Reporting (App-V) Protocol.

                              -

                              Supported operations are Get, Delete, and Execute.

                              +

                              Used to execute the App-V synchronization using the Publishing protocol. For more information about the protocol see [MS-VAPR]: Virtual Application Publishing and Reporting (App-V) Protocol.

                              +

                              Supported operations are Get, Delete, and Execute.

                              **AppVDynamicPolicy** -

                              Used to set App-V Policy Configuration documents for publishing packages.

                              +

                              Used to set App-V Policy Configuration documents for publishing packages.

                              **AppVDynamicPolicy/*ConfigurationId*** -

                              ID for App-V Policy Configuration document for publishing packages (referenced in the Publishing protocol document).

                              +

                              ID for App-V Policy Configuration document for publishing packages (referenced in the Publishing protocol document).

                              **AppVDynamicPolicy/*ConfigurationId*/Policy** -

                              XML for App-V Policy Configuration documents for publishing packages.

                              -

                              Value type is xml. Supported operations are Add, Get, Delete, and Replace.

                              \ No newline at end of file +

                              XML for App-V Policy Configuration documents for publishing packages.

                              +

                              Value type is xml. Supported operations are Add, Get, Delete, and Replace.

                              \ No newline at end of file diff --git a/windows/client-management/mdm/enterpriseextfilessystem-csp.md b/windows/client-management/mdm/enterpriseextfilessystem-csp.md index 12f02b683f..58fdde76ab 100644 --- a/windows/client-management/mdm/enterpriseextfilessystem-csp.md +++ b/windows/client-management/mdm/enterpriseextfilessystem-csp.md @@ -40,10 +40,10 @@ EnterpriseExtFileSystem The following list describes the characteristics and parameters. **./Vendor/MSFT/EnterpriseExtFileSystem** -

                              The root node for the EnterpriseExtFileSystem configuration service provider. Supported operations are Add and Get.

                              +

                              The root node for the EnterpriseExtFileSystem configuration service provider. Supported operations are Add and Get.

                              **Persistent** -

                              The EnterpriseExtFileSystem CSP allows an enterprise to read, write, delete and list files in this folder. When an app writes data to the Persistent folder, it accesses that data from the EnterpriseExtFileSystem\Persistent node. Files written to the Persistent folder persists over ordinary power cycles.

                              +

                              The EnterpriseExtFileSystem CSP allows an enterprise to read, write, delete and list files in this folder. When an app writes data to the Persistent folder, it accesses that data from the EnterpriseExtFileSystem\Persistent node. Files written to the Persistent folder persists over ordinary power cycles.

                              > **Important**  There is a limit to the amount of data that can be persisted, which varies depending on how much disk space is available on one of the partitions. This data cap amount (that can be persisted) varies by manufacturer. > @@ -54,24 +54,24 @@ The following list describes the characteristics and parameters. **NonPersistent** -

                              The EnterpriseExtFileSystem CSP allows an enterprise to read, write, delete and list files in this folder. When an app writes data to the Non-Persistent folder, it accesses that data from the EnterpriseExtFileSystem\NonPersistent node. Files written to the NonPersistent folder will persist over ordinary power cycles.

                              +

                              The EnterpriseExtFileSystem CSP allows an enterprise to read, write, delete and list files in this folder. When an app writes data to the Non-Persistent folder, it accesses that data from the EnterpriseExtFileSystem\NonPersistent node. Files written to the NonPersistent folder will persist over ordinary power cycles.

                              -

                              When the device is wiped, any data stored in the NonPersistent folder is deleted.

                              +

                              When the device is wiped, any data stored in the NonPersistent folder is deleted.

                              **OemProfile** -

                              Added in Windows 10, version 1511. The EnterpriseExtFileSystem CSP allows an enterprise to deploy an OEM profile on the device, such as a barcode scanner profile then can be consumed by the OEM barcode scanner driver. The file is placed into the \data\shareddata\oem\public\profile\ folder of the device.

                              +

                              Added in Windows 10, version 1511. The EnterpriseExtFileSystem CSP allows an enterprise to deploy an OEM profile on the device, such as a barcode scanner profile then can be consumed by the OEM barcode scanner driver. The file is placed into the \data\shareddata\oem\public\profile\ folder of the device.

                              ***Directory*** -

                              The name of a directory in the device file system. Any Directory node can have directories and files as child nodes.

                              +

                              The name of a directory in the device file system. Any Directory node can have directories and files as child nodes.

                              -

                              Use the Add command to create a new directory. You cannot use it to add a new directory under a file system root.

                              +

                              Use the Add command to create a new directory. You cannot use it to add a new directory under a file system root.

                              -

                              Use the Get command to return the list of child node names under Directory.

                              +

                              Use the Get command to return the list of child node names under Directory.

                              -

                              Use the Get command with ?List=Struct to recursively return all child node names, including subdirectory names, under Directory.

                              +

                              Use the Get command with ?List=Struct to recursively return all child node names, including subdirectory names, under Directory.

                              ***Filename*** -

                              The name of a file in the device file system.

                              +

                              The name of a file in the device file system.

                              Supported operations is Get. diff --git a/windows/client-management/mdm/firewall-csp.md b/windows/client-management/mdm/firewall-csp.md index 19fbe15c22..2d9fbf4570 100644 --- a/windows/client-management/mdm/firewall-csp.md +++ b/windows/client-management/mdm/firewall-csp.md @@ -103,68 +103,68 @@ Firewall ----------------Name ``` **./Vendor/MSFT/Firewall** -

                              Root node for the Firewall configuration service provider.

                              +

                              Root node for the Firewall configuration service provider.

                              **MdmStore** -

                              Interior node.

                              -

                              Supported operation is Get.

                              +

                              Interior node.

                              +

                              Supported operation is Get.

                              **MdmStore/Global** -

                              Interior node.

                              -

                              Supported operations are Get.

                              +

                              Interior node.

                              +

                              Supported operations are Get.

                              **MdmStore/Global/PolicyVersionSupported** -

                              Integer value that contains the maximum policy version that the server host can accept. The version number is two octets in size. The lowest-order octet is the minor version; the second-to-lowest octet is the major version. This value is not merged and is always a fixed value for a particular firewall and advanced security components software build.

                              -

                              Value type in integer. Supported operation is Get.

                              +

                              Integer value that contains the maximum policy version that the server host can accept. The version number is two octets in size. The lowest-order octet is the minor version; the second-to-lowest octet is the major version. This value is not merged and is always a fixed value for a particular firewall and advanced security components software build.

                              +

                              Value type in integer. Supported operation is Get.

                              **MdmStore/Global/CurrentProfiles** -

                              Integer value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.

                              -

                              Value type in integer. Supported operation is Get.

                              +

                              Integer value that contains a bitmask of the current enforced profiles that are maintained by the server firewall host. See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types. This value is available only in the dynamic store; therefore, it is not merged and has no merge law.

                              +

                              Value type in integer. Supported operation is Get.

                              **MdmStore/Global/DisableStatefulFtp** -

                              Boolean value. If false, the firewall performs stateful File Transfer Protocol (FTP) filtering to allow secondary connections. True means stateful FTP is disabled. The merge law for this option is to let "true" values win.

                              -

                              Default value is false.

                              -

                              Data type is bool. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Boolean value. If false, the firewall performs stateful File Transfer Protocol (FTP) filtering to allow secondary connections. True means stateful FTP is disabled. The merge law for this option is to let "true" values win.

                              +

                              Default value is false.

                              +

                              Data type is bool. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/Global/SaIdleTime** -

                              This value configures the security association idle time, in seconds. Security associations are deleted after network traffic is not seen for this specified period of time. The value is integer and MUST be in the range of 300 to 3,600 inclusive. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

                              -

                              Default value is 300.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              This value configures the security association idle time, in seconds. Security associations are deleted after network traffic is not seen for this specified period of time. The value is integer and MUST be in the range of 300 to 3,600 inclusive. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

                              +

                              Default value is 300.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/Global/PresharedKeyEncoding** -

                              Specifies the preshared key encoding that is used. The value is integer and MUST be a valid value from the PRESHARED_KEY_ENCODING_VALUES enumeration. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

                              -

                              Default value is 1.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Specifies the preshared key encoding that is used. The value is integer and MUST be a valid value from the PRESHARED_KEY_ENCODING_VALUES enumeration. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

                              +

                              Default value is 1.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/Global/IPsecExempt** -

                              This value configures IPsec exceptions. The value is integer and MUST be a combination of the valid flags that are defined in IPSEC_EXEMPT_VALUES; therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

                              -

                              Default value is 0.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              This value configures IPsec exceptions. The value is integer and MUST be a combination of the valid flags that are defined in IPSEC_EXEMPT_VALUES; therefore, the maximum value MUST always be IPSEC_EXEMPT_MAX-1 for servers supporting a schema version of 0x0201 and IPSEC_EXEMPT_MAX_V2_0-1 for servers supporting a schema version of 0x0200. If the maximum value is exceeded when the method RRPC_FWSetGlobalConfig (Opnum 4) is called, the method returns ERROR_INVALID_PARAMETER. This error code is returned if no other preceding error is discovered. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value.

                              +

                              Default value is 0.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/Global/CRLcheck** -

                              This value specifies how certificate revocation list (CRL) verification is enforced. The value is integer and MUST be 0, 1, or 2. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value. Valid valued:

                              +

                              This value specifies how certificate revocation list (CRL) verification is enforced. The value is integer and MUST be 0, 1, or 2. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, use the local store value. Valid valued:

                              • 0 disables CRL checking
                              • 1 specifies that CRL checking is attempted and that certificate validation fails only if the certificate is revoked. Other failures that are encountered during CRL checking (such as the revocation URL being unreachable) do not cause certificate validation to fail.
                              • 2 means that checking is required and that certificate validation fails if any error is encountered during CRL processing
                              -

                              Default value is 0.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Default value is 0.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/Global/PolicyVersion** -

                              This value contains the policy version of the policy store being managed. This value is not merged and therefore, has no merge law.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              This value contains the policy version of the policy store being managed. This value is not merged and therefore, has no merge law.

                              +

                              Value type is string. Supported operation is Get.

                              **MdmStore/Global/BinaryVersionSupported** -

                              This value contains the binary version of the structures and data types that are supported by the server. This value is not merged. In addition, this value is always a fixed value for a specific firewall and advanced security component's software build. This value identifies a policy configuration option that is supported only on servers that have a schema version of 0x0201.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              This value contains the binary version of the structures and data types that are supported by the server. This value is not merged. In addition, this value is always a fixed value for a specific firewall and advanced security component's software build. This value identifies a policy configuration option that is supported only on servers that have a schema version of 0x0201.

                              +

                              Value type is string. Supported operation is Get.

                              **MdmStore/Global/OpportunisticallyMatchAuthSetPerKM** -

                              This value is bool used as an on/off switch. When this option is false (off), keying modules MUST ignore the entire authentication set if they do not support all of the authentication suites specified in the set. When this option is true (on), keying modules MUST ignore only the authentication suites that they don’t support. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.

                              -

                              Boolean value. Supported operations are Add, Get, Replace, and Delete.

                              +

                              This value is bool used as an on/off switch. When this option is false (off), keying modules MUST ignore the entire authentication set if they do not support all of the authentication suites specified in the set. When this option is true (on), keying modules MUST ignore only the authentication suites that they don’t support. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.

                              +

                              Boolean value. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/Global/EnablePacketQueue** -

                              This value specifies how scaling for the software on the receive side is enabled for both the encrypted receive and clear text forward path for the IPsec tunnel gateway scenario. Use of this option also ensures that the packet order is preserved. The data type for this option value is integer and is a combination of flags. Valid values:

                              +

                              This value specifies how scaling for the software on the receive side is enabled for both the encrypted receive and clear text forward path for the IPsec tunnel gateway scenario. Use of this option also ensures that the packet order is preserved. The data type for this option value is integer and is a combination of flags. Valid values:

                              • 0x00 indicates that all queuing is to be disabled
                              • @@ -172,71 +172,71 @@ Firewall
                              • 0x02 specifies that packets are to be queued after decryption is performed for forwarding
                              -

                              Default value is 0.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Default value is 0.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **MdmStore/DomainProfile** -

                              Interior node. Supported operation is Get.

                              +

                              Interior node. Supported operation is Get.

                              **MdmStore/PrivateProfile** -

                              Interior node. Supported operation is Get.

                              +

                              Interior node. Supported operation is Get.

                              **MdmStore/PublicProfile** -

                              Interior node. Supported operation is Get.

                              +

                              Interior node. Supported operation is Get.

                              **/EnableFirewall** -

                              Boolean value for the firewall and advanced security enforcement. If this value is false, the server MUST NOT block any network traffic, regardless of other policy settings. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              -

                              Default value is true.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value for the firewall and advanced security enforcement. If this value is false, the server MUST NOT block any network traffic, regardless of other policy settings. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              +

                              Default value is true.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/DisableStealthMode** -

                              Boolean value. When this option is false, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              -

                              Default value is false.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. When this option is false, the server operates in stealth mode. The firewall rules used to enforce stealth mode are implementation-specific. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              +

                              Default value is false.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/Shielded** -

                              Boolean value. If this value is true and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let "true" values win.

                              -

                              Default value is false.

                              -

                              Value type is bool. Supported operations are Get and Replace.

                              +

                              Boolean value. If this value is true and EnableFirewall is on, the server MUST block all incoming traffic regardless of other policy settings. The merge law for this option is to let "true" values win.

                              +

                              Default value is false.

                              +

                              Value type is bool. Supported operations are Get and Replace.

                              **/DisableUnicastResponsesToMulticastBroadcast** -

                              Boolean value. If it is true, unicast responses to multicast broadcast traffic is blocked. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              -

                              Default value is false.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. If it is true, unicast responses to multicast broadcast traffic is blocked. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              +

                              Default value is false.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/DisableInboundNotifications** -

                              Boolean value. If this value is false, the firewall MAY display a notification to the user when an application is blocked from listening on a port. If this value is on, the firewall MUST NOT display such a notification. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              -

                              Default value is false.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. If this value is false, the firewall MAY display a notification to the user when an application is blocked from listening on a port. If this value is on, the firewall MUST NOT display such a notification. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              +

                              Default value is false.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/AuthAppsAllowUserPrefMerge** -

                              Boolean value. If this value is false, authorized application firewall rules in the local store are ignored and not enforced. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              -

                              Default value is true.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. If this value is false, authorized application firewall rules in the local store are ignored and not enforced. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              +

                              Default value is true.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/GlobalPortsAllowUserPrefMerge** -

                              Boolean value. If this value is false, global port firewall rules in the local store are ignored and not enforced. The setting only has meaning if it is set or enumerated in the Group Policy store or if it is enumerated from the GroupPolicyRSoPStore. The merge law for this option is to let the value GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              -

                              Default value is true.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. If this value is false, global port firewall rules in the local store are ignored and not enforced. The setting only has meaning if it is set or enumerated in the Group Policy store or if it is enumerated from the GroupPolicyRSoPStore. The merge law for this option is to let the value GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used.

                              +

                              Default value is true.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/AllowLocalPolicyMerge** -

                              Boolean value. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.

                              -

                              Default value is true.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. If this value is false, firewall rules from the local store are ignored and not enforced. The merge law for this option is to always use the value of the GroupPolicyRSoPStore. This value is valid for all schema versions.

                              +

                              Default value is true.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/AllowLocalIpsecPolicyMerge** -

                              Boolean value. If this value is false, connection security rules from the local store are ignored and not enforced, regardless of the schema version and connection security rule version. The merge law for this option is to always use the value of the GroupPolicyRSoPStore.

                              -

                              Default value is true.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. If this value is false, connection security rules from the local store are ignored and not enforced, regardless of the schema version and connection security rule version. The merge law for this option is to always use the value of the GroupPolicyRSoPStore.

                              +

                              Default value is true.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **/DefaultOutboundAction** -

                              This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. DefaultOutboundAction will block all outbound traffic unless it is explicitly specified not to block.

                              +

                              This value is the action that the firewall does by default (and evaluates at the very end) on outbound connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. DefaultOutboundAction will block all outbound traffic unless it is explicitly specified not to block.

                              • 0x00000000 - allow
                              • 0x00000001 - block
                              -

                              Default value is 0 (allow).

                              -

                              Value type is integer. Supported operations are Add, Get and Replace.

                              +

                              Default value is 0 (allow).

                              +

                              Value type is integer. Supported operations are Add, Get and Replace.

                              Sample syncxml to provision the firewall settings to evaluate @@ -263,70 +263,70 @@ Sample syncxml to provision the firewall settings to evaluate ``` **/DefaultInboundAction** -

                              This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore.win if it is configured; otherwise, the local store value is used.

                              +

                              This value is the action that the firewall does by default (and evaluates at the very end) on inbound connections. The merge law for this option is to let the value of the GroupPolicyRSoPStore.win if it is configured; otherwise, the local store value is used.

                              • 0x00000000 - allow
                              • 0x00000001 - block
                              -

                              Default value is 1 (block).

                              -

                              Value type is integer. Supported operations are Add, Get and Replace.

                              +

                              Default value is 1 (block).

                              +

                              Value type is integer. Supported operations are Add, Get and Replace.

                              **/DisableStealthModeIpsecSecuredPacketExemption** -

                              Boolean value. This option is ignored if DisableStealthMode is true. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.

                              -

                              Default value is true.

                              -

                              Value type is bool. Supported operations are Add, Get and Replace.

                              +

                              Boolean value. This option is ignored if DisableStealthMode is true. Otherwise, when this option is true, the firewall's stealth mode rules MUST NOT prevent the host computer from responding to unsolicited network traffic if that traffic is secured by IPsec. The merge law for this option is to let the value of the GroupPolicyRSoPStore win if it is configured; otherwise, the local store value is used. For schema versions 0x0200, 0x0201, and 0x020A, this value is invalid and MUST NOT be used.

                              +

                              Default value is true.

                              +

                              Value type is bool. Supported operations are Add, Get and Replace.

                              **FirewallRules** -

                              A list of rules controlling traffic through the Windows Firewall. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.

                              +

                              A list of rules controlling traffic through the Windows Firewall. Each Rule ID is OR'ed. Within each rule ID each Filter type is AND'ed.

                              **FirewallRules/_FirewallRuleName_** -

                              Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).

                              -

                              Supported operations are Add, Get, Replace, and Delete.

                              +

                              Unique alpha numeric identifier for the rule. The rule name must not include a forward slash (/).

                              +

                              Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/App** -

                              Rules that control connections for an app, program, or service. Specified based on the intersection of the following nodes:

                              +

                              Rules that control connections for an app, program, or service. Specified based on the intersection of the following nodes:

                              • PackageFamilyName
                              • FilePath
                              • FQBN
                              • ServiceName
                              -

                              If not specified, the default is All.

                              -

                              Supported operation is Get.

                              +

                              If not specified, the default is All.

                              +

                              Supported operation is Get.

                              **FirewallRules/_FirewallRuleName_/App/PackageFamilyName** -

                              This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              This App/Id value represents the PackageFamilyName of the app. The PackageFamilyName is the unique name of a Microsoft Store application.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/App/FilePath** -

                              This App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              This App/Id value represents the full file path of the app. For example, C:\Windows\System\Notepad.exe.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/App/Fqbn** -

                              Fully Qualified Binary Name

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Fully Qualified Binary Name

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/App/ServiceName** -

                              This is a service name used in cases when a service, not an application, is sending or receiving traffic.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              This is a service name used in cases when a service, not an application, is sending or receiving traffic.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/Protocol** -

                              0-255 number representing the ip protocol (TCP = 6, UDP = 17)

                              -

                              If not specified, the default is All.

                              -

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              +

                              0-255 number representing the ip protocol (TCP = 6, UDP = 17)

                              +

                              If not specified, the default is All.

                              +

                              Value type is integer. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/LocalPortRanges** -

                              Comma separated list of ranges. For example, 100-120,200,300-320.

                              -

                              If not specified, the default is All.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Comma separated list of ranges. For example, 100-120,200,300-320.

                              +

                              If not specified, the default is All.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/RemotePortRanges** -

                              Comma separated list of ranges, For example, 100-120,200,300-320.

                              -

                              If not specified, the default is All.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Comma separated list of ranges, For example, 100-120,200,300-320.

                              +

                              If not specified, the default is All.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/*FirewallRuleName*/LocalAddressRanges** -

                              Comma separated list of local addresses covered by the rule. The default value is "*". Valid tokens include:

                              +

                              Comma separated list of local addresses covered by the rule. The default value is "*". Valid tokens include:

                              • "*" indicates any local address. If present, this must be the only token included.
                              • A subnet can be specified using either the subnet mask or network prefix notation. If neither a subnet mask nor a network prefix is specified, the subnet mask defaults to 255.255.255.255.
                              • @@ -334,11 +334,11 @@ Sample syncxml to provision the firewall settings to evaluate
                              • An IPv4 address range in the format of "start address - end address" with no spaces included.
                              • An IPv6 address range in the format of "start address - end address" with no spaces included.
                              -

                              If not specified, the default is All.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              If not specified, the default is All.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/*FirewallRuleName*/RemoteAddressRanges** -

                              List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "*". Valid tokens include:

                              +

                              List of comma separated tokens specifying the remote addresses covered by the rule. The default value is "*". Valid tokens include:

                              • "*" indicates any remote address. If present, this must be the only token included.
                              • "Defaultgateway"
                              • @@ -355,70 +355,70 @@ Sample syncxml to provision the firewall settings to evaluate
                              • An IPv4 address range in the format of "start address - end address" with no spaces included.
                              • An IPv6 address range in the format of "start address - end address" with no spaces included.
                              -

                              If not specified, the default is All.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              -

                              The tokens "Intranet", "RmtIntranet", "Internet" and "Ply2Renders" are supported on Windows 10, version 1809, and later.

                              +

                              If not specified, the default is All.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              The tokens "Intranet", "RmtIntranet", "Internet" and "Ply2Renders" are supported on Windows 10, version 1809, and later.

                              **FirewallRules/_FirewallRuleName_/Description** -

                              Specifies the description of the rule.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Specifies the description of the rule.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/Enabled** -

                              Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. -

                              If not specified - a new rule is enabled by default.

                              -

                              Boolean value. Supported operations are Get and Replace.

                              +

                              Indicates whether the rule is enabled or disabled. If the rule must be enabled, this value must be set to true. +

                              If not specified - a new rule is enabled by default.

                              +

                              Boolean value. Supported operations are Get and Replace.

                              **FirewallRules/_FirewallRuleName_/Profiles** -

                              Specifies the profiles to which the rule belongs: Domain, Private, Public. . See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types.

                              -

                              If not specified, the default is All.

                              -

                              Value type is integer. Supported operations are Get and Replace.

                              +

                              Specifies the profiles to which the rule belongs: Domain, Private, Public. . See FW_PROFILE_TYPE for the bitmasks that are used to identify profile types.

                              +

                              If not specified, the default is All.

                              +

                              Value type is integer. Supported operations are Get and Replace.

                              **FirewallRules/_FirewallRuleName_/Action** -

                              Specifies the action for the rule.

                              -

                              Supported operation is Get.

                              +

                              Specifies the action for the rule.

                              +

                              Supported operation is Get.

                              **FirewallRules/_FirewallRuleName_/Action/Type** -

                              Specifies the action the rule enforces. Supported values:

                              +

                              Specifies the action the rule enforces. Supported values:

                              • 0 - Block
                              • 1 - Allow
                              -

                              If not specified, the default is allow.

                              -

                              Value type is integer. Supported operations are Get and Replace.

                              +

                              If not specified, the default is allow.

                              +

                              Value type is integer. Supported operations are Get and Replace.

                              **FirewallRules/_FirewallRuleName_/Direction** -

                              The rule is enabled based on the traffic direction as following. Supported values:

                              +

                              The rule is enabled based on the traffic direction as following. Supported values:

                              • IN - the rule applies to inbound traffic.
                              • OUT - the rule applies to outbound traffic.
                              • If not specified, the default is Out.
                              -

                              Value type is string. Supported operations are Get and Replace.

                              +

                              Value type is string. Supported operations are Get and Replace.

                              **FirewallRules/_FirewallRuleName_/InterfaceTypes** -

                              Comma separated list of interface types. Valid values:

                              +

                              Comma separated list of interface types. Valid values:

                              • RemoteAccess
                              • Wireless
                              • Lan
                              -

                              If not specified, the default is All.

                              -

                              Value type is string. Supported operations are Get and Replace.

                              +

                              If not specified, the default is All.

                              +

                              Value type is string. Supported operations are Get and Replace.

                              **FirewallRules/_FirewallRuleName_/EdgeTraversal** -

                              Indicates whether edge traversal is enabled or disabled for this rule.

                              -

                              The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address.

                              -

                              New rules have the EdgeTraversal property disabled by default.

                              -

                              Value type is bool. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Indicates whether edge traversal is enabled or disabled for this rule.

                              +

                              The EdgeTraversal setting indicates that specific inbound traffic is allowed to tunnel through NATs and other edge devices using the Teredo tunneling technology. In order for this setting to work correctly, the application or service with the inbound firewall rule needs to support IPv6. The primary application of this setting allows listeners on the host to be globally addressable through a Teredo IPv6 address.

                              +

                              New rules have the EdgeTraversal property disabled by default.

                              +

                              Value type is bool. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/LocalUserAuthorizationList** -

                              Specifies the list of authorized local users for this rule. This is a string in Security Descriptor Definition Language (SDDL) format.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Specifies the list of authorized local users for this rule. This is a string in Security Descriptor Definition Language (SDDL) format.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              **FirewallRules/_FirewallRuleName_/Status** -

                              Provides information about the specific version of the rule in deployment for monitoring purposes.

                              -

                              Value type is string. Supported operation is Get.

                              +

                              Provides information about the specific version of the rule in deployment for monitoring purposes.

                              +

                              Value type is string. Supported operation is Get.

                              **FirewallRules/_FirewallRuleName_/Name** -

                              Name of the rule.

                              -

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              +

                              Name of the rule.

                              +

                              Value type is string. Supported operations are Add, Get, Replace, and Delete.

                              diff --git a/windows/client-management/mdm/healthattestation-csp.md b/windows/client-management/mdm/healthattestation-csp.md index 03fb5b432d..e570b9890d 100644 --- a/windows/client-management/mdm/healthattestation-csp.md +++ b/windows/client-management/mdm/healthattestation-csp.md @@ -26,18 +26,18 @@ The following is a list of functions performed by the Device HealthAttestation C ## Terms **TPM (Trusted Platform Module)** -

                              TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

                              +

                              TPM is a specialized hardware-protected logic that performs a series of hardware protected security operations including providing protected storage, random number generation, encryption and signing.

                              **DHA (Device HealthAttestation) feature** -

                              The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

                              +

                              The Device HealthAttestation (DHA) feature enables enterprise IT administrators to monitor the security posture of managed devices remotely by using hardware (TPM) protected and attested data via a tamper-resistant and tamper-evident communication channel.

                              **DHA-Enabled device (Device HealthAttestation enabled device)** -

                              A Device HealthAttestation enabled (DHA-Enabled) device is a computing device (phone, desktop, laptop, tablet, server) that runs Windows 10 and supports TPM version 1.2 or 2.0.

                              +

                              A Device HealthAttestation enabled (DHA-Enabled) device is a computing device (phone, desktop, laptop, tablet, server) that runs Windows 10 and supports TPM version 1.2 or 2.0.

                              **DHA-Session (Device HealthAttestation session)** -

                              The Device HealthAttestation session (DHA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

                              +

                              The Device HealthAttestation session (DHA-Session) describes the end-to-end communication flow that is performed in one device health attestation session.

                              -

                              The following list of transactions is performed in one DHA-Session:

                              +

                              The following list of transactions is performed in one DHA-Session:

                              • DHA-CSP and DHA-Service communication:
                                • DHA-CSP forwards device boot data (DHA-BootData) to DHA-Service
                                • @@ -57,7 +57,7 @@ The following is a list of functions performed by the Device HealthAttestation C healthattestation session diagram
                                  DHA session data (Device HealthAttestation session data) -

                                  The following list of data is produced or consumed in one DHA-Transaction:

                                  +

                                  The following list of data is produced or consumed in one DHA-Transaction:

                                  • DHA-BootData: the device boot data (TCG logs, PCR values, device/TPM certificate, boot and TPM counters) that are required for validating device boot health.
                                  • DHA-EncBlob: an encrypted summary report that DHA-Service issues to a device after reviewing the DHA-BootData it receives from devices.
                                  • @@ -73,9 +73,9 @@ The following is a list of functions performed by the Device HealthAttestation C
                                  DHA-Enabled MDM (Device HealthAttestation enabled device management solution) -

                                  Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.

                                  -

                                  DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromised by advanced security threats or running a malicious (jailbroken) operating system.

                                  -

                                  The following list of operations is performed by DHA-Enabled-MDM

                                  +

                                  Device HealthAttestation enabled (DHA-Enabled) device management solution is a device management tool that is integrated with the DHA feature.

                                  +

                                  DHA-Enabled device management solutions enable enterprise IT managers to raise the security protection bar for their managed devices based on hardware (TPM) protected data that can be trusted even if a device is compromised by advanced security threats or running a malicious (jailbroken) operating system.

                                  +

                                  The following list of operations is performed by DHA-Enabled-MDM

                                  • Enables the DHA feature on a DHA-Enabled device
                                  • Issues device health attestation requests to enrolled/managed devices
                                  • @@ -84,8 +84,8 @@ The following is a list of functions performed by the Device HealthAttestation C
                                  DHA-CSP (Device HealthAttestation Configuration Service Provider) -

                                  The Device HealthAttestation Configuration Service Provider (DHA-CSP) uses a device’s TPM and firmware to measure critical security properties of the device’s BIOS and Windows boot, such that even on a system infected with kernel level malware or a rootkit, these properties cannot be spoofed.

                                  -

                                  The following list of operations is performed by DHA-CSP:

                                  +

                                  The Device HealthAttestation Configuration Service Provider (DHA-CSP) uses a device’s TPM and firmware to measure critical security properties of the device’s BIOS and Windows boot, such that even on a system infected with kernel level malware or a rootkit, these properties cannot be spoofed.

                                  +

                                  The following list of operations is performed by DHA-CSP:

                                  • Collects device boot data (DHA-BootData) from a managed device
                                  • Forwards DHA-BootData to Device Health Attestation Service (DHA-Service)
                                  • @@ -94,10 +94,10 @@ The following is a list of functions performed by the Device HealthAttestation C
                                  DHA-Service (Device HealthAttestation Service) -

                                  Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.

                                  +

                                  Device HealthAttestation Service (DHA-Service) validates the data it receives from DHA-CSP and issues a highly trusted hardware (TPM) protected report (DHA-Report) to DHA-Enabled device management solutions through a tamper resistant and tamper evident communication channel.

                                  -

                                  DHA-Service is available in 2 flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports a variety of implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.

                                  -

                                  The following list of operations is performed by DHA-Service:

                                  +

                                  DHA-Service is available in 2 flavors: “DHA-Cloud” and “DHA-Server2016”. DHA-Service supports a variety of implementation scenarios including cloud, on premises, air-gapped, and hybrid scenarios.

                                  +

                                  The following list of operations is performed by DHA-Service:

                                  - Receives device boot data (DHA-BootData) from a DHA-Enabled device - Forwards DHA-BootData to Device Health Attestation Service (DHA-Service) @@ -120,8 +120,8 @@ The following is a list of functions performed by the Device HealthAttestation C -Device Health Attestation – Cloud

                                  (DHA-Cloud)

                                  -

                                  DHA-Cloud is a Microsoft owned and operated DHA-Service that is:

                                  +Device Health Attestation – Cloud

                                  (DHA-Cloud)

                                  +

                                  DHA-Cloud is a Microsoft owned and operated DHA-Service that is:

                                  • Available in Windows for free
                                  • Running on a high-availability and geo-balanced cloud infrastructure
                                  • @@ -134,12 +134,12 @@ The following is a list of functions performed by the Device HealthAttestation C
                                -No cost +No cost -Device Health Attestation – On Premise

                                (DHA-OnPrem)

                                -

                                DHA-OnPrem refers to DHA-Service that is running on premises:

                                +Device Health Attestation – On Premise

                                (DHA-OnPrem)

                                +

                                DHA-OnPrem refers to DHA-Service that is running on premises:

                                • Offered to Windows Server 2016 customer (no added licensing cost for enabling/running DHA-Service)
                                • Hosted on an enterprise owned and managed server device/hardware
                                • @@ -152,11 +152,11 @@ The following is a list of functions performed by the Device HealthAttestation C
                              -The operation cost of running one or more instances of Server 2016 on-premises. +The operation cost of running one or more instances of Server 2016 on-premises. -Device Health Attestation - Enterprise-Managed Cloud

                              (DHA-EMC)

                              -

                              DHA-EMC refers to an enterprise-managed DHA-Service that is running as a virtual host/service on a Windows Server 2016 compatible - enterprise-managed cloud service, such as Microsoft Azure.

                              +Device Health Attestation - Enterprise-Managed Cloud

                              (DHA-EMC)

                              +

                              DHA-EMC refers to an enterprise-managed DHA-Service that is running as a virtual host/service on a Windows Server 2016 compatible - enterprise-managed cloud service, such as Microsoft Azure.

                              • Offered to Windows Server 2016 customers with no additional licensing cost (no added licensing cost for enabling/running DHA-Service)
                              • Supported by 1st and 3rd party DHA-Enabled device management solution providers that support on-premises and hybrid (Cloud + OnPrem) hardware attestation scenarios
                              • @@ -168,7 +168,7 @@ The following is a list of functions performed by the Device HealthAttestation C
                            -The operation cost of running Server 2016 on a compatible cloud service, such as Microsoft Azure. +The operation cost of running Server 2016 on a compatible cloud service, such as Microsoft Azure. @@ -193,19 +193,19 @@ HealthAttestation ----MaxSupportedProtocolVersion ``` **./Vendor/MSFT/HealthAttestation** -

                            The root node for the device HealthAttestation configuration service provider.

                            +

                            The root node for the device HealthAttestation configuration service provider.

                            **VerifyHealth** (Required) -

                            Notifies the device to prepare a device health verification request.

                            +

                            Notifies the device to prepare a device health verification request.

                            -

                            The supported operation is Execute.

                            +

                            The supported operation is Execute.

                            **Status** (Required) -

                            Provides the current status of the device health request.

                            +

                            Provides the current status of the device health request.

                            -

                            The supported operation is Get.

                            +

                            The supported operation is Get.

                            -

                            The following list shows some examples of supported values. For the complete list of status see Device HealthAttestation CSP status and error codes.

                            +

                            The following list shows some examples of supported values. For the complete list of status see Device HealthAttestation CSP status and error codes.

                            - 0 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_UNINITIALIZED): DHA-CSP is preparing a request to get a new DHA-EncBlob from DHA-Service - 1 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_REQUESTED): DHA-CSP is waiting for the DHA-Service to respond back, and issue a DHA-EncBlob to the device @@ -213,35 +213,35 @@ HealthAttestation - 3 - (HEALTHATTESTATION\_CERT\_RETRIEVAL_COMPLETE): DHA-Data is ready for pick up **ForceRetrieve** (Optional) -

                            Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.

                            +

                            Instructs the client to initiate a new request to DHA-Service, and get a new DHA-EncBlob (a summary of the boot state that is issued by DHA-Service). This option should only be used if the MDM server enforces a certificate freshness policy, which needs to force a device to get a fresh encrypted blob from DHA-Service.

                            -

                            Boolean value. The supported operation is Replace.

                            +

                            Boolean value. The supported operation is Replace.

                            **Certificate** (Required) -

                            Instructs the DHA-CSP to forward DHA-Data to the MDM server.

                            +

                            Instructs the DHA-CSP to forward DHA-Data to the MDM server.

                            -

                            Value type is b64.The supported operation is Get.

                            +

                            Value type is b64.The supported operation is Get.

                            **Nonce** (Required) -

                            Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.

                            +

                            Enables MDMs to protect the device health attestation communications from man-in-the-middle type (MITM) attacks with a crypt-protected random value that is generated by the MDM Server.

                            -

                            The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes.

                            +

                            The nonce is in hex format, with a minimum size of 8 bytes, and a maximum size of 32 bytes.

                            -

                            The supported operations are Get and Replace.

                            +

                            The supported operations are Get and Replace.

                            **CorrelationId** (Required) -

                            Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.

                            +

                            Identifies a unique device health attestation session. CorrelationId is used to correlate DHA-Service logs with the MDM server events and Client event logs for debug and troubleshooting.

                            -

                            Value type is integer, the minimum value is - 2,147,483,648 and the maximum value is 2,147,483,647. The supported operation is Get.

                            +

                            Value type is integer, the minimum value is - 2,147,483,648 and the maximum value is 2,147,483,647. The supported operation is Get.

                            **HASEndpoint** (Optional) -

                            Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.

                            +

                            Identifies the fully qualified domain name (FQDN) of the DHA-Service that is assigned to perform attestation. If an FQDN is not assigned, DHA-Cloud (Microsoft owned and operated cloud service) will be used as the default attestation service.

                            -

                            Value type is string. The supported operations are Get and Replace. The default value is has.spserv.microsoft.com.

                            +

                            Value type is string. The supported operations are Get and Replace. The default value is has.spserv.microsoft.com.

                            **TpmReadyStatus** (Required) -

                            Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.

                            -

                            Value type is integer. The supported operation is Get.

                            +

                            Added in Windows 10, version 1607 March service release. Returns a bitmask of information describing the state of TPM. It indicates whether the TPM of the device is in a ready and trusted state.

                            +

                            Value type is integer. The supported operation is Get.

                            ## **DHA-CSP integration steps** @@ -508,14 +508,14 @@ The following list of data points are verified by the DHA-Service in DHA-Report Each of these are described in further detail in the following sections, along with the recommended actions to take. **Issued** -

                            The date and time DHA-report was evaluated or issued to MDM.

                            +

                            The date and time DHA-report was evaluated or issued to MDM.

                            **AIKPresent** -

                            When an Attestation Identity Key (AIK) is present on a device, it indicates that the device has an endorsement key (EK) certificate. It can be trusted more than a device that doesn’t have an EK certificate.

                            +

                            When an Attestation Identity Key (AIK) is present on a device, it indicates that the device has an endorsement key (EK) certificate. It can be trusted more than a device that doesn’t have an EK certificate.

                            -

                            If AIKPresent = True (1), then allow access.

                            +

                            If AIKPresent = True (1), then allow access.

                            -

                            If AIKPresent = False (0), then take one of the following actions that align with your enterprise policies:

                            +

                            If AIKPresent = False (0), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -523,24 +523,24 @@ Each of these are described in further detail in the following sections, along w - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **ResetCount** (Reported only for devices that support TPM 2.0) -

                            This attribute reports the number of times a PC device has hibernated or resumed.

                            +

                            This attribute reports the number of times a PC device has hibernated or resumed.

                            **RestartCount** (Reported only for devices that support TPM 2.0) -

                            This attribute reports the number of times a PC device has rebooted

                            +

                            This attribute reports the number of times a PC device has rebooted

                            **DEPPolicy** -

                            A device can be trusted more if the DEP Policy is enabled on the device.

                            +

                            A device can be trusted more if the DEP Policy is enabled on the device.

                            -

                            Data Execution Prevention (DEP) Policy defines is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. Secure boot allows a limited list on x86/amd64 and on ARM NTOS locks it to on.

                            +

                            Data Execution Prevention (DEP) Policy defines is a set of hardware and software technologies that perform additional checks on memory to help prevent malicious code from running on a system. Secure boot allows a limited list on x86/amd64 and on ARM NTOS locks it to on.

                            -

                            DEPPolicy can be disabled or enabled by using the following commands in WMI or a PowerShell script:

                            +

                            DEPPolicy can be disabled or enabled by using the following commands in WMI or a PowerShell script:

                            - To disable DEP, type **bcdedit.exe /set {current} nx AlwaysOff** - To enable DEP, type **bcdedit.exe /set {current} nx AlwaysOn** -

                            If DEPPolicy = 1 (On), then allow access.

                            +

                            If DEPPolicy = 1 (On), then allow access.

                            -

                            If DEPPolicy = 0 (Off), then take one of the following actions that align with your enterprise policies:

                            +

                            If DEPPolicy = 0 (Off), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -548,15 +548,15 @@ Each of these are described in further detail in the following sections, along w - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BitLockerStatus** (at boot time) -

                            When BitLocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.

                            +

                            When BitLocker is reported "on" at boot time, the device is able to protect data that is stored on the drive from unauthorized access, when the system is turned off or goes to hibernation.

                            -

                            Windows BitLocker Drive Encryption, encrypts all data stored on the Windows operating system volume. BitLocker uses the TPM to help protect the Windows operating system and user data and helps to ensure that a computer is not tampered with, even if it is left unattended, lost, or stolen.

                            +

                            Windows BitLocker Drive Encryption, encrypts all data stored on the Windows operating system volume. BitLocker uses the TPM to help protect the Windows operating system and user data and helps to ensure that a computer is not tampered with, even if it is left unattended, lost, or stolen.

                            -

                            If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys cannot be accessed until the TPM has verified the state of the computer.

                            +

                            If the computer is equipped with a compatible TPM, BitLocker uses the TPM to lock the encryption keys that protect the data. As a result, the keys cannot be accessed until the TPM has verified the state of the computer.

                            -

                            If BitLockerStatus = 1 (On), then allow access.

                            +

                            If BitLockerStatus = 1 (On), then allow access.

                            -

                            If BitLockerStatus = 0 (Off), then take one of the following actions that align with your enterprise policies:

                            +

                            If BitLockerStatus = 0 (Off), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -564,11 +564,11 @@ Each of these are described in further detail in the following sections, along w - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BootManagerRevListVersion** -

                            This attribute indicates the version of the Boot Manager that is running on the device, to allow you to track and manage the security of the boot sequence/environment.

                            +

                            This attribute indicates the version of the Boot Manager that is running on the device, to allow you to track and manage the security of the boot sequence/environment.

                            -

                            If BootManagerRevListVersion = [CurrentVersion], then allow access.

                            +

                            If BootManagerRevListVersion = [CurrentVersion], then allow access.

                            -

                            If BootManagerRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:

                            +

                            If BootManagerRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI and MBI assets @@ -576,11 +576,11 @@ Each of these are described in further detail in the following sections, along w - Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue. **CodeIntegrityRevListVersion** -

                            This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.

                            +

                            This attribute indicates the version of the code that is performing integrity checks during the boot sequence. Using this attribute can help you detect if the device is running the latest version of the code that performs integrity checks, or if it is exposed to security risks (revoked) and enforce an appropriate policy action.

                            -

                            If CodeIntegrityRevListVersion = [CurrentVersion], then allow access.

                            +

                            If CodeIntegrityRevListVersion = [CurrentVersion], then allow access.

                            -

                            If CodeIntegrityRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:

                            +

                            If CodeIntegrityRevListVersion != [CurrentVersion], then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI and MBI assets @@ -588,11 +588,11 @@ Each of these are described in further detail in the following sections, along w - Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue. **SecureBootEnabled** -

                            When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.

                            +

                            When Secure Boot is enabled the core components used to boot the machine must have correct cryptographic signatures that are trusted by the organization that manufactured the device. The UEFI firmware verifies this before it lets the machine start. If any files have been tampered with, breaking their signature, the system will not boot.

                            -

                            If SecureBootEnabled = 1 (True), then allow access.

                            +

                            If SecureBootEnabled = 1 (True), then allow access.

                            -

                            If SecurebootEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:

                            +

                            If SecurebootEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -600,16 +600,16 @@ Each of these are described in further detail in the following sections, along w - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **BootDebuggingEnabled** -

                            Boot debug enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.

                            +

                            Boot debug enabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: the device may run unstable code, or be configured with fewer security restrictions that is required for testing and development.

                            -

                            Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:

                            +

                            Boot debugging can be disabled or enabled by using the following commands in WMI or a PowerShell script:

                            - To disable boot debugging, type **bcdedit.exe /set {current} bootdebug off** - To enable boot debugging, type **bcdedit.exe /set {current} bootdebug on** -

                            If BootdebuggingEnabled = 0 (False), then allow access.

                            +

                            If BootdebuggingEnabled = 0 (False), then allow access.

                            -

                            If BootDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:

                            +

                            If BootDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -617,11 +617,11 @@ Each of these are described in further detail in the following sections, along w - Trigger a corrective action, such as enabling VSM using WMI or a PowerShell script. **OSKernelDebuggingEnabled** -

                            OSKernelDebuggingEnabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: they may run unstable code, or be configured with fewer security restrictions required for testing and development.

                            +

                            OSKernelDebuggingEnabled points to a device that is used in development and testing. Devices that are used for test and development typically are less secure: they may run unstable code, or be configured with fewer security restrictions required for testing and development.

                            -

                            If OSKernelDebuggingEnabled = 0 (False), then allow access.

                            +

                            If OSKernelDebuggingEnabled = 0 (False), then allow access.

                            -

                            If OSKernelDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:

                            +

                            If OSKernelDebuggingEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -629,15 +629,15 @@ Each of these are described in further detail in the following sections, along w - Trigger a corrective action, such as such as informing the technical support team to contact the owner investigate the issue. **CodeIntegrityEnabled** -

                            When code integrity is enabled, code execution is restricted to integrity verified code.

                            +

                            When code integrity is enabled, code execution is restricted to integrity verified code.

                            -

                            Code integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with administrator privileges.

                            +

                            Code integrity is a feature that validates the integrity of a driver or system file each time it is loaded into memory. Code integrity detects whether an unsigned driver or system file is being loaded into the kernel, or whether a system file has been modified by malicious software that is being run by a user account with administrator privileges.

                            -

                            On x64-based versions of the operating system, kernel-mode drivers must be digitally signed.

                            +

                            On x64-based versions of the operating system, kernel-mode drivers must be digitally signed.

                            -

                            If CodeIntegrityEnabled = 1 (True), then allow access.

                            +

                            If CodeIntegrityEnabled = 1 (True), then allow access.

                            -

                            If CodeIntegrityEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:

                            +

                            If CodeIntegrityEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets @@ -645,16 +645,16 @@ Each of these are described in further detail in the following sections, along w - Take one of the previous actions and additionally place the device in a watch list to monitor the device more closely for potential risks. **TestSigningEnabled** -

                            When test signing is enabled, the device does not enforce signature validation during boot, and allows the unsigned drivers (such as unsigned UEFI modules) to load during boot.

                            +

                            When test signing is enabled, the device does not enforce signature validation during boot, and allows the unsigned drivers (such as unsigned UEFI modules) to load during boot.

                            -

                            Test signing can be disabled or enabled by using the following commands in WMI or a PowerShell script:

                            +

                            Test signing can be disabled or enabled by using the following commands in WMI or a PowerShell script:

                            - To disable boot debugging, type **bcdedit.exe /set {current} testsigning off** - To enable boot debugging, type **bcdedit.exe /set {current} testsigning on** -

                            If TestSigningEnabled = 0 (False), then allow access.

                            +

                            If TestSigningEnabled = 0 (False), then allow access.

                            -

                            If TestSigningEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:

                            +

                            If TestSigningEnabled = 1 (True), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI and MBI assets @@ -662,33 +662,33 @@ Each of these are described in further detail in the following sections, along w - Trigger a corrective action, such as enabling test signing using WMI or a PowerShell script. **SafeMode** -

                            Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. Only the basic files and drivers necessary to run Windows are started.

                            +

                            Safe mode is a troubleshooting option for Windows that starts your computer in a limited state. Only the basic files and drivers necessary to run Windows are started.

                            -

                            If SafeMode = 0 (False), then allow access.

                            +

                            If SafeMode = 0 (False), then allow access.

                            -

                            If SafeMode = 1 (True), then take one of the following actions that align with your enterprise policies:

                            +

                            If SafeMode = 1 (True), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets - Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue. **WinPE** -

                            Windows pre-installation Environment (Windows PE) is a minimal operating system with limited services that is used to prepare a computer for Windows installation, to copy disk images from a network file server, and to initiate Windows Setup.

                            +

                            Windows pre-installation Environment (Windows PE) is a minimal operating system with limited services that is used to prepare a computer for Windows installation, to copy disk images from a network file server, and to initiate Windows Setup.

                            -

                            If WinPE = 0 (False), then allow access.

                            +

                            If WinPE = 0 (False), then allow access.

                            -

                            If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.

                            +

                            If WinPE = 1 (True), then limit access to remote resources that are required for Windows OS installation.

                            **ELAMDriverLoaded** (Windows Defender) -

                            To use this reporting feature you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.

                            +

                            To use this reporting feature you must disable "Hybrid Resume" on the device. Early launch anti-malware (ELAM) provides protection for the computers in your network when they start up and before third-party drivers initialize.

                            -

                            In the current release, this attribute only monitors/reports if a Microsoft 1st party ELAM (Windows Defender) was loaded during initial boot.

                            +

                            In the current release, this attribute only monitors/reports if a Microsoft 1st party ELAM (Windows Defender) was loaded during initial boot.

                            -

                            If a device is expected to use a 3rd party antivirus program, ignore the reported state.

                            +

                            If a device is expected to use a 3rd party antivirus program, ignore the reported state.

                            -

                            If a device is expected to use Windows Defender and ELAMDriverLoaded = 1 (True), then allow access.

                            +

                            If a device is expected to use Windows Defender and ELAMDriverLoaded = 1 (True), then allow access.

                            -

                            If a device is expected to use Windows Defender and ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies, also accounting for whether it is a desktop or mobile device:

                            +

                            If a device is expected to use Windows Defender and ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies, also accounting for whether it is a desktop or mobile device:

                            - Disallow all access - Disallow access to HBI assets @@ -696,61 +696,61 @@ Each of these are described in further detail in the following sections, along w **Bcdedit.exe /set {current} vsmlaunchtype auto** -

                            If ELAMDriverLoaded = 1 (True), then allow access.

                            +

                            If ELAMDriverLoaded = 1 (True), then allow access.

                            -

                            If ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies:

                            +

                            If ELAMDriverLoaded = 0 (False), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets - Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue. **VSMEnabled** -

                            Virtual Secure Mode (VSM) is a container that protects high value assets from a compromised kernel. VSM requires about 1GB of memory – it has just enough capability to run the LSA service that is used for all authentication brokering.

                            +

                            Virtual Secure Mode (VSM) is a container that protects high value assets from a compromised kernel. VSM requires about 1GB of memory – it has just enough capability to run the LSA service that is used for all authentication brokering.

                            -

                            VSM can be enabled by using the following command in WMI or a PowerShell script:

                            +

                            VSM can be enabled by using the following command in WMI or a PowerShell script:

                            -

                            bcdedit.exe /set {current} vsmlaunchtype auto

                            +

                            bcdedit.exe /set {current} vsmlaunchtype auto

                            -

                            If VSMEnabled = 1 (True), then allow access.

                            -

                            If VSMEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:

                            +

                            If VSMEnabled = 1 (True), then allow access.

                            +

                            If VSMEnabled = 0 (False), then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Disallow access to HBI assets - Trigger a corrective action, such as informing the technical support team to contact the owner investigate the issue **PCRHashAlgorithmID** -

                            This attribute is an informational attribute that identifies the HASH algorithm that was used by TPM; no compliance action required.

                            +

                            This attribute is an informational attribute that identifies the HASH algorithm that was used by TPM; no compliance action required.

                            **BootAppSVN** -

                            This attribute identifies the security version number of the Boot Application that was loaded during initial boot on the attested device

                            +

                            This attribute identifies the security version number of the Boot Application that was loaded during initial boot on the attested device

                            -

                            If reported BootAppSVN equals an accepted value, then allow access.

                            +

                            If reported BootAppSVN equals an accepted value, then allow access.

                            -

                            If reported BootAppSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            +

                            If reported BootAppSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. **BootManagerSVN** -

                            This attribute identifies the security version number of the Boot Manager that was loaded during initial boot on the attested device.

                            +

                            This attribute identifies the security version number of the Boot Manager that was loaded during initial boot on the attested device.

                            -

                            If reported BootManagerSVN equals an accepted value, then allow access.

                            +

                            If reported BootManagerSVN equals an accepted value, then allow access.

                            -

                            If reported BootManagerSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            +

                            If reported BootManagerSVN does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. **TPMVersion** -

                            This attribute identifies the version of the TPM that is running on the attested device.

                            -

                            TPMVersion node provides to replies "1" and "2":

                            +

                            This attribute identifies the version of the TPM that is running on the attested device.

                            +

                            TPMVersion node provides to replies "1" and "2":

                            • 1 means TPM specification version 1.2
                            • 2 means TPM specification version 2.0
                            -

                            Based on the reply you receive from TPMVersion node:

                            +

                            Based on the reply you receive from TPMVersion node:

                            - If reported TPMVersion equals an accepted value, then allow access. - If reported TPMVersion does not equal an accepted value, then take one of the following actions that align with your enterprise policies: @@ -758,63 +758,63 @@ Each of these are described in further detail in the following sections, along w - Direct the device to an enterprise honeypot, to further monitor the device's activities. **PCR0** -

                            The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.

                            +

                            The measurement that is captured in PCR[0] typically represents a consistent view of the Host Platform between boot cycles. It contains a measurement of components that are provided by the host platform manufacturer.

                            -

                            Enterprise managers can create a allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.

                            +

                            Enterprise managers can create a allow list of trusted PCR[0] values, compare the PCR[0] value of the managed devices (the value that is verified and reported by HAS) with the allow list, and then make a trust decision based on the result of the comparison.

                            -

                            If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.

                            +

                            If your enterprise does not have a allow list of accepted PCR[0] values, then take no action.

                            -

                            If PCR[0] equals an accepted allow list value, then allow access.

                            +

                            If PCR[0] equals an accepted allow list value, then allow access.

                            -

                            If PCR[0] does not equal any accepted listed value, then take one of the following actions that align with your enterprise policies:

                            +

                            If PCR[0] does not equal any accepted listed value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. **SBCPHash** -

                            SBCPHash is the finger print of the Custom Secure Boot Configuration Policy (SBCP) that was loaded during boot in Windows devices, except PCs.

                            +

                            SBCPHash is the finger print of the Custom Secure Boot Configuration Policy (SBCP) that was loaded during boot in Windows devices, except PCs.

                            -

                            If SBCPHash is not present, or is an accepted allow-listed value, then allow access. +

                            If SBCPHash is not present, or is an accepted allow-listed value, then allow access. -

                            If SBCPHash is present in DHA-Report, and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

                            +

                            If SBCPHash is present in DHA-Report, and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. **CIPolicy** -

                            This attribute indicates the Code Integrity policy that is controlling the security of the boot environment.

                            +

                            This attribute indicates the Code Integrity policy that is controlling the security of the boot environment.

                            -

                            If CIPolicy is not present, or is an accepted allow-listed value, then allow access.

                            +

                            If CIPolicy is not present, or is an accepted allow-listed value, then allow access.

                            -

                            If CIPolicy is present and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

                            +

                            If CIPolicy is present and is not a allow-listed value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Place the device in a watch list to monitor the device more closely for potential risks. **BootRevListInfo** -

                            This attribute identifies the Boot Revision List that was loaded during initial boot on the attested device.

                            +

                            This attribute identifies the Boot Revision List that was loaded during initial boot on the attested device.

                            -

                            If reported BootRevListInfo version equals an accepted value, then allow access.

                            +

                            If reported BootRevListInfo version equals an accepted value, then allow access.

                            -

                            If reported BootRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            +

                            If reported BootRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. **OSRevListInfo** -

                            This attribute identifies the Operating System Revision List that was loaded during initial boot on the attested device.

                            +

                            This attribute identifies the Operating System Revision List that was loaded during initial boot on the attested device.

                            -

                            If reported OSRevListInfo version equals an accepted value, then allow access.

                            +

                            If reported OSRevListInfo version equals an accepted value, then allow access.

                            -

                            If reported OSRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            +

                            If reported OSRevListInfo version does not equal an accepted value, then take one of the following actions that align with your enterprise policies:

                            - Disallow all access - Direct the device to an enterprise honeypot, to further monitor the device's activities. **HealthStatusMismatchFlags** -

                            HealthStatusMismatchFlags attribute appears if DHA-Service detects an integrity issue (mismatch) in the DHA-Data it receives from device management solutions, for validation.

                            +

                            HealthStatusMismatchFlags attribute appears if DHA-Service detects an integrity issue (mismatch) in the DHA-Data it receives from device management solutions, for validation.

                            -

                            In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.

                            +

                            In case of a detected issue a list of impacted DHA-report elements will be listed under the HealthStatusMismatchFlags attribute.

                            ## **Device HealthAttestation CSP status and error codes** @@ -825,204 +825,204 @@ Each of these are described in further detail in the following sections, along w Description - 0 - HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZED - This is the initial state for devices that have never participated in a DHA-Session. + 0 + HEALTHATTESTATION_CERT_RETRIEVAL_UNINITIALIZED + This is the initial state for devices that have never participated in a DHA-Session. - 1 - HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTED - This state signifies that MDM client’s Exec call on the node VerifyHealth has been triggered and now the OS is trying to retrieve DHA-EncBlob from DHA-Server. + 1 + HEALTHATTESTATION_CERT_RETRIEVAL_REQUESTED + This state signifies that MDM client’s Exec call on the node VerifyHealth has been triggered and now the OS is trying to retrieve DHA-EncBlob from DHA-Server. - 2 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED - This state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server. + 2 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED + This state signifies that the device failed to retrieve DHA-EncBlob from DHA-Server. - 3 - HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETE - This state signifies that the device has successfully retrieved DHA-EncBlob from the DHA-Server. + 3 + HEALTHATTESTATION_CERT_RETRIEVAL_COMPLETE + This state signifies that the device has successfully retrieved DHA-EncBlob from the DHA-Server. - 4 - HEALTHATTESTATION_CERT_RETRIEVAL_PCR_FAIL - Deprecated in Windows 10, version 1607. + 4 + HEALTHATTESTATION_CERT_RETRIEVAL_PCR_FAIL + Deprecated in Windows 10, version 1607. - 5 - HEALTHATTESTATION_CERT_RETRIEVAL_GETQUOTE_FAIL - DHA-CSP failed to get a claim quote. + 5 + HEALTHATTESTATION_CERT_RETRIEVAL_GETQUOTE_FAIL + DHA-CSP failed to get a claim quote. - 6 - HEALTHATTESTATION_CERT_RETRIEVAL_DEVICE_NOT_READY - DHA-CSP failed in opening a handle to Microsoft Platform Crypto Provider. + 6 + HEALTHATTESTATION_CERT_RETRIEVAL_DEVICE_NOT_READY + DHA-CSP failed in opening a handle to Microsoft Platform Crypto Provider. - 7 - HEALTHATTESTATION_CERT_RETRIEVAL_WINDOWS_AIK_FAIL - DHA-CSP failed in retrieving Windows AIK + 7 + HEALTHATTESTATION_CERT_RETRIEVAL_WINDOWS_AIK_FAIL + DHA-CSP failed in retrieving Windows AIK - 8 - HEALTHATTESTATION_CERT_RETRIEVAL_FROM_WEB_FAIL - Deprecated in Windows 10, version 1607. + 8 + HEALTHATTESTATION_CERT_RETRIEVAL_FROM_WEB_FAIL + Deprecated in Windows 10, version 1607. - 9 - HEALTHATTESTATION_CERT_RETRIEVAL_INVALID_TPM_VERSION - Invalid TPM version (TPM version is not 1.2 or 2.0) + 9 + HEALTHATTESTATION_CERT_RETRIEVAL_INVALID_TPM_VERSION + Invalid TPM version (TPM version is not 1.2 or 2.0) - 10 - HEALTHATTESTATION_CERT_RETRIEVAL_GETNONCE_FAIL - Nonce was not found in the registry. + 10 + HEALTHATTESTATION_CERT_RETRIEVAL_GETNONCE_FAIL + Nonce was not found in the registry. - 11 - HEALTHATTESTATION_CERT_RETRIEVAL_GETCORRELATIONID_FAIL - Correlation ID was not found in the registry. + 11 + HEALTHATTESTATION_CERT_RETRIEVAL_GETCORRELATIONID_FAIL + Correlation ID was not found in the registry. - 12 - HEALTHATTESTATION_CERT_RETRIEVAL_GETCERT_FAIL - Deprecated in Windows 10, version 1607. + 12 + HEALTHATTESTATION_CERT_RETRIEVAL_GETCERT_FAIL + Deprecated in Windows 10, version 1607. - 13 - HEALTHATTESTATION_CERT_RETRIEVAL_GETCLAIM_FAIL - Deprecated in Windows 10, version 1607. + 13 + HEALTHATTESTATION_CERT_RETRIEVAL_GETCLAIM_FAIL + Deprecated in Windows 10, version 1607. - 14 - HEALTHATTESTATION_CERT_RETRIEVAL_ENCODING_FAIL - Failure in Encoding functions. (Extremely unlikely scenario) + 14 + HEALTHATTESTATION_CERT_RETRIEVAL_ENCODING_FAIL + Failure in Encoding functions. (Extremely unlikely scenario) - 15 - HEALTHATTESTATION_CERT_RETRIEVAL_ENDPOINTOVERRIDE_FAIL - Deprecated in Windows 10, version 1607. + 15 + HEALTHATTESTATION_CERT_RETRIEVAL_ENDPOINTOVERRIDE_FAIL + Deprecated in Windows 10, version 1607. - 16 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_LOAD_XML - DHA-CSP failed to load the payload it received from DHA-Service + 16 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_LOAD_XML + DHA-CSP failed to load the payload it received from DHA-Service - 17 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CORRUPT_XML - DHA-CSP received a corrupted response from DHA-Service. + 17 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CORRUPT_XML + DHA-CSP received a corrupted response from DHA-Service. - 18 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_XML - DHA-CSP received an empty response from DHA-Service. + 18 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_XML + DHA-CSP received an empty response from DHA-Service. - 19 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_AES_EK - DHA-CSP failed in decrypting the AES key from the EK challenge. + 19 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_AES_EK + DHA-CSP failed in decrypting the AES key from the EK challenge. - 20 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_CERT_AES_EK - DHA-CSP failed in decrypting the health cert with the AES key. + 20 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_DECRYPT_CERT_AES_EK + DHA-CSP failed in decrypting the health cert with the AES key. - 21 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EXPORT_AIKPUB - DHA-CSP failed in exporting the AIK Public Key. + 21 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EXPORT_AIKPUB + DHA-CSP failed in exporting the AIK Public Key. - 22 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_CLAIMAUTHORITYONLY - DHA-CSP failed in trying to create a claim with AIK attestation data. + 22 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_CLAIMAUTHORITYONLY + DHA-CSP failed in trying to create a claim with AIK attestation data. - 23 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKPUB - DHA-CSP failed in appending the AIK Pub to the request blob. + 23 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKPUB + DHA-CSP failed in appending the AIK Pub to the request blob. - 24 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKCERT - DHA-CSP failed in appending the AIK Cert to the request blob. + 24 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_APPEND_AIKCERT + DHA-CSP failed in appending the AIK Cert to the request blob. - 25 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_INIT_HTTPHANDLE - DHA-CSP failed to obtain a Session handle. + 25 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_INIT_HTTPHANDLE + DHA-CSP failed to obtain a Session handle. - 26 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_GETTARGET_HTTPHANDLE - DHA-CSP failed to connect to the DHA-Service. + 26 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_GETTARGET_HTTPHANDLE + DHA-CSP failed to connect to the DHA-Service. - 27 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLE - DHA-CSP failed to create a HTTP request handle. + 27 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_CREATE_HTTPHANDLE + DHA-CSP failed to create a HTTP request handle. - 28 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SET_INTERNETOPTION - DHA-CSP failed to set options. + 28 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SET_INTERNETOPTION + DHA-CSP failed to set options. - 29 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ADD_REQUESTHEADERS - DHA-CSP failed to add request headers. + 29 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ADD_REQUESTHEADERS + DHA-CSP failed to add request headers. - 30 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SEND_REQUEST - DHA-CSP failed to send the HTTP request. + 30 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_SEND_REQUEST + DHA-CSP failed to send the HTTP request. - 31 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_RECEIVE_RESPONSE - DHA-CSP failed to receive a response from the DHA-Service. + 31 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_RECEIVE_RESPONSE + DHA-CSP failed to receive a response from the DHA-Service. - 32 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_QUERY_HEADERS - DHA-CSP failed to query headers when trying to get HTTP status code. + 32 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_QUERY_HEADERS + DHA-CSP failed to query headers when trying to get HTTP status code. - 33 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_RESPONSE - DHA-CSP received an empty response from DHA-Service even though HTTP status was OK. + 33 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_EMPTY_RESPONSE + DHA-CSP received an empty response from DHA-Service even though HTTP status was OK. - 34 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSE - DHA-CSP received an empty response along with a HTTP error code from DHA-Service. + 34 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_MISSING_RESPONSE + DHA-CSP received an empty response along with a HTTP error code from DHA-Service. - 35 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_IMPERSONATE_USER - DHA-CSP failed to impersonate user. + 35 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_IMPERSONATE_USER + DHA-CSP failed to impersonate user. - 36 - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ACQUIRE_PDCNETWORKACTIVATOR - DHA-CSP failed to acquire the PDC activators that are needed for network communication when the device is in Connected standby mode. + 36 + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_ACQUIRE_PDCNETWORKACTIVATOR + DHA-CSP failed to acquire the PDC activators that are needed for network communication when the device is in Connected standby mode. - 0xFFFF - HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_UNKNOWN - DHA-CSP failed due to an unknown reason, this error is highly unlikely to occur. + 0xFFFF + HEALTHATTESTATION_CERT_RETRIEVAL_FAILED_UNKNOWN + DHA-CSP failed due to an unknown reason, this error is highly unlikely to occur. - 400 - Bad_Request_From_Client - DHA-CSP has received a bad (malformed) attestation request. + 400 + Bad_Request_From_Client + DHA-CSP has received a bad (malformed) attestation request. - 404 - Endpoint_Not_Reachable - DHA-Service is not reachable by DHA-CSP + 404 + Endpoint_Not_Reachable + DHA-Service is not reachable by DHA-CSP diff --git a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md index 875c7d0ded..f2da07d4e2 100644 --- a/windows/client-management/mdm/management-tool-for-windows-store-for-business.md +++ b/windows/client-management/mdm/management-tool-for-windows-store-for-business.md @@ -41,12 +41,12 @@ The Store for Business provides services that enable a management tool to synchr -

                            Application data

                            -

                            The Store for Business service provides metadata for the applications that have been acquired via the Store for Business. This includes the application identifier that is used to deploy online license applications, artwork for an application that is used to create a company portal, and localized descriptions for applications.

                            +

                            Application data

                            +

                            The Store for Business service provides metadata for the applications that have been acquired via the Store for Business. This includes the application identifier that is used to deploy online license applications, artwork for an application that is used to create a company portal, and localized descriptions for applications.

                            -

                            Licensing models

                            -

                            Offline vs. Online

                            +

                            Licensing models

                            +

                            Offline vs. Online

                            Online-licensed applications require connectivity to the Microsoft Store. Users require an Azure Active Directory identity and rely on the store services on the device to be able to acquire an application from the store. It is similar to how applications are acquired from the Microsoft Store using a Microsoft account. Assigning or reclaiming seats for an application require a call to the Store for Business services.

                            Offline-licensed applications enable an organization to use the application for imaging and for devices that may not have connectivity to the store or may not have Azure Active Directory. Offline-licensed application do not require connectivity to the store, however it can be updated directly from the store if the device has connectivity and the app update policies allow updates to be distributed via the store.

                            diff --git a/windows/client-management/mdm/messaging-csp.md b/windows/client-management/mdm/messaging-csp.md index ad2d4edddc..69893ff362 100644 --- a/windows/client-management/mdm/messaging-csp.md +++ b/windows/client-management/mdm/messaging-csp.md @@ -21,36 +21,36 @@ The following diagram shows the Messaging configuration service provider in tree **./User/Vendor/MSFT/Messaging** -

                            Root node for the Messaging configuration service provider.

                            +

                            Root node for the Messaging configuration service provider.

                            **AuditingLevel** -

                            Turns on the "Text" auditing feature.

                            -

                            The following list shows the supported values:

                            +

                            Turns on the "Text" auditing feature.

                            +

                            The following list shows the supported values:

                            • 0 (Default) - Off
                            • 1 - On
                            -

                            Supported operations are Get and Replace.

                            +

                            Supported operations are Get and Replace.

                            **Auditing** -

                            Node for auditing.

                            -

                            Supported operation is Get.

                            +

                            Node for auditing.

                            +

                            Supported operation is Get.

                            **Messages** -

                            Node for messages.

                            -

                            Supported operation is Get.

                            +

                            Node for messages.

                            +

                            Supported operation is Get.

                            **Count** -

                            The number of messages to return in the Data setting. The default is 100.

                            -

                            Supported operations are Get and Replace.

                            +

                            The number of messages to return in the Data setting. The default is 100.

                            +

                            Supported operations are Get and Replace.

                            **RevisionId** -

                            Retrieves messages whose revision ID is greater than RevisionId.

                            -

                            Supported operations are Get and Replace.

                            +

                            Retrieves messages whose revision ID is greater than RevisionId.

                            +

                            Supported operations are Get and Replace.

                            **Data** -

                            The JSON string of text messages on the device.

                            -

                            Supported operations are Get and Replace.

                            +

                            The JSON string of text messages on the device.

                            +

                            Supported operations are Get and Replace.

                            **SyncML example** diff --git a/windows/client-management/mdm/mobile-device-enrollment.md b/windows/client-management/mdm/mobile-device-enrollment.md index 6c898afe02..ceacdde6dd 100644 --- a/windows/client-management/mdm/mobile-device-enrollment.md +++ b/windows/client-management/mdm/mobile-device-enrollment.md @@ -140,53 +140,53 @@ The enrollment server can decline enrollment messages using the SOAP Fault forma -

                            s:

                            -

                            MessageFormat

                            -

                            MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR

                            -

                            Message format is bad

                            -

                            80180001

                            +

                            s:

                            +

                            MessageFormat

                            +

                            MENROLL_E_DEVICE_MESSAGE_FORMAT_ERROR

                            +

                            Message format is bad

                            +

                            80180001

                            -

                            s:

                            -

                            Authentication

                            -

                            MENROLL_E_DEVICE_AUTHENTICATION_ERROR

                            -

                            User not recognized

                            -

                            80180002

                            +

                            s:

                            +

                            Authentication

                            +

                            MENROLL_E_DEVICE_AUTHENTICATION_ERROR

                            +

                            User not recognized

                            +

                            80180002

                            -

                            s:

                            -

                            Authorization

                            -

                            MENROLL_E_DEVICE_AUTHORIZATION_ERROR

                            -

                            User not allowed to enroll

                            -

                            80180003

                            +

                            s:

                            +

                            Authorization

                            +

                            MENROLL_E_DEVICE_AUTHORIZATION_ERROR

                            +

                            User not allowed to enroll

                            +

                            80180003

                            -

                            s:

                            -

                            CertificateRequest

                            -

                            MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR

                            -

                            Failed to get certificate

                            -

                            80180004

                            +

                            s:

                            +

                            CertificateRequest

                            +

                            MENROLL_E_DEVICE_CERTIFCATEREQUEST_ERROR

                            +

                            Failed to get certificate

                            +

                            80180004

                            -

                            s:

                            -

                            EnrollmentServer

                            -

                            MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR

                            - -

                            80180005

                            +

                            s:

                            +

                            EnrollmentServer

                            +

                            MENROLL_E_DEVICE_CONFIGMGRSERVER_ERROR

                            + +

                            80180005

                            -

                            a:

                            -

                            InternalServiceFault

                            -

                            MENROLL_E_DEVICE_INTERNALSERVICE_ERROR

                            -

                            The server hit an unexpected issue

                            -

                            80180006

                            +

                            a:

                            +

                            InternalServiceFault

                            +

                            MENROLL_E_DEVICE_INTERNALSERVICE_ERROR

                            +

                            The server hit an unexpected issue

                            +

                            80180006

                            -

                            a:

                            -

                            InvalidSecurity

                            -

                            MENROLL_E_DEVICE_INVALIDSECURITY_ERROR

                            -

                            Cannot parse the security header

                            -

                            80180007

                            +

                            a:

                            +

                            InvalidSecurity

                            +

                            MENROLL_E_DEVICE_INVALIDSECURITY_ERROR

                            +

                            Cannot parse the security header

                            +

                            80180007

                            @@ -240,46 +240,46 @@ In Windows 10, version 1507, we added the deviceenrollmentserviceerror element. -

                            DeviceCapReached

                            -

                            MENROLL_E_DEVICECAPREACHED

                            -

                            User already enrolled in too many devices. Delete or unenroll old ones to fix this error. The user can fix it without admin help.

                            -

                            80180013

                            +

                            DeviceCapReached

                            +

                            MENROLL_E_DEVICECAPREACHED

                            +

                            User already enrolled in too many devices. Delete or unenroll old ones to fix this error. The user can fix it without admin help.

                            +

                            80180013

                            -

                            DeviceNotSupported

                            -

                            MENROLL_E_DEVICENOTSUPPORTED

                            -

                            Specific platform (e.g. Windows) or version is not supported. There is no point retrying or calling admin. User could upgrade device.

                            -

                            80180014

                            +

                            DeviceNotSupported

                            +

                            MENROLL_E_DEVICENOTSUPPORTED

                            +

                            Specific platform (e.g. Windows) or version is not supported. There is no point retrying or calling admin. User could upgrade device.

                            +

                            80180014

                            -

                            NotSupported

                            -

                            MENROLL_E_NOTSUPPORTED

                            -

                            Mobile device management generally not supported (would save an admin call)

                            -

                            80180015

                            +

                            NotSupported

                            +

                            MENROLL_E_NOTSUPPORTED

                            +

                            Mobile device management generally not supported (would save an admin call)

                            +

                            80180015

                            -

                            NotEligibleToRenew

                            -

                            MENROLL_E_NOTELIGIBLETORENEW

                            -

                            Device is trying to renew but server rejects the request. Client might show notification for this if Robo fails. Check time on device. The user can fix it by re-enrolling.

                            -

                            80180016

                            +

                            NotEligibleToRenew

                            +

                            MENROLL_E_NOTELIGIBLETORENEW

                            +

                            Device is trying to renew but server rejects the request. Client might show notification for this if Robo fails. Check time on device. The user can fix it by re-enrolling.

                            +

                            80180016

                            -

                            InMaintenance

                            -

                            MENROLL_E_INMAINTENANCE

                            -

                            Account is in maintenance, retry later. The user can retry later, but they may need to contact the admin because they would not know when problem is solved.

                            -

                            80180017

                            +

                            InMaintenance

                            +

                            MENROLL_E_INMAINTENANCE

                            +

                            Account is in maintenance, retry later. The user can retry later, but they may need to contact the admin because they would not know when problem is solved.

                            +

                            80180017

                            -

                            UserLicense

                            -

                            MENROLL_E_USERLICENSE

                            -

                            License of user is in bad state and blocking the enrollment. The user needs to call the admin.

                            -

                            80180018

                            +

                            UserLicense

                            +

                            MENROLL_E_USERLICENSE

                            +

                            License of user is in bad state and blocking the enrollment. The user needs to call the admin.

                            +

                            80180018

                            -

                            InvalidEnrollmentData

                            -

                            MENROLL_E_ENROLLMENTDATAINVALID

                            -

                            The server rejected the enrollment data. The server may not be configured correctly.

                            -

                            80180019

                            +

                            InvalidEnrollmentData

                            +

                            MENROLL_E_ENROLLMENTDATAINVALID

                            +

                            The server rejected the enrollment data. The server may not be configured correctly.

                            +

                            80180019

                            diff --git a/windows/client-management/mdm/networkqospolicy-csp.md b/windows/client-management/mdm/networkqospolicy-csp.md index f0fadc3fe5..19462512ee 100644 --- a/windows/client-management/mdm/networkqospolicy-csp.md +++ b/windows/client-management/mdm/networkqospolicy-csp.md @@ -45,79 +45,79 @@ NetworkQoSPolicy --------DSCPAction ``` **NetworkQoSPolicy** -

                            The root node for the NetworkQoSPolicy configuration service provider.

                            +

                            The root node for the NetworkQoSPolicy configuration service provider.

                            **Version** -

                            Specifies the version information. +

                            Specifies the version information. -

                            The data type is int. +

                            The data type is int. -

                            The only supported operation is Get. +

                            The only supported operation is Get. ***Name*** -

                            Node for the QoS policy name. +

                            Node for the QoS policy name. ***Name*/IPProtocolMatchCondition** -

                            Specifies the IP protocol used to match the network traffic. +

                            Specifies the IP protocol used to match the network traffic. -

                            Valid values are: +

                            Valid values are: - 0 (default) - Both TCP and UDP - 1 - TCP - 2 - UDP -

                            The data type is int. +

                            The data type is int. -

                            The supported operations are Add, Get, Delete, and Replace. +

                            The supported operations are Add, Get, Delete, and Replace. ***Name*/AppPathNameMatchCondition** -

                            Specifies the name of an application to be used to match the network traffic, such as application.exe or %ProgramFiles%\application.exe. +

                            Specifies the name of an application to be used to match the network traffic, such as application.exe or %ProgramFiles%\application.exe. -

                            The data type is char. +

                            The data type is char. -

                            The supported operations are Add, Get, Delete, and Replace. +

                            The supported operations are Add, Get, Delete, and Replace. ***Name*/SourcePortMatchCondition** -

                            Specifies a single port or a range of ports to be used to match the network traffic source. +

                            Specifies a single port or a range of ports to be used to match the network traffic source. -

                            Valid values are: +

                            Valid values are: - A range of source ports: _[first port number]_-_[last port number]_ - A single source port: _[port number]_ -

                            The data type is char. +

                            The data type is char. -

                            The supported operations are Add, Get, Delete, and Replace. +

                            The supported operations are Add, Get, Delete, and Replace. ***Name*/DestinationPortMatchCondition** -

                            Specifies a single source port or a range of ports to be used to match the network traffic destination. +

                            Specifies a single source port or a range of ports to be used to match the network traffic destination. -

                            Valid values are: +

                            Valid values are: - A range of destination ports: _[first port number]_-_[last port number]_ - A single destination port: _[port number]_ -

                            The data type is char. +

                            The data type is char. -

                            The supported operations are Add, Get, Delete, and Replace. +

                            The supported operations are Add, Get, Delete, and Replace. ***Name*/PriorityValue8021Action** -

                            Specifies the IEEE 802.1p priority value to apply to matching network traffic. +

                            Specifies the IEEE 802.1p priority value to apply to matching network traffic. -

                            Valid values are 0-7. +

                            Valid values are 0-7. -

                            The data type is int. +

                            The data type is int. -

                            The supported operations are Add, Get, Delete, and Replace. +

                            The supported operations are Add, Get, Delete, and Replace. ***Name*/DSCPAction** -

                            The differentiated services code point (DSCP) value to apply to matching network traffic. +

                            The differentiated services code point (DSCP) value to apply to matching network traffic. -

                            Valid values are 0-63. +

                            Valid values are 0-63. -

                            The data type is int. +

                            The data type is int. -

                            The supported operations are Add, Get, Delete, and Replace. +

                            The supported operations are Add, Get, Delete, and Replace. ## Related topics diff --git a/windows/client-management/mdm/oma-dm-protocol-support.md b/windows/client-management/mdm/oma-dm-protocol-support.md index 40757af748..5e8ad6957f 100644 --- a/windows/client-management/mdm/oma-dm-protocol-support.md +++ b/windows/client-management/mdm/oma-dm-protocol-support.md @@ -48,8 +48,8 @@ The following table shows the OMA DM standards that Windows uses. -

                            Data transport and session

                            -
                              +

                              Data transport and session

                              +
                              • Client-initiated remote HTTPS DM session over SSL.

                              • Remote HTTPS DM session over SSL.

                              • Remote DM server initiation notification using WAP Push over Short Message Service (SMS). Not used by enterprise management.

                              • @@ -57,14 +57,14 @@ The following table shows the OMA DM standards that Windows uses.
                              -

                              Bootstrap XML

                              -
                                +

                                Bootstrap XML

                                +
                                • OMA Client Provisioning XML.

                                -

                                DM protocol commands

                                -

                                The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the OMA website.

                                +

                                DM protocol commands

                                +

                                The following list shows the commands that are used by the device. For further information about the OMA DM command elements, see "SyncML Representation Protocol Device Management Usage (OMA-SyncML-DMRepPro-V1_1_2-20030613-A)" available from the OMA website.

                                • Add (Implicit Add supported)

                                • Alert (DM alert): Generic alert (1226) is used by enterprise management client when the user triggers an MDM unenrollment action from the device or when a CSP finishes some asynchronous actions. Device alert (1224) is used to notify the server some device triggered event.

                                • @@ -95,16 +95,16 @@ The following table shows the OMA DM standards that Windows uses.

                                  Meta XML tag in SyncHdr is ignored by the device.

                                  -

                                  OMA DM standard objects

                                  -
                                    +

                                    OMA DM standard objects

                                    +
                                    • DevInfo

                                    • DevDetail

                                    • OMA DM DMS account objects (OMA DM version 1.2)

                                    -

                                    Security

                                    -
                                      +

                                      Security

                                      +
                                      • Authenticate DM server initiation notification SMS message (not used by enterprise management)

                                      • Application layer Basic and MD5 client authentication

                                      • Authenticate server with MD5 credential at application level

                                      • @@ -113,8 +113,8 @@ The following table shows the OMA DM standards that Windows uses.
                                      -

                                      Nodes

                                      -

                                      In the OMA DM tree, the following rules apply for the node name:

                                      +

                                      Nodes

                                      +

                                      In the OMA DM tree, the following rules apply for the node name:

                                      • "." can be part of the node name.

                                      • The node name cannot be empty.

                                      • @@ -122,8 +122,8 @@ The following table shows the OMA DM standards that Windows uses.
                                      -

                                      Provisioning Files

                                      -

                                      Provisioning XML must be well formed and follow the definition in SyncML Representation Protocol specification.

                                      +

                                      Provisioning Files

                                      +

                                      Provisioning XML must be well formed and follow the definition in SyncML Representation Protocol specification.

                                      If an XML element that is not a valid OMA DM command is under SyncBody, the status code 400 is returned for that element.

                                      Note

                                      To represent a Unicode string as a URI, first encode the string as UTF-8. Then encode each of the UTF-8 bytes using URI encoding.

                                      @@ -133,12 +133,12 @@ The following table shows the OMA DM standards that Windows uses.
                                      -

                                      WBXML support

                                      -

                                      Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the SyncML Representation Protocol specification.

                                      +

                                      WBXML support

                                      +

                                      Windows supports sending and receiving SyncML in both XML format and encoded WBXML format. This is configurable by using the DEFAULTENCODING node under the w7 APPLICATION characteristic during enrollment. For more information about WBXML encoding, see section 8 of the SyncML Representation Protocol specification.

                                      -

                                      Handling of large objects

                                      -

                                      In Windows 10, version 1511, client support for uploading large objects to the server was added.

                                      +

                                      Handling of large objects

                                      +

                                      In Windows 10, version 1511, client support for uploading large objects to the server was added.

                                      @@ -162,52 +162,52 @@ Common elements are used by other OMA DM element types. The following table list -

                                      Chal

                                      -

                                      Specifies an authentication challenge. The server or client can send a challenge to the other if no credentials or inadequate credentials were given in the original request message.

                                      +

                                      Chal

                                      +

                                      Specifies an authentication challenge. The server or client can send a challenge to the other if no credentials or inadequate credentials were given in the original request message.

                                      -

                                      Cmd

                                      -

                                      Specifies the name of an OMA DM command referenced in a Status element.

                                      +

                                      Cmd

                                      +

                                      Specifies the name of an OMA DM command referenced in a Status element.

                                      -

                                      CmdID

                                      -

                                      Specifies the unique identifier for an OMA DM command.

                                      +

                                      CmdID

                                      +

                                      Specifies the unique identifier for an OMA DM command.

                                      -

                                      CmdRef

                                      -

                                      Specifies the ID of the command for which status or results information is being returned. This element takes the value of the CmdID element of the corresponding request message.

                                      +

                                      CmdRef

                                      +

                                      Specifies the ID of the command for which status or results information is being returned. This element takes the value of the CmdID element of the corresponding request message.

                                      -

                                      Cred

                                      -

                                      Specifies the authentication credential for the originator of the message.

                                      +

                                      Cred

                                      +

                                      Specifies the authentication credential for the originator of the message.

                                      -

                                      Final

                                      -

                                      Indicates that the current message is the last message in the package.

                                      +

                                      Final

                                      +

                                      Indicates that the current message is the last message in the package.

                                      -

                                      LocName

                                      -

                                      Specifies the display name in the Target and Source elements, used for sending a user ID for MD5 authentication.

                                      +

                                      LocName

                                      +

                                      Specifies the display name in the Target and Source elements, used for sending a user ID for MD5 authentication.

                                      -

                                      LocURI

                                      -

                                      Specifies the address of the target or source location. If the address contains a non-alphanumeric character, it must be properly escaped according to the URL encoding standard.

                                      +

                                      LocURI

                                      +

                                      Specifies the address of the target or source location. If the address contains a non-alphanumeric character, it must be properly escaped according to the URL encoding standard.

                                      -

                                      MsgID

                                      -

                                      Specifies a unique identifier for an OMA DM session message.

                                      +

                                      MsgID

                                      +

                                      Specifies a unique identifier for an OMA DM session message.

                                      -

                                      MsgRef

                                      -

                                      Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.

                                      +

                                      MsgRef

                                      +

                                      Specifies the ID of the corresponding request message. This element takes the value of the request message MsgID element.

                                      -

                                      RespURI

                                      -

                                      Specifies the URI that the recipient must use when sending a response to this message.

                                      +

                                      RespURI

                                      +

                                      Specifies the URI that the recipient must use when sending a response to this message.

                                      -

                                      SessionID

                                      -

                                      Specifies the identifier of the OMA DM session associated with the containing message.

                                      +

                                      SessionID

                                      +

                                      Specifies the identifier of the OMA DM session associated with the containing message.

                                      Note If the server does not notify the device that it supports a new version (through SyncApplicationVersion node in the DMClient CSP), the desktop client returns the SessionID in integer in decimal format and the mobile device client returns 2 bytes as a string. If the server supports DM session sync version 2.0, which is used in Windows 10, the desktop and mobile device client returns 2 bytes.
                                      @@ -216,28 +216,28 @@ Common elements are used by other OMA DM element types. The following table list
    -

    Source

    -

    Specifies the message source address.

    +

    Source

    +

    Specifies the message source address.

    -

    SourceRef

    -

    Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.

    +

    SourceRef

    +

    Specifies the source of the corresponding request message. This element takes the value of the request message Source element and is returned in the Status or Results element.

    -

    Target

    -

    Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.

    +

    Target

    +

    Specifies the address of the node, in the DM Tree, that is the target of the OMA DM command.

    -

    TargetRef

    -

    Specifies the target address in the corresponding request message. This element takes the value of the request message Target element and is returned in the Status or Results element.

    +

    TargetRef

    +

    Specifies the target address in the corresponding request message. This element takes the value of the request message Target element and is returned in the Status or Results element.

    -

    VerDTD

    -

    Specifies the major and minor version identifier of the OMA DM representation protocol specification used to represent the message.

    +

    VerDTD

    +

    Specifies the major and minor version identifier of the OMA DM representation protocol specification used to represent the message.

    -

    VerProto

    -

    Specifies the major and minor version identifier of the OMA DM protocol specification used with the message.

    +

    VerProto

    +

    Specifies the major and minor version identifier of the OMA DM protocol specification used with the message.

    @@ -272,32 +272,32 @@ The following table shows the sequence of events during a typical DM session. -

    1

    -

    DM client is invoked to call back to the management server

    +

    1

    +

    DM client is invoked to call back to the management server

    Enterprise scenario – The device task schedule invokes the DM client.

    -

    The MO server sends a server trigger message to invoke the DM client.

    +

    The MO server sends a server trigger message to invoke the DM client.

    The trigger message includes the server ID and tells the client device to initiate a session with the server. The client device authenticates the trigger message and verifies that the server is authorized to communicate with it.

    Enterprise scenario - At the scheduled time, the DM client is invoked periodically to call back to the enterprise management server over HTTPS.

    -

    2

    -

    The device sends a message, over an IP connection, to initiate the session.

    -

    This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level.

    +

    2

    +

    The device sends a message, over an IP connection, to initiate the session.

    +

    This message includes device information and credentials. The client and server do mutual authentication over an SSL channel or at the DM application level.

    -

    3

    -

    The DM server responds, over an IP connection (HTTPS).

    -

    The server sends initial device management commands, if any.

    +

    3

    +

    The DM server responds, over an IP connection (HTTPS).

    +

    The server sends initial device management commands, if any.

    -

    4

    -

    The device responds to server management commands.

    -

    This message includes the results of performing the specified device management operations.

    +

    4

    +

    The device responds to server management commands.

    +

    This message includes the results of performing the specified device management operations.

    -

    5

    -

    The DM server terminates the session or sends another command.

    -

    The DM session ends, or Step 4 is repeated.

    +

    5

    +

    The DM server terminates the session or sends another command.

    +

    The DM session ends, or Step 4 is repeated.

    diff --git a/windows/client-management/mdm/personalization-csp.md b/windows/client-management/mdm/personalization-csp.md index bf3d84f0f4..7a1a41565d 100644 --- a/windows/client-management/mdm/personalization-csp.md +++ b/windows/client-management/mdm/personalization-csp.md @@ -30,14 +30,14 @@ Personalization ----LockScreenImageStatus ``` **./Vendor/MSFT/Personalization** -

    Defines the root node for the Personalization configuration service provider.

    +

    Defines the root node for the Personalization configuration service provider.

    **DesktopImageUrl** -

    Specify a jpg, jpeg or png image to be used as Desktop Image. This setting can take a http or https Url to a remote image to be downloaded, a file Url to a local image.

    -

    Value type is string. Supported operations are Add, Get, Delete, and Replace.

    +

    Specify a jpg, jpeg or png image to be used as Desktop Image. This setting can take a http or https Url to a remote image to be downloaded, a file Url to a local image.

    +

    Value type is string. Supported operations are Add, Get, Delete, and Replace.

    **DesktopImageStatus** -

    Represents the status of the desktop image. Valid values:

    +

    Represents the status of the desktop image. Valid values:

    • 1 - Successfully downloaded or copied.
    • 2 - Download or copy in progress.
    • @@ -47,18 +47,18 @@ Personalization
    • 6 - Max retry failed.
    • 7 - Blocked, SKU not allowed
    -

    Supporter operation is Get.

    +

    Supporter operation is Get.

    > [!Note] > This setting is only used to query status. To set the image, use the DesktopImageUrl setting. **LockScreenImageUrl** -

    Specify a jpg, jpeg or png image to be used as Lock Screen Image. This setting can take a http or https Url to a remote image to be downloaded, a file Url to a local image.

    -

    Value type is string. Supported operations are Add, Get, Delete, and Replace.

    +

    Specify a jpg, jpeg or png image to be used as Lock Screen Image. This setting can take a http or https Url to a remote image to be downloaded, a file Url to a local image.

    +

    Value type is string. Supported operations are Add, Get, Delete, and Replace.

    **LockScreenImageStatus** -

    Represents the status of the lock screen image. Valid values:

    +

    Represents the status of the lock screen image. Valid values:

    • 1 - Successfully downloaded or copied.
    • 2 - Download or copy in progress.
    • @@ -68,7 +68,7 @@ Personalization
    • 6 - Max retry failed.
    • 7 - Blocked, SKU not allowed
    -

    Supporter operation is Get.

    +

    Supporter operation is Get.

    > [!Note] > This setting is only used to query status. To set the image, use the LockScreenImageUrl setting. diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index da0f0543dc..a03f3f09f7 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -48,24 +48,24 @@ The following diagram shows the Policy configuration service provider in tree fo **./Vendor/MSFT/Policy** -

    The root node for the Policy configuration service provider. +

    The root node for the Policy configuration service provider. -

    Supported operation is Get. +

    Supported operation is Get. **Policy/Config** -

    Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value,) the configuration source can use the Policy/Result path to retrieve the resulting value. +

    Node for grouping all policies configured by one source. The configuration source can use this path to set policy values and later query any policy value that it previously set. One policy can be configured by multiple configuration sources. If a configuration source wants to query the result of conflict resolution (for example, if Exchange and MDM both attempt to set a value,) the configuration source can use the Policy/Result path to retrieve the resulting value. -

    Supported operation is Get. +

    Supported operation is Get. **Policy/Config/_AreaName_** -

    The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value. +

    The area group that can be configured by a single technology for a single provider. Once added, you cannot change the value. -

    Supported operations are Add, Get, and Delete. +

    Supported operations are Add, Get, and Delete. **Policy/Config/_AreaName/PolicyName_** -

    Specifies the name/value pair used in the policy. +

    Specifies the name/value pair used in the policy. -

    The following list shows some tips to help you when configuring policies: +

    The following list shows some tips to help you when configuring policies: - Separate substring values by the Unicode &\#xF000; in the XML file. @@ -77,59 +77,59 @@ The following diagram shows the Policy configuration service provider in tree fo - Value type is string. **Policy/Result** -

    Groups the evaluated policies from all providers that can be configured. +

    Groups the evaluated policies from all providers that can be configured. -

    Supported operation is Get. +

    Supported operation is Get. **Policy/Result/_AreaName_** -

    The area group that can be configured by a single technology independent of the providers. +

    The area group that can be configured by a single technology independent of the providers. -

    Supported operation is Get. +

    Supported operation is Get. **Policy/Result/_AreaName/PolicyName_** -

    Specifies the name/value pair used in the policy. +

    Specifies the name/value pair used in the policy. -

    Supported operation is Get. +

    Supported operation is Get. **Policy/ConfigOperations** -

    Added in Windows 10, version 1703. The root node for grouping different configuration operations. +

    Added in Windows 10, version 1703. The root node for grouping different configuration operations. -

    Supported operations are Add, Get, and Delete. +

    Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall** -

    Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see Win32 and Desktop Bridge app policy configuration. +

    Added in Windows 10, version 1703. Allows settings for ADMX files for Win32 and Desktop Bridge apps to be imported (ingested) by your device and processed into new ADMX-backed policies or preferences. By using ADMXInstall, you can add ADMX-backed policies for those Win32 or Desktop Bridge apps that have been added between OS releases. ADMX-backed policies are ingested to your device by using the Policy CSP URI: ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall. Each ADMX-backed policy or preference that is added is assigned a unique ID. For more information about using Policy CSP to configure Win32 and Desktop Bridge app policies, see Win32 and Desktop Bridge app policy configuration. > [!NOTE] > The OPAX settings that are managed by the Microsoft Office Customization Tool are not supported by MDM. For more information about this tool, see [Office Customization Tool](/previous-versions/office/office-2013-resource-kit/cc179097(v=office.15)). -

    ADMX files that have been installed by using **ConfigOperations/ADMXInstall** can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}. +

    ADMX files that have been installed by using **ConfigOperations/ADMXInstall** can later be deleted by using the URI delete operation. Deleting an ADMX file will delete the ADMX file from disk, remove the metadata from the ADMXdefault registry hive, and delete all the policies that were set from the file. The MDM server can also delete all ADMX policies that are tied to a particular app by calling delete on the URI, ./Vendor/MSFT/Policy/ConfigOperations/ADMXInstall/{AppName}. -

    Supported operations are Add, Get, and Delete. +

    Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall/_AppName_** -

    Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file. +

    Added in Windows 10, version 1703. Specifies the name of the Win32 or Desktop Bridge app associated with the ADMX file. -

    Supported operations are Add, Get, and Delete. +

    Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall/_AppName_/Policy** -

    Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported. +

    Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app policy is to be imported. -

    Supported operations are Add, Get, and Delete. +

    Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall/_AppName_/Policy/_UniqueID_** -

    Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the policy to import. +

    Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the policy to import. -

    Supported operations are Add and Get. Does not support Delete. +

    Supported operations are Add and Get. Does not support Delete. **Policy/ConfigOperations/ADMXInstall/_AppName_/Preference** -

    Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported. +

    Added in Windows 10, version 1703. Specifies that a Win32 or Desktop Bridge app preference is to be imported. -

    Supported operations are Add, Get, and Delete. +

    Supported operations are Add, Get, and Delete. **Policy/ConfigOperations/ADMXInstall/_AppName_/Preference/_UniqueID_** -

    Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the preference to import. +

    Added in Windows 10, version 1703. Specifies the unique ID of the app ADMX file that contains the preference to import. -

    Supported operations are Add and Get. Does not support Delete. +

    Supported operations are Add and Get. Does not support Delete. ## Policies diff --git a/windows/client-management/mdm/policy-csp-devicelock.md b/windows/client-management/mdm/policy-csp-devicelock.md index b394ffb753..3df3e81293 100644 --- a/windows/client-management/mdm/policy-csp-devicelock.md +++ b/windows/client-management/mdm/policy-csp-devicelock.md @@ -761,7 +761,7 @@ PIN enforces the following behavior for desktop and mobile devices: The default value is 1. The following list shows the supported values and actual enforced values: - +
    @@ -777,24 +777,24 @@ The default value is 1. The following list shows the supported values and actual - - - + + + - - - + + + - - - + + + - - - + + +

    Mobile

    1,2,3,4

    Same as the value set

    Mobile

    1,2,3,4

    Same as the value set

    Desktop Local Accounts

    1,2,3

    3

    Desktop Local Accounts

    1,2,3

    3

    Desktop Microsoft Accounts

    1,2

    <p2

    Desktop Microsoft Accounts

    1,2

    <p2

    Desktop Domain Accounts

    Not supported

    Not supported

    Desktop Domain Accounts

    Not supported

    Not supported

    diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index d627137d97..b033f662cc 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -747,7 +747,7 @@ The following list shows the supported values for Windows 8.1: - 1 – Allowed, except for Secondary Data Requests. - 2 (default) – Allowed. - @@ -790,7 +790,7 @@ The following list shows the supported values for Windows 10 version 1809 and ol Most restrictive value is 0. - diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 1813782b4c..1fe9517d3d 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -1747,7 +1747,7 @@ Other/cannot defer: Any update category not specifically enumerated above falls into this category. - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B - diff --git a/windows/client-management/mdm/policy-csp-accounts.md b/windows/client-management/mdm/policy-csp-accounts.md index 644ff6136e..2d31514b75 100644 --- a/windows/client-management/mdm/policy-csp-accounts.md +++ b/windows/client-management/mdm/policy-csp-accounts.md @@ -42,20 +42,17 @@ manager: dansimp - - + + + - + - - - - - + From ca465462b809b2af0da46e54cb1533d5e9ca6bfe Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Mon, 30 Aug 2021 12:10:30 -0700 Subject: [PATCH 0136/1214] Update feature-availability.md --- .../feature-availability.md | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md index 16eb1e9257..8e813e308b 100644 --- a/windows/security/threat-protection/windows-defender-application-control/feature-availability.md +++ b/windows/security/threat-protection/windows-defender-application-control/feature-availability.md @@ -1,5 +1,5 @@ --- -title: Feature Availability +title: Windows Defender Application Control Feature Availability description: Compare WDAC and AppLocker feature availability. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -19,7 +19,7 @@ ms.custom: asr ms.technology: mde --- -# WDAC and AppLocker feature availability +# Windows Defender Application Control and AppLocker feature availability **Applies to:** @@ -28,7 +28,7 @@ ms.technology: mde - Windows Server 2016 and above >[!NOTE] ->Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). +>Some capabilities of Windows Defender Application Control are only available on specific Windows versions. See below to learn more. | Capability | WDAC | AppLocker | |-------------|------|-------------| @@ -44,4 +44,4 @@ ms.technology: mde | Path-based rules | [Available on 1903+.](./select-types-of-rules-to-create.md#more-information-about-filepath-rules) Exclusions are not supported. Runtime user-writeability checks enforced by default. | Available on Windows 8+. Exclusions are supported. No runtime user-writeability check. | | COM object configurability | [Available on 1903+](./allow-com-object-registration-in-windows-defender-application-control-policy.md) | Not available | | Packaged app rules | [Available on RS5+](./manage-packaged-apps-with-windows-defender-application-control.md) | Available on Windows 8+ | -| Enforceable file types |
    • Driver files: .sys
    • Executable files: .exe and .com
    • DLLs: .dll and .ocx
    • Windows Installer files: .msi, .mst, and .msp
    • Scripts: .ps1, .vbs, and .js
    • Packaged apps and packaged app installers: .appx
    |
    • Executable files: .exe and .com
    • [Optional] DLLs: .dll and .ocx
    • Windows Installer files: .msi, .mst, and .msp
    • Scripts: .ps1, .bat, .cmd, .vbs, and .js
    • Packaged apps and packaged app installers: .appx
    | \ No newline at end of file +| Enforceable file types |
    • Driver files: .sys
    • Executable files: .exe and .com
    • DLLs: .dll and .ocx
    • Windows Installer files: .msi, .mst, and .msp
    • Scripts: .ps1, .vbs, and .js
    • Packaged apps and packaged app installers: .appx
    |
    • Executable files: .exe and .com
    • [Optional] DLLs: .dll and .ocx
    • Windows Installer files: .msi, .mst, and .msp
    • Scripts: .ps1, .bat, .cmd, .vbs, and .js
    • Packaged apps and packaged app installers: .appx
    | From 53f01c161a28b0747a0b5206a199dc8a08d85910 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Mon, 30 Aug 2021 16:32:49 -0400 Subject: [PATCH 0137/1214] review, updating with master --- windows/application-management/add-apps-and-features.md | 4 ++-- windows/application-management/apps-in-windows-10.md | 2 +- .../application-management/sideload-apps-in-windows-10.md | 6 +++--- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/application-management/add-apps-and-features.md b/windows/application-management/add-apps-and-features.md index 835543cb01..30c4423927 100644 --- a/windows/application-management/add-apps-and-features.md +++ b/windows/application-management/add-apps-and-features.md @@ -8,7 +8,7 @@ ms.pagetype: article ms.author: mandia author: MandiOhlinger ms.localizationpriority: medium -ms.date: 08/25/2021 +ms.date: 08/30/2021 ms.reviewer: manager: dougeby ms.topic: article @@ -70,5 +70,5 @@ Microsoft Intune can also execute Windows PowerShell scripts. For more informati ## Restore Windows features -- If you use Group Policy or MDM to hide Windows Features or the entire Apps feature, you can set the policy to **Not configured**. Then, deploy your policy. When the device receives the policy, the features are shown. +- If you use Group Policy or MDM to hide Windows Features or the entire Apps feature, you can set the policy to **Not configured**. Then, deploy your policy. When the device receives the policy, the features are configurable. - Using Windows PowerShell, you can also enable specific features using the [Enable-WindowsOptionalFeature](/powershell/module/dism/enable-windowsoptionalfeature) command. diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 0ad35e3d24..387c2a7325 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -61,7 +61,7 @@ There are different types of apps that can run on your Windows client devices. T Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a Web App](https://azure.microsoft.com/get-started/web-app/). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview). - Use an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. + Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. - **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 2895977bac..11defe4f8f 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -10,7 +10,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile author: greg-lindsay -ms.date: 08/25/2021 +ms.date: 08/30/2021 ms.localizationpriority: medium --- @@ -74,8 +74,8 @@ For more information, see [Enable your device for development](/windows/apps/get If you use Group Policy, use the `Computer Configuration\Administrative Templates\Windows Components\App Package Deployment` policies to enable or prevent sideloading apps: -- Allows development of Windows Store apps and installing them from an integrated development environment (IDE) -- Allow all trusted apps to install +- `Allows development of Windows Store apps and installing them from an integrated development environment (IDE)` +- `Allow all trusted apps to install` By default, the OS might set these policies to **Not configured**, which means app sideloading is turned off. If you set these policies to **Enabled**, then users can sideload apps. From 6eba2559e4af31eace4ef68e41f6e0984e96e28f Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Tue, 31 Aug 2021 11:04:58 +0530 Subject: [PATCH 0138/1214] Updated --- .../mdm/policy-csp-abovelock.md | 11 - .../mdm/policy-csp-admx-addremoveprograms.md | 45 ++- .../mdm/policy-csp-admx-appcompat.md | 2 +- .../mdm/policy-csp-admx-appxpackagemanager.md | 22 +- .../mdm/policy-csp-admx-appxruntime.md | 89 +++-- .../mdm/policy-csp-admx-attachmentmanager.md | 111 ++++--- .../mdm/policy-csp-admx-auditsettings.md | 22 +- .../mdm/policy-csp-admx-bits.md | 306 +++++++++++------- 8 files changed, 379 insertions(+), 229 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-abovelock.md b/windows/client-management/mdm/policy-csp-abovelock.md index 23c1bb8142..79d9b5b8d3 100644 --- a/windows/client-management/mdm/policy-csp-abovelock.md +++ b/windows/client-management/mdm/policy-csp-abovelock.md @@ -159,16 +159,5 @@ The following list shows the supported values:
    -Footnotes: - -- 1 - Available in Windows 10, version 1607. -- 2 - Available in Windows 10, version 1703. -- 3 - Available in Windows 10, version 1709. -- 4 - Available in Windows 10, version 1803. -- 5 - Available in Windows 10, version 1809. -- 6 - Available in Windows 10, version 1903. -- 7 - Available in Windows 10, version 1909. -- 8 - Available in Windows 10, version 2004. - diff --git a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md index 0c7c4b543b..c68d969b32 100644 --- a/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md +++ b/windows/client-management/mdm/policy-csp-admx-addremoveprograms.md @@ -67,28 +67,34 @@ manager: dansimp
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procheck mark
    Businesscheck markYes, starting in Windows 10, version 1607Yes
    Enterprise
    - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -150,28 +156,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -231,8 +243,9 @@ ADMX Info: - - + + + diff --git a/windows/client-management/mdm/policy-csp-admx-appcompat.md b/windows/client-management/mdm/policy-csp-admx-appcompat.md index e145a37e11..0dfe1a0429 100644 --- a/windows/client-management/mdm/policy-csp-admx-appcompat.md +++ b/windows/client-management/mdm/policy-csp-admx-appcompat.md @@ -70,7 +70,7 @@ manager: dansimp
    Windows EditionSupported?EditionWindows 10Windows 11
    Home
    - + diff --git a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md index f3aef0211f..0b8b0533a4 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md +++ b/windows/client-management/mdm/policy-csp-admx-appxpackagemanager.md @@ -36,28 +36,34 @@ manager: dansimp
    Windows EditionEdition Supported?
    - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -74,7 +80,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. +This policy setting allows you to manage the deployment of Windows Store apps when the user is signed in using a special profile. Special profiles are the following user profiles, where changes are discarded after the user signs off: diff --git a/windows/client-management/mdm/policy-csp-admx-appxruntime.md b/windows/client-management/mdm/policy-csp-admx-appxruntime.md index c30dafd023..aaec3dafb9 100644 --- a/windows/client-management/mdm/policy-csp-admx-appxruntime.md +++ b/windows/client-management/mdm/policy-csp-admx-appxruntime.md @@ -45,29 +45,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross mark
    NoNo
    @@ -83,7 +88,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer. +This policy setting lets you turn on Content URI Rules to supplement the static Content URI Rules that were defined as part of the app manifest and apply to all Windows Store apps that use the enterpriseAuthentication capability on a computer. If you enable this policy setting, you can define additional Content URI Rules that all Windows Store apps that use the enterpriseAuthentication capability on a computer can use. @@ -114,28 +119,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -153,7 +164,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type. +This policy setting lets you control whether Windows Store apps can open files using the default desktop app for a file type. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a Windows Store app might compromise the system by opening a file in the default desktop app for a file type. If you enable this policy setting, Windows Store apps cannot open files in the default desktop app for a file type; they can open files only in other Windows Store apps. @@ -184,28 +195,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -222,7 +239,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched. +This policy setting controls whether Universal Windows apps with Windows Runtime API access directly from web content can be launched. If you enable this policy setting, Universal Windows apps which declare Windows Runtime API access in ApplicationContentUriRules section of the manifest cannot be launched; Universal Windows apps which have not declared Windows Runtime API access in the manifest are not affected. @@ -256,28 +273,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -295,7 +318,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app. +This policy setting lets you control whether Windows Store apps can open URIs using the default desktop app for a URI scheme. Because desktop apps run at a higher integrity level than Windows Store apps, there is a risk that a URI scheme launched by a Windows Store app might compromise the system by launching a desktop app. If you enable this policy setting, Windows Store apps cannot open URIs in the default desktop app for a URI scheme; they can open URIs only in other Windows Store apps. diff --git a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md index 7a82136079..ad8afe2281 100644 --- a/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md +++ b/windows/client-management/mdm/policy-csp-admx-attachmentmanager.md @@ -48,28 +48,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -86,7 +92,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments. +This policy setting allows you to configure the logic that Windows uses to determine the risk for file attachments. Preferring the file handler instructs Windows to use the file handler data over the file type data. For example, trust notepad.exe, but don't trust .txt files. @@ -123,28 +129,33 @@ ADMX Info: - - + + + - - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross mark
    NoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -161,7 +172,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments. +This policy setting allows you to manage the default risk level for file types. To fully customize the risk level for file attachments, you may also need to configure the trust logic for file attachments. High Risk: If the attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. @@ -200,28 +211,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -238,7 +255,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of high-risk file types. If the file attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the medium-risk and low-risk inclusion lists (where an extension is listed in more than one inclusion list). +This policy setting allows you to configure the list of high-risk file types. If the file attachment is in the list of high-risk file types and is from the restricted zone, Windows blocks the user from accessing the file. If the file is from the Internet zone, Windows prompts the user before accessing the file. This inclusion list takes precedence over the medium-risk and low-risk inclusion lists (where an extension is listed in more than one inclusion list). If you enable this policy setting, you can create a custom list of high-risk file types. @@ -271,28 +288,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -309,7 +332,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list). +This policy setting allows you to configure the list of low-risk file types. If the attachment is in the list of low-risk file types, Windows will not prompt the user before accessing the file, regardless of the file's zone information. This inclusion list overrides the list of high-risk file types built into Windows and has a lower precedence than the high-risk or medium-risk inclusion lists (where an extension is listed in more than one inclusion list). If you enable this policy setting, you can specify file types that pose a low risk. @@ -342,28 +365,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -380,7 +409,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list). +This policy setting allows you to configure the list of moderate-risk file types. If the attachment is in the list of moderate-risk file types and is from the restricted or Internet zone, Windows prompts the user before accessing the file. This inclusion list overrides the list of potentially high-risk file types built into Windows and it takes precedence over the low-risk inclusion list but has a lower precedence than the high-risk inclusion list (where an extension is listed in more than one inclusion list). If you enable this policy setting, you can specify file types which pose a moderate risk. diff --git a/windows/client-management/mdm/policy-csp-admx-auditsettings.md b/windows/client-management/mdm/policy-csp-admx-auditsettings.md index 56d9939332..e2ccc80ff4 100644 --- a/windows/client-management/mdm/policy-csp-admx-auditsettings.md +++ b/windows/client-management/mdm/policy-csp-admx-auditsettings.md @@ -36,28 +36,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -74,7 +80,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. +This policy setting determines what information is logged in security audit events when a new process has been created. This setting only applies when the Audit Process Creation policy is enabled. If you enable this policy setting, the command line information for every process will be logged in plain text in the security event log as part of the Audit Process Creation event 4688, "a new process has been created," on the workstations and servers on which this policy setting is applied. diff --git a/windows/client-management/mdm/policy-csp-admx-bits.md b/windows/client-management/mdm/policy-csp-admx-bits.md index 9a5fd957e7..76a477a1a4 100644 --- a/windows/client-management/mdm/policy-csp-admx-bits.md +++ b/windows/client-management/mdm/policy-csp-admx-bits.md @@ -75,28 +75,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -113,7 +119,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default. +This setting affects whether the BITS client is allowed to use Windows Branch Cache. If the Windows Branch Cache component is installed and enabled on a computer, BITS jobs on that computer can use Windows Branch Cache by default. If you enable this policy setting, the BITS client does not use Windows Branch Cache. @@ -147,28 +153,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -185,7 +197,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computer will act as a BITS peer caching client. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). +This policy setting specifies whether the computer will act as a BITS peer caching client. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). If you enable this policy setting, the computer will no longer use the BITS peer caching feature to download files; files will be downloaded only from the origin server. However, the computer will still make files available to its peers. @@ -219,28 +231,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -257,7 +275,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the computer will act as a BITS peer caching server. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). +This policy setting specifies whether the computer will act as a BITS peer caching server. By default, when BITS peer caching is enabled, the computer acts as both a peer caching server (offering files to its peers) and a peer caching client (downloading files from its peers). If you enable this policy setting, the computer will no longer cache downloaded files and offer them to its peers. However, the computer will still download files from peers. @@ -292,28 +310,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -330,7 +354,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting determines if the Background Intelligent Transfer Service (BITS) peer caching feature is enabled on a specific computer. By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner. +This policy setting determines if the Background Intelligent Transfer Service (BITS) peer caching feature is enabled on a specific computer. By default, the files in a BITS job are downloaded only from the origin server specified by the job's owner. If BITS peer caching is enabled, BITS caches downloaded files and makes them available to other BITS peers. When transferring a download job, BITS first requests the files for the job from its peers in the same IP subnet. If none of the peers in the subnet have the requested files, BITS downloads them from the origin server. @@ -364,28 +388,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -402,7 +432,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server). +This policy setting limits the network bandwidth that BITS uses for peer cache transfers (this setting does not affect transfers from the origin server). To prevent any negative impact to a computer caused by serving other peers, by default BITS will use up to 30 percent of the bandwidth of the slowest active network interface. For example, if a computer has both a 100 Mbps network card and a 56 Kbps modem, and both are active, BITS will use a maximum of 30 percent of 56 Kbps. @@ -440,28 +470,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -478,7 +514,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers. +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the maintenance days and hours. Maintenance schedules further limit the network bandwidth that is used for background transfers. If you enable this policy setting, you can define a separate set of network bandwidth limits and set up a schedule for the maintenance period. @@ -515,28 +551,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -553,7 +595,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours. +This policy setting limits the network bandwidth that Background Intelligent Transfer Service (BITS) uses for background transfers during the work and non-work days and hours. The work schedule is defined using a weekly calendar, which consists of days of the week and hours of the day. All hours and days that are not defined in a work schedule are considered non-work hours. If you enable this policy setting, you can set up a schedule for limiting network bandwidth during both work and non-work hours. After the work schedule is defined, you can set the bandwidth usage limits for each of the three BITS background priority levels: high, normal, and low. @@ -587,28 +629,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -625,7 +673,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the maximum amount of disk space that can be used for the BITS peer cache, as a percentage of the total system disk size. BITS will add files to the peer cache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1 percent of the total system disk for the peercache. +This policy setting limits the maximum amount of disk space that can be used for the BITS peer cache, as a percentage of the total system disk size. BITS will add files to the peer cache and make those files available to peers until the cache content reaches the specified cache size. By default, BITS will use 1 percent of the total system disk for the peercache. If you enable this policy setting, you can enter the percentage of disk space to be used for the BITS peer cache. You can enter a value between 1 percent and 80 percent. @@ -659,28 +707,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -731,28 +785,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYestd>
    Educationcross markNoNo
    @@ -769,7 +829,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job. +This policy setting limits the amount of time that Background Intelligent Transfer Service (BITS) will take to download the files in a BITS job. The time limit applies only to the time that BITS is actively downloading files. When the cumulative download time exceeds this limit, the job is placed in the error state. @@ -804,28 +864,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -842,7 +908,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain. +This policy setting limits the number of files that a BITS job can contain. By default, a BITS job is limited to 200 files. You can use this setting to raise or lower the maximum number of files a BITS jobs can contain. If you enable this policy setting, BITS will limit the maximum number of files a job can contain to the specified number. @@ -876,28 +942,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -914,7 +986,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of BITS jobs that can be created for all users of the computer. By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this policy setting to raise or lower the maximum number of user BITS jobs. +This policy setting limits the number of BITS jobs that can be created for all users of the computer. By default, BITS limits the total number of jobs that can be created on the computer to 300 jobs. You can use this policy setting to raise or lower the maximum number of user BITS jobs. If you enable this policy setting, BITS will limit the maximum number of BITS jobs to the specified number. @@ -948,28 +1020,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -986,7 +1064,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create. +This policy setting limits the number of BITS jobs that can be created by a user. By default, BITS limits the total number of jobs that can be created by a user to 60 jobs. You can use this setting to raise or lower the maximum number of BITS jobs a user can create. If you enable this policy setting, BITS will limit the maximum number of BITS jobs a user can create to the specified number. @@ -1020,28 +1098,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1058,7 +1142,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file. +This policy setting limits the number of ranges that can be added to a file in a BITS job. By default, files in a BITS job are limited to 500 ranges per file. You can use this setting to raise or lower the maximum number ranges per file. If you enable this policy setting, BITS will limit the maximum number of ranges that can be added to a file to the specified number. From 0b7421daacf85820649220cc21036be50cd158ab Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Tue, 31 Aug 2021 20:55:26 +0530 Subject: [PATCH 0139/1214] Updated --- .../mdm/policy-csp-admx-ciphersuiteorder.md | 44 +- .../mdm/policy-csp-admx-com.md | 44 +- .../mdm/policy-csp-admx-controlpanel.md | 90 ++- .../policy-csp-admx-controlpaneldisplay.md | 624 ++++++++++++------ .../mdm/policy-csp-admx-cpls.md | 27 +- .../policy-csp-admx-credentialproviders.md | 81 ++- .../mdm/policy-csp-admx-credssp.md | 296 ++++++--- .../mdm/policy-csp-admx-credui.md | 52 +- .../mdm/policy-csp-admx-ctrlaltdel.md | 108 ++- 9 files changed, 952 insertions(+), 414 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md index 44e91fe2e9..b0f0a3ca01 100644 --- a/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md +++ b/windows/client-management/mdm/policy-csp-admx-ciphersuiteorder.md @@ -40,28 +40,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -78,7 +84,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting determines the cipher suites used by the Secure Socket Layer (SSL). +This policy setting determines the cipher suites used by the Secure Socket Layer (SSL). If you enable this policy setting, SSL cipher suites are prioritized in the order specified. @@ -113,28 +119,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -151,7 +163,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting determines the priority order of ECC curves used with ECDHE cipher suites. +This policy setting determines the priority order of ECC curves used with ECDHE cipher suites. If you enable this policy setting, ECC curves are prioritized in the order specified. Enter one curve name per line. diff --git a/windows/client-management/mdm/policy-csp-admx-com.md b/windows/client-management/mdm/policy-csp-admx-com.md index 13d4fabf45..515d46c987 100644 --- a/windows/client-management/mdm/policy-csp-admx-com.md +++ b/windows/client-management/mdm/policy-csp-admx-com.md @@ -40,28 +40,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -78,7 +84,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. +This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. @@ -115,28 +121,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -153,7 +165,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. +This policy setting directs the system to search Active Directory for missing Component Object Model (COM) components that a program requires. Many Windows programs, such as the MMC snap-ins, use the interfaces provided by the COM components. These programs cannot perform all their functions unless Windows has internally registered the required components. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpanel.md b/windows/client-management/mdm/policy-csp-admx-controlpanel.md index 9dec30ad01..bd127d636b 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpanel.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpanel.md @@ -45,28 +45,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -83,7 +89,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. +This setting allows you to display or hide specified Control Panel items, such as Mouse, System, or Personalization, from the Control Panel window and the Start screen. The setting affects the Start screen and Control Panel window, as well as other ways to access Control Panel items, such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. If you enable this setting, you can select specific items not to display on the Control Panel window and the Start screen. @@ -122,28 +128,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -160,7 +172,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls the default Control Panel view, whether by category or icons. +This policy setting controls the default Control Panel view, whether by category or icons. If this policy setting is enabled, the Control Panel opens to the icon view. @@ -196,28 +208,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -277,28 +295,38 @@ ADMX Info: - - + + + - + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -315,7 +343,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. +This policy setting controls which Control Panel items such as Mouse, System, or Personalization, are displayed on the Control Panel window and the Start screen. The only items displayed in Control Panel are those you specify in this setting. This setting affects the Start screen and Control Panel, as well as other ways to access Control Panel items such as shortcuts in Help and Support or command lines that use control.exe. This policy has no effect on items displayed in PC settings. To display a Control Panel item, enable this policy setting and click Show to access the list of allowed Control Panel items. In the Show Contents dialog box in the Value column, enter the Control Panel item's canonical name. For example, enter Microsoft.Mouse, Microsoft.System, or Microsoft.Personalization. diff --git a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md index f1f3907cbe..828dd52285 100644 --- a/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md +++ b/windows/client-management/mdm/policy-csp-admx-controlpaneldisplay.md @@ -105,28 +105,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -143,7 +149,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. Disables the Display Control Panel. +Disables the Display Control Panel. If you enable this setting, the Display Control Panel does not run. When users try to start Display, a message appears explaining that a setting prevents the action. @@ -174,28 +180,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -212,7 +229,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes the Settings tab from Display in Control Panel. +Removes the Settings tab from Display in Control Panel. This setting prevents users from using Control Panel to add, configure, or change the display settings on the computer. @@ -241,28 +258,40 @@ ADMX Info: - - + + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -279,7 +308,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This setting forces the theme color scheme to be the default color scheme. +This setting forces the theme color scheme to be the default color scheme. If you enable this setting, a user cannot change the color scheme of the current desktop theme. @@ -312,28 +341,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -350,7 +390,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This setting disables the theme gallery in the Personalization Control Panel. +This setting disables the theme gallery in the Personalization Control Panel. If you enable this setting, users cannot change or save a theme. Elements of a theme such as the desktop background, color, sounds, and screen saver can still be changed (unless policies are set to turn them off). @@ -384,28 +424,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -422,7 +473,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens. +Prevents users or applications from changing the visual style of the windows and buttons displayed on their screens. When enabled on Windows XP, this setting disables the "Windows and buttons" drop-down list on the Appearance tab in Display Properties. @@ -453,28 +504,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -491,7 +553,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Enables desktop screen savers. +Enables desktop screen savers. If you disable this setting, screen savers do not run. Also, this setting disables the Screen Saver section of the Screen Saver dialog in the Personalization or Display Control Panel. As a result, users cannot change the screen saver options. @@ -526,28 +588,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -564,7 +637,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This setting allows you to force a specific default lock screen and logon image by entering the path (location) of the image file. The same image will be used for both the lock and logon screens. +This setting allows you to force a specific default lock screen and logon image by entering the path (location) of the image file. The same image will be used for both the lock and logon screens. This setting lets you specify the default lock screen and logon image shown when no user is signed in, and also sets the specified image as the default for all users (it replaces the inbox default image). @@ -599,28 +672,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -637,7 +721,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the size of the font in the windows and buttons displayed on their screens. +Prevents users from changing the size of the font in the windows and buttons displayed on their screens. If this setting is enabled, the "Font size" drop-down list on the Appearance tab in Display Properties is disabled. @@ -668,28 +752,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -706,7 +801,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the background image shown when the machine is locked or when on the logon screen. +Prevents users from changing the background image shown when the machine is locked or when on the logon screen. By default, users can change the background image shown when the machine is locked or displaying the logon screen. @@ -737,28 +832,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -775,7 +881,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the look of their start menu background, such as its color or accent. +Prevents users from changing the look of their start menu background, such as its color or accent. By default, users can change the look of their start menu background, such as its color or accent. @@ -810,28 +916,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -848,7 +965,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available. +Disables the Color (or Window Color) page in the Personalization Control Panel, or the Color Scheme dialog in the Display Control Panel on systems where the Personalization feature is not available. This setting prevents users from using Control Panel to change the window border and taskbar color (on Windows 8), glass color (on Windows Vista and Windows 7), system colors, or color scheme of the desktop and windows. @@ -881,28 +998,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -919,7 +1047,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from adding or changing the background design of the desktop. +Prevents users from adding or changing the background design of the desktop. By default, users can use the Desktop Background page in the Personalization or Display Control Panel to add a background design (wallpaper) to their desktop. @@ -956,28 +1084,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -994,7 +1133,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the desktop icons. +Prevents users from changing the desktop icons. By default, users can use the Desktop Icon Settings dialog in the Personalization or Display Control Panel to show, hide, or change the desktop icons. @@ -1027,28 +1166,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1096,28 +1246,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1165,28 +1326,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1203,7 +1375,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel. +Prevents the Screen Saver dialog from opening in the Personalization or Display Control Panel. This setting prevents users from using Control Panel to add, configure, or change the screen saver on the computer. It does not prevent a screen saver from running. @@ -1232,28 +1404,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1270,7 +1453,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the sound scheme. +Prevents users from changing the sound scheme. By default, users can use the Sounds tab in the Sound Control Panel to add, remove, or change the system Sound Scheme. @@ -1301,28 +1484,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1339,7 +1533,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB. +Forces Windows to use the specified colors for the background and accent. The color values are specified in hex as #RGB. By default, users can change the background and accent colors. @@ -1370,28 +1564,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1408,7 +1613,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Determines whether screen savers used on the computer are password protected. +Determines whether screen savers used on the computer are password protected. If you enable this setting, all screen savers are password protected. If you disable this setting, password protection cannot be set on any screen saver. @@ -1446,8 +1651,9 @@ ADMX Info: - - + + + @@ -1455,19 +1661,27 @@ ADMX Info: - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Home
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1484,7 +1698,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Specifies how much user idle time must elapse before the screen saver is launched. +Specifies how much user idle time must elapse before the screen saver is launched. When configured, this idle time can be set from a minimum of 1 second to a maximum of 86,400 seconds, or 24 hours. If set to zero, the screen saver will not be started. @@ -1530,23 +1744,33 @@ ADMX Info: Home - cross mark + No + No + Pro - cross mark + No + No + Business - cross mark + No + No + Enterprise - check mark + Yes + Yes + Education - cross mark + No + No + @@ -1563,7 +1787,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Specifies the screen saver for the user's desktop. +Specifies the screen saver for the user's desktop. If you enable this setting, the system displays the specified screen saver on the user's desktop. Also, this setting disables the drop-down list of screen savers in the Screen Saver dialog in the Personalization or Display Control Panel, which prevents users from changing the screen saver. @@ -1601,28 +1825,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1675,23 +1910,33 @@ ADMX Info: Home - cross mark + No + No + Pro - cross mark + No + No + Business - cross mark + No + No + Enterprise - check mark + Yes + Yes + Education - cross mark + No + No + @@ -1708,7 +1953,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This setting allows you to force a specific visual style file by entering the path (location) of the visual style file. +This setting allows you to force a specific visual style file by entering the path (location) of the visual style file. This can be a local computer visual style (aero.msstyles), or a file located on a remote server using a UNC path (\\Server\Share\aero.msstyles). @@ -1748,28 +1993,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1786,7 +2042,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Forces the Start screen to use one of the available backgrounds, 1 through 20, and prevents the user from changing it. +Forces the Start screen to use one of the available backgrounds, 1 through 20, and prevents the user from changing it. If this setting is set to zero or not configured, then Start uses the default background, and users can change it. diff --git a/windows/client-management/mdm/policy-csp-admx-cpls.md b/windows/client-management/mdm/policy-csp-admx-cpls.md index 6ad7cad008..e1ee9b86de 100644 --- a/windows/client-management/mdm/policy-csp-admx-cpls.md +++ b/windows/client-management/mdm/policy-csp-admx-cpls.md @@ -36,28 +36,39 @@ manager: dansimp - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -74,7 +85,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo. +This policy setting allows an administrator to standardize the account pictures for all users on a system to the default account picture. One application for this policy setting is to standardize the account pictures to a company logo. > [!NOTE] > The default account picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\user.jpg. The default guest picture is stored at %PROGRAMDATA%\Microsoft\User Account Pictures\guest.jpg. If the default pictures do not exist, an empty frame is displayed. diff --git a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md index b7ed4ab54a..0cad585609 100644 --- a/windows/client-management/mdm/policy-csp-admx-credentialproviders.md +++ b/windows/client-management/mdm/policy-csp-admx-credentialproviders.md @@ -42,28 +42,39 @@ manager: dansimp - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -80,7 +91,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off. +This policy setting allows you to control whether a user can change the time before a password is required when a Connected Standby device screen turns off. If you enable this policy setting, a user on a Connected Standby device can change the amount of time after the device's screen turns off before a password is required when waking the device. The time is limited by any EAS settings or Group Policies that affect the maximum idle time before a device locks. Additionally, if a password is required when a screensaver turns on, the screensaver timeout will limit the options the user may choose. @@ -115,28 +126,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -153,7 +175,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to assign a specified credential provider as the default credential provider. +This policy setting allows the administrator to assign a specified credential provider as the default credential provider. If you enable this policy setting, the specified credential provider is selected on other user tile. @@ -188,28 +210,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -226,7 +259,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows the administrator to exclude the specified credential providers from use during authentication. +This policy setting allows the administrator to exclude the specified credential providers from use during authentication. > [!NOTE] > Credential providers are used to process and validate user credentials during logon or when authentication is required. Windows Vista provides two default credential providers: Password and Smart Card. An administrator can install additional credential providers for different sets of credentials (for example, to support biometric authentication). diff --git a/windows/client-management/mdm/policy-csp-admx-credssp.md b/windows/client-management/mdm/policy-csp-admx-credssp.md index 04bbf46ba4..f55b199a4f 100644 --- a/windows/client-management/mdm/policy-csp-admx-credssp.md +++ b/windows/client-management/mdm/policy-csp-admx-credssp.md @@ -66,28 +66,38 @@ manager: dansimp - - + + + - + + + - + + + - + + + - + + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -104,7 +114,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). This policy setting applies when server authentication was achieved via NTLM. @@ -146,28 +156,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -184,7 +205,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). This policy setting applies when server authentication was achieved by using a trusted X509 certificate or Kerberos. @@ -231,28 +252,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -269,7 +301,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the CredSSP component (for example: Remote Desktop Connection). Some versions of the CredSSP protocol are vulnerable to an encryption oracle attack against the client. This policy controls compatibility with vulnerable clients and servers. This policy allows you to set the level of protection desired for the encryption oracle vulnerability. @@ -311,28 +343,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -349,7 +392,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. @@ -393,28 +436,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -431,7 +485,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). This policy setting applies when server authentication was achieved via NTLM. @@ -475,28 +529,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -513,7 +578,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). This policy setting applies when server authentication was achieved via a trusted X509 certificate or Kerberos. @@ -557,28 +622,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -595,7 +671,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). This policy setting applies when server authentication was achieved via NTLM. @@ -639,28 +715,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -677,7 +764,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). If you enable this policy setting, you can specify the servers to which the user's default credentials cannot be delegated (default credentials are those that you use when first logging on to Windows). @@ -719,28 +806,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -757,7 +855,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). If you enable this policy setting, you can specify the servers to which the user's fresh credentials cannot be delegated (fresh credentials are those that you are prompted for when executing the application). @@ -799,28 +897,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -837,7 +946,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). +This policy setting applies to applications using the Cred SSP component (for example: Remote Desktop Connection). If you enable this policy setting, you can specify the servers to which the user's saved credentials cannot be delegated (saved credentials are those that you elect to save/remember using the Windows credential manager). @@ -879,28 +988,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -917,7 +1037,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device. +When running in Restricted Admin or Remote Credential Guard mode, participating apps do not expose signed in or supplied credentials to a remote host. Restricted Admin limits access to resources located on other servers or networks from the remote host because credentials are not delegated. Remote Credential Guard does not limit access to resources because it redirects all requests back to the client device. Participating apps: Remote Desktop Client diff --git a/windows/client-management/mdm/policy-csp-admx-credui.md b/windows/client-management/mdm/policy-csp-admx-credui.md index acb7942b92..d1ad1b5737 100644 --- a/windows/client-management/mdm/policy-csp-admx-credui.md +++ b/windows/client-management/mdm/policy-csp-admx-credui.md @@ -39,28 +39,39 @@ manager: dansimp - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -77,7 +88,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials. +This policy setting requires the user to enter Microsoft Windows credentials using a trusted path, to prevent a Trojan horse or other types of malicious code from stealing the user’s Windows credentials. > [!NOTE] > This policy affects nonlogon authentication tasks only. As a security best practice, this policy should be enabled. @@ -111,28 +122,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    diff --git a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md index b42e1e9ad0..9836d5e9d0 100644 --- a/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md +++ b/windows/client-management/mdm/policy-csp-admx-ctrlaltdel.md @@ -45,28 +45,39 @@ manager: dansimp - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -83,7 +94,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from changing their Windows password on demand. +This policy setting prevents users from changing their Windows password on demand. If you enable this policy setting, the 'Change Password' button on the Windows Security dialog box will not appear when you press Ctrl+Alt+Del. @@ -115,28 +126,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -153,7 +175,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from locking the system. +This policy setting prevents users from locking the system. While locked, the desktop is hidden and the system cannot be used. Only the user who locked the system or the system administrator can unlock it. @@ -188,28 +210,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -226,7 +259,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting prevents users from starting Task Manager. +This policy setting prevents users from starting Task Manager. Task Manager (**taskmgr.exe**) lets users start and stop programs, monitor the performance of their computers, view and monitor all programs running on their computers, including system services, find the executable names of programs, and change the priority of the process in which programs run. @@ -259,28 +292,39 @@ ADMX Info: - - + + + - + + + - + + + - + + + - + + + - + + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -297,7 +341,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting disables or removes all menu items and buttons that log the user off the system. +This policy setting disables or removes all menu items and buttons that log the user off the system. If you enable this policy setting, users will not see the Log off menu item when they press Ctrl+Alt+Del. This will prevent them from logging off unless they restart or shutdown the computer, or clicking Log off from the Start menu. From 08ff00f279990b0e328c8c5f37f0d66af25734c5 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Tue, 31 Aug 2021 13:57:54 -0400 Subject: [PATCH 0140/1214] PM updates --- .../apps-in-windows-10.md | 34 +++++++++++-------- 1 file changed, 20 insertions(+), 14 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index 387c2a7325..e68f8d2258 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -44,18 +44,27 @@ There are different types of apps that can run on your Windows client devices. T - **Windows Presentation Foundation (WPF)**: Using .NET, you can create a WPF desktop app that runs on the device, or create a WPF web app. This app is commonly used by organizations that create line of business (LOB) desktop apps. For more information, see [WPF Application Development](/dotnet/desktop/wpf/app-development). - **Windows Forms (WinForm)**: Using .NET, you can create a Windows Forms desktop app that runs on the device, and doesn't require a web browser or internet access. Just like Win32 apps, WinForm apps can access the local hardware and file system of the computer where the app is running. For more information, see [Desktop Guide (Windows Forms .NET)](/dotnet/desktop/winforms/overview). -- **Windows apps**: These apps are included with the Windows OS, and can also be installed from the Microsoft Store. There are two categories: +- **Windows apps**: + + > [!TIP] + > Starting with Windows 10, you can use the **Windows UI Library (WinUI 3)** to create .NET, Win32 desktop, and UWP apps. This library includes native Windows UI controls and other user interface elements familiar to Windows users. For more information, see [Windows UI Library (WinUI)](/windows/apps/winui/). - **Apps**: All apps installed in `C:\Program Files\WindowsApps`. There are two classes of apps: - **Provisioned**: Installed in user account the first time you sign in with a new user account. For a list of some common provisioned apps, see [Provisioned apps installed with the Windows client OS](provisioned-apps-windows-client-os.md). - **Installed**: Installed as part of the OS. + - **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. Not all Windows apps are UWP apps. + + For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide). + + - **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. + + For more information, see [Get started developing apps for Windows desktop](/windows/apps/get-started) and [Make your apps great on Windows 11](/windows/apps/get-started/make-apps-great-for-windows). + - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. For a list of some common system apps, see [System apps installed with the Windows client OS](system-apps-windows-client-os.md). -- **Universal Windows Platform (UWP) apps**: These apps run and can be installed on many Windows platforms, including tablets, Microsoft HoloLens, Xbox, and more. All UWP apps are Windows apps. Not all Windows apps are UWP apps. - - For more information, see [What's a Universal Windows Platform (UWP) app?](/windows/uwp/get-started/universal-application-platform-guide). + ??These apps are included with the Windows OS, and can also be installed from the Microsoft Store. There are two categories: - **Web apps** and **Progressive web apps (PWA)**: These apps run on a server, and don't run on the end user device. To use these apps, users must use a web browser and have internet access. **Progressive web apps** are designed to work for all users, work with any browser, and work on any platform. @@ -63,13 +72,6 @@ There are different types of apps that can run on your Windows client devices. T Using an MDM provider, you can create shortcuts to your web apps and progressive web apps on devices. -- **Win32 apps**: These apps are traditional Windows apps that run on the device, and are often called desktop apps. They require direct access to Windows and the device hardware, and typically don't require a web browser. These apps run in 32-bit mode on 64-bit devices, and don't depend on a managed runtime environment, like .NET. - - For more information, see [Get started developing apps for Windows desktop](/windows/apps/get-started) and [Make your apps great on Windows 11](/windows/apps/get-started/make-apps-great-for-windows). - -> [!TIP] -> Starting with Windows 10, you can use the **Windows UI Library (WinUI 3)** to create .NET, Win32 desktop, and UWP apps. This library includes native Windows UI controls and other user interface elements familiar to Windows users. For more information, see [Windows UI Library (WinUI)](/windows/apps/winui/). - ## Add or deploy apps to devices When your apps are ready, you can add or deploy these apps to your Windows devices. This section lists some common options. @@ -131,7 +133,12 @@ When your apps are ready, you can add or deploy these apps to your Windows devic - [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) - [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal) -- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps. On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally. +- **Application Virtualization (App-V)**: App-V allows Win32 apps to be used as virtual apps. + + > [!NOTE] + > Application Virtualization will be [end of life in April 2026](/lifecycle/announcements/mdop-extended). We recommend looking at **Azure Virtual desktop with MSIX app attach**. For more information, see [What is Azure Virtual Desktop?](/azure/virtual-desktop/overview) and [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal). + + On an on-premises server, you install and configure the App-V server components, and then install your Win32 apps. On Windows Enterprise client devices, you use the App-V client components to run the virtualized apps. They allow users to open the virtual apps using the icons and file names they're familiar with. Users use the apps as if they're installed locally. The benefit is to deliver virtual apps in real time, and as-needed. For more information, see [Application Virtualization (App-V) for Windows overview](./app-v/appv-for-windows.md). @@ -140,5 +147,4 @@ When your apps are ready, you can add or deploy these apps to your Windows devic - On premises, you can use Administrative Templates in Group Policy to deploy App-V policies (`Computer Configuration\Administrative Templates\System\App-V`). - Using Microsoft Intune, you can use [Administrative Templates](/mem/intune/configuration/administrative-templates-windows) (opens another Microsoft web site) or the [Settings Catalog](/mem/intune/configuration/settings-catalog) (opens another Microsoft web site) to deploy App-V policies. - > [!TIP] - > If you want to decrease your on-premises footprint, then **Azure Virtual desktop with MSIX app attach** might be the better deployment for your organization. + From cd0d8758784e053021fe958487d99c239c261028 Mon Sep 17 00:00:00 2001 From: Mandi Ohlinger Date: Tue, 31 Aug 2021 15:03:09 -0400 Subject: [PATCH 0141/1214] Removed extra characters --- windows/application-management/apps-in-windows-10.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/windows/application-management/apps-in-windows-10.md b/windows/application-management/apps-in-windows-10.md index e68f8d2258..4fc3710369 100644 --- a/windows/application-management/apps-in-windows-10.md +++ b/windows/application-management/apps-in-windows-10.md @@ -64,8 +64,6 @@ There are different types of apps that can run on your Windows client devices. T - **System apps**: Apps installed in the `C:\Windows\` directory. These apps are part of the Windows OS. For a list of some common system apps, see [System apps installed with the Windows client OS](system-apps-windows-client-os.md). - ??These apps are included with the Windows OS, and can also be installed from the Microsoft Store. There are two categories: - - **Web apps** and **Progressive web apps (PWA)**: These apps run on a server, and don't run on the end user device. To use these apps, users must use a web browser and have internet access. **Progressive web apps** are designed to work for all users, work with any browser, and work on any platform. Web apps are typically created in Visual Studio, and can be created with different languages. For more information, see [Create a Web App](https://azure.microsoft.com/get-started/web-app/). When the app is created and ready to be used, you deploy the web app to a web server. Using Azure, you can host your web apps in the cloud, instead of on-premises. For more information, see [App Service overview](/azure/app-service/overview). From c42cfb833ad094ffe4d40ae1a4f7fa6caf3731ba Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 31 Aug 2021 15:06:03 -0700 Subject: [PATCH 0142/1214] Update secure-the-windows-10-boot-process.md --- .../secure-the-windows-10-boot-process.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/security/information-protection/secure-the-windows-10-boot-process.md b/windows/security/information-protection/secure-the-windows-10-boot-process.md index 45fc317aa9..9776d72d6f 100644 --- a/windows/security/information-protection/secure-the-windows-10-boot-process.md +++ b/windows/security/information-protection/secure-the-windows-10-boot-process.md @@ -20,9 +20,10 @@ ms.author: dansimp # Secure the Windows 10 boot process **Applies to:** +- Windows 11 - Windows 10 - Windows 8.1 -- Windows 11 + The Windows operating system has many features to help protect you from malware, and it does an amazingly good job. Except for apps that businesses develop and use internally, all Microsoft Store apps must meet a series of requirements to be certified and included in the Microsoft Store. This certification process examines several criteria, including security, and is an effective means of preventing malware from entering the Microsoft Store. Even if a malicious app does get through, the Windows 10 operating system includes a series of security features that can mitigate the impact. For instance, Microsoft Store apps are sandboxed and lack the privileges necessary to access user data or change system settings. @@ -130,4 +131,4 @@ Measured Boot uses the power of UEFI, TPM, and Windows to give you a way to conf Secure Boot, Trusted Boot, and Measured Boot create an architecture that is fundamentally resistant to bootkits and rootkits. In Windows, these features have the potential to eliminate kernel-level malware from your network. This is the most ground-breaking anti-malware solution that Windows has ever had; it’s leaps and bounds ahead of everything else. With Windows, you can truly trust the integrity of your operating system. ## Additional resources -- [Windows 10 Enterprise LTSC 2019 or v2004 Evaluation](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) \ No newline at end of file +- [Windows 10 Enterprise LTSC 2019 or v2004 Evaluation](https://www.microsoft.com/evalcenter/evaluate-windows-10-enterprise) From 8c57f6b91792d7d38089ef565aea349f0e252872 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 31 Aug 2021 15:33:01 -0700 Subject: [PATCH 0143/1214] Update windows-sandbox-overview.md --- .../windows-sandbox/windows-sandbox-overview.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md index 47287eeff3..0fec75ee34 100644 --- a/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md +++ b/windows/security/threat-protection/windows-sandbox/windows-sandbox-overview.md @@ -36,7 +36,7 @@ The following video provides an overview of Windows Sandbox. ## Prerequisites -- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Home SKUs*) +- Windows 10 Pro, Enterprise or Education build 18305 or Windows 11 (*Windows Sandbox is currently not supported on Windows Home edition*) - AMD64 architecture - Virtualization capabilities enabled in BIOS - At least 4 GB of RAM (8 GB recommended) From 2da0babe15561e5e00b754ec8ed8358b0fb67645 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Tue, 31 Aug 2021 15:38:30 -0700 Subject: [PATCH 0144/1214] Update LOB-win32-apps-on-s.md --- .../LOB-win32-apps-on-s.md | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md index 582297f71b..9c23deaecd 100644 --- a/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md +++ b/windows/security/threat-protection/windows-defender-application-control/LOB-win32-apps-on-s.md @@ -24,12 +24,11 @@ ms.technology: mde - Windows 10 - Windows 11 -- Windows Server 2016 and above >[!NOTE] >Some capabilities of Windows Defender Application Control are only available on specific Windows versions. Learn more about the [Defender App Guard feature availability](feature-availability.md). -Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications and Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows 10 in S mode devices. +Beginning with the Windows 10 November 2019 update (build 18363), Microsoft Intune enables customers to deploy and run business critical Win32 applications and Windows components that are normally blocked in S mode (ex. PowerShell.exe) on their Intune-managed Windows in S mode devices. With Intune, IT Pros can now configure their managed S mode devices using a Windows Defender Application Control (WDAC) supplemental policy that expands the S mode base policy to authorize the apps their business uses. This feature changes the S mode security posture from "every app is Microsoft-verified" to "every app is verified by Microsoft or your organization". @@ -243,4 +242,4 @@ IT Pros also have the choice of deleting a supplemental policy through Intune. ``` ## Errata -If an S-mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active. \ No newline at end of file +If an S-mode device with a policy authorization token and supplemental policy is rolled back from the 1909 update to the 1903 build, it will not revert to locked-down S mode until the next policy refresh. To achieve an immediate change to a locked-down S mode state, IT Pros should delete any tokens in %SystemRoot%\System32\CI\Tokens\Active. From 72e29533aae2534118ca7e717155cd7d82c0cb3d Mon Sep 17 00:00:00 2001 From: Mandi Ohlinger Date: Tue, 31 Aug 2021 19:53:09 -0400 Subject: [PATCH 0145/1214] ADO 5367658: PM updates --- .../sideload-apps-in-windows-10.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/application-management/sideload-apps-in-windows-10.md b/windows/application-management/sideload-apps-in-windows-10.md index 11defe4f8f..7edd100ef0 100644 --- a/windows/application-management/sideload-apps-in-windows-10.md +++ b/windows/application-management/sideload-apps-in-windows-10.md @@ -10,7 +10,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: mobile author: greg-lindsay -ms.date: 08/30/2021 +ms.date: 08/31/2021 ms.localizationpriority: medium --- @@ -21,7 +21,7 @@ ms.localizationpriority: medium > - Windows 10 > [!NOTE] -> As of Windows Insider Build 18956, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration. +> Starting with Windows 10 2004, sideloading is enabled by default. You can deploy a signed package onto a device without a special configuration. Sideloading apps is when you install apps that aren't from an official source, such as the Microsoft store. Your organization may create its own apps, including line-of-business (LOB) apps. Many organizations create their own apps to solve problems unique to their business. @@ -59,7 +59,7 @@ Unmanaged devices are devices that are not managed by your organization. These d > To install an app on Windows 10 and later, you can: > > - [Install Windows 10 apps from a web page](/windows/msix/app-installer/installing-windows10-apps-web). -> - Users can double-click any `.APPX` or `.MSIX` package. +> - Users can double-click any `.msix` or `.appx` package. ### User interface @@ -90,7 +90,7 @@ Using Microsoft Intune, you can also enable sideloading apps on managed devices. This step installs the app certificate to the local device. Installing the certificate creates the trust between the app and the device. -1. Open the security certificate for the `.appx` package, and select **Install Certificate**. +1. Open the security certificate for the `.msix` package, and select **Install Certificate**. 2. On the **Certificate Import Wizard**, select **Local Machine**. @@ -102,6 +102,6 @@ This step installs the app certificate to the local device. Installing the certi ## Step 3: Install the app -From the folder with the `.appx` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.appx` package. +From the folder with the `.msix` package, run the Windows PowerShell `Add-AppxPackage` command to install the `.msix` package. For more information on this command, see [Add-AppxPackage](/powershell/module/appx/add-appxpackage). From db7c9b4dd07a620ba8c16d24fde62fdb1d6a34f6 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Wed, 1 Sep 2021 13:48:11 +0530 Subject: [PATCH 0146/1214] Resolving suggestion Suggestion: Title more than 100 characters : Resolved it! --- windows/configuration/cortana-at-work/cortana-at-work-crm.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/configuration/cortana-at-work/cortana-at-work-crm.md b/windows/configuration/cortana-at-work/cortana-at-work-crm.md index 7a9063b41e..983c40f7d0 100644 --- a/windows/configuration/cortana-at-work/cortana-at-work-crm.md +++ b/windows/configuration/cortana-at-work/cortana-at-work-crm.md @@ -1,5 +1,5 @@ --- -title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in your organization (Windows) +title: Set up and test Cortana with Microsoft Dynamics CRM (Preview feature) in Windows description: How to set up Cortana to give salespeople insights on important CRM activities, including sales leads, accounts, and opportunities. ms.prod: w10 ms.mktglfcycl: manage From 771e35488aa56bd2e1da4e6503d0e0c16e62edf0 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 1 Sep 2021 13:30:10 -0700 Subject: [PATCH 0147/1214] win11 topics added --- windows/deployment/deploy-windows-mdt/TOC.yml | 16 + ...uted-environment-for-windows-deployment.md | 270 ++++++ .../create-a-windows-11-reference-image.md | 682 ++++++++++++++ .../deploy-a-windows-11-image-using-mdt.md | 845 ++++++++++++++++++ ...d-with-the-microsoft-deployment-toolkit.md | 1 + .../prepare-for-windows-deployment-mdt.md | 262 ++++++ ...h-a-windows-10-computer-with-windows-11.md | 120 +++ ...-10-computer-with-a-windows-11-computer.md | 165 ++++ ...1-with-the-microsoft-deployment-toolkit.md | 114 +++ 9 files changed, 2475 insertions(+) create mode 100644 windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md create mode 100644 windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md create mode 100644 windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md create mode 100644 windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-mdt.md create mode 100644 windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md create mode 100644 windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md create mode 100644 windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md diff --git a/windows/deployment/deploy-windows-mdt/TOC.yml b/windows/deployment/deploy-windows-mdt/TOC.yml index 51493a1083..0348c31ff7 100644 --- a/windows/deployment/deploy-windows-mdt/TOC.yml +++ b/windows/deployment/deploy-windows-mdt/TOC.yml @@ -18,6 +18,22 @@ href: replace-a-windows-7-computer-with-a-windows-10-computer.md - name: Perform an in-place upgrade to Windows 10 with MDT href: upgrade-to-windows-10-with-the-microsoft-deployment-toolkit.md + - name: Deploy Windows 11 with MDT + items: + - name: Prepare for deployment with MDT + href: prepare-for-windows-deployment-with-mdt.md + - name: Create a Windows 11 reference image + href: create-a-windows-11-reference-image.md + - name: Deploy a Windows 11 image using MDT + href: deploy-a-windows-11-image-using-mdt.md + - name: Build a distributed environment for Windows 10 deployment + href: build-a-distributed-environment-for-windows-10-deployment.md + - name: Refresh a Windows 10 computer with Windows 11 + href: refresh-a-windows-10-computer-with-windows-11.md + - name: Replace a Windows 10 computer with a Windows 11 computer + href: replace-a-windows-10-computer-with-a-windows-11-computer.md + - name: Perform an in-place upgrade to Windows 11 with MDT + href: upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md - name: Customize MDT items: - name: Configure MDT settings diff --git a/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md new file mode 100644 index 0000000000..06399d410a --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/build-a-distributed-environment-for-windows-deployment.md @@ -0,0 +1,270 @@ +--- +title: Build a distributed environment for Windows 10 deployment (Windows 10) +description: In this topic, you will learn how to replicate your Windows 10 deployment shares to facilitate the deployment of Windows 10 in remote or branch locations. +ms.assetid: a6cd5657-6a16-4fff-bfb4-44760902d00c +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: replication, replicate, deploy, configure, remote +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Build a distributed environment for Windows 10 deployment + +**Applies to** +- Windows 10 + +Perform the steps in this article to build a distributed environment for Windows 10 deployment. A distributed environment for deployment is useful when you have a segmented network, for example one that is segmented geographically into two branch locations. If you work in a distributed environment, replicating the deployment shares is an important part of a deployment solution because images of 5 GB or more in size can present bandwidth issues when deployed over the wire. Replicating this content enables clients to do local deployments. + +Four computers are used in this topic: DC01, MDT01, MDT02, and PC0006. DC01 is a domain controller, MDT01 and MDT02 are domain member computers running Windows Server 2019, and PC0006 is a blank device where we will deploy Windows 10. The second deployment server (MDT02) will be configured for a remote site (Stockholm) by replicating the deployment share on MDT01 at the original site (New York). All devices are members of the domain contoso.com for the fictitious Contoso Corporation. + +For the purposes of this article, we assume that MDT02 is prepared with the same network and storage capabilities that were specified for MDT01, except that MDT02 is located on a different subnet than MDT01. For more details on the infrastructure setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +![figure 1.](../images/mdt-10-fig01.png) + +Computers used in this topic. + +>HV01 is also used in this topic to host the PC0006 virtual machine. + +## Replicate deployment shares + +Replicating the content between MDT01 (New York) and MDT02 (Stockholm) can be done in a number of different ways. The most common content replication solutions with Microsoft Deployment Toolkit (MDT) use either the Linked Deployment Shares (LDS) feature or Distributed File System Replication (DFS-R). Some organizations have used a simple robocopy script for replication of the content. + +> [!NOTE] +> Robocopy has options that allow for synchronization between folders. It has a simple reporting function; it supports transmission retry; and, by default, it will only copy/remove files from the source that are newer than files on the target. + +### Linked deployment shares in MDT + +LDS is a built-in feature in MDT for replicating content. However, LDS works best with strong connections such as LAN connections with low latency. For most WAN links, DFS-R is the better option. + +### Why DFS-R is a better option + +DFS-R is not only very fast and reliable, but it also offers central monitoring, bandwidth control, and a great delta replication engine. DFS-R will work equally well whether you have 2 sites or 90. When using DFS-R for MDT, we recommend running your deployment servers on Windows Server 2008 R2 or higher. From that version on, you can configure the replication targets as read-only, which is exactly what you want for MDT. This way, you can have your master deployment share centralized and replicate out changes as they happen. DFS-R will quickly pick up changes at the central deployment share in MDT01 and replicate the delta changes to MDT02. + +## Set up Distributed File System Replication (DFS-R) for replication + +Setting up DFS-R for replication is a quick and straightforward process: Prepare the deployment servers, create a replication group, then configure some replication settings. + +### Prepare MDT01 for replication + +On **MDT01**: + +1. Install the DFS Replication role on MDT01 by entering the following at an elevated Windows PowerShell prompt: + +```powershell +Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools +``` + +2. Wait for installation to comlete, and then verify that the installation was successful. See the following output: + +```output +PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools + +Success Restart Needed Exit Code Feature Result +------- -------------- --------- -------------- +True No Success {DFS Replication, DFS Management Tools, Fi... +``` + +### Prepare MDT02 for replication + +On **MDT02**: + +1. Perform the same procedure on MDT02 by entering the following at an elevated Windows PowerShell prompt: + +```powershell +Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools +``` + +2. Wait for installation to comlete, and then verify that the installation was successful. See the following output: + +```output +PS C:\> Install-WindowsFeature -Name FS-DFS-Replication -IncludeManagementTools + +Success Restart Needed Exit Code Feature Result +------- -------------- --------- -------------- +True No Success {DFS Replication, DFS Management Tools, Fi... +``` + +### Create the MDTProduction folder on MDT02 + +On **MDT02**: + +1. Create and share the **D:\\MDTProduction** folder using default permissions by entering the following at an elevated command prompt: + + ```powershell + mkdir d:\MDTProduction + New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction" + ``` + +2. You should see the following output: + + ```output + C:\> New-SmbShare -Name "MDTProduction$" -Path "D:\MDTProduction" + + Name ScopeName Path Description + ---- --------- ---- ----------- + MDTProduction$ * D:\MDTProduction + ``` + +### Configure the deployment share + +When you have multiple deployment servers sharing the same content, you need to configure the Bootstrap.ini file with information about which server to connect to based on where the client is located. In MDT, that can be done by using the DefaultGateway property. + +On **MDT01**: + +1. Using Notepad, navigate to the **D:\\MDTProduction\\Control** folder and modify the Boostrap.ini file as follows. Under [DefaultGateway] enter the IP addresses for the client's default gateway in New York and Stockholm, respectively (replace 10.10.10.1 and 10.10.20.1 with your default gateways). The default gateway setting is what tells the client which deployment share (i.e. server) to use. + + ```ini + [Settings] + Priority=DefaultGateway, Default + + [DefaultGateway] + 10.10.10.1=NewYork + 10.10.20.1=Stockholm + + [NewYork] + DeployRoot=\\MDT01\MDTProduction$ + + [Stockholm] + DeployRoot=\\MDT02\MDTProduction$ + + [Default] + UserDomain=CONTOSO + UserID=MDT_BA + UserPassword=pass@word1 + SkipBDDWelcome=YES + ``` + >[!NOTE] + >The DeployRoot value needs to go into the Bootstrap.ini file, but you can use the same logic in the CustomSettings.ini file. For example, you can redirect the logs to the local deployment server (SLSHARE), or have the User State Migration Tool (USMT) migration store (UDDIR) local. To learn more about USMT, see [Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md) and [Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md). + +2. Save the Bootstrap.ini file. +3. Using the Deployment Workbench, right-click the **MDT Production** deployment share and select **Update Deployment Share**. Use the default settings for the Update Deployment Share Wizard. This process will take a few minutes. +4. After the update is complete, use the Windows Deployment Services console on MDT01. In the **Boot Images** node, right-click the **MDT Production x64** boot image and select **Replace Image**. +5. Browse and select the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** boot image, and then complete Replace Boot Image Wizard using the default settings. + + ![figure 5.](../images/mdt-10-fig05.png) + + Replacing the updated boot image in WDS. + + >[!TIP] + >If you modify bootstrap.ini again later, be sure to repeat the process of updating the deployment share in the Deployment Workbench and replacing the boot image in the WDS console. + + ## Replicate the content + + Once the MDT01 and MDT02 servers are prepared, you are ready to configure the actual replication. + + ### Create the replication group + +6. On MDT01, using DFS Management (dfsmgmt.msc), right-click **Replication**, and click **New Replication Group**. +7. On the **Replication Group Type** page, select **Multipurpose replication group**, and click **Next**. +8. On the **Name and Domain** page, assign the **MDTProduction** name, and click **Next**. +9. On the **Replication Group Members** page, click **Add**, add **MDT01** and **MDT02**, and then click **Next**. + + ![figure 6.](../images/mdt-10-fig06.png) + + Adding the Replication Group Members. + +10. On the **Topology Selection** page, select the **Full mesh** option and click **Next**. +11. On the **Replication Group Schedule and Bandwidth** page, accept the default settings and click **Next**. +12. On the **Primary Member** page, select **MDT01** and click **Next**. +13. On the **Folders to Replicate** page, click **Add**, enter **D:\\MDTProduction** as the folder to replicate, click **OK**, and then click **Next**. +14. On the **Local Path of MDTProduction** on the **Other Members** page, select **MDT02**, and click **Edit**. +15. On the **Edit** page, select the **Enabled** option, type in **D:\\MDTProduction** as the local path of folder, select the **Make the selected replicated folder on this member read-only** check box, click **OK**, and then click **Next**. +16. On the **Review Settings and Create Replication Group** page, click **Create**. +17. On the **Confirmation** page, click **Close**. + + ### Configure replicated folders + +18. On **MDT01**, using DFS Management, expand **Replication** and then select **MDTProduction**. +19. In the middle pane, right-click the **MDT01** member and click **Properties**. +20. On the **MDT01 (MDTProduction) Properties** page, configure the following and then click **OK**: + 1. In the **Staging** tab, set the quota to **20480 MB**. + 2. In the **Advanced** tab, set the quota to **8192 MB**. + In this scenario the size of the deployment share is known, but you might need to change the values for your environment. A good rule of thumb is to get the size of the 16 largest files and make sure they fit in the staging area. Below is a Windows PowerShell example that calculates the size of the 16 largest files in the D:\\MDTProduction deployment share: + + ``` powershell + (Get-ChildItem D:\MDTProduction -Recurse | Sort-Object Length -Descending | Select-Object -First 16 | Measure-Object -Property Length -Sum).Sum /1GB + ``` + +21. In the middle pane, right-click the **MDT02** member and select **Properties**. +22. On the **MDT02 (MDTProduction) Properties** page, configure the following and then click **OK**: + 1. In the **Staging** tab, set the quota to **20480 MB**. + 2. In the **Advanced** tab, set the quota to **8192 MB**. + + > [!NOTE] + > It will take some time for the replication configuration to be picked up by the replication members (MDT01 and MDT02). The time for the initial sync will depend on the WAN link speed between the sites. After that, delta changes are replicated quickly. + +23. Verify that MDT01 and MDT02 are members of the MDTProduction replication group, with MDT01 being primary as follows using an elevated command prompt: + +```cmd +C:\> dfsradmin membership list /rgname:MDTProduction /attr:MemName,IsPrimary +MemName IsPrimary +MDT01 Yes +MDT02 No +``` + +### Verify replication + +On **MDT02**: + +1. Wait until you start to see content appear in the **D:\\MDTProduction** folder. +2. Using DFS Management, expand **Replication**, right-click **MDTProduction**, and select **Create Diagnostics Report**. +3. In the Diagnostics Report Wizard, on the **Type of Diagnostics Report or Test** page, choose **Health report** and click **Next**. +4. On the **Path and Name** page, accept the default settings and click **Next**. +5. On the **Members to Include** page, accept the default settings and click **Next**. +6. On the **Options** page, accept the default settings and click **Next**. +7. On the **Review Settings and Create Report** page, click **Create**. +8. Open the report in Internet Explorer, and if necessary, select the **Allow blocked content** option. + +![figure 9.](../images/mdt-10-fig09.png) + +The DFS Replication Health Report. + +>If there are replication errors you can review the DFS event log in Event Viewer under **Applications and Services Logs**. + +## Configure Windows Deployment Services (WDS) in a remote site + +Like you did in the previous topic for MDT01, you need to add the MDT Production Lite Touch x64 Boot image to Windows Deployment Services on MDT02. For the following steps, we assume that WDS has already been installed on MDT02. +1. On MDT02, using the WDS console, right-click **Boot Images** and select **Add Boot Image**. +2. Browse to the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** file and add the image with the default settings. + +## Deploy a Windows 10 client to the remote site + +Now you should have a solution ready for deploying the Windows 10 client to the remote site: Stockholm, using the MDTProduction deployment share replica on MDT02. You can test this deployment with the following optional procedure. + +>For demonstration purposes, the following procedure uses a virtual machine (PC0006) hosted by the Hyper-V server HV01. To use the remote site server (MDT02) the VM must be assigned a default gateway that matches the one you entered in the Boostrap.ini file. + +1. Create a virtual machine with the following settings: + 1. Name: PC0006 + 2. Location: C:\\VMs + 3. Generation: 2 + 4. Memory: 2048 MB + 5. Hard disk: 60 GB (dynamic disk) + 6. Install an operating system from a network-based installation server +2. Start the PC0006 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from the WDS server. +3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + 2. Computer Name: PC0006 + 3. Applications: Select the Install - Adobe Reader +4. Setup will now start and perform the following: + 1. Install the Windows 10 Enterprise operating system. + 2. Install applications. + 3. Update the operating system using your local Windows Server Update Services (WSUS) server. + +![pc0001.](../images/pc0006.png) + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    +[Configure MDT settings](configure-mdt-settings.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md b/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md new file mode 100644 index 0000000000..33d92b8cc9 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/create-a-windows-11-reference-image.md @@ -0,0 +1,682 @@ +--- +title: Create a Windows 10 reference image (Windows 10) +description: Creating a reference image is important because that image serves as the foundation for the devices in your organization. +ms.assetid: 9da2fb57-f2ff-4fce-a858-4ae4c237b5aa +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, deployment, configure, customize, install, installation +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Create a Windows 10 reference image + +**Applies to** +- Windows 10 + +Creating a reference image is important because that image serves as the foundation for the devices in your organization. In this topic, you will learn how to create a Windows 10 reference image using the Microsoft Deployment Toolkit (MDT). You will create a deployment share, configure rules and settings, and import all the applications and operating system files required to build a Windows 10 reference image. After completing the steps outlined in this topic, you will have a Windows 10 reference image that can be used in your deployment solution. + +>[!NOTE] +>See [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) for more information about the server, client, and network infrastructure used in this guide. + +For the purposes of this topic, we will use three computers: DC01, MDT01, and HV01. + - DC01 is a domain controller for the contoso.com domain. + - MDT01 is a contoso.com domain member server. + - HV01 is a Hyper-V server that will be used to build the reference image. + + ![devices.](../images/mdt-08-fig01.png) + + Computers used in this topic. + +## The reference image + +The reference image described in this guide is designed primarily for deployment to physical devices. However, the reference image is typically created on a virtual platform, before being automatically run through the System Preparation (Sysprep) tool process and captured to a Windows Imaging (WIM) file. The reasons for creating the reference image on a virtual platform are the following: +- To reduce development time and can use snapshots to test different configurations quickly. +- To rule out hardware issues. You simply get the best possible image, and if you have a problem, it's not likely to be hardware related. +- To ensures that you won't have unwanted applications that could be installed as part of a driver install but not removed by the Sysprep process. +- The image is easy to move between lab, test, and production. + +## Set up the MDT build lab deployment share + +With Windows 10, there is no hard requirement to create reference images. However, to reduce the time needed for deployment, you might want to create a reference image that contains a few base applications as well as all of the latest updates. This section will show you how to create and configure the MDT Build Lab deployment share to create a Windows 10 reference image. Because reference images will be deployed only to virtual machines during the creation process and have specific settings (rules), you should always create a separate deployment share specifically for this process. + +### Create the MDT build lab deployment share + +On **MDT01**: + +- Sign in as contoso\\administrator using a password of pass@word1 (credentials from the [prepare for deployment](prepare-for-windows-deployment-with-mdt.md) topic). +- Start the MDT deployment workbench, and pin this to the taskbar for easy access. +- Using the Deployment Workbench, right-click **Deployment Shares** and select **New Deployment Share**. +- Use the following settings for the New Deployment Share Wizard: + - Deployment share path: **D:\\MDTBuildLab** + - Share name: **MDTBuildLab$** + - Deployment share description: **MDT Build Lab** +- Accept the default selections on the Options page and click **Next**. +- Review the Summary page, click **Next**, wait for the deployment share to be created, then click **Finish**. +- Verify that you can access the \\\\MDT01\\MDTBuildLab$ share. + + ![figure 2.](../images/mdt-08-fig02.png) + + The Deployment Workbench with the MDT Build Lab deployment share. + +### Enable monitoring + +To monitor the task sequence as it happens, right-click the **MDT Build Lab** deployment share, click **Properties**, click the **Monitoring** tab, and select **Enable monitoring for this deployment share**. This step is optional. + +### Configure permissions for the deployment share + +In order to read files in the deployment share and write the reference image back to it, you need to assign NTFS and SMB permissions to the MDT Build Account (MDT\_BA) for the **D:\\MDTBuildLab** folder + +On **MDT01**: + +1. Ensure you are signed in as **contoso\\administrator**. +2. Modify the NTFS permissions for the **D:\\MDTBuildLab** folder by running the following command in an elevated Windows PowerShell prompt: + + ``` powershell + icacls "D:\MDTBuildLab" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' + grant-smbshareaccess -Name MDTBuildLab$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force + ``` + +## Add setup files + +This section will show you how to populate the MDT deployment share with the Windows 10 operating system source files, commonly referred to as setup files, which will be used to create a reference image. Setup files are used during the reference image creation process and are the foundation for the reference image. + +### Add the Windows 10 installation files + +MDT supports adding both full source Windows 10 DVDs (ISOs) and custom images that you have created. In this case, you create a reference image, so you add the full source setup files from Microsoft. + +>[!NOTE] +>Due to the Windows limits on path length, we are purposely keeping the operating system destination directory short, using the folder name W10EX64RTM rather than a more descriptive name like Windows 10 Enterprise x64 RTM. + +### Add Windows 10 Enterprise x64 (full source) + +On **MDT01**: + +1. Sign in as **contoso\\administrator** and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. The following example shows the files copied to the D:\\Downloads folder, but you can also choose to import the OS directly from an ISO or DVD. + + ![ISO.](../images/iso-data.png) + +2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Build Lab**. +3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files + - Source directory: (location of your source files) + - Destination directory name: W10EX64RTM +5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. See the following example. + + ![Default image.](../images/deployment-workbench01.png) + +>Depending on the DVD you used, there might be multiple editions available. For the purposes of this guide, we are using the Windows 10 Enterprise image, but other images will also work. + +## Add applications + +Before you create an MDT task sequence, you need to add any applications and scripts you wish to install to the MDT Build Lab share. + +On **MDT01**: + +First, create an MDT folder to store the Microsoft applications that will be installed: + +1. In the MDT Deployment Workbench, expand **Deployment Shares \\ MDT Build Lab \\ Applications** +2. Right-click **Applications** and then click **New Folder**. +3. Under **Folder name**, type **Microsoft**. +4. Click **Next** twice, and then click **Finish**. + +The steps in this section use a strict naming standard for your MDT applications. +- Use the "Install - " prefix for typical application installations that run a setup installer of some kind, +- Use the "Configure - " prefix when an application configures a setting in the operating system. +- You also add an " - x86", " - x64", or "- x86-x64" suffix to indicate the application's architecture (some applications have installers for both architectures). + +Using a script naming standard is always recommended when using MDT as it helps maintain order and consistency. + +By storing configuration items as MDT applications, it is easy to move these objects between various solutions, or between test and production environments. + +In example sections, you will add the following applications: + +- Install - Microsoft Office 365 Pro Plus - x64 +- Install - Microsoft Visual C++ Redistributable 2019 - x86 +- Install - Microsoft Visual C++ Redistributable 2019 - x64 + +>The 64-bit version of Microsoft Office 365 Pro Plus is recommended unless you need legacy app support. For more information, see [Choose between the 64-bit or 32-bit version of Office](https://support.office.com/article/choose-between-the-64-bit-or-32-bit-version-of-office-2dee7807-8f95-4d0c-b5fe-6c6f49b8d261) + +Download links: +- [Office Deployment Tool](https://www.microsoft.com/download/details.aspx?id=49117) +- [Microsoft Visual C++ Redistributable 2019 - x86](https://aka.ms/vs/16/release/VC_redist.x86.exe) +- [Microsoft Visual C++ Redistributable 2019 - x64](https://aka.ms/vs/16/release/VC_redist.x64.exe) + +Download all three items in this list to the D:\\Downloads folder on MDT01. + +**Note**: For the purposes of this lab, we will leave the MSVC files in the D:\\Downloads folder and the Office365 files will be extracted to a child folder. If you prefer, you can place each application in its own separate child folder and then modify the $ApplicationSourcePath below as needed (instead of just D:\\Downloads). + +>[!NOTE] +>All the Microsoft Visual C++ downloads can be found on [The latest supported Visual C++ downloads](https://go.microsoft.com/fwlink/p/?LinkId=619523). Visual C++ 2015, 2017 and 2019 all share the same redistributable files. + +### Create configuration file: Microsoft Office 365 Professional Plus x64 + +1. After downloading the most current version of the Office Deployment tool from the Microsoft Download Center using the link provided above, run the self-extracting executable file and extract the files to **D:\\Downloads\\Office365**. The Office Deployment Tool (setup.exe) and several sample configuration.xml files will be extracted. +2. Using a text editor (such as Notepad), create an XML file in the D:\\Downloads\\Office365 directory with the installation settings for Microsoft 365 Apps for enterprise that are appropriate for your organization. The file uses an XML format, so the file you create must have an extension of .xml but the file can have any filename. + + For example, you can use the following configuration.xml file, which provides these configuration settings: + - Install the 64-bit version of Microsoft 365 Apps for enterprise in English directly from the Office Content Delivery Network (CDN) on the internet. Note: 64-bit is now the default and recommended edition. + - Use the Semi-Annual Channel and get updates directly from the Office CDN on the internet. + - Perform a silent installation. You won’t see anything that shows the progress of the installation and you won’t see any error messages. + + ```xml + + + + + + + + + + ``` + + By using these settings, any time you build the reference image you’ll be installing the most up-to-date Semi-Annual Channel version of Microsoft 365 Apps for enterprise. + + >[!TIP] + >You can also use the web-based interface of the [Office Customization Tool](https://config.office.com/) to help you create your configuration.xml file. + + Also see [Configuration options for the Office Deployment Tool](/deployoffice/configuration-options-for-the-office-2016-deployment-tool) and [Overview of the Office Deployment Tool](/DeployOffice/overview-of-the-office-2016-deployment-tool) for more information. + +3. Ensure the configuration.xml file is in the D:\\Downloads\\Office365 folder. See the following example of the extracted files plus the configuration.xml file in the Downloads\\Office365 folder: + + ![folder.](../images/office-folder.png) + + Assuming you have named the file "configuration.xml" as shown above, we will use the command "**setup.exe /configure configuration.xml**" when we create the application in MDT. This will perform the installation of Microsoft 365 Apps for enterprise using the configuration settings in the configuration.xml file. Do not perform this step yet. + + >[!IMPORTANT] + >After Microsoft 365 Apps for enterprise is installed on the reference image, do NOT open any Office programs. if you open an Office program, you are prompted to sign-in, which activates the installation of Microsoft 365 Apps for enterprise. Even if you don't sign in and you close the Sign in to set up Office dialog box, a temporary product key is installed. You don't want any kind of product key for Microsoft 365 Apps for enterprise installed as part of your reference image. + +Additional information +- Microsoft 365 Apps for enterprise is usually updated on a monthly basis with security updates and other quality updates (bug fixes), and possibly new features (depending on which update channel you’re using). That means that once you’ve deployed your reference image, Microsoft 365 Apps for enterprise will most likely need to download and install the latest updates that have been released since you created your reference image. + +- **Note**: By using installing Office Deployment Tool as part of the reference image, Microsoft 365 Apps for enterprise is installed immediately after the reference image is deployed to the user’s device, rather than including Office apps part of the reference image. This way the user will have the most up-to-date version of Microsoft 365 Apps for enterprise right away and won’t have to download any new updates (which is most likely what would happen if Microsoft 365 Apps for enterprise was installed as part of the reference image.) + - When you are creating your reference image, instead of installing Microsoft 365 Apps for enterprise directly from the Office CDN on the internet, you can install Microsoft 365 Apps for enterprise from a location on your local network, such as a file share. To do that, you would use the Office Deployment Tool in /download mode to download the installation files to that file share. Then you could use the Office Deployment Tool in /configure mode to install Microsoft 365 Apps for enterprise from that location on to your reference image. As part of that, you’ll need to point to that location in your configuration.xml file so that the Office Deployment Tool knows where to get the Microsoft 365 Apps for enterprise files. If you decide to do this, the next time you create a new reference image, you’ll want to be sure to use the Office Deployment Tool to download the most up-to-date installation files for Microsoft 365 Apps for enterprise to that location on your internal network. That way your new reference image will have a more up-to-date installation of Microsoft 365 Apps for enterprise. + +### Connect to the deployment share using Windows PowerShell + +If you need to add many applications, you can take advantage of the PowerShell support that MDT has. To start using PowerShell against the deployment share, you must first load the MDT PowerShell snap-in and then make the deployment share a PowerShell drive (PSDrive). + +On **MDT01**: + +1. Ensure you are signed in as **contoso\\Administrator**. +2. Import the snap-in and create the PSDrive by running the following commands in an elevated PowerShell prompt: + + ``` powershell + Import-Module "C:\Program Files\Microsoft Deployment Toolkit\bin\MicrosoftDeploymentToolkit.psd1" + New-PSDrive -Name "DS001" -PSProvider MDTProvider -Root "D:\MDTBuildLab" + ``` +>[!TIP] +>Use "Get-Command -module MicrosoftDeploymentToolkit" to see a list of available cmdlets + +### Create the install: Microsoft Office 365 Pro Plus - x64 + +In these steps we assume that you have downloaded the Office Deployment Tool. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads\\Office365. + +On **MDT01**: + +1. Ensure you are signed on as **contoso\\Administrator**. +2. Create the application by running the following commands in an elevated PowerShell prompt: + + ``` powershell + $ApplicationName = "Install - Office365 ProPlus - x64" + $CommandLine = "setup.exe /configure configuration.xml" + $ApplicationSourcePath = "D:\Downloads\Office365" + Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose + ``` + + Upon successful installation the following text is displayed: + ``` + VERBOSE: Performing the operation "import" on target "Application". + VERBOSE: Beginning application import + VERBOSE: Copying application source files from D:\Downloads\Office365 to D:\MDTBuildLab\Applications\Install - + Office365 ProPlus - x64 + VERBOSE: Creating new item named Install - Office365 ProPlus - x64 at DS001:\Applications\Microsoft. + + Name + ---- + Install - Office365 ProPlus - x64 + VERBOSE: Import processing finished. + ``` + +### Create the install: Microsoft Visual C++ Redistributable 2019 - x86 + +>[!NOTE] +>We have abbreviated "Microsoft Visual C++ Redistributable" in the $ApplicationName below as "MSVC" to avoid the path name exceeding the maxiumum allowed length of 248 characters. + +In these steps we assume that you have downloaded Microsoft Visual C++ Redistributable 2019 - x86. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads. + +On **MDT01**: + +1. Ensure you are signed on as **contoso\\Administrator**. +2. Create the application by running the following commands in an elevated PowerShell prompt: + + ``` powershell + $ApplicationName = "Install - MSVC 2019 - x86" + $CommandLine = "vc_redist.x86.exe /Q" + $ApplicationSourcePath = "D:\Downloads" + Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose + ``` + + Upon successful installation the following text is displayed: + ``` + VERBOSE: Performing the operation "import" on target "Application". + VERBOSE: Beginning application import + VERBOSE: Copying application source files from D:\Downloads to D:\MDTBuildLab\Applications\Install - MSVC 2019 - x86 + VERBOSE: Creating new item named Install - MSVC 2019 - x86 at DS001:\Applications\Microsoft. + + Name + ---- + Install - MSVC 2019 - x86 + VERBOSE: Import processing finished. + ``` + +### Create the install: Microsoft Visual C++ Redistributable 2019 - x64 + +In these steps we assume that you have downloaded Microsoft Visual C++ Redistributable 2019 - x64. You might need to modify the path to the source folder to reflect your current environment. In this example, the source path is set to D:\\Downloads. + +On **MDT01**: + +1. Ensure you are signed on as **contoso\\Administrator**. +2. Create the application by running the following commands in an elevated PowerShell prompt: + + ``` powershell + $ApplicationName = "Install - MSVC 2019 - x64" + $CommandLine = "vc_redist.x64.exe /Q" + $ApplicationSourcePath = "D:\Downloads" + Import-MDTApplication -Path "DS001:\Applications\Microsoft" -Enable "True" -Name $ApplicationName -ShortName $ApplicationName -CommandLine $CommandLine -WorkingDirectory ".\Applications\$ApplicationName" -ApplicationSourcePath $ApplicationSourcePath -DestinationFolder $ApplicationName -Verbose + ``` + +## Create the reference image task sequence + +In order to build and capture your Windows 10 reference image for deployment using MDT, you will create a task sequence. The task sequence will reference the operating system and applications that you previously imported into the MDT Build Lab deployment share to build a Windows 10 reference image. +After creating the task sequence, you configure it to enable patching against the Windows Server Update Services (WSUS) server. The Task Sequence Windows Update action supports getting updates directly from Microsoft Update, but you get more stable patching if you use a local WSUS server. WSUS also allows for an easy process of approving the patches that you are deploying. + +### Drivers and the reference image + +Because we use modern virtual platforms for creating our reference images, we don’t need to worry about drivers when creating reference images for Windows 10. We use Hyper-V in our environment, and Windows Preinstallation Environment (Windows PE) already has all the needed drivers built-in for Hyper-V. + +### Create a task sequence for Windows 10 Enterprise + +To create a Windows 10 reference image task sequence, the process is as follows: + +On **MDT01**: + +1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab** right-click **Task Sequences**, and create a **New Folder** named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + 1. Task sequence ID: REFW10X64-001 + 2. Task sequence name: Windows 10 Enterprise x64 RTM Default Image + 3. Task sequence comments: Reference Build + 4. Template: Standard Client Task Sequence + 5. Select OS: Windows 10 Enterprise x64 RTM Default Image + 6. Specify Product Key: Do not specify a product key at this time + 7. Full Name: Contoso + 8. Organization: Contoso + 9. Internet Explorer home page: http://www.contoso.com + 10. Admin Password: Do not specify an Administrator Password at this time + +### Edit the Windows 10 task sequence + +The steps below walk you through the process of editing the Windows 10 reference image task sequence to include the actions required to update the reference image with the latest updates from WSUS, install roles and features, and utilities, and install Microsoft Office365 ProPlus x64. + +On **MDT01**: + +1. In the **Task Sequences / Windows 10** folder, right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence, and select **Properties**. +2. On the **Task Sequence** tab, configure the Windows 10 Enterprise x64 RTM Default Image task sequence with the following settings: + 1. **State Restore > Windows Update (Pre-Application Installation)** action: Enable this action by clicking the **Options** tab and clearing the **Disable this step** check box. + + 2. **State Restore > Windows Update (Post-Application Installation)** action: Also enable this action. + 3. **State Restore**: After the **Tattoo** action, add a new **Group** action (click **Add** then click **New Group**) with the following setting: + - Name: **Custom Tasks (Pre-Windows Update)** + 4. **State Restore**: After **Windows Update (Post-Application Installation)** action, rename **Custom Tasks** to **Custom Tasks (Post-Windows Update)**. + - **Note**: The reason for adding the applications after the Tattoo action but before running Windows Update is simply to save time during the deployment. This way we can add all applications that will upgrade some of the built-in components and avoid unnecessary updating. + 5. **State Restore > Custom Tasks (Pre-Windows Update)**: Add a new **Install Roles and Features** action with the following settings: + 1. Name: Install - Microsoft NET Framework 3.5.1 + 2. Select the operating system for which roles are to be installed: Windows 10 + 3. Select the roles and features that should be installed: .NET Framework 3.5 (includes .NET 2.0 and 3.0) + + >[!IMPORTANT] + >This is probably the most important step when creating a reference image. Many applications need the .NET Framework, and we strongly recommend having it available in the image. The one thing that makes this different from other components is that .NET Framework 3.5.1 is not included in the WIM file. It is installed from the **Sources\\SxS** folder on the media, and that makes it more difficult to add after the image has been deployed. + + ![task sequence.](../images/fig8-cust-tasks.png) + + The task sequence after creating the Custom Tasks (Pre-Windows Update) group and adding the Install - Microsoft NET Framework 3.5.1 action. + + 6. **State Restore > Custom Tasks (Pre-Windows Update)**: After the **Install - Microsoft NET Framework 3.5.1** action, add a new **Install Application** action (selected from the **General** group) with the following settings: + 1. Name: Microsoft Visual C++ Redistributable 2019 - x86 + 2. Install a Single Application: browse to **Install - MSVC 2019 - x86** + 7. Repeat these steps (add a new **Install Application**) to add Microsoft Visual C++ Redistributable 2019 - x64 and Microsoft 365 Apps for enterprise as well. +3. Click **OK**. + + ![apps.](../images/mdt-apps.png) + + +### Optional configuration: Add a suspend action + +The goal when creating a reference image is of course to automate everything. But sometimes you have a special configuration or application setup that is too time-consuming to automate. If you need to do some manual configuration, you can add a little-known feature called Lite Touch Installation (LTI) Suspend. If you add the LTISuspend.wsf script as a custom action in the task sequence, it will suspend the task sequence until you click the Resume Task Sequence shortcut icon on the desktop. In addition to using the LTI Suspend feature for manual configuration or installation, you can also use it simply for verifying a reference image before you allow the task sequence to continue and use Sysprep and capture the virtual machine. + + ![figure 8.](../images/fig8-suspend.png) + + A task sequence with optional Suspend action (LTISuspend.wsf) added. + + ![figure 9.](../images/fig9-resumetaskseq.png) + + The Windows 10 desktop with the Resume Task Sequence shortcut. + +### Edit the Unattend.xml file for Windows 10 Enterprise + +When using MDT, you don't need to edit the Unattend.xml file very often because most configurations are taken care of by MDT. However if, for example, you want to configure Internet Explorer behavior, then you can edit the Unattend.xml for this. Editing the Unattend.xml for basic Internet Explorer settings is easy, but for more advanced settings, you will want to use the Internet Explorer Administration Kit (IEAK). + +>[!WARNING] +>Do not use **SkipMachineOOBE** or **SkipUserOOBE** in your Unattend.xml file. These settings are deprecated and can have unintended effects if used. + +>[!NOTE] +>You also can use the Unattend.xml to enable components in Windows 10, like the Telnet Client or Hyper-V client. Normally we prefer to do this via the **Install Roles and Features** action, or using Deployment Image Servicing and Management (DISM) command-line tools, because then we can add that as an application, being dynamic, having conditions, and so forth. Also, if you are adding packages via Unattend.xml, it is version specific, so Unattend.xml must match the exact version of the operating system you are servicing. + +Follow these steps to configure Internet Explorer settings in Unattend.xml for the Windows 10 Enterprise x64 RTM Default Image task sequence: + +On **MDT01**: + +1. Using the Deployment Workbench, under **Deployment Shares > MDT Build Lab > Task Sequences** right-click the **Windows 10 Enterprise x64 RTM Default Image** task sequence and select **Properties**. +2. In the **OS Info** tab, click **Edit Unattend.xml**. MDT now generates a catalog file. This will take a few minutes, and then Windows System Image Manager (Windows SIM) will start. + + > [!IMPORTANT] + > The ADK version 1903 has a [known issue](/windows-hardware/get-started/what-s-new-in-kits-and-tools#whats-new-in-the-windows-adk-for-windows-10-version-1903) generating a catalog file for Windows 10, version 1903 or 1909 X64 install.wim. You might see the error "Could not load file or assembly" in in the console output. To avoid this issue, [install the ADK, version 2004 or a later version](/windows-hardware/get-started/adk-install). A workaround is also available for the ADK version 1903: + > - Close the Deployment Workbench and install the [WSIM 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334). This will update imagecat.exe and imgmgr.exe to version 10.0.18362.144. + > - Manually run imgmgr.exe (C:\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM\\imgmgr.exe). + > - Generate a catalog (Tools/Create Catalog) for the selected install.wim (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install.wim). + > - After manually creating the catalog file (ex: D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM\\sources\\install_Windows 10 Enterprise.clg), open the Deployment Workbench and proceed to edit unattend.xml. + +3. In Windows SIM, expand the **4 specialize** node in the **Answer File** pane and select the amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral entry. +4. In the **amd64\_Microsoft-Windows-IE-InternetExplorer\_neutral properties** window (right-hand window), set the following values: + - DisableDevTools: true +5. Save the Unattend.xml file, and close Windows SIM. + - Note: If errors are reported that certain display values are incorrect, you can ignore this or browse to **7oobeSystem\\amd64_Microsoft-Windows-Shell-Setup__neutral\\Display** and enter the following: ColorDepth 32, HorizontalResolution 1, RefreshRate 60, VerticalResolution 1. +6. On the Windows 10 Enterprise x64 RTM Default Image Properties, click **OK**. + + ![figure 10.](../images/fig10-unattend.png) + + Windows System Image Manager with the Windows 10 Unattend.xml. + +## Configure the MDT deployment share rules + +Understanding rules is critical to successfully using MDT. Rules are configured using the **Rules** tab of the deployment share's properties. The **Rules** tab is essentially a shortcut to edit the **CustomSettings.ini** file that exists in the **D:\\MDTBuildLab\\Control** folder. This section discusses how to configure the MDT deployment share rules as part of your Windows 10 Enterprise deployment. + +### MDT deployment share rules overview + +In MDT, there are always two rule files: the **CustomSettings.ini** file and the **Bootstrap.ini** file. You can add almost any rule to either. However, the Bootstrap.ini file is copied from the Control folder to the boot image, so the boot image needs to be updated every time you change that file. For this reason, add only a minimal set of rules to Bootstrap.ini, such as which deployment server and share to connect to - the DEPLOYROOT value. Put the other rules in CustomSettings.ini because that file is updated immediately when you click OK. + +To configure the rules for the MDT Build Lab deployment share: + +On **MDT01**: + +1. Using the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Properties**. +2. Select the **Rules** tab and replace the existing content with the following information (edit the settings as needed to match your deployment). For example, If you do not have a WSUS server in your environment, delete the **WSUSServer** line from the configuration: + + ``` + [Settings] + Priority=Default + + [Default] + _SMSTSORGNAME=Contoso + UserDataLocation=NONE + DoCapture=YES + OSInstall=Y + AdminPassword=pass@word1 + TimeZoneName=Pacific Standard Time + JoinWorkgroup=WORKGROUP + HideShell=YES + FinishAction=SHUTDOWN + DoNotCreateExtraPartition=YES + WSUSServer=http://mdt01.contoso.com:8530 + ApplyGPOPack=NO + SLSHARE=\\MDT01\Logs$ + SkipAdminPassword=YES + SkipProductKey=YES + SkipComputerName=YES + SkipDomainMembership=YES + SkipUserData=YES + SkipLocaleSelection=YES + SkipTaskSequence=NO + SkipTimeZone=YES + SkipApplications=YES + SkipBitLocker=YES + SkipSummary=YES + SkipRoles=YES + SkipCapture=NO + SkipFinalSummary=YES + ``` + + ![figure 11.](../images/mdt-rules.png) + + The server-side rules for the MDT Build Lab deployment share. + +3. Click **Edit Bootstrap.ini** and modify using the following information: + + ``` + [Settings] + Priority=Default + + [Default] + DeployRoot=\\MDT01\MDTBuildLab$ + UserDomain=CONTOSO + UserID=MDT_BA + UserPassword=pass@word1 + + SkipBDDWelcome=YES + ``` + + >[!NOTE] + >For security reasons, you normally don't add the password to the Bootstrap.ini file; however, because this deployment share is for creating reference image builds only, and should not be published to the production network, it is acceptable to do so in this situation. Obviously if you are not using the same password (pass@word3) that is provided in this lab, you must enter your own custom password on the Rules tab and in Bootstrap.ini. + +4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x86**. +5. In the **Lite Touch Boot Image Settings** area, configure the following settings: + 1. Image description: MDT Build Lab x86 + 2. ISO file name: MDT Build Lab x86.iso +6. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. +7. In the **Lite Touch Boot Image Settings** area, configure the following settings: + 1. Image description: MDT Build Lab x64 + 2. ISO file name: MDT Build Lab x64.iso +8. Click **OK**. + +>[!NOTE] +>In MDT, the x86 boot image can deploy both x86 and x64 operating systems (except on computers based on Unified Extensible Firmware Interface). + +### Update the deployment share + +After the deployment share has been configured, it needs to be updated. This is the process when the Windows PE boot images are created. + +1. In the Deployment Workbench, right-click the **MDT Build Lab** deployment share and select **Update Deployment Share**. +2. Use the default options for the Update Deployment Share Wizard. + +>[!NOTE] +>The update process will take 5 to 10 minutes. + +### The rules explained + +Now that the MDT Build Lab deployment share (the share used to create the reference images) has been configured, it is time to explain the various settings used in the Bootstrap.ini and CustomSettings.ini files. + +The Bootstrap.ini and CustomSettings.ini files work together. The Bootstrap.ini file is always present on the boot image and is read first. The basic purpose for Bootstrap.ini is to provide just enough information for MDT to find the CustomSettings.ini. + +The CustomSettings.ini file is normally stored on the server, in the Deployment share\\Control folder, but also can be stored on the media (when using offline media). + +>[!NOTE] +>The settings, or properties, that are used in the rules (CustomSettings.ini and Bootstrap.ini) are listed in the MDT documentation, in the Microsoft Deployment Toolkit Reference / Properties / Property Definition section. + +### The Bootstrap.ini file + +The Bootstrap.ini file is available via the deployment share's Properties dialog box, or via the D:\\MDTBuildLab\\Control folder on MDT01. + +``` +[Settings] +Priority=Default +[Default] +DeployRoot=\\MDT01\MDTBuildLab$ +UserDomain=CONTOSO +UserID=MDT_BA +UserPassword=pass@word1 +SkipBDDWelcome=YES +``` + +So, what are these settings? +- **Priority.** This determines the order in which different sections are read. This Bootstrap.ini has only one section, named \[Default\]. +- **DeployRoot.** This is the location of the deployment share. Normally, this value is set by MDT, but you need to update the DeployRoot value if you move to another server or other share. If you don't specify a value, the Windows Deployment Wizard prompts you for a location. +- **UserDomain, UserID, and UserPassword.** These values are used for automatic log on to the deployment share. Again, if they are not specified, the wizard prompts you. + + >[!WARNING] + >Caution is advised. These values are stored in clear text on the boot image. Use them only for the MDT Build Lab deployment share and not for the MDT Production deployment share that you learn to create in the next topic. + +- **SkipBDDWelcome.** Even if it is nice to be welcomed every time we start a deployment, we prefer to skip the initial welcome page of the Windows Deployment Wizard. + +>[!NOTE] +>All properties beginning with "Skip" control only whether to display that pane in the Windows Deployment Wizard. Most of the panes also require you to actually set one or more values. + +### The CustomSettings.ini file + +The CustomSettings.ini file, whose content you see on the Rules tab of the deployment share Properties dialog box, contains most of the properties used in the configuration. + +``` +[Settings] +Priority=Default +[Default] +_SMSTSORGNAME=Contoso +UserDataLocation=NONE +DoCapture=YES +OSInstall=Y +AdminPassword=pass@word1 +TimeZoneName=Pacific Standard Time +JoinWorkgroup=WORKGROUP +HideShell=YES +FinishAction=SHUTDOWN +DoNotCreateExtraPartition=YES +WSUSServer=http://mdt01.contoso.com:8530 +ApplyGPOPack=NO +SLSHARE=\\MDT01\Logs$ +SkipAdminPassword=YES +SkipProductKey=YES +SkipComputerName=YES +SkipDomainMembership=YES +SkipUserData=YES +SkipLocaleSelection=YES +SkipTaskSequence=NO +SkipTimeZone=YES +SkipApplications=YES +SkipBitLocker=YES +SkipSummary=YES +SkipRoles=YES +SkipCapture=NO +SkipFinalSummary=YES +``` +- **Priority.** Has the same function as in Bootstrap.ini. Priority determines the order in which different sections are read. This CustomSettings.ini has only one section, named \[Default\]. In general, if you have multiple sections that set the same value, the value from the first section (higher priority) wins. The rare exceptions are listed in the ZTIGather.xml file. +- **\_SMSTSORGNAME.** The organization name displayed in the task sequence progress bar window during deployment. +- **UserDataLocation.** Controls the settings for user state backup. You do not need to use when building and capturing a reference image. +- **DoCapture.** Configures the task sequence to run the System Preparation (Sysprep) tool and capture the image to a file when the operating system is installed. +- **OSInstall.** Must be set to Y or YES (the code actually just looks for the Y character) for the setup to proceed. +- **AdminPassword.** Sets the local Administrator account password. +- **TimeZoneName.** Establishes the time zone to use. Don't confuse this value with TimeZone, which is only for legacy operating systems (Windows 7 and Windows Server 2003). + + **Note**: The easiest way to find the current time zone name on a Windows 10 machine is to run tzutil /g in a command prompt. You can also run tzutil /l to get a listing of all available time zone names. + +- **JoinWorkgroup.** Configures Windows to join a workgroup. +- **HideShell.** Hides the Windows Shell during deployment. This is especially useful for Windows 10 deployments in which the deployment wizard will otherwise appear behind the tiles. +- **FinishAction.** Instructs MDT what to do when the task sequence is complete. +- **DoNotCreateExtraPartition.** Configures the task sequence not to create the extra partition for BitLocker. There is no need to do this for your reference image. +- **WSUSServer.** Specifies which Windows Server Update Services (WSUS) server (and port, if needed) to use during the deployment. Without this option MDT will use Microsoft Update directly, which will increase deployment time and limit your options of controlling which updates are applied. +- **SLSHARE.** Instructs MDT to copy the log files to a server share if something goes wrong during deployment, or when a deployment is successfully completed. +- **ApplyGPOPack.** Allows you to deploy local group policies created by Microsoft Security Compliance Manager (SCM). +- **SkipAdminPassword.** Skips the pane that asks for the Administrator password. +- **SkipProductKey.** Skips the pane that asks for the product key. +- **SkipComputerName.** Skips the Computer Name pane. +- **SkipDomainMemberShip.** Skips the Domain Membership pane. If set to Yes, you need to configure either the JoinWorkgroup value or the JoinDomain, DomainAdmin, DomainAdminDomain, and DomainAdminPassword properties. +- **SkipUserData.** Skips the pane for user state migration. +- **SkipLocaleSelection.** Skips the pane for selecting language and keyboard settings. +- **SkipTimeZone.** Skips the pane for setting the time zone. +- **SkipApplications.** Skips the Applications pane. +- **SkipBitLocker.** Skips the BitLocker pane. +- **SkipSummary.** Skips the initial Windows Deployment Wizard summary pane. +- **SkipRoles.** Skips the Install Roles and Features pane. +- **SkipCapture.** Skips the Capture pane. +- **SkipFinalSummary.** Skips the final Windows Deployment Wizard summary. Because you use FinishAction=Shutdown, you don't want the wizard to stop in the end so that you need to click OK before the machine shuts down. + +## Build the Windows 10 reference image + +As previously described, this section requires a Hyper-V host. See [Hyper-V requirements](prepare-for-windows-deployment-with-mdt.md#hyper-v-requirements) for more information. + +Once you have created your task sequence, you are ready to create the Windows 10 reference image. This will be performed by launching the task sequence from a virtual machine which will then automatically perform the reference image creation and capture process. + +The steps below outline the process used to boot a virtual machine using an ISO boot image created by MDT, and then run the reference image task sequence image to create and capture the Windows 10 reference image. + +1. Copy D:\\MDTBuildLab\\Boot\\MDT Build Lab x86.iso on MDT01 to C:\\ISO on your Hyper-V host (HV01). + + **Note**: Remember, in MDT you can use the x86 boot image to deploy both x86 and x64 operating system images. That's why you can use the x86 boot image instead of the x64 boot image. + +On **HV01**: + +2. Create a new virtual machine with the following settings: + 1. Name: REFW10X64-001 + 2. Store the virtual machine in a different location: C:\VM + 3. Generation 1 + 4. Memory: 1024 MB + 5. Network: Must be able to connect to \\MDT01\MDTBuildLab$ + 7. Hard disk: 60 GB (dynamic disk) + 8. Install OS with image file: C:\\ISO\\MDT Build Lab x86.iso +1. Before you start the VM, add a checkpoint for REFW10X64-001, and name it **Clean with MDT Build Lab x86 ISO**. + + **Note**: Checkpoints are useful if you need to restart the process and want to make sure you can start clean. + +4. Start the REFW10X64-001 virtual machine and connect to it. + + **Note**: Up to this point we have not discussed IP addressing or DHCP. In the initial setup for this guide, DC01 was provisioned as a DHCP server to provide IP address leases to client computers. You might have a different DHCP server on your network that you wish to use. The REFW10X64-001 virtual machine requires an IP address lease that provides it with connectivity to MDT01 so that it can connect to the \\MDT01\MDTBuildLab$ share. In the current scenario this is accomplished with a DHCP scope that provides IP addresses in the 10.10.10.100 - 10.10.10.200 range, as part of a /24 subnet so that the client can connect to MDT01 at 10.10.10.11. + + After booting into Windows PE, complete the Windows Deployment Wizard with the following settings: + 1. Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Default Image + 2. Specify whether to capture an image: Capture an image of this reference computer + - Location: \\\\MDT01\\MDTBuildLab$\\Captures + 3. File name: REFW10X64-001.wim + + ![capture image.](../images/captureimage.png) + + The Windows Deployment Wizard for the Windows 10 reference image. + +5. The setup now starts and does the following: + 1. Installs the Windows 10 Enterprise operating system. + 2. Installs the added applications, roles, and features. + 3. Updates the operating system via your local Windows Server Update Services (WSUS) server. + 4. Stages Windows PE on the local disk. + 5. Runs System Preparation (Sysprep) and reboots into Windows PE. + 6. Captures the installation to a Windows Imaging (WIM) file. + 7. Turns off the virtual machine. + +After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. + + ![image.](../images/image-captured.png) + +## Troubleshooting + +> [!IMPORTANT] +> If you encounter errors applying the image when using a BIOS firmware type, see [Windows 10 deployments fail with Microsoft Deployment Toolkit on computers with BIOS type firmware](https://support.microsoft.com/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7). This + +If you [enabled monitoring](#enable-monitoring), you can check the progress of the task sequence. + + ![monitoring.](../images/mdt-monitoring.png) + +If there are problems with your task sequence, you can troubleshoot in Windows PE by pressing F8 to open a command prompt. There are several [MDT log files](/configmgr/mdt/troubleshooting-reference#mdt-logs) created that can be helpful determining the origin of an error, such as BDD.log. From the command line in Windows PE you can copy these logs from the client to your MDT server for viewing with CMTrace. For example: copy BDD.log \\\\mdt01\\logs$. + +After some time, you will have a Windows 10 Enterprise x64 image that is fully patched and has run through Sysprep, located in the D:\\MDTBuildLab\\Captures folder on your deployment server. The file name is REFW10X64-001.wim. + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    +[Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md b/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md new file mode 100644 index 0000000000..b6a311471f --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/deploy-a-windows-11-image-using-mdt.md @@ -0,0 +1,845 @@ +--- +title: Deploy a Windows 10 image using MDT (Windows 10) +description: This topic will show you how to take your reference image for Windows 10, and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). +ms.assetid: 1d70a3d8-1b1d-4051-b656-c0393a93f83c +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deployment, automate, tools, configure +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Deploy a Windows 10 image using MDT + +**Applies to** +- Windows 10 + +This topic will show you how to take your reference image for Windows 10 (that was just [created](create-a-windows-10-reference-image.md)), and deploy that image to your environment using the Microsoft Deployment Toolkit (MDT). + +We will prepare for this by creating an MDT deployment share that is used solely for image deployment. Separating the processes of creating reference images from the processes used to deploy them in production allows greater control of on both processes. We will configure Active Directory permissions, configure the deployment share, create a new task sequence, and add applications, drivers, and rules. + +For the purposes of this topic, we will use four computers: DC01, MDT01, HV01 and PC0005. + +- DC01 is a domain controller +- MDT01 is a domain member server +- HV01 is a Hyper-V server +- PC0005 is a blank device to which we will deploy Windows 10 + +MDT01 and PC0005 are members of the domain contoso.com for the fictitious Contoso Corporation. HV01 used to test deployment of PC0005 in a virtual environment. + + ![devices.](../images/mdt-07-fig01.png) + +>[!NOTE] +>For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +## Step 1: Configure Active Directory permissions + +These steps will show you how to configure an Active Directory account with the permissions required to deploy a Windows 10 machine to the domain using MDT. These steps assume you have The account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. In order for MDT to join machines into the contoso.com domain you need to create an account and configure permissions in Active Directory. + +On **DC01**: + +1. Download the [Set-OUPermissions.ps1 script](https://go.microsoft.com/fwlink/p/?LinkId=619362) and copy it to the **C:\\Setup\\Scripts** directory on **DC01**. This script configures permissions to allow the **MDT_JD** account to manage computer accounts in the contoso > Computers organizational unit. + +2. Create the **MDT_JD** service account by running the following command from an elevated **Windows PowerShell prompt**: + + ```powershell + New-ADUser -Name MDT_JD -UserPrincipalName MDT_JD@contoso.com -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT join domain account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true + ``` + +3. Next, run the Set-OuPermissions script to apply permissions to the **MDT\_JD** service account, enabling it to manage computer accounts in the Contoso / Computers OU. Run the following commands from an elevated Windows PowerShell prompt: + + ```powershell + Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force + Set-Location C:\Setup\Scripts + .\Set-OUPermissions.ps1 -Account MDT_JD -TargetOU "OU=Workstations,OU=Computers,OU=Contoso" + ``` + + The following is a list of the permissions being granted: + + - Scope: This object and all descendant objects + - Create Computer objects + - Delete Computer objects + - Scope: Descendant Computer objects + - Read All Properties + - Write All Properties + - Read Permissions + - Modify Permissions + - Change Password + - Reset Password + - Validated write to DNS host name + - Validated write to service principal name + +## Step 2: Set up the MDT production deployment share + +Next, create a new MDT deployment share. You should not use the same deployment share that you used to create the reference image for a production deployment. Perform this procedure on the MDT01 server. + +### Create the MDT production deployment share + +On **MDT01**: + +The steps for creating the deployment share for production are the same as when you created the deployment share for creating the custom reference image: + +1. Ensure you are signed on as: contoso\administrator. +2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. +3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. + +4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. + +5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. + +6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. +7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + +### Configure permissions for the production deployment share + +To read files in the deployment share, you need to assign NTFS and SMB permissions to the MDT Build Account (MDT\_BA) for the **D:\\MDTProduction** folder + +On **MDT01**: + +1. Ensure you are signed in as **contoso\\administrator**. +2. Modify the NTFS permissions for the **D:\\MDTProduction** folder by running the following command in an elevated Windows PowerShell prompt: + + ``` powershell + icacls "D:\MDTProduction" /grant '"CONTOSO\MDT_BA":(OI)(CI)(M)' + grant-smbshareaccess -Name MDTProduction$ -AccountName "Contoso\MDT_BA" -AccessRight Full -force + ``` + +## Step 3: Add a custom image + +The next step is to add a reference image into the deployment share with the setup files required to successfully deploy Windows 10. When adding a custom image, you still need to copy setup files (an option in the wizard) because Windows 10 stores additional components in the Sources\\SxS folder which is outside the image and may be required when installing components. + +### Add the Windows 10 Enterprise x64 RTM custom image + +In these steps, we assume that you have completed the steps in the [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) topic, so you have a Windows 10 reference image at **D:\\MDTBuildLab\\Captures\REFW10X64-001.wim** on MDT01. + +1. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**; select the **Operating Systems** node, and create a folder named **Windows 10**. +2. Right-click the **Windows 10** folder and select **Import Operating System**. + +3. On the **OS Type** page, select **Custom image file** and click **Next**. + +4. On the **Image** page, in the **Source file** text box, browse to **D:\\MDTBuildLab\\Captures\\REFW10X64-001.wim** and click **Next**. + +5. On the **Setup** page, select the **Copy Windows 7, Windows Server 2008 R2, or later setup files from the specified path** option; in the **Setup source directory** text box, browse to **D:\\MDTBuildLab\\Operating Systems\\W10EX64RTM** and click **Next**. + +6. On the **Destination** page, in the **Destination directory name** text box, type **W10EX64RTM**, click **Next** twice, and then click **Finish**. +7. After adding the operating system, double-click the added operating system name in the **Operating Systems / Windows 10** node and change the name to **Windows 10 Enterprise x64 RTM Custom Image**. + +>[!NOTE] +>The reason for adding the setup files has changed since earlier versions of MDT. MDT 2010 used the setup files to install Windows. MDT uses DISM to apply the image; however, you still need the setup files because some components in roles and features are stored outside the main image. + + +![imported OS.](../images/fig2-importedos.png) + +## Step 4: Add an application + +When you configure your MDT Build Lab deployment share, you can also add applications to the new deployment share before creating your task sequence. This section walks you through the process of adding an application to the MDT Production deployment share using Adobe Reader as an example. + +### Create the install: Adobe Reader DC + +On **MDT01**: + +1. Download the Enterprise distribution version of [Adobe Acrobat Reader DC](https://get.adobe.com/reader/enterprise/) (AcroRdrDC2100520060_en_US.exe) to **D:\\setup\\adobe** on MDT01. +2. Extract the .exe file that you downloaded to an .msi (ex: .\AcroRdrDC2100520060_en_US.exe -sfx_o"d:\setup\adobe\install\" -sfx_ne). +3. In the Deployment Workbench, expand the **MDT Production** node and navigate to the **Applications** node. +4. Right-click the **Applications** node, and create a new folder named **Adobe**. + +5. In the **Applications** node, right-click the **Adobe** folder and select **New Application**. + +6. On the **Application Type** page, select the **Application with source files** option and click **Next**. + +7. On the **Details** page, in the **Application Name** text box, type **Install - Adobe Reader** and click *Next**. + +8. On the **Source** page, in the **Source Directory** text box, browse to **D:\\setup\\adobe\\install** and click **Next**. + +9. On the **Destination** page, in the **Specify the name of the directory that should be created** text box, type **Install - Adobe Reader** and click **Next**. + +10. On the **Command Details** page, in the **Command Line** text box, type **msiexec /i AcroRead.msi /q**, click **Next** twice, and then click **Finish**. + + ![acroread image.](../images/acroread.png) + + The Adobe Reader application added to the Deployment Workbench. + +## Step 5: Prepare the drivers repository + +In order to deploy Windows 10 with MDT successfully, you need drivers for the boot images and for the actual operating system. This section will show you how to add drivers for the boot image and operating system, using the following hardware models as examples: +- Lenovo ThinkPad T420 +- Dell Latitude 7390 +- HP EliteBook 8560w +- Microsoft Surface Pro + +For boot images, you need to have storage and network drivers; for the operating system, you need to have the full suite of drivers. + +>[!NOTE] +>You should only add drivers to the Windows PE images if the default drivers don't work. Adding drivers that are not necessary will only make the boot image larger and potentially delay the download time. + +### Create the driver source structure in the file system + +The key to successful management of drivers for MDT, as well as for any other deployment solution, is to have a really good driver repository. From this repository, you import drivers into MDT for deployment, but you should always maintain the repository for future use. + +On **MDT01**: + +> [!IMPORTANT] +> In the steps below, it is critical that the folder names used for various computer makes and models exactly match the results of **wmic computersystem get model,manufacturer** on the target system. + +1. Using File Explorer, create the **D:\\drivers** folder. +2. In the **D:\\drivers** folder, create the following folder structure: + 1. WinPE x86 + 2. WinPE x64 + 3. Windows 10 x64 +3. In the new Windows 10 x64 folder, create the following folder structure: + - Dell Inc. + - Latitude E7450 + - Hewlett-Packard + - HP EliteBook 8560w + - Lenovo + - ThinkStation P500 (30A6003TUS) + - Microsoft Corporation + - Surface Laptop + +> [!NOTE] +> Even if you are not going to use both x86 and x64 boot images, we still recommend that you add the support structure for future use. + +### Create the logical driver structure in MDT + +When you import drivers to the MDT driver repository, MDT creates a single instance folder structure based on driver class names. However, you can, and should, mimic the driver structure of your driver source repository in the Deployment Workbench. This is done by creating logical folders in the Deployment Workbench. +1. On MDT01, using Deployment Workbench, select the **Out-of-Box Drivers** node. +2. In the **Out-Of-Box Drivers** node, create the following folder structure: + 1. WinPE x86 + 2. WinPE x64 + 3. Windows 10 x64 +3. In the **Windows 10 x64** folder, create the following folder structure: + - Dell Inc. + - Latitude E7450 + - Hewlett-Packard + - HP EliteBook 8560w + - Lenovo + - 30A6003TUS + - Microsoft Corporation + - Surface Laptop + +The preceding folder names should match the actual make and model values that MDT reads from devices during deployment. You can find out the model values for your machines by using the following command in Windows PowerShell: + +```powershell +Get-WmiObject -Class:Win32_ComputerSystem +``` + +Or, you can use this command in a normal command prompt: + +```console +wmic csproduct get name +``` + +If you want a more standardized naming convention, try the **ModelAliasExit.vbs script** from the Deployment Guys blog post, entitled [Using and Extending Model Aliases for Hardware Specific Application Installation](/archive/blogs/deploymentguys/using-and-extending-model-aliases-for-hardware-specific-application-installation). + +![drivers.](../images/fig4-oob-drivers.png) + +The Out-of-Box Drivers structure in the Deployment Workbench. + +### Create the selection profiles for boot image drivers + +By default, MDT adds any storage and network drivers that you import to the boot images. However, you should add only the drivers that are necessary to the boot image. You can control which drivers are added by using selection profiles. +The drivers that are used for the boot images (Windows PE) are Windows 10 drivers. If you can’t locate Windows 10 drivers for your device, a Windows 7 or Windows 8.1 driver will most likely work, but Windows 10 drivers should be your first choice. + +On **MDT01**: + +1. In the Deployment Workbench, under the **MDT Production** node, expand the **Advanced Configuration** node, right-click the **Selection Profiles** node, and select **New Selection Profile**. +2. In the New Selection Profile Wizard, create a selection profile with the following settings: + 1. Selection Profile name: WinPE x86 + 2. Folders: Select the WinPE x86 folder in Out-of-Box Drivers. + 3. Click **Next**, **Next** and **Finish**. +3. Right-click the **Selection Profiles** node again, and select **New Selection Profile**. +4. In the New Selection Profile Wizard, create a selection profile with the following settings: + 1. Selection Profile name: WinPE x64 + 2. Folders: Select the WinPE x64 folder in Out-of-Box Drivers. + 3. Click **Next**, **Next** and **Finish**. + + ![figure 5.](../images/fig5-selectprofile.png) + + Creating the WinPE x64 selection profile. + +### Extract and import drivers for the x64 boot image + +Windows PE supports all the hardware models that we have, but here you learn to add boot image drivers to accommodate any new hardware that might require additional drivers. In this example, you add the latest Intel network drivers to the x64 boot image. + +On **MDT01**: + +1. Download **PROWinx64.exe** from Intel.com (ex: [PROWinx64.exe](https://downloadcenter.intel.com/downloads/eula/25016/Intel-Network-Adapter-Driver-for-Windows-10?httpDown=https%3A%2F%2Fdownloadmirror.intel.com%2F25016%2Feng%2FPROWinx64.exe)). +2. Extract PROWinx64.exe to a temporary folder - in this example to the **C:\\Tmp\\ProWinx64** folder. + a. **Note**: Extracting the .exe file manually requires an extraction utility. You can also run the .exe and it will self-extract files to the **%userprofile%\AppData\Local\Temp\RarSFX0** directory. This directory is temporary and will be deleted when the .exe terminates. +3. Using File Explorer, create the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. +4. Copy the content of the **C:\\Tmp\\PROWinx64\\PRO1000\\Winx64\\NDIS64** folder to the **D:\\Drivers\\WinPE x64\\Intel PRO1000** folder. +5. In the Deployment Workbench, expand the **MDT Production** > **Out-of-Box Drivers** node, right-click the **WinPE x64** node, and select **Import Drivers**, and use the following Driver source directory to import drivers: **D:\\Drivers\\WinPE x64\\Intel PRO1000**. + +### Download, extract, and import drivers + +### For the Lenovo ThinkStation P500 + +For the ThinkStation P500 model, you use the Lenovo ThinkVantage Update Retriever software to download the drivers. With Update Retriever, you need to specify the correct Lenovo Machine Type for the actual hardware (the first four characters of the model name). As an example, the Lenovo ThinkStation P500 model has the 30A6003TUS model name, meaning the Machine Type is 30A6. + +> [!div class="mx-imgBorder"] +> ![ThinkStation image.](../images/thinkstation.png) + +To get the updates, download the drivers from the Lenovo ThinkVantage Update Retriever using its export function. You can also download the drivers by searching PC Support on the [Lenovo website](https://go.microsoft.com/fwlink/p/?LinkId=619543). + +In this example, we assume you have downloaded and extracted the drivers using ThinkVantage Update Retriever to the **D:\\Drivers\\Lenovo\\ThinkStation P500 (30A6003TUS)** directory. + +On **MDT01**: + +1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Lenovo** node. + +2. Right-click the **30A6003TUS** folder and select **Import Drivers** and use the following Driver source directory to import drivers: + + **D:\\Drivers\\Windows 10 x64\\Lenovo\\ThinkStation P500 (30A6003TUS)** + + The folder you select and all sub-folders will be checked for drivers, expanding any .cab files that are present and searching for drivers. + +### For the Latitude E7450 + +For the Dell Latitude E7450 model, you use the Dell Driver CAB file, which is accessible via the [Dell TechCenter website](https://go.microsoft.com/fwlink/p/?LinkId=619544). + +In these steps, we assume you have downloaded and extracted the CAB file for the Latitude E7450 model to the **D:\\Drivers\\Dell Inc.\\Latitude E7450** folder. + +On **MDT01**: + +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Dell Inc.** node. + +2. Right-click the **Latitude E7450** folder and select **Import Drivers** and use the following Driver source directory to import drivers: + + **D:\\Drivers\\Windows 10 x64\\Dell Inc.\\Latitude E7450** + +### For the HP EliteBook 8560w + +For the HP EliteBook 8560w, you use HP Image Assistant to get the drivers. The HP Image Assistant can be accessed on the [HP Support site](https://ftp.ext.hp.com/pub/caps-softpaq/cmit/HPIA.html). + +In these steps, we assume you have downloaded and extracted the drivers for the HP EliteBook 8650w model to the **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** folder. + +On **MDT01**: + +1. In the **Deployment Workbench**, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Hewlett-Packard** node. + +2. Right-click the **HP EliteBook 8560w** folder and select **Import Drivers** and use the following Driver source directory to import drivers: + + **D:\\Drivers\\Windows 10 x64\\Hewlett-Packard\\HP EliteBook 8560w** + +### For the Microsoft Surface Laptop + +For the Microsoft Surface Laptop model, you find the drivers on the Microsoft website. In these steps we assume you have downloaded and extracted the Surface Laptop drivers to the **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** folder. + +On **MDT01**: + +1. In the Deployment Workbench, in the **MDT Production** > **Out-Of-Box Drivers** > **Windows 10 x64** node, expand the **Microsoft** node. + +2. Right-click the **Surface Laptop** folder and select **Import Drivers**; and use the following Driver source directory to import drivers: + + **D:\\Drivers\\Windows 10 x64\\Microsoft\\Surface Laptop** + +## Step 6: Create the deployment task sequence + +This section will show you how to create the task sequence used to deploy your production Windows 10 reference image. You will then configure the task sequence to enable patching via a Windows Server Update Services (WSUS) server. + +### Create a task sequence for Windows 10 Enterprise + +On **MDT01**: + +1. In the Deployment Workbench, under the **MDT Production** node, right-click **Task Sequences**, and create a folder named **Windows 10**. + +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-001 + - Task sequence name: Windows 10 Enterprise x64 RTM Custom Image + - Task sequence comments: Production Image + - Template: Standard Client Task Sequence + - Select OS: Windows 10 Enterprise x64 RTM Custom Image + - Specify Product Key: Do not specify a product key at this time + - Full Name: Contoso + - Organization: Contoso + - Internet Explorer home page: https://www.contoso.com + - Admin Password: Do not specify an Administrator Password at this time + +### Edit the Windows 10 task sequence + +1. Continuing from the previous procedure, right-click the **Windows 10 Enterprise x64 RTM Custom Image** task sequence, and select **Properties**. + +2. On the **Task Sequence** tab, configure the **Windows 10 Enterprise x64 RTM Custom Image** task sequence with the following settings: + + 1. Preinstall: After the **Enable BitLocker (Offline)** action, add a **Set Task Sequence Variable** action with the following settings: + 1. Name: Set DriverGroup001 + 2. Task Sequence Variable: DriverGroup001 + 3. Value: Windows 10 x64\\%Manufacturer%\\%Model% + + 2. Configure the **Inject Drivers** action with the following settings: + - Choose a selection profile: Nothing + - Install all drivers from the selection profile + + > [!NOTE] + > The configuration above indicates that MDT should only use drivers from the folder specified by the DriverGroup001 property, which is defined by the "Choose a selection profile: Nothing" setting, and that MDT should not use plug and play to determine which drivers to copy, which is defined by the "Install all drivers from the selection profile" setting. + + 3. State Restore. Enable the **Windows Update (Pre-Application Installation)** action. + + 4. State Restore. Enable the **Windows Update (Post-Application Installation)** action. + +3. Click **OK**. + + ![drivergroup.](../images/fig6-taskseq.png) + + The task sequence for production deployment. + +## Step 7: Configure the MDT production deployment share + +In this section, you will learn how to configure the MDT Build Lab deployment share with the rules required to create a simple and dynamic deployment process. This includes configuring commonly used rules and an explanation of how these rules work. + +### Configure the rules + +> [!NOTE] +> The following instructions assume the device is online. If you're offline you can remove SLShare variable. + +On **MDT01**: + +1. Right-click the **MDT Production** deployment share and select **Properties**. +2. Select the **Rules** tab and replace the existing rules with the following information (modify the domain name, WSUS server, and administrative credentials to match your environment): + + ``` + [Settings] + Priority=Default + + [Default] + _SMSTSORGNAME=Contoso + OSInstall=YES + UserDataLocation=AUTO + TimeZoneName=Pacific Standard Time + AdminPassword=pass@word1 + JoinDomain=contoso.com + DomainAdmin=CONTOSO\MDT_JD + DomainAdminPassword=pass@word1 + MachineObjectOU=OU=Workstations,OU=Computers,OU=Contoso,DC=contoso,DC=com + SLShare=\\MDT01\Logs$ + ScanStateArgs=/ue:*\* /ui:CONTOSO\* + USMTMigFiles001=MigApp.xml + USMTMigFiles002=MigUser.xml + HideShell=YES + ApplyGPOPack=NO + WSUSServer=mdt01.contoso.com:8530 + SkipAppsOnUpgrade=NO + SkipAdminPassword=YES + SkipProductKey=YES + SkipComputerName=NO + SkipDomainMembership=YES + SkipUserData=YES + SkipLocaleSelection=YES + SkipTaskSequence=NO + SkipTimeZone=YES + SkipApplications=NO + SkipBitLocker=YES + SkipSummary=YES + SkipCapture=YES + SkipFinalSummary=NO + ``` + +3. Click **Edit Bootstrap.ini** and modify using the following information: + + ``` + [Settings] + Priority=Default + + [Default] + DeployRoot=\\MDT01\MDTProduction$ + UserDomain=CONTOSO + UserID=MDT_BA + UserPassword=pass@word1 + SkipBDDWelcome=YES + ``` + +4. On the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. + +5. On the **General** sub tab (still under the main Windows PE tab), configure the following settings: + + In the **Lite Touch Boot Image Settings** area: + + - Image description: MDT Production x86 + - ISO file name: MDT Production x86.iso + + > [!NOTE] + > + > Because you are going to use Pre-Boot Execution Environment (PXE) later to deploy the machines, you do not need the ISO file; however, we recommend creating ISO files because they are useful when troubleshooting deployments and for quick tests. + +6. On the **Drivers and Patches** sub tab, select the **WinPE x86** selection profile and select the **Include all drivers from the selection profile** option. + +7. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. + +8. On the **General** sub tab, configure the following settings: + + In the **Lite Touch Boot Image Settings** area: + + - Image description: MDT Production x64 + - ISO file name: MDT Production x64.iso + +9. In the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. + +10. In the **Monitoring** tab, select the **Enable monitoring for this deployment share** check box. + +11. Click **OK**. + + >[!NOTE] + >It will take a while for the Deployment Workbench to create the monitoring database and web service. + + ![figure 8.](../images/mdt-07-fig08.png) + + The Windows PE tab for the x64 boot image. + +### The rules explained + +The rules for the MDT Production deployment share are somewhat different from those for the MDT Build Lab deployment share. The biggest differences are that you deploy the machines into a domain instead of a workgroup. + +You can optionally remove the **UserID** and **UserPassword** entries from Bootstrap.ini so that users performing PXE boot are prompted to provide credentials with permission to connect to the deployment share. Setting **SkipBDDWelcome=NO** enables the welcome screen that displays options to run the deployment wizard, run DaRT tools (if installed), exit to a Windows PE command prompt, set the keyboard layout, or configure a static IP address. In this example we are skipping the welcome screen and providing credentials. + +### The Bootstrap.ini file + +This is the MDT Production Bootstrap.ini: + +``` +[Settings] +Priority=Default + +[Default] +DeployRoot=\\MDT01\MDTProduction$ +UserDomain=CONTOSO +UserID=MDT_BA +UserPassword=pass@word1 +SkipBDDWelcome=YES +``` + +### The CustomSettings.ini file + +This is the CustomSettings.ini file with the new join domain information: + +``` +[Settings] +Priority=Default + +[Default] +_SMSTSORGNAME=Contoso +OSInstall=Y +UserDataLocation=AUTO +TimeZoneName=Pacific Standard Time +AdminPassword=pass@word1 +JoinDomain=contoso.com +DomainAdmin=CONTOSO\MDT_JD +DomainAdminPassword=pass@word1 +MachineObjectOU=OU=Workstations,OU=Computers,OU=Contoso,DC=contoso,DC=com +SLShare=\\MDT01\Logs$ +ScanStateArgs=/ue:*\* /ui:CONTOSO\* +USMTMigFiles001=MigApp.xml +USMTMigFiles002=MigUser.xml +HideShell=YES +ApplyGPOPack=NO +WSUSServer=http://mdt01.contoso.com:8530 +SkipAppsOnUpgrade=NO +SkipAdminPassword=YES +SkipProductKey=YES +SkipComputerName=NO +SkipDomainMembership=YES +SkipUserData=YES +SkipLocaleSelection=YES +SkipTaskSequence=NO +SkipTimeZone=YES +SkipApplications=NO +SkipBitLocker=YES +SkipSummary=YES +SkipCapture=YES +SkipFinalSummary=NO +EventService=http://MDT01:9800 +``` + +Some properties to use in the MDT Production rules file are as follows: +- **JoinDomain.** The domain to join. +- **DomainAdmin.** The account to use when joining the machine to the domain. +- **DomainAdminDomain.** The domain for the join domain account. +- **DomainAdminPassword.** The password for the join domain account. +- **MachineObjectOU.** The organizational unit (OU) to which to add the computer account. +- **ScanStateArgs.** Arguments for the User State Migration Tool (USMT) ScanState command. +- **USMTMigFiles(\*).** List of USMT templates (controlling what to backup and restore). +- **EventService.** Activates logging information to the MDT monitoring web service. + +### Optional deployment share configuration + +If your organization has a Microsoft Software Assurance agreement, you also can subscribe to the additional Microsoft Desktop Optimization Package (MDOP) license (at an additional cost). Included in MDOP is Microsoft Diagnostics and Recovery Toolkit (DaRT), which contains tools that can help you troubleshoot MDT deployments, as well as troubleshoot Windows itself. + +### Add DaRT 10 to the boot images + +If you have licensing for MDOP and DaRT, you can add DaRT to the boot images using the steps in this section. If you do not have DaRT licensing, or don't want to use it, simply skip to the next section, [Update the Deployment Share](#update-the-deployment-share). To enable the remote connection feature in MDT, you need to do the following: + + +> [!NOTE] +> DaRT 10 is part of [MDOP 2015](/microsoft-desktop-optimization-pack/#how-to-get-mdop). +> +> MDOP might be available as a download from your [Visual Studio subscription](https://my.visualstudio.com/Downloads). When searching, be sure to look for **Desktop Optimization Pack**. + +On **MDT01**: + +1. Download MDOP 2015 and copy the DaRT 10 installer file to the D:\\Setup\\DaRT 10 folder on MDT01 (DaRT\\DaRT 10\\Installers\\\\\x64\\MSDaRT100.msi). + +2. Install DaRT 10 (MSDaRT10.msi) using the default settings. + + ![DaRT image.](../images/dart.png) + +2. Copy the two tools CAB files from **C:\\Program Files\\Microsoft DaRT\\v10** (**Toolsx86.cab** and **Toolsx64.cab**) to the production deployment share at **D:\\MDTProduction\\Tools\\x86** and **D:\\MDTProduction\\Tools\\x64**, respectively. + +3. In the Deployment Workbench, right-click the **MDT Production** deployment share and select **Properties**. + +4. On the **Windows PE** tab, in the **Platform** drop-down list, make sure **x86** is selected. + +5. On the **Features** sub tab, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** checkbox. + + ![DaRT selection.](../images/mdt-07-fig09.png) + + Selecting the DaRT 10 feature in the deployment share. + +8. In the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. + +9. In the **Features** sub tab, in addition to the default selected feature pack, select the **Microsoft Diagnostics and Recovery Toolkit (DaRT)** check box. + +10. Click **OK**. + +### Update the deployment share + +Like the MDT Build Lab deployment share, the MDT Production deployment share needs to be updated after it has been configured. This is the process during which the Windows PE boot images are created. + +1. Right-click the **MDT Production** deployment share and select **Update Deployment Share**. + +2. Use the default options for the Update Deployment Share Wizard. + +>[!NOTE] +>The update process will take 5 to 10 minutes. + +## Step 8: Deploy the Windows 10 client image + +These steps will walk you through the process of using task sequences to deploy Windows 10 images through a fully automated process. First, you need to add the boot image to Windows Deployment Services (WDS) and then start the deployment. In contrast with deploying images from the MDT Build Lab deployment share, we recommend using the Pre-Installation Execution Environment (PXE) to start the full deployments in the datacenter, even though you technically can use an ISO/CD or USB to start the process. + +### Configure Windows Deployment Services + +You need to add the MDT Production Lite Touch x64 Boot image to WDS in preparation for the deployment. In this procedure, we assume that WDS is already installed and initialized on MDT01 as described in the [Prepare for Windows deployment](prepare-for-windows-deployment-with-mdt.md#install-and-initialize-windows-deployment-services-wds) article. + +On **MDT01**: + +1. Open the Windows Deployment Services console, expand the **Servers** node and then expand **MDT01.contoso.com**. + +2. Right-click **Boot Images** and select **Add Boot Image**. + +3. Browse to the **D:\\MDTProduction\\Boot\\LiteTouchPE\_x64.wim** file and add the image with the default settings. + + ![figure 9.](../images/mdt-07-fig10.png) + + The boot image added to the WDS console. + +### Deploy the Windows 10 client + +At this point, you should have a solution ready for deploying the Windows 10 client. We recommend starting by trying a few deployments at a time until you are confident that your configuration works as expected. We find it useful to try some initial tests on virtual machines before testing on physical hardware. This helps rule out hardware issues when testing or troubleshooting. Here are the steps to deploy your Windows 10 image to a virtual machine: + +On **HV01**: + +1. Create a virtual machine with the following settings: + + - Name: PC0005 + - Store the virtual machine in a different location: C:\VM + - Generation: 2 + - Memory: 2048 MB + - Network: Must be able to connect to \\MDT01\MDTProduction$ + - Hard disk: 60 GB (dynamic disk) + - Installation Options: Install an operating system from a network-based installation server + +2. Start the PC0005 virtual machine, and press **Enter** to start the PXE boot. The VM will now load the Windows PE boot image from the WDS server. + + ![figure 10.](../images/mdt-07-fig11.png) + + The initial PXE boot process of PC0005. + +3. After Windows PE has booted, complete the Windows Deployment Wizard using the following setting: + + - Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + - Computer Name: **PC0005** + - Applications: Select the **Install - Adobe Reader** checkbox. + +4. Setup now begins and does the following: + + - Installs the Windows 10 Enterprise operating system. + - Installs the added application. + - Updates the operating system via your local Windows Server Update Services (WSUS) server. + + ![pc0005 image1.](../images/pc0005-vm.png) + +### Application installation + +Following OS installation, Microsoft Office 365 Pro Plus - x64 is installed automatically. + + ![pc0005 image2.](../images/pc0005-vm-office.png) + +### Use the MDT monitoring feature + +Since you have enabled the monitoring on the MDT Production deployment share, you can follow your deployment of PC0005 via the monitoring node. + +On **MDT01**: + +1. In the Deployment Workbench, expand the **MDT Production** deployment share folder. + +2. Select the **Monitoring** node, and wait until you see PC0005. + +3. Double-click PC0005, and review the information. + + ![figure 11.](../images/mdt-07-fig13.png) + + The Monitoring node, showing the deployment progress of PC0005. + +### Use information in the Event Viewer + +When monitoring is enabled, MDT also writes information to the event viewer on MDT01. This information can be used to trigger notifications via scheduled tasks when deployment is completed. For example, you can configure scheduled tasks to send an email when a certain event is created in the event log. + +![figure 12.](../images/mdt-07-fig14.png) + +The Event Viewer showing a successful deployment of PC0005. + +## Multicast deployments + +Multicast deployment allows for image deployment with reduced network load during simultaneous deployments. Multicast is a useful operating system deployment feature in MDT deployments, however it is important to ensure that your network supports it and is designed for it. If you have a limited number of simultaneous deployments, you probably do not need to enable multicast. + +### Requirements + +Multicast requires that Windows Deployment Services (WDS) is running on Windows Server 2008 or later. In addition to the core MDT setup for multicast, the network needs to be configured to support multicast. In general, this means involving the organization networking team to make sure that +Internet Group Management Protocol (IGMP) snooping is turned on and that the network is designed for multicast traffic. The multicast solution uses IGMPv3. + +### Set up MDT for multicast + +Setting up MDT for multicast is straightforward. You enable multicast on the deployment share, and MDT takes care of the rest. + +On **MDT01**: + +1. In the Deployment Workbench, right-click the **MDT Production** deployment share folder and select **Properties**. +2. On the **General** tab, select the **Enable multicast for this deployment share (requires Windows Server 2008 R2 Windows Deployment Services)** check box, and click **OK**. +3. Right-click the **MDT Production** deployment share folder and select **Update Deployment Share**. +4. After updating the deployment share, use the Windows Deployment Services console to, verify that the multicast namespace was created. + + ![figure 13.](../images/mdt-07-fig15.png) + + The newly created multicast namespace. + +## Use offline media to deploy Windows 10 + +In addition to network-based deployments, MDT supports the use of offline media-based deployments of Windows 10. You can very easily generate an offline version of your deployment share - either the full deployment share or a subset of it - through the use of selection profiles. The generated offline media can be burned to a DVD or copied to a USB stick for deployment. + +Offline media are useful not only when you do not have network connectivity to the deployment share, but also when you have limited connection to the deployment share and do not want to copy 5 GB of data over the wire. Offline media can still join the domain, but you save the transfer of operating system images, drivers, and applications over the wire. + +### Create the offline media selection profile + +To filter what is being added to the media, you create a selection profile. When creating selection profiles, you quickly realize the benefits of having created a good logical folder structure in the Deployment Workbench. + +On **MDT01**: + +1. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click **Selection Profiles**, and select **New Selection Profile**. + +2. Use the following settings for the New Selection Profile Wizard: + + - General Settings + - Selection profile name: Windows 10 Offline Media + + - Folders + - Applications / Adobe + - Operating Systems / Windows 10 + - Out-Of-Box Drivers / WinPE x64 + - Out-Of-Box Drivers / Windows 10 x64 + - Task Sequences / Windows 10 + + ![offline media.](../images/mdt-offline-media.png) + +### Create the offline media + +In these steps, you generate offline media from the MDT Production deployment share. To filter what is being added to the media, you use the previously created selection profile. + +1. On MDT01, using File Explorer, create the **D:\\MDTOfflineMedia** folder. + + >[!NOTE] + >When creating offline media, you need to create the target folder first. It is crucial that you do not create a subfolder inside the deployment share folder because it will break the offline media. + +2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration** node, right-click the **Media** node, and select **New Media**. + +3. Use the following settings for the New Media Wizard: + - General Settings + - Media path: **D:\\MDTOfflineMedia** + - Selection profile: **Windows 10 Offline Media** + +### Configure the offline media + +Offline media has its own rules, its own Bootstrap.ini and CustomSettings.ini files. These files are stored in the Control folder of the offline media; they also can be accessed via properties of the offline media in the Deployment Workbench. + +On **MDT01**: + +1. Copy the CustomSettings.ini file from the **D:\MDTProduction\Control** folder to **D:\\MDTOfflineMedia\\Content\\Deploy\\Control**. Overwrite the existing files. + +2. In the Deployment Workbench, under the **MDT Production / Advanced Configuration / Media** node, right-click the **MEDIA001** media, and select **Properties**. + +3. In the **General** tab, configure the following: + - Clear the Generate x86 boot image check box. + - ISO file name: Windows 10 Offline Media.iso + +4. On the **Windows PE** tab, in the **Platform** drop-down list, select **x64**. + +5. On the **General** sub tab, configure the following settings: + - In the **Lite Touch Boot Image Settings** area: + - Image description: MDT Production x64 + - In the **Windows PE Customizations** area, set the Scratch space size to 128. + +6. On the **Drivers and Patches** sub tab, select the **WinPE x64** selection profile and select the **Include all drivers from the selection profile** option. + +7. Click **OK**. + +### Generate the offline media + +You have now configured the offline media deployment share, however the share has not yet been populated with the files required for deployment. Now everything is ready you populate the deployment share content folder and generate the offline media ISO. + +On **MDT01**: + +1. In the Deployment Workbench, navigate to the **MDT Production / Advanced Configuration / Media** node. + +2. Right-click the **MEDIA001** media, and select **Update Media Content**. The Update Media Content process now generates the offline media in the **D:\\MDTOfflineMedia\\Content** folder. The process might require several minutes. + +### Create a bootable USB stick + +The ISO that you got when updating the offline media item can be burned to a DVD and used directly (it will be bootable), but it is often more efficient to use USB sticks instead since they are faster and can hold more data. (A dual-layer DVD is limited to 8.5 GB.) + +>[!TIP] +>In this example, the .wim file is 5.5 GB in size. However, bootable USB sticks are formatted with the FAT32 file system which limits file size to 4.0 GB. You can place the image on a different drive (ex: E:\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.swm) and then modify E:\Deploy\Control\OperatingSystems.xml to point to it. Alternatively to keep using the USB you must split the .wim file, which can be done using DISM:
     
    Dism /Split-Image /ImageFile:D:\MDTOfflinemedia\Content\Deploy\Operating Systems\W10EX64RTM\REFW10X64-001.wim /SWMFile:E:\sources\install.swm /FileSize:3800.
     
    Windows Setup automatically installs from this file, provided you name it install.swm. The file names for the next files include numbers, for example: install2.swm, install3.swm.
     
    To enable split image in MDT, the Settings.xml file in your deployment share (ex: D:\MDTProduction\Control\Settings.xml) must have the **SkipWimSplit** value set to **False**. By default this value is set to True (`True`), so this must be changed and the offline media content updated. + +Follow these steps to create a bootable USB stick from the offline media content: + +1. On a physical machine running Windows 7 or later, insert the USB stick you want to use. + +2. Copy the content of the **MDTOfflineMedia\\Content** folder to the root of the USB stick. + +3. Start an elevated command prompt (run as Administrator), and start the Diskpart utility by typing **Diskpart** and pressing **Enter**. + +4. In the Diskpart utility, you can type **list volume** (or the shorter **list vol**) to list the volumes, but you really only need to remember the drive letter of the USB stick to which you copied the content. In our example, the USB stick had the drive letter F. + +5. In the Diskpart utility, type **select volume F** (replace F with your USB stick drive letter). + +6. In the Diskpart utility, type **active**, and then type **exit**. + +## Unified Extensible Firmware Interface (UEFI)-based deployments + +As referenced in [Windows 10 deployment scenarios and tools](../windows-deployment-scenarios-and-tools.md), Unified Extensible Firmware Interface (UEFI)-based deployments are becoming more common. In fact, when you create a generation 2 virtual machine in Hyper-V, you get a UEFI-based computer. During deployment, MDT automatically detects that you have an UEFI-based machine and creates the partitions UEFI requires. You do not need to update or change your task sequences in any way to accommodate UEFI. + +![figure 14.](../images/mdt-07-fig16.png) + +The partitions when deploying an UEFI-based machine. + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    +[Configure MDT settings](configure-mdt-settings.md)
    diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index dc5907ae88..59ab2b1a39 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -20,6 +20,7 @@ ms.topic: article **Applies to** - Windows 10 +- Windows 11 This article provides an overview of the features, components, and capabilities of the [Microsoft Deployment Toolkit (MDT)](/mem/configmgr/mdt/). When you have finished reviewing this information, see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). diff --git a/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-mdt.md b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-mdt.md new file mode 100644 index 0000000000..96f5180256 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/prepare-for-windows-deployment-mdt.md @@ -0,0 +1,262 @@ +--- +title: Prepare for deployment with MDT (Windows 10) +description: This topic will walk you through the steps necessary to create the server structure required to deploy the Windows 10 operating system using the Microsoft Deployment Toolkit (MDT). +ms.assetid: 5103c418-0c61-414b-b93c-a8e8207d1226 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, system requirements +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Prepare for deployment with MDT + +**Applies to** +- Windows 11 + +This article will walk you through the steps necessary to prepare your network and server infrastructure to deploy Windows 11 with the Microsoft Deployment Toolkit (MDT). It covers the installation of the necessary system prerequisites, the creation of shared folders and service accounts, and the configuration of security permissions in the file system and in Active Directory. + +## Infrastructure + +The procedures in this guide use the following names and infrastructure. + +### Network and servers + +For the purposes of this topic, we will use three server computers: **DC01**, **MDT01**, and **HV01**. +- All servers are running Windows Server 2019. + - You can use an earlier version of Windows Server with minor modifications to some procedures. + - Note: Although MDT supports Windows Server 2008 R2, at least Windows Server 2012 R2 or later is required to perform the procedures in this guide. +- **DC01** is a domain controller, DHCP server, and DNS server for contoso.com, representing the fictitious Contoso Corporation. +- **MDT01** is a domain member server in contoso.com with a data (D:) drive that can store at least 200GB. MDT01 will host deployment shares and run the Windows Deployment Service. Optionally, MDT01 is also a WSUS server. + - A second MDT server (**MDT02**) configured identically to MDT01 is optionally used to [build a distributed environment](build-a-distributed-environment-for-windows-10-deployment.md) for Windows 10 deployment. This server is located on a different subnet than MDT01 and has a different default gateway. +- **HV01** is a Hyper-V host computer that is used to build a Windows 10 reference image. + - See [Hyper-V requirements](#hyper-v-requirements) below for more information about HV01. + +### Client computers + +Several client computers are referenced in this guide with hostnames of PC0001 to PC0007. + +- **PC0001**: A computer running Windows 10 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. + - Client name: PC0001 + - IP Address: DHCP +- **PC0002**: A computer running Windows 7 SP1 Enterprise x64, fully patched with the latest security updates, and configured as a member in the contoso.com domain. This computer is referenced during the migration scenarios. + - Client name: PC0002 + - IP Address: DHCP +- **PC0003 - PC0007**: These are other client computers similar to PC0001 and PC0002 that are used in this guide and another guide for various scenarios. The device names are incremented for clarity within each scenario. For example, PC0003 and PC0004 are running Windows 7 just like PC0002, but are used for Configuration Manager refresh and replace scenarios, respectively. + +### Storage requirements + +MDT01 and HV01 should have the ability to store up to 200 GB of files on a data drive (D:). If you use a computer with a single system partition (C:), you will need to adjust some procedures in this guide to specify the C: drive instead of the D: drive. + +### Hyper-V requirements + +If you do not have access to a Hyper-V server, you can install Hyper-V on a Windows 10 or Windows 8.1 computer temporarily to use for building reference images. For instructions on how to enable Hyper-V on Windows 10, see the [Verify support and install Hyper-V](../windows-10-poc.md#verify-support-and-install-hyper-v) section in the Windows 10 deployment test lab guide. This guide is a proof-of-concept guide that has detailed instructions for installing Hyper-V. + +### Network requirements + +All server and client computers referenced in this guide are on the same subnet. This is not required, but each server and client computer must be able to connect to each other to share files, and to resolve all DNS names and Active Directory information for the contoso.com domain. Internet connectivity is also required to download OS and application updates. + +### Domain credentials + +The following generic credentials are used in this guide. You should replace these credentials as they appear in each procedure with your credentials. + +**Active Directory domain name**: contoso.com
    +**Domain administrator username**: administrator
    +**Domain administrator password**: pass@word1 + +### Organizational unit structure + +The following OU structure is used in this guide. Instructions are provided [below](#create-the-ou-structure) to help you create the required OUs. + +![figure 2.](../images/mdt-01-fig02.jpg) + +## Install the Windows ADK + +These steps assume that you have the MDT01 member server running and configured as a domain member server. + +On **MDT01**: + +Visit the [Download and install the Windows ADK](/windows-hardware/get-started/adk-install) page and download the following items to the **D:\\Downloads\\ADK** folder on MDT01 (you will need to create this folder): +- [The Windows ADK for Windows 10](https://go.microsoft.com/fwlink/?linkid=2086042) +- [The Windows PE add-on for the ADK](https://go.microsoft.com/fwlink/?linkid=2087112) +- [The Windows System Image Manager (WSIM) 1903 update](https://go.microsoft.com/fwlink/?linkid=2095334) +- (Optional) [The MDT_KB4564442 patch for BIOS firmware](https://download.microsoft.com/download/3/0/6/306AC1B2-59BE-43B8-8C65-E141EF287A5E/KB4564442/MDT_KB4564442.exe) + - This patch is needed to resolve a bug that causes detection of BIOS-based machines as UEFI-based machines. If you have a UEFI deployment, you do not need this patch. + +>[!TIP] +>You might need to temporarily disable IE Enhanced Security Configuration for administrators in order to download files from the Internet to the server. This setting can be disabled by using Server Manager (Local Server/Properties). + +1. On **MDT01**, ensure that you are signed in as an administrator in the CONTOSO domain. + - For the purposes of this guide, we are using a Domain Admin account of **administrator** with a password of pass@word1. You can use your own administrator username and password as long as you properly adjust all steps in this guide that use these login credentials. +2. Start the **ADK Setup** (D:\\Downloads\\ADK\\adksetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page accept the default list of features by clicking **Install**. This will install deployment tools and the USMT. Verify that the installation completes successfully before moving to the next step. +3. Start the **WinPE Setup** (D:\\Downloads\\ADK\\adkwinpesetup.exe), click **Next** twice to accept the default installation parameters, click **Accept** to accept the license agreement, and then on the **Select the features you want to install** page click **Install**. This will install Windows PE for x86, AMD64, ARM, and ARM64. Verify that the installation completes successfully before moving to the next step. +4. Extract the **WSIM 1903 update** (D:\\Downloads\ADK\\WSIM1903.zip) and then run the **UpdateWSIM.bat** file. + - You can confirm that the update is applied by viewing properties of the ImageCat.exe and ImgMgr.exe files at **C:\\Program Files (x86)\\Windows Kits\\10\\Assessment and Deployment Kit\\Deployment Tools\\WSIM** and verifying that the **Details** tab displays a **File version** of **10.0.18362.144** or later. +5. If you downloaded the optional MDT_KB4564442 patch for BIOS based deployment, see [this support article](https://support.microsoft.com/en-us/topic/windows-10-deployments-fail-with-microsoft-deployment-toolkit-on-computers-with-bios-type-firmware-70557b0b-6be3-81d2-556f-b313e29e2cb7) for instructions on how to install the patch. + +## Install and initialize Windows Deployment Services (WDS) + +On **MDT01**: + +1. Open an elevated Windows PowerShell prompt and enter the following command: + + ```powershell + Install-WindowsFeature -Name WDS -IncludeManagementTools + WDSUTIL /Verbose /Progress /Initialize-Server /Server:MDT01 /RemInst:"D:\RemoteInstall" + WDSUTIL /Set-Server /AnswerClients:All + ``` + +## Optional: Install Windows Server Update Services (WSUS) + +If you wish to use MDT as a WSUS server using the Windows Internal Database (WID), use the following command to install this service. Alternatively, change the WSUS server information in this guide to the WSUS server in your environment. + +To install WSUS on MDT01, enter the following at an elevated Windows PowerShell prompt: + + ```powershell + Install-WindowsFeature -Name UpdateServices, UpdateServices-WidDB, UpdateServices-Services, UpdateServices-RSAT, UpdateServices-API, UpdateServices-UI + cmd /c "C:\Program Files\Update Services\Tools\wsusutil.exe" postinstall CONTENT_DIR=C:\WSUS + ``` + +>To use the WSUS that you have installed on MDT01, you must also [configure Group Policy](../update/waas-manage-updates-wsus.md#configure-automatic-updates-and-update-service-location) on DC01 and perform the neccessary post-installation configuration of WSUS on MDT01. + +## Install MDT + +>[!NOTE] +>MDT installation requires the following: +>- The Windows ADK for Windows 10 (installed in the previous procedure) +>- Windows PowerShell ([version 5.1](https://www.microsoft.com/download/details.aspx?id=54616) is recommended; type **$host** to check) +>- Microsoft .NET Framework + +On **MDT01**: + +1. Visit the [MDT resource page](/mem/configmgr/mdt/) and click **Download MDT**. +2. Save the **MicrosoftDeploymentToolkit_x64.msi** file to the D:\\Downloads\\MDT folder on MDT01. + - **Note**: As of the publishing date for this guide, the current version of MDT is 8456 (6.3.8456.1000), but a later version will also work. +3. Install **MDT** (D:\\Downloads\\MDT\\MicrosoftDeploymentToolkit_x64.exe) with the default settings. + +## Create the OU structure + +Switch to **DC01** and perform the following procedures on **DC01**: + +To create the OU structure, you can use the Active Directory Users and Computers console (dsa.msc), or you can use Windows PowerShell. + +Copy the following list of OU names and paths into a CSV file and save it as `~\Setup\Scripts\oulist.csv`. + +```csv +OUName,OUPath +Contoso,"DC=CONTOSO,DC=COM" +Accounts,"OU=Contoso,DC=CONTOSO,DC=COM" +Computers,"OU=Contoso,DC=CONTOSO,DC=COM" +Groups,"OU=Contoso,DC=CONTOSO,DC=COM" +Admins,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Service Accounts,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Users,"OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" +Servers,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" +Workstations,"OU=Computers,OU=Contoso,DC=CONTOSO,DC=COM" +Security Groups,"OU=Groups,OU=Contoso,DC=CONTOSO,DC=COM" +``` + +Next, copy the following commands into a file and save it as `~\Setup\Scripts\ou.ps1`. Be sure that you are viewing file extensions and that you save the file with the `.ps1` extension. + +```powershell +Import-CSV -Path $home\Setup\Scripts\oulist.csv | ForEach-Object { + New-ADOrganizationalUnit -Name $_.ouname -Path $_.oupath + Write-Host -ForegroundColor Green "OU $($_.ouname) is created in the location $($_.oupath)" +} +``` + +Lastly, open an elevated Windows PowerShell prompt on DC01 and run the `ou.ps1` script: + +```powershell +Set-ExecutionPolicy -ExecutionPolicy RemoteSigned -Force +Set-Location $home\Setup\Scripts +.\ou.ps1 +``` + +This will create an OU structure as shown below. + +![OU structure.](../images/mdt-05-fig07.png) + +To use the Active Directory Users and Computers console (instead of PowerShell): + +On **DC01**: + +1. Using the Active Directory Users and Computers console (dsa.msc), in the contoso.com domain level, create a top-level OU named **Contoso**. +2. In the **Contoso** OU, create the following OUs: + 1. Accounts + 2. Computers + 3. Groups +3. In the **Contoso / Accounts** OU, create the following underlying OUs: + 1. Admins + 2. Service Accounts + 3. Users +4. In the **Contoso / Computers** OU, create the following underlying OUs: + 1. Servers + 2. Workstations +5. In the **Contoso / Groups** OU, create the following OU: + 1. Security Groups + +The final result of either method is shown below. The **MDT_BA** account will be created next. + +## Create the MDT service account + +When creating a reference image, you need an account for MDT. The MDT build account is used for Windows Preinstallation Environment (Windows PE) to connect to MDT01. + +To create an MDT build account, open an elevated Windows PowerShell prompt on DC01 and enter the following (copy and paste the entire command, taking care to notice the scroll bar at the bottom). This command will create the MDT_BA user account and set the password to "pass@word1": + +```powershell +New-ADUser -Name MDT_BA -UserPrincipalName MDT_BA -path "OU=Service Accounts,OU=Accounts,OU=Contoso,DC=CONTOSO,DC=COM" -Description "MDT Build Account" -AccountPassword (ConvertTo-SecureString "pass@word1" -AsPlainText -Force) -ChangePasswordAtLogon $false -PasswordNeverExpires $true -Enabled $true +``` +If you have the Active Directory Users and Computers console open you can refresh the view and see this new account in the **Contoso\Accounts\Service Accounts** OU as shown in the screenshot above. + +## Create and share the logs folder + +By default MDT stores the log files locally on the client. In order to capture a reference image, you will need to enable server-side logging and, to do that, you will need to have a folder in which to store the logs. For more information, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). + +On **MDT01**: + +1. Sign in as **CONTOSO\\administrator**. +2. Create and share the **D:\\Logs** folder by running the following commands in an elevated Windows PowerShell prompt: + + ```powershell + New-Item -Path D:\Logs -ItemType directory + New-SmbShare -Name Logs$ -Path D:\Logs -ChangeAccess EVERYONE + icacls D:\Logs /grant '"MDT_BA":(OI)(CI)(M)' + ``` + +See the following example: + +![Logs folder.](../images/mdt-05-fig08.png) + +## Use CMTrace to read log files (optional) + +The log files in MDT Lite Touch are formatted to be read by Configuration Manager Trace ([CMTrace](/sccm/core/support/cmtrace)), which is available as part of the [Microsoft System 2012 R2 Center Configuration Manager Toolkit](https://go.microsoft.com/fwlink/p/?LinkId=734717). You should also download this tool. +You can use Notepad (example below): + +![figure 8.](../images/mdt-05-fig09.png) + +Alternatively, CMTrace formatting makes the logs much easier to read. See the same log file below, opened in CMTrace: + +![figure 9.](../images/mdt-05-fig10.png) + +After installing the ConfigMgrTools.msi file, you can search for **cmtrace** and pin the tool to your taskbar for easy access. + +## Next steps + +When you have completed all the steps in this section to prepare for deployment, see [Create a Windows 10 reference image](create-a-windows-10-reference-image.md). + +## Appendix + +**Sample files** + +The following sample files are also available to help automate some MDT deployment tasks. This guide does not use these files, but they are made available here so you can see how some tasks can be automated with Windows PowerShell. +- [Gather.ps1](/samples/browse/?redirectedfrom=TechNet-Gallery). This sample Windows PowerShell script performs the MDT Gather process in a simulated MDT environment. This allows you to test the MDT gather process and check to see if it is working correctly without performing a full Windows deployment. +- [Set-OUPermissions.ps1](https://go.microsoft.com/fwlink/p/?LinkId=619362). This sample Windows PowerShell script creates a domain account and then configures OU permissions to allow the account to join machines to the domain in the specified OU. +- [MDTSample.zip](https://go.microsoft.com/fwlink/p/?LinkId=619363). This sample web service shows you how to configure a computer name dynamically using MDT. diff --git a/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md b/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md new file mode 100644 index 0000000000..f1aa143648 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/refresh-a-windows-10-computer-with-windows-11.md @@ -0,0 +1,120 @@ +--- +title: Refresh a Windows 7 computer with Windows 10 (Windows 10) +description: This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the computer refresh process. +ms.assetid: 2866fb3c-4909-4c25-b083-6fc1f7869f6f +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: reinstallation, customize, template, script, restore +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Refresh a Windows 7 computer with Windows 10 + +**Applies to** +- Windows 10 + +This topic will show you how to use MDT Lite Touch Installation (LTI) to upgrade a Windows 7 computer to a Windows 10 computer using the online computer refresh process. The computer refresh scenario is a reinstallation of an updated operating system on the same computer. You can also use this procedure to reinstall the same OS version. In this article, the computer refresh will be done while the computer is online. MDT also supports an offline computer refresh. For more info on that scenario, see the USMTOfflineMigration property on the [MDT resource page](/mem/configmgr/mdt/). + +For the purposes of this topic, we will use three computers: DC01, MDT01, and PC0001. +- DC01 is a domain controller for the contoso.com domain. +- MDT01 is domain member server that hosts your deployment share. +- PC0001 is a domain member computer running a previous version of Windows that is going to be refreshed to a new version of Windows 10, with data and settings restored. The example used here is a computer running Windows 7 SP1. + +Both DC01 and MDT01 are running Windows Server 2019; however any supported version of Windows Server can be used. For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +![computers.](../images/mdt-04-fig01.png "Computers used in this topic") + +The computers used in this topic. + +## The computer refresh process + +A computer refresh is not the same as an in-place upgrade because a computer refresh involves exporting user data and settings then wiping the device before installing a fresh OS and restoring the user's data and settings. + +For a computer refresh with MDT, you use the User State Migration Tool (USMT), which is part of the Windows Assessment and Deployment Kit (ADK) for Windows 10, to migrate user data and settings. To complete a computer refresh you will: + +1. Back up data and settings locally, in a backup folder. +2. Wipe the partition, except for the backup folder. +3. Apply the new operating system image. +4. Install other applications. +5. Restore data and settings. + +During the computer refresh, USMT uses a feature called Hard-Link Migration Store. When you use this feature, the files are simply linked in the file system, which allows for fast migration, even when there is a lot of data. + +>[!NOTE] +>In addition to the USMT backup, you can enable an optional full Windows Imaging (WIM) backup of the machine by configuring the MDT rules. If you do this, a .wim file is created in addition to the USMT backup. The .wim file contains the entire volume from the computer and helpdesk personnel can extract content from it if needed. Please note that this is a data WIM backup only. Using this backup to restore the entire computer is not a supported scenario. + +### Multi-user migration + +By default, ScanState in USMT backs up all profiles on the machine, including local computer profiles. If you have a computer that has been in your environment for a while, it likely has several domain-based profiles on it, including those of former users. You can limit which profiles are backed up by configuring command-line switches to ScanState (added as rules in MDT). + +For example, the following line configures USMT to migrate only domain user profiles and not profiles from the local SAM account database: ScanStateArgs=/ue:\*\\\* /ui:CONTOSO\\\* + +>[!NOTE] +>You also can combine the preceding switches with the /uel switch, which excludes profiles that have not been accessed within a specific number of days. For example, adding /uel:60 will configure ScanState (or LoadState) not to include profiles that haven't been accessed for more than 60 days. + +### Support for additional settings + +In addition to the command-line switches that control which profiles to migrate, [XML templates](../usmt/understanding-migration-xml-files.md) control exactly what data is being migrated. You can control data within and outside the user profiles. + +### Multicast + +Multicast is a technology designed to optimize simultaneous deployment to multiple devices. If you have a limited number of simultaneous deployments, you should disable multicast which was [configured in a previous procedure](deploy-a-windows-10-image-using-mdt.md#set-up-mdt-for-multicast) in this guide. Disabling multicast will speed up deployment for a small number of computers. You will need to update the deployment share after changing this setting. + +## Refresh a Windows 7 SP1 client + +In these section, we assume that you have already performed the prerequisite procedures in the following topics, so that you have a deployment share named **MDTProduction$** on MDT01: + +- [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md) +- [Create a Windows 10 reference image](create-a-windows-10-reference-image.md) +- [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md) + +It is also assumed that you have a domain member client computer named PC0001 in your environment running Windows 7, 8.1 or 10 that is ready for a refresh to the latest version of Windows 10. For demonstration purposes, we will refreshing a Windows 7 SP1 PC to Windows 10, version 1909. + +### Upgrade (refresh) a Windows 7 SP1 client + +>[!IMPORTANT] +>Domain join details [specified in the deployment share rules](deploy-a-windows-10-image-using-mdt.md#configure-the-rules) will be used to rejoin the computer to the domain during the refresh process. If the Windows 7 client is domain-jonied in a different OU than the one specified by MachineObjectOU, the domain join process will initially fail and then retry without specifying an OU. If the domain account that is specified (ex: **MDT_JD**) has [permissions limited to a specific OU](deploy-a-windows-10-image-using-mdt.md#step-1-configure-active-directory-permissions) then the domain join will ultimately fail, the refresh process will proceed, and the client computer object will be orphaned in Active Directory. In the current guide, computer objects should be located in Contoso > Computers > Workstations. Use the Active Directory Users and Computers console to review the location of computer objects and move them if needed. To diagnose MDT domain join errors, see **ZTIDomainJoin.log** in the C:\Windows\Temp\DeploymentLogs directory on the client computer. + +1. On PC0001, sign in as **contoso\\Administrator** and start the Lite Touch Deploy Wizard by opening **\\\\MDT01\\MDTProduction$\\Scripts\\Litetouch.vbs**. +2. Complete the deployment guide using the following settings: + + * Select a task sequence to execute on this computer: Windows 10 Enterprise x64 RTM Custom Image + * Computer name: <default> + * Specify where to save a complete computer backup: Do not back up the existing computer + >[!NOTE] + >Skip this optional full WIM backup that we are choosing not to perform. The USMT backup will still run. + * Select one or more applications to install: Install - Adobe Reader + + ![Computer refresh.](../images/fig2-taskseq.png "Start the computer refresh") + +4. Setup starts and does the following: + + * Backs up user settings and data using USMT. + * Installs the Windows 10 Enterprise x64 operating system. + * Installs any added applications. + * Updates the operating system using your local Windows Server Update Services (WSUS) server. + * Restores user settings and data using USMT. + +5. You can monitor progress of the deployment using the deployment workbench on MDT01. See the following example: + + ![monitor deployment.](../images/monitor-pc0001.png) + +6. After the refresh process completes, sign in to the Windows 10 computer and verify that user accounts, data and settings were migrated. + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    +[Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    +[Replace a Windows 7 computer with a Windows 10 computer](replace-a-windows-7-computer-with-a-windows-10-computer.md)
    +[Configure MDT settings](configure-mdt-settings.md) \ No newline at end of file diff --git a/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md b/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md new file mode 100644 index 0000000000..fb7cfe97e1 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/replace-a-windows-10-computer-with-a-windows-11-computer.md @@ -0,0 +1,165 @@ +--- +title: Replace a Windows 7 computer with a Windows 10 computer (Windows 10) +description: In this article, you will learn how to replace a Windows 7 device with a Windows 10 device. +ms.custom: seo-marvel-apr2020 +ms.assetid: acf091c9-f8f4-4131-9845-625691c09a2a +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: deploy, deployment, replace +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Replace a Windows 7 computer with a Windows 10 computer + +**Applies to** +- Windows 10 + +A computer replace scenario for Windows 10 is quite similar to a computer refresh for Windows 10. However, because you are replacing a device, you cannot store the backup on the old computer. Instead you need to store the backup to a location where the new computer can read it. The User State Migration Tool (USMT) will be used to back up and restore data and settings. + +For the purposes of this topic, we will use four computers: DC01, MDT01, PC0002, and PC0007. +- DC01 is a domain controller for the contoso.com domain. +- MDT01 is domain member server that hosts your deployment share. +- PC0002 is an old computer running Windows 7 SP1 that will be replaced by PC0007. +- PC0007 is a new computer will have the Windows 10 OS installed prior to data from PC0002 being migrated. Both PC0002 and PC0007 are members of the contoso.com domain. + +For more details on the setup for this topic, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +![The computers used in this topic.](../images/mdt-03-fig01.png) + +The computers used in this topic. + +>HV01 is also used in this topic to host the PC0007 virtual machine for demonstration purposes, however typically PC0007 is a physical computer. + +## Prepare for the computer replace + + To prepare for the computer replace, you need to create a folder in which to store the backup and a backup only task sequence to run on the old computer. + +### Configure the rules on the Microsoft Deployment Toolkit (MDT) Production share + +On **MDT01**: + +1. Open the Deployment Workbench, under **Deployment Shares** right-click **MDT Production**, click **Properties**, and then click the **Rules** tab. +2. Change the **SkipUserData=YES** option to **NO**, and click **OK**. +3. Right-click **MDT Production** and click **Update Deployment Share**. Click **Next**, **Next**, and **Finish** to complete the Update Deployment Share Wizard with the default setttings. + +### Create and share the MigData folder + +On **MDT01**: + +1. Create and share the **D:\\MigData** folder by running the following three commands in an elevated Windows PowerShell prompt: + ``` powershell + New-Item -Path D:\MigData -ItemType directory + New-SmbShare -Name MigData$ -Path D:\MigData -ChangeAccess EVERYONE + icacls D:\MigData /grant '"MDT_BA":(OI)(CI)(M)' + ``` + ### Create a backup only (replace) task sequence + +2. In Deployment Workbench, under the **MDT Production** deployment share, select the **Task Sequences** node and create a new folder named **Other**. + +3. Right-click the **Other** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + + * Task sequence ID: REPLACE-001 + * Task sequence name: Backup Only Task Sequence + * Task sequence comments: Run USMT to backup user data and settings + * Template: Standard Client Replace Task Sequence + +4. In the **Other** folder, double-click **Backup Only Task Sequence**, and then in the **Task Sequence** tab, review the sequence. Notice that it only contains a subset of the normal client task sequence actions. + + ![The Backup Only Task Sequence action list.](../images/mdt-03-fig02.png "The Backup Only Task Sequence action list") + + The Backup Only Task Sequence action list. + +## Perform the computer replace + +During a computer replace, these are the high-level steps that occur: + +1. On the computer you are replacing, a special replace task sequence runs the USMT backup and, if you configured it, runs the optional full Window Imaging (WIM) backup. +2. On the new computer, you perform a standard bare-metal deployment. At the end of the bare-metal deployment, the USMT backup from the old computer is restored. + +### Run the replace task sequence + +On **PC0002**: + +1. Sign in as **CONTOSO\\Administrator** and verify that you have write access to the **\\\\MDT01\\MigData$** share. +2. Run **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs**. +3. Complete the Windows Deployment Wizard using the following settings: + + 1. Select a task sequence to execute on this computer: Backup Only Task Sequence + * Specify where to save your data and settings: Specify a location + * Location: \\\\MDT01\\MigData$\\PC0002 + + >[!NOTE] + >If you are replacing the computer at a remote site you should create the MigData folder on MDT02 and use that share instead. + + 2. Specify where to save a complete computer backup: Do not back up the existing computer + + The task sequence will now run USMT (Scanstate.exe) to capture user data and settings of the computer. + + ![The new task sequence.](../images/mdt-03-fig03.png "The new task sequence") + + The new task sequence running the Capture User State action on PC0002. + +4. On **MDT01**, verify that you have an USMT.MIG compressed backup file in the **D:\\MigData\\PC0002\\USMT** folder. + + ![The USMT backup.](../images/mdt-03-fig04.png "The USMT backup") + + The USMT backup of PC0002. + +### Deploy the replacement computer + +To demonstrate deployment of the replacement computer, HV01 is used to host a virtual machine: PC0007. + +On **HV01**: + +1. Create a virtual machine with the following settings: + + * Name: PC0007 + * Location: C:\\VMs + * Generation: 2 + * Memory: 2048 MB + * Hard disk: 60 GB (dynamic disk) + * Install an operating system from a network-based installation server + +2. Start the PC0007 virtual machine, and press **Enter** to start the Pre-Boot Execution Environment (PXE) boot. The VM will now load the Windows PE boot image from MDT01 (or MDT02 if at a remote site). + + ![The initial PXE boot process.](../images/mdt-03-fig05.png "The initial PXE boot process") + + The initial PXE boot process of PC0007. + +3. After Windows Preinstallation Environment (Windows PE) has booted, complete the Windows Deployment Wizard using the following settings: + + * Select a task sequence to execute on this computer: + * Windows 10 Enterprise x64 RTM Custom Image + * Computer Name: PC0007 + * Move Data and Settings: Do not move user data and settings. + * User Data (Restore) > Specify a location: \\\\MDT01\\MigData$\\PC0002 + * Applications: Adobe > Install - Adobe Reader + +4. Setup now starts and does the following: + + * Partitions and formats the disk. + * Installs the Windows 10 Enterprise operating system. + * Installs the application. + * Updates the operating system via your local Windows Server Update Services (WSUS) server. + * Restores the USMT backup from PC0002. + +You can view progress of the process by clicking the Monitoring node in the Deployment Workbrench on MDT01. + +![Monitor progress.](../images/mdt-replace.png) + +## Related topics + +[Get started with the Microsoft Deployment Toolkit (MDT)](get-started-with-the-microsoft-deployment-toolkit.md)
    +[Create a Windows 10 reference image](create-a-windows-10-reference-image.md)
    +[Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md)
    +[Build a distributed environment for Windows 10 deployment](build-a-distributed-environment-for-windows-10-deployment.md)
    +[Refresh a Windows 7 computer with Windows 10](refresh-a-windows-7-computer-with-windows-10.md)
    +[Configure MDT settings](configure-mdt-settings.md) diff --git a/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md new file mode 100644 index 0000000000..41cd6d8006 --- /dev/null +++ b/windows/deployment/deploy-windows-mdt/upgrade-to-windows-11-with-the-microsoft-deployment-toolkit.md @@ -0,0 +1,114 @@ +--- +title: Perform an in-place upgrade to Windows 10 with MDT (Windows 10) +description: The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. +ms.assetid: B8993151-3C1E-4F22-93F4-2C5F2771A460 +ms.reviewer: +manager: laurawi +ms.author: greglin +keywords: upgrade, update, task sequence, deploy +ms.prod: w10 +ms.mktglfcycl: deploy +ms.localizationpriority: medium +ms.sitesec: library +ms.pagetype: mdt +audience: itpro +author: greg-lindsay +ms.topic: article +--- + +# Perform an in-place upgrade to Windows 10 with MDT + +**Applies to** +- Windows 10 + +The simplest path to upgrade PCs that are currently running Windows 7, Windows 8, or Windows 8.1 to Windows 10 is through an in-place upgrade. + +>[!TIP] +>In-place upgrade is the preferred method to use when migrating from Windows 10 to a later release of Windows 10, and is also a preferred method for upgrading from Windows 7 or 8.1 if you do not plan to significantly change the device's configuration or applications. MDT includes an in-place upgrade task sequence template that makes the process really simple. + +In-place upgrade differs from [computer refresh](refresh-a-windows-7-computer-with-windows-10.md) in that you cannot use a custom image to perform the in-place upgrade. In this article we will add a default Windows 10 image to the production deployment share specifically to perform an in-place upgrade. + +Three computers are used in this topic: DC01, MDT01, and PC0002. + +- DC01 is a domain controller for the contoso.com domain +- MDT01 is a domain member server +- PC0002 is a domain member computer running Windows 7 SP1, targeted for the Windows 10 upgrade + + ![computers.](../images/mdt-upgrade.png) + + The computers used in this topic. + +>[!NOTE] +>For details about the setup for the procedures in this article, please see [Prepare for deployment with MDT](prepare-for-windows-deployment-with-mdt.md). + +>If you have already completed all the steps in [Deploy a Windows 10 image using MDT](deploy-a-windows-10-image-using-mdt.md), then you already have a production deployment share and you can skip to [Add Windows 10 Enterprise x64 (full source)](#add-windows-10-enterprise-x64-full-source). + +## Create the MDT production deployment share + +On **MDT01**: + +1. Ensure you are signed on as: contoso\administrator. +2. In the Deployment Workbench console, right-click **Deployment Shares** and select **New Deployment Share**. +3. On the **Path** page, in the **Deployment share path** text box, type **D:\\MDTProduction** and click **Next**. +4. On the **Share** page, in the **Share name** text box, type **MDTProduction$** and click **Next**. +5. On the **Descriptive Name** page, in the **Deployment share description** text box, type **MDT Production** and click **Next**. +6. On the **Options** page, accept the default settings and click **Next** twice, and then click **Finish**. +7. Using File Explorer, verify that you can access the **\\\\MDT01\\MDTProduction$** share. + +## Add Windows 10 Enterprise x64 (full source) + +>If you have already have a Windows 10 [reference image](create-a-windows-10-reference-image.md) in the **MDT Build Lab** deployment share, you can use the deployment workbench to copy and paste this image from the MDT Build Lab share to the MDT Production share and skip the steps in this section. + +On **MDT01**: + +1. Sign in as contoso\\administrator and copy the content of a Windows 10 Enterprise x64 DVD/ISO to the **D:\\Downloads\\Windows 10 Enterprise x64** folder on MDT01, or just insert the DVD or mount an ISO on MDT01. +2. Using the Deployment Workbench, expand the **Deployment Shares** node, and then expand **MDT Production**. +3. Right-click the **Operating Systems** node, and create a new folder named **Windows 10**. +4. Expand the **Operating Systems** node, right-click the **Windows 10** folder, and select **Import Operating System**. Use the following settings for the Import Operating System Wizard: + - Full set of source files + - Source directory: (location of your source files) + - Destination directory name: W10EX64RTM +5. After adding the operating system, in the **Operating Systems / Windows 10** folder, double-click it and change the name to: **Windows 10 Enterprise x64 RTM Default Image**. + +## Create a task sequence to upgrade to Windows 10 Enterprise + +On **MDT01**: + +1. Using the Deployment Workbench, select **Task Sequences** in the **MDT Production** node, and create a folder named **Windows 10**. +2. Right-click the new **Windows 10** folder and select **New Task Sequence**. Use the following settings for the New Task Sequence Wizard: + - Task sequence ID: W10-X64-UPG + - Task sequence name: Windows 10 Enterprise x64 RTM Upgrade + - Template: Standard Client Upgrade Task Sequence + - Select OS: Windows 10 Enterprise x64 RTM Default Image + - Specify Product Key: Do not specify a product key at this time + - Organization: Contoso + - Admin Password: Do not specify an Administrator password at this time + +## Perform the Windows 10 upgrade + +To initiate the in-place upgrade, perform the following steps on PC0002 (the device to be upgraded). + +On **PC0002**: + +1. Start the MDT deployment wizard by running the following command: **\\\\MDT01\\MDTProduction$\\Scripts\\LiteTouch.vbs** +2. Select the **Windows 10 Enterprise x64 RTM Upgrade** task sequence, and then click **Next**. +3. Select one or more applications to install (will appear if you use custom image): Install - Adobe Reader +4. On the **Ready** tab, click **Begin** to start the task sequence. + When the task sequence begins, it automatically initiates the in-place upgrade process by invoking the Windows setup program (Setup.exe) with the necessary command-line parameters to perform an automated upgrade, which preserves all data, settings, apps, and drivers. + +![upgrade1.](../images/upgrademdt-fig5-winupgrade.png) + +
    + +![upgrade2.](../images/mdt-upgrade-proc.png) + +
    + +![upgrade3.](../images/mdt-post-upg.png) + +After the task sequence completes, the computer will be fully upgraded to Windows 10. + +## Related topics + +[Windows 10 deployment scenarios](../windows-10-deployment-scenarios.md)
    +[Microsoft Deployment Toolkit downloads and resources](/mem/configmgr/mdt/) \ No newline at end of file From 02d4e1c26e3209d96bc04be98cbfa6e70ee006c1 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Wed, 1 Sep 2021 13:32:58 -0700 Subject: [PATCH 0148/1214] first --- .../get-started-with-the-microsoft-deployment-toolkit.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md index 59ab2b1a39..7d8a20b736 100644 --- a/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md +++ b/windows/deployment/deploy-windows-mdt/get-started-with-the-microsoft-deployment-toolkit.md @@ -1,5 +1,5 @@ --- -title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10) +title: Get started with the Microsoft Deployment Toolkit (MDT) (Windows 10/11) description: This topic will help you gain a better understanding of how to use the Microsoft Deployment Toolkit (MDT), as part of a Windows operating system deployment. ms.assetid: a256442c-be47-4bb9-a105-c831f58ce3ee ms.reviewer: @@ -37,7 +37,7 @@ MDT supports the deployment of Windows 10, as well as Windows 7, Windows 8.1, MDT has been in existence since 2003, when it was first introduced as Business Desktop Deployment (BDD) 1.0. The toolkit has evolved, both in functionality and popularity, and today it is considered fundamental to Windows operating system and enterprise application deployment. MDT has many useful features, such as: -- **Windows Client support.** Supports Windows 7, Windows 8.1, and Windows 10. +- **Windows Client support.** Supports Windows 7, Windows 8.1, Windows 10, and Windows 11. - **Windows Server support.** Supports Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, and Windows Server 2019. - **Additional operating systems support.** Supports Windows Thin PC and [Windows Embedded POSReady 7](https://www.microsoft.com/en-us/download/details.aspx?id=26558), as well as Windows 8.1 Embedded Industry. - **UEFI support.** Supports deployment to machines using Unified Extensible Firmware Interface (UEFI) version 2.3.1. From cb6d02d109476697d70ea11c7d247d53ab6b902c Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:02:44 -0700 Subject: [PATCH 0149/1214] new article --- .../block-untrusted-fonts-in-enterprise.md | 2 +- .../threat-protection/fips-140-validation.md | 2 +- .../mbsa-removal-and-guidance.md | 2 +- .../msft-security-dev-lifecycle.md | 17 +++++++++++++++++ 4 files changed, 20 insertions(+), 3 deletions(-) create mode 100644 windows/security/threat-protection/msft-security-dev-lifecycle.md diff --git a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md index c1ffec9b59..3fff0198ed 100644 --- a/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md +++ b/windows/security/threat-protection/block-untrusted-fonts-in-enterprise.md @@ -13,7 +13,7 @@ author: dansimp ms.author: dansimp ms.date: 08/14/2017 ms.localizationpriority: medium -ms.technology: mde +ms.technology: other --- # Block untrusted fonts in an enterprise diff --git a/windows/security/threat-protection/fips-140-validation.md b/windows/security/threat-protection/fips-140-validation.md index 9b2b985db5..b7e5fddec5 100644 --- a/windows/security/threat-protection/fips-140-validation.md +++ b/windows/security/threat-protection/fips-140-validation.md @@ -10,7 +10,7 @@ ms.collection: M365-identity-device-management ms.topic: article ms.localizationpriority: medium ms.reviewer: -ms.technology: mde +ms.technology: other --- # FIPS 140-2 Validation diff --git a/windows/security/threat-protection/mbsa-removal-and-guidance.md b/windows/security/threat-protection/mbsa-removal-and-guidance.md index 83a6f5e00b..a12edb4f83 100644 --- a/windows/security/threat-protection/mbsa-removal-and-guidance.md +++ b/windows/security/threat-protection/mbsa-removal-and-guidance.md @@ -9,7 +9,7 @@ ms.author: dansimp author: dansimp ms.reviewer: manager: dansimp -ms.technology: mde +ms.technology: other --- # What is Microsoft Baseline Security Analyzer and its uses? diff --git a/windows/security/threat-protection/msft-security-dev-lifecycle.md b/windows/security/threat-protection/msft-security-dev-lifecycle.md new file mode 100644 index 0000000000..18ce55f174 --- /dev/null +++ b/windows/security/threat-protection/msft-security-dev-lifecycle.md @@ -0,0 +1,17 @@ +--- +title: Microsoft Security Development Lifecycle +description: Download the Microsoft Security Development Lifecycle white paper which covers a security assurance process focused on software development. +ms.prod: m365-security +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.localizationpriority: medium +ms.reviewer: +ms.technology: other +--- + +# Microsoft Security Development Lifecycle + From a32eabdf469edad81bfa879dccf2f2bdb05cfb41 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:19:36 -0700 Subject: [PATCH 0150/1214] Create simplified-sdl.png --- .../images/simplified-sdl.png | Bin 0 -> 218369 bytes 1 file changed, 0 insertions(+), 0 deletions(-) create mode 100644 windows/security/threat-protection/images/simplified-sdl.png diff --git a/windows/security/threat-protection/images/simplified-sdl.png b/windows/security/threat-protection/images/simplified-sdl.png new file mode 100644 index 0000000000000000000000000000000000000000..004814102fc3e8272429bde640e4adc1e752f333 GIT binary patch literal 218369 zcmY(qcR1Vc|2 zSI7*hDS<1;mDjd_Co;dMdOBAshj=!DH`iRW4YjXase#d6I8p%bX}tBV{jOYLXa4sf zbAgWn|AJKb=)Si3Tl<|Him;p56Xd4xp2y=-)A!93`r*_90$uvlGIEX0&5wP8g7AwB zWIDGRLrb|IJhwG?ymo;Kc3#h!2~y;y_SoBl;vu=JS*bG_!Ej{)*jPkvjDG<_KoMYk z63~;2v%`hUQ*sEA7!-x&?Dit9gZMCwTW=%qWkb%_ki<)>3nNL=`8HN_{#-^QC1q~0 zeV<=*o=`(Xp`e!scuh#u0+d7#A?!|B_EZ6X&5W_S%pvn9omHXWYGD`Ns}bZ>myb7a z-h_iqGq?*1oAvF+4J)DSxi{`%s{?nYl7ipT1%QLJU$o5hYW`bEd>1GGL3_e|5 z600DhHq{XU&bJXO=U$hW8$Eybu21Z14m!Nxk9+i3B63D{MXzwUTg~r z8hS|>gXiMZz~?{5&?%Xj=R+y)@Rp>@IVltwioMNmap58h>H+CgminU(C+=f{WOR;^ zy}RYxL7D0o6pNDupvC4;|s=VF1IEGb%Hy=2s>nG3&9wv8KY_peOU)WRzf>Rnl1!4CW&76 zl5D)O2aNkW$|1zncg<6+P0wsLj1)UbQmxJF@m1jc(3nFrA| z3?F`Q96mgB99}uhj}-Xru#xn~vvKGBn~OkhTO@%s%x{lY34feH6CWS{qp#mHOTi2C47P zKOO+rtL#dKV1>72f_ndbnA0ppm%wP1;D2u zE;!@G%azuw-e`XD36dk|VCCW|j%8yIZbzuYwcd^06I<7?$q8g{ITZVw?vhPVx-=rD z)h(>ImJnYzEl|1t@VDR7XvY-KE}YdySiS3Qui1kwMH5uQAcPctW00!7;eTFeNk~BD ztV=^xJ602N)emXE{4w+!;ni-?8i}-vE(lN*s(x#nPH+!UQQyb`W(UJddI!m=C*Z~* z?wB;3DoP!UyibZDxMB8$ePJypDFi!B67@Fe#`Mu{;D9=)b1FSl65{s?z1dVuvT;Ru z(oRVZgzWaDqCC}G8ElYqWG&r631~`t!q|4}1e6M2bJDz`kss2=1oSlV2!wTeSa7T$ zB%N)!L@4L`aFicp|CKK&2!onN3k{K#5i43}iI#4fI>Bf=yfyBO#}73{yHsn#-}zm1 zYH2Hoosm~5NNb(1pzrADWbJI9V0gMR#QF9F!*jYh7ysKl=5^$z!Yk=qu1mXQ-@}lLQnB>{In(%dG7O}c9aCc{y6~Y;#?x2LVl{oP(MaPX`zrN2 zRUu-s(IX`FCi-UkOXv77**;1{e|p`suyiS4g5z5Y5?>9gUq8;Eu0w^d4vYnFB|uic6$H;mj5{`&Qn|972bVd}@f z=$5)vjG}M(s{6#4a>ffP*hYwPeN{B5)JaIRQq8K=$&NjhE7_t%;5UcCt=ByYC@_%! zrtxPF@>g8G@>wR~rXRb$aZPZoxE*$JYBiev?5TrO((ow@o7Be}w>iK9zqx%&uAblj zXh|0BowN@MAiJ=%5BH7ZuUWo&DyR{M|9hD5LqEegdo+%Hx#@`K^K)N@_YxYkb>7IS zoHK?b@WGYg1OBOE$eXj;CUSO$RRiKnQZc({cI+r z()fl(UemK%zj2a_SwmpE0NF$wHoxoE8^k_EEm9oS?=wU83gp zRYN+&b%adjtgDFYrFBpYUjiE(Nv)32!ngY0sz<#?5R-lrf9?f^n8I=x4&SoaOmF8rEdkRt+*yr1I5A z>_ISI9<}My+NQ3qF47aCT=0C%T(Q9M;Y*H#gST;n#yedgcM&x9ax8E}VYI&ABWSI4 z6FCoFM|v;Vk=D|m+sWjNBCyOk+kyUjkE!}kGD_yE^a3n#|JR!abkG(6O5ZP={YhMB zdtF5LXLt)zAJM7;wc5G`y%}Qsk-%iRrM>p&*zu_Dk@wD_uJ^$@r_$-crEYv_{9n}i z^vjjS)K!(<)+aG$ApV#KQ(ts)U~}4Zl{UFhb9^D8;zV_vSl}QOUax#& zR0{*74E9G+d@u&moyX2GI8RU&E9Zte`MWK>JZV5 zUlrjs4#^@|M3Yt_w-NjyO$t8=jf^{I{_M8rmvpb-pXY3h-Xu7$f0%23-0W8jsV9}w zDjK!d8`tZEhJlZI6BE%wn6%5Wlm6Wx3&Prg_iif&3P9<4V_Bs){3ot3eke#4fp4Pm zNLy;A$BF|AMiJs~}Rw+@6be(bwojjNf2jDaK3jCy!? zI}eIKnrltit|`6CX{Zk>E;>4zbaSf~?RPpx{&;9XC8h~`h0djk3MC)iY}_Q8gJY4z z?7a*tM)+!~*MYX}GdFA-3PM3D-uoIJc$x`-VWJo_caU7E1%4R?;A$Y74eUY7msDel{3~JhrN^&vf*3`Zk|geu+4e=y%IuR!Int; zCC9J-++@@9`TU}L!auGEWc_;66tTFX$6;tC)A~iE!aLmdmf%gjm*iinUmNMS7 zKD(J{NhyEIRB(p)d$kkVP4VA5lav*f2*Z0R4cZB2srHIhlmn(Ot9oNN zZA#Qj6=Yq4^0XPMEJrL2%!YIF56dGlz3sl|<;LK-2q zPIe~0CMH^2d8vl*4D73pA=)g5KW72ee}9h($hF_ta(N!?>l|T-WntWFt!GupF^rC2 zk3D=uL8%?kyjnkc;+K88*H82(cqNr@#SclSs#x;M@IohWEL$2%9T=!GDWG?lX(Cim z7ag<@LR6ijFv*h2ewq=GgT;Puc6bS{7t~G@x1a0NBy-=c5|vq@E13{2;lk{Qs@ttT zS?yQ%3rzeiIgT0+@!TfOdxs2md88>;A3Dv>Y?_b^R7--tr;g3;je$(_F8|jKFhYd>LGP3=WFcYJhyt% z4>rL7P?OVST!LdsT6vlD{ofF<=9CXD;cSQv$cM21o331BKhZKPbmy`hSAIDMto9&p zP$_Y>weX~XpoSlhc%Ej{QQ=qXfDIl{XP<2U(Md}wDw1h9nR-W@)=Q~&{S;Sj<8U}r z_Yjv)`=6_gZBx~`SI`14Y3<;PQy#ada($qsKcsZScA~(KR8>Mm6OkPxIv>yhfX0@@ zhABu60fE-VWi`3nT+a=t#;$l&pG^P72q~mDiOTrwlhm5ND6zI;uI?W{J3Sr?-akET z)o1*cmIv!&KSi?>Z=TEMhRL*bxptYRB%SIzR>zNAq$ED5Gkxunp18!>J0+xaLf}jS z^JnMJkrH|y=vwj$#i~G}c`R*Mp805nw3~tjpueTMOHrY;-@Kw{{p;jGnkj=*l?i(A zKy4Lqf1Q%eSxU(H8|jP78Lsec)x`#>Nf6X~G&A(_QdIUu`P?XLwhc%AQ)@ zy1YV-F-p-cvM;nXnu%Kqyx{)Gpu_}@d9{;a?v87}6ZC~Qhjxs?DEt|=Strpw?5iC? zjIy%)G$xKCV%v$%hVJ6(1Fl>2n)OEY+@Q|k0D5FXvPfjn)aT*C;R}|Fuk1fhuaSrA zJmxiMb9E-u{SZ4T72ydMIYD7d=0qDzoB0)X2)P;?)0?I+35nfa(1TbpE^%c~!~IsC z#~PJ4E8Z+!?}guD|Hi(muO1<6oBtRsjb{3{w1$pHOUc!@1K92=$*tf^n|tYQ%+}5|CU(*e zJ;{CRzZu^oz1JqU5&RYIvlcr9ZYGU_RVa%{NjO=OJdVXTY?b4Yf6{czy^*uNk>FiP z#Ier~9A(;IjCr`*I&FeiCtCf}3}1$Mq48S)O9}ZWiITiYhC$zqSHHO9n@B~3!3@Gg zG+`9l3C?!V$H(`lZE3F-B8Cs&f~>q9RPL%OGrq#{A`2EeAl5PG8O)TT7pQ@6kIdNl zGH5<94n{KR#p<^F`PwH|5A&!}nW=AD(AsI90OOF|V6|L?Q)N=3O0J4#c2oC=a#_%< zo&WaAv}Tsmf<{x~EVw2g7kch<1PBU{jv{5WEU=YBm0MLv+(lzRS5@%4bqg5;w_O-> z9dagvL0a8e@UE%`<9gAP77gFyyjuXK3{K0oPX3BA+mleg$6mz8!zh6Y@)-b_$4|{s zpbgVronTpfNiRwrPon`e!{0t*gJ*5yS0EJz@ni??g;AhIfNLBBlv}L8mZmVNd~Wji zd1x;>rJhhmT21f(GzrYoM@!^Y{6oDMZ5+U(S>V0TEMj)qQ^$|JM8e7QsNLA07xOJ zsm>iU{t(_hDq4mYIBlfMF1$KmzrTHt_E?tJ3cbp2JT#O}Ikiq^n?Z$=N{kYP_ldAe za{i!sXkwO-`SKGaL9}8-EO}7D?bjp9JJVT#Cq?r&*y#c~q*MIm7ZK(1?zw;6fZgS9@6AtuTpKxp`F>P@$zYM_5uHD*x(Jx{H;AaAiD1yvRH7DIj>T&J@SVw$bgpmH4FXCAC_xcxFQ{#T~Ft;wBa zmWba)+)TpOUQZu5C_Mk(CDyfcqQ8vMnnT|-As@F}-QL|c8399{mk^vB=3Ih?c@=}= z?7i$0-4x6QWlVeH1$t1BfU@Wwo1_;1h+B$QW~m?NKk9Y}&zK8~RUq1^Z$GmSzY?6f z)qj}Hip}R)Za{ajA6P>eex>=8)VL{Fq9W7sR+no{-Yi+iS%t8LRB4cRDuALO?nB^N z@JRBN^_Ip&TSZ{Y#R%~YXh@Uw;J7IVQ2{TY9onGqzqH9<)Auw~;NX5KGugMMi}#ZA z|780IDd?u1KAi$DJ>DVH=D+s@;PQ3L9Fa#QRdrQS1%xo{zDL6z?0&;u)pemK@mj*Y zx`MrZbmp(BU*sEbg6ygVc{*4Hd7nn5GF9H@sHE1YSzqd>vr@C2A!o}slBCXbFpDbv z+Z}Qvq?Ey2eU2k`hd*4~UG2%d`qosk%{zaV*;<>bHM{plXxZhBY~2)x{@jt_wYSFe zFInf(>q!?JCA~eVg!|7g=Xibm``-_likB_C765sH-o<-zA1N_jFk>!}*LQGp0R0v< z2XN&X-jHO0_b?RBBE4=xiLwvo}p3IzWV6RG@dyR*m zpzH}2c$&@DEo4XqX&zUc=*exHkAv}IE?wka|Btu?k|quU09C1p7d9kG0K_FIHT0#^ z#8zuYXvZ+PUtJeZA8AbxY5Ue91m&v>_I5F!Pj|rEpj)Q9FrCIj8giz6>JmBYe0umf zKRl^pw(4-~{g9u_@2R;d$FFmgSS!1Rf;qfpL^t^Uajr>ky#62X7}N#VY)yzEAZFpu z)-BzU{_qKiKXUXzzj}Z*E+eAJ<)l4c+H-E$0$dyd3mP&{95-+xde)ahfs`)w87sq}&W{NZVA2x73QfA1f|@fBP+ zIDxt@*&y91>y>V*1gpzkdW%OYT;+e^)TdoJJ#MPnHuEoA##t_vWEmE>{7;W}PRoPL zV!yC&k%UR+ZO~y-cRk-lNb!SGv(U=cE8u7FsCDrnEe>~xUG#f>X~C?QpQ`24Ze?4A z(umOre$+=~vXiv z;am*jxbowm_f%NYwWDn~MvlOtn?}xY<1XGX6V&P;Oqif~!(nMEvz;ET7TKJqtMuJh%6F65xn&`27dmVfzJ;|o2tLjE^`(xlw{i=Azn zt*lB>yH8~)X|2-YL~aBnw|RHFUaMJd zn3TEsLvrypc|0PV3^0bIw{&hZ`?N}$tAMC%Xn^>K^@iZzuMR;aCyoKHl z-jD~QdsB~o|G+=r<{iD|rOm$%ir|Gk{2|2@P=3waq)Wfi6^(WxcI6HROV4V155S)! z03$L8=CbspCIX$4?-Ck}gR;cA;8w2b`hdUQ~FdBYXRrRV#e(t|(q8d7rjU;ONCwIgMGahkF;)MIx}+kvS^Jq=%!P z6hL|C?dO^=r*m}ojM~w%Z%|sU51Xhk#pq7FHlk`0(hW`o0N1$035RCszVk&!?($9& z*W${iP6GpX2x)Lvw%#m4vuI9AT?IK7i8RKx4ycFVY0B};W8h9GJC0=lyo7usmT_6U z3kk>~RQfWO6RiMmY5=;_Dv!UdRX3LCIGo!mtsL)*`Urnlxjpv`u#|~xfqyw_b_-JO z;r-P{Q=R!Dogp3V;8s#BX@?`D_d`++fSJFJGZr$0ip-)XR3ny)$ux33{kKiM*C7ul zAvtre+ZTFa#RViDmrKF--amj+wlYC4lIk24EvzKnuNuYEwrq)F;!wXn8P->Wj$5{TfY z*y5mhl55FwFkypBLRE15NoritR_~{JeQs^{uu9eo{~FZ`AGh0WYc%^8r~4>Lj|~w& z6v&rVoHVRsN}3BX>OUG1AJR=LEY2VKWOhR*vD$*&S~nrnsa-!VI`g&uG*^oEeUJJd zvE_Nbf};Jgvvi+-Kg>@`KMr{Tl0l#n@^@=I;Nt#-^B>c&V)0cD{ncsx)$~UR54WCc z)NfghP5&t>Te_x`bi++{!nNe9&HeB^wHF>Gx#XH;^5znT6T&W>&LtU$X#nUr_wO4> zEPuB8ePH!A)AUXI>;Ke9a?w&s6uWFW;ka_irN7fNlq-s%(tF)foFP>k&!E32TN!(B z=hT!Qd-R4zb)9_=AD;-nrnm7(h_C0Yzv1>PUdmb4yOf1t`(@N(etE6%f76}sRDZV} z8tA)NjppOv?>XNOI3@G#^o}vj$tZT*WHe_E_(jcEIV*eG_}4+WhVt$hZO5Ct87Z{q z4eeHKFMc|VOLIMT`+ZMzO6_HQU(Bub7rJo|$7up@8dVoaI{elVOs1x@OdXn1pl&r` zSvHz{*Qy%2cz;=lqrMQe()w6c{>A!-*@ahbvM_8Cb*4 z{CpLo?U>VKiCxsRdkAiqGC*oET7ME!1A^+|X}&jblI2)RZ6d)W^Gj!R!x_9DP)JkF zUXu_UM1H+hwQj*5`F;>wMl2&ZVp*zBrov-OB^)*;Tcthm4jjLlrZy#IZEmt})y^)s z1Y=`6>raB8EYRP>bKpLp3(k!RUI!o^p%wr?S$yd%`28=xbtBz&6){j5zlFmgLpx0ZN~w`F*`J7xX1G_RS`tWbd!! zar&9yA>L}bCu)f1OK827AIu+w=|!6Dk}Lz@r`v8wRUEQ^b^)D#(wq`ng0t~s!~@PT z(%cNA=x0pD5tH%iNOC~ky&0A8j~@;|e$^!%Lx_$B$Qf@>j<&x1{q4=m{ZlSG$N#vU z{1@h3Ex6sU$y;w~`oC1bRv4;w%#X7SYOeG@GCUl!1$B~#m(>Au-kcnbSe&|Q&n(qqpZ+FsTA<88wt{`48Qr8};*i`T}r zBQ3LC25a(CvH60`zqZt(rAzuk$aH)jMSo{nbXtm=dD%kE8Jm! zu=;WuM!%=-k2$@r(a71DjNq6{WjlI4dGsqmb9+QyBhhJz^6x3<;z8ogX?O}O%Zj^% z$^D6#z|Q-ZlUm&}H&-|fobKiwC{#V^CTx&5-MIVfmgabo+v4>Zb9E}RF5lL>RdN=@ zG*hSJyQef(P64H^6+eo$I3I3yQ`_XmjD8r3occPJ@U*LA%w*KHBKIncqBu|K=^G6n zuJ;3~^f4b7gM0J4e>n~FY1Yo{=!%xp+uKFYNO`t=32>8k)olpvY&eO~ut8|Auy{;+ z@y@(lVUCf!&|w{Sc39LImvTIpa3QCJycU;3B!IRoPuW$$n|}XY@y?ufEgRkuqm=Gr zZMUGiS2-Nbm$oq}kPI&!Hh(eqtfN(mIRGmB>U1f+w?};^zb`zgj+ZAYHqA$kV>hv8 zX{Fl~Y9^5{QyD}P#VXK~%d@Dl@9@A-c+yJ8m|5~g8)EvZn_Y)@42zqQA3$x`Wo+%V zBo&;^o&O`-4ik!N4qtjda^nRD$B!YWHl43SORHB)6WR@!gDV;CXLp7Nu(dm%Ha$;} zzP(`^5U2i(J><>qH6iaG>fU~+W=vXrxzJA+mR+OTtYA8;x!v)7Ua;eE4{rF}AynwL zFW!b5_n1VFmulW?RqlDlXl`ttb_uLEG<3V3c?&XKvv>FhVXX94%4f4RAdCmoa0Z+A zBjq%qh>94!VdC>xV8v}h0{oF%6fQW$SC@XkQhX7qeF^XEqd40uBD8NnPB$}$Uj=b< zAWGTkW@fq1D>l{Y`W8hVrpSMF?BWJb`De+z5H?r+r3WS}4{wT+BAWS$7^z(G{pkVl|@B^|$~-w~(_ z7r+iiZnf5(D4JdvcY>`6sH{4;$kYHh>RKo9qn~^R>6lS2CckS_cF8g{o z$BGEhA4joX*r7%54n0QufKK-+0fHiPGD6n;1tEEW=??^z?^g%_;ese9Sg#TENoceKs@h-aWO$|au%KP48Tf7 zH_iNU00_U4eAxeKVFuisA1c@#XG+926|?=c@HJkL&k-qYa(Pn~KETL$luj;6d6kFz z3d;B-R&=UFV3M28qR#JZ#b!u%52y-A&ZC6Ow76GY~}tO#1|> z?pCpEoXp+%YgHH%V!JyHLkdlbl#S|J^rj}(-sgqtgb1kBgkMVUSe6P-A*fZv|1+F` z3G-eXH%T?LSaq|}=8kw%c3rww4KaH4b&{rHl#7dM8^7K;SvD^nis4u#B-n$X^KX_& zJKO|-n&ezI46T04FkFX6i`2q&5}Wh{-kvF!R4=Pt6R7Cx=W@Sz|A5B*N2Nl(h`9UD z_v>ZX<)2&YnrM6coE=e+9g8niE=NO6{pU960yHh|4jKpBzL|z$KIp8Nyq4EXO1#gj z82=`Ft~aC7?G?R6w7hu?JM-UYyFx_vqT$5ft{;AjUY%Z>*0EJ>E`8SX=5}E{d35s6 z*fZV=tfv%l&mH;LxoczT5<6HLc7q(&#fmJ@S6W(G6o zZmqdh3p!o!ar_Xg&Z4TpQC%bMzYq@U5#4{BVyMvdl3SD~;O2CiREJJlwl^);Vw$oe zeWTo_iO9VEiZ}cV!4({5<_ZWZq`{ruET{wt z8fZQ1<_Qg}guZaus4n0gSAIwM{BU=w$@rHTo+hVUW%Zife1qoRbqqH1-$1fF!&;0x zE%6WzWOF9f_0oqPo8#>W@W5S5OwiH7R_k-Zm_J-(ToRL32XB@FfCnO+NVvbB;kE&_ zD5*s<9kpi~)wN8O1-`Q}a!&`9NckH7>1kn6RpWA9&7J%QptAs(3b@=xiw@MR@oi+A zjwqM-O|Wh$FG?a%!v1p`bmey++;GXsR%VNqED;GDN5B6Z@!_&HtpY0d|%Eu6U6__Hf^|%uk%3Bp+^S=@cYC%gmI%Uycz~m zu1AyS$cm|u{3{WHE%Pi0RO-G*C;)QR{F=C*IG^|lpw0$-k<~E>zKAQ%0r-@}-OIxP zz>`MI8qaV08QXmzBrD)cPh|1(O`<#I^g?)(`pueO$5!T-nth=N2|k_+*t-PWUOnBjH# zFy(7{Se5>B0SQCN2CYnSxz64!>D(MQ+K;p3i~gE#1FPM)db4I%S++<4hLdlY=od<4 zeD)F$vPs&Q($X7>htlS@foxZ;b$59Rmfs)lY(1NKQ&7&S8*d@vm_U0Y$^7}QJ`lV~ zj8eCf^lsF}47n7zNX z67ugSl}GnvDVm<0T7JB%Nfi+p?mVuq?%oc)Q=A>S_eqwH{{^6O*go6&Q}*9g@h}Nl zdcFU2-`1PUKthQ^m_m3Rew8sgv#cAN6a7Meq>0C^j5!9I9j+63QERNFaoeGXNk9G5 zRr>YpSgsVar)3P&pR;D9F1!?xKAn~2HkiHCX*Ly+`snlC{SPe0FU|!G+qA3+f{>AW z`yVW|Kpk&J1t2TNW860l;r1Yf8jK?{L)KrOsts1N`{PAG;SaecK zq*@@ZfG;RXMIkGL>X4bie?$* z)W~ePc@R&*XeEOMl#u>Ul~N@eMlpD|cg+3VLhr&Sl0)P7sP$I6A}K1y?gvn7*d;Rg zmx+DWWTCQP5Y{5p4d$Z|C&M0w*aUhl<%SK6@8566Hx-U=MciBGZ> zCTJbmjLQO`#B0F&Xki3ALF$hs0VzIcp{!Dk3EDEtAP_H}TX~(Vctv3Kt-Nb}lg!a` z44bzOJ?|Gez#itg00Dv^`1adhGd`~mt<|UMV))9R>u!JFxR{Yc>#h2j!@dV!fLaLA zL%TnRzxS$F%)MCv1{4VlXli7^-0S@R4XBv!z!Or=zasA_v>AAWVuE%dD()mscK~+) z>4&KbzxI_x)4Z+Skor9j6?-xqY<>9o%OTe)^FKM|W>g?z_pAXjOp8iPivONB?=#i( zj<;6M7v`D0n`;FgJzM7joQ`}O7$JSmeStmR6KSW@YtTNj`_lxbs>jR1>Vi`}2ZUS> zVaOLYV&c1`k^F^FL^9ZQ!EL)ED}bxUR0HZQckmUSiA}{3!gx8jMf2_T+}eA1xpuTr zmCk1@GKvtVmb7)S)(eMy00Xxzk=(TNOC0hD8vg$0|KIHikDzJ^F zlUsnfa$~jCX*Vc0bf*pk4_$tXn;GW_`GFpzRJrSMPwj1WM(BpYBvt6_P?V6}6^6h_ z5G*jVm_G=pGreEW7%@qqSExICnD{Kd#i!W)?`CEMQ7fphP~6|pBxvNjl;P;a?TOu> zhfbQ4f#W`=-m~|G$3?{Q<(|g>%q&e9;u$en`yE?0Ywm$^95iR0F?mpV<71LH8L4n0W(mq5RJk`nlu{6gyPyvv{M zx*3-lLLK=fH|Dx{u$hFugWPip0c!W3vnJf&A7oa2LvCQ%r_4>~FEW1@xjf&Pckewo z>;^lBa&Bo*uWHPi!lEb!Wm1OyRQ#(9X}S1$eJ@Aripm8r7((L{(zPe~j&BzB~5P*9WJ7Sg7 zc}I?Lt>D&E2R2d7PwaiN+e)9aK3%uyZ>~XS2?%ka#swy5RY`fGWpQ zAxfc~OSeU6&}zCYfRB7C_+s>d8@yL)iB=>)(qWN#yg5AoasDO6#VAtWfkTUn!=cf{ zbtC#A9i4n-|KxO ztVGN2MH=Hp); zEZZ=|n#J|=_-A5ZD_g9=rY5h@apQzzqc_|nd-$yC@PqdsFc3{+#f0)ydqoj&W8eTy zOZn-dKo4uO0q1I>F~9j%5@Y1eC)Y5K=dADR`d^HEn>~wE1h!#uLz_ z*$&dRZqiRo)qfXNx2U!7QLrBEg5%@7vA?f|AHvyFN$Y$3Naj4J3!Syt}ILR<>r*GVr|0GuUp{%{t?;@%0}Y^?yy zojN-F=5^t}AOycJv*`4D!jBUwK{EYBUYcPt_Ylj9U5_+{*(uMr7VfwVvj#_kGd+KR z{S41@CtPXyDqqJwNI7r_1C*zpxcEaJ9VN{U2UqIi?P)KXdl2+Vmp1rzG-Ia+Z5d%% zi38Wr>9pGadLr1es&*L-wkNEm_YvrpG=o6ve1|;4QD>hu8@{9&0+6u|=z43*$sfQn_NpR&KGRL=sYQ=*`We5oNDpNj=kFO{Z*X1_ znt$8aviU}7oZ(gzy_zPPE!Tecy0J#Gp}br5qmchf=v6|=s~QqDBsaF>>VseFO@PN6S)!%+8g^_hq%s$S18@rmgasMsGkgX6Y`c7q}K( z^-i6QKeQ}VdSsiGkct(pH_2z-y`pD;)Q%4G`jsVUQd>OSdsp3e$HcMk_52%~z%K$> z-q(m`R})yVx9;CSEdQdY)8>%0b}sy6b~N~e%HPmfG|>bLkUOxd@Ro*hCxmCTqlU(f z&&*}mXR1BdtVb^??M-gkZ=cj_*ROtgUZY@!(o*hQmR%J6IB34`ptzmtfUP=qONRkK zIwcDGPiMt#W3DB+s{^Vu!Z#Sdo!T@fZL zjNV&&2~Hom^9%Q)Z^m)8u)h%DjW7@j#9ha={ssT#^BN$I|o?6@f|yF&BYm;j>&n;Giol4VrKc)6!&uc0Is-sYobL3 zeWC0)Do(&&a%$tpRHbv#9$N})%?Z=ztu2Q@<#JPo;Tck%WMmIy6?1I-JhRs5^Nzos z55IK+mjrOZC=TJx|MGW#-;SjdNoyMUxPtf)Iwfc!q3dy@)P?B(QYe@z6p*2wsyhXi z_7J8RaEyT4Mibf@aJ^i0$cuQ6|DbAIWnQHb_EVj+3)Go|-|GtIqeCXqvV|eFY>&6q zU7LTlKVIeY8!+Ur7_!P4Z7L2rvdAZdZ7cZh5c1DG_0$=7@I*^>2vfy8i|@em=fKH> zOXOQzsoNiQpAMi(m4<6BBg*H0N)Fw@{h8&LazlE9PK|+=UaPsRiFs#VLl)%HZRMjg zq|jCBGCk#IzYy5Dr9%n!DS1Ce`MEBcA6PyeK0hwSx|1wPs~n#r18na6m}ShrU(pzX zpC>@m5V$kcc^9RGFGq$G9^$6XVNH7fVup1<%n*TgI;}zgy)PrQr-yP?tT$0%>yU~W zcIAq)AT(vr-_Y&$`q)E(LW;KeqJ6bGVYMb5OW`s@1;hg8{fK{^;*ojC%tnsFY|pB= z4*rae5I8ro>mE|0sD^pK7fOF3^Fzz2B&n2_=dk>~3;np(?#Ay_hJ;?r*}0E~=Izd3 z>2(avSqn2l9*yec$(c(TWC|MIeIUxv@M_X-)fkd1vx)t1 zbVK+06dcsD+_LVt;}w-zT9N;r;Rd8jkU{>bwQRuBo&9J3efTWEmi=PTJbvmTh0gfJ z{Gx`b{nnWaPgGdsFWDrW+)a_D zWZSNv1tza{AV(pL=3IU^BB}QDD~4aYJ$r?0oXBMxYaIFI#+WJfBs}(myH1BTQ{#|= z%kYF@9nFPrC71!(MiDTyl&1F7(qu22&i>h!8MR*&B~}LgOUEC+Nr!<*yYeR^==>IF zg4O&>dUw~D$gF(7=t8&LJ9-V1^1rQH(^({}a}*7jI7gSu8gfhwIW+2&-Q(iyg7H|s*=K9T zRos$jBu2cA>c$4sZVw-t1nH@>Y21l6z-N$p4%VIWlD;ps_CRxNhK7~1k~cKW-huh= za{Q~N!rn2IBc(p@&_-n8Sc*uit%D?4G!P=ORQEXd0#e0Nn1*v8(z}WD2LU@ea9RT1 z$}|K#Q;A)s>EVgP#Jta9AFF?f$$>szF~m-t7PcRqN)Cki9D42&L!vk>TomohX*0hP zj;AJLpNnSwjjva-9{{Tr0mUL7OXW)vveE0@3#XcosMJ*tlzO+^G704LwtjUv@3P~X z%?K+$0Y`^l2%UDxjT`HFZbsO}vBVN$Nt3huFUx@?_v=J2f;9499EhLM5IY&YZbjf8 zsLbV1RkBjBp7}mBKK;;e-4Z$-<|yIX7>(r%6oxC=|46zZEo(R~Fh)TI@MC{T&c3jJ z0Y!EEGzR9o+9LmYzHC5r2h{6&y1xKpjW%<(dRrRnR|c>M z4tHoyPI~CjiVt(sI|tl~jNuqGQA(vDJKs-1Xarm&>rd!7{euy`iLV1n=o)y^M5EL{ zis_ErY^|N$OAjr34&W#~DQA_h|AN)*YyQco+g-fea}#1PW^*J52uOTUnqC=v$L%&0 zL!>7QoO*}7W4N@rHuUSDC)4v9X0JykGa&lS;<2~3F?S1EcMk2(f;rEAv7iy}2^!V$ zaO+=r0Zpjp*HcV(%8TjIe*k`xRPf$4&t5=fCXcc#TJdRO?AF>zWFXf|Sqtydy1dlL zS(68n^;(&8u9Pq-ISbcFxmRj0`N+xmi`vhuO= z7SVCic4oy)OA83U+u-QASlx0%+Liq?e=Xxxww%beLKgw=K2Az`YwH3F6Vo3%cdv;@ z-}t)uo2$}@+AocDQwtBFN9@+<&Uwv<`hdFUPvw&0Bh~D8;Go|QR%7M~u=fBT;V>NU zes+=U`@y?uLr!w=RoOzv*y4v%j<{D_S6SRjfEra8jaNy?;EIV^>VL{B$;00>E>j_d=o0Lph<WZMES{3 z$)N)K1-v)p!Zbf`BZJN6MWPm7ozRlX6XRW)j4f}~5Ouf11CFIF4uHli%g|ZUF;ynLXnf(&$oyH8xqIKmJk~dE zuSTDG;Tgr&KvGN(ZJGA2at){}F@gH!I(JIq`$FbdUD+N#tHs8g>DsUnD$w$BsnFzJS9TrYNXP&G9H5NS@0Bc?Y zKkp!%hLL16X$VsV9Q|QLfE=ODB~AZPat(dI9`LGLqe@x0j9V5o4u&mOcul4=t0R{p z-d8aGb7E0|$xFBsq+wFHo_bgiL^4ntD?SkPhI3&n{e!xKdT|^;$Qfjtii`jqggN zJFHL_Kfk(`8{+pLe*Bf?y~&$Ry<31D*~Ux(5_P|-t<{e11HP&QEa*fG^0)t_jT8D8 zRo>FTg91QVp>J?NEa>E)r~EI%l!_L*XmEiD;RoW2{T7ucA&*l6yhCA%{BO!yZ+zOi zvQt8VO5tuBd+cBM!qUO=C)Y44PS?+P6hj~Kjq#mG5v~88F$+ck5#>puQPGeJSF88T zPm1TAkqd||N)E9ujLK_?7%^`dHyVBx!By%8U_wo5cxDN+ThaU2EeaZWGY|TSL&J|f z*As8p=pOT!g0u$B=S|keBlKLDp68a5BX_C>f5n0WmS%d~wl@}TvHhRHOW%t$MNFM5 zYeb!d2O)PCWnVCU2EF}6>N{PQrTh_ZNk$|1<#}nzjW^z31h`Y7!WGJ5_3xZ8uUHAK zoN>ekA=rmsUV7?DQa!I}*LLqNo79eTuCW;y$z0q3QNSrg=4p*|X3nzjMUEa;RKMCn z1LuFfeb(ty9yd{E;Hy>crs#fk@K6lPaZ}(GU(`PYNYd8sG5t?ECk2)sc=PYQB(2<1 zy;}`Bm3Q6=h<5`C?PC*GlP>==zDd~`uMjE801nKT>5EvaJWT3>r0s9`lKkvB4 z58i9+JdWfV>F-i&P)H%As?@S9m3*vbsl-eS3IOq-y--iQRgE5&R5)o& zA=UlEuMkX4RTDQL|7;5jgSV)M7|%pSz>+CQrGV*F0Hd;(s)~xLD$)SY1S4@H;)*1K zg~`L6buOJ6+Y>tYwBa2wWdVlqDexU2m)~A>MSrt@{@tT^qK#X}9i!ueh9<@H7cPba z+?sIg{=jT^NjVF)7RLmWo5f>X7Ju-N3Tn`*EFRkwA*yZz1>qO>D5;IR9Nj7*xIMgB zpb?RGYH z_&4Rvq%_&R>N@05QfQiLE9Vol2fSeT>eQ*|h9zWcc$5a0G}b!Z@WeVkT-_9x)q z%_72Su-m_f55PR%@1$CCI{!o1Zj8w_l z+5dkWqP1+hA}fAc4&gZOsJM9nld8Tw@XFm~*aJ3!!;X$iTsXbGoL6VCB23T$nBP-< z<4T(`9sb1(aZIy>&#3gwz4ymj)S3$VgJ>h%x{MNs zyD|@V1-Kmbs_3t2$4;Id!MyFl*K$VH!CH@N#GW5-q?>=KUwr+pz}(;+3uq>y-xitc zykpY&S~hfTizT9K_#S`W9k_Hcl!Y%Ui*oX+P(<_{R#ZPl^p&A`r-qt4SK!o?NJ2DX za#p_^J=TC-|8Txh{NdYaUVvDZ$hrL>UuJHWcRsbc(Ye9eiQ_i?4)=F1@l$Sq;EI

    %F^uf!-YdA%?x=IK6bpwj@QLKNQ(>&h)jUGN`4ik8*G( zj!+QE>it>Se#s|GD27zWR49$*Ynig5=Y(s>m(aJxLbmiFTdIQc(;4h@I($OgoMaSa z3OHI&vh)w3iHyS$I*KAE25Sc6!WRNN8E#Z=xNchPdQ5|?S|3uPBB&U(dUiv}I3?d= zdS5Q%fZGpNY3y5Kz>Y%pwo%?0Gf+%DvDF*ew%1o=anKrYH^*pWtFB&?h&hxHG~Z_uMD(xGxtP!+KX4jwW4Q9J5H=sqLztQ0N$3z~x% z(->9aN@h?aBuztz1L|ACYFI$2uxyefnZ!z^8*uRyPbCgD5Rci6R{b7qIn?v!dX5tn zsVLqp9!mNST`tRjwn*udvpU!KDJanmi-V}XSG2Z2lwi<5{o%F>z_E#>E8(=lWMCfXLZTew( z2jA9qDZ5{mupIv6{PlB*9=>`3Koo`T2C01+FXfLnKx8_9YqHnzKfGeG-SG|9T6#O< zAF+J00npZ+0P;P+IX5E~ma9FHmTadQ1QC(_RyvM)oCetp7={CAnrEt~H9I*&y5yPt z+5`dI?%JLsGUq2GTfcyWg|dhP*dKlqWI7$b(&FFycV3#y2mZes%^cPc4xy3zkAtNg z{sB3=9gx{P7>0Pa%iv~VhM4yEhix{j)5AyU>k$^%e$)QWtllzv8C*>1zTEP^i#A9T z{cmvv&z`}sXW-J5bfOiqYgs zrG;ulK^u2Vef*>2+EQ}|CQCUmuS-;?}N zCu3z)`bWJE@Hs&sc4Q~KWrIqA*^yCdGf%oKg zvSA*GPifAYagR4U&9vT%O3w6;(bdcE<0Wt?onVav zXf?z?6tP2o-#KZ9L6Y>D(jGxswFst_MABV!n8Ji*(PjJI#MKV#ZyFSX;0BZVBI81H;JXTi&pZwOTFJE zg{Buvvaieqt9L%1JElufm&jWH2Zg{W{BNY37P~mH4nZ%Oe9*|o17d;>@mixl-GjkK zn2K|K4985zWWNvnz;jG4BD?W?Yz{}~&Fe>fjxk~(LUFYd`14Hjg4v$~ zMGr62r#_gja(Ez=f5|N7U%Yy@Et3yybLB$j5a17_fRlp;-H;Bzks4sEUvEZ4BPSp# zGe;f$$lLt@b@AkN8k|IZRHhGZL`s@iZKRTQFY#?Vu*||}$Uaugs3M!E^`~zCJS6%d zPEyY37)k0l`>>U^T&~<&k`noT?pRPQ7dVWXh3h9O+Frx65tCr>z&*)sKKXDDRhS`$ z??ICFd~o!JkimJVVB3Am_iCADaAOC4syGofKJr8|Ohg47#-G%!Z#h1)+SEaF_JrU{ z`miPAuTTcTfe-u!fxmMO{BDG6o#Uf`tggd?yL@|M>R;8DARxBe>Dc<87hhRzT)2yI zSvNdxY;j)j{|uaw#EdA6xTd6dhU}*hQi&=*`%_B?SlO?3zl@P>)X7>%NVRoy#9_yf zOz0~9LHw#7?hr=uH4nPv zwk_^5K<}g$0?c4cAkzh#v^fIu7^%1~-~cR915%?QDOR{v4rpBiE>~~7487et=xZ=o zUQK_jWs%Mgl z2_mP93d4rwlw!l<3?uBM3Z{3BozM7*=W?IDMy)iN5%6@#6DH@3%-{JS@t$Z zhFyPJ*Wl8Oqn3alY3)w^yD$a0LErN-bPvs;G(k?0=G(nsHbWt;*^?2k@cXtT#bK4-T)B!ia`FjS* zkrTB(aky~EtzI6f8jDNX z>RnKUGjjBm(Bi4TBeIjvP-SEjP?BK!S32`t@{1*t`qTVqOz!SYniwqkZ@pxdV=m;W z>VOCir6I+|GmKy*t9t#S<~3cPOBfmhxa6zr$)fj?Z{-GW;%sh~lPGF&`|*KVu=#^= zsiel37apOo;g)3?|0k?;_>M?u8LE?U*?%T<_9m%8`(1U-^cs{~n|silvi))9Z8JIU zJdFz09{93PsE}vR0xy#m`Mg(3An@$ApM9x^c#;_2j|4b52lATa*QGp0BZ%PvDXQhkdfA&Rl=v5a5jX8jc! z&B;B@4DOtv470xBpO=ve_w9|>`aOGF42;~bz|-{&`2qe0XxbQWKkUi2GUAYP!t)R* zg7DBd?yn@j2BipvErw`z{Qg@~~<@nUQ4HrJubnEjW{q*AY+`>HyhSw`t#RFUP9A0F^vDRt;jY^kLo58!nlBia?0dOEPEuqL`!DJqa9lq(q$#gVJp85O?^n#wTbo}lYFKuE zap);bqFXcg{*X|6?h|G(V$h*WX3NBL;MEQRAE9xWomub01x(cUctH_7D9VHk(k6R3 zojU`v(he>NG52~?QGUA!{DdFJrkrzLJXaGE12hSDXIjBXKP?~mPd42ap)L5YrFMQU zC9X`Qd!dX-bWdW}{W*|I+fKq*bB`|>r&Aeek*7vq;(P9dw4wd}G(HxBD$(*i;^i?3lW~M+Lg9RL zVg?DxuTB*%=Uq%+(Q5ITBl)4y8KP(lt=iV|9~CAq^2C>k${G7lgXR*Za+6!oP@jkA zn|0#XzB>Fcf}mT*BseC-L`{6!ZgKI}Kg2tQh5G_;3+*!Z`*p7N>mPF z45}is0)oZhQUk3w7#Lg_;au`)g_25iJ(iwWs44P>%2X^2Jp^tFgah(eEEK_PTvU~M zuYUz@3P0!AtsZ$Y;DkG${0QltLen5&0{BreSTh@jNPtc$yz)X#0nlr4ijK~Yj9xp5LH82_^jV1 zq{`;Iz?g&lkcmfN6Qx0>1#x-tf;Fil?C$ebwfohx>F?{|zaD!^?fS<#04b;$gd?lT z8Tlf9%_nNjH@Nj=1F6w8dF!<)yAS{c+VNb3vpZuM=S>@gAb#{! zj#I&P$8H^~a>CFUUexZwksD%xK6mfpjpu*UMt@UGbsCIrBz|M0Zno0~V$GX%pkzmY zTR*?jZi_*LuK6?j!;Szgumr>(g75^mU)iY4JTGjt1z;QX?(tilTfkoff>|(;J}|D% z8fgO?Fxn$^Cfn6vR_<$c?a?XU1q#mlb;@s9G!%CmbO#L6?T?WwE!vTeNmWw+fI7Yy zdEkkBbF=8n?{mFeeNRVB1n$XJ+|Kg?(Op{epoiQsgp{qVdaP}+6*T>^2K_)a&jFt; zzvYD+bV2kn6u96qr!6l6671gCg03RUzwL*#39OS!6zxIfMMSQbK~M?Q6jg*iH^L- zStdD-BNDTH%GMJvOhttxR(0|p>aF)|>t7_a7?nnSj4s8G*K%XXeNHsjv-qf9`UNRN zZfUo7U+ILmcblZNr9lW{P#hjvIKT1O4XSE5Va3|Oed9vKIOu-1G+_Cu@9(ME>n=uZ z<5b$<5wn2i8@siA)awY_cz+p(*=M+Q4Q7}x%&LO@+QotM)RPPO5Q zz8#(5DG?c^ra?-wkZE6uLW3{jg^51gP`<7r^6}8l9ipX9-U`$o1W?0v;7ng2O@Y7@jA-QwLy|AbxOj2*)`hbIy ztdhX0^!1#jlH{k&!$(1zBYE7RxIKDUSti0;kI1mQpFTrlOz6WZ$lrRHWx|8TZr!Cm z0Bm@VB);ed$Z1spbdqWlPY%x@03l$rIYZg|<;1)>IY`|~41;I*G3iM*ifboC+5(Hp z6h$$O0}YR-xzz>PBav~v^?9(`%!(h$)IVuV^(s0iVrZUtPYKokx^qL;=W$?wE<77x z>Nx`R3yAm3xyH2};jPthkQp))7(lQO85|BbAY|m1^)y-o-rx-Wz~3Ytk+au*KSGQ<5$YU{G|5XoZndZ+A=t+Ce|H zYPrt@d;)jm|QXi=fnp(-uycWUjKo`v7_3ghF(VQ(`fr?R#yqwF7LmSSWo zmj}%}m$7y(RtHWunYeFdrYbsL3q|$mH}DO$JVR6lD+C!Bwx#n14s|EmSqzs9%Sr6Z z-L^JWx*h*fPmbChp*~!=>N%;nz4NYX`mIvh#s}N|K=60t2X&tg{RH_>_>P9_)jVgyaI5{hCymEM&IF2f+3?k=F!K)cj{ktn&pWmZRghZBsnu^5_?}(SMSX~UCyB7tnNSQ z0qMfA{GV~7fsv6@GDY9Up4$$`HJuNaG>K3cN3*#2kV!dc7yu7$1oE=>#ahx>K4{Gx zbgy@q2N;#~P6Kdu0KnkdCqESDCoURh^+bP=6MudhXw*vmPlIfB%$1(#y_0xNXt(1u zfz>@Eli+zu;N5u4?cFFb^M3xsS>)wh1c;scUBt6eVX3js)X#8@&xLYFH3CG9yGi(X z%pPw@b@|9qKPz1HQaL@Do67UeMy=OEM?i_)%w7^}|5DI@$&JCnYVHv2SBC3r+cn>y(Hg!RrmHQn+S8%D3o0GUGnDxuINfZrm zwDKGcdWMC!A7GTD{=u-q+@i_{r0H;0!VZ7 zi+6)T84_ujazzdy8zZm&{n!*j{wo`Kv|6GTJRj&LbNhcD!B`;Poha0>Y49T)xW@32 z7JWc1>9PI|xeroB4g=D+IyU7r*@teQfNlWQ5r(M>cO71ZY8=RYeJ3P!TLWBeyXl9%I1=%3PHSUsL{NS#ZYn?4bZqJ z&LgfuJeTI>cJxIyQ&yj01`@X-4y_N5>Zc^pFDJj0=1BD(2AYC4qy#~|DZ2>?EP)ly z^6zwR$?|2loYY^QeG5SpT(&}Gt8Z`U1ROejL1BFXR9CbBdwFr}HS3RJvE45Fz;7@$ z)Gg#QitX3+kxL#(NJcfJ&6o1+wp9I)^@z-_3h?J=2sW$SF5O9DzRgBK*r^!|W^Z!C z1wxM|?)xcs_$zBTByPgD$9w#9Q+&c%)lGG>GHmlAw+#w?+On$R0Xu^zu6>22C26wu z`}%_t^&zN3| z>@ie=T!Z+2voHXuWFQZJiYr1p`oRDR>_DJy26#DivPhn={T7J^rovd@cJyy_=uCoG zw>Vea3c=q(yo?a{v~Y&++`R}4;$NHGtYQq_A^^d^vZFFr<{7>Mv-&WumDU6~VT+xd zK3ViSh{a9=*+OcNoRN3;q*>4AK}KpYo0r3S_(H;PamR+<+pq4i zv~18QX@kV2@*#G&tAb+@^I!#TdH1&U(4X?AN}Tw}Lc`7OY44`MBJSYP-mKP$?F}b; zI*5c)-`N{`=^Gb;RM)SnOj{eGIfIP^TMn0oL3R#)4~6OMm?aKDzAYbpxg%MJT(CAmVpz}q1FSxntC z*@`n(KP6+LR!mLCj>xufHtxM&2Pa#}5to(SGVy6m7j0QTd9>y(SwlB%SyoTdcOBt| zjUB}pl%(f>asO)W=qLg|ABT=2xmB!zme%W+I3Z#N5=+k%FBI*IaAY4TbMX8Yqb=Ji zpQ~hvVjYrHs8gw-ts`jsfm=tw^1i9dI%vSIWlC{ZT!ZgMjU1Dtr?mqaGZEwm{yIY{af}|HqK3MQMajIq5v(_zHJR?bIZxTTr&_QX>)skn)DrvGsFJ# zKvaI%`G>>lz+?T?0tzw=KCUu5b0T!*PpS3NQ*%>)8*-*+IN!Kkw~v|o0q5uQ%?P9CbUI$QS2p2pmk)7U`qdZ?LZD9u~jXnqR=z*_6 z;NmXG!$Ts?VVkg4V+8UeJnFm^$?Zni3<%em6M%XY-amnSaO}nN)B)@xTnEO5X2sJZ0M`k*I7#z0FTPy4PoET?08~tCw%nw@ z|M6nW2`gM@4+`)m4diVSHy5n+tFO{=8Yp;$XRtkndH-PZ#v#lzEvD0FjiY$HSFUBU z*W5y9VF+u}&ZJ$~4asLKPp&Kfci2}x?pV??tHEM&j+&#LaYkA`ujSvRn!fFJZG2&$ z=kS4~CEQLq|A{93+uta5ng-LV4LTOx3(sZLG!4|~C$JTs=u=~(0KI1cyR@v94yoa@ zCkAC1pvx&&iSix@VWC?xXiuXVY#PlhXP0AOeZ7fkU&>Gu1byPlBZ1+xH7Unx7@ljC zf^MRVlf%z|mJO{sJ3+srg7{fmcH_vmwDa4xNUeOecJ%=XexT1|2s&gmLxlySWI@0wN14wz>bhcg~R}v zcobJcAj;!Jpz++6@EIr(aEssGp>z0R{rlldH@BEg8x>hPP1at_LM76a)WXt4ZYnk7 zZzDYViNqd;+(OdWbp-3EFCv)cr0JE1Fv=}CYxQeT>j;>BnspDZA9Yf%z3m{on|>>C z^P_tPTFo(LKb~dm)ZeoA?qHt(#Cr11CvWVuK*z@cuQfBI%061V4A;>09lBy->=jus z;HEnwzH2bS9)&Z>x5bL%J=0PXjB5Dwa72MG9OdQ0(E_JM5*bSw~MDh#e9D&>7p1`q|*-7(x*?NsGdx-pON^p()%E%k~XD3XVB zrTq2n>CPn{;Eb?}K3&la6?n_M`5FAEo6i#$NiU!JbhjNpko~8TrFbY;rjo#Evt|$$ zpXSJWrPF31T9j^w0>DC#qJE1Y`$W=yRyDLButKZg3(Pa!Mm{5{`$_OGiz+_dKLX9M z%qhmIo!mn$ZdkleXjlG5<4jg%iR5A zx%U~O|7bItm(6$Y#ny$cEa$wK*p)WlXlCV;X%aK(OLQ)N2s|KUf?fKl@UtgEk->)pR^b!6k%hg^Mf7W1~qs#H} z6|lmy84!w)VR*M8Q7Pb!KZI+3dv>Q+pi)IK=C`{y&1XSd9psY>9(*Z0_sLX~OI(b- zvaM?J`M{6a!0tA9>v3J}oeONxg;quPufp8$BF2h)A6_AVPC9Y^!7497TtjXWWP1at z#c}8COAP?O}gm zxC`qcIfKMIW@sDh=Y+r72UX;O=veb77#53yBy)4HnV2-n`2A$EW%47;XHT-w6u{2KlP z=cmoy8Et3jxpo_M=kx?w*6Cj0LQca~CoOLXvhv4+wUZhOb#09|3aJ`OH+iiEWeM8hk@qzxE3ZmW1S8!y^j7|535$< z6He)aM|R952`CN)TH;vfRG=)ismaQlgMMR2Q2YUqo?A;u44MoJvQxXoXodequ`db` z=ccX`EcLPf;<+OW8jm;pHuPFLEc5S+JLKMr*>Tq5E@7V#*8T_)_HMPLZ9^uy*AXmX zoLnwpAy>QwZ;ad7PS+ctayKV5vxfpua^&ZWv88hFlb6~u|MnhKGle~RtxtZ*A?}JP zFlU2>eZXuKOd6o}TnK|BY~Kb?gQlF-+C*<@GHTi4l?DKMnZs1^&Jz(c?5{1PA8YPI z&-LChhO^;s`bL?QgbE6%a)rWT_gK}+pJI{lmZpaWMgLMXuthtL3dO+*@@0PHA{Ji0 z3X0Pv#;zB!)kb{s3Lttm8gWC&w?30%VdLsk6&bWOT1PU+42M1lNfgr}pmHPW?ny?` zEE0QN(}RsBPl}Cu)hIOCbE4&b4bn>cMdmj)#$kC=r9}sja31x%$S0KX? zJ^w>3@;&}uw}CI<{=aM#ysJU_2$(GLeGK9FeYfq~mU^ua z75~>tQ>78H(`3=6|8sfFPXz8UzLvS0Bb)9U{u;JKG9J)f48M9d+VH|Npf5a|_ShM4RuoAK(^GfIwaBrm?kib{fF3+N1Zh&N@-rk2~pK z%5;j6Y|uXg_JPw2jQ=dhI}Hi~wK#*;iMus;Y+YbX=T$4N9=U}rxsQ<`xamx;9hTGy zq^AndHrDUUCt9%S=EU);yB#^^}oVBFoA7hVj-tjKV3eV@+xO>iK6|BVJ9tW{dWx@SH#AT-^HiovZ$&vck0K(o6wf|O-3HarrM~4;X2~T6 zH*;o5e0*O9U0jGtgtbIj?J1E@0u3sh5Sw72ONN<^2FC0ai8_7Cl1PUy$7&q3f^hs@ zfzlY+uIr+YKKX7d9BuOC$OP5NnJ^?b_2UCxK9orciViRTk9TOccNQLndHvNk7Y?Tj z4kEU^|KeLdGwF}}oN6INHbgFnrsj*@6qhhZKLKQz#g>A((CljB^sbszcZ31 zpBpHPwnn`m>g~mTC#u5X8m%Rn{y4g6R7u5Vw*It_3=>CFfQyql7X_W{Z@gUBkXT&O zqH<0x<|8o{YPVRyVJ_aK7iSSq7j(~yJqw^7q=gkv;( z_^#As^1Y6|j%;Z?SF~omHQf4_ZsZTEz%>bRE22J=u1`hQ7Wg6DT4fWUIWddXT~gjL z$5WvYc*I1^t@cG+8B_^1st*uWUTnpw&ovRGEtrZ)soXI{VV1l#-K`Sj)KtX@kCcn# z!(I_%1Oe0q4^Ll8@cA*G@Tr|;-g5V!m7t(#;;~b5oyaXqOTFG?;&K7b+I4l@7=f^S zHRfP4bXJGRo+;KBln=fcl8`T?Hf~OuZ#T5iB~!h?ioUoZiiVFr3~ROfnk6P){l4xm z&kM7TlUGH95ow>{w?xqwBLw6W=rpAGFkY`;unxpMMRX+B0@mR4ja~zmB<;fDsG(H= z>A6OF0MwQMfW-PgAb(IT%%wAH6G*FDPAUNI*w`BX_C7Rz(BBwje+;ULwinOUlk5k4 zINi@ho%&THF9%LQz8H#0E$|Ihy&|2fXQ{{);PgeXw1K_+dt9QC5&apg zdwGp-rAR?H%qA&iH%Gy7onODm?vf|jcc1dTd@98HV;1pU$)Nutkj`3EUY2BEd)`Gj z+SGq79D z-?sWfo3mW{*FY{_9;{BjAws$DXAvBOUmvvAC5s4u70!{Amvt@>RXX0!%zrGdw((Q^ zX{@gCTbg2ynP8f1l2?UEr4fUBhB}Mrm&Ik-%cnc(tnxu(I-2%9NrhR1DrK(a%wJ0j z5f#m04F=XY z7j)WF`Vzuwfr5UdYEfN6MyzynO1(qD^G7t&jBXf92#}aT0Oltf0;P*yRHAq z4y2Kzv5lL-yz?j?j8P~ z;BX!gl2v%ANTBqXZAk?dLN^o<{GR1`U0pF3)PJ~!l}8aCS)q%rSQ^Dm)t2;!!5Xs- zKK+3w*S_DbRUxlmi5u(5c9Lv6ftP)JN{NZdIN+<~BxzIy1_DaNlBEyR4EU?cm_9m6(cE@g^^{$rlo@j z%FpNBi|1n)po%=D)2iFP+*Fd^ZdZcJ$; zch2I&-wAbty1{>=!n;-hK+o@~eN3zr$%QR3n$rJ2sc<82V z{vSwO1565ze70I$FI8yYx#nuOPv?cLRdx|9^)M zcwn}z0rHW7*lAbNNAShYp3enbKpP%zNKE2JpO43RB2hUZd`Inm$Lkd%W5$`4*DH38 z#!XO!oG$E7p2cJ5n15;GGFrD@z5ai148bfSy=di{Thn|GZr;}02YyO|^xl*}wu>$u zRsnwV7r0aa8mqF14}Z0jYwR*Wk)glw z+5=f6RKM;MNou~4B4^!lr(`(Xv=bT9egC})>5-9D2y-1(bvAewQ(Qhj%vSGuRY9V0Hj{9lSb$*uS7ewRsfac>;P?}oREFaDwHjDxmh zpRh_XZRaoN}W+lum{udmFno(l0|*Wrw@gETiiwgp>mhtdEg zVBuYUZb-$MS&sTU61! z(US(QU$^Zg=&hZ&{g^x9r=E$G(_~2oy?sN^4d(SSh@FX=%}DH+ zdK4<Z{(pU}cnjN#<#mSSddF{46zZBiBqS3DKedV~7}m<|cZ@igBB zGmR*)VJ*j5jVNzix+p(j!9#H|L;V>hG(sEtNlqc@-GEWt`a(3``gi#(J~~D`T@q(J zU5c7?(!c7`)WyF-gS#H|cL^A#1}6h#Hi&8DK?q4czWx(e%jE4!kGMq~biZmS2_vVZ zI3d~L9RnFGgZ!^oK;Uzr_dv4M+a<+8#@Ek=*LQDu!ajD!S0f&v>|JjwDL&_XvPN2d z!c7eYXyrl2JTTqT-gPD*CT=;NLoLQ`arW7LI4AS#T_^obs}BIFdNT6AtgRT~bOm^1 z1b`)8T{*ilt}7Y~lQUX`ifH3*E44gL^U`;#_vHZQ^LKT7C+By1Zk7r|P6HU{<4IH+7(A+4;z{4O zB21BU9t61*fbX( zhDCX{ulP2ed3{`Ag6}xq%C9KMtRaTK_+BD4-QvvvLY(HgUJE9uTxk}sQVB)#l}Xf8 z-zlCwf`41_kJaQdtP4_0dg1a=Y z%3D#mg(%zv*!bF$eWU%9KnC_8L_hD$w=fyfYcIE(gYs&<)3kKaSEqCklc-7HlZEF$ z%3X#Y(91Bxq{d}bO+9lT*_9QiQciiPx7c@%-=1Fs+cT`w`WWg7Bzh3w-T|=CliM^f z_XX0xaFN1K&bECcx3&e~9=pvPfs1fL&SsUD!|Iv~5FSf4^D9rM$KILyxY}_dp&T4v zxyH4a=A)}} z>h@s~$=R+;jIO~bZ%DLvslnOSjUMhr)jfUclB>E0Sz$!?f*XfR^~p}e`||V>swKv( ze38jAtIVKzDCXtr#Oc?WN!+pRzf!aAX>VLME zEL}Tx(|J08O8IJ-M$U8CK?JH;T>fL@*oY@@ClvMfp}zg6kCNSMoNt~Bj6%z zrYPsz!Y-r`#x^EDA4EBqM)WZLS8bY^=&-@kKo}LpR%4z2p9h{&izD zpieoegVrT#N^d5@3j}TOmp2|C-Z*`yLC~A2qxSe_vYVc7}^sHzxUWcgbxcah& zp2P$Vy`suNBkt3})0EmJ=}kh%)5Vy6Pu+p4NXne{#L6~lk3K7bo+|m5|4XOA;Xfbn zlu7Vp@Y)z-R#@^KS@vZec^m^*ci468EUZgwQZB<32#;x*+0UGq7W(5O=y$K)_iwOT z!v6?rQOSnOM+0roqtH$MrQjr{B0AKNN=TM3abT$h7b+~*O*ZM{2i zQ?}>MZ#)Ij^du_{8sri9?V$DEFzjLe+I`*KM?$%FI;^xAC+uT8p^sE&qnPiJ*Ixmk zM;2ipmAaPd_)%#&31sGGg@$YV2O%qC53(Js{@aIkktD= znVz{i0L)Q=-#2V5J8k;#arZ}>AjA)bX@)6n$~2e*Ob=L%I2L z{s(>^SM35;bXF~tk4_^9%SDWr_gDv#sq9@Zoo&3uaeWU%pmGu^!1PRM!Fo zSt2yUS6mW4EV7(4z{SVp{#`c}d2 z26TKaSo|2h=DNMe&!uIWBT|cjAv``|kf~|BUNgmOK-kL%NRGvTlVIMz7x@GtcGw}+ zta1SikuPA0n#>>8&tDzM@fq^MwvXuCCVe}hCx0i1@}*Zzjwk1@_&WWv*V~^%F*`6u zCc)yRSOdF;^+dc;nb0ke!&2e7ekkX|?U4QAZ0w_o)0D&h%Y=rtQUsPv$?NY3X~Zm4 zM0$#jhVgAIRGsI%g8N_O<0I)s`D*ee4@RqwR*&_=b`f}Kh6NpJ8jR*80wC+%FL?xfZAjtjoG8|NCf;pV|+=IOaAJ#7Oy$&LzhHyd^$`vO zJ88=1!`e?&u%h$9o+jwDO^D~h!BnHh2u?T+q`?zoe^xqG|lCdsrp<0GC&mvayy z_|*82Y~Vty?9}_Z0ZsEu(~IT=E+>q(RX6Hns=!YcuH{cO#|OBCraiZl6JqtT9rA<- z1Wabh z@2nov#c1pMS0$b8n8ZKyUy#neEr|Q&&^@D+qOqX5i~q*7WLfpiI5-+An_@{mkaIf} z{H@S=ftn(s%cjnfQXA5nS?VFeJ@~f3l&0)5y!?F;Gf;f*x9aAJ>b`oS<-4NhG3@KV zD8F|(x+!Nr7W#Z1+U+oJYd&f4<~f?XdG`DIfD%5fy4;t$Z&+or?)J>b17b0^Nr*y ztCEg)58SnYFVvZ%T%dio zVwt*eD@eR19dyh;n`Pl`p;;>1G%(GyfTk#$r#yp{=HY990}kgeI329<;L!pEp= z#y-}0J>Y!c#?!&W)BYwXP2K5Zn?Hi5O=oe*$o;41Q=iGmpZXt4TSr;_eriWtBGpgG z4%6u0l4N%tNhMVGt}y1qQrR7HQmcKT$2XTLH>(FCC&5TMi^wH?`ho*WymAojGO=nL z)rXA|0b>!D_=a7MbIoAo{eLUA>i-#zbxq&cN^vf}ke2N$6My;UoM^O4<)ead7N^p2 z>4@JWFYbb)%BUg`L%|W;r}vo_mK6UaNc;MZ=;r)L`0D%)I>p}1a#czAbkdb1sG8{| z*cA?iNfoqI{{jBbOr3O?*^P0V9jqFJSfFNmHPNU&#s|~A!;SI%zLu{i+&i+}=0~{C zRQBw~XHjI8e=+pZfkdhJm0Rum{Y``Ss}m0WAN&*CnZxq_ zcci_)tbKaX>zp?+5pGh=L*x0sNAn~HNFJ~qV!gsaI>o$yJJR+T{tP;NBt(0w319)I zmg*~Q(u0|!nxES{KMV@^zpAEb_2n*JbtNRRY%I*KoSvpd)a?J&Hs_C_^;4$U`{|w2iDD4U1TJOQoYOjQMgUsdWZ#yK+b0%jjd`5AIU<|? zAfUqe8vJg^l`eT>SJ{oKg%@<^z2+ee!Jmv0-)lOQzNQb!UB7+noSN}3mkLia$xQKd zL3K>j=mg&cmY-EPDq{p6uAou#+`Kv_J^kI7ySd!1op;^wbEAp+Mi}H5u3rM{{^gyB1Lso;b4oK(j%4R&F%Vz7V>!h7y+(xhQ)eP1Hp(xP7Tq!^02(ywFMPIg1f0M?RmKPV zeE;pZjyE60CcY-6s(gHg+J(+y31^hTNz^|QJB zpmK+za?LqT9?Zy*n8Be!n~C1rL@ei0*CS&6xi>mPmI(l z-qtC<45Mx-@0?F|Aj{No2EkvYxVvMI>FkRGI{C8X@eQ#>3=B=q$c{pHXrB(C$#XO29dy~Wq;k4Ft0AKOG{U^q9LU@&Zd zd7^98!E+b27_lvVVOHmwWkF zN}+L=qr+yr9mG;9n7_mffw2G~Ejh1TysFSplnr$gsV(De^mpU6kB;K#&gW}=IbN3D zBs(=sjJ~*w^In7GwG;tg6Fjij_8T775pGux%f62fBNVZrRsS7M7|GPiR1piubl)K_ zJyDls{$NV|9{@!`y1qp0;0&Y&szf$Xc_Z~5N&hV-{WdFX;`H5UrOyUrJ*PLZ&PuOD z!CE~%Ro1}UY49$-=Z)4&;kByM;k9aW;I)`3-)9ON8N{47n@yQ=wR*cfei=Q@({^gB8TDsBviu&q%Lz6}EvBMQP4Lh-rKtvG=&z=?x~U<^#bTR0UlSeb;gC55dZ zyic%jgxkr%K%@|e#ftFR5D0NQYrywUz87W!+4nR^N4>BjueRyT9Gyq(^22~79?_b9KO3aatsa@fh-+p1|+3&yqhVXNbc>ddSHYvVz_X@1|WHr=JY6?E< z0?@Y*%XuLEcZIv|mrC@80mlc6vxna{UE2aBmX_t-Gxt^how-j-;XiY~g4KW3eda&9 zkGSPNYoJQdZ-PxA6jb+Dq1(7DO-pi}mh!%IpG~CEbJc$~nGpO5?z8vcvdGZ9khfzN z$k*c?$kXwy&4rr1nU$F@+@~gM?zUN0k^6Z%WQJ0sia_OUG3dYPKJ$2MG#vUqm5rfv zilE#4^NS#8eK<4FVcSEudr$8}!iM_bvnIev?YGwb zbh%Gxe77RqCY;rM!tQ=rwcqMKQF@&plw9l0))}=uj=hI@@63P2eM{{Z?iXL_1tnIM zg`f@i-Mq0f^S8C0qFMnQ0 z*gPks`^J*i?+e8z6oq_UaFX2(Yk!9<-(~OkW*{@)l6&6jh`HyP%snA8_n`aft^KO| zs{iD7@a72E_w503T0iV?YPW+d-rxL@O zeH?R-H`YaJlB>7n7gvJM%JR%vs+%(|%@)s?wx*m!z^+NZ_e<$uM zIMjZs^Y;3$)_%3#t99S*zpVT698hzQaG%wF)o~Tof4a~77k;bQ-ABBZ;Q2a>=N`If zB46ise$Ue`b5Ef>-FWV4{FYzt&RIUD^8;T4{&Rdp?upMZ_np;#v+g_A{S|liRbr&KjW3GXEyW+E3?6qrJ`Hr|0H* z*key0D7DO6b^k?c zzbp4ur2qJyQn)NUBoE6y`Fmil>G;-`?5*E?pP4V*-`nS%EO(}SxC$2JfakM5gr8QI zg{Oz>0&B2Rv(+j18hV`;YLq&owiBpHiX5r|Pf}~c^B+&*Oc{jFV&2T=&gl8`NAT;z z&)}!em&1dDb>K-#Jif0cd+*aj)s>~Bnue_;4h3p(zCCaUv|M!xzj%IS>;CcKQ;30kRL> zlP=yKxD#UM9fmuPpRsj4{rMMYJTD2}?7kL09K0Jo9Ky*amc$46xSgyBHBhsDv2j8`U?8+zuF%j0m!jUZ` zSy+z~W+(V5upqUbLya+?b$B14`xK%mOtEl9VG2W&0Si(XlI#IWgs9ROo>*|QBLmb* zYMPo*cq+N9EL7c63nrhL24`-cg~Q(+fq-Qp;IY`toJ3H7l2DMcgeeL_0t`kJh_oyq z%9_kiKQt*XF{2dZ@0k^YR%Xc4Da&tp+h*=6l&2f>pRVZ0+3~H*c{*o?yq(?#zggb= zN)4P~IJ!@m{!91yl20VUw<22zoIGdOMo`zVx5GCr3J@bYT+=cW(4c zj*pHGg|chPGl%W|m&b{J09~CVezy3oqH$hAjh}kE8yl1IUw``*hU^^%9t*tC@ASBj zSll=LXYMoqh5IylVD9t#4(==Wnfp5bUAXTsfl$c^_tnQ<(tURR%qt6pKFS5TJD}HH zvq0{4Z*6=x>fN`P`NI7y6|%gOyUkn6^K`-I+rJ5=MizpI%~9-^Yvew;9JZ+noV<0K zjiddx==4$uSP_g~i^(&&&-_=NH-DDy(=XPf`)1vj{+sUe+K;Xa|5f)ZqWe_m$%SDj zMv5&0_~G%7P-9JPD7&(pQu{;9+K++NS?zb*eL~|sVX6DN+AloUp}J3vBxkjseD_-G z3$Z(Dz@+n2;n>aNaOKWbsF+v@JXia$^T1i{*SYVt8XaEc15J}!!h*|-;qwPyz^W^2 zpvZ!fP+~dOQuKS-r4`}`1DyEkB$S;|4m=i?*1IqLH{2%__g&V0@>fCUcN$RbFE*|S zn`r0l@)qRkl=;hS%`%r`=Bv4<OY8-8ds_^t{R&U5_M1;L7ItHmn-?moQ>wbwKN-<5$5?pt#YLd_$}JT7vN4?5E% zsRi8m=?+`}FTef*eRlQ-uSLGhr>Jf5@a04E0*XsFEoM8vpI?yYOFipZSh;z2$*+u=wL;%*WLquZ5D!%YZk2W{EXrp!UuN zaO3e!wmr{(eGdJ14}_xgOLFJeAsY9c`OnbQelNB5JFENYsr`SF`;>d~vE1_(}phMil(|lZ3TRe7b8>Kdqqik3kr%#e2Ir}9MjK`9FoJadA!9&4=y(agQ zkUf>)-kxx{mlO_nad~$)=guyZA9jXWxJ^(qb$cjh8|Nl+V=L!-VhiW`mJs-EGv`|Z zYY_1bfi;NudSfu-E37{+%9qF&xUQQkO2gAxIRNHoho{rCfART<4}F;Vf8mXHcfDI@ z$y8d!;_%kh$I-a?L4eLb`4e>z6^^}F2ae=Z-~>5Cb7T4&aa+Jj-^9ZZF=hk2(|IXm8@P=<_x>RM?~>Aze*TcI6vg$t)qgu=>AwTl&mSi~z;(aV zZ!1Jj-2;6Rk3ig{&G265CGdW~&FpjOeeWQ&9q$do&!ug{?RvfMHU@1Y|2I%&<5V_H z@jc>o|J!>jyxwOkyp5m#cK>aVx$joSTgW@2flAw8Vr`(lZLkU6?jzX{<_qZxR(Oq?tkILtW(po$ zj5)7NHgYt3vt7;(nV;os|2h=t`2hss#F_qWzKAUtqBct~OeuupWLy%kz9Mu;?hKE9 zc`S?s*mZd~4A}k=jM_UE4t#b{Jj!opZk&ZmYoZ`fZw!Y(oRIiom?)Q6 zflW?=@G-jDm6mj6P0)rgMuiQb;J>Z{_^d6@f_{1Y{6H)+{y0%7hmRBV7_EaI^Ggim z;JW?samKoetf5N5jn+ZSa`;*bWpu^rpnXGN;I6?CJU0xy7WlCD(`&rf`ZMT0t&e`w z>$%#SJw~5Pj}i2<7fyIftu6~*Ykb*f&^mkt^fM1Xerz4yY+nM{YfG#u4JB8VVb9S% z(z?pxYiV5`bfwYC(ioO}*<)-S@;A-`&sE+~e1#_zTV4u0R(P?WS%4BDio#PVoIIBl zc&)&ogp^oT8j3D1$tbzB42CEQQ}kyz-jIJ@VOV%^u^2&s%Qvrp_snuoc&-POT8!ad zgem&>z>3ZHgd+GjJy&#YN${BOWerdcA*u}f6E_QUO-iN{_Pzz);4!rX2CesiCegV& zyzwY|vwzeR%F~V2{%j31m&@7yt*f~@(`()WpP6OY6*FuyVYqMgUv)nmCkK+SO(vn6 zA`L<;pzjjHeVj-jz4)xvvxz68FP zJomu!fgYFsTPG31dllS11Drq*Ud#D8z?OtMiBKjJUU)8eE#Y_)asnYH5ey9b9GdhB z-(9(H_g^|Jd`=Ja9#33v$vLH=;D8*Et37(%IWy#J{rb#I!I}QS%onvkZ`CYs=WO-n zs@yoy&e`@2@EBGADs8F)k=x?9=Nqd)w|%`J<%<+y4{y#So>>Qt)-;6*E3kgc#t-^S zu7{)hbf0Q3K@OAm{5*)jI!(1Z2+CvqC8yc@h5td+6j~o*KtI!K$WL;H>L;y}+z;Fk zf^PW3&|~J6c|Sb<0jjS`U{}(!W+}dwz6a=ie3HrCA%FRIg@nEb_;(5UMz5#Gq~qk4 ztoICBA9^O;r}veU&#B<+$SBnd^jdI6rEENO5r$%uZn^p`-egQodco5oM2YlXq~F-v~A=pof8EA{;*~q z@|ygl98+>N)qS3u=yeiuo!mWn>lE7_x^29?2@1?Aisz6w%S0uXmw}q=>%z$WqoHMD z8z?aiJz7$h*M5Zj=kC*A+?3+(FUK6T0=J7@d1|fwEDK@YDS^;0k}30)T8cSlQ7I_0 zs3a6$cCGc>iI{C8gW3G&qjIV{lm?FxF2r;&T!#XR#SNc7A0f}_`C^!VC=3-e#peuvy6owvDf$vpP#Lm0USk?!05cW|H216=!$`<8*Z zhmg6aK!2Wl=)#GdZQh)bDX%s69H9U3)s$?jVBUxD^Ng(UbfqV6e$thyhiVHFoZzZq zYNv*V>Lw}i@c2Lt_~i%lyZ7n+Z{b?@%wLZE43%w+Z_&1 z55yTfNsbmx#!9^5NDWNZAk{QG>G^%(@OWPsTe6>%si}$2(Qtm;JqGOYx$SBc3rRB)I779zKd5X(IBRB=^;JONo;N%}J z!29`d$r#4TD;d5A@(knT9=aQH4cH7hdai;GyDo#*+b)1!YmbW44&d>#Um$!`BD~dh zK77!1DP%*k_goFR2X2Kt_+DzHX6e5jKXVUMn064u=U(_=&`x-(-*(oBq{qD{CPTo~ zgHRTi*#_=_*L!b;tOIvKwvTo(J{YtEGWS>qZ**D)nLDq5tke+2$3FOICwz#{XU8S+ z9=`XVy|&`M?16HVQ=sgGWO#qTc6hVTHnu+EeI#?w4e)xW<&1axY=rmlHPoQ}U=V&D zTk@++|EK2`*081RD z<8}_feL>#uw*}s%#%UkXNW~?iw`ii$ve!lvYNAr(w5J05c^$ls$AULck?s=NNJYA> zF`t5gnu@f2d`C`1h2)+fY&Nd zJf5k-V26_~N3%CNWN-WC&pF!h$wq}`LF{UdN*J1ma12U1!Zt>Ne_{}{+t<+&OhzP) zf&vqYK*?F9A#_m$T)25rJj1WhsIevi{8j}(Fovf9ED+u}$&A_(3w3ulWFaSVV>Fb- zpin-s0t8{5AQ%S(YDzCM0ib*QnUHttImb_E8# z-Uovs?JG40=<^u(T6$lxp{Wc`Aj&TH zpIk5iGkI7yye41$)0K+M{Bh*=X4q01|Q=e)8|Vvd&*qHsc_f}x0@a8z=3#!+f6 z9=A!wA$R9@ASX^XvbTTZZjKgj)Dg;4-Dm#OpUvfHm-$N0PH*rg>+~`Zxiy+y(dWv4 za$gdPlLko$P8h6&qbHnTMi`@_4VrWZtq+9?40M@!FWt97o{&dv_jRx|SbJ^h1Np`j z#0j(y_|7g5^;S28w&> zPQX`qF=xqlf+nvtX{GZZc55}Lf#+WwzBUNYJ9@v5cwMO_82)FKgrYM`LYc+*IDVFN zpVmoE)A?Rwdjf=Qhy;)2p6nc;bAh1s(9Z-rUuYXv<3t3viJC-3mzIRk4G~anYfXsU zPz5}edO?Y0UQmWj9?)|;!hMO?GBIJ6h{=NiI?usL(IOMpSi*^eBNXsC#^ga_nLsGs zEABJ@H4eWp=zfWrUXZ_UcGf)2)gd$FX!YjgyiKf=jm+Vh-^ri4? zK?uk3h}?>kYV_V~Nm&?~I$D^6S>xx&&}d~7@S5!nVe2CCHBqb<(~{ixL!an=gWZjx z-tI;af;EfR@K9DmtKgW^bG3KYg9=!u%i$zc`cLNu)l-6M9XUpIJqDeuhu;a+x7C7j zs{>e_rSFWgxEykHnAkFaA0GVx)mGF5&!uHqZTG{;EB%=}IbL;J4M;$*XMVa|Z?#bTbjm|mR$=s6-f|gfwJNKkj_gOt( z8v?t&*e#AMj@85Oq4J603-={aQ^$}*vNTqXd*) z$-fWiH69B+q3{gM8`FzHDXhI^mYa3I*piY^WU&W3_OY9)GWRPbMnQ?i=&^90H;=Hs zBW0HQg7-4qPCO=MmiR)k`6a<)fhR<+tpf4ut3!q5!B7~pO-Z_H+o<;{)Yx=U`&r#5 zl)A6f{tVAOczzbc^OxnG_E^_3_k7sm%>bh zN9R4Eb6@Ab%sp!6ag}>`_R;4as(rl<_7z6(Tf-GiAosZZ=sL66BFjA3IYk+azU%0F zBM|2;p7^~(>y}XNFS4`*`wpV-hgh5|lv@=Dg|Xh#yugxqB<|)OLS`Q|^SH`A&fF)` zaG&|Fari}{x?hrVPoEEY?&(Oi|MiI;37P(foW~n;e`ANt@BKI_>l&Dw4W3PZAD&Q? zHKiu7t5R8Ww3b-vnxujhYLe1Y-mj*h{#;dn_YdHb5f4w3W8v}sYVgZ#^Sk%{_h;ZF z?!%`m{ozv_(;v>y6VLG5jS~~$*4AJ!8k^K;+>gs6P2kC~mhd>W0c$WmP6`Fy$Q10w z$Myul6Z~xU+M~_k3BLBx{up@78lBYetc*nA`lu0$>)cxj9`CLIPjFw@>kl`?b>m~S z9;4Z*G(C3*z~jAmKeZlyMl*bUV_a7}JlYk&w$pqq|GdZhE8}P5axX&ru{#hyt0vpN z$0@bp(e5DpEPNkrdr}yK*2Oqb4IZU7WIRl+0rz)>!h>DGxTL0P7~I?ahAh@=Av8HlRi*LCsXwP#t0=$Do~%ZNN6hKf7;)o}12zQ;s)S zL&t1}H@dEccl&LH5BhI~QAt-}-?dw??~~i?wbkYyhSV>9gximvLBB2MaUJU+cHR+K zaO^95{0@A5?eF!e%R3nSe}XUXJc0H2df)N;;GexV z!<&7#v8L;mOE+N8$G2eT)tgXhMhg6Qw+&Eu*w2`%l_`L^^5IrFN98JKc*8XUfU1X8~{3^UHof>KLLvkB4CE6X7j*GA)vskqvAT8NH9Vf)QptKNpS@X z(gX!+lZp)aO8|0Eg&IYzliI;^wZXc*H{_pQ7`#`MW8M_O$wBy%%5e3z`R^$H^86QQ zxup$wEb?R%kdn(wL-VATu>H%O@Wq2K;VwG+&BJe)M;-QcW^NfxDLmIlog9Pb%wg`> zvpdZ5Q@2h-kK|rZcp*-9HpQ}Y@erOr2fs^&wn-hB_cS^1Smp_}(fuu7Y{k#|0?(Zv z;PQ``VeE7^A=VPy#0C)PMpClR)Z1T~^O*;UtwI)PA;lLs+@C?&B^AXxJhgFPW85A;h1 zhQs6;ebl)Bs{AiGy9{_tD+T#_WrG|z*~r-`GknehT~+qGWf0zfC;B233GUZwblAIPvdjJ}2Zw&r8Sr~t264rREmpEqR%$~23pw6}itZ80uO#s%v zo^a&GQ8;?z7}n!WtR~L9FdII;`!W28HTJ8AU$eSZds}@rf%IDG4IdpIDz=PY$w}WU zo{P({2{pOh>rh`f@LdXg`{+AXi$A~rIs3k7u%i)_Sn36(R+M2)t36-uWlocSw7um0 zQQVfBPp}^1w(iFLjN6FoURD;yoE!&d@%xGP@mo9xwtc<>Vm4NVlFM+?%>H8^-t3%e zpWG3WzS#?3<95?$fBE1m*!|@mXu7incr5W`uL)UK2{wPe#rR%nwW}>O-`xsQaa-s= zw(|Ys8|*x4vZFcVUr-q8?`X)j^^5yoioFJS_WT(f{^|&%U@h;Q)C~&HD-O+fwPb%< zee&ihw*5cicfnWq`TM_4hIYFopXhT5P@z1!>zmeT_M|UW@l>b858?(*$Qxn;9bfaGq z#4V}@B^Q)tzc?OrbTF%Z^zTbjUH@}EjdOEAU^a}#YMD+b~ z>CR=$Ft^$HOs`r0=|-r&xfT>(T8f=N!;g<-pLOrqeYQPxyMbOLe|Z45<9SAzCv0s5 zY{T!DgWny3gWn#4<~v$J@r9*WS0p0xZA00yE@!Jb%7tPJVj#Q`q^%ZfL)! z6L`$`gc1wz++S3NEytgjgy&c)I}auun+%m#M#K7R8{o_TN8Ve2M{%z2|Dor!ND?Rz zA?|JjcP~_F3lw*EcXvVv5#sIycPX@#LZQXo-QBHz?*H?=GqW?Z*+A&&Ip_Pk{%`xa zW_MH7=y`^D({O=L}JDH;$riY6H@*w4bQItT7^~Zs3v8ivEt#_K|ih z15K8-5cNPH`SLdF+vBOGjv2gm7`zhwXkSuO1e-kYBaOBT-nMuhw@K^V$A<5VK+XKR zVju+{+~93@@{d!6=Gmw4XY#hl`!a1Uz}rzE?SuHB1#6$Tb-r1n)>n-rU&Xo($*n5R zE^D#!V`Lo9qVIoPtdsW>Ki%Ae*+0$`2eSh*LR1f=^*mbNW6JwzLsKOc*8`3@b`9b7+dKr8VH_`X+9dB9jL8Mjwt61xQy^N`V7rB9W`5m8f z-x^XtS_IoUC{<7bQ)61He5df4%%>9DJ`w@suXlfv)kbyI?ISq5qye68`4CSwHNc~v zM$1d2c5Qb!uCJ;mhm_6m^O2eO{qAo3`RXSA_3I=2@$3?Qx&Aet?&^!Dn;Xz;KER8u zjqqZ}SNP>ZHhzD2gkF1Fy!Ou**YVrEeR%RiUp(1R6EF7;66^Z?-X8pV^BX+g(F3ne zEW{s=PvFm=@8ge`H}LE2@A34<0eHHpF2qPx9)Y^00iJ(D-{sgmdjAjj;EBt&e4Szg6D}C0pi+Fh< z9}l;DM8AVasWukxf3~|1e!aF1zdt#RKYzJLJfO$t@$&Lo+}-ps9;~m2hwE$O;nyGH z#mNNxdjAlu?=HRWK7M_898XVW;MT@ZaC>zv+!KLn1KeTON^pp(<<{!@f}5-A{XGpkA zS8+B>Hw&DmNjMteFjc}{ut}hd5Vf1K3Fc$hV(glu@+K#bU=3f3vZI!x;-rnRo4gU< zpO#(Tq8;N4Mc&^1>*qWs(M zzoU87W|$3FjE|Fc;a~ENwf;rs@!OL(#AD<3&8eHPpRfx57_kx!7pbQla_gM>9nAXW zA!yzf`Ypf7bAj(p-=u<04G)xd;^rgxOkIsq!rr7v)B+Py^JFj1r&{BRD+O1gOImOa!RIv}i`58U?B4hDaE~&%sP~5oDq4 zAX8+@Xdf%jHSqhj>l>0y-ysL3IwqpThYJN}jb^l#_0G+3WW%5Gr&V^TkFB$Mqe6;FQGT-OrCBW{BKcY@j zJu(4R!J{m-rzaY>Ef=?<9({*UDyVBw=d$eV3VDgX@y)2jmBQsVZp#EQnvx4+rTuhu z52~a{M{#|!{HXv~BrgH(Kf8}+*)8Cm>W^(#zmw-e6t3R!eyF{;9!@_vBhLkXyz-MU z?n;~f?F@Ltdn4mSR*~1lJooTCzF5&3j!CZQv!%a0m$#dL;rmPa%P1&q>&0(SaB`{q zOy5?XT!mmVI$T@?WCUXo6*St>jM~N{XF9Ix0{cbIXuYZ}e);_uc?q!Xy!v~!?bz+( z2#yQIgl{Ivb4<5UYsa8@`iHox31D@N{v02tdVYxS?yz5z1u3Jqkq@D(hTruCLmF+tQ_N(F?VzQhs<9Yxbm&7xZ7td^YoS_xO?V{xVD1lLI$h4+u>fuf zUI-wQ&mq*~U(|wD+xW&SW51(qDU}Z%RKw!aOXMYmTlT>m*hM?y3o4kkmkZ(3OFa{P z;F}eI_8U8ig9oM>7qd#c^5BXHXIzrpsc=xQv-#-dBm8ttJ>suznTN9ApG1XvdSxmY zs5r`0@1^NvrXP6N>H+pWQ^~ zb=}~S?2fkUJJ9R?ke86}xVT;1WWu=Zxv>`+N3!H+`o;lc)yx{=V1$2G5N7=}N7u({ z+v8V{(Qng0xF&m|`En|xG-1+?OFOB+SG}6j_~t^jGU{T`mLc*S(=B30B-~@Xv4;xo zq8i`CW#ERvaEWolsxxckxu#poj4zP3FI|2nU7xdZbX9oJXH-k8i8W`|%1cbQ12+z! zMaD;Pif~2ajAnSO`K{Z}eXlzxtF$W*ub^>KGk7laQMJsP*P_+ASZ?&3w<)>ccAx4D z`vI1)?`MHZ-3=r8RP9r%)U(WFyZ(~zaUE%c`uT76J;r^%((h~ge%^k*SlLE|&PvNW zlrQ$%wU*Qoef{^>)P4Vk6B`i}9U?|krXSBV+*HoEU3qc^9oKY*e`X*WENLX3EA7Xt zKjGFh)!R?nIt9&hKh&*j;QGO6nA=3$DZQw6_TD+_wP)=nm zIv87|&JSEa2)~3tF>?CF?=R%Jg&Q9r`*6u8aHH*E{e=zkT+{92oKNvl!6&-w{ZHI7 z86I&y@J{hV|IGt&LvvFuS_uoeQ46T>@e(x|Z@;&8+@2S+=JYAMMH-rAI z+F8`M?`wHa_#X29lJAkUUtHf~O8Z6o9@+cIzK0*b&iAnAVXck)P9HXPUeXoL@$T@< z^g-)&ZNL2G->{0c&Gb`dL;Lh>HQ-&_Ej!1 z?(k0Y69*$s+}GbETHA7t#0{J&NZs_B{-}-r#-y6TXKvu1q!hESB~aiqd}( z+7BS@`$Y%Bd9)4r9zL*ae!k3CWh$}Wsj=>b|F2WW%<@5`)wjPVTH#sL`*@KT1QDDn zK`IBX0&P&LMF~x1wsCN34E0xnkM(@ZBRD_R1*}iV^PI`4f~T8mi_xP$UtBCN0si>y zSDann7dKbb#Ph99@$2~v^7N{2(YD`dTX?vmAD*nMffwI>iQn(5ms~M!w|7m&-Q@vz zaZs)E{`mb@yt-}rJ-@%ajR)I%;OU0ic*&zow>HPG*IwUm|N8JG9&YQ5C+lnD+4`z@ zby~ft;_u{lUfkF%Khw7-r?PQ-WlcO@R};^E9E3k!sWrE@{r=l8xUlL=+*%fj2b({^ zFSmEfOA5CaH+SLM>K3>~>%FtOzTo!idbqVpW@SCxl)1sIkhs30F0L=Hi)%7hmq}ca zxxBQFflIV+XD-TIpnA=i^W+T_&gB=)Sq-L^YuCeEkVDwpX}GyFF0rR!2ajJ@g zj*YONB4H;}X|k3LuqDKF(gu_swHl*W=|`|O30nh;5zA11!Ui#db<+v;8m)i)DH*FP z_nzR&-N%@?>_=D*$-$OWx3KU0P0U=e3*8epqgTone0y9qYI`o;L8Y9=U{sEeCP!fm$f=k^7dhTSbssFY;Tw zkb_g6-#-3pnDwUOc=jgTdLrGyQ3(U~oV|fXoA%@M4e0{?O6!-k110+BiqWVEJI~2; zrMBb56-2H73A<103wgddSKaAL@LvB+l;csX+R>+l0#u^N@YFa!CFB5AB1d8{lPxGa zNFfWBG9nBem?@L-A3$FBU}9(v%5+P{J1rLQWddNnjXh zK8$vZfvA;NM;Cxzx_=2XHqOHIO*3)nfjUBG&dz!8Nc6&_AEdj8D(%9(3&{E@8{5uo zljlf{H8o=0NO;70Va++UfaGhNg~V4ua26R)GB)9R7RXDaqOMVD6A{YtNC~BFJ@XAb zqkK>+w+;?zj*#EEd-j@F+it zI)a)^K2zI3jr>}I>O@F(DEe&fs|#4itmhG|o~W8v166aY)3iGLG6K04&NDbfWkS9~ExLW@T7nz(TiT%z4jBeymc>uO)Xr=xB;xfSWV({b_sMR~5&PTo3+ zdWj9-66c0#JJk@4*Z12WzhUj+wOD>&1?~IPfbahEduW{2l!|6QwRoVSK?fHTR4fFi zPys>&CCkXgLm{Ym2oi;ZR4j<80zW4+Z?D|`<_Agm~QPxA2yrEh3uxMDRcbRjQ`kKSOe>pLNn~Upec{QP@&G?X#vIypw$~=cl>y zT(#{yw-XsZX5z?oedv*WI7fu`lXs|h6u^7E}nBcdG{2mrPe^B{KmSwv~xRr?FelX8904g9d*ua!q*eg zGXG0#KD}A&`;^8bSa+WL0pFe8j=oF!i9mhN^}RTF4PqK1>8E6Q3B*mV0_O+AEz%RI2h-%aQrmZN zKT@`*V$;#h;#$2*`}WMY@DBGy{p5zY@kDbGcNc%nwr*G-3E?;5OHTG_BS9 z+v=aU$I9@U7K7|9*<@*_+&WbOWQ-k4Cf1=6I?(0N!`S08~qk?`{~$0 z?|t+_GoqUG$o^;Tk+rBBUmqXkeWE)UH+t*7qyAe;e(~z9)iw&rmDa4djCd7J0Jdb&ckax9w-~(uO?0>nQd;wMF0mR@x`c z8}u)0|8>4c@jOgzgYT&;c^)I*!+wW@(vjOn%Ks8li}@iIeK+>Q)ZNo?{Qe1ft~6Mp zO=eqh`G|nbVC0-sZ_;=B$!*NtJQw5EjK{H?>SfE~_a?$6-W{!0x6vKo8nj9}5LGRw zh8Qiav=cW^V8WV-nEmx^+;}YYX}s->*)kRmvCe3}t|R%T8~FOf*O*B)&5-3oF=xvh zTz#l|=!89qaE)_E=k;CihrAt0`->$QymSaAuA79_N7i8Krs;59=#FYxHFO8gj$S*8 zF)PMmHvJwx>wp^%avHpTDAhjFWm^oshdqz%dxEsSNAW)Fb4>akIVdfr?-AN(otx6X zR_lsRwfZfRVrZXH*2x%rk3IGMJc8Bya{1=vl>^I$c6)xs#?NCaod0D}1w4zj#mkko z@#?$JiI#Y^jrq(3pQ?QOi3vW|^UX&FUJ5>x;M485euQ7|sQcxY4=>`z_R)B8U=n`4 zv>5;TL-G;aZc$BrBC9SQuBjnLuF^lYnEwZPk81~WapvpscyNBJn8)qqt)Fm*f6sB% zzy0>}6I}i&5ob1!!Q~&qai3m)dCOqjUJ`^Cd&kl$^?~i<>j!b|Ko%Zd)gQ2ZcI6wf z?q}<3;g_=+@?5Dsrv2O11KGHDb_@Q{9DI9u^GDoS-3X6Y1>?nW^%6(iI3T@!ay_w@ zevkT_e|~%oS66?AyDO^U*IVj=$Y=M?;pErTadOjmT;7|4TPN1wRKdr%v7{KLP@bu0pc`k5ge;h95SHbNSb#Y7P=5nTd)E1o2tAz{1Ib(A5oRv`?8!tDYSqHCMz@I~X z?2XJIyo$BP^XQ7WFtdDnS@QqG)^t{*63xP{nKh5VJ1xScaCO#JxK00>*lfU6#%0^L-?q=y4k!Nm0jY&2L;SdWq;R$4VTe*uo|@#b>?q^)u42keH8_>j`1+-oQM_?8_3W} zMfBqrzo5aqbujCbiw+q-k};7sXc4f^TLrV;+4vxKyCGoZR

    ?EPKSjtV1-~#cei( zvfPH}?}S;;4AhO-stZ`##crbc>F}Sq(Gak5+jjI49Qwz>tZf7u&s`}#S7}k34x&VF zde4mYR0OF<;n(arO-3S`ep5J^ie!9!^s>A}3Rvq*Ta0)6rlahzB}4(SSkKUWl_7aX z@Ca05Fr$n@l`#aUQixi1pdQPCnKBs?15A;wr+-@U(Y@Dby@NARrh5|J`7j(MK8!+% zX0tDvRUf2WhgBTKuGGWAx>E158!8R3gmq7I_)K$0gT;+RxWplAVaQA^mZ*|l4ShDL z*YV=UhJi;5D2)rQ)3?rG{OXAaT);Q72u8oJ`{QQ-96{s0c?1OqcJ0#Iq1>eMczshTNa?^ zg4(FJs6Lt`HN`0^nz?a-6ZZ9dn2)i*yOT+Gw4>n0zq3htGqhXL!4R-=TYg|U z+^2b<(lmR7eK+6mTexjJwh_KF{ZVPE9j0!cCeM{x_ky1AjP}Nl*VW)EZD%?xMwG?7 zV@kp|%pYg(NyP;h;;ph*ONaZ-E~ihg-w850BupM8)>zorUr>Bbd0zsMOo?Pn%w4;4(rA zSGmA`llJQ^rXs=!4oyXHnok9Uj=HGLM8^_A}5JZ(=p92Ynv>sYothYEHos$HhJ zq2#2}u$fZ{o6oA(4jj5}IL2*NuYtzFX4mX)FrQ?J3bQN1E5aL9;;O?d-Ult0eXa{w zCv2DqoA65Lv$-GXTHPNcexC%->0Yp(;eZw?ABoXJO5=dFZhSpB$GBqZ_p0WV?apzs zGaRQoA?o{Rd5N^FLvBa0J(vznsox<26E$cH2c>urkV%g-LMa+d6%V3-V7-yI1dZILZk-N~I4{iJt&UXYmig60LoWv(0QCpN^s>*|P#Gk4FTN@6vP z-KJ`i1J)MlAHhE<5PRjbBDfdjeyiO03Me(TjQDprcV9Z2;?=J&(Yl~5TI7AG3s^by z_n#dAo9UG>Ve>@YcinwqH$vuBhRw7}7`1Mc?l+FxI8Ge2*myw=aXE0Zo?wfT6HCK+ zo-6iVlfIV-mRI><>7OP-yR^{iqpU8&;ET&?>79?mk!lz6FPtz;l5Y+`~PwV4GSr zaR60&eqH#{cMez(gwTX)Xp{F90_Fvw?6~()esV=roJM_neh)Evl^X}DUu1kK4tfQL zSH>>-T}oTAe+AseyTf;uKRoAoBXhqxYIpCYeejv>hbC!FrL#ulw(ih+1WgWx?HD__ zOmaiyx6y{6kN5o@vpS(#R1ICgy6?h1RG(G@?++`FFA}~G;fK-+_7=c-x-043U#I<| z^{>}HZ)dzsdd>2n0{eZiud(T2e%|`CvYsS)*1qa{`k1e;L`Ap_`5xaH(n00o_@1Ks zeSP0wIkO5TemBXmPv?Ua-In)&YrF?0?VMuxJ8>A=B%vv4q}IftJF3@M^xYy@O|pi? zbW2o=uYrqHgmZiG%L{y-|0SxVSHr3MYVpY0V*gQVVI8r)(AcVIS@4A}I2yQe5Imwi z;k(EWT?)F25#!ug>w}gKhWA`w1Vqw)oBBe&goDzSA6@~kg+8d7Q3EILsiD^SyBE+Z zxfNVzxWRdjD=J4-!3U`=MDS8CyFR|mZ%y028_G?s0IS(Hu$g6t*j;h*yMaU34N&3 z7ka;4->>xhMfUxs^epk0v`iw)i!WEV7MIH6 z#(j0){C+4st_(^}DUGl4+Zk>G%KMX`xDer8blb^_L9k!wfB{L zt%X~-I|7B@k$jKN^Zd7c5A&A3hbf-+8U6Yc-{Z=@r?&+v4YY(+ck^tLyP@Cbc0ame z)8|oE*ME2dBooIXqSQP{+%yEo7SO*}~UFZJ`TTNo4rfpTFsX&R?G0 z!S%xhIGouS*9xlR+2*GB@ zf3L3k7!Nmnf`9#@`hdICukKB5h=cLIIG!4UTYDGLPm=a;f6}^dem4TQ@;veUm>RJ1 zL4ot%N8rb3UmQvd#GS)xV9Vk0#q~XKeQ9m{_E_z|@0|V`yJ*`vyvPwp6TNXfvkuN? zSHayao$#;Uq(K)P?jBs)7vIgUfIZ>mac*sInkVHA&+eSSsoeUwzN7|jF0X?d9HP=^ zXt_pQU7~WOK+omHwQx!1V!jFosLc7inu2rGhZ%D=N6(q;w?q5hLhGjf^lC;h9>>@M z308O%S>f!80p;9f+5eAP;{^>$G!4IO_CW;x(L4;+1M|fwRS~96-2_)2l{$5!z*)u+ zrcRM?oU#E9ll9m$eA@n`4T4G&*XyvIz-%Da32Zc2kC(6-zg|#r+&WYs-W|FEBUh*f z?D?x-(QwWxlpL}ImZR68!r0Z=cw9B@$FANbgP91k9?5ujU>-^jU4k;hm*bs*i%}Y|efaDp8qHn>v!0n~7QM|7 zu=49W#H@o^r+EC6{(dgwR^ak|HFTS}^aq%APeGmVuXO=y+eI5_eyRvdZ)r~HAC>(L z%-Tiaz5cnVIBYR?ol^~X@;8U+dnKYx;&w8q()a!C_doDu_%fKajfDB299o`&Ug_V_ zXGqKMKYfAPQ}gi8-l?!0vY5yx@+1Z;F;CpFYFS`7uxH=aH$Bshd|Hp;SQh-q^?F>3&Lk z_Uai177P+$U6mBR>u?}q_N%Apb8$6#^=ORUIu2vL8;hu)q79?v*cf*z=!EM}u8Zf~ zVz+z2W5Jt;4 zoQjO0*0AX%g{xK_En?05%`6n{bF=PcF@cJV->s?0a2{@pT4}YU0(&tP6&n4U(th1M zDjm8hLdMMZ8M12uD~n9xvzc8&_wvumIR?Kqk0L^XQO^Q!R;IEX4))o5A`RkEuJ zLbIyEFD(E)HuTg7tZPQYd7%qJvO*D($u}Sig;%lOZ5Tk z_;nLdX`USx{G^6L51&6oM3De`IH z%@?(R(_Cjb(eLcIw6o#&a{<&VuQxm*Jmtb6NP>z6rFali9&I6`77k?0nMInZf_7wt zGEzbm4rK1N(BJcQ#{VyA-_(3lXxBpoaG^oCj;A7{mnCfbi6Y~t3Ln1bPm(tj8MfWb z8(H_YxMI`S9F_W(LuC$Em2iplUL~^{!hclzNe(W0F6kvsvF*6Fvo7eEy?Kr(2rH*n z!N>WZ=&tKIf9re^lm;dTp+)Y8;<}1ToBPc?5%$dbVYWPngN{dNnfy82BHU3qtqNQg zxglb={#unSGCst}uhmgacc0!xr!*doRB0ylm9buEoJswzCIFqdVIrz?0H(P< zYTn*F3|vK@P21Ga&BMhh^GciZ&0JKCtELNBXKk7dyJ-&ait#}p>2lW<^`PRKqif+h z&kgnw4w(DBdgHO{RBVUNuLAc49#jwq!Y9@b?h8H8Dz7zWZ=Wkh`))e7SzPi(35&Uq z@0!z1^y^*`KG=Eb2Qi=9lD$jFo7#yW*K2_{vJPkh){A@LG2Ih`R}VIf?c>qAU6Q-N zdaMogw|=x=c15Gu#=5|i1HYiTA-aHd=IU9n9aRZ#v)$o6$487@RN9(@Yv44=8NLhr zOzYhkjrRR%`{KTz!_`Xt%E5+5uJ$s2P`-^hkK$nMi?bJOdYRi2lJDsuA5qP|WWu;I2G{y?84ec`l#_Un9!r{oaqxT206T7GB+oaeiu{i+UlE*G-= zJ*KUn2Ae6i@Qd{q!H#ddKfL({R7oN5O7IrJX`i)y5lOyo$;qYohKltoPt?(Te89X) zR8@E`@`hiWzfSi{_Ai0`3`cm!_zHg{0#?m-H+=aBxXt$vm+(;9))VC0rh18>%{Rs$ zj$uwn(1cq&lCWufGdP7gW8En=VEy6j4{)344v%@BaGB?dux(-T684B!(J-bYCv}_WGtF&#v#f0xsJkP(Qebx8Wl08o?8PmRp zpDVtHVc)}k$0yYn!?q5S|0PVfYY(sCi{vk1JJU{tiXP zzj+)r<7|hyU#j$`5H~H%p+39sx_+WR z=aJTYHeU7-^s5hFK^!q82_kg_jTcr9*xrbuu^h&Xs+@I4yOW779%{m&x<6lhO3bkn>>xS zy7s3WuD)1a3u46TH=p9w)=xBiY{W+rTNFOj&_eKX3x}t~*9spP(M)1q0e-!0 z`t*3wsBgV-xB&a(LvS^}3ZAa5iI+RO;m@C?`i;ZO8wWCQYx@|yI4~8@_D;dCkLAnp zkshvZ8;`r1%P4XC`N3&CJDG|n+k4{v@+x?^vN|5Gu8yZaj={g=nw!JP<172(WU@Ez zudI#Ri~Vtb*JKffa{HZX&`ayPHtsE}f*Y$o#&0jw zvw&_NNW!HIcRW23CC>p~J-vei87*)=D+o6WLU4O)AO6{*{rShAIJdqZE@TGa)eY4j z{7E(Qvui)#!M^#pweE9V%?-l!ykI=qtKRhVXYz<=znO_^+s5Gj594ree-!?ZxA&jP z(;dtE6qjYpb@s=7?w1eYlr;XHW*oQ!asv;hv2)(h+>7RHXKG+~`Ugs0>6*o>2~ z9=BG9)mVv&M1?VHbd)FFAH4?e3|fW}%hj-l1J(w!R^r`(`7j^33h$3viH*lqBb)!j z37GdzMwy{YQI?jM8McDV@M^^GIEM!>)FXi0_y~q_q)r5^;cH;lIR))gcd7yF^OtBe zYdOrirJ-5Ww@?DsUw-`^ts>W=M9*}T9J~~66ISE&E%o%%35$1%QL=UBZPEv<(d%e_ z68xvG!L7$?z&bE}E6lnipwyrOSdS!Arn$ar(w2iT>lBNji+_^m(8l}d8LE%Z#yj1U zMR;n~CktQ1ZlwZ1`YaK!PRhkUd!)c}P%bP7=4g(GUr zN&wnNAw@>}SRvUo^lxXt)N+CGx`=*hDBU#y?=+uBx}MM4er{G{a6eK!k6>cVEc#kl zQE{R}$Jky-->HP-}8-<1x}xg6vKQUT$GVVj2;iq|)_J_UX7RbE>|z{+7NA9Z(M;0~WS zAG9iHr3+E}=J$m&75tuyJkc`0C2enN7|=bZJKAJ_rMnj5>)NJe0#TLqqBp5pJ*A-e-^KGu(#=f>B5 z4d1o^eqnwhWc4HC??**=A?E)Zm{^}b87|-XzHl67L&dWN71?6sYMNOkGi#FlKUw?S zXxVrwH2&ZM+i9o`YNgafBQCIo_GSIk_E1lt=wH=-9m7D<&bb4}8ZTX?)aG&Fj!@C8gMMER+K$}9+!08{f(|Me6r>RsRETP!LP1BA5!7#pz9W*1 zyq1L;gvr-H1ps3x22AMGfGJ%U2UF|f&!u9+ZM+i|8B}2RqrSbH#evdwN>?Mvv&jc)M136VNERkuG2zv~&XJ zVm0I)$t(0dc)zIh0U}_{>>>{8`A7L<*JU-(TDET)oTfOzXQ2~xp9lvkguTP)bLM)B zQH4rdy?-^FNWZ>ezNU4rU_$>KuzJn#M5TW3!=^X&{oT!i6}1KlksUX;rZNq}q3GIkN>#)0*ML-Q)5cVA%3u zaG2+Sp6h$bbKcy>Zx|2%7=N6+r(TyaX=f7L=D8s#IS9ej|9jK6^X0NH#f>SIHelHR zvCVnJQy;prqhT2bto@hvhexCb0+Is|oD_^5mo)+F!R2t6?SK)R)k_lb$iWU79mJ@) zkmL{qCkGqwiI=vaAE+2s4nQl7^{BLq_bwoGK`6Xqyb+ubjNMn&&|%sBW#muX5D*_A zJkS^UU+4nXVatZWW3C4-Ke{Z>A%C_r9gb6-;Lq3Lq&~@Gp$8^!nJh1r`;WxWU_Z+q z>rScx>$a2I;6BA2z7f9gSm1$~TUDK3zIPe*BkIF#uG?Go{iby)Fs13@Vq$%~{qZ*A zNM43LjW}bcqj{=XSu?)LiQf10w*14odl@(nvqkOHT7`U%*7HdE|4;dz>TmQttl^Pap}UOB?#n--erf~wB>KQJ(Gv@PRL{P6UE_m9pQU|<=9w+@0qfEM zu$gUxjpx(>1g~q{7gvj{h88(3u>1OM-3VK5+8W{f-SY^X9|%9v=(3}Q@3X*X_wly( zNzNzmi1NgSGq1nSrP4S6<}*pWBfSmYM;T>W$oCj~pW^r)t?o@}|9_-^@tO45ZsX)| zRrWn)8kea`k~bV!yT71flc!Nu*Zx>k5l^CQ@M2j_y!!Sth(Oh3a7ujL!ieSu48iH< zW<}6cVp9{D#u6JF;Q7X;`1Q8B?|t#$5>9O#hkK_r16Ii2-rF0F`zxyA#hOsO+&u*U z`cto~qT00`vvH2L&6k?NK}!4cm&bT{aTV^bYmSG@g7IY6Xp#SL`}x^joGfUA>v@&& zWNjThTwWQEb`Hazav#pugT1i6A8zfKD4uis_2pw6U(yy=bAs@AO&vU5T@!a#HNdZr zRUdHs=wh5n_P~=v>cR4tkFVosR#V(4sD}H?tK!}_J=6^9kKb{6O+TDV^~9}j2IAKj z_r-i|`~CS%JlGeGtGSi&_^5iY<8_Tk#vaaXg>xApxVpF|uH+MW5|?Ez<<-EYT#1WJ zj>H9-^GtRPoD)>XIqJ`tvodF>Ut>-)8HG8OQB8u+K+$kggYh!yJ*L-pn)=wwsX=%Y zRSAE@TH#4##V0?Euuyyt=RN;}fVJ7QdL^39y}&oLdZ*bORP2)@f>q}!8{sr*J;7n> zdJ(89I2c0Ib+DU2QyJqx)kZ-MQw@Qt9HJ^gs&SagL2CKY5*(;9 zN~S^^u>OMjGgsiB1M*R3_)3%;u>u=30c-a6$5EzFD#{F53X5SY@a~``7^}I4>!sTd zF@4GRXdAH#onzMG@e67690#l)&!^Apn27c%JJm}BJbQ_TvzEcEYYLi1Zq)^>ts~dM ztVbH&8(2UE-b$RgtqEB3cZkugwdZcs1*~61(R(^3z<0`O+|&fDgEPK?S?2_l9GC~| z5e4}6lv;=+a=_Xl2Ez-~fc5U<=cq9u8zs6Y!(wnAeUEf>NZN+qWh2J{YpqE+_(%67 zSPaM^vWYAWnXu@uB}1a00*^d3LKmhIh9FhKyibZmZ-rzHNv7##ibNUBJX7yg*4;N1 zrMtxAAI;~YM3Z?a(P+-ocWMkCOo}fLxh6c~Jdkr# z4P4ly^XM2p#fRaeuzN4<6{jS!sqeR>pJ9Y5w=rwRz-hjd_-r;)pDg|a_vGtxv8INu z917?8&RBg)4OqW9{SEDeX-6DSJK-2N%-x}$k}3k$*apIgYmLm-lUqfwR6VJ>E?`aG zkqobSo(PDOO#k2wgAL}1N2DIVeq0oz2QJZXA^5lPbH3K;7fD~BU9LKUmCaqx+#YbB z?=A|A){9%~0@nVE`@?y*vnYB#&;49iD0R#1hF0mV3^y3#qUZFD)7W!<5B6WA&%Q{1 zNB&%T&eKk5ozXN_KZ140;vsOI=_-nf;K*Pczoiy^so$qkALs<9*-l9LNex&JUp|b` znW6BU<0;GyzyH&?Pm#YnUlbz7ZPbcUaGCBR70k>$GDXEH;b`0JuH9Y0^4b@4QeLUK*PmUVCPU_q0v8UzbO6J z&Z;e_l|@AbQ8SZ@3Yi+2R8TM(64hxZs8Ee|luXt1s)8!%R8Yups3k}XMdh^0Dyfx) z-W6E)-B;@a*5NBhz#+^5fk}blK!RJW8yaLc(2d%A@caQ9MmI#QxLUe^=o04?fvl`(b0RQz=DC;a@YI?9^c?#sIo6di;Qvp>`YtYcS= z6+sS%K1$;NwMuvuct=qY5FZH7XiqHsK{Z_>V2!K;r!Xf>{YDK~xqxXA*FtP7ZVTPe zaY;wRX?|?Vx@UD4Aygn06M|@oLWM(=zl2;s=vYVvMNx%A1RHtT%!e1jdnv=S8s>?Bb#V{)F7ic(l^t;Bxf-xe*)TWU&oFQmd)6qp61BKXT$i0@Qd>k+kso0o9=)ZUk;#YLQ@Q1 zKU|(81+4XB>!WQ!TSLIg{o$#br*!+4eY8(uUGubSPFFNbZl()Z`TBPr;U4gc^}=U) zpQ&1=Heu}qaj?lZ))!4Po9e<*)_LRj#=4Qa=Wd@9+Z1n4$~MK%c{*a*2vm)%s$0jD zbyMIx%Nc%){1CJ#2;W~+N0IYEOYUd+Zx!~v`nTX~fLEPY6<&P#0Qwtiwesy54n3E%KJ`T}mF;0Y3A6;1%YD%zc^i5;f= z)%#Y%X{-}`=M-~aA?sg!{&aU#>RVnMT(Ie8{-olkr3aGa%?aUq_*(PA_t3T>!d3P? zq<8i`hQ7ZTzDL{l>-&9u-_QNMZ=x?oeLcz$N?v_*6;n1%G3@90;AH*i`f!eLM$dIU z#XP0)!6??NqF?q!doJyvd3(`4ue<2yPTo}m*0}9)a1C=6`v49(z2m&`-_p~o9U+S@3olh`;~sbm|AB3itnM%^Ob#% zb$8Of!OU-dn_5Auxn#E?z;8~n9PZHMXr2wzTobMhNBTGR+1Wf+ZMrR~Ie zrZv`|QSW8I;k?!-DIS~Q(f@p4c*{BU-V(dd?Z(vAQ^|XGLi~1B^SqA>nI9tU7s+=| zUN;%L&+iu3T-G-BRaK&@VAb(e@*L?5Aj#wJ7YMH=d;Gi~^AI{O6g~@lOoXQFdHz?v zr?uBwd(E2`n{>c;r(sag+S-=BdK@h*6LP(7PX3Rs)rMt&9CT~Zl$ zw{XBJ?OUXPwJ$ED`{PP>2+pnSB(6pKg5INTJfijLmf^Ugx$NKXzrMi3Ylm_F$^ksM zdJqq;9HhtliG8?zdK>nqx4@b75M0Tvfy*LDCC`#0aZymsz=iDUIIoZ;AqA?{1ZOj= z64h{q`ZngY5vQoH({eJ6sZxj&GSc$Gui<6d^@w#7C#i3}kP?K4QI+r;X`3|u_=ize zeM$04-oqiQ=>PwFt-+M~C7R5>BEr=svr(Z>wjo$`oG3G4Jsf20$FCFE$y8#-ahSRm zw&T{qM$1@Y%vx9r*1$?(^cqy8X$6{A7_}PZHN4M^T#a&qRbsTMV1$I_$d#}du@Ywe z3&>Qc*CP`F>-1&#XWtx@8L}MZhAqQ}qpARNIAHCSf--{^i;&fF=o0KWs~+|1pSS^L z&8NZa^92Z*xP*!*sbJ@T^`kKQy!P>Em-M|lf|Uc-=}TbNDG5y@zE%U)-+o8yg==8e zEgA3j&x7mOynJfuaC-0<$!fU7XHyC0T%tT z2st?ItH6P&79})Q(1)jj-YEt|fZ8kBh$KBd6N^EDN)OFr9j4wV(NqL=TJd8Pu#E!++3Ppf8X%ZV*;o8g9Pan*3}h8nP@>_`#e zBAb4%C@*}O`=vPI%#BBZ49gz|hcONaoEeCqnL+TI?g#Iw-Uyi;BG%Wnpo?MT9S5vE zvU`YN$ZMe&TIXs4RuXr=ynb+);UJ2hmRT)zg;LL~o~RpH*AN2m&U419>98MR5C5tD z2%HuGzsbJvoZx}rX+dzC?21p5KNZ&+QyLfET#R_n_eM~-egtdE_7pgdcNB$q%8zQm zdhF^^1WpNr{Sn5W9(38R&5N+9fk{c)Elv^KfE69licAw+glXP#bUOJ zd2fPDm(Lt3GKSdl(Q6T|R%laZajEiVe1UsqM`LE))nXhOvETW?g5yAI)QGPpMsL*3 zDnk1@{j1uqnNEd-4k{!R(x{lwK}AI>6%zs~Bn(g?k)pz*fK=4cKs=gA3m4AaR(90| ztb>;hLWLO>;I+sL0dfBLH2+h4e_0J_xaIE7h2vyLREs4|YYrOZ?9PVgL=X7Q@I%n- zAOy?|fcJDS@i=&1Fnr0dJB2&JX1X}T7FkyJiZSZhb?oxE`pwIXW4VU7c)Y*9xp-gtNe&10I2 zQAAuccU)`~ux4}@1+Y{^kl}ybC<}%Q1{pT!I+Q{|i=k*RLN@%qb4i1yFs0Qu@wWP> z&*AT22vI}bC$FC@M!~a&o98yy1+3FIP8a`Pfk^?h>;v5h)>)fp z!Ev6W{&Pql?Q`10KHOd$jN`C#v*t!Yr*EA`z`OvA+Mr&Sjsw<)u?^8Ur7?XkDS%;3 zOkXn%&f}dBI6DBrb4b^-{NX*r3zg@Fz=Qg&mRXaeb%||y8I;%45X4;8ubl8-n2<*I$F;55cb1g|EwZUWv8z4$ujeaediYgXOOU%daZ`4E!)Ykf~W(!1XG)G_G) zb-w3q`hKDN><@7Hp;T=0{(V0cdP-ZoXR!#Hc~pL@C9QM^t4A&!375&v2$~m!5bB2m z=J<=hOGsFV=%=d0Q}LwL;EG|)qs^p zu+lOf0m~sjhqv00fBF99aGK_Xw)yHAINVZprNCjPgXqiI5AoDxfeXIO`vMPNO8o%$ z9rfnagZVIXlp0kMGrv|xhw|ytmFHF#2MPFq*pFA#>k=;AzXY}uZQ(}!2Zy-qfpnJ$ zC>Rc>sZL^4u+k1)IfRfo!El`A0M~i+KKiZNAeAq16fz@31h;EXtd-|VBUs%gx``3h zZnNDm>uY_$T5n!Gxbn4ujr#sV{k;|wT74~l)%TDl9EaF|`gXqNDy-UD6eNR!^FVgqaEVlNmrb@m?@;+MM6RPt)l~aoLJ$xX52Qg?{ zx16rx0IWxZI~E^S@3zjD7UN5pSk1A*=*^?$xw7Yo`4n!GToFY30roY%Gw5$eh<(8v z+81P#zt+?-ye(KyvqI8d_3~JJz^>NpTJV_cA^P;dS%L7G?gM}J_|v`7GOeY-lkg3< z>d&o@($xQ&k2S}ft!l`B?#?;dACZq+;4OX!d!)eGf#Q191$!48`q$rn{|z6NSf`Tswi#DWSsG2Tlt_z|;VEP4a@@6h8#d2!0VaSeiw`5@lZXkQ#jsez*@wQwY<8V)Cf;z(+3 zoXM<-+l#BvSBC zw!`BC`Vp+hGMeIgPAG2Yhv3fU?zAqcrudWgM<-YI!MRj_+{_KZ`6M?SiSxz5^yWCd zX(C=}g4UY{b8vo>dda9?ogiNNtZayP;IAhO6DZ>cM2y`ipOyi^NPZ-Zt7#trv%}CWF`Dc z+I|#K;pL8@WtG8n?0eYz^Pr;tV!+yHM$Hn9W?V9BJO}SIo`Lc`GsLO?B1|2>PGAUB z$E`&r4Yp&MHLy__qawo8(W_BWVU&ajQ%9~c@V-pB5fWubtQ1%dS6BfHEyE*zrWe4hLp+)+*n}r9)qu6tg4HnV zk|@GnmoZCqmk1C6Yr7cKoV89Du(sh)w%sE5OjvFdux=5fRNw2H1*;)>`hfN811Qlx z3V!1YaPO&l#P8UZduS218g3)=(K}-Y9=%XcOX7gF=J-s!(>WIAebR|E4XH5it)Lxo zT8!Y7{I2rCzHpdo5BD%Pw9NQSS19$%?hEHBPWb-3S_E-8)jqWy0_XaZ0r5ed$l4gNq#xR( zwT9gkTYQ%CnJ!=*oI4oKlborj@Ip{npgv&TmJG+S_Ef+)B4MX`^!@RR#~7M71P!Aa zqDfq1j94`sZPMF_fZS?yMe0jju;H*e5_s+YwQw8j3hx=7@SR0Pv%<{3h;|(^eq^?M zs8DwrY)eIkC8&@<#r9>El(aQ-CE2sdlCHhiz0^orF2Yr(fmWy^j_8r-3z+GoeJ&_i`!wu`r)XTP=|_hXIM|Jh~D|V@QZxM za4rN|ENYHMaSipM)XH(FIH3aiF6%A!DN5UZ_B+}hK11W=Mp(2v#t_tUJ9+&CYR#`n zMY}zwY*t6h-FSE%&7(dL-=715j(Hu_K7<3-v~FpDkCvWD{BYTxghCceJQ$ z)7|`n7}?#u9D?Thp*{zzM%u5%S|{CiUD+AyPpbh0j}%JWnTQsd&C$A`wLV~7HwnHA zy@i%P$Zlo`R=7>uFcmITMEWQA(z2%dfOXSMIL@)hG|iPi6)tiv2b^U z;Q$u5oL$+ln{0zIo752$9I$>6+YBD0)t#5r>vf&Hc>*1?J0O^^0~g_kdhvBIVC4X` z$!-k?`rOZ{sMcO~W$@xbLSLQ{9{4ot6C*8;hw}_ReclUAk{gTbdCO3XpL3J zR?2gv{YtOAo(Ne$MelrH)QYKre#`rzLv9D5-$scIXdSAr;dMApb)bEx4+5wd)&;Bw zR*9g^X_f=#eyg5+!TYs|t0thqqWbtSr3DUMSFg_>_e~u9XZWJtqPn^O>gCTb(K)#@ z>?YZZ(f&KmtD_Y8`hIN^TccTAQ*od(eYbiba_{*)5 z^q%4lI}TU7TfnND#jA>+mSNvxNpPWIX4%EEqE$D`H9WGG0_l9~F<)lB(h- zO~82M`Vq9vZj0dPAOuDSpk7j4jM+FEpJjat*9Fd~or58}Eb>Rtq5ybB zdf?S*Lw+`oNb8-mmh$BG0CdIOTvfWL7Xd z=X<~}!dKkbRB5cOuTtBfMM`r7(Kh^P+Q(u9yV5vdDs`g8O}6@?DO?_fWr1zQ>w;PboVyXOca8e&KtpyOtSk)7|n9KCs|4&|306n!ca4 zZ_4**wQsEd*ZCer`^EJ=g}jf(_jp9RVbJ^Bp-xmS;VVKG2BB5v7Z|>JIDEpqg@0FG%Lf(uWcP;8Ja2R;=zvR))KUE$u=-Ko z+?rm`XJYVviMPoL6W&LU-0p@^xxbOW`e0!*bkFH#STB3NMcWpk#)9fXd%^RA@OkRz z7`bYM@clmXyo%|2G~TDUzUP0Tea6(f=yUw&^V#=^k*nOdcPewbTy2Bzk;B#Z>pxpq z@zSr+96(v)`Qj>4uquL7ZJ62=uQn<)5$HnH4ezyxZ~y@R^hrcPR0`TKwEht!&j+xK2F@^PRd8A%RpOM42t29ZWBBt< zBL)(?=@cMv1Iy=iGjEmSqZ;HS>efo3eR^AuP}ln&%THIe&vR?|HW{% z;j~&M8cw@pCIToaT;j#;!r7F%q^iQi!@5Hlro1WvoPqx{9W& zP;ulcRFEk@f?0|875MahnXYP6rk*&d~7(P30SuuMd|JdDBUj?Wd`Pnz%pl-YHoh{?GGHhd>>aHybuMj zawz~2u+CWqv(_B)v*0pni9TS>*#@((B2jb3 zYJI@U?`abapK(iZ^RZMca~qtpS-Qzp?+jQC%E7lM)E#Kz=Kc6*$0+=xYXV|6s|5wO zXRm(6g*&og)cl_NPhOzbxOBYJVG+!Gr4k&R%He5GQzXH>ha8^vNHmEdIHkX@F7)iC zB~DM**uNKLy*=VlszWs1X*LTb8WIhr|7uos@OV;uIYNZ1b{#CNY`R*mwCzDVqR!^< z9P5nQsWqje)@fv@7<#TyE0xTZOwE*Pf*LZ_$xKzJ4LpE~f^I9j=#0snO|#)eW;vA1 zly|fzhO8N+3xd|4Tu)}i3pxAM3%7H-_4Fo=+&+wBcaGt~%lqP{I(6e}!#T_Wqc^HY zr?~Nv>MM_~7;c88Oj%RImkvdR$?v20@?N5VQJV4|UN0LMel0g~`d4^eDy*I9yQw1` zwjAFAS1M|&MupZgX&Jh}DH?g#5} zR^n7w?J3)Q1f5UyKXl^|F3C68TDUa=6~~sxXUU)7;S2Qu%i!!maGu~uMTIAV<_6%{ zO?A|_2v|qi!)1yS1~1VYTpkg?r>BlxK3d!*{L#xt*n4>|zCQIe4qZDWPRUZ*;Iu(- z8bJl~bT7jDZ^M@haE8p54;AT-18rd4l}F}TqGFpeD@r<>@!b;*;i`4#GNY}#TmH&L zhGTy#R9_S-4lJr#Ed`ntxakhNIw0h}j03C()WcgKgx&BYBrl*al!bMFie-8_Ud z_s@s}A1e>9gxypd%-kxS!hM#OZ@aLK3h(W>r3s(DKeZj+lfCdkVl&)Uu3JeyY25O$ zu%BEBl_P?&QxoKHdq6r=ZeGU+8k8nRu+FOqhiP`0vPl!LKDbWBMpL-XaE8k)Cv?bG z?*uFY*3_SR&hs*Cw$4xspTK~yA(gKAV%8*88S&iel0vTFXd zEow(3KFj3rQN2Ftq%{-Z9Zr2nd;pqdHm3et4OpkHp8}^j4)BZhM$?QYx`1`&h8b{} zSqam=QAa8(2AhMQYfn@!!|l%F+h`H_0cp|}<2Q|!=Sl%<^F=g&hAnz6QSX?~jSps> zxN{tbZ&82vNa_z4d>aniY1a5W^D}+Gnl}(`GhE;i?v78=KgR8+nt*l1I5ZH~(_#UBuO~22G zem_;}_tn0i`h2(Rz(jbV*8z;hUmMyBsR>euum(t?4#lnS8sgLqQV6;Cx7r5bbqcdOn z=k$Zi3@0%vw0&MX@)T;o$_I2gp!HqIA-^BK*M$7b_AV8pgk5G!8Z`d5zC-(iOAjxJ zYftVvzYFyv>*<1czRc4R@{m|RK8X+F znxR>I6J5YMV)1a;PpE{DupnJX&+YcpTewPoPwa@~cJ%TQRG(apJdYDRX1ZbRQO$Mw zk8gw97#DFM*ln5%EL~+(TMg4J?(XjHPATs06nA$h#R(KBQrz9$DOyS)!QH(;3GQye z`SQHy`<0WNoZRFlcQU&>Gi&Fj%Vpe0*>qkf;<1(6_-cOiOaSH^K@>awxc115-G;MC# zrkmo+1fe`{9{C4#WE5i@TT$>U^WwBlfn}l!PNF?K$gTNTiADqO|R*NjFm}ohAXD3)uJzWqf+|1NS}q?^VG9pZZOn@`J$?@$MEV5<8RW!}mwV5v z?ni3>!#r%iNuQ8U;Qkj=VAQNbAy4@hD8{n;<>PI>iNeR8c4tGS=ltb~PKE-iv9?ml@`{XynMJEyG9;vcHkaI})9jWe3^m|DwM$hwi?Ivii3J2T*Pt(|uE za*SAOYquVcS0C;okADur8a%U&ziQb>j0AOeM6szz^i8UDUmjf4 zfF76Kxh~iGbso-owO+1NuRr^Spbn?=b9Hq=!)i<39+r`qE^qEGF2~QrI)C0?Ymf-z z?}e^`(TfR2?`rF2LuTz??r%xOpnG~iuP@}#J$##fc~}j0@S8(RTMsfjZ4V;#AhF+d z&**MULeoPV5oR4}#}Nw8x0%SoX>-V#d|@7RpFRi)edTeX3p#$kDmV3HEk_Loe5DL| zc|mS;JL?~3Te}?ZwuV}Ul@o4}FuBOS|GUZaaBkcff4Sf0H2WtOQ+Po!OvQCE3qB*t zGh4!8+UfQbr^7#(V-Ow?%VqV9q%2gbkDDJV)2+CWrq>@*%ElYgr1Hyq5|6O{L5eHw zam!U?8r8ZnCY+%P7TBQjr4u$`aOJ9cxVcZx2-3`Uw;KVxzgz4&_5UDmDB#0`S

    8 z$>2=XPKR5Zt+iw;g|8MY&C>gs(L~Ck2&z-^XsxFdpJr7^4W{doA^HxpK$#XkGTa~2hdf^oaLBO;{5-lY*p`Y27jUWa6Z~E)Xx9lH zL$>T8=W=F%ZbA`;fdpCttg>2@+hiPFMdXJeitk7SQ~xr3Qs3t)*1YD(3o%LB-6*9i zziVn8eRzM=-kP{nEKeXg^SsRw>09rRb1|Zpera-EoIi_O!_tN4M{`D9V?^7k>$|y&*hJaIa9pKi>Lcn@ICF`6C$)$4^attKEkhP z{FE#0Kn-2}siyyTSMi(G$CI2Xxu&{0O6PpbAD`$Lq;-NU@xsS6Of&?R0Xx3g`;x zk$(uE>8VbfEujssQL)+v;Ykt&50@w*Efr2W-7aSY)}Wp!BH1K`4-+(>1I&VMNLhwchu4>D4ne9z`w^k67T8YZt(Hb@n4zM_M=0_ zYXVGSP=E_fi0|b#%L26+LgeYc=a*SKkyuu_a{+g2(^MfZKPqtIXW1*7 z&NoN1!e*^N`+}1sZT(I^;BdMCWJ325VDi5)jC^FhmftDvCZQVO{V12 zlxOs(%IuD+Bd>|-oAps%i62kap&eY^{(AI<_DT!Q$W`mZHG>kvw*xya-p8!6ucT~q z6ZT78I$43ksCuPrME7E?Vv4Jox9&4QXlu<0JOW{+ak>I%NX`~0+>15bv81|*DII_L6eQu)^Xg0qb=6YMS<^HnhRjEFj)WF-rHW{haxA0&5CJBs31*z58)9AzBD)qm%s;PKp6s;)cHD%yRfMcrxq{q14Wk;kr4b}Cj%!WjD!hJ68?ZO%K^YN(2Mfh>C!02 z!a<>No(IoRBF;+vq53>c6UD3Hy~g3~J-B)CO$7hnc)4~vQ63?AN~nE{ z_*kMM*mPWb(*a@OqwyX*0@%xQub$T7z>1H+R-^SQ@DoVTwtV8Ys0<^Sh_nooiYvl(?i%u%eJlMH<$^=Xd_lhIp{hF!Eac~H>j0; zWg(LNuxNog=B<`4U;Cv<#3>yHQ^!?a*&xw`4q z$QOf{*-F+bqOx36MN*Qf*ArNAW*>A*N7X(7$0&6rORp}g=``gZfvOn@PSVh>Dqpv&q)$d zM7ELWCQ!anc5{Y4hbmlKOvm!?CjzQzV}?d&gyVP>nQC=y&9P-tF-(NvxD^1l#wcY zxoYL%GW4WXn5i(IludK~WrV%p&lxKHtX1;1n`x)_bjXR;Q#q`a+%(ZnMzpzqNvtF% zZ{@w9RO`sh{=K(k>PIzAOblyP0kf8xBx39&f$O>|!Lcr}pnAOaiS@!Ujurn-R(a`_ z=V{a>8ia71_(BnjU&SeohfTryc20}Ag9HJ!)4X(0Ytcs|_Lm-RCq?+W z*eLB}7o@_+0^|ZR>H_r}~wlUs_Hq``#>D z%;7I`+z5HXbe{wcok&oHe+=YvHer}&>@fAoAJyH9k^UFG8!dMy*C6r@*!c`Kx#J~W z{8JOvd3;qvQIf)mH{=Ak(=CxzLwvXm6K=Ai16>0mw13Yw6}UF-U5vl`i#6m{G_O=6 z;91)_TguA3lsI_}o`YiG2}m;N>OL92xTrOHp32C{+e8chyfiu+e+tQmdOxuT<${u^ zWhEoz$O#Bw=Ro8Iq|h8>DOTDCBVWeorJmAcWKKp{S`zbB$}TOg226PlCN)k*gIrQX zTZ|t4CRa^cCuDMkzdw@JB_@zyborm7QtePSZG!1|U);7^Oe?fOe2t8Z9EHp=@pTt`Jc1$UXXc{G*ZBdz!}2SAsV!2t)+;`h z`kU~@m7FF2ig! zV;%oL#Q>>(fA1}^)TeFk^VnJ|k6uYf635?;9c8v)ZZ2Iz?2`FMq%F0rQG0=jo3ImI zrUk6pa2|xxq!-tel?vWp_7?YJhKJ-}l-^XhL1&qM8E)o~5At&d2@@2Y!G**4j)jK` z2s{^bk1f9&-N@!iDN{`bgSei8Y53rHXhVc~+bgZFupVh8T?K!koXW3m%dApyu3#sG zQ4!Jw$ncA!J;Mi=cJm0w2BXzGI}BMYPmq%c3d?Q)D-EjabF+*vM9 zBc8XuZ)$S-$x|cR+!H;g;~e$R*vQkZatZf3^SX|g-KhVd;L$c)Vk{w8m!A{g5qPpc z`;+J?U+%UC%}%F2%LOsNJ60#t`~Mr!!_@Z&S^U!yugbGoh5Wp41ArEw68Vcp)xpFg zp!v1fD$xA)W+Bse@+5Ay%QWde+YT+aFZTYdq!60n@*c6_QFun%&VqS2@0*lK4N7en zBjEe2CbQPjh~2XsL|>1@g)Rvm1kg{XNZ=OAh0s1Jh+mTRAcgdIe;e#lsLNlb^KWRnP?QN&2S;+iDDFTDYz*znEcg@XeT31 z?zr8C{WZD0$+fxAVQtRW5w-{Ks0m(xruCD}Lq>`y~LlRs1r4 zo8u)PY~t>x>MNHTEuZzvjq^HWLN)7w z=+tHQVZ;;)1y9JC=Yz_SVDv-pivKL|yDuw}h4XS@k znX+@E54;zfYukT}%b&^s8Tj%pKNhUA1e_6_1=7E=t?J*tx33DF1x7FXQ_A0qoxVQC zh4Qe;tC&Sq;eA$#^TRY4LBb6hlxj=F6EAaBUZslTfG+GsF^`6dIon)ujVz~D4M#Sz z)m}ZtaodNirF(^gWH%Olc^xeUA5Rn~eWc&dt&FKbl#*+q!>U9NYB%z~7C0AvO%ZjP zs1CTqFkbMW$J+^E14yVo+!P#zo*$Ve-@4KgUW^T&>hWn=D+^p-?=FAeS18gj;<|D- zunrbLpQMs*Q>Cxx)33{XzJ99)X!!?W=gF_dim!$=V69h(^t;Dkbu#%5hTUy#x7A%# zVI-GmG)m-mz4)yXuFT^PL$Et%7B&HjYwnk#6Ypb?pKqp-&_u;{GRQ08@c1IjUxOv! zrI=8E-N`?!TE8D~RY+S)ei?XSg+lxhP|sKRLK_CZM^cR@R^yV#x0;B4T`OP};Cs(bx9%19}>Y9kd? zq&@jShz%~}v>AnF5|{^qaYGSxogGQL5quvDH~TUiw{IWFqB3^I3fS}B0t7MlzYZ05 zuy*7TMmvv-_m*?$c=-GBHc**F)G8~0!7Tpz5c0S{fYu^a4Xea9QZPO@o)@h;-6gG?7N@D9D^ zJmSR<<`T1ofx)OgOhMoCZ$v$KX|VPAWIQ?YE5?C6zvFj2zup;;n+XylS=Vk`86h{= z!tZ=>qcd3%#T;IW8=TcEZIUP!?_Q=l$nfs@TkqwWycD?C!QaVdR* zc%XMj_Rq?OkQV`WG}RUIHgF?V0>5}Vf^qX6#c`1I)qCzcG!A`{wq>QUr@kcR;Ja+5 zO^goocu%9O`391z5W5_Eo zjT5eUFR;>?g}#!EVHid>qlRbpru^ha)fh)ND&bA46vfpejW@FU7Wwwb>(Ba{Ws*(K zBf#YMz3Q(%54UsMx9FZga^m|@Nk{1K<0OrGKNo<5*wUWN{ErTyJaGO?gxT$z`c-Q} z1oK}v80FTAIab)EJ9)^(|L? zRK=P>dp#s+P6BugpX60aRsS%LSXK)PFGiHRlV!;le^vOQ9TEMKTjYIp@HIhR>B%>+ za#lC3N&>A2xO)05CZ-D|_y`2#Q6zOOST^eb}(neLXu5Xk`^3O5JG6_1YC|!1cXrkk^u(KY9tCdM@xB- zDOrw17bzQ3tGMY(#|PW*4zC~b+}G(7V{l=dH!Orzn+XtLiMZ79&Njt+4dZ+~iEYt* zdAHB!^DKpyP}}L)`rOh4y6pXueiZiw)xfdFS3J_O_Bqy3yx95cXq_NbD*4s{Zinic?#dJ}!j` zz!kU>Uj#ZsR_M?PJ?5RjNk=s7cdHT*Wz^)E9LjqeN|#UKq0)u<3^(3y+e#NS(uLeF zi#U`3tR&zf)1*wGt0KFJo0* zMct8wY(`JRKkW;1P>opaaJfj=;KhVjEyYO+JJ3dq0;FTNzFm)sixoTSnj>aInX9)* zOP@*F@%w}`)za{Cpw&xW5n4FzH{p@o{;MegsTa~OJya`k#{yJX3Y(YoVa8Zk4kHX_@A?U$ zf=W66!fTP8gKK+XtOoj4cVzu?=LS-@Q;S8QYL%M8%}u-Mk$`U8!|X*(e=jT1V)HrL z-79KYASTa0dy#%`QrC;`HwPw%=)SOy~`Nau>Bc<0l1YkjR0h zF;{p%KexJ~T;gtfhWK6O2~tv$v)sG-i_BRDKuxgTmG=a|424!AsFTf{qQk%YT;upo z73O?P-m;(PJ}jNMtVRy4{l^^6y4)?gZ+y1+jOUu0RS!+hPX?P&>b#Ca{7BAP3=YP` zLm{U3)>T{;Z|TpHzh-a$_B*~Sti>MS>q9-we_IY)hW`>j1uS2+V$LqBTn5KVWVT%h zuO_sz-`#aJUS>(JojR=ADa-=no&ts~Zy_XS)VJf$Fbc=1{}kqYR3obTxs6%7OdXz+ zp8&a1w*bfY-P&1kD(a@n<=+^UuZVXSKH)Bhfq!Q1-89xd`y1SGB`SwIK9|Cp9VWKJ zZ0O%G*!Tg|!yQ4QE7?!M0UM39r$}pa;5;)n=Zt5kHJYWWm0zN)_bgbImYA0X)Ew62 zhwlA_z2grp-NU2ft*iEjE&d^U>d$&>4SNHJVwn2%;_UU^_gTAvB1*vF&TxcvM+rSX zsgpqdRU!ar^@8jvm}l|!RT)IZboWfNe!&Ki@F$=B@5a&e>=`h4^I?_KWR&Tz1|ybi zr|r7EFkMnt{2as!H2n&axVs4&rKRLKQ}5idNc2ACjuc&bP?rAHMe$Q&+x6$1f%A$s z_(J5b)&ucTPb2?bwv0%wA}N)e2xE7%4}H8>Nd2q?SFY-K2Z-^tWhvh=x260QtEHWZ9zpuc%l?l)Z;0#RC6PPIRH+wh8HySq8=wK~7?H^yCqIZ1Dw zBHecF^~HSsq|qKeFT9#jg}4a_9cMn?sp9e>9fql3f{puyF!u-P@yiCG!ATdT_~pLj zTEV_f55o|>{|@X7nlae3%G0KK(ggux4#;x zKcmQ5Ekk{5iVpVSx$osDG z_XA7(e71t9t%E-B2y-LPguYk;%v|erN77RKtkdV&*05@SqcjLhBVRCQNaSu{S@_t} z*;pRCev1uVN>?w$B;Qf*ZtDg0z+BE~>n+GxbR4s<);s>ni6g2yN77pjK!U05&l*)# zOCYS6-oK!y${~%S^&>rwyrQ9wvq^fJ;mS%*K-8SGrH-^<_LfAgkXNO43&r!(Jki0< zKM$v5wkZa`7_DL~BK>scs+d3i>7Fd3cuZC%p6p`;OoYF8lmock4kEXeYq-=ouX~b- z&B0G1)zaXPJFXR8eqY4i|ML^5Q&)X|7G5>0X->+ZzElNB-Z*rWg@7jpUgd zW&_S$wBVM^&Bc1R^4eD<8gVga1v`CG#x#kpj1rsbIBW&mIZuO<*Q!VM6*<l>lo6MOWV-2{gt zWL(Y8TJ*$}@*{~=F6p%@HO04k;+!cXnBg~;pJ(~ejC>iEi)OFYD*1iamiI?r)6NIB zsyx3bUj|Xg_p%_hATD6HwF*9*YT~1*VTWp;#eT~~i367!+E+4nL2QYY7Yb!N8C{pN zFW2jwB!Gc=#Uq>ZJ9Q!kHh+C8D6|5he&N5R@-9`#nNA}J-gm;)S)Z{H$cfFc-sFxv*c>Ki0yU%n%@&m8|lmkB5QSDK`1f7E8f?GJjqiZ);2SBFU} zuA`}iaFn^Xt3=4?Fhrje?PDGUP*cqki3mQL)U{~c5o??j_S~#T936aE1F%mr-5e=J zbS(QB4UPL7A)CF4@Hg&xJJ7TYN)-X7QMG$ypBgUxkGiz)?bPW51r6s$7VimPT}5&v z@Z{vDV~{bhBwfW35?ama5^gnC8yjYUX76ZHy0(*QumWV zc=Ek>*4#T;JIqq2Qk+0d(P9&fPQbF&ZNS;n?z9)F1)F0bs!Od8;V_5Odkc)xh9>lU z>vTry1&&*9-)gbSzZ^nX2ip#xV@mOI_g<@j0zj4hC7Xmy#kRsE!Z_U=xUARzM>%mxzla>U$M zbv6rq; z=g4bQ+8s{wQ`?Rai7J>hqioBRd|oa(?P1W}8yj5EzJ}B-q)k|t_n}}+1p42G_FDTI z%zR|N3}Jg(zI%oCy&cVKLsDPGsrW0Zaj6LwA$Y--W&OWzFVxn)xqV7XhVCcJH)C=% z^XHWKJmX*%EA<@nhEOJ^lOre}oImr?F%NOo96m;iCI1WY0J{rUxvY)8{O*OYBjcCqMO^Sy1IjP-TdCMv8;}1R z`vO39?|q&2it}>E=KaPGlpBO;!RBYrO8tnhe9fR`C$r!QqrIfG*Z50LX^_$6c(iM1 z21%(y{ykj{Qb4Lc?JM(IILqYt^kWZ%lBYK#{!XExvU8Gp@pzu4W~FXto`7y2)9V8kU=$YnN^6s_l~(D0e)>Sl zt-yxqD$N@+gTb9fTGnl|EP?_%ge`m9v>M#1h6X02DtW0IWG#WZy7I^>)GyyywJ;hp zRJu&e^e(MPq~;Hx3E<7Fe(k#3ELS!^2COS2w`Z*|b!D!oCGa6Awqxt#sU5k-B)(aB zV;ySqYy5k|+x|Yb>m%qxcX8AvDp-B-aTWpUHxCtB1Mw5sm&`h5J`4ibnL3U+gsRhy z!H7}iG#x3Y@y5AG&YU=x@CsgQTe@*key`E6)rqIIB^Gdx7l#qLlghTRTDji|PG|+MBoJfM} zJVa=anRZ}3MVGLK;opQQiN2*?g@)m^s%~}oIa1_WM@j9|n|nyTP)MUtOnIj=^J?2S0O5Kw6$sV}Aut@rMcGEd zvlvhS$v^kgvtsT^dXuPS7Q^<2Iz7^mS8)zLhi8_M)4(oDP2h$`2cV!EbTC#0ji>t<&sCy!!B(ukG*_CG|Cjg^ z<^@0;i{V&}UU98$7{rZsI<{5wktPN`Gt#cyMI>#q>8uZ-5G|XG$N|Ca6Y#EO%hY$YVx_;Co`7dp0>7d28)<^}UTpEm$ zhgY)A6Iuc|)8d|=j;!#xEMaQtI4-U5gFNab9)e+L&KM>RC)|#4szn?n1XaR*Y^rtr zxf2-&CJ&}e=*l6rMptt+os7wvAk(GBbdBk$Hj=lR}iAs~Gu0CHVLzR!hvdfX)E z2u^$ZXrkTbJ`>W^=3W+}vnqs-U3T(o0Vs)&Wul8+=gUF*@1%7)Ye8H_NBZ(J@$Cxn%E)i~_=9@X5CytzuhhEoap9)aMuSBtqEe@kC|IWS>lQR@ zbL-(%#Zc?TlGo&*>(r9^{jQ4%C7PIH^#k(bPiK7JX3?R(`tH|du&pKDTkI5U+Z!&L z{yfla^5f4()#%LxX&+=a`|5QoUIsV2FF#4+a>;+;_|>Q)w7yH=?znGq--T2Nmu*o$!cio@Q%2rt zn+F9HBe_kt48@{z{jCtca0X1jZ#REPl~G=x^!+LOPl?td{Kr9PINN}`OzAi$!L+`P>>=(33FCCMxRRVkGrS|f`|;d9+2n3_M#R5Rjm zi*UuV(bFl9!n9%4zO9CIxd&dD#})K8VS#^hfNI)yyp%Os4+#X^nEq4 zDWbQ$--Er4Sq2+wtu?F%e^YWiv3z`_@4ESmp5{dLh)7tX`w0P4UTx;Hr4)^FJ4T3@ zIl|4O!f?_~ z=s}^2vPc^qF8t;4lt9oALd30jn;*19YezNbHe&{EaJByx(gQLm|>0E8-tB z+bDB3H$U$AW&Ssj4%Z>F! z)-tzI;(*SrMmKcKcSGNTYKKW5xG}4^vt7szTp)sJcTXKs(9)#H=@9=v=RMubX;_}ygn!xLBgJqcdtdx-3_nRWFF zF;v-LUOj?s&(O*Xb|!h6UZwY!>2Lx=JB8kXvEkb}183uXnZdpodqrXD??z{AfRI_J zVD2KEnzbNy0qFT3D%3$05fN`s`+A-F*(k zQV+t>dF>8s0NZaA0V-CWmYv_*o`lN1b%>qKVv{4)9RCsTK#&KX4xe?v7lH#Y?GztP z+P>+18V}sdO+Qjg5sEY6Se`ruoM2|K)Lb;lv{jV^X(TmV*q^C9F+qhHP}DN3eO0 zmkdE&FN?=)vEsXdlq^6dn}$N-rYF0zS^%g7paWE>gd!i}D^d9?sOlY>YByZg4*t&4 z?d%_Zk9Gt$cy62r$wNfW_(J5~hXRD;OU-qRgd*<65dBPJE{Z_ z>^V}pXiT~#=4+16{t{q{nQLl&uhp1)y}CJm(oX73kg^Z(f%F>};zfVX^OvTB&5P+1v2QcI zn|;lCO1}Clvc7L zSzHBv@`P))6dClphzTicLc+;VE34z~FvSpZYIV*{k45?KwUB+?jz6A~zbWY--?v5< zMf!uFxD+xG*T1-GZMh*xND$c|89_6?AgTAg8g~zo6DL~J`$JTXip4BQvL}?a6hlYl zPM}1CGC5YeyKQ&Grc{@UQKj6zB90d|{jiuis`}r&=G=$EDXw`AxpKBt_SCXUm6AyK zv{RQDKf1EyVunwzp9X;038>ndM*KX?e|zy~!+h7|imfsofyTAB=DRcu z-Txr?LFWH5Yx%M(FVMIylRr+dS9zIhi@H0MjBqB*ST<0hCl(c}xQ!d2R5O^HD(xt8YDZ?$AY@a6`$em9gHQns%e;U>vu;X$<)&o1T0 zxZxjRR2GR>lP6~3RcH}#Ku_DMY7XPpu=&F8r|vEP?@<7|Js8tUXo&iYE4+B#GJ1pc zX)L#}&1cnO{Fd(!a6}VJ07V6Q>Niy!x~Nh!)FFAL-W6^~5*2y*p;QtbRaN2=T9Wc% z>$DbB0+dF%;QT8QVnJidehSOwh!}K1BZ{$-ZKi$4GC$)mwG3qadQkJJ+hXr^y7wn9 zX!=oN(O+?^g-Gb$8eI?PHfUzD_}NI@9aro0@-SP&ecRKrllfAJm$ld#UC#LA4hv&33PkRjBh`#mcmhT{+a7_W4=9G(C=|6S*<(Dc=BM&xHiOA<#W z=g-}C9ns_R>`x-7O}SRw){p$U`J}Lkqf>)(z?l%O)eyAT+=VOiLB)4D?JAJIU;O<$ zCUmn_C(nQHNIu6FeU&TWEp|q{G50xmIn?K;tNCY>^RTD;VS=2rBe@iPfQEUCuOldl zEiQN z8?drt6>HAv-Th9C^xu2_Dzqg)+U-nJ{|25HFLio)lt`tYr{|ia0 zzIN05{~C0v6$8qpj(5kQG$Y$NV%Ra*>1StHzpiW1m{d&|v_h(7EJe}HR1U3?we2#Y zy$WNgiaUTljEN&Undv7jI+f}-u#31;JQ1E}v2NcS?wQz;TmFS96$N+Qj+fr8TxC7& zcQRr0iE7P&Kz1z)uCiYZ?l%=BRw7$Y`Z?W5s=~yZ-iY-?&&OwnyjM<4CZQ;64OKYu z#OuBYc%wJcv~LUe_B#v%UXM-RL7{w}tU<@1Py-Z9Z31=96l@x&I4X5)(Zw(9M%&DI z40ICWv|hp~SBsv}Pu()2=~Ptgj7U|D{C4kQpvddsCbLi~bq?5GNNe3Ywlh5Xu`p)qftXj^u1-RafMY8og%=30QtmtNusL+|eNf-nPzbFq{7czhP zc4+=VCBS7i@i13oJ}3)f8pnHU5T{H4Q={shZT4F>L003V?4F|rrlxIxP0iN>M?|&% z=$6|xvu=Tpiri=edC|2lipCGlQBq;y^#1uNR21gFN|>ttt1MMs+Y<^7gTmO!Co9Me#5 z9fH`K4e5rffIcR(0F5IV0s}TfYp9(whb3<3-nD4zgv{vYp&4I4=QPN*$PwSsC!h+b zMV10npQ*2Izbe;G>g-SQHU^#WIta=)_G@{s+I3Bge-+b~7IH`v!55Jd5s@=;(0jEd z#Ssw97vsEDu~U1=k$H2wZknjF!AGVxZR_~U(ri_i5VM45Uu$O9S|KN)X0!OFXX66n zxHTwoN#XX!eO(I}w@Q0_r-U{!8UyjC$zl0cFXh>;jfma$5 z{6t~Xy#6@EmR~(WU1~eObUhtYnD&Fe)?n3a=}p4meW`x@Yw7kg3=yqK68zL{hP>-x zs|K;7`5Y7hmJdN$s}Q2CG}@G~6#p2s$xtK)Mt-(ZA3|IxQ?I_p2i(#iZrc?NS!hj%1}&;yp^-(O-^&1$fZdM~s4U0*6j7@^j>L|ZVQ7v88P3pLk&x6? zd$ZDzR49i8y#E78ID?}>>yX?zahdm}5EZaSPB6tg@ZNm>fKUE{2zmr?c?iQwI~$vN ze7l>g|ITZLZD-0ZMkWHY25`8h-k&z{yv5BLCKF~ikX9EO4hLib-`qo6Y=PFVsrP!X zWR4;2j%V+CK=Z?YuV?=i-rZp=-E1@0pfGvJd&Yfsh(5HS{>L^VA~b0147HYCm2h7L zFG9MooUd;M&)DCq9vrioADchaL4C{6bh&FWtiNPU7brPLH}X(Js=yi95y$`ll80Js z-#MU%?^1t8KLV$nlR!Tolml8Hdb^K@82@(&z6$XR`}1>Qr1920Ih&~ZRXXhA-as=nXyM9Enq!!l`=a9%Mi9JCgK-9nAmI6H{j?Kq`-MbD4`D6!XQ<>b)+$SYVAvhjrm9T z{qTZid9YC*e6RqE5}jt9f2ZKf^ZfP#u7+|lvIG5SJ~r(HNkJZ>aT*5S) z*y$CsP|L%a^CmGKgQqUd9FYRQB2CSNG^QFrmo~^lQ(m+Js6jpbNivb7pi=bnipHD4 zIPg*aQk3p~3L^LsG!tkm?D9_`FYhAK*h|=?Z7AOG^K$0>&r{VD{cB1FlUJ_xW4dmY z1yZk8*|RHVEoc0()`S%Knrr06Hw5PK&>BPmT~qWMAbHKcO0g4_t*#TL^8FM;8p|x3 zLWzC5Y6kyVGD|9r+MoFa$xhi{{3IV07bB{#6?N5;o(eLie#pXZoD2+%>+JE&@=Qe= z{J@-`#T!s;UB=~@RS)N#&hpU;flHQ~_p!7D#&E0UBKZAM6W(wYD@4ZYQb+`s`m?^| zIn?{J7u-0j@o2~gZ^TfZWIdaQf%-*XZu%XWwF1%2-3b_Ku>M%?&!4kti(c5sCR^U8 z|COjS&aJ${apUAQdHzfN6(~_7ryZ&`C{Muqxfl(9!~%zA3-}!?%r>lw&H}c-3whK4 zWki?d5Ix`Re*w2o^#|=LGOw1%h$K${9RuGF8aTe$2y~1c_6qSB zPhQ)AR%S$p^)<=D8^SDp1vx3iQTkHzM5XyM>fAEvpUEtY5$Ll&x21<_46*{ac={0B z!YMSXcb@wk41cw~luD!B_?JDzG~W-7EXLGNell)r^Bb&;T=lJ>wT>jJ@$Ar5Jv+I( zU}+ESTNQ%NJlZs%*F?qb`_ig?SxMiwb`R)ffgtznULG<}$`#W`$|M%=N!#D3eJJ2w z4Ml}zE9K`nl>FRniAKQC!1JK}$KIwuxs@P>L^CJHror{sf08L(Tg@K`j13=*0Jfge zCW1R`Dt|`N8Qkaq9U8>g1vZd7)HtZ7M;M#FZj82HJkimh2HKGHTC&c@ z%lscx-yN6a`@LW8v>dsz;i_D@N4ark!yE~&9Hp75r74aaNUkg`M{ZNm+_KVb6pqb25Xq&e>kQorp+doyQm_SWzsA= z#~y3wr5S=b?*%*pPMZmw9R_E4a-WnLapE)!mQmz1D=dTL67YBJ$M zW}!YMtl?cCipP0)d*acm&by1Xw89>+?>D`tE#H&8=r8C-Ep=ITH@-BK{r>Bc%$9He zu?v-WMh3fM3{kc#m&NEj?bpAM?K6fLlFA7-_Gt$+nX<0_b*Rv!R3Nf8V z$@*ud5`Ux=2$4)T!LQFGyu%zMB`cYJWm8#@owfA$`F=Z5LiVR&joQuYAgA3XZf)m? z!6c<;N!>h7c`}Is!|uvm??vmkHGePH7D#swcfOQ5EzNEs6x*m5ocKiNSZMc>1MB_d zk%%q`zY~@{{iN#t3UK+Uk5Xp+%?mhEM$HQqvm$z~m zKqr-SJsI(6TAH}QFQ5@YeDOA*ytAgDRrogQmjJwAaHVSBSgc?~H}iY$L+^Y zkvXPP@&bUS6I+-R4V;uW&>YGc{I6(0^T*Z&mPGO{H9=yO=<(|i7BmH1D{t9f<4rZTZ@pdEwcL0GK(DqD|L)U zK78AwA8BJ6&h50sJRdU%owrNqwwk{kC@SpE%qHBYJ$U+C)al3)vQS8vLYGL;sN2tD zUz4RkB*yyvIxG^V!$TjoCV<+{G8Dr-;Ya(##;`RAi28D}1 zU%Wu)G2UFi(V-io7zkrVeTG)6 zHm!JhwV}=J?uXV7UUsu-05L|;UEJ}E4ib^uGU1plJf?T zPhbTNi?rYx_k=r%&%`-M0TUnIlAD!;lvmC=W~qwvlL9PniGA2|a+kaPvL=Or73o*@ zH+e3(Z0n^BcWjWBRQLSUK70IQmn(lg-hOX+o+ZU=bSLab7e5gQ%0_$Gr5*$ z_%BGGd0cW_R>nP;`iQqUW-wK~IF{#0+~8Ri2%tTRFw5uj8|fEBm=t)<@sxMo@=(l_ zR2Fr;r+2fA`)0{^D4)=~dF5@;yI-On7UqTUGhMy;tqBDsj~K14M8)@s#?mjghATT( zQ`arZrzqm;pFN%*h8}VamZr?3dVzzYlPj#{h9)0;t$W#5n6a*j=A!oz0qRuk7T{sv z@Nh1qi+?o-5>Va0C%=GZ>)tB8<|z;x?lNa@4FDt90X$_DLe)|#2xU$IoF#Wi_NL1~ zO9&8G?*(I|hiHzQM~5xLt`rP^S#K@iYUS5eo7v2xhE4+{eDb5izEG#@RkEC$d)6M5 z{PvH94h~k2sz$;s|4~&1@XH&5rKB6c<>)S+Gts~n+I!K6FZ7vZ%Dt66Qg<`}o>r&M zSpne9fMO~(sncIGhjpxOk?g-5 zg!(%S&(ll7-Z0Ixl>>!t!%bnw#i=ic%`#L4N z&d)Xki|Gb`Zxql!eE~*X(m(9eok!aL86t{<U(@=syAK!C3RN^$D*+s z#&t+h1CD(RcXoj8ed~=wH$H)=?>^Rb&iKim$P0|aJzFLK*#F&R?mj{SpSFH`ESja) zQK5Z`rxKU~7o5fU3xHQ{ki*I z)`i>QO?k`lUgxVNZaE}Jfn)Cao)vU~`R6!a5sMr%Un zFc@i^vyIM3D7<;m&LXpGPA2y8J4SE}ipyL5J z6eK?wO6X`6y!Tew$m0{({B=z(lBxVo<{f|c&x_m;-jYB_Qq-6{yI0_&>1vaA$E4hmqEGNm+S`8}=(j^m2Y`4EL8JubZUdZJ9 zerX>x^XIVo$&;BhYdq1PkV`n!ZosdR|BPtW+$^kO6@I!tn_v24{E|JY)=Ac=+oj8c z26?~p)h-HOIH6_HbXHKVzOCs^qoANlT`rsThCR*>ddg;$FaFxx$G2eW zoTj*`Qb_*!>l#@%iQT*>@8~M$a$2!0eAHRAqWq9HN>b()yW_sOERkV(f+s2L+bct@ z@XvZJk#P}hx>>zfrBL}MQT%Xa599n-yy>7XJVyj>XV(E=m*lM|bb>#n47ta+FOLv^ zM=*Zf616Zpec3Cq%-%7y$oBEYYXU;N_gx}3n$6>%Pf|CMDASlLqf|XQ^u^3nT7gtL z#Wflm(zUYf)L#SA)(qnGq{)AH(MkmOz(J2RYz#5kLu~BhKQrud@?JT_K3@oH% zl~bWTp5~lh@#98W&sSU9Ng_utEcgr?`42qE=EF^S;sqLEIXsURO1w;G#F0KgLEFwR zN2RAE4_rqPE(KEu1NJMbC`Xmg^LS)#qsA>M1V-m_^K+}vmxz?LL~FcfI*xY{twdfU zV!0FCH)s5vcbtPjDfHkb1**awqF8ijmYy&n>V*ccF;wJ$Yf91|0qxmuIQLWpf%fj# z*;6Kin^EqF?c1F%`*jxE2X(%(LWHmSVJQKrq2a%=Lb`Q513C?qmGy;Y(vc6U<`6MN zjU>>vj7|}R8BjS~odi+8AOv@Uza9BP?ijrsceynkzZxM<{^G4-D@DTRtekk%_({3Rot%I+s43)7H-Exj&#pEh#T1ih~%_pCBs&cVw6 z{&fgWLo%fy2V)6mf^^j<g6pM11cu1A0o0Ep)i}Pva zhPfGLcXz}E%S$u08^`4CBkWwZcU@d+?Q-(o^;y4qGG7;iN-5V)V_ppd-Hg!mNm`6R zoh#JlhlD6j&}2{VDlyOR=x9{jPOm@=Rs=ZZI8ggnKxLX1!RAmn z>$(H=Na4W%dMjhHKTu~xnzH1a^PJOBlmmh?Ok*E+c9dGV=eDY#;2&~l*@Na#gj9wI zAdz6IPys&@q+?USK8~=+Lb8vG@PbQ_274wg zdmUnfyEu)P_O$#&ld>AGHBzFWnMh6lI7oZud2h$=Ef&XTMDfB0ja6Qp6}A>|ut>;J z&gkyly53Bs;Xla+=}ixTK&}5_%2WBIf!(MndqgH*aeQ7pk}ri5e4D3;5145G2>D0o zy3)|_sq-?o&hVe?cYT(^W^rCzJ^0Ou;uKEH_u{H{IZr=mTv0315EhM$PY_(>V2&ve zH9FCG<>#@|y=(JaLfms#-NO-CW26PtR?F@TOvD_9i4cEw6>dcu6PdChK15!!Lp}O7 zjpvOf!I&1&xDHF$3w-b2%l%Wv-<4dFmE>2}Rn40eh-D6>(TP_C^npq*tc$KaCGr~A zczgplLFMvy9!@9nc0yP}a=3c8MDxj}x5%d!bqcgD2~3)Ebgd~q_Cw@jr3EhS2EG;9 z4;mOR#EUOv=e?g|IfeHiW@xD&36Ir(CBE6#TEuv71xC?6B<;{Rztp~l!v6v;j%UP4 zT0NziuF>o>NIhyrjKJ|>uP9N^$!F*>qZ&=-dKo(>gA-n1R4y&+(oZS2a^7t~Im6oC zgKBPrYF|93d1wo~wG|t?b zGe}q0r)ekoapuk(sw;TZo!6I_orXfKd;#``x%R-q9 zCTa%7&dMt#E)7h%2>$}5Q-aI=p9kdSj4Zb*wS7N)=~T7TKbGx|)osA)8U$yPgNG(D z3QxaMea-_p;m73SXlXl5(jDLfwD9fd-&4hRidPjNb~4xCv~Sz{4%}9>3BbiErHGLE3j0OiO>%bqle}+-G)5MjmvO+b7GYXUB~dn~@7M ziZndy`jU6!4b?2rY^zR<|Y@=^8^eki|Gt6}^w@FnNfCov02Spq7bp_~5k9x=Wa zd7G5KBG@kKQNy%XrPcm>P>TuU`ff``^H*U#yv$TzQ~c?WN3n(#OC!0KRkn{+-x~J? zjR$$Y`K$6<~MF@FL!J^NiI5Lgx{yV|4T?;j9LoTb3 z{Ie(fyU5G+0-ubYDs#`h-Rd0MIxoI>!2RgEL}>3wzKQK5JC8g|oFbo5*|+FO4uj~- z+FoOQ?jQJ5N45;4owypMLofTsyFB_8Kg)&eP}MU|pB*+Ta5LGvHK3-|q`#Mu(}j%% zj@4b!?qK=nAS+pAWt7ih4XIy`Cb%9x>|zk)oRmn(11g|-^uCD31KA=9Qy@Z00|@)T z>%%`Rd$HHh-^YBFBz-GwAHUJaWiQHRl&L2E!Bs(|NOHmAwJ zdB5ol{C!ShV(&cd1%kpbL|vzGGzI|mdjJL{3OW%sbj5J;B|xM!*glgc@-DlcYQ@T- zG2ao^cT3m0kDXz+4&!0yKTu~pIz3cI@E0pycn-Y*cOnXg5(&XG`=DN`ERBN809G|T zn6bl2#?7}c1zt}=u=K7e<|kg=)NMS_Olb!`KbN?^mNcn$x#HLUOiNg$VxBN~-_Lxi zAT4%6*y-zEL})bm@JaYSsPNw=9|=wQC{ImLC#D38rW%j2v*_I!g09%{|Lyc?-sL+O z7z64O%WfUhHZ;CQWp6T*w-g6eC*=9{>qr-9y9sB7dQ%-|(lbh}XZrA~v8AQpa+zU{ z@pv|Qu!;Jbynn%ch(N_>@FilU2E6G(W%Wg381i6I8&a94WxCy=Ax}bVd=BYRB+Y0G`oZClz#`W@Cn)hbr6z{ybI21R(~%G zF&AD>FOPR8q=liaDr>7XE~-E!w6L*W4&W~=l#O_+R47tv@Av8L(=TGIlF>eD?R%ecriinjDW< zmL7J>o16lhv9BA9x_TZ`@3*HmAyyBZXFn!m$Qm)Q(ww?c~z1bw700{`VUz6iZ=cZQ?fQ|rxV{GC`2 zs|$mH%G;ybJL&Q;T$tp=;|w40=@wsLrC!|57WgyHnoh5Bhnd?y9>$sb$8Y>mu+#dy zZ5?vtKlKP=w#uaht`cH5Srl&V}wt5J0(`*7xfWafopk9^QbOc>x;4A%)h3xV`sh^xYXqz@0;AGEU>jPg{Vks@8pP3ad~te091RQ-)W|w?wLCy8iu)CSmD($(U)gK^gGOgPSp{+=Qw6*Xks0 zcTV4Fam`-`ORft1c#vqT;og##lerADt3AuGGb3{`5czc7HEVE8x5N6=t*=>-uXtK z0$t0bJSqM;sEW$SdgRA-c}Z*D`&A7tCw<9G=?07MkFj}Ic*5?)-1fm2mX+ODsAq15 z1Oyatq{KfX*bkjC#CvK9RH!ykjjjG*+FPpDFTnk}5oU>ugqKj*w=O!I^XpOWurnjOW~nf{t4}40nFTe|UuoQXfgBj=mX7;ZYuTzS zbUyThfyYS2pki;BdYzstx_-O8>RE&7PpNu#aR+PxgXtGFp6Qbd?!?PR@}(r*w`>y^1EP(k*(j`(!;2`74I*3 z8@=kgz;k;0>RyYj;*S_Tru51;!=DVrN*))~*n~L`focL)O`7B1{WX-)-Dn9V@kRrx zx(_R>obsxPHTs&M5V$(Q^Mlrn$93JbYh)d|9Pss={G9$i#yEkvMsp8v=3YcEfgEoA zrg2~mQO$}}*#u8#h1neX6}mLtd0cC&@JIs)l{haw+0W$irdk`i(-45A zD0uNg`gB|N8fSTPlz>=3thGity&{M}H6^kRQT_CDTPV7~Rbf#0Ir1K=otqqWtN>Kt zP0iE8!QTV5*%q76XcX(A)A&}sypJD!_5bVm&_>(-aL=jb8hOeuEwEbHqV5&@Z_TVw zAgM~0=4`C!tKrc^I0j`xo(Tj!CAyP0P>3lmeEX(WC4lbpC`JiHUZ5PGsOe$=VwIr3 zoOe0eDz^`Ql$Q-p$LIvag2R52T6E~L?`{Ak`DEHQ?4&tZk zS?*42Kx=mzW~)>jrnOw@JIJYp|56Nyh8T3}e z{D-_UsmRYNBF;RQe(!d}seMASbK=2YBKPpb@xfU14)Vp3&fLD$0;_iO;+y`dRI)00 z2QwacagyFt_lz)ubJ*XT(Q?zGeqTY;O@YD-25z_L=nmMfXw?m=m;PT@++U`=XM2+$ z`6H*iAKbyk1}PD~_aaM1eU%SVB$H4i4!LIK_O@TvuUW)wxEc&8NpMJ7QiK!h2!x$f(rg`aUBrs}DCbPIipEoBW7<&-Ps#}PQ`3EF%sWZpznQW%7X092%+@fLV5=OQoTQTP- z*P}u*W|sPVzCG96rQ1C{3}7>QA^paA>Ew~RSia&dF1|4l2>~In{3ZLt82iUywu6L{ z2SYRn>#vLV(b)p?bzKy7LnB*Ba$~VEGex8yhHqb@DTbdo*#sKfpZ1#p*dqkh2I!?* zI9sr^HR9TD;^<5aVVGV^tZ2XB4ZYRqL*{O;NC-sep(jsZ4We)umLv5?+{7F7&zQF& zBUri2r>vv8X&JlK#B>Ydfbq?CozSaZT*zYuM-dmAAV+;jqiz2ZTJOl)fswfxORMk_ z1(8qTbqr~j$pQ3YO7x~+ffgd3V)Ot*T~|B;MbbfxLQ|3%yX^!HKdlSP3(<2EUxurL z&L;?o=1P!(l|zu*UTx@#Rx%KI`uxzf9&zp5(CjXP@FXlXbk|F-*<5PElBfhQ0tDP; zS~QV23nz(9rbPRJ7I26@n8EQRA<$$=7#}22M2RM9GX$q|^pc+CC-SmjbYe@O*b_;i ztK@RcqWxK!tk8Lr-L&cFH!jEGQXUb>IjltYL7jQ?WnGHMci?KjVKl9N9XL1VB#~F2 z#sLo?ub6jjRH9P#UyvlrQ}X za{r~SaIZXY8gx~fV|))>lxKdL_jFpN!jQn*T+n{H?;;Fi4yL0Tqs4ghOdee)aFwo{?+evPJbus z)-T=om>zj70w)t}wz)2z;V#guE%(whVjzX%J|<ewj z@D@DGZyN!%M;!cJUW57j;evzjysr-ltlH`Ry((Ek{IfRMADTy*3?{7Z$KFWa*c|vc z5U7EXo;M8Qzmc%PfrjQtEoWon@ z7^avCrD!(Wz}lYz0%v)u**L*x?QOZmZz+8*{K=#sqwc_S@zbti@nu1QXtrB{ne)cc z32esKosvG+b(&i86i6yqNS$JcK`0(~mdKkA|2UhE^|*|tm59U}e;0E}7K^mr(B~J~ zpM3stA!ZB0&|H|TrS7>e2WleDA{#x(_n$o$S+W1vgr#v1bm(0`2>vX!Wz=v@PIam;xE%F%K0YlIME-oG* z0Xp&8e&#oU*56x6&pY-T;iW{9&Hvre!OLan-#0bwD<()#b;+<|FCl0m5xv{~hPZ|@xprTN9zY5pM=inhA2cgaO)x4zBXFXXGv>u7DwHdt zm6P$n_P<3DfzMO0s^p1FI6_5us7=mj1^h<%ch0KNmZ|*y@kaMwnhK`XzS9qWu2;6d zVuy6}7YKXVaQgnryU~4UPg5%}$CfJzT~tHPo|vM3KZ((8Lrdd7d6uhn-|j}QQax_5c=m+{~j+n=kgvM+CM z&bwp?Hd#0t73H`KmgKnenJe7VFqbYfO^aD=73f=t{IS%mt@#7b)6-S&__zRhXN=YT zYA)-OW*m0#7IelRFQ<5h6+gDn7AgMMmE{yB=(yylSLSZ%xHciK0-evbgYc&(STHa+kODdpz-@7tM0kmHm=m1r~drGe*u@$lMo#lnEOcBW0|(B%1UB z?v7QxiOLj`U^TNbRnd5e>`8sNKarJ_OO@cydYcK$Iwf|F6es~QR z{#;F7iO}RLq47ZvU9+u2RI}$q-I$Oex8n|SSwNpIZua_dh;=4Juqk;M>D3-WE?gE! zWs;Mv7iTbaI&QTclNqM-pMdA?0;iOm(oy?Ddsx@Y&GF_hW5qOZ6r>YK0R0izr#z^3 z=~aKwN(A%Y4W;FSOcfWIK!m{AKe!C7lzgE4f}F{J=%z$3nmeHD=r+buqBp#hc-l$B zv^8AO#FtdL6W7MW&LY-U*bLKuu!#eqH}P(Y$j)= z--q^c2*=tpV7)aWM;H{IKpb_^9L0%zr@o_k5%1Df0P;>@3i|^-IpHFn;|*khMF&hR z<+(OF9>i<1pFykZUF7v!F_lQlb9&wPzV1Hq;%k&|))UmRirES@BkdRg-jTTE{hi2eTsYgZL#AyaUd-@y5zNcOt#H*CpU~e{gW! zz}-keb2AMEsXXUYzq|*xiap~OvzX;DqdSfO9o`qSiYpq(DcZ@Lwd}ZD?Yz~9z?ei6i!7gvqg<~7JBzOQI;X-&9SFq-y-~cBcpf9Rrl-%l1;dh z7xby8FXB7Vxpi~|y{fRiE&dR-SEEk|+)_IWZv9E#?JdgO`FW+$q0I+Oe*oXv*uIoT z2|@i$a3yptxH(f+;QfKLs~bdU!{5*k^?Qk!fCgHfXszj2c8I){kUZEe3z>#Au>?}l z_~ldo8u0x45Yc~yzWm>x{G$u^EGkTOqT|5e63>`b{V%-ZR~_?LuOh9BgumG`dzO6~ zlUEn2!VNOlu#J!0>1iEizvEn9E?DsA+?qS-;$|D@=;HO&wXt^Aw-i_!wVe(HQcyWA z*|CAD)EMCP+n4oUaQpf*Wh42Loh-V49@~i;@KL1=Q~ArT&}~Q~{beym6>JtP z;(9#ZNyxi97dUv5uFR7nB5p?uz9p0Xs;pBR%+Ui|JjkPC(^EXp+t{{%m59-xl?#FgFwLTp;6 z$2h$(MgO*pcZ#WBT|DNQ@l#vc4IV|Yp^Xz@@Y%)$n_>y72HMhZplS2?#+7B*^MjqW z{F*Ej%%yN=vpa+kb6X8_Vbm*^)x>6IH)HBr18+Z+Sb#zVRy8bO#!C!&-Lz<%-#_Pu z6H_-fUEM3%Buj#j!l4b39FPvB0e%N0d-%hR`*?#rDH-rrKz=|1uRJc0QO{wARDmzu z)&h^qk9U=sj{i#zo-s(95*g0C!nE?ps4`QxCz=mL)JJ{e|1o*5P8hG!n56ELFI#xX zuswK1x%U=xBwK0-D(}`%~SXVm3+~_ny2IaJR8pY)RbE z;ptZj_+EupKGx`<^JE$+ic{O?7l@B_m{F^oQUj{;A1~$vIxqDQqxj%92Dfj)*b**c9VZ$oq_7k z!z5i1|5B!2jnjU%-2DL;cDIx^Lmzfyi&tXR{Ky|19*xiI~9 zN|-1@HOZ&rL}DK`XDN&U_UzrU<_KB87jgGJZ)xdkqC%^H_e5CxcKf8NkBWhmIVv{a z@;e?msAEFT5WaviQ5Shaj3tKBINC>WSm1lCKS%^Ni!-9rcQ1x_Tvgh$lH)*LA6il$RNP&EJ2i%BA@oD!7V`BHwd&(i+S8M!gkQQ|VbG_92ZRFFZmBMK}8{MK{q;&%@c0Z`AvSvUwNID>0UpwWhI~ z8aIzUdqKOl)bb4HaAo)hr+C@RfcAEYLxLgiYA!+YmwJtPMF3HwfIbAG+)R9)Ms@(; zJZ3zX^Iq!4i$Nq1!}9<}wso%{B?dKU?mx?LP5*fOFl)Y2)dW$l-i0q4j4>gpmzwIDb25-S4+}kAZuIp`g@K%SB~#*XsK54yfuAtp}I72hUo(?JpCD zq?g$zH-jFfl~I%&KFRE#kurOv-ybclvU4&mUSNicf$w9)yZw3_MYquR>}NvYjJv3- z%WGG@kdgzx5_P^yQ-1m6e!i3t&>whIZq=|cawDih#7yv`Q?)mw#k@zgu8D>WoRN|A zeGKABn8$3MI>l4%@UuXMsBG_=%F&j1lKC2c_3L9b34^qrE%v%H(Vrbi-60W27MgxX z#GM$VYJfP{<6sj~qaiS`L9tS@#Yc3R{z zE>qQpCz4K*C}2?O>q3^MmW-!@u`Rvo_6L~w(?Nt)@&H+oPA&=4;^}9h6__=dbHtyZ zM*tl7AJ|I!_9Yae4~_@W?mzUd6;FSJ!}h_4sDXRVPz{l!8wL6a=S6?0MCiU|fYDB$ zn<+iWx^d~jMmHyzc@z!#$Qm}`Tx|_+3HtPe)K4F4VXm}29)Dx}^+jIq5_$<<`)|!& zdSEu?3;?Q~w~4$*Bn^}QTebb)sw_w685GgxTPmL>&&KWrNMVO@&O6k8`tH+>0@7@L z9b{t~qB6c$APfeyFl|4P1LrczzZ0o}AN(0foyEU?U<;LqkTd3bftE>KGD5j zrpv{%L;AM-H@yq1w zFrA8VV9>FeD9dj_Hz7FN@U$#gME@SY=KFa|c4ga{I?+iV^7FvR6Y-(Ho z*#5yRV`JB~bn;E|jerV~n}7r5N|gNd^KJp5ds+64J_rS4Zs_@hWreQfFimdeYvIx7 znJNk*;@NvnMYCB3Hr?;=tQD-}yI5(I@A57tM!0sdaLhjcb5t6eRrG~2)o^1brfcVl zRJ(I;BrEBy1nsl2Gui2hiThZ*jIceq9DDU1f8fUdda3^iOipDrBF;K$sVAe|I-$(WNkYQ}w}Gi+tJ#>E|fdhV;9tg_6L zQ&S$StV0yPL zY7~-Boq%Gk$3txfQ@LaYaHHm$rd+aoUDRh#_`~wlaq2p>-A+Q99Z;r0lcu!E>d9e} z1jjzvT}Y^yL`RVp~S&V%-S} zxXn?4DB?079(j@DV`vzWk#2~>0!Uzz=I-ab<8<~rHHWJ3f>=6pPhfq|IR@>@h6}g#-QcvhAxMKla;)Zhxw%s{BUp36yb3%%Hd)b$;tDZ7Od2j!?&8`Wcy9?w;J}| z|JoBA>Jh*5>w~~QdOUJMuu;7xxAM-o@oj=z$6XFbCx;||CvI&JXhr*m!iu(5&7a^v z@A{p0vnv`y7^^r*_ZwQ~gPwuH1cQJlDLZBJ$wK!qU6HXRE!yfs_=xg*7^>BUTuP?& zdrVtos6-3yo~frl@qUXXDb>xxF#FUQ3_Wv8zR}B~LsE#~cTG=08+wxe9g7Q5+?%uG zo=dplu_VWh1euGwzC8OAC2;CK+3f0im3Sjay&5BDQ#z&@Bn+B;4R|Mdb-omoU5baC zzs&hA4YpAR&)9fbY1Kfr#8`(W1U6_siK!pwVr#R&UqXV*?2A{Et;<803Ima=#WFy` zD%&=L$V1u;_*0Pu91sYSSd)Pa%#zV_L*m}Y^@H2=jIVmW{xo)twtipn0$AoXBmV~v zivpoYoo8mxLWd_#*1=i+V&8|;c46=Z!OoRJpsK=`Q_qN?kdv?U0hg%{Z$_fa*oK`3 z%A15#@FG|HoxM!yvoJD0c}cu8HQrV>=dtf6wmVEZnpF!N*5ZmhaLZ%60s($T{^)&bRy+@IjT_W&Fi$DD&pkLa>PV{%hWFec;_I48 zHq*DJ;~RamyGb8fOLOno0k)NisSJP;|3f#xxzqnp7oum3{bn}XnQ#it^xoVsr5s~3 zLge1oFoC1*5Q3s@~OSLVM1T@9yOTAyQ{(nz{P$YN;$6H zXS{?qQ=KX1PjEf?n20*8VLUH<;X&JKao<Sno(2K{T5$%C3YPy2&K+F@1h2TvsYPw+moC;RJL*dHeR2?YRgFYb zpH%IlmoKsh7_BZ$83e@1SV`WvMYP1}ly{)wGk?$G%Jq$9QsnRRVm21eVxFIGRCb{? z^+a-*UuwIOYT;W}%h9vm4Ldd&bbQn_vUDW{auWBDs&o2?a=8^-ffm@^Q$B9n!M=l+ zG_nyz9!LhcwoBpAYX>Lkx=$nv9q_po8|s0-+noRGn;cg>`{A1Nc_Y!kfB#%@U`4e> zF%o?jVghs;w&VSf8t`}!66q3fg=C9&fuvO&c|%aH5G@A1^orGTdPvo#rJ^?Yi?BG0tyT-Xht zrhLL)Q$(}A_;~b3ExsN4TRg*K&Y|5$r1S|kE~BDhX365eA}(hWRC6rPU$f_;be6Y3 z_Ugr*{;OC(_6EWX^bIxvp9{WDj-cxT9+JkXiM9+PD}{veQIP!&J465UsiN6@cv5V5 zGTWloq|rTkDuWcSTl4Ke_}lZp*n}w`%{#Kn(d5N|4RXaVu7kisz5=a{*;(V8cF*Yj zf17o#`IME$^pYzUNhyIceawNn09K&jCXTuA;qp*;gYj29dKcl)IK@g^Kp|*g+v>@4 z-m&`hwzJKws9B17f8)FVUA&f};mFub0qG%Z9)@wvUf&={5W}`;@QZwTAvqN1m*!;p14L$RLI7&DpZRqlI7NO@wU5at^J;*P zpSefx!9tpS9-$Hx0U@7mCNvf0umzLFJKS8};9h<{`sGin`MH^>fRFpoQK)%TdMJ`y z`Lfva$8%0@^aWJu5rseWO=EDqH$qpLoa73S<>$zAI79{IxemDyS4f%RA@UxFUiD|) z?l`dRN9m1G^oAz|BMhb_$FTQ;+D8U;F0h1^hJ6@rL-;u_<+Ye0%R(Rf@10RFLk0l3 zV4+nvqkr7muD0I=k}p^h?NoVQ%i0_|0BNy>nFv(KVIIVf;#b$^Nnj+p;Z6Mb6GED? zclpuJu&vVB;LdB-A8{@Lfz7rs1JS#XhzH2)cZ7MgO^a8*_}3l1nx#q0lUHI^uQXbu z70YCl^E&J*k5fnGtjfV{&nq9~pEs6C3ju#(x3IfI-;XnwVNtX2y|v8juKy-6CT3IW#vZg7p#?jmMemlLB(jx0W1ZXIjG~WM z$>_(Q2F5g8f7sYR_cas}25t`$IV>a30t`Wc>w-&xoWO-{sR%Z^<5KkRq&KyAvFQvz zls4+!=GKp&`*xK_-z$mD?kvw|HlZe?-Vbk*ib4EfF1xB|{x7?=cwOeQn=b!MHLW0^ z|9&%@f0fw!^+np1?pzI5rfbcGtmisTh#E$|XXE>$$Z%WgOH#@y*vaAae1PQKFF?ER zLd6dVvO=?0IQipG+dquYht!+&+@%KoUJ}K(HTEuF|1^0W*fZ^cu8uby-C1W(_84iV ztb-l_tauFy6piEBoFSm`?Q`gDgrHC}eH{qZDFQPKMM2=aE*ZSP10igO)`BrA=*1G+Zz*D{R#_^VB79;;au+l9cy}2yd|&(d4}3P9-3X-R`W_w zX!{{0yA7F8+E|EcKa^zbW_X}3kNsWWie1%Bo&r9{BKpsT);d9;Eu>QV>G{TiH_6aV z&=*Sde&}YnNc6!aHwK#7VUX~NeJ$SKYHZu89P8m`6DN*vk*xszMd{{TUK`smhQdWk z0~_Pu-d3aU1%!?`6TJ6YY@XRPy7!bW!n@|Eqo~-{Mrh)TDFUd)XNanS7Y2HA-C&WQ z0GbG2t;f$63d_;=NuYHm>74mBXf{GKig$7mMCl&;Q7I7l8XdmJP?#3~83B3(cB%c5n zbu6?UA6`qJC!C)}W8oX*{QBZSYH);ZqbP8{G^jv3YcOACdML}fj0kuipT~N0;&=~` z)iAsZp1BhQiB`XW_cAu9hxiYByoC+wKj{}gg}m+tZYLw+uD+KM*L zIi8l3@9N+yrpiWBN#21u&v`$TKh-590+gD? zVc8r`EJlGVFZFe2^O~PM zqerro(Mg!MxcHX9t0lym?U(3UyeqhqXW_vbk-34FDl>Y{Y?T|{4au0s#sr^Ic2Eke zmB?4W)1iU)Sv}y_x3Ctz;qU`(>3ycj#km>L=01xEx~N%aDh%SGt3S_z;>K6WC1CF} z@=2r6w!KWU%*#7jaI!=Ec^X_cau9l&VXOT7_2&K$_~opI{ft2hI}bE5n5Xbij(K^v z6mth2y&N21eSaylzDbZF)s?@TY3oy-Cj*@4Ltrwt9!Cxu&Kh`Dlt42TS1qyZ(SCV& zuu_MLXS>f;x$Xx2mLpkDpRDZTD|aP5%v>U1j1-Zseig@B$w0JmP+4yIGi)sDs$$r5 zg#(b-0(qG~D6Un&c_gr;3jILfDSU8j=u*^%w$E$d{IG-SrA0&-w{8hP5nH-nbhzF` z6fneG{sR_{1|)0y=%eZKi%su-Cr>61s`V1jbNx;nI~e1bU!r18jcVUL{M`$BX*mW4 zUdj#hx%t0+SN@L0Hxuj=s2wk-b2{_9yt1~tf6ynAu=|CkXoB`jIR>4Vn%wEHmz19b zefPgTPjKJuhlT~FRf%FvkbN&TJ;xkUmrJ2c5 zqsDBYQ!Dl}_@n)0M?4b4waD$gxnIYz+=<#%avgYUshK0YocT(~c#$o5=8@eb7g{kT zU{X~pqP?xkqWJo!r00mepxFfbkTVDcp24nf%$x2jWZ@f;BdU8AKg$~BuL>8^#&h>w z7p*}wV4aJ9HElrx(qGfr2a-En8cxxp{2X0ZW~qUEdm4q)@VZq6E&1SB6;s6VbDem) z548C|_ERpIBniDH^R`q3-xWQML^CbiHSQq%DxSQIl@t3in2mbWY#~Sx7UsvSA{D?F zJVQ2~L6q{;rBX__un0c?fpH}zce8Og3X5RmI)k^g!R_UQt~_Hi4bBYM z$vIn=uwBo*$+mi({b{A#_F3f37N~C8QjkZMw4onCNuppcRp(WScV?F1@?e(EtLp5@ zPnV|A*Hn(0%KX#W7-ongM5U3*<<^_*-FrmFjV@27wGW`RKt>wx-jZMa1id=rk#-ZR9|jj9xx86 zJ)-QvPK3v@Zrjwxf~)XIhSg8?W>x$u+gb`n{f539e9ywZpqN?`MXYYXvKwNXVz(WA zDuT2Re}O(vl!z}rx}1e`#@nPc%Smlj70px~XgIB8J+^gP#Z@-&CAbE!>MIM*z_|6t zDt+9{*t^n`Nc`RhT3<~k+W`QYG*->#i#wgQD#spDG;g1Q_P1D$Y28sT; zq35rf94K*o@pg0^3Pmf4Drqc6J!o1j_3uA=0*Bq1!$DMG*leW1s3P3ncTvf!dK}2c zt?}lUWvK$t#UNsvgHCrs13@3JueLmgW`bEYuJ5m z4dRtS%P}I+i12T|YtkRP#_AzHCCng+4$@Fn7IND`)fh9utt7uVI&`$ex-^90c0S)$ z%8MyKjYr_lh@z@oKk@hBztjOG0kWF@&SLhr3D_(oya&38WpqRnIksxgeoI;$9I3hJ z5z?ztFIJ@e?54JW#idGCcE7I;DS>eNyNlN)v8+>2a{mb5B~Af}G`L*4grw+& zK*8S!-RujBefVK~%{yEN{@m6Vkr*WE(`!&W4Cq)G$-RcXPM}Juu3Cvsk<>~k;*hs( zhUFyfm0wT{&Whc*1Fh{EBh=d`aK-i%xu#-nIb!!_zfOJgHUUfc?Fin-x(nWBc@AxTy7D?M4?hwbaWVN;X=2 zq?aY3R!lM)!Fa$k6!~I_5F?WE5fa8-w&kPG(N2+RP?*gY{pW=hs&U;^%ZU9S;uapZ;{YTV~R% zSZ$N>(fe1u_tT%{P8J9sktEZ-NR8e!tDqr|C612eon?;A!Ygp+zU8Ni#Kwc~l39{j z2k?)pr2|U$w|^Dhw-4HT(OZ}$k@+BK&ZCo`r|{s~N=MiGsCc9@ z3A0r3g&`OHh~ZHNN`B3=Kd@vaD4h>`gtf0vOGZ9?I#fu-PRC`{A5QHTW8lKjTvhZbx!>;>({G|Jo+usFJ*Y@akT;TZpW{?5vStnz8ilrdEA2r#WUduX zqE4x+-I^*NW`DPIFX={x&ny8`P%d+!(PnBwoy@9(QLUBqHG=F>*eXa2dnCpb*|@{~SxV zlSwj{pkFG;!m3B=YaD{Ph$COuE_j)lT0~Eo-GO^tzmfmuXoz>snSnktx%cJh5}Kbs zB=7AGvxPs1&5~dE`ZZN`NeuT*z^F+-C2rIv8Mba+oNiikN64s8e^l7$a|$eLUO$Ce z0Mcgz5rZfRJScWNUlLHfCT28}zh*Y8HOg1P(cxHcxM;(i0wcF7K0GH1VMSP<}~Jp>_HVfnC!rKb5XNU47Dgws;H=x6SrFPI-G10xhv;Tj!0hG12A5kHQn;&pW9 z-MG9ZGW)v`I6fhA7$3+wI>n7rk?tRG>cV$)YyioU92v(BwhW>V49U9amC{4DnaIiqoOBf`SlZ)_g;6-x8S0r~m|RLT?6hY=G?Qk4}`qQejW3 z(#s6*V~iy4L2PSb5EvLd&SV(O#M^&n$kM>oKd8GXs^U}@8&10z%~_7C>f4P=|C8aS zHr7FHq83UPcY8Kgc{cV$Yiww1Y!&(22UyUh@p{Oe-$RM~9GnNiqlt1{~=^1$np!&zg0*BV! z&4N~pj~9B=T*&Jg)n{~L z`0;|MU-A2AWOAJtZ&)9wu+SLMkq%=zYGXP&&(Ci}?qOf?6mNR(&YiJuf9>9I z%b^yg2fMQjixPn3c|t}=l{Rq4WhSHdAXZgtDX?sljDwkWZI2yaMgCf<_*hJdmox|q z_^6+!PX{eu7?NE1emv9SDn@Y{BR@{D*YIL%-NHZvQvxz!#baR}7(74l6CRml{Wk|m zbA7T-=L-Le$eKTaD=S}h^Bcu^iM409HhD<13%mtIqkT4(ZY%TjAEk8Mi7 z#`irKu&&9-wD_eehS()!S>Vlle@$55ndAz?8-eB0d1Wg1-;BbY+*1W5grQ_Cgh;aV6m5PqwCLGf7V5$+S%mw{yK(aTde_&uxd*Gg znXEN)avL%I;f$3rQgkLKX-I}iM@KT%myDIv7e3Y058AcNUA3Pn8ZYR^i$rwe!E4HE zpeZ0Vmi+tXKuiF+odD5^MM|~}A0OV;`9S|TAh7a&1Y#GkLyPkC&F(;QaL1&%X8K8V zK%;KF03skL$BxQvLp7-Pyj0zXxRu82VF}JV#rJ0BB$&WtuQ@lunuSePBax)Lj(S<% zZ2jlmQeSZr5h1QkT9rd^7(5jQUT5!(QnjbTOsnoW-`t(1!reFj)7B#XB0gNBs~kd_ zW+ew_XV1l0mLMu_y@?1q6U6JtFy?S@v@uhFqn$Z4jG0Nwno;mEqZuvifvd-<_!lm( zkeD_#bi=|r!tZ@I{(<)2b?INPvtul1stG@Fxb>ww-C2%Eb7JKeGdgKDde z5Z-h_bMLQ$a0kK@Sfqz>qvvFe!A=&DDX{#2a>p8d$vz7PqX#mWp3uB>DSDY=^wZ-x z{W59WQmh$d&#jk!l2TacvHxuB?bcZ3EB6-}-}cv%0uU7?Qwhq&4?4!mTQC5_LvqcSTfRANN8@rv<-{S7h&kRRN#vl`rD1C7x|HL53*>p}Uv#-d5 zEd%I4_h)^)hvIvjT0%-+8*$ti*p;R3v5E8ZcH?XQ05|rpW!?r%0rUA_z%wNIpn*CO zr|zBAIkDJdYu6g^kV_Q9dymQRT~y9WzT=q=L1BY5bnA0+=8?;N@snAc8S&JVmDJ^Z$LfuVJWbLIsNLSjFR+6wT^+{M;Tb$O}OAxIkYQ#L;FN% z-h5Wl{5@aWI&{}hiGJr6-#?68asOW0Ao862_tIuAayG2|#!_kihFip7?t!DBut)Rf z{|e8*07&5(7=Q^Ffu;c{ZwtPxLq$$fe3rUd$%$*Sx#Bp{;CpcQFE|8V?ik8ECmF?6 z@I=hb+oThoXs}k&adIMwIF}{GczU5Xa{8y$E9%e0HO35+rxg6Ueh)&|u$SFs~=$*Ml{`4Y?G z04(0@e#17RtYGSr=1Uaz^1)2&_;}*q!BD(^|G|tLE@qGaam!Yu@cB}MZpzp+-vJb$hp=X6!Pq?KI)wigE$gBs{C0^XVr(64_kV$JwFHZhlSZC7Au zCYM#v%rj31PzL)AnLTXSf&thi3+5#fZ ztx;sEaJE!?FNyDmjHdaDx|e*B1ih*T*h5a(@CCZHg`=5tQi?#8huNOeUWC;1bbKd z3sd_Y+2WfZVjz^!wXfnr;JbEnXD&<~XnbK%ChMhnXnDLMz*_jvx~Q|6xMBV9Qe5%F zK>?Ou)lPsrBum64;>-jO>U01MTOcime+51NI?T3`2KGh0KYbf9V2h}6&leSQB*ysP zQN5=fj0mp=aSCo#4}xI+gN5LR1|3^`><>9ZH9fLZw1}8JD&~Sm0zLXEE8KL#x{M0L z&s9dBY%^DzSH3a;iKPP1B zaeTAE2maTNa4#I>=&&!Oyh!HI;(tn(;oUxf1?PA@lsrPT_&x%)Zz2iu0X)ChfxkG02Q7i*0RRf7RT5~sC`czF zdj0oxJe5)khmck(YUtFLAdHCVWT>nESPC(mofFG-Q3jYlRu^`T&kDArS9tPNqxR(=#k30QRdb!%REY-g=h9%t~|htDyrB?_;2E zNz$j3^weqwXdg{dh}fDsAOOFr)4FvRlnh||N*NgO;V zr0mt;_kTeI*Y*E$9wdlW@!FGEx1XxFgt0!pT>b*EmEJe}-C?^hNAnYR&hr?iN9E)J z56S{l!&+O1a;POp0H@L(Kj|0b4;2IO;?s{VQfQs)e^T+Y>V8&10Wm14f&`TN8VsxB zM!kx^bvQoCckIb55sVvcyEl4W<3zT8wey^a@A{Q4y6Hh#**)cTO=fT4PG94St2T9P zx8J+z#&l;LC&6O>%7Fi!1PhppyRcVo(LV$^&d7}ymiL>aJen{64X!<1q{s>u&w@O~ z2m5T2z4Ww$gfI#h@u&7IQ1sx@%TjX1r`-#^wejzdJ&LR9|H-3tkxK=f4>g1G$5n&Q>^DOt#G zOUjMP@;Fa1Tu9xo^j<@}AIT?$*TZ0ds|5gwaGV>BKJY1r>6I=S!$1zGSvw7pT4m8} zufqi0aMPa43r(7D5SWUet+ygRnlC+dfsNPWa@KS8Y`2bVH}!1mj_1}LE!G|2%>rX( z(4}5#lL%_f$dkftG!M1sy$)>nc{I?qOo_ORPJAd6(|v#$zPe>OsFHFFvVX>i6j;`! zz8!#FEgaG_-MU@V=To*ifrsH`S_n4VPxyyy0XX{+_#~EVqgf8ym5Us)R73l6fCR%T z^THjzA5q(!?&55TN=4V{!}Vb2>TdN#JcKRjmbTqUS^evFwRNAS)9V)SN|9RI#Eh=^ zLh4gH@5aYB4ao*iR&eM9S_v8H6;C8C!w^gvC2K-PwWXer_GFk{(zE)K$*=D*SJt|C z_8zQ{M3Y9cKuo`P^G0MWheg)VQ82t`vYfb4z^92(5i(4 z9qsOaQC^*m0~M2=Qf=!~ZYH9amah^Mr4_66i(1xx&an>3NjPva;Vi5al-Au5~)pA?#DWoX2_a4!qgUIXQ45`NEVEcJYg6N(f3c567=?!wex3|5Qg<1cu}8 z_AiJ70d(Wj4_U$7$MERbwisk3Eue^U4EgGviw}9sbD!9Z@QFXHd}f|_)T9rxn_7);2SGa(h%T@)jH;3%XU9a*`$5TAbsA12gjln>o!7Q}0y`Ptp72li7zX(EE&CDU_oK!$w^Ex3I=0gT3kZf| z>{AN2>;fClY-RSe;?0+UlGUV=m&8tmBl#Vdq-90s=dx(K62Ro&(EvE-b^(ruW7z&r z@M>dwOcqzSLjGDvZ#7DMY5i$}2>o%U$e6kOTWMgM`grPJiDMC@k&Z^ig(A^ibeMs;-- zVY5;^7;^t&;XDXQGX z(yK51Pd;E1j>*#MN_|OLV@d7eZw&xQtceqpd?E1}N7}vPZwGo@LAp6e%)k2eXG+%l zw$|Jev5+gPi%&F|OTFZf#Z)RR(IsTRXpGKQ%9rYT54W$*M4nY>lH{?jKJm$s5T7HML*LyWel7vuYv%hh_#jB! z&DjP4BJ;gp#G0#St>4;(GK7ir5z9X4o|V6J?qAL}9fRO1_1_0;_#~WXrkQFh^8}#0 z0z2R1Y%_e&t_&W6CUG-}!~_Cp=X;Hfa5En`xYJ5Qa_cXb5Dc?Hy`!sCT*xqQw^X03 z&M4+$r=pm{Evv;k`IjyKo6tp;oG9Jxgd<(k*sMmdrB}|d zQD##elqQ_D&u*tR+BIAmB#S%SD)^^(5OCZV3WVPf_sg;PkxJi^%$-4De=|igp|Org zvB&J-W0$UVJzo?u8Q`I&U?FQ~&H;Hf<|b!G=ZmU%uEpT1vVGo9*2YatvxIOIksj(EwBrx9jZrNqWe;P0^y5*As%W)gQ*2e>keK{MFWZ-X_ zHzJP+R_(1D=L2wJr3l`9p1PhmgkkV|*{Ef1^}&~I*1rJBM7@;>NLLbYCBe|^0J!38 za6Hr`UY;omheo2zbK!-_-S1jk8c~*LPD&v^BaUNswK;W5=^7$ z>Ij~Y&DqT>_+>k0CkF9UG9DEHK^J&zP}Hc+_5@pun*xs4q(kuYXhbt=Qa-r*@W=R! z@ee+b>Dclx+{*t&$F6=cmG|0;o}HH*J=|$!Vq-S<`JKVGP@0S;BKGDybVaJkTt#kI z7yh-C1{(imriS(>^clW*-?x5elY6K}{Ix-kXzncWYbv7|n0%!@#@ZvJsFL(vWZ}WczRif~GU!&j z+c<^aLVbB%4*z;cT>naJUMDmwtPoLzIfY%ZE}5+*6vu2VDq$MUId-8)#VDyuN{Az4 z;p4t>FmFVqL3oC4{969TdN7-ptA~h5czLR}>%0Qrgoz20 zqh6UvsZNkY(+S1d#Iy>F%{g7$DzY+5o$;r2xo;ne2dw-7wp z$<_FMC7-G3G8YuX;H{&Y`Hw`kUFN3=PcH?_bt}UQ}rI8ni#GxqkF9o{pPyS z@H1agL%Hc-e{M1~lR~OwBJsUh*H5KfP$YSkj?)Tl!SO6M1w&ttRfV9};M((l8iHNV zYaQ(kPfiYFFAe|Vj7**AnxEY9xVEx#xyhR2kMyP#8Divhtwl)8h)29X-HEBxKMx?m zf)exxdqlkzfVCa3cQp1uranv-L=fZDP2 zI27j`?r{9;$z+YI@%@n96On?sPmlVYOuM>J91>MN*~3$83&Fi#_t(ac?y#xRT+&WF zZ+LPj8(YQNE?;+dSSeaz-}A}g1$luZaJwdzPp+l@zC>#zVopgf2o10l|6%5Q_lvIj zl?uslHhE)x&{}8tcttfN*)(Klg4?jN;CI+)Ak7ze-CN2MYJ;Fxg7h?=#6Ya#fiFj; zb@jI^&{9imsONzeQI~iQ^?6^8s`O{C?=C{rzk%gbeO5-nQ`5GmTugxtmyrW%%MGH) z4A_eHqc2)!O5`ov9z%(g&wSStq=oe~_jza-(a>sU>s#uRHpN3<)hI5U`P0nc+iO^2Xy>5Zmu03%{Rg|z81fnC(JI0+_-HBkKoRyh zWlZh4ll(_p=@`mSf2KuETtmbZ#n6o~J(XEm4T z_I(R3K52fdyXnj`77Wg=Zv7%QQZjUkKfREK*wr=7A>nBB}7#Gvt%^gdZjfw&`UXt)2- z@TEJg91@TH1AbAjLJPtmDD9yXV1*T*9`OC>q-ClzN9qGA;U7l&o)^O@mLkv@M)KU* zZzPO$b71@Ww(W4u+Q$}|7Ye*E`{E8krEl*Qz3mBf{ssqymQj5f9II9vvRmQ}DV$N|?0ve5vI3^oc$$rP@${)|(NRdBEUSi^TpZ84M%6#^9!z<6L zif|Kx!iYi6s^?0a8{P%({D~D6B-gCOaB$E;PO)L6F1NcwvHH}#HO`4fCy86>S8eyw z4M@m>X|OPjg=ykrRWjNQl{ss>)O&}M+`*HWg}J$pRQAPY4rGY0td)Mt++r|(rB8tC zY;Ss=Qf6HpZCq*Euq$AaUw)Uh09z6K^_rE8ZWPRD!{_0R3?=PTrFz(cESrFZ`_1B@ zgzM}RJ|fI=j%zmf>b<4lw+jOT7fLMhkdqxUOlt8G;+SrcBYw+WiS zwMTjGzUI+N(F~;?qo6ga)`Fm_)xv$ztLW`lO?nfODzxi*3?GRiTKtQO%tc8&mMej` zLurg~95bK?NSsX~jK*jWZ1dQeD2+F&$Cz24z`Q6$>u?Q5BVE&n5a{SjSz(gjcWoN8 zg4RAC1fx|Ztzb8LLelKc^YnTx|C*Pm>zy}j>;=CM=QunM^zAJurK6rOp? ziV8s~IWIFn-TWEUF`vXn?tR^FuzAIklPrA<^q&V4=VdB#lwRKn_bFXNYo$VZJ`U_g zqc-J2mU1$tjFxhgU4>|kW)&?MqKP_3W{X_-;O7+-4b~}Rq3@P=sRkYXeD>Ozgd1)# zml9=7>Rp#FioQkq2PaBn0$1$b#9Ii6w;ewkf}1dc)S+}NUd()>{2jN#0Z{NN8WqKk z9=UbYj|!wL3C^0c6I^SCPy{}jy`@EasX4Eiz;84x$Z zQdq|#f(tT_j*MMd4~qv6=Tt;xODTSDbVSt_on;HvG&8?`q0~#a=UzA~=U!O*6ns_` zw)gzPkS$~Gvd^EZ1Srx(Z_w&T z`YHj(a&FH%TizaIx`IZ(0#PGb9djzaC^KE!9jfyyK26psgc4Re+aStyZz}eNJ$d4& zO_bZ13bs>|cyz3D-p{$WNFJV$*GSai)}E&lUD55nJ>su& zRzcGPU$o-utIt^D9HE5NT3YO`J|vfABp~fuoHLaFjrnUU8HsgdMe6;n!#aI)Gow~m zLj}e%x3;iQe!j!&a6eAfb#%$MdhqR7#2=(_foVha6cz0mDIbT=#6z?*=I#mc=5>aP zgBzXR7ngRXC*Tu%-qymfwCqUlyTtXSs~;Bj53!NNXn`qc-eo{-tJ`s#R1Oc^ex!6W z+F}f&VlfEz~WCDNuse%GaX6HGb$}^9mY7ZN2 zRy7lQ7cm)mUMs?bo2-c+6xn9I&Y*kYAwkfd#mqD6@PTatyyBz9hr^F`r@ju5DO5gR z3ihA&iGpWA`N3GbJyhC?<1v4Ng=%oWm^{;Tzjw#<=U7(GZGXO%*2gMJgfJe%&o>iR zo84;T>UC^^T&BxVt>+U1bAkmsAOTwiAg4nB+4Y$ussV-ek-rxHj#Pp!y3&^dsng}t z%~^8~@9orDp9=GSxOI{QN`6EfI_WdjSdCTwsYw{=Af?ND`rcX!#|0V6x3H6fx{TR| zyKJ>6YU33iJzb+2rj)X%bkMBg&G7Y-?cXWnGc=cO0t3f2S+V zU@!U3zi?{tUFZPjFLxjsa=;Ts%tMd(92DDVikU1*&SvmyQ?4&=`EY!)9%Vf*8(F8s zSA$TPVo+72bn0AJ7l!SUOF8^`#n)tL=Y@r9e~L3){X|F(!TErvR5Tx%7(b&LFkEy} z5ldXz&};qHaV}3z6vO$|CjGSRVaIeCEGrA_WP$b_%$5n73*R1X{=WYFgT`2Bh`We< zzdK;4L-fK&aN_Gt`y z16Ruf&W7F|F#Mxnpy6L0PGf|REZt{6{ay2Cx#724hc3$Du@hfWh}mYAA0IG*SHtS! zmx7>7k!F==*0unv-7M_Qz^rHZp!M7*p|E=+&i_z-_p);(j3c6z_rZ>{DX^yjGVjYT zWcySW^y`DF*;!@hN4*~zvm{08W*RI;99A$G z4*oGAWJ2M)_O!OReQkq_Q(nLg*k~M0o;3h0Y$du|XX9w`#V%iT3kq8!MG~&Ig+WeU zadFQPtBeQluHkb zd#at}+VI-Ro!+4X%x8p?0dHXE_%2M7XD8WVCyeiRLxnZq)5K|i?u=x!Lu)gS%)bSq^(Od>G>{^tu!wpdHiqAt8nB!)l*t|YD~BqOuwzZgsMw1>Ni#nvg@ z>tYYy%?8M9R_)|UIdq3X0&@hpptbr1t+X53p3N4O6FQ-9MfE~I24R^?Q(x2$Y=tTK zw0>*&vRTgOt5>F!eJ6O`PEeNSqQgFo(Z-Q8%KM`4lkK+jvxFNp7}*y8g08JQvmtp& zA1+uWrJt39tfD!&#Id!s?6G{`b1uDJjKx%i6)*6NPL{Pc!6^Y%A<^CodG3)u~c*P zQ`S#)1KC`~0@z+BmAWkBR>!{GAcZext%4s4JyMo}h%J~d?S6v z>Vx`w=68IUb)RxXy%L0+HYqx;pE#aX7$%WY|MHJOz+nPVz)}fFAOcDN%Y0`&VjN?3 z^~_=R)4fv3Csh;u%djWoBs4(dQxZTbrGT1s#;iGn#|VgD`o=xEpK>cbzVBgvqCvo8ILyran!~5l#-b^^QkmYV%r|W)&_8VJ?y5K}z9C5Hikj?B`Ypdf)V+ck)gWbl~+UcIC-3_@#YE-{2V!ej(4q82AJE>HKw5|A}CbLDE6w3P32 zT$;nkx{9#i%k{9#y$Tk#LvKc}-;}10w?|OAX=`S>+pqW*Wgc0v_BbJ2L{GM{l&0g% zudwSt=ffbk`jJnwD(vBy>8nAtNbIG?v0lD6KWD7Al#Qnbc zNgAWxKn}}R$Aj__b|gbMx&jJa;S;o?nkG8YIyLF$*WzZI`2Cta1(6@JFmZ(Q1K{rH0i8`GDY=Rdv!v6BcdFE=2X3Zl z$sU47ZlpO{QAv!U5EIZxk_Qs@yDAx5gy&5kapA&%@8@3a=hQf<+nV0~0J6oiVN?eH zE^5MX<5eTI@VmOZpU9?f{+9g;eC(_nBOdrkz3+Ig!~?mPuhH8dcwp9xFJ1eHM|6_& zF((kGlGo`1uCwY*+Wquxs-E8`%DAf%bSyqHet2p)_4c;{}P~-yn89(jMX8M+n z$M&cG7dgTI%WTuWJr;m?uaHrI68hbyV-gkAV)2G!V7C`W`dtSsiq|4u>&&*@_4R_HF zSLuzS7wTWQKRH}*Uw5}GzGse~px?Tdb9fLSv41W5q=@Wq*3Fz&v2ojGSufqzZ@_(; zS4y!{mIMaYKjz)BCG*n`(G~u#-16yZ<{LMC+xZQ2@YRXm^|~5XD>`J0o{$aWC_rK? z$B;K!|Kbv9wqA4zD-5y)zBKB?Pi2iU3s(a=}oM(QN9(IsR)c6 zUp)9*Vc;Mln0_$(#;B-CQ{T18-jO%RiSx!*}O9&ZkQ4By;H=p3FkJ6TW5CIeQ7iqnq;)&7iw9 z8^*kNu}SyMGva%&Qn7TDB^%9+7Ma(aQA;6uDq>W{A8sDxL}uc+(=k#3)8Y>EHa&Ox z@$*_j*z+0k$W-dFa9X29DtHNN>0vm9;P&LUVzc!n<>k_0+JM|VtKSxr-GLnFM2#g; z7mmYUFbR}FK}Ee+M6)$>zb6`m97n{MwB8@d*=-9dlA!X%InS(9P1I+Bz)-ZTi_gxU z0$BcEK~>sytkS4!t*Q{xFgjLjJb+C8-8%Sgl7{G7lt420(9h z_dzVZD?92aVEfDEvAijgw9==FR4OzmzL!nT9Qw`h)cK;<;?l_8uU#S7q=krrv2J(3 zZ>;PsM2vG*9o)awz3>9Tb|;+W>)|uLz!l0Q%l*OZKNXmJD&Z>Uz<8$FICOWM6sc5y zr_ulkr}>$!OiR79B5CRjxErCjMb_1!WxxA`vy9NgY8txY?) zVsGjtud9d%Z#9YjwiOGDs_m{}IUhuy&879LJWg9DTB@AZzx;{?g`@bR%jRROXO!DL zEhmf9d!W-*(ci9e@0=%QQ=Q-83Q%qrG7+N_Fp1n2%IcsL^2*$VTk)(AW{SPbhVlLz z%fTi$4s^mBOY5EldUMg8cg<>*F})oZS&a~y^-k*DXSA(h^r)nv;*Kv<~ zM-onu4IBh*&cB=-)8P3x{YN9U2GM7f93|a`OIY7(#5F|PO&ydoO9y)pggV45qZJ;Yrhi7GIPztdYD-)i4ljV=}n`jPRNF;oh2<&e3 zSf$?2Cb#F#vxeAr-#lEuHaK%+pj&(|xd>JxTyr#-?SLybSc!d zPzxQMcd*oro+wVu0aX|6FWI*fEPFemEUvh>g6*6Gsvawal`#ag3Lfm}IJuYcSXMB| znNwzn_bkKC`SgJ86N66)VTNgC$)8gg6-)&L45_t?nrM_C=GPWA&vk@6rZbVP_EaBF zKOfT2G&P{6JQg`o+y{{GJ}n0zc?0B@KWf~Ue%h7kZsA8+atQ5Sw?X(@nAp7m{JLTu zmzHuI)t>wcr55#P>ro%a73!`uXUY;}PT@TWClni{=%>eJSQ+Ji`_Yf4CETz~@*Zu? zuj$?d_v*T<$=g1yYo3{8(@gm*!J^}G5B=*HuD_#QXA(jAkIO-lh}szEQ7X*vo^C%= z=PLu3+RRso!2;C0A`$;$cE3*JXw0ZWYea{>I*VKZJ?l@XZGK$24ArelzH>{o(zkT$ zx=;C*ifPWkh6Do^?)J|0kqbt5@zMaxPnMsE_1oX4R%8W!&Y2cIlRDrDyeTO|Pym$g zy{Qn2JVRb>B1JD>9~4wlVa;1gD!vw|YK@amGM|T~R1U-!`e*sN^d>OsR_gz3&3^+o zm~5ItmVK+O+TN?ukpIm!@zR+0k_1teRqNz&J+37%_wxY$l)6_IwMC`lfMI1q?O+B& z!1eg82L)6~8z0nkh+`F$IPC+Ljo;4DKWVTPWy;L?T{=t|896eQQs~__5cZCoMjlHs z-^k(npS5<_UHjkE%tv|;usvU`vW#C!Q>$(18lFF zuJWbAywfx$M%`O&%w%mT(TI07Lo7^+U##ugX-~({K+fvIRDR5*U#EeP3zsYSU5eMe z)Jt_N)F-L*8Q;X7t=##v+RYh~A^BLd-_h%ou(Mk_|CQ+kEOpJ{guOsU|8wOCudL2P=3?Wb znB1^4ENS`wgO9ZGKUTV3r>79q^t59ZH9QRh-9a+!B!G5O7M6uRl{LpbiFY4pf0&YA zb;^HAJ5 zBkN)3&&Y8pEB>py38?BxdirBwea~gk-}Cl(B4|#VoILLDQR4*lA1%b9f=383FyR*S zTt7vWkcvpT1;+=)IL;4WllS=(Nn0+2{zpt}frQG+je^}wf-@ZlX}^fq;}l7A(0u75 zuF3cn@x3#e#&i1LGqMhIzX%y-KMwsy^9rB=*lFhwSQ%tJHziD4`iC%_^8#*1fc=+ zOr_mP;aqwOmeAwA4zh4kkB99^VHHY2PUg~kvet~sWI_hrx# zkep>`MlbkY_=rUHGnWO$6EZ-~fBIPaUvm+=dt;P)Z-`YH%{h)(f9&0?Sc1DhGSB0~ zf`t+;lZ1>UO*E<1afrkS5FhY_hc+?<(0El6+osNW@$?_OTx>kE1A1VX*pV3bC*cOy z@H(YAyqaKYGF;FY0phMjiNwdei4meV7Rt7*IE%I7y@2`cskCz}B_XxhJpO~qz}Z>| zV!e`a5#l5@T3R=B<)7}1Q1r;Sn~&pZfB-92!)g0pktFp3D#iD_eu2SL2MU9>e3JLd z6#zm6TFCqRZT1fPGC;=nE4 zDscCh%Lpz6Nw?Z-+*@KsA2g&Drm%>*bL-52Vc$Y9=RUA^5@jsrhKgQnI3C`c%3$lx zte-Pi3Oc2)@^?HVWv&ufAuu)mkv?#Kh{T8R>Aa>~hm6*(IP3i1>5wnB#rGO2)B46Bb@pJ4%Z|0{ z8EnL7+Y8DSQvJ7{#W$NwdGtfP<3=lwjhw--=o~O>a^|9#=lYNv0i$?rn>p#RnA^MG zUl(t308rD7FX*AKfQY$th8BrXlj6jh7g?M`@ADK_k|6^xBu>t9Nk!j`QkXna=&D-F zC(Z8;Zt0z)3Y>5Tk`{^7ey4_3{im5_%Nr2v*|_4Kc%Y1TVo9z0+n@D6I?|G&fsz}v zZOpn}LNgr;Vv_4|4*}3jbThrmpIN}VtM`rbaym|Ykkt6IFxxz<$hZ)UAW)G00_cRI zj@Ie}`_!mAc~`oWYvv^?K&@A8SZx1^Ni4ygqg{5+Ru$mdoJGmv{mWO&an z**thfCFNKqu)Q!&Tjd{ri;X!hh@9jrfQ%b7fZ0Y0alcGG8-QLctC0AwU$(7YK=QBI^M6>nw#k}gFyEehEbo;#9%HbvmF|Bz>@Xz5 zs!|_5J}D15Pm)TJq}0dmS`p<9T6Q>rK6L6~4~t-qR7}=s;oFns{}esUKRjs@hIk4X zJxcp_TFGqty|ZQ8uo{cJj&?{t2j_pfu#ZXebC+|Mbq&0QlJ8}tbvh-BMPS{HkCI@_HcP?#@m zai2ZY*WaRNu$RX@4nvd=ruU}j3g{f*XE{;MZM`bQL9t`orc7Gw*tdb6nqR#w#YE>b zg+JW%2n7~e-2h?j5nxVlLu53*yPn6dKTC-SkIUoj4(OLK>K23Uu z-%HHrW_#^p&OVT!^K(6S%j>(X3L9ZR*x`@>-aP7Cg@vy}Q9mmn!Qv3Hmg?VFBO6t83 zp1u5v{=Vly?nMg|)GI1FYnc;qxgcahVxNT2G)01S`Ju3za9$5sE3dpMym@?*h!|iW zK1`%XCgCT~k`@iRs?dyypQ#Y)6`c}9+Gmgl_HM3zSOBiqs|H3)pAXy|H`xEE?-Djm ztv0P}ohf+Ed^gE(cpZhmC#L!1g(H`+E$5aixM+eAq*2Kj%yU$_ciQ0O1%Xlto9=a> zXd(E$cVk6LYb5!Cy~wb0ZL+KhheQjOJ+gK&KtlH^vm8L|M{ih)R%Rpf-YsF-d)?2= z&ijt?O$cBoS4K4%14;(bZcCq`qnNmTicFLQ5t1)iAh}7#)D|u@%^c?d2hz`W0ry=9 zq68)x*=PrF#wLI>v|qlt_;S;K3AqmPk&NlE^&0rCe7%}FrhNlqK%ir_!QySq4uf`4 z%VfqrTVZ##?tej_D`oX&9t*i;UOQ3MG46SWaML!{@`=<%`>Fof2y95VMTA}Er<)N) z7C+n8?2O>%5hxBGQwVeiQ-SE?HdameJbz7x2p%%pxjy;Axy2?B$GV;BFFhEU zv}dr|v`Y4dDmsBaUx0yT^xWM}4NsH!7I5y@W!LWxoZ@Py4AaqTUUuQ?TbD3_bJoFh-2Y7hfid>46{WYj z4Nv3jeCTv3xaeV@l&=7_j{x-@fdr9t89NkolROi(N=19WsJ$?NJO(AHQ-NAzLPY_! z(5Ebl-W&a;cdT&_I)hHXXc%_4x%QpN(6oi1yT5j#`8mUiP7BDKYk%vs0<$}+>0$n1 zu!m?N)YauQm)ANVw%53s#7T3J5V4CmH4TTj3)6JX8s39Vy)j(NzTb@Z?5h?g*AbMH z)@7TPErdvsQg39Vj@$5u z|M{bof-Hu2sQ}0SUMpInh49yUr{hH)b5+eWc1MZk*Y!Ug3csInT8~(XNER2^s8Ra5 z8R>UMBW)1mO8;I?t6`wYDc0oeb9#|=t)UMU=#kf!T~c**93F zu}r%LlM~-bXw(c_5=FI%iF~1LzS>};!F1Ox&VfqF-7Ou|NuJLPSA_{^p zA9x<`@f@H(3)&vtYzg9kz`#x^Hsk9?V?T07g9EtesRgL11gb#LLZ?m3oO#3~acRlY zv~zG~G~F(0BuHrFtLO1`R2iyVDh8@w%S{qf3~(scB#KM9 zBYY=6s=Brvc~#m}&~Ukg`o^YKIlqF2=Sz1oDSE9~9b={M!Usj&2X;>=r{aWjSieZD zhHpW9_e2+E&G5&*B_gN2v$3fD?2WpG2&7RjcPcU=RlSNcsRP*&is0L0hAi**fPZ7{ z)Gp^}{>50P?hdK_H;WL_+a4dj+F^my#4#(#!{gd^f(26#a9w2e{{do_E8b>i%M4?Y;w$YiDz`sl zx%!2)neSFk^xLxx`4v!#7f_|LImhNKHj-rSw@<=Y!_pZyN$3 z8EVsPihq6oS-10qVKy7e)~{_Kn2OUzB9reZ;rAfKl|8HyQ%$^e@l3)wKC1xD=moBo zo3kF4+*?H!r3i!aq?Bl@zty;LVioVY0%4{=Q}~9ehjosf49u#c zOeOplL`(G_c7!RXJYd~x?RV|}fH|dyriIW2F7*-|eneT;-oyKwK!oc^YlwcMCmY$Le?s^QEhfmpH&V9wYEWg66ISIg<% zol_s)7GG0Er~76ggjV$@b2jb%%Lm15x18zw@^vb@((M+58U2O@wv@t)-`-Nf~sj>d1C>%4a2OZS*v zh`x>aNbH~hnazh~b3fA*Rm~dqXWB#Vj7Xvms`G#WkJ{$Jyp6Y1UF`fC+=964NuWT1 zNqAK;xgqJ7+P#Bun$wA6opo7WKZkLP9{yQ|@pU34Qy}I=zkHJKuhhh`p}-6@yckFcpP~7P(g!%0iuiE<1k0@T03O0hTkw{ zbGGW0Nj@Dv^5Fc?$i-%u99*|{%n?!x)CM`7SxlsU^O3$HW9(Pvh9Pv=A@T=dpa^;$&m^xg;K>qyt*U;ryFZy5U++Y7Qc+l7k@3C=Sl1ai)9WxqczRMO@Qqk$pf2;krv{xaVPVZOs_Z;V+G-t~4Xlf7G4}Bx18Z=$1BJImR zTRwS23||^K{iU!~(tlxduXB%>wZZ&I)Mq{t+onJoBg*#g6-L?%nG~-Iex0Xmk4P)E zkQ3x~Exn7Qeo5s^V7qndRw~QZ6n*d3@+;fnTiJ50<;>sNdVF63YF-Ne|3wXrVX?;7 z_}07DWfz`-I={@iI0aSiCqSd!Fe3vBkrTGv#|>1!(Gq&UpL5FMyxnWGdS7(k`s$_|UU-im_fZ=}7&0q8hQIG|1tSvDDY8vccS) zuC_&Z@$RIBtOnBjcy5q&m(1kFZXMalrPFVJ#qMz~YJ40}H`p z_M@}AT|VBDGZd+rE1Wt3w&|z4gu01oqz4_lt%_`xL##0{))Bzi$(#bRs>SZUrdT&v zYdt@D`}a&SO|(Hba+*Vt$z5vYQAQbOQLE)(X9taPdS@E z;(8y%X^J)7(D7Iitmo?Q&xW~>*L^wgzoF9xO5JVVm+(P+4V0fZzn5`-PTeN?YhbpY z$x2jBO%*KbsBxUJt+P%+{x7YsPzf5pR{&_X_kIqNvFP#IX{3Cv<#8h#)rws;PYYU* zx%Fkl{=+6*L3RV%vD>vg#ae#HbS3&P3x;QOZeMm0-+7q#h(?O?`3rY;xOJ4xGbOtY z$X(Ki9_yLhO2zN?{=B1Ua)2kZXv)h`$6uS6(hh~Iq|%r57Eh+K7yOVP2w}>$S&!-^ zumYQwJ}a1Oy0>dg5HIpetel>{Tg(~(({8IR-01bX7{CA0PO+G@Um`zL$IED)=AMqQR$bY1@WgkCwtKD}38VVjp z^9|LM!L>T!f#Y<0#NY1tfy-jekbhgm@r9BWG<_Vbx2YRQploozz|Yoo`+9{NiQ;l$ z$*+VBU0QFhNq0s7>Fuz~Eh>S@7(QKZA&RM20aq`;>8+_juTkLAQ#IL`f_!Fk`^_F7(I+ig&kBaFt z5I!Y4cIS?u{wwYIi_9l-zet1m#CjT) zzqoYe38G5x2>WP_BWkuLYV$bXr36UZ2^CnLhr;HPKP1&&>)4r5t0@o$C3a+zSiou3 z?ztDEZKfq4hF)bjUBE0l0^$yZ$y4!H@axz+$GjYFn+@IBWf{pLsh5gp?{{}~cLBR-pdb4O$!Sv&zlTW_}>wXes}qWELCLH!}NCx>AuIuj(1Nlsg;s)S+*CP z=nh-@swd^~BES5|Vt1K!Qio(&9WXY)C)A*dQ%$kx$?>%4c^%xk=4-0*ZR0ow ze9JQnx!H|b6bmCUm4(!1IRTjzwf1aXV%hu+5Xf12#Ig+yDOsruDJy1L=qWS3B@FEbxz+}kL2V9txGt8BfI;jtfwPVGz4 z)?7OF#kJv<|FyM{{V^y`TFp-~Y~Q}9uhUs%EZsz*e%sM zGoot4@BdwGSZg&p@|E{~jR>5PJ7yaJuz#kTjcIRH?kGU)z z7%9ciJzSo9(CwllltWB0X&!PWou%JxHJd0hur$X707^p}66jOSf$g6sF(7IoIousD zPbKhizQ)bCg|#boIylDmF&j?FvrrJx;e8!tkc8k^cvzoROX4#KVVG1Kk_p=k!AxU>j| zbZ{Dwr@FQ&1-R8-Y=|oz9S1X^YhQeWs*_wvkE&7`#4%B7P~DANCD+d8zGY<{DtWT; zyxDMNNU1k;D3Jx@8WCHJX9qUnZoADg=W zH7Io@L(Rs;$}`_u?0R=2(J+fbVw8KFt&v0Oy(@$0J&T@0_UQ%G!+cBf5a{)x%bDBt z<0$4Y6=B$E6%~2p@WG;9one5`p~>ixdW%06Iu^V`nP;biG1P-T27;$Tr+l(ZN=_PX zNmJ+ESajC#Qq4h^Qdw2o^LUAKM;pgut#&Uvd08%Y<6bN!OB+z7FPW@;8*@xO{#}Yw zY^S(-*D)Vrwl;V05Lsq!w_F?kE_!}@&Z`GaY?;W%im#ru2?LydMFEwn`V@h2LAXGqs+;rLM{VSV$!$HHHe zaK@LIGk(Z;9SR~u!d8PCw@anT%S9%^PjA0mw0>7NLbH9kvu)8N67(BE1C(@joV%o0 z;3rMfY@Y55o~CKBGYf3>{}RU~5@>DIATt^H5HteY3mVjx9lLLMB;$AFnMjY$8@u4M zT+h{>Cho65Z7BSy`bT9LoatT(>Sv`@9Zx&+iOiWwS>a4!h9MMT&jGh(1>9CE!WDXM zvfGL(6?JGTt#i3&u~EL@Ob(*I_I<4CWJ_XjDZDYrDXT!X9euS8gI_54)o#oAuGBM3 zfUw&EGsbf>v(0B&&a0#Q2=h)&0aY#*$t}A47y{EaZdlgzlpcd#c9|TUzsRkHyBz!K z`Q6kwd9|I9rB8y)_+TGaHS~l52ZhzXb^OW3+ zZ{gnrd&Gh-=)*m^l)$#-RH?bShS9CYF|ihp;n(somY?TJ`o8%eanQax?-vVi`B&Xc1% zEUWTG2;LW#I#t>$&UplTsqlyn(d=}gXb9c&gZor9Zy0T>i=WL-Zo|8Yo4urz0ILJr zg<{k1naf_1N0o2li6Gy00wg~xT=nxM`$c*Qm6&3shQZd{!Vg8HPQ zDc38TnN=yerkdhDIZgg*N^p8l6X3Q)A4@-j+C!8e5I`Z)9}|^Z`dUlOOudEE`6tI$ z`Wmsv3z>a(TRpAYCSye!QWj>8p6}mlS=t(OJN{^-!(S{19G$D2(%oN=m3D?*eWRT3Hg=yRm7m9wflVO+g};t( ziesfn0K>e*87|BkEn;|U;7IR?p`d zT>hXeJczW4pALyUz8>}1`G`y(O)M4Wm56+Ao7bXYL<+5T(xDW&<8f=n?kS)T(#S*h z<7SCzXX@VFmbo4kA#6#ol)& z?(5PGcEmm3pW!yJ`P@lc+#UrT6WnEAeo3=W-rl!aKIy{8`dbZ!{EjP{;GTz_bjB%u ziIv_FQ@bZtsPhhmO754$KqDQy6N@?ZJ*A4X97}8mj8pcQHRA94d9})E8d93G&hc4C z)a>aN+r{$5?1Fs$_Q3Ym@)9Q_%I){R#8u7=7un*dKhsk=G4Qs!wR&1ddA54mNREkl zt`IFgd?H0wo(7bTY;TC5gD>9gclCG=rYS0#@3PYDqF7l=A~z*`^Lq*=vuB1(Wy9Q9c{ej z5a{xB{OoL&%Ne{{u}92e5#IGM!Hr09)+k%)@o6Vy7PG6B2|O3Efz*znr9eAbi~3I- zsvC1tSoGR%Tc(j+bIJJK&wiJ3r;2G4g%od{ z%Nr$RyPl4Txi(1E9w0trO{>w){2Z6R&=R&FIfGldka9y2!AO51bu>UZg<(jXa(FF$AY46{;#q3l<#S~(xSt%X1ImSsUr->;zH(Vk}@(OX%0A^&-Iz1!$F6Dti% zDQO86+;d@3v++!j48%`W7E|TVY*lx;`QlOS867(96vG6Os#)8%pmV15`o(dy#zH(z z^t2B?Ii7iBb?lhTdFQrWJ2GiEVc-{Yw&BH)rKu6VV+;-U)Wq%R9&U@zqNsHvur;zY zcQwh*v1P{&p7pUFtMoqu>$=WD6N9o9-(v1araF3H_q%Ai_EU51YC zm&btZjf0B$%Y>guAR(6EFnUnFD_LkRi6B$%U@W^YrXj?qOQdGO8^hg^jm8?H2}IXJoWEu97z4$Jlw_4?QmXd2NtY2CvW~xv>ZKJ6>9|HqZ@cC>_TFI}lt6!uq~% zbqDi+?}=jYN*s*aZOn2Jmm*h zc1ePOz9iu0^);7;`Q!V~l>IN=3VG;dpbsLHi3%SV)$;rO!l8Inw(wQ|@uU~7QWi}-XFV(YClB~m2aN4Fn+Z!8n6HV;vYFigJriByI!&RJ5 z7Rr+7h9Qy?-oCju9o-a=OvzB(!#-jIT_xF*9EQIg!8~U-+s^ObQ(lyhE~WlFu!+G4s#Cdw8?32aVsZQVp{Dg@VR-{_)Ns=%+Yv@%%0~NA zYSHe2pAe0mZ{Dm^K}cK*#MptuC29cZxkG7yMwO~e9ac|TvO|FG^l+T{FO1)l$YB(( zm~vcH;Rr`T!C_?{1;K~>|0BN6kDvSv6xwCg|poo$nC>5}ImH*oN5XN)qZ5&$-D%u+*TNQ2AI zk>y;IlCQ?unrB0WBG`KTXD-`x56MnSLG_FgEr4ZrVZM924I{t)hq>&t#*W5=Q7TGD zp1oTrtlojcf2($TWq5@pBUe;sC~dUi3=dW}l{v+e6G7Dp}K%xlY$jf3EL zlXD!7k8bBrNa;TYRBAH)4(b3h{qEsvb9OJ*ViVwR?Rm&+S2^@94SaPp5A)>(y%nsI(>5&kcK~j*ee|(jScbiPg3jmYm zX%5M;%6W6i(oaW34k}^rM(5%?r4rrOFAd5Sp2XL>z490gBxWR^@;9+hc`ez@u{CAZ zHRnLl;Un5i^A%iX{YFB#$`C~#z6G7e8TnqiFcq)k{GHIR@rMupde~|@Yk2MELoFyP zIA%Xx=a`;I>dsdu)ymRsJbM;kiROxeEwK^$o!dKxj@xIpdX^sh#sRQGM+vpUk?1k8 zO$FI;7Q1@*;)QorNA&Dv5Lz0KE%5~Ch$ZF8G1E1YBCob706 z^1!%%#R`6>Bnij%XE@z_pu$tJKWxuAzy4!$8#Rt^zQCGc7s!vxdPdMb{o1sF-buVBw~( zg8IVU4Yr+n*=vE`C9QE8nF&5D^tzuSoR#hgj*42LX>;JMxu@=~jx-lsHeiIRBX+-0 z+U9{?;C^Z`AwSn%L~_y7P4^bFf3VUh$?m&~UsRrnO0Pw31HYM7E^rdM$+Y8p{e#T%BvZeoepV;^{a^|$q+)ck2rs7k2=@@5mfgFWD zD@#NT&qCCxvqGKzwTaJ`NCGhM+Lrkw&XY=kMeC-`$JE$}*$j~a!e;<)UpiKa?J~5= zF&ye-`z2(_@!5R9<4mjPIm4|E4C@H$bS@0*m{lf!dD3h_iJ!?kqt(;xvA%&JvgoZWjD&we|WvM^3}Qm&U@CJkCheGQ=iw7WL`RT-L>i7Yw;${fxk^s7ufqR zx4Q+l(v(QED$CotH?~#$%G-Kqe}=SA9~G;Lv)^UR@C*VI*JAy58I7Eiv$DIFPPsa} zMxe>IC7u!d3NcsJvh5wM#?PDTB?F9jADS*?&Oan_oNL=j(0j9skFrIwb_V^-9I)q z^kM9FY|f=JlW(&$L))piV_`)CX?hoB)H9tWd0SbR`Y9;>;3U%GXkPISs$lLV44xIpjgq2 z@D=Z=T^6E+Ylxm}j$k1{m;l75DB>)0nz_a>b1jo?tz(DxFJ?vW{ML9tgsI@sC6(9(X^dO6-lmLpX)MbV&wS=R z3Jxo@E7pElK==>`79L>mk`k_3!3i&k_cqFAz)H}=cAVbD`@n0~2F5*A%pbb7z|Cy3 z{revt)&F_knWA0yQ8vvm^XG2*mRGf!V+aS_oVQu>@W*ZQCx2!byWdm(%|4h1D8!5I z%Pu(h;p;F-qSK*1@InQP2zGltx^eIJoZL64_>`YIa$F0k>R2o*jY2}DBK-+L`u)9k3 zLSO3?xat=NJmG{J8|PvR@*J*NCW0lp!F)&1>Z98sl)F41C_TqNa`BD6D0x3l!|hcU zX`q8v^sa?%0YT-H(oIekiQf@V2xy!LMM?g>-Qx(8`v2x|y)?zRK)j5Mg4z*u5OHtw zUQE4~)7$Y}@NBEF+D0VqGmC0J5_jS1Wc}A4$7IFOltPCSb^i)zP=U~ZXNY5n-i8Pm zw29HK{u?tWU!N{*3A!bF(5;8^K^|LKDr^I>^Kf{3zF8#_2!($*>I3~=VOvduy2BbDY>|(^3 z?RNVBj`J&-%@-zYh=Vh&8OF?h!O#KQ9H>;HtQ=B40zt0#)I-5s_K~C!KnCnlPt)F9} zhREX&p7QQu7DudDF71MAL7s`id+#+4Xu?ewx%>uegAp$_J~fY8kek=!3LTm|@|zqi zSw|YIj-HRm8R90MCPrkm%Js`QkXNxJy#rsFgy{+it7U(Tx4oBqP!n^R7aT^FMC4%%;HZGlR2kj-+aR})(Xw_+Sju52 zB?@UEmix>~(Cyb*Pv%x&`(NmUbo{!o(t=|nNPd{XHJ|yRkj|8luDoBQA5dvKVMZ6S zj~AxQd#>{6zPsv1D3Qs_axX0yN}~huU>?krA@WHMKy}``=t!jQF%QY13~z z>^Vpoz5-R?aq2%BEyI1ix$aCc8_sHNv?(_+XXSW#hD&G5nk-mFT_f`s6qRtlwLVDW zV5Nl2MS;6K;3`k%A|uW*T;zgpu&?j)@{?&;9Morp_RiFiSb%4nkEA{0N1rbEOqQ;^ z2wq(vj{pL$27WzIeHHPS5PS;$mCCSd3fsYAx#VbNm~tpvod+HJmtB8(Jz+fCLt!5P zhDgv96N!^zcw41n(ac1VnukI>xp_1;1-j2&kRLub}YMjweJa3 z`Bp@keQkqq#l>MHR|JwD82w4)!FhEJ$sllaV+19Bufb`pw?{ZPXnBAdPc%8aIw> z4%obEJn`oKUvjqKc1WZL3=c*hUGcZ~s@Mwmc!i`(N%{E9T!nM8gTuws{qAcXE_}r{ z8WH?px5Gt;?_cMs{8()q!I2ek)acJ7DH169u z;$yRpxsPFC0+PHlgL3oJV|13XX>0Z&YzYa|^R>rVX!SU_FCT=p3lA4y3lI4W zha%1lyI;Ke{oBkG8|P2k6QKP2Q@McZ!QUqY+6BTCCzK*s+LS<=rWL`$2`7RrT2>Lc zP?ESjAq-U%X5~TFW@0kJV4^A$y8ppr6gu$N3sPq7ZODz`~}q}`x)WG0Ut zf3L&Tr|99rUW~kHXG7c~vgP!QEgOE={&PGAXud%0%SV+X6KxOjLxz-{ zE`gkc8mq`b>F{3zGxl=avk6jKz1dDlkASA~_I`h$wt}Tp*(bgm0J8tKrCd=~J^~K7 zV&b){$dfNl{Z-qp!Q(bhvDG;##`?xgPos-d9qPSesWDv?I^qgmSYF5c=jex4JB2(1 z!eT{eN^oD6oAA)}Fz`9r}5D zWLE?dori5u9TMFJY+H1Xp%7Wwk!U##>}^o}^p_4Uuj%!0J@egbHem2PCYN%jUtxo) z%3y0mlwxRL51l7k(uQeQj!%Qs0;+cTrMpoJyNUa;Uy(;C;;Yk%BVA1RCTrcj3m>B0 zP4jyc!n{`ZMf^Gb{UwOGAr16;!Pvvg3%Cr?$-rQMeRP8Q=HahD!w~rTneQQyI2Vsb zi>m!W5eP%Rb^=UfDE;mTB#F=nD)&4x77C(0FHjw>x8aFGf`nXrFln7LBMfkFiuON=ad0hrI<0wU(G{R}uCWAUU(R2SisOPcI=IXC*MfqzOQ`H z5G*{A!QqO57q)?It6|#alD8DFUI^oA@_WOz=RTh{cpfQEIAI;g0}Iu|M!I0EWG|o@ zj;NdJo6?`=jpZ?mgqNBSbel1{+opA4X}GQFeHB82XOQR2 zO0`!o(QIUz?)w^B0)a_IkQNB$C;yk4`h;)#FIwc%#Xr<4DK^C>bFV{>eBUtu0|>g4 zrCU3L8Z2flXFf0p6K@EhgQi?<%~wzr+i_XpzkS|eiG2?`mNQG$@0Xh^CPvUAnn8C~ zq?E^;Ds2PtLqGq(QD6leCMd2Lit2=Bo&wwS`rd`xrkm<$11~`ZQxYfFqnUoQn~qbY z-+yF`BOB~!kNj(qr5sN)GaTq!uB0lVYd<8Rr1}1k5S{1Wk`utcV7cm8U0aN z516Cj)ZaTxIfniQJ=s&&?H7F;HavO#jV8y5AspjZWu5&xez`Jt@H-|NhMI0IH74Vs zJ+*VSw@Ee8QHR)4z)jwnhYA?aFS=OG&3C|rsf2le`#QsuEe4#ppj8=~WCLxr>9Y&LF8C8^t+VC zk}wl_eUxf2hzd_QS)s0S<=Dx0AN!-g&M1|bU5?pC8tKfb8mWiVhYG>ddJ{watf5Ct%-=~(CTefCoZ znN~61I*idm!m_IxO(i;}_sc0M{|^B??AZJ7o;(qHV_e2Mc1GXtfGQK4N34YKJcu~m z#kQT^RYmhrTv9(&{~>;JxeC2=tC*BMTsC1mogjl1BxTenRF{d6chArxeKG4`**H#p zc|Y-4$0KaN83?w2NIi=psFJ7uA@@PEQVlbEa^%+6F(a#lK?>pb$Jjqp8%(A2o7=1% z`~iB3iV5KBlyn#UXknHSE8d?(kr(7H>zeAkPYAXcu&E=5hb>Sz8jy`s|ICZ>f8kQ< zDb9-%1T`kNy*n4=fBukPei7SQ5REChe=b%n|B}>Mm!Qe0?{r7-w~Uxu)V^hxIDEu20SeiVHDpH?5E!b}Z*9-K+LD8n6Q_;~s zJ){j*p)?#t4`dBIf-N`#6OO<>7QXMU#`;(CN6rGpg6ydAzZe&hj#ySj_DYkyIy`zs z*Nhuwg{_RN>qMJ%%TF%Xh!27IpIL0<{+K@9pxd^)}+Ct$?zChLf51s0P;t z4gJyHd_v2|wqG${y{kx=GYZkTeesGTo!SMo-8g_b%?=u!`(XY+_JiPFhiLd0=s;Fa ziPeIS$cy*13-~KN2M*@9j40jhYB(*m318Y`x<_4?9FboQGPZo81UFXCt2qQ17)BYpKw+LF#HULp^>OyVJ0doYrB;Gv*EhOmW0mgjJ4 zw6PG0vD;lWQ`ReHV~8Cnd@PxVP!Q|}1ZF45+x!Ad-CH>C zZs%f^7G_BRfnxePVSt+DfPwUVl0fHg=aWyDFKXVemSEiv2pEuOPqQMs5KXAAd(nZO;wXBx@QU zjr)1OSqEm4;EnswrS)MU9fr(|$5aA88+Fm$HTd#UZKn7)C&P|%m*L5tsEj<1}j}L8jB9uL!h`*mFSHOP`x^#8^UH=S;GZ(8gG)Uvr-T<$DzgE|$zYvb3?DN>_5MdK zy>W@P+pS`z%usHrRoJXho7_oy{u@HQf)Wl5yMIHSWDrz8{Zh}+?~69afH(2T=lOal zlve_9b151HP}1oP63pLQD8M$oY~| z<#KNyt)i5 z7eOKv?P*g3sj?Zq6$az;K~gAOV0{f5(Rlc;+(L|Lhe35yutOCV((w|_0Bjy`?RTdx z3?>VWb?_!7aTKhHxa<}B`oG{8&@~vqE~#>buuu23cfJ55!}^TBL9P&aVi>ncH!o#? z;5NijDv^RHK~#U63zGY6Fb4f|R;aA~o^xqw!zY)|S$f3SvQCe5*2C_{pa^ayC8aM! zv0xR#|0SBH&r`z#jThUjpEc>o? ziUw~Dz(Xn~06?+RfI{G?^!8_)uf2tx&5?KhDXwZoxW54}C)2lcr(t_BQv9YEeQ`DF z#x0cPHNP7p{QLrLF#iTD|A+n!Dgp!xH5}YmDs9pwcON5!Ek1y8LPHAP>|8-`l4w_lESLN(ZfsS7i*~82CJf$=-D~$b>wdfRKlB@ z(BCX`xG;67cd3wLD3acC#lh+SBcy_DRLt_!*X6+yvV%$DXqmNmz<;W50ZYZ;4&GL# z*9#i>H?-Bei6Ys)m?;!m(%@!)OcU@;px#9jLrr1?KpzJGj{4F--Jm-dx?^1$bFrXR)4wE`(5 z7%yzOWb!mmCz!4RZFE(p`b`a?#eyiHa;q*0{aY}|lsU6q65IlzUfuxaF)ca3yj zE>~2U?j};z%)KYAd96rf-B&#$EjH(njQn^0SH0WgG0_P&JN7<(UP}!&q%5Pa<90tk zoR&q)Cq;=vJ^vA%*wJalz8p42i)JbEp)R7KQ_Ha>Q)}|lj&v7n08T||Dv#8jzC?=z5Bjh^&X|Tspy5eD93us zq95mrr=-gESv$7z%ogPlicRaIycal1?}8_dRND2U;ONr=kKycnOed^*7{)R>WM8^W zPW`y~uh9=f%@1I_&b9U99kzhsc=b zEC0Xb3U=;2R8Ow~jwLSWx*uE?$DPlujNHSLWdH~?6eG%-PY~Ozc-9~Mory82mc)p)Ew1c2a{}lY0(c*zF1-~&ROE10tO|IH?=}~K0dcoxcL!@Aa z>qB=k44Xf~t+!h3&Ie*!UM-5uDn#R;H?jdka1T z9xxa6{4REy`sK)VyP$xIj#%oIspj@tH-)*Uz!!3A*hbim=EGG(@a#1LT}aU2K=`94 z?p`v$v)ZV=aRXR(jsr@?rYE^0Ab#c3Ihx3SLAgo$GBh+W`5k?Z=p%*O^ke2{Ij|{Y z#EEU{ar4&xI#(Z={D*sI7bsKXP7G~LSgG<9rsyh}18#@%nnlr1XmPg2^}y!&=Xx7Ep~ zt)l__Gd_aMA!%CW+^Pll(IlPEhdpD@F2jQd44J~vBY^(CiZ%NX?OA5dY}zd;oAw%3 zQe~_=Eo$Fft^IXAsmJ||o4@yhvuIKB^fZY&yi`+(B}0ZN@D|#TOE@*&*!1)Tp9T`$ zq^u;27;S~H0Xx{*jml7Tm@czV>nwE}NR$tAZ1=@=Q)1d6U|QP5s^fLz7TOlFTa;c-51bnw!=WNXDru#~)tp^JY&>>rY zkR1zDzd%owA$W{s0|X}M<)PDwOtUEGcBK#yLL7%DCSeBU+}dU}P!*AFCzzor+LW!} zyyt6{M{V3hT*wF&v1!eUtD}~6_uilmE17~H_egllDaB5vAJPaPT|)pK2uQYU>}0>o zPVQKBKLtWbXjv*+1s^aW^BvXK*cYG`?Gia#z&X)v6ML^Pi$wTlrI z#nQ{%0i*<*tjhr6Iv$o5@fY@;Mz(Y$v!}5qpzbwFNq!~D4>5bzXzzUhSHALxqo0JM z(d>XbamSIeHt83V+d5x>-zAOzr8i-X!ReW31$U@&Sp%9^5i;})Gt*u zXKqBl-A#|IOY z0L!|f@U&*Xj$ayit%yCTd~I_z{-wdIKi&aI0&(i6KkMgRarG0@7Z2c*?i!Avxio!n z;c#jG&(Qf2kL5CDK3%|LAu}ic#Y$&Nk%D8#sD!JW9vEtBasCFzzt`Zb?!F64yIGmW zr^6#=Rkk>F!Y#=C<%D#Mc$7m~-52V&+WKG~vEuIAdw+r|qagT-x6T;~f9u;}>&Q6y zzh!}1^oiy{3W4V?kKQ#sCzz8izj331Ne`Mds6t^rhc9J2jW-u5U2?O0T`iR9g+`K4 zV73*gkz+OnC?ZZKoN5%RnU3OT;EkE>XejrnMWG!E`&ze(g1`e^N*()L@zrx#9jr^T zEp{d!4xVsyfrrA2L1O4hc57ov;1(x_CBV>W^~Lz>eNs0{wu$BK=a7X~85tNxcrR#7 zcDjjquTOk6eWonO@@52VcKLg1PH+1S zpH+w1KC0w@bP80m7sJ|!gHL5GzY+_E*cgS5R;O@mZzsjSD9e=Z<>RDexlp0A2O^Uy zSBE+eMelvD-uo&2p3ImFN2zC+{QI<7&*M+zd=K=daZ^54l-02_N!O#p3y`^OT_RLO z%e07v2X{lKQ^hm-YuPR-Unl0F<431C)cNT@C5K*HS^8!6&Zf!ABx2ZN3zi>@DagTy zoDc$txVe8#50g7kdf*MuvnvaB*|36Bz~LWm{^-W`v^w-f9QQTJush5^o`2Ou32Ke# zX=rYrEiKR83r&^@NxasAG@v3>%t<3AVQGqQ(XTeWXXI690=gVL5=BVV7EUVXvu|u~ zdL4x7rY5dLanWto?N4DV!Hjcac$!a^cHMLRO;clR}}g8Tq@I9ua(F>hI+xMTp+v+<=QHM}tpkuG`b+@SDRkLL?V z?K6Ou$F+gGg=LhZ6e^l!dUYqZ;~$-QS@TFE-7!mi>-JtTO}1qkMGx^3yIoo77Lzhv;lQ zwhl}8*~-?#H=pew&i{^EP#HnR1f4fL>neL6lz`yT)`NSW)_duL*dOiD12ot^P|w;C z&gM?RFw*N_QNVOGCsh9%PgU>rhY#Y|aG|Kta6nS`2H~`b6P>p!b>{ zO~%O;E1c9cB=u&talCZ8ljHR5JCx_#jjX%ZL?N*j#HS)Jbp4~wqn~;0fne$p;(Anw z#)hH4IR%PKVsTJ`8vMeVWqMpS1;#js;Nw6^G{3&xz(JT<06a*PnknSx%2GXNA z`8h+65Ja(>4je?_iE!vR?_}06NPbn$lcoY48*&jpGY@D{>KF}3d zIAG91uq{ydUh_G7dNU)A?dHvNYpK#4z{{T<(;6@D}*;--HdbGAYukJ*v9BVP%n zEdx}Yh{M8QWZ#anfNVOKhXyu z)8qDK()?=+v(Wq#7x0eb=(u69H6bIu9M*tCQ3w8O;BRlv6`b1hqeRvYN8SRfJa*KZ zrF?Emz1MyS#{(-3(zSW6B_pU_Vgyk%P^ZlO&uKvP*X{e-C%4o+zG+z})bjcD31S-O z%-z@5KaZD^YAt4@2~8QwIu&|pS2Z&d6vA-pQQNUfo>}{6y|n7PFEw+MhgUm-A7+YT zg!x)l2I`$ML4X-{vaKhoBrCGC0|cduI)wI}l)A4`+uX61C0;>G2%`(gLp}zE*z8(e zLlllQaX=^tpUVERh zw`L?n@r^{mE_NOvA@$ofY3s7Cye+v6(@w|#iAhkkt;R5CDh@}x?m`F+^Xr9pAZ zBj+VSN)#JgE7sy(WbQ&@XKid+5E0PLS_ksEPh>VP1SB`f?(uGCQqcK!YyA(YCuZL7 zB91Xw=9Qc>@R;p*n*LbzTwN_+`^|doXo`? zIWs9k`-=P_hX?Y1Q#`Jnu;)brHc;1SWfW9*>pz#q4^&FN6w%Xn=>&BgGovy}HXhE> z@ko9=`s&2tgd?33S>LwArdI{#&+BvEhPea0lsV|7OaQ#9_FYS%N#dmg0i$yV*%${IJN7^MH}RSw$Q-a1NG{_3|Ksc31DWps`0q}mEV(MIlvI+) zp#zn(4kCw$jX9r^Q;~BcRt^wEw1 z`}bc~N}t2~b$UJ@uWz)eD%FBPnj?{V5j&3u&(K#2pX_>8Q|<+cEAc$KGoe!Zv4#-r z`FM-NcL$5VY?^585l+7DS3eqY_Hi2oXoNVm&rzEhgVisXAB{vS-dR$A(;m2tq?Usa z?j$oHc^#d682ZT`$d{1)v>m`-rw2@r0X1QThn^h%M2R< ziY5>}w=L=p_x}=vb!;2Q;$dd2o9{=GsXlcNaGqw;p;jAk1;vcGNmY8GTAy{`a}w0X zV=L&3!49<1;+N{pfL2CvN+`o0xP_Udp}Hm-M~QY3+T=?##H5A44dZ=2Xz!xEJfS_i&?U z`k6w}=d``FU8HK+O}}=8kV^V&LKld+AgisgE}sh;U_A*js~NiQG;{DettA&T^lINf z@-+5Qr#H&{bn(r>u%}G?*>$;}s)S|bDW zp9l+Bavz|rUpZH>U1-%=qPoZm^ls%aKjkH}KFDI9Lg6CpCL!{t#rf7vXmD}hRor;e z{*boQ#;5b(fw(CD{n*{UL93p)K#%>K3j5%RJibATDeK%fqJ`aQdrCmTZ-99srJ~EI z60hmYcK&=50mn4}oo$$8=eHR1G?}}wpB6>Tz`BPTfnSc3$8!uI;HA<*70V!JF1xWa zY2GJsR;GSGWUao>MQ5`5G+Z=5J!6EuFt_$AU!-U-akGd5+|pV9aXs9^obyv%=n$VO z;?{g?qXCkX-zV>*D+0&-aD6qlqe}3Mc%OiUKpCro;5Z$4g7+UODQG~bhgqCm-hPKV z$6c5=Oop+X&y>!~b532vH~+dRt^FTLb|FFb@Dd2){_3^+Nw94Vc>?x;0mX}y6x%ht zdzI6*i>x;KDHNr-*C>Y_2X|$<3F^1O^^wA=?@sK$QMT^YS{oK3t zxMYN}8yK6o=18cS#rai#Io?@br?TVeL*i+S6$pdcDw+W00pnJWAz7iMiU;afWe?;8 z2luX8+NBVC7wNYB)_=r!L&QJXyC)FHH~cZdahfz3HN1if^oyJ-XuKlbg~A6O zyCyoELRFjMZm2Q|;R-PW4ed!k9-2Hr+Kj~T=Z*!czm-CI`2YyB38m>XgL}m9_AlyR zwHME^Lp3O}8dwy)kjjvVk$3CEplU{(9i@!rQd$&C_>@C0&w8m#;_rQDS~< z$bgRCfBR8Gs}=5`b;x0&IJ!Y=gy`senKS_^KuIqR$%wXc@k)4>S5Iq&ehVh7#t4*^kOM+g`afYMu7 z>kh=#QVplBaYCmT8;O9&o{Kqrc!$!3nYy661fB@E$Rfn`3KbR4j+pWAl6Ii+S zKr;dJ(hl*O-9@~a*XBJY4M2RBkCOQToaVfLy!%RM!S_n+R#>edKEmSs%yNQrNd zqQk5uU-h!{FCor$B(~FVD@5`dvh>TuPUy^sc zd@MXvGF;Xsd#9;zlRuBKz}qfM3-iRVM&_GWP&c6xtzq=*ngBRj7n1j!vxMnbLmb%5 z3>tL=0*{o;7)L6`V>rTY5RC6aCRgpAT^3q#FS}qpByPb%d82JJR*&RL(NKODqO=IJ zQZiSbFMqF0zqXz-HDMo7uRcrc2fc zO1?%*(d-^sRIQ-O&lB5e4g_s6Njk}H=-5lBqodj{*e}(c9;tvh30iQR*7Ng3vMA^j z|86G~Jrl$hbor8$Xs7#YAo+{Jf>=As)8BO%yHrYe=~eUb@zq$c;MhKwb58^u+Z|5Ew%M3#f>m| zzcli6Fu?-+xe`gFqu=l)7HB;or4h=0X-+dqXnm`OWN@32JAsFj;=nQ5$04r8{=x~l z#k%fIkU1Xq9B4ySJElnKSEvSkt#al~n z0)n{_3C3tf>bm`C#r=VNk+ySXt*Lx__X=*3ANIw89m~Cu8c)rSFRl zim9X5t@+6YCPWftYmG>>rZ9I8=Z%Jlq6^dd@bS%X*@B$@WM8YzJ;PJ_MV&0xehO+# zl&P$^=TXd7brC=Az|A_+-Jv@{hf*#w!(tr5H^wxr-QM=kEJx4LK52tVB`yMSG6bwp z0GU7O&cljk2O~91FXMBO&>nXsyO_@ApRV5J08-)pU`DiT#>Mx^@9xY#-3O-+W>{@f zT`$+{&F;)_Xn;p{uFZe;UiJSj9zKkw+`GJ~7?VWpDBl(@6+bauY$1I_H^XeLm?8gQ zI)8!|7Y2=V5E)dO^FAiIJ)sPDG}#=@HE$Rvb~;Y3SzlTDlKN|1f7*yjwr%dxJUq6X z)eiD3rfuSwIn((*!R%+6r~>n~&36|%OPp`xmm`VMzbUg*v7@qu$E4j@w!i49gHgnb zI7_gMp*}X3==`wu)Xbr~*MI|?iPmsmjk`+Xk@lS>(89+9pP60LQdILuSU0+SzuUfC z{9}#RjzPV&tF!fL!`MM1tSzjCSNM8 zx+*Jnz^Sj4!JM|`gJ$2Mk+oy(47tq&uZofE*$P=dC)XlP$s!ezcbPFQXT0j>7&FUp z=?%{P^y#FAF~`t_v}c>oA80b3+w?=6Xh-67SnlUb|Z^IUADQxmSDhdwV(J8co#P&qd> z@s&u(J_T0WiIxz`dyv7hb`|izU*m26HqwKPhGIpKhLCOk_$Uf2L9Nwa|_c`mY$pF>Q zjP+SnNu(vIGbJWkHDW@HY*#XrD*3cJV++)HyzbgaY7Tjw;F6|49=vVi;G-#Kxcdp; zxVFo%zb7HLQ(d_*^1+L$8}GN=M!#H^pk*viC=jbcRF9Z)@9YN}>iUv=eplz!cJgZIlJMKi&xh1slF$Q(4kFDzRMhMo6UV~XGpA)+t# z$_!?Tw^civysZQjOmWy*05$Ph}Y%x{CW)J%6moyX$eaO?-_VvABO(F&TSq>;`Tgv2!Ul&GN>1+W%8tC64#2Wj7dA?!Sq#Tz)b(G@L2$F{OHi_ z5k4D>f&1isUnN@i9`c?3)MT$%dZE(%YL!~n?d!sdF}uP}H|)r_*cLxjqiH)?aj-7< zSfmGRkoYhqbaxy8)tL%njB3SQ}DU5nR?9=ZTgQ zhKk=>!ydOEVvAl9b+-w6IRz5mM%=f`qI0zUzu8HksR~-jfS_qgTg0kSB8cCFOpOWj#KuRAnoeD2QX{a zdX-;Cy`XMam?ky~Vi`IO=A&P=_-}+amQ{cGE?gUosO587d5Ccz!Rr_GANua=B0K;# z#)H)HXDtHP)#2Lgg=)gB`QNcib649-9m!c7LtBG!D z_0Tb@;q+hU>%1OEbP%TqRq=)bSc)*z^DF($X#E6a2aHr*bi@AE{Gk=U@xjZJNez^* zRH!_W-ex59u-3(burYpCoSU0hwSh%lSUgP#8jcL5C(*6-*RB1o4btbLrCn`bmp2ur z(QBT47WIe}iv%O-h}iq#p=ThHpFY#Cy|wY-5o-Xzv3r&{4Bq0U9zi=v(+YXjzR!I5 zE?LYL=qUE}YA8^ojSB#P37=g8WEfx8b@x!n=9I;;OR`X7(sxX*Zk(pb`jZZwtAk;+ z@67gBz>QujTX=ksH;6FbiR zP)1o3v`Mlhd(LzW&OO4TCV}wPUOT2AG8cMbD`;1~yA<_tAazy{TjQN6G&*WLD}oAJ zms&;1`b6;OZYGapZzP_&o?7fR+)h{%i`qYlkupdv9#0+VbL-)eK#Hh-V$rgO3nP=w zvN1zZ$t5fygETB4DRxxqgulN6?z0QE?k7jp)9}XXeZ#so)1M^=!2%9j`RE zF6=>=AzL&)$mntZ{q)r-tj5P+wYmP=GZRYoH&n4tVc&C+$-jzjk6t}Cx6s-AeKfrA z=HHFiZfD*T6od>T`bVmfNEEh@uH}^f6`oSvQVYQULTUj zV`=gBU`Ye6_nn4;pH^!F#y9;1{i#Au45*mv<{uUQDdUm!8EGC#g`MD-_a%B^#-WRoSA40eeake;vJA> z^0fqAY7;lPPx{PKXW+o-Es)23g;T1S?@m{Mx#S)x|?m;KDaJt+G8(C@LYs+;W>ue#Oq4V$}hLDv(7b-K(eGwRdQ;7DAG}tFz$lWNR`hteh5F{+!VG^CZj_=Q?%o9kvRR% zyy~qY_gf>M8GAn~$J~dCMQQ^n|46or0Jd7me9Vh9ab)HgYqt&S;EXZ@h1!}lvstmM zaC|$SBChqB{?~b`NxPx^RTjt=t^rh%XLJldwu!DqP+Wz*RO)%)74~^uZbC?%IJpuq z9&}rC?ZvsdOvK82OBnVJML)yhLI%{e7TWeQeQWgG=6Us?wCalceLtZgZu+YqN@9Z0 z3q~w~KAM4-5=!=cozgzYX;sRpl0DPeeOueSNY$jt(Fx@d=bYrh<(5DpLTK0Z%21)f z3oVsMA8kaq6jIdQ(zATF14g_d_;7YLRo41w5UXUPx+&ZfVH=k&>)Yip8-3ATz9_ff z$xm|LA`T)w?Z z#_}!gw0^qx%{2I znp+?3lLt`AD!p>GcYUj~Wy0Xk-b_K!@G8VG^j1(P<;S{=*F{fXJCL!#&}{R(cj*58SK)z1!6k zzcz}lU|xxh*n_8Y8+zt`OSiUcCd*i|&Qcjz9mEYt9D6q5$F!b*tQJ^0I$hGu8J6}R zv?|GLde#>wh?}rW_LIVI)#1WuwO-3~b_(BRra?%GWbz9p_>)sj4O;A4{SKWXJl1+D z=k+0Wx9QRhv9x81+NiX;6W_96Sr$JTyT_vR>Wwg|a%Ak*({F+ivTqrYP^JZsZmGFI zTwbksCY{Ha$7K4{mY^uX?k_!diY4{xgowP1M`C%Te3SwDe*U}sfxs*Ac@}3z@D$Fghnw;y3;b1J-6*V-d@EisPz z-9?rY4${OxWx6k1kbl!>bq}ASW3LqEyae*&(^5jCPmi-?Tm!Y8xqN)!halEZ+1Kxv zV}qfD{;>O*l9jb&QJp%^;h0~tn>S5y(cyyFr7@wnH_D`T@hjbPd#Szj(3%9l)6-)< z6?mI1f_(#M`Q~(d{rW-MsUXxXaPBMAnd>wB&N9Uf+#q!C zS5ur@X>qFi>MPJ+GbYG${Ty3So}cEMP!{b2Dr>Z*>s1uxWpVygP?X1!V_y0@#?jj* z-3x(w>h%E`gnZL-Me4u+`Eo%oaZAY_*fL-_Gv{ zuWR#%B)TO_^b`@yj4yfBg{@d_tLD2^tHXoW1TuuTb0s!Dn#Wn?#WI+69^-tiIMj_H zX3S9elxJKBXgmOJYdF{skm6U9aP`g+y5pmyxmG{25%eyAk?2rsial{-S4wm<9XKnE9 zXXVFm{R)@S^?A8*rQ}&z^p3x(5Hmh=%Mbb9Xjj?jz0UT4%te!xPS%MC@2anYCt!#q zH&rxm%@JvnUHLY>`fDadN|1cS+sbrzZTK8(d2`B^(1vutNFXOE2uqg^SKA2qD(Q}f zXUMfIn|p`vTKfhqEzf9e@eY!#q3~lXwdDEoOKK^9Gh(xy**%#&)ekpa3ZQ*aZ*-~- z0EI)(5ljETf`A|vwT5zlbse<5g^ZHhf_tk%dVd07lT0ApetCw_z}lppR#l60UnRfU zzK^fXf10=4W>OgQd?;`BkiW^SUSxrAo=mROl9I@nL%%+0`@O>;a8_sOmU#0rQkP%t!V$hlK%@dF-{r`-Y?qUb zvku*=c5Ahx6n)nxE@Z4z>)R`@kQObL zTD64oN0lZelUna=^n3#3c;{T?-)xJMLi+67rhi5JcJZ~X(6pl4+l;+4Q+FcH-N#?$ zK8nOKmGf=H{PMf*WqOu(-Nm~Sfh6)Y;1ivgJb-iZ5YA$zt#Xz77hr}Hl$PJpyFBJI z6|B!KZIoJvj?j7fD$Fxi`!j-jm%no1&EtHfOq;hqgYr~Y{0Q60Yx*{)lJ_-NjsAoJ zCU%U_x_mr)dFih0(sC$WKdj@`n@Sr*L;>y{re&t$&V7@)WO8h_; z8Wy!T`OHuqsM2cXyAF4m#4G+uH$wpLSBlV7KhCU}P; zF8LNN_MG)ri2Ygp`4Z);7i!)4 za;E_t7x6I0AX>){wE&UFzihZT?O1QAzbaQ}gkDqYV!fSv8C-_GF&zXB+m5Q{I`5Rg zmy@+rWt0NRd~VAmKBYZCrMJH_H-1C;-j(&LNYI!^0oA!BuEYI+w4o*77@q(!XX4ow zqns-fN%?mc+dn7pvH^plK220CAGwe`_R7Tn|pk#k1HL>m>`h4<7u2wdMb7+>d1^7m$HQ~J7(X(?krHAqQ)HP!Jv`_hfzKg|&L z58>w(PWfC2BE1Xn$bsG4TXl~6xqhW}IchBhUpaa;iS;lWa7)wMq4O1rVV4x zAoJ=4OmJ;>;esD6MW}^nJ+zf9ZrDaF@AD(EnVg2cjQG>bt&ED76{`v(fpA=trFuqY z9oKxzf^z9)O3#b1{fzS6Faa+A<1&1-tSkPIxznA&Ad*fNMpe8--oFMrSZO2Qyya`K z*$7twWB%1CWT4nSz97C&f>;-i%cVd2JN&6F+-kR1>W}=!snD(oQTh)V`CtFiSzukz zN_jVm1_g6?nfNmON|YpHqo3o@4`k8yEsA2V7_qmKJ4L|!J&fG{glI+;OJx4>(M)HcUx zicg`DI7#Z{tu3{-0$4D`s?^V=rt^8#?U)ii31mB=v?>fdPIoim*THdxjZ=oWJuZjt z966nyXr6J9c2n5RkUo&$9wYlFC@0gG zI~n2bC($3K?`|JTP~(2k@l=ib^?0byP?!XAybU4bFQW;`e;5?}=>c(}amTvq*MrQo zt`%sX_;7GPhDCyseT`#u%0lm>h#UUVp@+_ z;F7z%$q_veS0v^R_~I!%6A;}_Lgol~81}t+!;+lvhnubh$Q;KyQu#*vW`X>#32qvt zbDj|)gAk)6VJhVyjgkqu(+9S!oUI*J`(RV!)_ExPWKHSu&GQfWw@B&-CJr(Vq7H9? zVf*%OWof773)!`Gdo@X0e@RccbliquUSg5mP>LN4p}q<3EjJRN7}WT8DCv&>eNGk` zo+pcCCaYf0o?R9R%8cR8AP&-!6{utjb_EUQW*G)P-BC&xJYvCx3pG?`cGEn|(4N&zjdg7dJkLABw=FrWB|2DPV=P@3;i|1Xlr zFE@G3;3@L@Lw%yYKi99sm)T!E79u!Me5@V5K{wbnr)1r#Vie;JncqZ~?2aveY!>N8 zbnAUyXpwKwxM2Ef#WBqiugfx%eICI79U58jD9)iJcr*e(oS|CO@o3B)GZ2VURv+5w z9vJPR=Gp$Yr=`{17vzYr=`K0nzZ_j$rqbhh5-7~=@%Lc*3gq8UipGg&S7Caykv-1oT8Vu|4 ze0&*AsXhn`BfWYu(wO{?(l27^X*Yi>JH~OW*2fJeg^ZdbMx57QzqDoUQbHn%q+*0f zlaL|@)Sf4p3e@xM*3WPd^0K7&=)Mxlos-gE&5Hh_EtvK_<+x-xaWn4R5V{V*UJ+Ct$)c!ljqi!Yz32 z9BrD2XYtRe*c{s=+l7;Z4o!O2#$gc3?2uSn<#ocTBc?jXlefxU06V2@i?_X!mUpjU zSC<4*k8(MQluGrvgMZgk`Rwre!J|`wbI-N}zC4Cn*;^(1J|=BB&xV)0IT7%}53_N> z5J#U@M)_NUPX2OD+vP6CjUxZPt$iUpadoIMRo==lGZ?np46c0MaP{if@4ZHroNgmw?Nb`QG#6FNYs7&3Ro2qy#6-0|r!4~=Yu|>E&!u=H7z{i`3W%|@PlRF4(@Hqj`H-UwcQ44nw zMk!tQm_$rL2ePqvhDAhMgJQh{fi~I@`No(bC2t8-hRZ-8c{=iDnK1!|U~$n;u8J zE$U@tfi&gq6{ey+&T~H0HDU++9d#gUyQRhif{!xT? zdX3Xg*f&Y7z0eWM*y>g59a7i1q=l9)t58hsA1WCvW=!1clmq=MNdEgf);59Cl>)B? z1(uXmYV88oK2MNm>nFY!B;O=ptS>rBc~o4{5ANd=&wJYl+4@o7BQQ(jF6ExDT&cx) zTB{~%2Ygm4|I%=UVw`r)^kjYEZ=O$zj^SKoeGYY&{Kd)V@Z;{A%yIk?F1wmlzi%l|DdWpah&TAKH!?>)<~*RmW1F zXxPSEEB(4UfiK^VIxg53TAiW(F%UTjW>#k_KAUNEzkqd4XI<`p7hs;fKmD|X>?tQl zfTK$Lc>G3#GqZh_~T0dYAw zw`);W`Pa_fs2s^UZl{g}N6ZuI_Q?nNst$yRqF8GF&F-H5y%gC^Vpax-3H$-#F_*N2g`uL+=OJw8%~=Xi zEHwGZk?GN@$D3~vTnctgiSroa!-J>JNE$gzjrLz!ZW+1?>oGmUwkt?auTZ3R2k9RB`}KdvS&J%%8q9dxzdvb+rX-7AI7sQy<%p#fovCKNZ? zWK_~OO|vffr2VQJN3A+u%d1>|r7;@-GtYJjzAl8sZKVAYkwDU~gPJnauQ+*-k#}u) z@s2(c=N9l4HO;S5+9qKLrqx1zA0*@6DydneJeWnFgq%)zlV#J3o_cBYb4hNG5mtM8 z^xnkUhHbV6yTR|HS?X%#Iy0#Zz1xBK`#Q_`KGX+Q7x_ev55o|C3D6USG6 zx2#=7Vd5jko3JtIZ|PP@s+Kpz8QS_&KEaGPYQZp}msaD^`gh4Sv0R&B94em%nhMo) zYh+^;Tq)YRwvDEu%DOYYwsEnepD$lA;HOu9V0u5RxZEd6kC>4@^xF{~4_G36tHYjoP zQXH%JqtE1%592jYd;9>M&uwNSG+DL5da;joqB zM&sX&yTdfdb2DEjhL|^6o+eg=)b0_$mN;Fx$}R43s8rcH_Q^=9hr7A!+4((zKFK`B zdkZbP@bWD+0$L;cW)D@HBjWR%?q>u;^2u%TVfhYY&P2JPkh#h344+>@aY&1g5H4U^ z-)X#??GQzNz84Xsae4S0dV%zjDpg zGAq6nAA=1$E!_XM>>7S!(+`mp!hhq^l{MZTC}c}^$fI$0X&dbPw1sv^3LbnhJRulV0C|w zl5R&d)l{71PF@bYil%(^-KhCti3DwQH)g+A6>0--VN(^Nol~)%&c!HCXs&B%l;`zT zqa4`HP#C)`R>%q+YK(Z|O{&Vh&=^|;#!ia%`rv|`AZ@2ZxOo+aWRL+Td5p(W@>(si zl&|T7Zv=eV_Pq&JI+(RyQJqMuuxpi!wfGD=T4^5*ST8*^Wz zi&e#UfKi<^XH;jaJF|G5rhGs@tyF*B;~qCfX(3pDt-_)8G#G*c`TTut1oXZ6Y9r!T z-lo6FoE~4O)lT3h*3gkSDR<;oW=f~4OYp#eYi&wKF1wZP3(mPekXv;SO( zdnQ#s#ILYYb4w|8<43@BzzTY0p14X*9LCUxs~3iQtslZDhLfG0Df!w;M(?UqDm2oY zQR7y>kb-FvP-CO43$<>e+@K*7^!y3PR^&JE`W3s=ShKTKU~7bX=SDVV@ zpB@G+|B86=1B3InLq#f>FBbxjyyCdk_X5ihFi89qzTvr0n634~6KY)c?C8Y)%*h}5 zy`ce5BrVH)-MPmgPpXXcWgEV%+b!KyQCM-?{T}z>$G#gsWU8I(ueAP%$HH^7mg9D= z?{E_0#|{mqb%Pjm6M=%tfkt1WeyH)WJV_Yr7;gw0N#OIe+{^$$F;}9-^Yu`wBB3by zc|3CtPxc=M^C~NYDzaXen@YQf*|T3q25g4P-4@A~58DF#%J&H^89R}JMTg2x_};~l zmjd@vEY4-`^IDVg)AY3~$5itsKaolL+)d1;%B?hSl!o))5O&1SB1}(w?T-hAkV<`s z?*foWP(&At*871d%XA4DrKO^5tb|yjMQ1E{LVv z6sx(P6A5iYp$?TEekmN#5NImdYB}h6!uL#GW67!5F~MG6!hi{Jy_VacmHPuez1w*s zY;EsW3*5-KEV6YugzKc5jAl_Y-G~0m83<$3~4s*8x?%Fq;feVh*}H#`oML5kdW+dM@yMbIUxd1ytZy(3LLc6 zPbZA>c!r4YKBu=aS{m(ts3tEL^!IG;x5h~(2rNmVguG3XQ`+-%eS8yzUiG+ z?+HX+p=z(*FDkW;C#Tc5-supJNVUW$$KtKOjE_m(6FNuh{!!&UcERv33TkP|lxOM6 zxv2ZXHbeSz-(c)zQvh+L{3?&`vSYut>#bcH({}sxb3}f35PR zY?i-vEHon*7!rQ<=r_dnR@PYWHvQz10{*Fqdn~tBZISmKHgQ$Ab~%U{1r^Og=SIP%=eLr{=j4Hl|y1ae>M045 znh)C5B$0Y&E63kV5Vgx~hA-5GY=oLZl*X6AUeiuAi( zt&j!0zgI7R+s1Jax1O*0HvgQQKI_iRPdV|IV4lqQOX7o!W;MSK1=`}!m`hC1M%+n&4 zW5R6hWt(gMW5B<^hqC`Gu(1NmrG7W7VTh0869@b~4i4d8;^_il*XO9Fby%6pyE(rL zI2HWty(?{t5#A&-?uD1KsGq7)QTA;kImfk0$J6ce+V0;<-dl3`i=a`;9o-6@xV_mf zhhGjd#VX*viNm>hKMVyLvL)XZix^>Yn)opmm^&d-`tKpH-_770>`wp7jGVeCme6-# zB|1ZNn@PZrcbxV@W3pR{%_M?vpR39=?8=A#@7lDH=>u;vWbr3pg z3aKpTsGvGjao@KOutOXHvqI%WP4Y)`lbiKz7j7s0fmUFEFBuq+A8d;c=!mWMzXy?O zfZ_f}i7dJ;UfEt>#D%CIc%4JhX1kR?L9phKS*nGrK|2~Ybnz%zU@22<^cC@RCu3*Z z;_O7wwnt z53KK7Um~7Lhf>7Pc9@jXmu^B_g*oKQ%O?z+1LeDL9>eo1!qH-4M3X`*$lAqx=F0lCMm#g1~9zvm!)^9CXCc|f$)P{Dmcz!=t}O^zKe zsc*UCaT&OI#sg*8aZ#2-{69)g(!O6ud0W!$@?08)IjN#2RH3iVrY>B;{~bclwbA2T zeje6ozY+20K)oGU&Gxcw8zzpRC*7mjn{R#tW$MO<#GkX|Deis+Z09*%{6-^P*23@X z$h$Rbyg7mCNCr%e4#MvZ7l8Mp3XIU)O2h+XC?!DaBk1=$@~Pihw&x$rI6Rmx_u;v8 zRYJrm$?W?tXAPr3$BGZwR0KKe$eY*<87I3CV2oB5bIy6xB`18lxYEaed52M?H$hve zlye^w%2f)d7L3UA!!?6X*$!L|9sNIy7|zZ6&-Q0vB6ykYq9KqEuo>#bZNN!TrDyJY zghYKQ-`q(r*byB;=1BZrurP z8#irnEZBfDl|;`Z@8m2~0qLw*RUP$HiRf!O)FrwUYWy#Izj&95k^CoMe!dAP7k@F$ zm)T627qrkxRa*;94sYXs&DG#f?lB2tJE1+5ENM_LwLkQY|8HX{fN@NOu#rLDo3a%m zjhC$Nt3BC06ocKaj^{}Q{$B8d>4$XW_CNr>>Q+|e!{7HxS9JF&{XpQH1|qKR1Aw9- zq8FRdAScXr8)lr*<3?f>0Wtvo{UlpfFZ8NyPwv^JZ^Z#LysuB(A5y?S@7V7p-E308 z@feU9PdrRx)lSx9LYM)?%~$<{UujYe(zngY2=vOC5InP8u&e0x@$4> zBA9-Ihq4_IzWS4fN-LUveHeGWJr@L7PfrEWO5rNtPKmNnZ?FDMSo&9_idn2v9bK)P z&v;^_vv$7C{LL9!^BuUW%!-`%J|7JVNOl|-ci6dVJL;sLrIJ)6p4x=-~l9E z1;?8Z!oN}mDPAfVhOxxl;lS&S3~ZD480Trr{g*1XwH?kCpQmfjcJ;{J2C;}g|`ePrRLj?bOD=MH102=C_ zHEQ22IqtD%I*!<{w+%7-B(xE&BjwgKji_5{hfVBVsu)r8Ye#9~alD0L4e_!z4!{PD zYm)}!YdHic4ghk~lNT8(YtzWt53?WZ2?a@n_J21HZrg6GMdrFZJn|((=#9=v!6ESc zjnXO1&@MB1@%Ytz1;sdUaW2CCL5%$ejgj&nG{(Op4Y)CU9P9cZh%_P)6!G>baM*I_ z7ykpvxR2m?tII)bIaL8z+0U0DG{{UvQ4_lZ19p=fv^G2Ye~BqS4drX>5a$a}xJl+d z0Ep4p0W?m#SGT_#RNXFXRo1Nc-kO$xiFE-N?0=$*faUKGKsV=~_(90Vybabtv|3rZ zSymAP-$~~pMwr*$_yb(Gyk^+|Ke&24H$XsW2+h~xpz8thl=Gwms+F!F`=JJwJph*l zVWan)&0YX-;IK>J^|3wky;8aI*e@Xx!y?0#KWbxw>0o(hxb};x8iJ-jh-#fjyR$KQ z==8JMBK_4x4!vBzQ>pk}#_J$z3%rm7CkOyz^j_kCW^cCG&5jJ8$UR%yTM|qMq;;eF zB8q=%6GsYF3IEZ0?TGotE9~YsWsTFOfF6*$j5B z2SomnW~yZX}gpL&E#0PNL{$0Y0I6n0u%n0-}4_ck-NH>~BxnaW2-yDNBK?8Hy!t;edj?=%>7U(I2!5Pg`H2jw`SM7-E0oe~&`Qzw zmtOy5Dx|{tUi71u8$8F#nzw&2RbMF`u9H>K^M8<^%SOALWn;nsni>w-r%rH&AV8wo2{)q(3pFt#$J^RPCo=%Tu71!$g#>KFS8HWpbI4_qk zfw6;RM3a6!K0*ujsQpp91r^;=&wiH@e7cp8?*vBK?n37rHbpPYP~ht)uDF~$b+MVv zJ%oL&fY&_zP*BC*gh<%VbAk||d6xLEZDY%;E6gdy# zh^6rcm{s{5_>F341nFmnZ|e zewg^-#jj77TvyCDI$)#Cw=%UemU^E4=3o6;ziE_om&2>v4a*O%@wZ%=95HII>CGV2 z8((6-aR5K__8_h!+2=CuUh@S8E1TTSsNU+@HRt8ON_T0Qo%oCwx2J=id8nGxBB{e_$l{J2I~`XZ zR;qccUQ?i0+U%qSMncOivOAY0R*zg6+22Hu@D(|3;m3KIa*}~+(q-l{T~{i#gbJi~ z8h?;N>{phH`D%GTOTIUeU--}mx7{}r?_*SmRmkPvY4Z56`0J`@x^DZ{`Chua!$OyM z(T*s80aqg5Vb8a#%Z7E}ga(AO%`ctkfvr1g#5rV}%*~sl>|Kg4K%TC;cY`%?gMMJL zpt!1o!Db|Uju4r+{V_<|s8WPlw>V<6K4QLJII^94g!`fFX9n1QhoXpfFsROy$B7E) zu{nvLC(qTyPSb|*q=pA+E);Nrt4GsY8Ulq5X(sq~DIwd<=erDj$QaLM>m$$S4}}Qp zGv!*|ad;je)B6qPNdA`5#g7|*lUP=0o|R*c3kDUE?~S}RT|FC~zN3i-11)T{ps{o3 z$o?QX@1olN!lp2c4$w5Sm;QPBxqN_}2EVwO=i&i`&^fhIzUfwKEERz3$b$P6`{JxF z(zpL+cfiXH<0^KrQ91w~0OmHmtI0)cwXEr56BWh7M`l+8#S@~iXSKtmL8dM6_IACb zP}(W=@g|-08X>s@Jwn{r#200(mNy@dUIDi9#|4s7HV!4YsWUl67ih9)36er3z;PsZ zr$&Kj1wV7rLW6^tdUd&88#tK~8AbR@oa5j04}(}@$4=z2i~W4Fr>xgf4HQeWhV@-N zE(1`;S&B)|Sl05mUlOb2!BbSW_8;T-_}T;-`UUXPiD{d zWQtPRUG=E5GgTbm4hM?|AcM11-eD8nhoV3c6p81AXueH9(sm#ekF84Vr{cF{a2M4+k!oLXR_e%%~R-%HA~iTWkuJ1;>5P+NALRYgbr zV9^w4$VVu(LYqn3dpTMk1D|=28dK>|$|3NOfsh|fce#7e$e%yXV8!4lk{tq!_5$hO zLEvQ$X@~CuksB~<(>5N3Np6QCa?WxI=Bg&2*a~rxw1XO-_pSaedn=_$01IlcrvQos zs_Iaqx7xY@cz3Q44#Q4VbgJ+*fdo51UjawAVz4$OWZ;nh=BWT^(K4JHv1TdaALAEh z=xoZWgt$AF8nNM4$J|-O`{kHFxYm~c?LvauddLve5^N#u?o)=x&`C>+Y2_oElOu1? z{;b;W0TGwGg6U7=U)yi7SHF!X)q&m+nvB8YS8Gp{E+Tr10kYBV5wfG-;XR(B0q}w653Q zTXLH)Fc)5HTQ7-rC_y0@jJ_h?WIy*L4Zw1G)b{F8qg)2AH{aC2UUzOO!n@8;5Ekm8 zR#L%U?BQwUQNJ)je+oS4Wy|({1Cadjpu$K{jlS`83o~No%+y*KXki;ep`K~qEr(3( z(_6F4^N8P#mq*5szX4i~Y`W8El@u~S^-T&F<>~FS)Mk3okRI6bXi>|J4esT1Jv}dR z)4+CNkOqQ`droa>h#P>*dRW8Wl>P%$z60@_3hK-EySIvc0MROlorXWBd%*aw{O4@q zWO{5ysV^Jt>jfI3AlLYm3~0TTz*w)i{UA*|yx-@}jQBI<`#)L5Sd%!V9QH%c>s5{xevK*LQ(2lHL$qmev^T}2kS-+0Btv^tsbC! zf3optCvT`bCky5r7+$=!6nI!LuVc&WA*?*xq7LU}9_XmEa>UzxX zLb?&!9?zyoq{gDvWRQqNm*MyKa7+1d8$JsDDt+R+kp%&-pQK-{Y7RQL;z;m1y$_9M zpibH>x_YhzmFj2jklJIaYq?6YA-yaR(VbyV_c>Sb-2ms*lFE1^qupY&!ZPrgd6PTO5cp%EUwnCUR!>>tjg!l zw?HQd%aKGLP)GadgTk^bQ}jUA z@k{lqmWEY`~ zMuFIz^?mHpnI+kjWfjVtQdbZ0Q9R=n>e=lGC(D5f42a)yL{wA7zRgN zD4o4D@KWy9L!6zmFPMORBk6rRu(D;d@{qOiRAuj&m3sQzTy>guN6vwHSw#QE^ZuC8 zH_7jN3Td+^)iUYfE}tbZUt3#z5_X^OXlToEjhwNUR1+%na%%q>^Nk=x{&1P{0Xqra zqO)p+k`)11lG<~eWBEXWa^8(0tCISL@&@&(A1S*r62h5ZS;ZpuUk5Ll^wwXTyhOR_ z1>V_gr)h({eAHImQ<^(Sqa@d*J)lp}oliijm{p9B8F-(zCEm2}r#4S=;r2l0GxjVWgK7VxY3#W2;b(x0ruu&=5Nje35o*iT+Hb>PFbl4NF`>m`TNWZuiG1$??; z`_Aj9O7-y%^1T@AoZ>GpE+zIInV)(n2<(p&QJ-8cDcxaBT5X{irP)mDgG zN*g{7l$44Rxu$xKvMAe65|YVYA-vz%bGlkmUjcFTefFE-N5`sv?A1(DqI{L6TJvj1 zXXeP0?VaKEJjjWW1V}>IFo!9rVm$WzPE5%ee``Xe)!@%> zhsJ<9>MbR_?23+T8@g~ktF7(6(hBP>fMKxnvb=;qFTqSh*$dU=UyoIJGRO=~7Ap}zH$KS>nO>ZuazTgO}qn|&Ki=A`^51BavzHdo)z`KDV5Xu zPb#aqgUXJdU=l+4-%hRK4p*!y{b&)%c{?V@4hhWvZ< zK=W~2RNqB+*xNU$H7!u)mIwI^xIAcl1P0Fx-Ku?|<>6KwN4uLcuv|m83{h$GZVfh8 zAXfxQfF;eGH}Q>W#;v@=mnlUQHrG&`xSspvDc+Knwi_&lanceCP;xalzPHd!0&mB- z>$za3T+!*+9#uF{_2D_uexP7%0J07lu6;~GqMtSIZM@iIdf|D3YT3JWdUkujYql++v0Qh2s`B;goh z9SC6b&a;@K#8Z#KZV=rPs9Q+xGu*fEL6PmIt9z>4R!Ld3_O{*wX)K#o4fK%<{>j@K z&F$K!!TwKEJ1uhm*w4MDTek%;f8kj6L3PG+U3II;{4|*K(RIuc-rw5(nH&d%8+@`U?&;z3jZa{2S7q%4nF0@jWUvpc$Qec;-{ciEc@Zqx_TA zT8SJwZdvQsnB;8C%6@W^DO**_oOt1vp+$n}s7#+1d|NzSeWqZ&^5D#Xvjpcw=Rh%a z%JMA9oX-mveDYfd?lBGHA8z#~aye(IhAf92JBsoi1C%kT2>W^a@iCoe6n?_b9X^z& zM(No{ctHjpZF{zs$}$EP8yRWQK%H z09IKkFOl9-eO{CzRPV9UTeFN~nuYh&kyK(P>bStgb3_et zIuns!IBa_6<$~o|ot1y=RHQRlHHc|2ntfmwHK)`-U7atlQb%2$d-iqh&T5EBJ4x%D zbYDSEnS3^%;k0W7xl;>L+lL*6lvSfG?F8H@X5 zkoMA1yTdDlz3wIb1>FYch#~7>wd3Xy*33gIsdw`g`CF!4=0>GR+1KYOpt+2wkfc0n zzySDIWBa+*EXcJ#p_kYks*6o`i4wbl{Unch*Pw<;1G`=oAJO23SW!oNvWVM)%R;={ zGF3!e_ z1J}ZYz2(Q(vT{|*)yHKEB!MDk?#sbZDlYjHzA!<(yyTSB znNRgX#(LSGxRVvKwSgg4bEzFj3q~o)Ja>ZV>&Gv)Eo6r&{XKazF|Q{`f0qM%MQ@VENleL7dr z_|(}f)8;~Xj+@vega;O^?GK0mj`|sGm8* z&l!-N=GaO?VcX>k;A*FUf0F_LU=39<{$l}_5Om=?*u#HS$nLA|wb5X2KTo`oqzWd9 ziq4(oX4y~WbvjhcJfoP`aOiL+_g=sdqK}Vt?+o-I_@?TKsGC*q(fRswhvBJhbw5jU zHE#qkM?=ecXyiyN4{zaCH=>PDXTkPVbH|`hZ!-+kw%d|Jv+hM|MdmlYEBl@nHDo6Q z%t=*jr@ONM7A8AmG8v}f?1t^**7qt|0JToo*0)9YjpS=fOdDr%!2uD%ipAJ7<-HIoJmkiwjRm@+Y0P{B)Sfyj!5<&9YD(#K|8#4xN6yatD$~h=@DX?D>h-KWMJN}il%rx_UIP`kq&7KV zD^0GrNRYbleQ#w`0EWi5YzlI<6b}SSQg?z=zHmlGtkvPS8n`n**>yl+lXPfiwfni^ zvdZNSmAeAB+Ri-YN!H$>Bpkr}M6ij~dc?GHv-2*G)DxF<#X@3NX@h|#|=W8tD(46-O-Ds zul;CBuIV>QpZi=?-}^D!u8ceM^gZ$OPUGuYwZK_{TT;@rpF43TU9=O# zH<+X}eovqo;o-0Rp|T@;)Mp+xd~#UYJ9Hc+%r<9IG>KpSpaP z36PqeJL2F%db>!hBX!@@6V+?ytPbW>JUC$b*N_L}Sgrex?p$$j4dLb=YjZagJx(P> zfNF99XvGR+lXebF(v0-Wx;uCt&@{QaoIH#e2L>XEhW(Jrsgvx+qoOv?gB z>bUPSsjIZjw(g-5x{5^r&V8K&{Y5vG73t2T9A)AhZmDV;@92y3u8?6(=C+OU4^ol0aniC{pq9L@3by-GVxwc_uV~kcXo3x-|nLD{_h;D|e0mt;l z`v<1?@ee%4(l)q0P77E${!0gh@CBFpp-C3yP8MtRh<}y$3@Hvuhpj&~(K7;8W?$=P zm(=SUAi0dcbCLtu#+_}LEsG&|7NWs6iSq-eqom!8_bn8;am_W!Q|b=?0{JsSRHv;}?JuaTBJ z@Mz*j6wvwEFW#)s%zm*VFJx`Yn|6h_e)b$K27;$Le-NzRgX*MfCo?=t&*BTcWRI~X z8t}@WT!Giv2zh!NQ(#Y!s}fD?bn^YEZ=^vq*fd~760@;a*`2knf_xJn3c7;Y&7dk| zP0FD*f$};cQN&#&*$ZQG?9{Ku=l-h-J&)*}T>j{g+)o9_WQPLq>1`AyDgJ=-(z$4R$%EiQlDzlp!Fa~dO_1)iIuAy zAz8Nm6m^2=Ih6JMh@wANl-EGDcNSS&Xb>&&Y|4fh)VI#$$drk?9lK6nUftn^mo)w8 zJBYBJYta8nnEAF!D&#J1BE;i&Mj)7py-Tg~n!*?2f|?da=XMr{H^|-Z|E8<#qPQTd zoV>;*uwKW>thFydCbi&I<*k*O z=fp~n<97LKV%AIOje=|I;0K-0d^pg%_h(`scD^3&65vZ4y<3(n?MQLt6}}bgYD3Pl z`8u$^d1G=*<=}!g={07ECwcYgp%9Gl6X-&WH7@ zg_XnhquwdzWo!o$%6(Q}l*u-oQOrKZb57-Bw4!T%J6yjq{rwH`QEuP)GK6p4j-7Q6 zL-w;sR$SO>JZOA+3&-vXIoQO%22+ci>8J$`_;;?8rI+0N@p&~>0?i5^ztfE9k#E_n z7+r8cX#GWVO1*Z7JjQAq4=T-aIk&Glg+Y-6eLk`-pKf|rpOUuo}9DL=d9pS5GKT&ghxL%EibvjLS{zJF@vOzPFa)@?Qc;x5K;MjQn_9$vFCV^=9 zL66#T*39Y*jK!1ZnvazXAT4^@)0UxuW&Ce6LFQ)O3RfI&}>V1gKKYzqH zn1JRP@CZ0ryz34vDj0aI)#)XK<3J-j=f9MTvOv1zGaQms8~>|*a0A_)RgC+EO^Il& zwoIuP_p`)KuNl8E!E^2!zl3AGW*kKIVk~f3rcPk`wja|sQV6#kXb6c=_zojNQg=WH zt6u{t!CkdM>e}POZuVt9%7@BP-u>t*3f6ceat8ng2rXfF;n?t$x>d9^_Zs#shHuvs zwZ2&0J;Eg}=cePpnBHNv^$dqz-Hcxfq>#msu)9JiPSQ7(-+``1 zQgl~HcJ>qSUS7%D#GW%azQ)+_SpB#CYNa7_x2*Db*WtJGwi8*G%YAnOCF#jacQul! z4e>~u1_QBZ8+D!|pztm69%qs@!QfGW$YRWu1H@dpGb=LjlcNF}x`TLaN)Gq;+I42Z zy3o=~!JvKXLyqg$B6X|sc&|PQX6tm^Bp%u;sVGzGzq-cFB~RJ?F`NWbin%ZPjZX!8 zE3vsYY-?Qygtx_X#kM&$A~tZqQJn7|dvCvW@EiU42 z9V=_SqE8N;GNN>h4CP3+bwlmFqWsIUHYu%qWm~Yl{Q?4aw)62MTh&qL-ClTw^xr;M zJ0*!BE3oo^aBht;0ap1-5Hjs0MrR#-EWbNFxXB0CJdK?vSrb}& zC0nYZC!evm99%fLYOqmTfTe5mbjF|pCQXZb4SAaWh`lAOJ^*7mK5!k|@AZOCFfrFo zJ8=f{VJC(KhIBQ5Y3|3`tRvreN&>jRyTX5=n3+3hH%3*Mm+h6v$2CxuGc|ESJJQj+V8x;0(o$V4tx+BgYndiX?uaKmCB?< zg&oCE9rj}q4P&Kc9o*<(qW(gsY1eKC#?7tb~GXNCiGr=Ur&(j0>>S z!{F@&^%f(rFfm$F_B7d2)+W#0$a|tl%=R!n`!d6IP>^8rst{AP0g{1h@9oLikKtrr zdnZnGXW*)6dt$h9+sWk*yfVJasbZwo)`9%;Mzq7YjS!*j^m}cGAhnV;&em(MXsiLg z4W>j?^?8N)Ha#ou>d| z4Y@7<_+)&0cwn?b!wsk}p<>lkDi3wMfBrJpckOm30uq{gq;mtzB8w?BDU`2}b1{OkkbxUZ6JL$)OEH<_E=GHZF0j~y=D5ai|b!nNT=4k(vITiscc ztaIGL1xCjJbXrF>O{C; zPG6Mq!Oq%zRaMJqHvHsm|+t+u1hp~~NiUv{9j&fG#!wrJj#b)q>#g7G+9o-Q3rEZN?q&LEHiS*T z=2|;+?hXpDJc)kjK2o%)yS^Fhku+|_?bhpvz_rxt?9+@$5-l2-1%EMsbf=<4UCu3g zJgR201$(Ucz|_kxi3WB?3tC4lL{-&jp~#1&02)*o(1hZSxYJ^!N}aD%2GuGB zqJbcx7mOp`K0Vuwr1Dih3B|&$% zN?TG`FP0Oy@aKRI#<3w~C8zP>xi32m#N&3pxYR81{I=Peeg0RMOG$3qVVI-m^Xu7E z(?!FzdkyzNf+`S*7IU`6;+P>&*q(ksrD^D7fOt07TB0xShE2e@5+RC639m)ESDr+? z?SYZEuAc`4+v7{-Sh{}xK;s61D7=-?yn|vba|!K%oyV zj&$Na(n;yHXaFK`b^h>JOQ>Fy^$1#&)lW6rM}naAzS~ZAU|O}xck4&1h1VthtJs!v z>*Cf|OUrtRYhCWzxoq2lo#?5{=X&?hMdU4TZ%?n+e{;o4{PYLbjqyWZx$u&G$_}?% zV&NWK`i*2D)0b|<0d4Pkq@C#z8{18eUqF(M6D;??a44be+y08yAuQ=7+(-TtW}j0(>R6fIe|! zVj*fKnl%H0^L|jRD$iN%#j$WAiiG7LP{>_W<2*RCT5rqy-W=D-a|It4+1nMXFdxOL z6~VewyOFJf(6$-~-SCgk9{3+0v1@Ykr@ddTza}+lbK_0*yy)AsRf@om^Q6d0NZz_j z;b{SepUqf+zrRtJhd)^)O z*#I8}N!dea-$!VnN-mlbG5NCWjz!B5-DyK37U5bQ99-Rtj|EJ@`PlxoAZ=hQrxY$D ziK6=Rfq1E20dM=l++5oRL~a%85_N>}75TZ~(pi>WM#~3Y@0zT%mE`KPY?}QT8P4`n*y7MVvQ-K72I9svF^4?LeeG8{0kM;!jb1SrMBM z-;I17Ngf~dZ#JsEypU^WJR0e)1F=&_7;#Vu+97j(i}^T!U#YO-0u31(W6d%ljYZbn+rWv+woY@4+AEZ^sExaP;BG1ZZ%tU!%DdGL*wk` z)lz4rP(efpU)uXM`oel-=I8mW^@poE5q0n%VULgDsccn(@bXCJf+g0zwq5ZK^Qy*# z)Q;t0HLxm|8{ujtbAJRjWFe3pJr8)>*hxZTRm@I03Ac1vB^8?PeCw^%Q*}R$>)_oXO zCZNb$M23u@Bgge1)@EZ;B0JLP=4C@~>)7`tXqPyV^ciF3W%z5cLC+ zhYqz9+(OVOSA=){Teba9iiQnM3@g?|x8`sxYDL%}2+fwjNM$c}C&-nC-$nSd2>)?k zr{x&r!-1BYo0a6OOi~RequL33K?Hm>=>S^O1a0R@n{YerG>a>*R{J%d@Hhg3lO@Th zI+Vwa$;!H^-lZ}|r~(nRMIBk%LVm%Xh+E$|QE2rZ_XHZ+Agvy)L`%wAsUO!$8j_wZ z5S74);ZRhKT^pd|ztt-+VDZ2N^eAxIxZMQ2BUy${=oo^g>O$|SEtq}m@p$}0y2Z85 zFZ5cTo%G3b6ruPCYgFIT_Gzb1i{Q7zRZ55qG3SM8$YD^%ZNmT;6-|x4yCg$2UzfIW zQ_7}|acf~$vBZS_z`?>JkrF2CoU!s^fc&tJHt}H8O>?Ade1~YH!n_=l+2X_j__Jww zi0#|pq`Z^b_#72)x&K7k%ZK{{aJqa-kyszem_9iM@`E+UX|r{|O4asx|V-G&Za!l{|YU8_XT zF@#)*{0N80kIsA?M`WVM5rOaS3(V|IA9vgGy?4>1c;*``Pp~y1!d^~22iMRmJ8kqb zS~Hpm_aV3p$&P+q1DVv1ZY5pR)=3lvKRZ#aFvzw03GKsiPiF4zFcd}@xVksH;-dt< zW2>b+uAtZdYN-aHdFz)Q32BSTp~sfua;t?+*KIRIEKC+-UOkbRS5#GWV!8O~DS>z1 zjSrPw-*y%HE?#c=JZu+ByipRK{)Slm^B#qd3<_w_y;Dg!CMt{|V(rBxlp_%3IrRwTgO|x6@@u{>rLXyxucB{|)46#1J-C!eAEt{0pmSiT4e<5l@TLR+ zv#Ms|Q3sMLIs__Frp^sM_!#&@R#G|;BknlgimIr1coLgw|8rkSX3lx9Yg)MV|E2&1 zouc<8ZU}zkKuZYH61@42C|A}Z(VlNvSSDSm_b%sdYEJU_vVD$Cf=2bcqAHK&IM)bIIPATz70YZPZX_=Luj#6mJmOPyoX>sD!dSQ)y^`@_Q!LRy)#eP z)RaFVA;$FL@}m6sKI+MCyK?O-f4La^r3q?Y)HI%BWfNzDI0~X_M5HB{v%himZEM>yd~t1ipFY|C_CHhgiA9&yP%8 zOqv$nyhtzU-0zb^2t;}UMy`4^3GozI!B7^pWveY4<3sq_BJ4!U9)> zw(QMn8Wbkoq9k90US3q253bp7KP<*|MR>)4Pe5f5mI5)nMzZu{%1s)v*u|1de(?2v zzsIO}Ckp#x?oGO{?x|wGd&z##4x>?x;Ox+Q7Cljf%}YS5v$v1M2VoNZVu8G3O$?$P zOo zF|(k2wOh*f$pHAwfqIeEA(9ESj0^{lzzNVvZbNwkJ?^uARRIu(YHY--d4|LBLf{3} z^Crh%6Prc0@?L-Guu)QrPdyruIV?$E5V2y&qF51{++T&@>l%*87q|Io^GfQJc{w$5 zF*~?X?+I?TxS2X{KkZ#4e~CU6T7Ugp)>vhTCQe5iqGPoYi5wa>0y3DzfclWcN8*_M z5U&m^Ka`e!;yKP9$n5IwaK6B|uK-uqau(b9{wiPEmw~q;YCkIB=^mwpM@d~(8eY2= zq)wn2O@vF%j9zlok7LnX3=!)3dv^P&n6U#nxy7urI(@TcvHE#oBU*hOj3c<@;o z0a%j`<>3;7phI!ERzJ^UIhpwK3{<}ScgXYKkL<+KBaW0%bvTSb7`Lb+EjmF~UU*Q7 z5B%>ZdGHuf47}>!EJ$SA#%!S%=BoANP4*nVv0GW`yTa&~a6b$hfNsHm+0r;%QsxWG44a-{tE=`WJsXQ z;68J1u!Cb9=nG1^=p)|&`X*Sgg3w4WPC8pX9$0)`2 z>w`4WW3ek2AAIdg@E$A*Mwv>vH4a^_?&8qXzc0Qic@wBXK)JiaJh5E%>s-YN6^cgX z0;mg@$u%584$(DvVU$XRn=RFB^$X<7pYIF4#n;zCj4h;|S22jINUPGl1uudg4L}}y zN3U`eta3Zy5}A(LD*UD4V4-8vrt3CCtboP~3Tv_3o4usXi|01X2 zfZDaqPg)7*mF#^GB4?n09A$wsI0c(d+!~|gg(m9=3&LsAy0pJu4P_I=fj=9ob5H{Y zK7Aa`s!?Qn2=u66p@QIvMa}7yP&YBW zWso}n{9EYHJ2!-M)5O(BjFBUe8JS2F6$i z^a#f2oo^{x213s=tEjPIG zycC_uR*P$e{qY^qj(#e$8H6r=kc_^fuMMR9pMyD9R*kF)R=ZOLis+s>UwI>f8D3(n zIp3nu4WolwuUr2K36t%9p*x4+6==#rwNU7{GhHDNY6XJ?M6l)HViRVb6k#3)v zg0cCzUlng$Cv8P!uu%}>yaFMD79cJcQIwEw#$xdq0V)IXA|O01h79T5IeO3(f^s10 zNOxIQ+AnM<%c5NG5HNCdLynz0iVJzyS5(AVObFj_i!&f7-R*@=zhyL+|VMZhBRZ9G-;V%3;?!?a~?sb$$t1(a2 zZu*glIJkTu*9*DW8}Yu2AN>*~h29$e;W7DeWMoFnPdo*=Bb2uJ)IVLi9qf7UhJ;kaiMTt^zo*bYl|MgM$Oau}Ax6 z2DNS$j=C8Em|^9^23jm_)mce_ueZK;SeqrD(RNJ~Jpx_m4n(4iSO`diYEU#+8v!7; zGg_ffA-MHPdgmcj04=;Lpem@x?YKBIOzYU^NITH?Hg;gE`OU2Rx9E2RVt%L{5?~X5 zvwqPTzE$c^Dbf$O5a~Vo6gr1eUaUHoy*v_!2nhM(9 z0?&{eRbZTy1ti@k+WKgOL-iB_Ucdmxy@fIUraXYk@iNKUnp0rDtSg=?0xZCmp$0@H z?t=;}@Db@4cP@RZlCJ5x@WxRjE06wt6X-&0|07t0EDF>;2ErIOuDW9JeIeCJjz`t( zV!(VXpuBWMOnnBzuKz)g@`|BgpJx8I?+jScM=doI<NnFaAS7+msXC11)$yzZEE+PwVmySI@8^d;q30fw2hqQ1&GLWA2XYq9=14T(n zz!d41=)O}}`t9n3vh!)U;>GC~K-ptXEA{qmPqM3c$^A@g$fw$5%;3A27^QVk6B>R zFGhgGkrUrl2v5EF^%u8(IE}@Pxh{Q#ZOM~b5d<=TWh+i_KJp8`)FK(6^v z>jSXk``!K@hq0D{YcCFL<=Q=H({yONztyeF!Ch7M%Jk$eCFoB7l!M*~N+^x^LXJ+- zOzQSM*3r;{MaEo)Bb%>Q&eD)-dFQ{ZALdM2jM{Sr3U__w&z_gJ$#D#JIK!xOlX z3cpB20!?~I7j`>ox3fEHodV|&3~OK$1dZzaP*Jw-y6cfn>a#Ensk#5tV(PspW);i` z5_|tkJvjYx-v$HU>yh8KZ%ZwT@EEp6igl6ep~as7V8tJksXp%3IF|^ z*8;uuf0z;AoQGlUICL@RgSp_9m}&Bm>p)(KtU!~t(W-|=x-GdLlWZ6;smeoaUl!K~ z3DOv_0D@@%L3NN49VZQz-5WcU#@l=1Iu;rTN*?87s0oaqB9+%fcDQ{#@^mA)ym)2= zaIj!S{!_SNu_Pn+;LnV3TpNM|K90B?8Sml48tQ=0+>$HR*u!f-X||EsZ>G57sFPFF z`HTuEe!p1>h`k-){l81(n8Fmg58nUh6JW0Jkggo&Qqff8K3UWB2pz|SYDN_tmk4tI zSP{7V^ngbmXb695i>!TAh4cOkCa+g!)=P4VzSI7ksdrpx3GtU*Q!|wW>$Gr(b4QG^ z2YYng9}Q!a1NhwA3hAUz%{v3O5PHO5bqYQSV4(JU5J21z&_45uW-_96VK9k}0ab&C zoU!|70u!*0mPKP1BHhZ~m?+uz?K|OYeU%iId*_oz(}nZOfF3WpV`yw;*2&z?vDElu zYEetVb5&j?e$aa|f#{^>M~MnGaODO4FB5mYD4a`!R{j2F2%N;;9`;i?d0x@UtwZ4R zdk45KlaUiSCVWu;fWiBh7~?-Q`G^Gy0+VUbK!s8TzykCvi$ie*!^}17{h~k{Rac@5 z0v~)&e3#Nqh7D32e~#MD7j~NO#;(wW=WO~@?ZH{#|K0AZYk;31Sn8Vn2n=bh8Rd(2 zM!4UHdaA82M$yJ+`g{X^kyypiX$zdSpTyz}lHUM?1K2!*RDz+kucmB@o)2^@zkB<| zPaX*x?(w`^aB#u3dPa+uws3Lon4AOsAeV{s%=l!ms0iw(#{2%rlBFXU+^qYTg)%hu z2x1At7^~O`R`Kd}s(~CHQ(Zz@9DuF-w&lVlQm}WXhlPt=rY9+ZFCESdmuLLdvj16J z?N?e7zyWZ)0bQ@4Z4BqYD>}o|69MrrlTE~?qxx?%dKe}Kv@ZwlBB&E2Y^n(zsjJcX z3?6a4KP5$5i)57?HS;Q_@YM{qWL`g>=S=fC*bE{F@oIp&(53O4LkMvHdJ8XN#>s~o zP^mSUQ6FisI8a{k70GuF8qf4Rs-%1LN`>Nc?dU2b>cLdTdXdr2;{fYde|_dHRA)e> z8Soj>#UqZY;8?=0T}L&MKFK+jK2#@?y4h*gv9%S=_@;OHa0$o|=bkNEH6q4#D|J_| zMmEWhxM9MLo)l+z-#r4OLB974n@#WrNmzzqG?eK_b>2O>Tp7MToZKsmG%~8_u-mo< zuS^-T<|H?J^GYe*#y|WH?y`c2ckKq~#3z40wo7>Z;@%Ny^%o&~)Ls}4{Y87>Ep)oe z=y~z-wwPW71$DS>2KE zq0{C%k_oJvE$N5+FJ=4#W-|@N@oh|k$?D?VU6`7xxWv`hl_Ra@aXE;lhIx5$V_bf3 zmv+k2_K|-2>!7bNcZI1LQj)a#JIM`CJ9jE4e$fp1jv6@v`mBZ!=Mq84fWWHAI|AJe ztfE;(cj)7!DaO*XNrI2_C|FBH7k6bqBCe8nBk6bY)}7Ra^{w`)Md#sPng4RCdwa&_ zywUkG{c=UgstwqJl&(UDysko46yX7=&5}Nqt98NXHtjuUjK_KfJAWKlnR(_&7QThk|f}kgAc-IeEh^{GQpW_Gb`wI z{sVTKU(+GPH%W#YF4+q8mvL{@ad9dxGZL5$A2m`#S$k&=exQ%TidFeUJht=pMD>26 z$2*tS^dvKs1lBEvg2T{{pxP(~hybH2960bN!J*K#AaDX4=;th;7C(57J6(Zo?i%hU zgda+8_Z?7lx@?K!I?Auyi1Ih?Z~4iEa3qj+ybV0>;_d)^_QDP$!Gc)*?prjs1JiBc zn{YOVpEP!|{1qILuT&Y^^{=3(o#S|cb^Ia}!%2ZGsim|266 z6;#c*Amh@G8p7F(mT2^u{HK6pscd!v6i6C4G@nw(lyTb_90#4fTD|5Xw>;JvRT0^k#`AC{^31@ zH1RmqM1I}mQs!p1Kg}b;hX7>a2;wYzWkL6xzX6dl`)tU$@K&d?ZDBE*DyVNsOVy`0 zPNSFJemloxT@|$ZCYSz~KJyjNJ0#*{_S6^uK$N|J|wI<4Bk=$yNJBxPhId zXIyB&-%df?n4zPGbzvtMF+4y3ifU()SQ+CTF(ny+5pyNifBK=2{xTwGp@R>HnWrYdvB4e;Q8k9uAmNw#ttBJa{Y4{Myh8PI~}$O5UK)iXANU;Xp+I#8UpDae{qM!V*Rv1SGATzT)yB(8L{?ZT+BHA*q6jdK9{}K`;I*i7 zxuTm(pR}MDPoEp0H1F8#237M9=KvX;il*w&Rm|U?P}JJGplfW|L(e%&FB~rwu~n?w zZTq+s4<1`=|8)5MgOna~vLhht$G7q%I6uKs6CWmN^SuV_98WUSvb-*L^5WiSE&;{Ch*hvJJ236h%I2Ob-dyth*i z7>$1#)k<}JZ5@Qt>Q2(r2YrJtBzYiv7oR0U56D^PEKToqN!B){N%<;j#V>~*r#4FJ9ne$HY={WGXeC>^AS6om}^3;GZ1n*AZY zbhXOJ6sq!A_2!rSeeVGJ*YZTTAqejkD~5X9!Hq=My@-9h)@fjia4lP;6(J6H==xy? zbUyn@_@1JO)_r=)V>b<7GFFSv;)c>F&vD1>k!7Q*oFob_r0xE^R{Ld~DrYRNH&3pJ z3%&ZzPmo3@wgK-k8RqY%lvV#azBq(0xZGP0_i@X zN+X~2L~DaI97f>>Z*Be1N{(rbP?Q?Sk^K$_QGOdpUlfAbh)r{@#_?i>VOZldv(5&4hGQ^La~3H(HUDElfWj@B zpnbmaz_!$frlsW>j{r)hn-XbW-Loob8C(B?# zG9gcYJVNn-Ei&Mo$fy8f<6+v3ZwHHBd?OWM4O-rXqF9?heYS#075ha0|6CDLnEaP@ zi}t>M`BJC#Acu!yPERN+sR^JkhA|%UOtys()gC(2CoS`6{g2or-N@1FD*0hAh6c#r zU9<#VBp)IX3V$12FIC)4r2P}naBU*B(Fx~C*1>S*{btKO{}Zi{#du|U zhmnnf^b6Dja_W&i;y^2hVsH*o6$hsp#$r|;s3&iigemtQ9MS)GRcJ%$<6-MR$DL+l z>z&CZ4;0-13Y>kLqhbnq6wfp!Q{-Oyvg18EvoY#2dYc%?J`Bppl8jNPkx`Bv6MChU zlQK)cGVKz`khJ}Bo|4jU?vG>24}sM>k8*$kdpBC zubS^fCyIF#4L%M0!KoxO1hF8CDHaGcL5{FwkgTBjT>8XV*l<_TWbXR~TdbS@xG!HX zy#wNQkhazBZ!Sa#W%)R4Qoz&s&Ef2^ITUpHgDL8ANz2i3~0Yt+8u_gfimayQ-J(=~g|pIzaU`d6FEg3)UoU?KV2Hlu)&dmzis`m zl>tipFISS*XV5yp7oiv|tV6Y7CQg2Z?QSQC&uOJu+zMml9>6l5GtV~h%tjH!QR`U` zI=*^?XE|iP9RB5{DQkY`G_nt4o}6!I#pbp`U#co`pdv!aX}s0Vh!bgd&>;Zo>^U$f z?*VEH@Z90bqua105)gNSF&snin8RcLiQH58e9I5(!HTKSX_w)b18!72s`gLqH%=?? z$ck%5p7wvL3;qU!gg<+RI8_}j@zY>BI~j9VWI3XA)vwhI|}AuUs>4Z`WORP{F>r$yv}6 zJ!?`IX%pvUZ!x^g!Q2VP>+jTLgdY?@AxF4@!{QPO!46s#rN>TFQa`3Ym->6(`0%P5 z8prI4k70h6SaJEN0@Y@3nHNR!zHdEQ9r(K>tKNa2Kl|Um zK%pXO#ETqIBzxrz40wpCbASA!g^XD`Zot)fFPZ?t+wZ~Ai`cz7I05Da=g^AVY8xHY zR#%X{D9nt`>@}P{MmHx^Or&ym&0R4QF?=4!0lx1gl9>IwbcCE0`2J%>i;_m39vf=hLGwE1l%L9`5Ue34t}z_%w|ibe4t)w^!kCaI~xLT zdi?yfD!$Bakp%Q_&=5KeFc?`t%37Q9q5^w~KdB=ZiXg`ohF>%R&s!o2ltj>!k- z-&t_RMk)tag`lDH1M^WHUsXwx%D*D*=}GT3WrLT}Cjgib1@}s%`$VzN-xv{+l>kKm zeco%d4?ZO^ut4ooURa^evA4edN7k`hu%KXU5nIm1`*V>{KZ~ba?Znt*ub%t6%wh|?94ntCQM=~ zkE6-lGhWK)^6a!q+ZvOOC_>I3Idwd8G%0EJwfDQ?y*=I=A%=f})7= z`(bPgECGAtKB*U^vo_9?UlfO_O!*=xwwt(&B!P|;ZIAKs={6H4sT9`<6Yn)s*Z^dW z_@C%Q=sSZXkBDJ5JX`T<%vSJ8s~@W2IH;uD)i}k=cyhIXC7yt(}JerVu4F00rb56+a#gjrBR(oxu+;?yD8AkTGQ=1oN@NXnK*_a! zq4lv~FO_E0PT|n$0woj|_)tGx-63*DK5Mm(NBWN2E`4WJrmQ!|78Tp!v(k8Yz$=i@ z5#?f)Pm$ux9?WM;aT)kxRyjIZF8g;;yHp<--S4I^o)bfAG;RrR@V`!V>=vGJ+|EHi zYkMQa?pE_zl@FU|n^L#_7>za!4tEp$751FIjv$11nE@Q&jONN99|KW4igGOP)kU_g zmeiT1&Cf|iO@jh_7+F%({=}G>DUaC^$9!7Wkj~R_>zP`W;P#h41V==bZY9mXsAPZ( z4=yF{kV**Yd~Ubpu@cwJ`vLbI{yA_=$DA|gPDaJ1#YD?dn1q4MoJq-~TYaVyKH$qX zi+uT>?R0s($!+N8-Dwjt2S^ZbUd=BDj0_1vkev4*d<23JuN-uO_T67fkUaCV*6Xoj zU?nnw{;y}N_j{1}cfAm-cZXwS%(cktm|UncrM1TU!O0?f$VbKK@MpnU4gYo#_tpLo zDgw-M#z78GCivT~g0>wwc+jzTG0l4DDja9EJLtnYEe#y>H1_=VYlT7EO;F z%bpunYoAr#JL2gy!jd%--M#s}sShj~Q5rKO46fE65|^wo*(*yp@OhGsogg*@Iu}iGknrEFCYr5(tWnrC>~Vr7mNoSSx#M%G z>o`W*c{*^^i8cCZ0*xKyoNeq7wYKw4=y9B+-prj;rMRvfg>>%>zUjzSyp1b+72)rN zV$$OwjI2p}6`*)XPh!8yj^QU46hrx8;K23M26V(*=|(PJI;16t;(oV1?4nekdf1m- zQ&7&%n%XC-hdNf19*vvuoP`A5eT1`y1Y3iyhC^U|(2N{yw_Z9Hak&J&pecucBi$2U zIM`|V6X`r)dZb5Nnm|KbhZ~d9`FX*LHh9b!791Sr)ts}2-*Mr2!0nie6ZU^v2%m35GK9Aw zw_p3V12d1fUc_;q<@d!ZR_W9#pWA4-@ry?bz4EYOTWZ8gZ|sN?nVEMFUs4CxMn1^A(YY4L!glZk7J)ZUv` zHWH$ZIYOL=8x9eDwZHt_p_xXDd0miT3S2x=4b_b;;=}l)?ZxTq5Yu#T(oL8AM<;ce zY}+s;gYUp)N#x5;ytMC-(0kR9EjSx_q*E*z;w3n)8Ke93336(FiYWaCwDor>pX{j@ zzR;ZYmF5ltbu+;)hu&3qOXufT%Gb_y13ST>CKe2z@?@&5h$nMIqzRRV>N}s1d^_JQ z@X)ax9k`o!a~iydGqwzPa3F46GsiC}^{?!Py#b=WSbTQ#iEax3L;LhVOhK@7oX|n- zFGs>EODEvx!yZuYa~>CXQfQzT=BsX_8%hmQFqGJ#G5@&YQkw&alge8=4SXDw7O$mAMa{^(FtJLL^4 ziLul}dix4JW1nQ@f3A?+sx_`RT_8o&yn>+1d=&7nhpIkq zHQn7jPbuo+xcMIFRAKOpupSbJi>oZZ>u@%fbQNR7m4rxG*9uBn;rdCiyc4t)AC3?# zw0T?GL1}zWdOU)h<5;blyuDI&lB%X9Q=_$!A{HdF8p7h-R{j;M9`7JPbVhWII9jtf zZ@{}|23M(b!8T_f(sM4mwI$edSZMuR{n6%S4@AK;sBCUH9xKZ;ZOdL@x$i($ig7Hv z?!yLd;R9I7jhY4OxsN54=LWaituIY`PHWZ|*Qh70drNrQy}2tdv;GO;>x6wqohwqG zqVz3ozSckQAg}ObrV7oaM79?i(|R^+SL-^d%A>#|O6X^U?@V+4S6`9wo~GBb_%+)q zfw7<1#U3oM{wO+$TtisSC~U7e3M%kTF z9g+QkB7KjnVU#7Ga-%0pHWG;U#KS5D=>oUNMj4a-&6&0Wyo!HKb)Eka^=nIaEKEs! z6`nCK|23Uwg_@1ecL+A2u)m2I?@k{kvB@!7b$)PGX*c6Kju{Y}W!t$1ld-N0u@u^< z;hZK5SUc#Ee&sfq=;A35IvE(@rLm}W1+7R5oJW^mAAUz7)vBp)9oqZ#LK#fxM_Lqo z&f>mER~MHWKTucM6j-|P8u3kx65NSPb{yGAE1d+C8#`N&adhCyN59587r}o$u+__C zuJa+9Cd&NHT-+wpvQu7jF!#7!>-Ea}06_5JDo4)owdB|m@*Obc)Z@L;`bkAgIdHn< zL>x_R_Ev=&5V720>oE~Kupg31zS!XeLlD8E5c@Edh9JSl6)T>Ww}Uv^_+YM=F^ zEz&|%t9y3M`H!@&HTd{oui6JNZNqJR1SnZ|5fb;Qni*y_zQny5;rEwIJ#CE7 z=TOn^tu)0mS4WYh8l!4567ux*z-o0qOH1d^w}3nMc_g85g6k$~lOz4uSJJib-H(D2 z0!tR-q^mM~q6i(nw#Vj!aitHnvdYpp!`h(BF#1pxuNIdMJ&&$fQ+j z4wm%!StH06CM8)q)HnkBU>Y+5h-y+U5`m;dZrEq$3 z&U3Mq^SCf*`n#e@|ElZ5;?KkSz3oQ-xNRok2c#UeWXBPPype!kh=vM46_As`3V)v} z=`P*11+V@^dr1oxt(LGx6-O&tjy;M>s?@2eYtLNXi)ObX|NM}tc+f5XPK#C*ClQQQ%2&`#LoZj+f&)8lXQ$B@QG4v~0pym6Z~VWd#mtN) zOHk;;Zjel880x2<_aC2Bw?C)_Uun;#p0BnB6*=uCKArJ{j_o)Ft0Kkpbc1C89a2DC zO`=my+a7zu*T>lZTIRK2!rb7!D3)2=9ufyW*++oioyR<22D``Hyg_Y5L%eL9AL{#g zehB5te&cZg>dFMgRe0b43Mhh+;%8r3K74)Y{8bNdW4y}lg6vuU31#?20XI z{%1x%@$f9r%MI#|6X3Tb31}XhQe`Lz&1xy7fi zj`)}224O^8^yA(U{qsk!pO`;8Zww{3M_j(+&;Xen4g1y1)_4 zOi3E8+4x-BkkpKIp74>_+|hVAl+LIR;;=OyTZR@%eSO2&XxuGw9fE4BVssaOr9Md` zcHp_oATLCO#*1BSx!#09g>M8zy?8@af2JlkRhnnr=Nk4R(Lrk zNT=#7{-kLqo!ErCEmY|BE!M+!GDvjO`=xi`YWR;#`L6vRczEiA^5O;s%<#=Mk3!-gGQZHZt^AZk^X`#0B$$a)e^;x_Dd*PcXzHFNe_>+yfjN^BXR zf=47_&t*%m_wxcUoVgpK9t?5r%=Fwk47#mZ|3Ls`@&OyKL$f|J`DbaMfqhr@7M>L$ z(CYFt$AuYzRwtg5>^53o4wwABS?R5EemV-h+Aa_=fv4NQdCbSFsd;f-ZcUT~A z{)W631vC&4tCT0zvk3MEMcRnTR&QH-F{REO#C;;3urW}2%&1cpmiZzvvUZh$i~c&s z);I`#4V0q-=(s&!yF5ii#8BgA46verU9JW;|6VuA8Wl;(Pia2?vsA~S-2$~=?1OQA zRstl@%u^f%ue8uOzB5(TP$(y5`|o=Sciw7G0v%;m&AOC z?R6G~vkEKft)$Pp2fA%{E5D4GH&Eozx9AH$+OEd^i#+D_dUVihI$$C=I>GyEUCLhw zS5cdDvoo%~i8SF_zbl-+CJizzp7u6-quC?B`0=}Iob;`N-5mrHmWmqRF8#EEJe@sI zMZZDD0gX?6cK_ocUbc!d-*#IcvmxoTZ)8Z?jGq1gw8tu$@n+ywBRkmbGF=_(Mr^J@ z1KeeAY&2IRUArUBm(eM5InBLa(AHl2(Mo z-&5yiHG+V;6Zza=cdNSR%B&qDv1XdNOdGUGvGG-$;^9Z5PFqaxW@S*H;@;dNczzTd z#$1nD!fNb4R%)&OoH~J5Bk#NNcviJ*qYT!+of7-iF!%XY?TP2R&hqr=vp5r|Xo2U& zH49?#dy8v;^31sbO)r;9Zvk78hn5TNm-1skz9mzV1sd2n_hk!B6P;d40LcB?j)L52 z=&@#58Dk}v^I%wAB4MzNva{fm9DKiz4-w>q>s}UySy{!|8O!vBizbP{a%wak3n%2Em6sL2bsanjVL(ti+MrF zKoIVv7yNK?zDF+7wL2_xI2`|t0y*OE@)z$-bD;3pT_oQaa#yI3>ihj@JLXoAy|2iD z&Nx05K!+~4X=rKjL2~AGLV5 z30X&9&i=|W{>{Y<+W_(*q(m%SLk!2BFAcQ`7?*3V_R0A zQ4cX!J|AkKdrfXrZj*rwTn=L#!+aa8HFI-RR|mTfN-HE5_<~9|sxK!|$iGyH$w7Wm zpSIroIvjnvFJrTV1~jyRXr$<@M72Y;)X)X0fl~8>5!Tomi_+& zM*ckKflVnlF#4WbiKr=s+sj4hLnZ?L+rTS)EomUIvSq z>oaR*XODNI$|`2DEZLNPF4B=T4vjb;8n-LqD9^lk&XEaWq(`Xx$bzR=MvR=r{i%{c z`h^;p5UHS=r2tQ~evA;YD)dVCjM}c)R>Q|Vdt4;xqppUY%v2{7$x@GH=(A@F?>nTZ zz(pJl1D^S4qp!%c|9hCX&0w%+15&teNkd82?0U@*`#zCttq5WUwO0wxZ!~QJ0MceJ zblw8m_4mrVF$J09one=5DJrD0N6yyhDV(qoBT7%BiS%YA`gZkrl4AR&#K9VLB;d_4 zMF=i2Y39Fqy(3_0X+8Xe7hXrWXfw#chkTP=PCmuE;Q__`lCC;WCj@L=IN#Ea_upLZ zJ!Pq1dZ&ZQ8vXwXL zv`@+dV%?=a+Ql|GItnIakj9Q<;5s+b1SHes(=X@8By3z3Nmn`7o)7D%JSWVMLdF;l zmBW>EvxaMFEr|u^re^iI%}dpxFK#vmsJQ=cl6jtXr=TCe?+o9qENPZe^G!`56 z$Zx(NM}_09qof#ffjJ;nSiz(w?u-3V8v0#F11t&D!vD1o{n{(Qt4GGiC_<%)9T(&Q z-PkIi=}LA$@KXuJxHkb`YZr-g@cxg`=f4-4@9fA1)xrPGX9X1lpvnA;&k7P5@OP$5 z|AWE1Wg=C5`vNA{>#{%DFs6nE1M1GM`2s@65vrn{7kz+EerP_za$SP6p1r`vsnrvT zPv~FV_H5coYKo;CV@(>6jR$b~*Gk}VyB6eSyc%W{-rsF_AS`U7(35_1O=nbxC!k?I zRq0E22c;f&$(HWhQ^g1E}C{RlD{j#>9`Q)8_9#-L)1(RMkS5w>nt0J-FF?JIC zU*8j12bQSKMcepzo=z;~=>oRg?y-%Xq9~Gg3nfRVY>|662RFO6iXQE#X?V8Pn}r{i zoZkq5R+Z?)a(@8}1DKoPZk|>+mv!aEx#Le6pnR=jKWB8|M3zN@u+j%fz4G{4_CJNu;zo$k(iO_U1Q;syD02GQ-F6`E|(@0RSoY==g2IWM(!gI$H48--h z2i%fnWh^^P3@YUfg>zHkt)8<_b|u2cUAonJpWKcg3i7SP!nXVeB3QNT&jMaEDcEqIl48{K-4pgIaHEZ%>HITB;Hc-;t0? zR}@FMf7h(j?Lc?wO$J1#&f1RKP^2aUuGZD;+ygsm|M$1y^2*liHN;2#|7#*2@-L0Z zKy}i$klO8A(>DeW0X3)<|9hWGnelfZYcn|4M1YSP#ZAvf5>4Pzpeg1$YK9t z6$Aaj)W5t|lGM`xqbJV#_`75?1qN!_uC04?!nE~2Vv%xmq+h0mqu-EKFgmO zztyM@y#HhB8?^SX@}+8gy5z>Mh~*M~e90N+M8}_1Y&+^Q9_dFIgMk%lqZnL6ij1kC z0ZXgDcA$1%6(LA5fl_Atg2JgfI6K%-EKLtc7nIUByQTB)HBJ551yCEKW~n~z9b`dA zB*JqEON<@kKi6h`+oFrU6zH$Taj}|mPyAi`z1D#t7SziWW(|F}zv36dQgE5Mh|AqgKlM7@GgEabr~K1okNUn}ieUH6l^}A+ zli;EvPffKsUs0EizT4Ei1il;m9t3tO2^TKCKBizfoe4G9GVwRKcSJPRolDjn-boRC zW$TRido--fV-U5TxG@s0D%TV=&74#Q>VOICa^e%so^`mQwl@X=M!J$w`zGnt4OxRC zPLv*7wYqHV!Oij&yC>sJyoDQP^~ko1L^+JKMc#lB1og z`_B=TZx#D40(@#`ZUYQ+`K3qG&TUtYf5JQ&W*Cr=)b0!npHam^HU#Tso_O1)J!5o4oY60&7G$Kc5B+uX)tZ8wt<1 za5KKrA0*z==cZDUJHb^rb8(!%u)6YM4gZgiR{SDMNWN9VEscly;fb8i8B5Ed5GQuR z_BRW~n^Akdh^F<`|8zA`B*B_n9j^KE?D`^T3BQR|M0HH;T1yUaISU;7@pmkzEUk_4hT-+ zTu(B*+v}vDb$P!C)cem}87b=*{T%OJk?tGPi>+&c+G0lnx4T`=6w=c!A<6J4xK78v zayG$4rc952*Aoz#JsdqQnhqZ)i^Z zVi=2?>Xu&kTYLpBa3lCkAzXus(;V2i^s#!*=qi z34e1Jb_z_7r?WmHiiai=9F_}L%j-RCpXEFCP{%}G^~*u<1;jABPt=(x@9Jdw(NuDM z46|eX*h}jb?H+mYQgH$Gi3Mu`{1ZveyuZK_ADiYVZeP2%?s`x(A^wR4*l;}bb9&(P926uKRt3JD{{1T zsWS}s$ZC5g(UiJg60ClL@bj+AWZc`xdlHdKi8|nmMJV)^Z1&}TV+WxxX5vRcLlTJE z03KWjl9e608@wcwcNV;A3|@NOmS=JvVi~ar;p9T{@*)k76z)&Q_|8Q~-HX%KgtdHD zHTCY2qT1VOXRIet8GGpoclk_bIM1V#gC=ApWe)TeDEIX{>Py~5Z-$X%p?31Fh;lar z^G(ebP0I;ugjeM*ShvvO2K0E~-IS=)T97B+Dr1t6eSRDqgu>4cv|O2TL}=j}?+_wrlUSX@s{?)(@>t{TO$qb{d+$ptT|5mhXpKY-<8{2L<)ndEE z8*+0jx{LVm(dxsbkw))&H%S>tU(@5ms~1PUc!)_TJmJDq-fAy?P*7!EMkp_?P2o=h zS%nGJ6;R$>z@0oD)$~W_Vr+>RH1VRk&w3YX`7tdmLw`9`_uVsC3uFUi!$s19)U-dI}LNDm>lE8j<@aWDl-1N$*E_ca2s+8@FOSG=9bh~%n zPVRT~m*Z&fxMv zSY>y!LD-(=^K#{>F>gplTYX5(MWsX*aI1DB`42$$U`-N3ScF(^$+F&-6?}?J-+j)bZTu5- z&R;pAP$e+%2p4))^UlIWc6V_Fu_4X}Uqn9~RJF`!O%gt5qvV9XRqv+%8D5|ALJ%z= zSA-R)(mhnRogLAhK7Az3X1#6S7*lUWZ@R9@TV-b^@E{dzU*{KjL`}C_e{hA$DSSt3 z!NVtgMwlwN>h>(v(WbNDBC{En?TM9VvVQrgd!~a6ncsl|{LmKT9w|15AxL;$4Nv+( zV*&5B&wtvHj(3@6)-8aVbQVo8R_Q*->iGdUj3V&mO)lYHnhDcT@~FgiJD6^W>H zYFjq-?K%s`UdpPWEd2)?<|8?33HTZ&&Dgz&p@n1EvB9zK#73r4o@qyrRg{I#TVFq@ zue-EW`WQuohgIEnHbK%^BGIiKbmp40@-G|Z%5(A?po{+$atJ?F%( zLBMuq@A4xhUtRM9ZWa12mw(ZyIbN`_)%lXzkZ~b;iMc>Pa1KG8!%HT+^i~=#PCZX_1xl8=!PW7fG zRyq2JE)`$K^V{{N8|hjq(F)F-Nr$Pr-Pfp^J0zmpIDzT9Wj7tmxEkhlvF91v&Je%Z zlxDs0rRQ&qLeuXh9X3qlwWo?m*j5LQ9NYA79M3aFN&cU1Q`6G16Pl+>zir6e+ZF289IoAQPPji4z{v5gHNhVDm9b^F%G{4YyC5?^XsGex!qf{c-*mgqL zeV#O{pQ~o^v>xV|zZh9CscGaNc{62`KQmAO7-worgET1^+@3^w8;$l<~>R!Zf)eZyfv6VS(py)V`4GCG{(G$6M!Mhj5oh;>67n4 z+RSUT^b<`vVhhqXzmB(I>wZ=S%!4uV_F}rY#!XixlYZ?pdHdh3)Q2FCsb(SDO4$X5 z>{Lp~iy;urZD$x^{W_tuy={Z`G+$Ex0Cdj*Nc5d}BsdqY1CT=pjrWlgkh^!z1>|M_ z3PGPC9A6+OfQNjl^%bWXJbIGuS^gKsB9&d+Bn~Hu@@|Yod<&AzVrf^tli3gxeXm}s z-mSTQB<3O@4IV^sIfulwgy?^q2+_|NiD79HdVYX4DgJ2eM$7xC<`8+xVI~iB*DuZI zkH`WFX#qXz!zYRmehsmUsx~`Mf|V(f^RyG>8^05n_q0-`d)Y;K^L|0nuXrr?6DXOMjw|#lO?0RT2T^*T_&eZ?;&#m5Y{%@`&9pyjAa|Z@OgA%}L-a21Jzz-R zHJUG}WixOyVYovMPCVir&k#*hnLin%(t+E~E$xkOd@{oU;(;9q)H=Tdx9sj_2)J3m z@0*O7wTM7ztaq>H}!w8cKw!917xhu-Tr!Ywe~s0fBgJAoK>k?CSsm`T!30ND8m5~NbV*&N$bZ~^%fr@GXKz^iO} zk=V_QZU#HM`iZ$QFi87&`b(cy4_@Yjesbp^>JsnGNr~(Gf2Tj)Zu+eavRmLR!cFBk zPEU>+bc(za!EBVe6M=iBvF!+7f&>vQsY12q9ot@Lyje-bU8o(c9CID4rZD%YfI8Kc zAr9QfaM4ca1=pJte3t1`fR(S*Y0|NC`TV1a&6?VxKz+FuWYpgX6tA|JFaOjUUC*jvi_3e$e-PxHUc6yp`I2Ydf$s&Q zV#l8yIBJObEB%7EpABi1dsccYJD0$nt;`@M z=kGZP{VNj%Ar)Bcwfdbr=eJV_IL4v#$VhHx61+<%F;pipItT)tUimf^UvoMgtip2J zG|sPfd``m;@;yLrW6}*&VEd|BH1SmVAF;>+Q^bW$}@cz;kSUg-U!oAGu`W#-2dp_WP5{5v{Gzvlj4?+ zN_F93SnyvsSLT$o7B2CPAdm`z1Naw>xik|RII)oBr@cYRzZHH#T%E?W1Z8RB1j?z0 zsi72E;9&sonaXMzce0H3F=cQ~{6{L@BJdo;Vs{JV!*3_^@7Vf}lhG4ork2rv2LKa( zZe;?U$S!=#<{#vABi)9X^E{6zkHS=YnDTHI2}-U zsH_D|VgJL429_v8CGt{&v4iEDe<5-i6{YI`vo}Zmd6HB^({+I@7kQP{&HMF?tT#s2 z@S5#&K=6<0#J&Ew?BC-lz?Eb9wy0I$DdYbnPe!sJd$H=(u2ikTUQnfRW_4sg_~>w+ ziCX--1_LfYZzrcbw^K7c-^T`AdWekZ^|-F}@FOK40I297(+)Zt_N4wOIsGgYQke&Z*eO#IF;x)MFjLvF^G{Ke3tfz3FoZh zs)23gmFQ&^zV$s4g$I8pF8hH})JInHJm&d;yK>Mu;XD7$`3tc8Er)K3K6W)5Y1$AZ z;D9r@$Yi94r#c3riQa42dD4-h;Mf5D@$H;<>QAaa{PJ8E!MLI@>1FO&bj#k-6N^M6 z#1Ay3F`jlimUKg!%BZ0=yQ|vhGJgv2HK?t>&oSgnptw%^&9L^_%F`vGj5NAk^MrxGzE7J#kA6UhsWw%x6nof{`g_e z)1RmBCr3YyLF%1|L$dKA*<#-Jgk;^nAZC(?{w#Us!&zp|6T@{GYGfI~BJ_NOO~2PI zWbaRNv9}295inrE>Gd4hg5Z;Tv$649ebQyB7S@^n>Dm8p;5Y)#JnIr!)H?-zdwjf{ z@-W5vT(KLu>peM6$PKX;DUwtd8YP$YjN>%_2d5u8EA#1}c+D*^?l~8{Ctq#Z9^F(3 zYFCAY9&H!5WaMgd6@skPMz>${7-esI;AS+P?$q()FEg-)BDnth?#KdRoNglb!NS*h zp!VRi;1w;R3;*z%Ruq9ls63`AU%waZW7vRORaB%r!+;A}S;+w9_*~uL_+@VD zQ;&JlT(I7@9NBrxz-BY>Nj-9%(ojJxK+y)bhgY{Oy9MFQv3I7C7~Nq+jo%Y~D*qae z0SSevH^n!+wz5<#y;gOvM|T-1r%ol(J^cwT$YU$T0z2aMDp=ujeNZ_yib#7#OR5xh zWBAgF_vg@_*S_|-A#!H;AT>y^Gsw!IjPo7wV{nF3C;1tu@L7>@aXQ9lR&`JCGi`-8 z=KXVKpfmjox&M%k@wru2t_+us=Q&;69yLnvUoK4W(p`EPt9%a8u!gvi?%lW#dRy3B z2kaDk-S&@1<>lSUlK;su`tn3&3mZWgWP@^WKu^>GU;X@4Z)aSqJ?iemuVHe)CiKYy z!&)va*`D@X%6D$+zDPgH!)yK&p2sa@>Az}w`Dh}C-0bY#3uPs+py@^wtN9nKE}Oa5 zm1Es*cSqt(e9!^p-CZFOk*7HUT)+hRz;>NZmiF_^JR5)lpuoJ$Z;{3l`=lqt8^4@f z!JE>*on%^@~y5Ct{i+)KTB7UBBTS1P*@u7{!|&#WP-a5_S2P7I)!z zZ2ieS1rFM@LU$4;=odr@`1U)eg@XqPYYoc1?Ev##KesQ`a+Jb^Z?M%~-(f7v~Kp@Pv; zPfrLHx*$o$t9}X61ix?pYkDW&jaj0QWFh%`4C<#67x#zY*3UYL3y&c}%wiR|`2P&3 znbE);@}4|pg4!&4U2EeD$VXu~t=F2rYM3^#D9!W8-?4q``!F#*=-jDn*-%gm{a3QS zllrU!w*hQnFNgwWZ=AAZS;D{vk^FnjqZw$&m1%`o$Dp&pq{daR<`;eV(%odE(~Q}1 z&Ma_ofsDNyy3ClhK-_e~Ek{e@Nxql*E>Ix3)i1FP1giu@77F)ewmmyqpVec%GaOf_^xE3|JSQu4^^{DP0fK;y+jeK%DV z^zVOd8-q;FKjtJ2UOFZo({{(Mc?kPvqy4%L>9)o_TrU%U1 z4A4;KZ3gM=AJ3on+w-3R*ROBLm1`*_uOn?iH6Ok;`1wV1JO<<7FyBEj)c&sUzf@ok zfL;rT^BFUfVNorCxZ4w{w*`F_(xjl&(;kTW52f&6&6#+QdJn#vz-iZmJ!2y=&sl|d z3kP7{)Ymmu#f90SkIC<1$hmE-Nwh>KtDxkS0gi!UPrFjdF>m4&mP4TbsWSkB8fVWg z=fJiK@Fx@kHW~hr1vps>;-zTvFG>x8e|$Sd)nED5i0m2Igt^Nr>|vW3>r0+;4U{g* zDFyhZ6seo~Wi_s(LUPs}gI;TfO}+0AoJ&BDmo87hfabf0Tq+~2s;bwTLo&EPTYj^S z2|A6{Bow(uR1^#WEPW+rP7m#RxXXJiHF_&ns_R3K-^G5pj@OifQn!UemgQRyadMcqZ@@3J5r5Qo7C3w@w|9NJ z2ZK!yzU(CRa;9cp22;N)kd)J@g``piu!5axRDp7d%0LT}80`W1WL;kw)wvWD4e7tg zv>zZ&1+O96yO^-8DKblOihc!!VXqa2kQL>wq4GKxYX~PkY zGT|SZIWu8*z_>rW0=|ejj;FqcSZtFudPWwz)Fb7n9+G8vxxJQHB%SW&Oinr^uRGwa zc!4#sdcDo;JZdIM)adp;OGMwQRgX6Oj%QXiF^ufCZ=R(|O>d#$4KDTLsReTfE97jT zw!>zM$|P2T7xc1(wo}p71epN<(9~C(yBa=^s12^E z!pAhpw%g?X{g(1wbn)Un?GV*nL zh8+6oqi?F`(%FsZ+EFwgzeGiuEtjErd7?7*FQdTOoWCU)^iHjkF29>v`xoAYy?`@F z8D8_(lR4AXR}MxUSNXni$5;CuNkYCpsAZdxdXG_=+U179Aj~E>XoDXwpzOw~(^1up z9b2`21RX`0<#{`&AByK%p9E0gh&@`lQ&o#YB=NeMWcvB|)Z_tj?}MKUgpVKibep5A z7;?vCvu-o-u>@wvCH!~C#c3w$)iWd$H@iXK)p#$? zir{qvi&}qniDE90J-GoC7^v8XCkB+X)?J4WH}wzJT*%I+qt9Dr3KY($RmRf0KK2R7 zWWuknS*=H^pw=)w?s*G#MFwoyvi7C!6&|Qx1?T(1_1Y7!3eOB@&X*)AMe`rTkf?iY z9c8g4Hu;W>?OKVolKujfscR?H?$ihf&1esEa!OQ3Zt1V24cpdg;a6!(iOwjp(|ZcV?D~gy zb&qNreOwb}!A?`<7CR#s_sj+x3Wz-R$S`J|rQaq$+JJv7>C6~rv*hI677du|*uc-* z_j0qDlN!R30xBYBPS${CXhX1=USCo@w?=MDAISjAj&XyrTNG3a46QkgnovT=KsS4+ zi?xywm^0&DEca=?K7}ocN63SLN0Ai|-yqxnpbZZ(G47oPo?ryPP%gU@!)IYP@)XM! zdAMID(rYQBzg+BbU97<-4dQS63Rb5a!|7cf6pM7$KJ%j9I`K_BRc19MH z5yLbSnD>@O2F6aJ_&zo_o%3rj+I)jvZ{7ThPjL1G#cDeNz+s?bpzhkL)amT4qXg)L zJ_>!j7BuWSt3;i*?-ThU^WJV{Tx5!x8}ZSR30yyG=%W5e`oE-u#hBS zh@mTlF|Fs1$+Tfw?{LtnkG%%vLK;s}OD$uT@a$r&qh$ZhbIUcXaxD;VtiU&=b-XH- ze>D=~VaHdp7JFylDFqz^pL+LcY=%Jbs|=g)16zp;?$hDyHx5Ten<pbW&f3od44O1Q!yg8BF8Q;Nd{eDq`sj|vhiCNrF zxFl%_S|+r_DH3+{AgZrYr#IcCq;JfkSkojip-D(5itGG`rG`=0HmF44YNR@9$svVP z;S%4K8S8K^?tCggpWXC6KkHO)zfb73yQIW}Gnq|`11iyKkRMpa`bI-TTO+^WwUsRz z+;=Fvf5NCrB6sROpLw$ObkJL@sBORX?mYKb626?~=imQ*Q&MdIsV`ZSeK%nA*@c?s z)*`cl{r&V$8a8>MiFOb-n|BU$&o8kJBzEz_{$cwePX2b+RoN3=iOBjOd_#(xWbs$; z)tC<++=Y)0@w%LbuSVK7&=pJK!uUqbIYP-NLdOkS^BJN;V&1_Z|(3a)o~&h4SXtuA_>`tFnPy zl|l2~thJ`mTfTwsCe-HXfli;Oi=g!Jp@18$QcT^}@cXvu535R(jdD)J#`|A<`t7Zq zgX;Em(2UEOA-DoiYtH{<$fm}{b|2BX4Ie$JLHS~nVnTL{ro}z#CmRciu{WF>0*>hj ze@97g1}UK}n4)Fr!mzKTZgs77v9&Kg!5i&o^!k%a0eDgm|Hvp3wTLs^9Ojpd2DShBMy_iVWJWCO#+U6^st57-)f{~aoFN4NyHJ(CrY zYrWGG|4#^>N$FwYW}wT*jWk4FhBEtopw+b3ESy)nN#m^lS}uiRX{Ukln&8`McbpVf z>_oWu69<0xIXXgwWKlmYl4W&;s?#5!5BC>@_GA1|-}RxF#ZhyWVOod%Yu-LuNQb_d3mN%MvfYENdE35FWNFZ5L73Yt}p$R8rC zsj_~?ff1a3SR*vC)*wDpw;~AkDNQg@HYgtln=R-CRf#VW~cab>uYvWg#`zLjS6s{Kyk6*|@V9eW$ZXod2b*CsEul zBGOl>T|?wAx< z`G>fMI{3f311yi^SSR&G|-tt+xmSg3^=bsLz(-Z~ zhJT*~Xze$NfsyVHCRwVEu-UBtivtjM{0TA*#SJ`W)1H_Q4hT9qdb_e@Xw`V2Ha-h<9ex9`JNP%~doqb-p8>IKrxA2Z0=j1}Xpu4-6qom#>i~f_ z@VOl@SLz@XTCI@k`>3sRV%RC~MYXzc6=OTD>aIXnpfG^H#dhG=YL@GV$}}puP!eMW z^G^BCh44m+k#ei<-aYBw_6=>4>$jg}g5FyxCYC?g@1Onr<`HYK_`mEA(o20d1x>&C{+D(UF#20O{9{PuaoS&3q3K#8A)A->|)?6(*D*ROuhuccQ0a!comgr@oT)wfv`1Q5ul zZR3xFp=KmlHzpsSzw#gwy{%(w)U2U^j@aZ+f%XAP&zj`u)zY&2bY<~jA+*i#@IuJp{f=@fpO-L~i&4Wpii++HqH4CEX@yvy}V*CO|3 zt$R830y^1h`-POqWB(I(@l49*uFq|E-rsN9s{`spE++Uhol`(L^rq5-DxN(l77o(S z+kYquOo}3t-UCz~n5M%dV3}k;_|_=v(rd=GR z!L<$Ne@hTRV1V_&Mr`Pkqx19NxRxLne@F<&MiV;9dA zs7)p98qf(d3Ez*`UHwTa3V)&=V8trToqw)2qs6EB zHKq#5W0GqXsMaX{1A%TIu+H1{99|XsC6OQxt6RO{4?=sM8x}*P9~2Lpmbkqo=Jr^| zKj%|`eW`F4OK^#KzrJ*%pkkFmN8Q4V*cZ`NqJTSsO#s% z2+oWY*U$q`uRWeH#XiugY*}GM3Vwdqi;QtFIb}o))yWFKVrwj{i)Oe z(SwOe{==qup|#W7li8`{fzgJCBj5gQ6sM`~Mt?C@etpm|2?-aj()O?(2({;@*-kN= zNKbFqOBJ%TkwPMN%Z>2oc)3DXLZK_(GbghPR7wQc2INu^UsipbHbrT@=|v3%>@inf zIKPrx?RJYG7wK_6)Osj5qbYsgX}0Fq4O&sU1}xu|r9z-Z(SC9(%}ep>1gumBk)~; zSL*^k4h5|q(TU|35qoW=ff&8MeM?sRgW3l@X;)aqR>09I5qTdAzLJl?@xGvi2UatN zpChiNF!I>x_wV&=h-pn6Lx?i3ot?&Vx(iRa%yU74tKcK0mveB_U+J0fMx33o zIW>rCO39xIjtZk^h3$umxKvKM2OO2ZfzR##=suUB`<5uuB20+8E&KAnxR9K`iFbf@ zz0)MUB?isrD>!2Kf&1hMhGD{>FuUpMXUp>T@+e+BdS=15`iASHa#YNJg3Z zFo&A~+dJy~5JFm6XSV)!a* z>D6fOv#{NYIWPLjuSdrUbLlH)s_w;e9QTpFG4hcd1ue9Jpk*{Jre1EXb}KT(er4;; z!Rq^_mue^%7YVFtkTWUFCdrHCg(lIda50;-f-cV08Qza`a&N{%Q@AFy6xC5}O%Vaj zFW^7YXncj5g)Qf(2Tr7h_InsgC_t!QazA#*KA?=w#qv&1XPpp)sE#xN+;?LCmTTB9t>E1u(YvHM8P9>(TX zV%$pZcxoKL2F%`5@@W5f*%?8R@}>e34$Yf<%quj}?c0@)UDlmZpv;IG$_=M!lgEup2+?Ke=eC;m@kUmj0o z{=PqIN`<77q>@r(sU)Go^pPl)EXSICD5R5wBuf+`(t_+IAv;;lvG0Uvv*jF1mWmu( z969GWzx(|hO*J#0-}f_r&1IInYg5voB2s39!ZQ_Do8WG#)u21EHh_;^LB70lO(Y2t_P}WRE{?Cb$tv1BP zskFsuz8Rap6mFP4YG+mn&WbsW#bMAHP-rPvx2AF?4-5H>W%Jn*;yqQZo3GH?DK&l^ z#%4~Y={yvl6Ysb`Yx0%ZrgNlSduoy(B%>pY%iNFS6C^>Z8jgE1=<-ML+c~BKDgX2G z(bC~U_RGm;Xx8FJfH}_9(AcY2PAjEV@aPYkM>?1itJU3U(iQA>)KK-W44sdl=RY!a zT|qQ)n6mQ(yRE93ll)NWojv5?|F}zZe$XywLTcf26iyr)cDykQE4kSxSs$5e*xSXZ=BmVIR?6nnqN z^JRdv+ycbMgriUZm;5BfkV&bPNb|4mbbu+ zq;ZJeq>$ISM$zSBqp*Xh%SITQ{g|7@qai3u3p4zSlCjdVaJ-^HZwb+Ti%X>f!o=HU z*A^4J9R|CXw}=lJ#^{=lX1K zd5wBZ98afBHC&QTG%DjJQ)lr+5Uhi&u4Ca9xg{#l^?FtuU+D}EoaaTgAcqcz;d3tt$u!Qx=N##6+u5T)aLPH? zJ$~WdQQU{so*+=Z{01P{)>=)O_b?{0Jn*LYg4dP;fr1mIhe4m1mn=r*)8=SvKeXTK z#V!9Tv0vX9hT*)$?uTf~z>vio8?pc?f>}J4tpJZ&L&hd>$En`c==hy6+J@cP)A zrJsHBNOsHGF~VqAM9Jj-JfB->C36*=6!?Bmj#B_r;L=*O4b7!T`(F3f6c7EVcFz&d zDc#vP+sjwRm1?q_?kgJW=Q{*qO2kaK8SxyM8%dL)I-ALNZ+7z(`*3zlma-Vca1KiH z%RVZm*Gd``Y$8Q&SJa=foy`hh>H2@|={IkH1bJ&2Dpmqx+o)qPvyZ-Rp5=zCWYAFtDc}L>{nzLm7N3=9X)Pc2 zPqiQLOmS$P3J;JHcz$YE25Fx$Ci2$%tyx+V-B$&#+FZW7+s!kj54|*Tn6meKTGun)J(q!l z0<#2Rhx1oY9TIP15|s#WS^#2$fb&l|?CUu<`f-Q*fdeitvv2Z7)nOWY!Ejkx{YxK@ z*17K%hRTm#ywiv{UJA+;$A$4Xa-qQZyDIc-`PL>cULM)v83iei#>@SRSj^Qj2DbOk zH-%7kr*(|a-JpMaS+@C7>RZOD|CSNEDm{@|1SCZxo|gTdY94Kjs}u8WovM6c_>B@y zREg(Q;Osy^fcZ)m#AfTM+bWTRp&jIgCP*gc(Dilsx(^-RN+K?pz!;I2I6u^OJ=zL( z1v9WKtmQftticT0k||JdswE6sEyFW+4_cAhoa%OYx(@dxSBZft8|i!&w8Y3ZqBe(( zMiFWB*HHxxZ26<(oJ^g;A=$*(D1uCq&9QHZ7r>whmfgKm)iQV!F7^d!D`;A!3Xy83 z0#rMgEo3RD-VrTMee3!aje_iSlM|%9?SwnOA>Y9}FH%cW)L0{9Y$h-;fKjvxkgSqH3<##i6nrv-hb z&$g7+;jjyd}nYCZ2DXS{Ga3 ztG}z$<(EoSZrBX5BE@~j{YaDO84D89&pIgOEhCgk(;g$c7&7I784D}0v*5uWyNO!xcCzUDMMaZlm#1+mucpkI4 z5P@eYzCm^O!{igh996zUEUBRzkJyH_4Va3Dy1*Gx?PD#tzHzym(4+W}Shq+HZcfq; zzX*0ktvzG(TDts))7@(~o~*k5Lk)+Li?46JT=9(L;R~`C;@qQvVYPFu2^(4Wg=9#Z zE0#$z2hli7VEpU+_2Et2DzJ^{M99Ig3(f{8?O2v8NY7P1nleZ98BM0XvD=nr=!=Ji z4dT*7cNgmnQ}hSs=^v(@$b8f))^UL6Z($Q3#!@saDf)=4Z!Du5oR@8W;w@e(57|;* zuFtueHaNedztr17Nddw}K7q!ezW)m)@5?5KQu#CNteZewLD{5?us|F0LM`*5)FHQc zeXUrdQ&Pvo#`LYnTv#>*xSr~6w;M_1HqG7_sp#=UJCcSx)cjNjTC~8*ftEEV1(xS0M68ECeiK_FeZ%ED>0Qkht}kuf3iDRM{rEf+j+y9G;}XUeB0_vc5^8>gk@Rk)vZeX|WOCa@rZ^ z7%l`2GwPEWNT9#LE%lyP9X|J)@~kOn{`RK|&LkKs?s#xeg8u4KZ1zT3N*y<5H$p~n zqz1N>zd*Vp=s`-#Q}UeeXLoMm6HFWR2D0fNIxK$&ouK_`-h0lSQ%I`y&<<(8fjpEc zDRe&TwL|-v=JoNG%VAQ4Y#GUWm-8bx#?L&#!n_C~X^Hl7@P@&b(E|$mXGjC-Q5xwf zO{Oe4mTq54l}m8p!9ftF|7wdI4H-n9BhfvJb)y_cIl=?e?5A$iY8koPdgr~fC@m6a z$fOT{1q)_?d_~05@oP$%lLa*o>;q3_q;>CSm2LKgN6(n_n=8 z#rqk_x_Ue~D_)PCY%z7FCwj={T`J#t?+S9mp$Z-16Uv{pI?!}xPEbnHljzVxh;t61 zNmmw@^&4MehFvc(L%HRNqf#q!dcJY%_q3R(V=G(pe1+ad18v;6FAMc~6+`!el1iNZ zY!~R8B+-je5Q>qdh^&K{aN6QIQM`CbV9kVU8QxfD`-03CC6?>H`F)?h99-gh(nB45 zCF#$0>F>9vwQ2LWXwbG4W(E9e14Noz$TQ%tMb@;_JWy&_y8%F!bb1dCYB5NdmLI`| zDt(QU9HMkMU$Mu%w!^jpBwa9?o4}DvNAdNO@@9E2khA1py?@r_0S8^UOVyhiP3=fn z=>ToIey{*_4PO_-`xWJ^9$)jFdiP4q6#~(Zc6xy;qy(KHeWu%bW>*aRQN=AoyqR`} zMkW1mtU|O5j8CjS?9M?CC_WzO9}E&4lpH2d1zMusuyXA#9uaGj{}UUz|Js0khjWtv73cZ z;E2>-A`#*?J|wELu0#v#2Uu7R$7P03LO!qTVuW0b>&}(Q%l?&joaKKXUS;RDe6sNI z#TWfr)3cde(>3AgX`*QYghL;j&YG#=V7mkxY7USnJL1Oel)E=jF+zFe(bhvkxFx^q zU@zvhmFUCcV9ka%bn&#)+q35R`kIB7c;}k7vEzspFx8CJQ#v>OFo8d7*{Bzdbt$d@l~ z&M}&9P^8 zwSAYfvoY@2W9(c!-5wPs*m&(Ie@6U9%#RP6dyx6cu|x4i?GLivEEvHnIrWcKJ-uTp zIy8{E7nmTpuM7pZ$ZBd_^Hq}x#oX@`ub*>=XG<;f#^AvgD}Ula-B<(DJjYNhyN+SD z%smtlE^EqbFSr<`E{OKxjv&=$RNS!B)pNpjqGH&y0ERs9R55$@Jo=Th@s1U8kdv7x z@-FT+EuQp8wKkEwy@ZdKcQa$u>t>z9PwQ5;eun-JwCXGd7Mm#nJKxIYBX&4jhYcZI z+)~xIYJ_3p38_r8x@SQ$+a0k!diT!m%U@c?$drv)XO!2m=Hjev5DyEkZ!m1sFkzJH zpU!HArJAfvVcS>7;3`rtx=VB6D(jjgZ_Ef{KC5DuPB>;0&XI2g$rK$$@>?FNM6D|Zbj?rvB0~{s33+&JA4B)B$ygWhfF5dL zES+8?sHmujlriU`pJ+l}1S|@Qlm8rTRl}yVC`UjwK^!6i@9@A2r4#^+vP~|%uw5cM zH+j4xaoAXy^}wP{@{B1(rIVxu=HRxBnvI_Xa>FT=!!?9Dr1_b+nw$?WYu&N37&+_Y z>EO`(VjcBm--cN{!+ituez4n8^3E_m{DDYqrc#d-eId?o+a+t=`i5~N z(BkuFX+ z6?yF+&SNL$ynm3gi*_G#XN2!->daovjqFv(efoFPsV>WO3JV9CLPFmaOVK2=Gvdn$ zcmTv2yFUyovK61rU9dxqj5QPDR&(m_>zFM2)SLLeVGK4%fs1jVC}5guP1ji7MB0Y1 zbrK(>Ih;`xgXms#sd_%f?ji*|(LAavZvhLg=&Uy?RW0lW+dS}y=$SGMMef(Eq6j6V`yZ)$Mvz=|%W-@pz z9L%#j47J<-$TY+Vep6F}i-ayx?5L8N%0c9jf;B0ueqh8e2g3N?O78h^eZvQqB-j*V zqby9J8op}Tm{HO5Sjd$)aCfREr!rbYlBv!@Fw19Y(!#r~DcN*gDM}I-;M~^Jg`Z>H zpGK)n`CcF0j8ib@1;4s4td(K>79TAnBR4%S3qbc3?meo|>3O`nGbDSQzL;9-#h&ykj>8(4CG$f{arHtA8YvN9Q!T31n zh2b;#ryexjq5Gvth9W?HyHbhru@$EfY8>l%VuZC7=R^}469AeoyZ+4~+^(kK-pjL- z&f&Z7VQx&WXZ{gx9WJ~hW3`01NyHtM8WZtf#9#8N>bmgU+Jts{A$wG{obs@P#iYg( zS28>|tdEe=H96T@pZC;C#N)MHx9XnwLV#c_C5%6iW+^BBzi01qZJ>Z@%r4zgl9L$T z1s8_ZT$!ieL_C$oU4Rt%o3(A}g0<}x7r@cu93F3{tg{RMEW$dN+*`<-_PUU@2qmp- zO}~fXgr8y=kDc>i9Ldl~MjuN!vI$$QDduTq-0-gv#Y$_)KV>J{B^JDkp!&PF?L$zQ zrK~&&)D5hcVF8SCeyyk{j`L#mBff7W8_@(ae>B6OBr%uXKUOTqSPxw(lohT23cM|z zEkg8R3g^n`i6M#$->vCEUctfEwy)rsfIM3$!EBl)m)-FLE>-U~e-`JhTIDLiRr0(l zweI~M@1bVW=Td4UDN$8MkL@N0_=UThiKK+&FChMyq((oaNK-S^?#^} zPpr32kY;ff+Ez8$baLw*Rxsjnrb#s|*S7CptedO6?z<5=7?v1$bVRa=kAB`eh|4DC zbP(`r2MtF(a?vgm%)y;N-Ar8`L#t)xCboZ3w9syCe&U+fTEH@S`|4CTDfnKlL7jBN zWbnQRc)p~)Wt;9N55rb1U~Z$aMKfKTpH&^51)=Iowv0&N?l8sDGUkV8B8P|MT@SX@ zilDIoO7h>w0$4i@5csi~7=-C{sn7}`X-)q8^Qj$LIM+YjjHe|r$!P&jZ*y#sy~;Jr zVhg#x$;-MFhKipO)$UuJy{8ZSU0RJ5;=V6H)k*@$)*kI_n6t}3Z@lUhnFpImU+U{4*Dp!Hq z4i<$>r8EYwH2S8vF=N@!?3vF3dj<@W^q>4^np%vkh^AH~*@R7fq}>^rOg3m;PVV^n z<18_if@n**QUe@of+HiX$tc11groqI7?N?rF|MsU$J=zD&RTyT*ZWrcrhR^))>}E3 zS~Hu^13DKKuMa7#^W=Tkt{7ru%y`{sAfKe{i(|Rw!9fj`9xX(JnFPXV-zSD3VDdT~ z`ba;;3pfrRF`p+^Ipg2Tf>w7HHMH=)qjZa4Mm%+=Z>pIuzihUy&si!Ax$xeNQ+KW% zOY6$3LP2LSQaaHSa^@N>;*^EEO-0g@X(!@Oheya5b>njlm336zb+@WUXgmKBHw(Qq zyXbg{-U>L{$mHU2K$WRx8e}6Qv6NHfsqV@9w*)Yz3e;TR6)k^bs?dNnIP^umOKi;6 z{b9Ih$>dby-PljI8_dvVZv58r>Yt~^Ka#Dn_r8EBBep|F_dNP8cL~h;4przQL$v6_ zK~dF-4fmvPPESj-YLc>;#n5KuLJTtEYJ6sN*9C5CjMcPAk^O0F3OHN$`5dlOed{S+ zKQh-4zX%PBD#=Aj=QGmer<6*DVrEY?VXjqp&0r)$i)ns?rHiaDu_AFb`cT^Z8%6KO zFh`|~26Wr5odEVmA<$!YLCV*ru{q`rXNBi6 z?vG5M3}IgyR2xlu)(sBpF~J-Pp8un_6OA~2Na|{6hlzn>3gLnVH@0_# zIJiB|gf@n+g?ZKG#bNw8oSKs#Zt$si;BGqfgg66wx2wr`zH-6LHQj?J$>y$}6aKuZ zHB=;!`o;D1kAfnVAdY2UTfNTiVJ!!XVGXp+=C2YG#?N_ovLZ4TRPxDUBjUjJ;k3%A zRisJs$9pi4`IYMYCrI0-eV1+Ol8X6B@~wLcZWN3PF3ZbV%Z=@QfNcDZ_04>NThT*UYiNK_k2|Fe~9#zAMwg71Tw%N z(UjDKCTFxA?_!IF@M<{h$0JHUKcC*9Aj50HY;J{Lw|rGCr?39SN9UexDX>` znr1hvJV7ZD=`ncVveZvU_UB^oGX?OS3c7qkWPj-By6w|$cUs?F8&|;qaeG_rHGF6N z_)pO-yofkh1HGx?>QL6G3Bf8Mo=@YiTrJ$3Zg${$vh)^$L(G~2!GRczq!fC-f(-6M zZ`-lG(Z1Ujd_PTQ{xWW<&dV${_gA$-;!+k55y>Y0W@$D)~i??7oR-s?fGGfr}3vAk(E2XDEbGmDa zvq7n)l+^Qf{K4q_*HuVeR6Ds5TXHiGVBgpI!Y$QFYK=WHW)=hh1>=PCfV2b7*EWQ0--qVzo z(2FeO7-&lP-$uk;j@TKHLXDQp>~MGBb$gd$}r; zR#RlBG(o`AWrgKkR?a?uU>xSsKkoM`;Rw8Po2c6j4cyVKlukXXpMgvv=lmK{E*qj$up8Zss5HbG?k}!Y0 zs<+f7{MNnqz8Vc9)G}0>x)_n~H9Xr!uO32&^y#J?nD3c0%B2^F2?ZZIKsRq>Tn^i|_jH~z?CyElV>GMxjXxeES zHnY5F8jDJ{RpXCz?B*G8vbVSA19y<#Vf#_I6rEkM`;3-LGsMDoQvYA$n(g(fNKJK) zBd&~jX{+fVPvpiZD$C2Q?!o3?fL>PnPl$^cQO2Yx0&jwoL4<;hdtCseEw4|DzM0SD zEuxx;U~^CbEnZY>LZKOr=Vm_3>=K{R4ex{HlB@DLeUChHpaDv0Z=(=T0*8omeDrOu zK_TdDqP?g>AZ$^Ej^O`_+Lc`M^*b}x3^*Gozb(L4zc9-q3RQUSek!Ny!YI zI36N?WxMZMOC#53$?x69El2h+AsVV-BfH=C-V4z3DE3UtN5AJ44(Mn`A5m!ZsWHpk9aOJ%R9{j zRoxb7tZD$dYKsmiUXC4{hhaHHW-S9kvZs9(ueQ2$;$8cq`F2@K=#Q3>^K$@@lC5p~ zN!oaK^5gUfxx^GNf2%#hTUpy|Z=IempuH!*`l@TisL&7;3}raHL3{GPEA=oY<~z1n z&h>g~H0k*f6>^26j2m|-D~WI3DP7K84*|D7s1J9>8)6t z;Mx@I zJEvM}Oa(`lysR`+lSvtgY975HN6&z!co9X`z|?L}!n)RJKXeMK0al$o&m4)0yAR(2 z&~3^?faC~`>l(XjAC8&MTdE9qZ0=J-M5s#@yNJt}jpEro3BqpNN;}|$!>4^J1;3aV z{wApN`B+sC`kC;NZJN6AYI^?x-AqQ`_)ZS;r6 literal 0 HcmV?d00001 From 413783d35fdc2da875ade876b7da12cc05c02f44 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:21:00 -0700 Subject: [PATCH 0151/1214] Update simplified-sdl.png --- .../images/simplified-sdl.png | Bin 218369 -> 174076 bytes 1 file changed, 0 insertions(+), 0 deletions(-) diff --git a/windows/security/threat-protection/images/simplified-sdl.png b/windows/security/threat-protection/images/simplified-sdl.png index 004814102fc3e8272429bde640e4adc1e752f333..97c7448b8c9b741540731dd89b14a92a744bc2de 100644 GIT binary patch literal 174076 zcmXtf1yCJL+w8%e;O_43uEE{igS)%C`+?w=;2a>hyA%8n+%35K&HLT@t9Ev(dV1&C z+In`TccwR1RapiFkpK|@0HDapN~r??Q2z>G1|Ig`nahr|P0N`T$S0Jnl z=l^5CdB`bA!yO<%;9_y~?ckLE50cjP5cl-3adrb#)=kO&gOEM`K~h%k7H+mK9=6U- z089jO%6~ZGf4HQxi?5rlwT%a$=F618KNR(UsGF79e^fFLTSqGZ_v06Ye=P|AwP-kh z^YAuvvjP~oeEvsA`d{a^?iLPa|EO+&*1qQCe=z)iu#TCVldY3AppWn{`X2`O|F8FS zv#F{g0+;>)~Jp_<1o;3jmM-xew*>PqsHn)v5ztZs(TTCXTEm)AbmHTR!C+~wOMk_)CK5+;g=kfY2r2vt z&k0{bK?aS1vx+&^qMld z6TGhC%1x9;({k<5`8vf|2B%9~CuJ9eO;peh~Q zAC@~THzFHsmcbv+yXOw|y?UEf3^8+KLqo?0)6v^Ng_$g_Z4Oe%@z*k4xaY*XQUff%myuYUeo6jyE@*Kga1 zeBiKNAvQiAaTS$WB&VmRr{9e)4iC7wS-Q|9nK!{46rT%qfntU1Vrr)P%jun77ee*D zy}_@cb(uVQoI05EIh`ipq%`RmMlb0cjUNAcpL^?q3X>#ge%`4D`0jhT8vQ@-sR13-O-HFR zEFuRP8Vt!oH?rpajXk$tF-k!um%eyJLo&XX z{q1)0s0(33)GHVHxP=2g2(RgdxL)uyr6c7Lr5pl<44sw-^t%Skj7erL-v_;5Ex$pm ze-s%Y8ITc}JQ|P4XP`G&1?BOfl9?(1Je;;0rqb>Zax%BpLGA`G+neRQfW8cFZc^&K z8eB%!y}9xGm?k_da{v}w%8b=RaWmp=)oY(b@d^`}N!1 zmLpc(x!|X8fNE@J(u&^oFeEZg@Ao zW+&PVNNE})-smD3f9OOs?goI|rkK(v|2utyS8bHac7f8;lwlQeo&sBIc>{wNDwpTQ z6{0C6Yl7uUch?Z1GxSxT!C=wuh*EwCZ}bGT#rvq!I>i68|yO}g=;vk z2|7F0lvzIn#^6Tt1tc6TBEOasFgq$8^P+-UH?I#OZ&M?g^YE92rNeNc^Aky-K- z*Hnz4sLk!^xVg_fR@A|^`149!JQNwblzC4?c2hWfvXY-L{KkjA9}GbErfTE0<)riR zzJboe6C@h6C^ZROnc(aJ0Fs?w-dE^CRYZZokh2Vg=+Ur|8CBpo)J9%UPEs9w5LwFy z5Z<^6p>lbJ(~K*od@PYj>_ZxZ_Hpml%YR)U@ z@JY~>kH7MVf8~%_?!fO@b9ninlxTuFT=B3rzIH}wu?cym{?&hqv$Mim`Mlk73EjH> zc_B%Zn;>%clbhqPvUlvA#Nd~(tg2$4_Vv|miiJo;oV6*tI4U0-m;`V0qa1X9q^L%F z$>@BJMrx4Viu$n4))vcCj$eJYm6)ae{`=y31GnoDh!p(zd-BV)+{mK8`}hfEP{F5g zRI@7;-Jz{%o=v(&x5DzW>zoXo zMg>c8{BT_5=<#1V#ncw%?Rnm@LXq?8%^iEhrCA;@hhcNeqlXQlSDp@7m(>NNGVAf} zBd^J8<=3womV~#oj@0Jcunt;JC~#fLB_STj&46+EnM==PQc~dhA6n>A>XSkFQBVzN z3x{M&58e%K2i6tQk9i9XHv`kJzuU&*(a}H7af5rfzSn+^WHsUk*Qr9V!z#JN30qIJ zb_-FiWg}>O2VJ?KdAEmozxtuehB2ez^J7W<9B#-xfF2Fk=^!EvqCv2}Sc)xMAkKSx zTL-Dzvu@d9to$1Mice{d``dY;Zpr7AND&82gEwBC83} z`izo(WXqtTM!fGx1~a+RoMrZKw=PBkt1HFhwDSd@DUBk~atCkElxg9WO@#gVKtbhm zUq{=xOZ|1s_p+B-BfDoG#tLb33|W#|x^G#gfuV&drZPqs&@Jmgxo>CKG@R8gOeFoS zxEU&vnUbc`!L7m5cT(0PKH$xoVS%vu#XRZg*{*f1MZJZL9}xk4Qa`hxVh@NI99lDO5WF*qx=y-@5ik_C(=T|$ z?^c5Q%ja&GqD;0U`}WuC>I&qI3Y^t$QcVnl+}FI<@9Bvpf*h6sfrbbXhzsbv++7<2 zM8pR#>sR|vucFtFh3^O4z3mm&#ub4mlXkSVR)h_-`7(LckUATM|KhrGO|3QXGYds) z_kP}hJAmyLbp+Pc7H7--qhX;4U6HsX%j1pW(~*KH$tCf{-;=*b34X=HbtjiVz_y&m z+Ki=C)rt9ntfE|STj?G6a9zLQeLjD2*wUGRTaPj0B!tasQQGQL7 zU1ARB*7CEnnJswq`rP0atmbm7XSvU{uj`jn5M25EJD#Y4U(rQbX*bbk)el+ZV{UFO z*74Z!8$X7EK95+Ne3K{1kTwm;b|@JBgZ7#KE}87}NO?t#j#jW{R@D{C*GGmsY}t;0U!cQou#oILPTw5hnF6sM?`Kx2}jeM?ii@$@7x0`KVQ9O7Jih zuCSYRSvDtKbB3*ej*O2^cz7?;mG#f#>9DO97bSG~AV2ILsYQHWmHf}2%R?!q1@oT- z)MNb8lP<+X@Q)Wm6R`>huHq6IP_C8BbWiSaDd(=oRs}&+J7uBa_o*z&lwINj*-tY$E^V5=w(jVy&wZQQ7nSxz>#cyW+w3ZpYe0XNS>*dGW_t5%+ z!1s>&&zI9Jt|0={3sr)wj2c9@SVW+Qh{m3LPT7q?FfU$Z+wu}GJR&dFA0r_Ik+UH`DusJ5R)8_+6l!+s zaf18v&UyCZxV2R{&-A+0qbf1bw>st|0yVOeEwwCNTH8;Q(uZ()!p!gy*8r6K0JFAw zv;2Pf15_CH!k17>cyy+LAf4@Rtbfre<8xSq=4{mC?m}luM`!hyE&8{4d82E1{>$1C ziSBD8XYbA1EXn)Ho~sRQbJI(bT<%x)Z}MH9*&zXIvyzjNMm$u~+A;G$h?VX^uV7!n zh29(=MhnK-=FRj$C6@jD4Fva!=yG1?*Dh+f;I-l#-!u72RkqADf1zb$*o8c}0JBt&=!F!81g0&g=AwVXP46xlgFi_M$sG9jg#J9Mn%DH=X z=9iD0yBr(pl8#taB(&tlTj|?5S#SVB3a?j}4Q-#&9_i8Tf%t$bm9=cldT6gd^@w|) zI|CCWld>*`hO4Sjl)2d{<5uVK6Dw3-_T}@P4rk8L5o{C8Uxx`vvnl>UR-*Hp&02(- zOy5gcn3dM*nqc3nOTn??C06fPM6-QM!#7%Oi{gl??aPVy>mftSoxS6olfNSE)le?i z@X7)EJJ2+Wiu?O2N%G_u8Asb^V>yU$Oi2d|!pGy>z-RO8i8JjD7lp0Smt9h!gS_t= zo|OtMRy1sjy3N;ApTLwvj$3{v3Z|MQVl)SPX2H&Pd}$>7BSrTVgwmvvr@APzXKXGg8H|)qm?RR?RsK_q zoI}^ob8`Y5holaT!G`Gq2Z2n!`7(>;)3R_97h6`m!@O{tGHn~4{#=Rl`QGLH{;}6; zGQVcL6<}Q>60{rDfv#wUVzVARJ2$#KOmOAVB)F;$Y~^rk+CNu}Uvl#3^L1}0$#ih` z6%=%Up{Ef_jRA=w8VU^wIc)wx=o(f#yy_uv-VvC3=uQ-lo?%+l+U4uuBmG0QiT8b? z_c7{mb;9#v){(2y#CDWEU?bkDfP)4By77jPDz2 z2&vW4L59{^C5BS@w$i>uV%HntmMrRu91#>rXug;+^?DC35z9>`QF6-8#XeaAemXo3 zI!-0SAp`QT#I=IAVbFjlz-5Uz`@=xs``eq1B>teI001^p>TSPiefJs?5aV~f8lQe) zo$Tb%E3=JFk6pVgSrulPqdzh9!_Q-L7d>U$dBx}EKyG9;)?KF!hJK4b%ZoMQE!LC) zXACk+*{dj!!x0N9antG2bS%ctDybbK_3b}6O9rlBVWqz#2A?pCp%96tu0Fw7@z z(c&i}D+R|h{jL}BAK=$I`!o$ig>F&LH-sW+>f?z)m))+X+at83%Gk+)g+7i$ShCb* zUrijT^byhdS<`b8xb?hrvXWOI>@Y6gN_&=W{deq;ebqsn8kPo6Umjp^ZS?gz^1*Z~ z(zPzkap?J#OaKmYtryGr!0)TYB&E-VIlbs)7fOC3*_xX2F#~F0ZunwGqrU*J=O(Yn zRp}_p%Lk0GBg(Y*@aZ0{ll@fb@4jN)rKFJONm4V14c+HlZfB!_YEwdF-&;?&=8u?N zX5XA~f#rBw(GiqA)FY`tV5;so7ADSd{dyW=qURTMswGtp&X` z-M{XYEq`IJ5!}+PU}`QH%%>&2uA23?FQ?zl`?$_`C)=~lO#X}$NkYsKcCJ=fZX6D? z`g*HvY60y$%&(@*disYf>jn?OoSx*>15`&xlZ!-8qz#11e5k5{v!PV=%yz48bya z!=+hO3@62FB+Se>2zrKz>JAITj`7a$`6F=+ZnO2Ri#xr^xiBD-h#tUqYv0>#sIau5 zDnDY8Zi}sohxeFIGndmy>qaj5=-s!2y7_k&Emc-#o>h;931@7ySC>pGEVBgHE6iOS z{##nnLuMG=*+zOW)|^2TNv1=}{G zs;bTvAhVpJK5X%$X*L}naUic zN*3@KSBiDmO#^+yZ1)Org)lf&S#CTz80|;OzN{*3^L|<$;ARksV2z~yBGeKZ`(1+k zA^na#j3NEksNN@Ae0;43*J3Oup3Ib~F2`ovREB_v5nXN1y`<=Sz1B)sQ>As#;}`S$ zSkCBNWUMtTI-Jnd;HM5AXZt2@g5jKoasm~%o=GKbkA;NT8)RxnqTpV;+ zXJ3mEow2u2{WX020ieXbUw#FglQ19@dAC^`3`;1!xVAsO&wF8=G{43SZrtH-vcgU2 zXc~w4vXooIa~h0U2o4^DE}^`;ymq{2MasCp8x0beGs3QU;N2r)rT3{Ow(gFn&^cJ| zI-KKy3QG$2fA^9&+fV&M17+XWH`{BW7+~DG@4Y`#9Z0kKqnFVa4$W8c;Av!zR(N{N zd=Y&b?B976bqP?Ad_n!ivTP!c=3{v8=rdl7C`3uOCo&VU*7Gk<=hWOdOIy4TX1KgH z_!_I+4{nu`D9M%B5-j!l>2F66_hhwqV@gTB8h=W=n(j)XydEn`3#bFG9)bh6En+PX z&-`fc>la4>(h!tsiFSuCe|8b^-=1Qk-`$JCc+p*FBvp;tW|xR4aK_526v>pSx^-Zm zXL+2hM&YkSDR#;|7h-lUq|S$)WnSMZw>C?n_H>_N!%i%J+hgP+WBRo}T}StN{Fw$^ zg|5x?u%yoSs5)q=9mj>!BgcJjzdN9NG!L^dREWI%M3h(6lTn%qN^Wuq(9B)MWhqBd zSun?Yeu6)qjME2BKvi4sy0WPh?0f8v(n?YGSweq*s@MVOLnSt{M_wyE+j!j5E2p5w!KLg7{JL#i2p!i&L}X*X&$fNm8pj7>6X%J?)OMcC`x)1$c*3|R_SJWLx7XS z9a1rMBr|$*`9A#P(|+N(H4ns;F27aDW5-A%fDJ@pAI*XMIJ#QSd_B9?-h9TrCW~+< zA0@#MA;98;faJThf(UbW{M=JMybzT2iR9Mu@V*SS0V}MP^ z$d)}JsDN&3_t(_726YT=PZo=tiVnrS%4g-6?NjwA(i_X#M)A1nR2HHSRM`8-!Cde` zv-AVoPC2wPj?)!MGMu~&V26^kDqY0jwPbfjGK@w{Eyoix%XEXBt)z8ZEC!(M=c9DR zQ`-g>+O;A8uBX1MsVER;t^k~)(b>(}4oVTcai3(LZF&Jq5QvKV5)Z#=8`mv2()^slQMNlywz{+0Kc zFaqnL?S+j185!FZp-)zmT4j>?^w!$`92hW&&mp+OE{rLv_Y{4{eSd5Ge9`+)`i?Ri zdbx8D_LeOcM6BjN;2>BkmJ%PBPK9<*Imo?X|Fsea6jQ0SPnWoe>cECTo=6+VYczVV zOa9Tqx_m>}JRp)|CW}FBdL3xya*Su(w+s#&Q0H&v_}xp3;<--1a`LwBFB0@gn)Eum zclt6v{Z9;FUebHfn0i+9Gj(3v=xBV#b>*WQXtpC&?5$Hn?rRPb zgxO4k=4`jLfeJnYFYlg<0M`a~HJCTmi!y8+BK^}Ott4}Og*?mKuvpzU7G{yzu#=`T z!g}VAeP(oZn6PJ_hckQEUM|kITxB(A+P~T+)YIKjg;r1juUq44NwtyIpvKo$O&Mp3 z%mSH);$0z(;sMUSedL&~-doX4AZj2(v6-Uer7ohMazxA^`P$NI08udm1EFLLX5;3(CTYOh0DViZXqKnkch8qYdG*r*S-N(hEu)nvH;#+OpB?p*J zc}J}i(ges3;M~Yv@`+x+5yf;4QP(Rv&A!h_4Rj$4=RMsm*;ifl@o5hS^%DYICq_Q_(;4$UQPhsm3We}US&kz3(WQ%g};`Z7A_=_ zDD;2Sa&N@t#k|o$R96fgXf=1!&Cw$%zpnS->_K~;GuR!DJPTq;NxZMeF6UT6e0C#w z?_!&1!lh&P8f5uIjIr+!IY20Y@+<4aQ9!QtHL6UtLE8(-pWc_Jn?nYuCU;8A8;jv(^^5WSu?B5`ldpw= z|JoPK)u9|eZ{my#KYwgZKELx?=T3L<_W=V$X+I)(qa{$ei)wAi@5MMhbH-ckk>$PG zV|YQ>4DZW~yZxB%bL0M_2EI&jU5OJ~h5->F%tSSB z!pN(xh~{Vf_T-x#H6Ffa$+Q>K!@GsTAZq5!6k@AmygAiehIc!T(XG#8?qp?@t>>h@ z+$IpWzGO$e?iQjvHL>*sg!&7S->)++wM~2^WLYJ5Dn$vi#=8wc5~3F{b*r%TOvO?k(?9*I>+x)q z-Q;ulBBfy@w2&WJQuQEqO+bG~OWe?bH zt|#%Y&DHGvIb$p35LDewX%#D<36n%H_TIqCr*o;3MiG82twfZXE(gDtGlxq5@)Pe1 zZ*Zc5p&sTGn~FAa^+$<-?{!ayH!X^{;uC-DUR-sEJ`LApOHtByNvjS0_s-ecK$~$4 zoHK*KDP~ZD7l`8rg1$-oy984<2u6xh>0+RJxTS?a)CCNyF=JSd-;n9WZD)3dsiC_U z7GtyzN;f5XQ@NMGg9~~MaQJ1Llm!7{po6IU&Z-I}ziJ7@Wrh0y6Si!kfei@-(D!}EHQ(fF z@u-kMjfnqiKRCj%PXeHUw z{81Cj{p}Eku%l1ImTeM4EN^;dF|>#7O7KMu6-dl$&4M}qlxBgjBLFj)XC0SDOYY1* z^W}#f$8IczjtXBqGm)5|zD$)v5u4uga!2BF<`2VLAh$(2yTZRQ+mE&5og=QiH`TT} znfsncOp6Qc2)&vH9%jl5ta@AlTLWIB14HJ02GORA!}9p>IoafP_tO8PownUY z`bqS2I$J7F8?hy6n0dTx0=7P6I=kd`2 zhMeoFjjR`p-#E+a7!4BzMd&A9UsYl7qL^+9Jk04=~ujuA)uc+oBhc@xRlH# z*>;RPE~s^Z=kmE(nQc6@l<9Fz^$N%S+7r|fBUK*Zw%Nt*yP012^N$$FsL8VoP;_7t zToRJHbELPx0jLdosR|HiQ((nuR)%*Dq;R zgmM)a>SD|CM_WUX^JCtmPa^zqamzxkGi_7t2ubwk`Z9wVGG;^*7J#$GEcGXLcM8R0 zH>aLR6IPoeb)6kW@wAhHMl|?c$JoEd+tazk-|6L0SHF{QV=M7*m{ZEIqjgmkCH9j2 z#{r4ubwQX9jKAze-Zp7u=n4+Pnki7T;MNe^pqC9JIcX}S_NQsLk69Y_+1cc{kHY9X zG*futkQe4Nkyq9r)iBw*9kRT#jGHyYH{-1$!hofw6(^teV9#Jl>);m|kihxWT^EVv z%O8mFaM^7~YzHGx>>=KW+C{xzJ_?&Y9?5i3^HQdS+&S^K!(~0%u0b4XB8Y2r1qk;T zzKkb8Hs@|4p&A${#r;~sOI}rg`XcAlUM+{3xLpx^pnP!0K+U62@bpN(q=@fWUPl6m zW-dj5-CdP+exsIbuvzOF`Gs%&i`pcv|F{9hyn4hPlMmtWYEhG^cOsC+JRn9iykkWH zldTI%5F^MRdO7Wh>ULR}e4A&ex_ih#Edr1!PE1e9uN$Jqb(yS!#Tsx|;iw@K_-$OB z`k!+sS7Wj%{x!wM5t>)Ac$EobO+PQw-|rHH?U_TUo3Cbu06K5#=ZV{EI;g$-fw1mR zvrXcbFlZqmpnqO=eI~6Ob5OCVr#Ur0~L-puaY z+kJ)D{yjU@sjNU}GWOtI;_BMl#ChQVHV4;NCA^fCpgkS*-ChAUV>97EW;DW%l)!?c zBaQR#k}}Ug*~xby1OQKJP9a0h)i~?uq{+)qlvqD;bp|p30aOKwjo=Sc<*XJRkAwB> z-WFTOEnB9|0C3m$U(IfEULQnUOvk@;OrJtWT6pS=kt2bOqHsRkl1@!kD~jM3-F6Ua zt`-P;sV%-dq@ubjG9V1KQ56Wb*|`%3tW_d5=W8_Fj39lDE&Lp~H!#lezV3P%!Fkxz z+6@-7dl9I1+TdAvzu55mpRW7ftteRsIYqf3 zfqK%R-7xnMK72HQ62w=9->`0MHwU9*4KuzUqTa|XpNiheRl_S(jpOMAxYIHfo!IMK z-CcvPiA|$CV2z8wU%b^HIG}r9+6pqW4>YBNqApXROQaSECL=;+Hy-?dyJ$SpzDVN|l2IUyMUE4KUlBe9luq`AQ~QNQK1C_V*xg*&qI; zx||41wLW^}Efc3vyLU;ct&}E?FLUzkqF*_ z$SFegPIQ}lz~0OAcdp^xWiSY+Kfas=@f2EPH2h3Lw#~gpOHiL!RsuJmtKl$pP}?Lo^7q)tIvu)QZ)s((HE$(*ye6USA@R+O1ejQP7#;L@lbn7-~Dt( zwR6`gUkliSik8{iRNl*AG$(XRa>TzRq=x(mBLIo3;y>9yI6U&*b$t|>-5?o%j%in{&-;-rGBIBm4Tup)OlLCu2$Iq)864PqZbnd$9>3wxxslt z2$&b0f_tBGaDQT!j8sw30_LGs8Q!bPh18|Ua#T)HQUZAOcOShuyS?i`xS#Pl;eRXpYxZq2L}>*gKll75d$5*DC=)43g4{w3uSQ3@B9 z;PM-68(iW*A|e$!A{wns+Q8e4WytM$<`rxkQ088N%B#7Hl(rgb_11HZs{Yy4Ei>c_ zxl>fif{6=gsNOlbBCgkpL-i4LG{q6wKd-d^sA-BNFIarUQufbKiUq(iUiGc5x@P5> zIg@^!kMvTW$tHMzfO%0H+fR!%_^Dnq>jmZ4F37YZ^c1Uic-C- zx&G%nR~;o*3MN)h*>8OQhFC|p5tx3n9{+?dBCGi8v+M$9=GKV6R`7i4AbTvJzxKSv z)ipJ>2Dr~M{^i0k@o-t2mX9-aA2KywN&Wkj{uE-x&XfpuApzX8!jO$+`wKj(|HpoytPDx35Vtt!YIio}tXPX{Q$ zkg^W^;fAEN7Ba&Ew;MPSudfDwZ6Rl8eV43N7OuA1f#jO~j^vb!4xV`5UtYX)#u=A1 zZRx^BR*z~>9{sQ|5VrIJPZV?BYQOYFJkfhz|4gp-f(ayyttBL(!T{JHKDm$__Q6lt zzV}S%ZoIavWn@Hg}n#^>XTGr@}x06D<^!qw51Z)TCaNKx1{ zH6l(6PcEf43lwfTn!(d)AGw2eKr`v*2iP z`T;+Sj10?b>bCHm9v`5kR?NW+Rw&kLNHO=c>cYMQ>_qffPqB2`U=`Cb%q^yfvsUZSae0 z^!<=$^FkS%(lP#KrGNk8J;HNW_bpaea*uZ@!%yz)?b*hF?~9b-pPaY>?F-Jhgmei? z(EaTaGck?czy-XxmZps&4BcsnS~EX+^eQro9`$inQbewpgc4cVUX|%t7CF7)Wz(Gm zFuqm;!p%}bU~Ak&TLP=-CtDUwRrC`BxKB~TEJw~b&mtt=qAmm4TD`B1|*Q2 zKM9sopAr~4cS+J>z#uk>Z^c5z1bMonTrZcyLLqC&%rS{uF>vS$g!lsN*%j@KfvqeO zzwv5{>G8r#+2Ti7mGDTxUK&AFkAu@2*L=N<%P9ht?&JM7e=kC8bJeY9l3I~*a(=g? zM$*SHy2d2+%y{ZrN@$q>#zNVQg=0mc)uDN$7Nf(X23k^-m!s*JlcB|ZMJIwzv^7oW zZ}tFg%i7c1D8~P^_<8t&J+Mp@U;CiBd@?b)Vq`&(3rW!Iy!s61Yvbcth7dw-_ zLd@+$h`04XG}4C!YvBSp@|&-wUsrJ~o1uLiJn{Efa zSBy|V)t%n20;JPA)3~_ua6#v2u#(xoTSUZCp?nEEXhnj?vn;aAC}JR(*RQf8wlhD& z`_qF!xj46mjde!+wjKYS)%OK2>T%579#L(oa{*MYo|bqDe_328r~r0Hg<>C z0}3o$&mFE{cKG~#Ncm*G?tN8KQ}87n-8_`1MToV#bb0(llfIGN z5<7!{ys?9Vs&)Idc{ijdVwlv854!D1_vcp@&+$E5w#4th=vbG)tFTUt$dtx-yc1S0 zmM@f@J=hK#LHz1~zK`pX$&f{q#Et1|{&>Nns;YP6#0DV2YAyPVMgs$hcwQ*+il(J` z+>btbGND?7pSmsPC`Zy5A{E1Pz$CM!8Pa9kw z6qUVx-micP&5h985X55(@8g(iYv`khm}X76P*jghSeO9{Sp5h!3?-?~?r-B_LEsQA zItM7$0?Eg~U0VP!SZ`0KXf8YV=&^WjJJJ-ng>x9%rJMjW%?=WQdZ$K$!^LI)j!0e` z;Y1g47d5U>8VtO@$mfYpaz}he0KoFjr8x|oxNpYx?~({{T;UY~I3z-i5fTHpuu?~| zd9{V_&!ORvr5;;XXmC0CNmtYw+9KohLPxlUmfGGo)zN6Tf}`sB5X_~+k#L;UD=OK3 zR1{y5grzd}hNQLIojoEsH!LyDnG|-XQZFVqvo_?@&mas{TQIh=x7nkc8ER-IY?;t6 zv9}OKj+v1=D^mVDibv3O_R^9}L%T{?Ap5szw7HlE+0SKmQa6%!6W3{m7Io=rvpL6^ z@7WXjw0D_&!-w7lxznJI(+t6SRI}oUH4gFMuyy7;wiXFYV8sC5WIrBJm>Sz>-}H^| zTCWkosUYjxSZ?N8b3#j%#T*6K<19ogQ%W~gbVRO{M52GNb)8L?X$tD+CF(d>+tWtc zh~_TC>_m6f4=>44lz=s{J4^8K(30T)(Ke6(SzH+&d&zWtjD_0W6zzq=*oN zg$?w#{wMx}C+W4Iv_k!>j|zV6kuFN(LZNo|aSX0Ik1)ch->f@5|J($aGV%)Kl~k%A z53HK7TW`qo{L->q33(;)BY}$P6BkhpK9fg{4_XhR_>Ybtp@uzjWSy_3X|dEO@z-Ah zgOeXL1ur)IL^UglSOsyv{PlrPAEDxs#;hV4>DISLo|K9_ll|$+Hj<*A=CiWC@Gpu` z!@t$J^=4cxN?*pmXz{Zl4Ke6oZk#oxl z&UAi#J;c=~Pj&pSAvp|}`;4c}+vQBPztUY3b?A7Mm<`B5_sidD>tRC9dA*2N^2@kE zha)}aM;v5EmtCCLT6iUcbn-Km*(H#6@_CA4+W2g4rgq4t?7f_2LXRbH`ncm?)Dkko zB}~V9C6&`t>XE4Xn~0&&oy`)`*^<@B3Lwj6z^6_H3Gjw$eS9)9W?y!P<+?Tdu}_jO zKI*_!b5ubKdJ|I&=e(z22+ zrQBQbvtChj*o|+$_q?5*zTF zIyixnz&FvSV`|!+FAniQ_+eLn(VOkR5_nm$`Oo>PISjYdY$0^OWWEOJn>Krh3K-^e z=s#%Jzh|ZCY))2=UBS55iN#l$>eA?l3 zQOFucjbmZsN`^tlGA~_WR5F8cOkhPTNg5?_}q%#2+zS^rWx;)B z28PO^yID%L*i`zR9LS_%zPEqo^C^zIeRDwC?-GQk;u!cP&JMv9=k`7_rrJl4&|$-L z1l_(8E(fQLziXm~vii*YA+(=#p>A_&`Y6-aZ2BVGL?nkPDT<%Ch4Ub>w1JZ$cLk<2 zM3OLTr-`wCz|sn%(0|ts`55ZACN@F*&O)?NtQB+gc8lmI+T-6R?8ZugUKQExs1)zv z`MIK{y@`YDQs&htLzd{Z%_j(LuiBwtB2VUy`FtRYl7&J5=4Rkk=kHwG;j1UMAkeEZ z7Y$*A0Bn~$F77iLA)j6h2oHywso%yI%iwm+Rd+?M&2Bgo5R&cH8-p9iTFO!Y!et#2 zEhFB}hgWxbxvwT4OUr9H74X2$M;<|Qwuk0rx=IBpjQ*OY5ljyZ3zDn%3StW+Aua52 zKZ<81{^LGI{?pz$s`5-i*wR7L-NKY5Uyk-HD`~`svZwJz;dsJ>qLLa-!yJ!MWjklb z`g#Gy+g!(%ch_z}<;V;&;|}uh$BWB{xV6RL)z`PvB@+mGXfKI>BK95iCaVm^HyC%` zJ9pn(8A=Gr{6H!q05tl9k4mEk zC1l7VJsx2oD4FNING4(2_GNhTWewMrh%6ZRB=a~nEACbo(VjW9g=JHm5v^Mh$R7Xi zFS_tp9uM7bLbl2qT%H!$t1buIk48D~US)s~lBc28RY7M{jZT>!@ga+ic!A=dRqq4t zMWUq)49%lDhW%{HW7rd5E;h&o4p3V)Hp(j2h#QQNQdFNtwXM!UZ|~8AFjd5yT-Q(WJwp(9vB|7+W1v`7o2yj}RG$kdC>_5Iz9d*q0sF zq~fN&fnUFCpErB+)O=x~;wA_0aMe@a27Hq5ks8 z_~VqHRN2huwuRMoQsO8r5`f2~@Fr*l9nXh6C|0^0(xS--OZ&JTyHePfmPE~0wI|DD zYnae41AG1F?(5JJ-^4cr8s2_9NeKnAx*>6B-F2xsrU42hb}cAV(lyyC1Ug0WemV&) ztg<`{Zs{iY^zW+J*k`cIJ3s#9gSlHU_nz7DNXS0w5t=s^wu8!ZdMg_apl0rNz0Z8bnxO^-s;4U6Qetnac%x z)0Cx4m203F{xcj#N*NH!FBeeO+P*)uVaiTIPZ^`8N=^GQ9#x;o9yX z;`$g&T^iA?sFLC_^9sYIaTF)T6uR&oD|r(3Wk6=LupZw8U3|`p`MT~^iRJ?EL^>Z7 z#?E|)GWjO7@v)mA!vfz}Ys-t+uyJzea;#qI=mAPgMIgKjzk6%2P#a9|)(spTw2M=* zC3y55PXkTI;x{u?0{xhcEuP`OPcq87AppRt8nSPdTf+iUhWtu7L<~6|cvg}e8$*Or zhIvyhZS)P@9L00H0>R#9KOZ}MYxyZT@$&o2w5Evv*N5=?d~9R~pK~UsT$_ta7`_IJ z0NUMdcCH_}4Hh17urjb}^NuW38GOi2ecP~_73AgAYCG7POvK1y|HRvfIh~%>ahB8N z9s1*Lx;~_(tES@G6XOZBZU>B0E}enE1Zq@n33+*WQAqJWIqHh($_p;9da^&2Jwy1T!psHAmOHXO--q}=0bTVv zGwS0@q!deol}MpD2_0G_CN8fK8d_|F<$6C?IO>n{hAHye$+}y)E+Eu+pKPB-4vQhSS;S*{cNi6{obMm&3&=N2$1BRtTWvX-hOa)azn3){$ zmIjb%!Wg0JvqjdMqS6(^MvMga|N*+WM!9j%sn0y3~$5*Vxmd#1k!?t%V$cm8CEd+~L1P-yS`rFVoH?Kf5S;m_0*hOSD{<%K zL^N-0YDOsCfL^G{TgDJ?Zvr<>R7S@?-rbs<2Jpo_KPsu(Db9=ATr|j^kvft5_9)7~-0Sq?+W;Om6VD!nfN$xqI#QueYDyLlbwT>4ka4&SgNV9x$UmE)tsP z{bve1TLy>}DCuqx6bx^D9Ezf#srMKp`}<%R1byrG5l^H5O9ycs1Oj6kn3@DJ1>mN= zgGKf{%9NPB!)290+yGM(ATj}N+c->33C^+wGRpv2c72!%rX}roZh@?#?E)xq5U&8- za`I2WS(OJ_CCA<&yDT*Ua00hVAj_~1Xecp2NkaT~fbSd$ymS2rFHZI=#Qh4Xw;nU9~X+l0^j>NzylrLnZ9 z1@B(ci47yuIBih}CQAmM+&Yfso%J}ZrxDqNidP1w@Z{Dpn4}#$>@fLz7G+ZT4jus9yxIE1mHiJ=0+uU;C&c%h66i=(eGg@vtYygr-<0eIWO zHcS+C{C49o%DUlszo#y2!NKiWJhyWKh89w0@}yw%K#gliH**xN#8S@9JK088NNGu&(tk4M)X%|0X#!90T8EM12sA~Nhl4N_ z07NhNxhKUe6IwQdgxLnm8alz4)^Bh9Q2K(=duX`#q~4EPOU7t$!{&=DlhoD)bDW_l z@YYpM5GQfBE))v&k6ifMFK#}ZI4sMbfPeAwFL1-tH=?z^4gav<-T1_DAIH(%N8!xg zf5dlQyA@?kK}V_`$Mhb9hIl<*9C-;Zj=cm$QNW2~Y16@2-ntAiC5BhWUc*acFJt4x zMoi`=v0EPiQyKE5Jm%H+;i%5HU|OHX3nMS0yRHW&H}UHDYiLO}8t4yIg)s16%k3wCn4lj(nh!@9RMqG_yY13jf z#vAeK=xgYz@4)ib71%tn8BYwX#e$~!IJ)yFkX^y7N&Gw{UXL2{^jrD8!hCqgsyuo8%ZM z?7`ytg;>_Q6!r0XY@XPPrv{#eMHY@~I}&g0IT_h_7Kb!0!3iD5V7xGf|Jw8brph^} zF%_k90rjygPV7Any$y3QS(?N%gU@2e)J|k#DXeH&hQ@dUULJlGbDQU2dHZs_F}exs z2cChd5EMl|2IUV20&zmTwF#EVQ8vad>OMI=-MhN?b31=h9_V^s)A^Oj(oc51_}VF) zbJTaXf-FlKfAX;>`(A~Lo%x-3bk}1zW8pvH$c~k`f5(5JOl2%@J_IpE!`kgn;rZd` zk!jB0n9ifoU*CuAx$RiD=NaTGIdr7kv9jfGjFv_*txw~~&Li>co@emXo~N);*@#h$ zVtLC_ENff}0MNOCzRtPWV-4ZSp|wc!6ml#N;)Hy03cYo`IK1sJG$)&|GrtS#hSoy` z!;!6rV^Py0FaR$Ozl@j1UPeMo;OO?FaD3-+sEgNOMe{O@8lxD~$MEp>hhZ8fEX{;o zv5!n2-F74vH!p%=8u;_@OV~KR0ji>*E|$Te?aN_V7B-DyZREmxm2>|b_Q#$Q?JclO4$GSOLf41W(|cYmeVrboSLb{%eQt3qfBTL< zzp}Dt*}ZX`>=U(3)T&-M^P_$P7i@VmW5KKjFg(jNu9@Ie#3n1 z$nC(>d)A?#Pb03z(VOYU@|I<2Nwr{CZnqOx1c;E)(m1~R81&W8#bjj)>ju|jPjL?n z%fS3bTNf|_)(x!38&jK+j@b(y-ux8AK(d#r>*PpmYw6=4w!+0N3yR8+>}UnIOwAh0 z-O&Bvy3)Y+rhn9T)$o(UH?*DKU`_rsQF(DeWzJF{l?8aMovB*R6akh6SOyqb&@0mz zd-m%{>e~@N`fAi4bQX|37$uz{&L)A>Txcza14;tM*o&a)O<;-&0-)9}h0?GHi~wWu zWl(-I)VldVq6t>+4JgT0s7=dZ6$W69t%t&Fr;4}%CA%1E!(xD`FsEJz&%Fu-1jMpX zn+^xJOz`Qgh_xOG#M@wuzW@}sf7QxDScyffY+!x6iG9%ZG-6vS#H5dWe?Ir0 zJBi^%K{o8~WX6yZp8s|`!b~yeXVcIS_;d{+6`ozPo9o_Q&%~;7=3Oy^#*R4CANqo0 z2UYUa`QzE%)Qv4*OjQJcch}YP(|;{z%E%JtTr!1KwJn_R=-2$<*dg3~#*wUR=)kXg zIHEiZz&{u5X|+dqBp!(p!b51&k#b1mS(UnEG9H%Zvm&A^oa2VY3uUiR}~e$%eHYo$~v z8&!i4f}U_CAw(uDEc4G)iRM=cg@gFK?mO;j-Hk_T+%Wb!emLwLJkkRStZrVzAHKbv zX0w^wrv8C*hyM^2mG)#iX(vrdpoF^?-a}KWiN|I=!ny++xZ?9G5xV61G1oDvYy#JO zavj}zlo!r;mK|+7xoF-c{AkEITrlz{tZQ1&go^PrbT+bV&oXYD@oT<6J}v z|0_b88ydB@yO!%d`!xwC!J{WUg6&xB?W$#b**H9!hdmv8x$dLuxqjTWj4vM#z`0|8 z#Q3Ul-16D2TsQMNrdLlzIucFOcyRthJig{hBEd+X+?ntG6S%tk@<8!{?Yn-As!&{0<%Z_wEN<63QOVpQN4Uy=FGrKvV?CGV2zI!6 zVIpJwhm42HXA|>Ad4B8j98orsAC5YQN#zqsuQ8c8U;=-haTg;BMj#zYQY3kN%~L$R z@fofjet)%-XvWK0FbGyHvz;d|gg=}B; zoR+&3Ur&1<7!Rja^TopxU)FxbZx;NPbjBkkr68K@=J=}PxO3Va3=R)Q3Q0mFd3eR& zczN5aTr=xxrj}1(&A~McEf`9Xzlf+A<((bxaZL3Lh8GM2;EkpXZl^7 zH1I@(aPwh5-SZhY%)g15!;azBskgADWg8wP zuQf06S?w1*ecBV~=x&~(3a@W^lP6a{#qCpXWng#!0Kb}X6_e^G@XqGTwhl;D!Bw5(v;7K<8|aL(`_Fs^JY5j9Mk)6T?_2>^Vy^K(49hrdj}hZCxg zca!!N$>+6Sa`VF9Gqh|7f1mX*^_}%7Dh!DX;rfqn;D_VRVdj8ixaO1VIAQP!oIdz8 z08SWo98(5P=9aH+<&tr;8C!ZZSATpRpYH#Z3y-*fnz^dkNq+L~MWh{* zduHCrS;No7laUp=%r2f;{Ve}j^*94cs(A3Y`_WaM?X5eQR5=k{(`o2#k3 z1ogmo2XzFgJv9polf+Fsj zemBQg&q4};RN$lCAM?9~H)CeJzDP)#aYFt)?wa~1PObSKicpY>*tdY+%>NyJUw{W^-Or@biAcxwT0gw(5guIoFc%*^n?Fpwg<@YZ zQc7A=ZQQx=ES zeR)4MzKXtK)|KAWvUJPc1(ywRIzIF`8zXkjIPiL1h3Jq6lKl?#e`uLe!g@{TAp;@- zFNWWhN6ha1IPq4r%9HUP@mr*?3?U@m!7*Z+9zpE?2;Y%6pbz)~j`V<{ArCGgvFc_D zkG>GC^jNHpt!RNtG=C9DL1OPaSX=*&M^n&;UxiWgBcv8U0){Y2?EN?C%@5)6mSG(I zM2L9*>hO=d9dE^n*g^$GBUSe~vE{!dGW`1l$NUbwMMxp> z4eOw7_5E1;ze3Z48KtSm1tD`pVHY$ha+gBr!8A8#l5AW5o;~~lGU)*hwyLquTftCO z6!}uozb?Nsf4+L?>Hqg1<@7tNklHNOtKtg>u^oYMgeznVfs@&U5I8+;PG&!ItY@=r z*K*yn3CFE0rXkU!%tqF#nTjte5?xUU`E+U`27mu(CGW4^O+1z6_PI-#`Nz4O_TWc! z#7(Z6IgBwSK9VWZ4Y5-t(o7;9fu^bqEebMc{#tH%{aYL<`O(;FMi=OqsT5vKA)rY_ zDv6p2Eg4ea=ka+J>PLa2=}`GX>;6brO5d|m_6lXsQh_&gd@dd z-RH-jA4J$T!gg_Sznx6EWtXUr88m~ZPkoa6XWok{6rNx5A`9vlaQ?_2bN-0)SiXBX z$2@T?k1YN>lgcM@*1$8FQ9PaVhM!9;5#yE*Zsn;(PZKdBXsQO5#IYPass~+qu*@`$ zZDFWhG*v^S9fa+M&UvL5Ct;yVxBAe8(s8`A`duEG{|K{3UdTB^f55wI-(}h((|L96 ztDG|UWX>LN7Kx-=@o!MxK;|xclSdak2EbXv&cNz6xn}OQGjC(D;}_ia{_V`FK9*U7X0mDDW=?tZdz}01k6F5FDFMZgv}Nz+NTe+ezghi{x#wa_ zu!LLg+)<9KM{!#I|WSJCk(8cxb4Bm?|*;*C^>DtUk1zqxeI-6h)tGEA!)gKRe$T_{o zWnX;z-}|t*=3*31EqHtQxsT3#?9LGjgR0f3x^6a6nB)VQ!uBdul>8T>s9mIpNt8X^XdUuhrWIYfOCeOjb^Gm@XZ6nP1lP4_%~1R?wa?o%rt-d>TjI(^y!@Y z(s>;0I>_v!E@XIc7!Q5@Fm-Kp0KB>4P5%1n12}dj%-B}ZER|cP|BfkDlbOF|K0kTp z0{*%1Sq9_};7`Z@k!qs~+qTd(ov@O}EpPmu&o+HVz#HJ~5ocjII(FJR%$Vqlt+WKf zmN=HgNo5zKK@BOV2t_UN=jY=wbZpDY(5FkI(&;;A^_)_=<{#{G;F2b{ngtKMY#KW6aurgu4Q$f1!yx(*DGbeK6yqgFcVXhi;B_st8E&LlT(G~#ywd5t9 zT=*2&5cCA`seV$i1eY8!n{!6|fPF3d_~oltaK}e?U?>JRO}mjP#gm97+_2$7e<4lH z2f6n3>!@w3r8->2NmVD3PNdvE{NK{;|HzN~@?@Fe$-=>L@MfiH+skP}QS$?ld{mEy zlZ&mB%acVPd~@4e{%g6RzqZrMpL5$BS8f2fcIq{}apoMZ9(x75n|Jfbw~x?fw(+a6 zS98LE<9KP=OH6xoIv;MG$JxWb&xz$H63fuKkPfMIip!3;gfj-8&O2+~VcOrP^V+)C z`QG4DID5cZL}T4NxAb{_@Zvd~@#2}RXWL^ z$2Z%*W=z3R+%f$&bfI(ZbLVpIOFt&)3Gmy=zad}dkxrR?vFYF6mdN(8yD$4;_#N0D zvVF&Vdsu8GiqmsXiIhs(BNPF!>X`|i>M&=hn(B7~1#WRY$3_tXML6yzGv7{T6Ap^7 zv+X#xt3c(*Z$jAU-XO)3Zy_-C3A~l3(7AsD?HisYkXMRvBhY%LV zu*|>-st4Os%&rB0rD4fK2*<`(b1tU01`3bC z7&@C&%4F9Uf28({n@K0T@ee&8r}z}icoaqTq8a&gv^KHpvzswH>(GN$i11|6#&C@4 zGf0~zTi^dB+uu2t<_&XDL&FJ;xfx4%S^wt6Y<=fKPz~}%UxP_L!b;3pjbeNz{aESif&Q z4=s5Jd z7FK4G6WGGav^!b+9AWpt^TUnvxaxzed4KQw%&3{38L)8D(I*iJ6=eSZ1eA>0xVnBd z|5*7ruWfscu2dJo5j?r{DW2W*EUOw<0T5Jz99uCHP1R^iv@w17G)4~?jYM)(*-=E4 z2$o|JPsMp`(LZ>8!wY;{y9j`MJkS_t0{4DPn2j?wcVQ6&a zQN!^^f;eeA!(4JE9yhLMHBZ{Js zr-Tq``%uBCXM(n*J4yG$g4~JJ5-w&=&N+^Y6_)6Wt^FO?I)|Ci9S7;SVZe!|4&qI1 zq`RHh?0w0%0g5iqI~zs35-KXJsXA&H-hdy+w0bStB4d@#gyOxq{tf=M^+o14%m-j; z?NXjx`y_Agew(C~bo2kD4=WSb|L=_-@YMRJcxmTLd{gUQGctcfHk{kEOpeGO!Ki|f zbf!8PSTc~~jyR6AOq1u!V_0w~Nz=_Ed~MC^JhSl`KCAuA#bVzY9$)!5bGFZ+E7gUn zC{!C&98=-aujWxXW$el11@ZtGTRaxWbos-#yT0Yo6_4@C)>molZX{%cNTd?Hwe4-< zb^=E@%-uMbWvxru*0z;~L?g4O&*oRhT}_@p4@Ffd@Z|H(*0*VhHUjX)_AhvM$2$ns zeYZq9#=uZD(+5n$veG>G#e=-R>pdP>@(80 zT=5uW+8r+kI`?zaM>lcb%KO-x+=K3MJwK{c_`3cpRyMB$V0-g+Uflcw&2|%NrYfkJ zHkny@3}J7WCA*jMr!Vi|^8;V-^7dC~Of;}^|4O_8FV~%T9p{ff4=E)@zCuVVytCtN z+EQ&UZ{PMIpX~bt)uZ4@H)J@d1~`78JC{7M@JZ%unZrNVKg*Z9zC=?sj;WY|opf_W zl4g=e7e2;|8(-w>JzoP*U=)BQ5mrB5+e6cbquc&G`MdaW54IAdEr>R@kZA4}c2eHk z@?zIomnR2qQ6!HPR+s0Mj~a}ssTrR9KV#b?GdNC9yXeQWd%s;}%FbHuM;46W+T4FFx&Ir->Q2>Js6Oeh|YG+lbI9h!jb+NvDOkc{aN%I8jVe;9R3F|fY>DVmoN{m@m+#s# zv+wlf$358E|A8lG?{PS+-D?yn5vEPFp@~FG)U-``N5|aMzHjcFrHxGNeIV>rZ8o?dgHIirKtv<%}9)r4c!$sA|7}Vk^Sm_kas~#g1UqPsRG8knz zW+w%u!zddv4MZAmcmSp>Bpp3~M^mUAb3P^2WAMe+p-VICwQFAgDoX7uXmu}>Zry;Y zsyKm>h{z-WTDH7{z3U~6{c}m|c^?H(iYAdvyR}-av`O3gr%~(YU>;lyfY2i(qMb-P zg%QYS;KYk4F0H}axspK1(I`eCcCv%w>LV#1JPCw_uV4_Cr;@a3x_Uy+CbIhy+jjam zYJ}q&pG8Ku$kjoFBQwfX-%aNJ7MabF*g`=~n^dRvljw+c?eA9p_`Qb?CjP&K_9>^_ zIRMrBifS0g71fmBFD}3~t$v|<83%Je_i}D>Sg-rJuR9vZmg}{Jz;>M86~={xjFm-o zS7K#%YaGH64Bg-_XOHEYDZ9#P0e^@01{~j`~m!i53{F2 zon>b&Hy~Z&%H)wGZ2^HGx>qM<3H+LZCLId=Zud5J#6kCgZV=5(_U9_gl^ z`&J&NE$5i*e@>rIf7dXFi862xD4L4hoh03ABI41FL~AdXYhTz^aA{z)hJ4){^pB|= zK7?RF9(F2C|Fw05%rKk`E+1|Bn3q=mi^tDPeI}YxoGExD+f!F~wuZpIt#L}@W&Pt~H9pR8lB|*CT?m^k7f21w49`C*Fd+_*G z%JNGI=2O&+c-v!0feWWxV?uE{Q%WhV*wg9MF0 zrg(^pm9!*ydfu%+ohmuxdALxF-u6D^c)0ref-)yf>R~l(Le9e13eo z;f5JXP#g&9!K@(f(KHkZ*G;{aD<)sT+P!O8wtE?aLp9`==Yt~&X~C>=;L$v8-b`lP z3L)^}LsxZ@W{OU;lY&qLOQwmLF3-}XC)*dMND~YNvmi>xRj@PbUL1;VhScM29VFVi zaJrr6+Lxq$FQpX4m*-s$^6~ugB45Rb8dO!qHhaP;bAxI7(rph-qkwH&EUa6=Pez~5 zu>)r^JT?@7FLr!^CDVj5{XDU1BIC=)<4A{f`_@t0Qj03whimF?rqk}AC{lz+(R$}( zM-Wi`_%cQjujVD+7k1B)*}+DE*A=o4bnhprB#8tfF7NdO_}lj$=9mG;@X7j5*jl@V zF{MYl<2}Q7HPszAx~5}zye|LGyr<^41uFnr;>`pDK{QRJ)9eJmPz}}dhEEU5xEmRw%lDkGowmfS;ymG*hIpAcQWxsR&1Gc$Mxnfs_A3JHA zcvCyc&Y0;$xuyNB#EWx(^dt53V>Uh*($yPN`BjMGfhfXum8I{9{g%1UbBLUm`R%w$ zn5ub5r(*2+;OCT#I*sD7KWE_dYe_6zk0V`tJ>DSxL8l`%FY&HcMEib{ty^ebbO(83 zuP3ki7}V-xNHxxi&H4hMt3>>2$Z% zW2bkJPNneJ?tkd3E99`z94NDu`;@-zy*(@YVtAO3qPPm7qiU#jngLETG7<0Ec2Hh3 z;r`AK;r~Oi3FVYKD@ZGIRG;tI!oj&pRIgIxKC8^x?|p&XyeZk!3Ax8)_H_Ypgj=FH zOCUmkZTCsE^(YFY(^Qm%xN!0yV#ySjJoX7KDL7;5DEHoulNF#O(p9W7Lb;l8xAs&i z0dN;B?Mb4h*J1!@nd&2olUZO?0n@T+Y>xskYjib5d0PnN1vq|GW#%5T*P3vM5|vB* zeYkk`c@J$rl<6P-fYNVQaaUcBB}up1hdF0GTxN7oM%-=JgT`jwqUNxPCyB6}7ukS_C z6iS1ov?bfP>4cjAm|ioT;!Q=A1{ljc}6g9`@p-r9G0a>7u z?=FTQe$D|^^f{9fVXxej-Q-+*^ zrfArX?S|m>j1#H4p&yp)EtlS7>GX&!Q|{aUIm%V<%jWF&o%jxy!g%O~|HUUWX(wB| zNw#-lcRL>>w{m5CORS^l693tX!V96I{KE1PgYXzSR?@_l7C|+DPjdyMJUxV0(X%wG z;0ggf*eEDj3%HV5lgG(evjL_InnJ;*2t~nSrdCY_U{}*l3i1ox{zRp*qY+2C>!tm1 z-tDY8xQ2p20YN=PYr2K2yjKCBN)=)D8b4H2mj-RO-!xUDE7n0%_W?!}59iHQZ}8mm z=kfb|lm*Laj5Tuc)Ys^1bD-k@P0=O>6%69op)=XGYAfRhj$>HKFf7}m_TV18 z6Wl^2np83&KfQ7NIJnkvwJ-LH3P^=ydl!k0E}U-hV%yx*ucee`(WQBpDTpWX%M1PG z!v~>g3YMAfJ2&*1Zv{CmS-REnu;IWucDLbBPCKa#hR!HRWNtW zTwYl9JbuGZS*VPLSOc?$&vKtrQCuFD78yfB<^}AGH>aoir;tcfBGbL+NJp}}We)(; z22W#Z#Z)%8Zz5vkGr4Rs#|$`z%?+Em=;aHUIBX&pOuYa>#``OTi!o5_D@3<7*P9^S zs*CYtjNL7}7+pG=lSZD%H+5f86|83R0Cz6gyl)G_?#(Mvgn~@>Vx7gs&f#bO8@l}u zJXulQ{Eb9wC#lXTcDH<>{q4jZybk4;27a%o%6*ZFVoHZrBZb7V?LLZ950bfjHy7J1 zCziP)W)3gT;mNKd)yv^yPL#Jdyv+$CPT;H~&f@0jH*@`m*V7blq9U(?IV)b}rPVJJ z@cAhZl~dPU$7x5pd2lK!-SIA3Vl9j)8o|43-{tA0PvJ9s6#0wjvbuTkqJLqi26ugQ z7awf@fVY1BmfI%|M7;UDwB{wAU-UdzPQQZNPQRTWj{G6dEpaPMw?*5y>a{Crh&E6Z zEGDQ2Xihid(|xX?E8F*d-?I-y{W0s8yMHL0|9fnO;}CD@Ak`5|%c#7){hh?4%vIFW zkBK}O)YThPkqTsSHHxr6<|=?Wc;(I;Qs%VhJVaLhwQ&>f+=mK?7R1&kF{@|dD;Y;> z=w-wXF2)boW}JqvZ-v+{G@}6YAbvH8ZYOE}WHzm(GZ=X4qxh&Bay}f~8Xch_~!Qm`U8VRu!b9V5c3V$aJ2N zsNM+n{%@$=`T>E#XEE%Ihw%+OiMEx`Q3{xecD8@`Ye?+F<1a$-1n`Ph@aou(=p!!Y zDpP&+jGXrVB67dqxzH-~{*br^3DvO}=(HdcvFN(};)ZDtbk4I&6r5noSQ9#SwGe6)%aU6_{pc?XdU3aP@ z2>V^Hfk#U8%)^9yI@mTokD7S~4J->)3iAD4f`$i=0`D%{!LLs}n&U^13f_4^1k*UUJXUl>I^#J+4FrV!Hh%=Bb1unFOaVQBNV|%5o-d51XsE&!GJ8B)c}9>qYhLFU(|^It5i@!D7q3v?RnO@1 z(LD0`!>rlAhM+fy@JJK^j@8>YKHZ0Hrm1bN1>on${hR?M189r2GQMU4tLs)Xrt)Y2 zmhV_jA`!J3J5d$$o z239iN*TQ*-$Em*pC9~(z?|AMr_MgzCaNY2J-R+CnlP~7{2|sZY{ec7R2e@b6-E3~# zL?9U8-F5G9!Nd!B?5B^hqG1J9kt(({ZsDIxpXTNBU!k_MmRKszpyC=1v>#w=!&Xil zc_IK2UzqI&w(-^WFF9lMnLPTV$M{XhZ>S7a;s|$X18kY~LhxePTW&iUIhg+^<_1`2lXU!9osnHuBuU zXSw_Ad${l1`#FEg`3x-`M#u>9>=*xJeZx9R!lmx}DLRg6L{}6$>b%naN%96MWuoNbz@-YxQ{l3RuWZ-=R87H7Wz$&u(QOZJ?xo>e ze}*O%_IEe3tbPeY$6t&WFN=08VqbS1A|QBm^{b3IeGIppdJ8i~x&2(=jd1bn7iATs zpf`ZD$rv^rm+t}^9vstMv&$VveuU+QEQO39C=l`l`E2tiEFHU)>4T>;=b}06YTJdO z89cM_8JeTb99exN^REAhvQQZTZvfkI@JNmBco+NH_c63^DEFUpKVw#p;iJv-@OgZw z0Ts)#cyY;#%o=P1HDG43?Zx>JPgSmWGRvlWA6(du>v{FMxP|pFs+2srP<`;F&U{y zihRXf`Q|U#)v|*LRpYti>^r#5ypGA0u3~FBHa{GB4p+>&ip6^uF{;EhcCX#Ln$I_X z#S%@s)yPMW?c6!CQ@@ep@O+6 zNVNQ+bT{vzZPVM76a+xe!=oz*>3YG*(3lh!YQY!=oO}<(2UdYmfTC)29o#|d<_{5{GZ}aOQ&{ag@D&ZGWycq^uXqTd<>8h=@5L(DxzGb~-{l?qwdZ1eDEwJPN&$qb zq1hG#Wji7nORjH{H%@=3>tC7sN&xN7JMa7-M#|wo%B;h1=RzW-KnRz?JDDnPZp>ltanW;3itIH~N;izcUD$@Kt143lw8XEHh(-BkO9Sf~ zyYYHG6#EqF4z}>whI*P4f<)S8=l)ho0v^I%cyIA07H{28b4Qd<*VWRMmJ|n7R_|!w zi_QD-8(#d1&EhTfEZNnH$K#=-?EZBCCg1i8#m16#;T2|M0 zVEDWgd0|WKe&%m&WJ_HqYxf=?;?pn`hu6MdO-DS<(KTg!v2GU&H#gw%dfj)FGV`9f z?<%vuW%eA|+upx#`fs^y*%6nssR|-yVzrrwMCTSdHeV_?zqPXBvfxPDuT3Af9HI*cWk4sxsH$)L~}GgT=OBZbd+Ib!&$a_DWB~4h?eeV@;rIi zX^Xi_=dz}LHErE(EZn((ZYxSe%V*8r)hyq)jEFy#W?fg0=hC;PrZmXc4wIY-hpFZ-_bFln2U*c1KyZ zdl@Smm$RmB4Z74R36v7iBkXD1&AfFV5VPYH8O3bayOwWvE+pZ^DGij8jHg(#V+lLj zcCfF#9>3y8lNwEJO)T57gqp%3j4B>UEFR~zZ|CsT{3mgAx5&n!_#bA=VFhMqoJ2<# zcFbO!-f3MPTbbTjdP&|iN60qgr_Y!5!4K)Uml?Gw-i{j|V=xk7WmzlAoWCkdozlml2Ca z$=CC#2vpF~)xj4VKW9tRCWaRdXITDlO8liP-LZuGKK=_ETGlh5U;v3&f~C8cvbAjs ztLj#wIUWM4pB;@m_+ZTk96Rb*I^rF?zH$zRZr~FJtM;s9_5M}p9-TsO5&N3znZJDj z?PjYRN|Zy7eQ@aaj#)32=ugXi+hu<&{}Z(uNK1l46zf5kl4whZu|2~Kp z0!88C@(}~j{che&54Mi5sSH$+j3?NBU@NI+%)< zUYvKClsu7FmLDh|QH|Qy)vV6}n98+MZ20je7)NkgM6)&^5 zeGi335t^g%`r_B9Z?9)h({2{-UPx!UlYK4qM7$AjU{~WVR@N;i--xh&&pMXZEn{=@ zCN|e^a&hq$(b?U>d&}SDFCYDxcBh?4FrT0jVoUvI7Vca~+=^4|D!`8*z$?)J@ew^XIqVF?HDf;p#N8rIjSP4_#QqO{&^XYb?w8mQKh<0Em)2NQZ ztE*mNXVXr1&JI-~O~K-Ai&?aLA$k5h0y4nLJu6v%U>#dqwy@{G9t_2xDp-YLsjS$! zjBj>)&DQ3v6nTpXd-GYjeFgJ2%p;zR@$HU<9PB>GktIhlqF^|wl*wDm=JM3Sr)U@L ztlYa2EGY69QEZgZ&|J^QYv-}AyTM&+@^D!6pLhE6BQ`cn@(KZ z*7k1d0f4RtiyjQ>%1w5D8I)9^%1r)KADK_0NRip3TX^D--@V^tjw9T>EJyJXcLH=Z zZo)dS7{ABCiPn=aC9$p!(uq!@8($!uwsAa#*m?=w?FVVy{yD^J5up*-fuT5BKCQbK z(zxJ$0_l1RMxBc%zlMf2b4exR*ixlw>*pL?{164+B%0MhN8JicTSMp(k|~Sk?O#&A z;C_PXJ@|tWk}^Ph;|`Jyi!fvyM=v6lu;{8=g6Q6hl0OO&8j2;n9N6+X4T~NnVAT^p zu$E*R@D?ESB05?cXxjQIYODcG(=y#Bvz4QzkcY}3!o^T#d0)>s=zHE_G0p4?6g1nW zMz*7-;@uneTQ^L9sQdXt^r1dh*8f(CI_VFkn9A#l5jrtEs0@E;k!!)p+)K(HaZYAs zkDe8(C2j{~MZW9=lKsMA`DQwdwPYYw(X-rb+icUZakW8nDrK1EwL400=z80%KNFMT2Q5DQ+f>c+O zbljeA?{t3AwZ`0Cet~a_gZieC@2@EzQH>GyVOvfX&n%)6TpOrMusvR4nPD=0tv|Bw zV`Yb~nX{ki3n_cRa9I-)9v6M+=JWTFeE^5cXtVHAvnQZgIjP2?(Q?V zOYq<_xCVE(%XioPUheQlR`s;hTZ(TX{7_#na7x z8O+nI)Q0Mfb>{W$M@aR+_FcSE;c6(oc=dn)dE9o|>Dv^BLrU3=sK_n!0CUnk+n*Qs zhGwfNqRP>>RoH5#!@1wFqvfe-s-E9+&(Jf2ui1XgKEljKsv1gu-r7qf7{{jK__V5! zaVinqfBsY(8k$^x{(#=@7p%b-O3X8*f#LtRDAnUz(JubJ#I)6mf-+pMl3a6n2KSz1Sl}end2Ezs4FmC zDN(NQFJ7`pw*DSBx%-r=goaG54lkn^8yPV^l9pU~ zqmT?X5YU>3D=&3{3MbAf^F@|rPE1;w5OMW@O+!(1*_i0`igp^soJ1@eOO_dhTz2G> zswxU%FtR3Aj5KGVs0?O;3`4lSlUN>>;i|kqb~m@3j}RP>8AyGr#koaE`EP>QiMCkb*D+Bwu z7x3VNjjIQaXG67OSw8FAtw7prnT@m$uK^S_>++zieuW~G3X@NgR2i{(Pp;ES8I&*| z<*^7kH8jQfei?HF3>{HrM;7Rkz_7~n%HMVRBj!w129GN8){&(~q{^df?S|0%g| zqTOFSJ@dwHU%E+SAtOu)k}z^f@|om$etL#^+q^PU!zO!`WR6y;pk|zeoYXe$;+mNj%S2Fp}ZqIGf`+k1tOXS*rFBVc5B!Lw- zgk9WCc)tC)9hp&v9+#I9DQ>Ul=n6-9h@&trfPgkx>6atUPUsbuT6{QzYLOTRo<#Yt zZ`41vy-+;G3M=v6WzNAK!pdTqTRiw$c`P-W1(+wJ=2cC zTTatf?ib`uXB|r2G`}f_`@O6yD;;A_Qf-~Sae*V-{IsO;8u$~O^S8iY%wPU+-`a$o z{j>8{O{L{jBAHj8P!fI^rC*5%202f>jawh}G)w!rQMuV@^T&$2e^Odb2@!)qH;|SK z^AJ#4N%C+B&ei@USHyv`xgnaS`fL~)ur4oeyJ`4UI@L=1%V$HMS4uZNSpjR)GEZcUV~wPMJS=qhACFWsl3!eyehhlN zwP=&u3llD_lwu(i=I5hjk`&=4$hp+obW2E`-xG4g7bW@O(gkg!;;Kry!)3 zi=<3?Mx=ElD}^!h^pAqQ13i+6jC+vNK2Q2*xo?7-Gt@si4?CmcPd}EvQrxZyC^h7_ z6TS(#PPDmnbtpPC+^`%|NA-swYj0XfNYbKieO^f$U|}1cOZ)Z-ahv4aEPCymf*-vT zOp7X&VPe|*X!BOJc1(D8K=)WTpwC75?z%1eM|t*>v}TsNm1pYdLBfe|?!I6NSiPk4 zMnH4YGrK&0ha3>36h7pT+1vHiiSg9P-n49OP+fUFA|f*E?WM(GyU71a_s=1`Pu%4h zp?kC~Db+UY4oELy7LuDzP237WE|91S*_c1Pt8>|p@|a|>&+wkQzbG$wRW8!<+j@@B z=L8wZv$DAxv}{p9duF~rL|%JQQiJLP%@*K6Z?bev-uSp7=hxJZKj@`tX+qQ-W}X8_ zYX%WY1mOH%58O9ajXVj9>5HS+n+*Z>3?V@w=>p&UO-v9e_)T)70ZA-W$wHp1xa7#N z^O0gnv#aC|wme?OMfm72a`Q&OB6kz>4#d8B$@<7A0@G}n1?hS*S{mfd9vaL@8g=$O z160>DHX@k%jb7D!y?-CeX!Lg3$sc52c=&}kIx>xToxqX#aoWY@ZTrg0_DQ8cRgW#d zovrVl+)m8H^_EIZjA@eN$8M8&beE!Z$4UfEJ3G#`C#TUe2kZ@E|JDueGUg zC<3XGR|4B)MBK->KS^mj*U@3YoFvopRk%thKKSbi+rHSFVX{xWIiH9X%}Ps`3|a0e zuNAYZCX4}x9_7Ri-Ql)6v#+g3#UGDcSConC@ayp#&ts$3BS!uALYwynF*lWkuK1#3 zV|o}UvUf#;Sp&yfMFdR})y^uvbJF(F1e`+p3q3jdXgD!{{mqKvT|4=_XH@@O0YGM* zRO|>0@$ZQarvVlX!NCN|EO`s>sdseim|0jP@7YZz$y)xPVZe|_M!wH>SQ{7-lrCPZ z$(Oj`qwxKSRM4>^vM+<{toeGf1<|kBdusmtHoD!_Tlwl{Ywu%wT3B^1M^4=a^J{>> z&AIBMXLMTErBCK*P3x-56HW;O^sxgE9yerPlw*J(&ZTYHuiy!rs)eBsT6?m&$F*%) zNX<3jbshp}AV)$DV1MSN5bb}=9T*@Kf>)(>sH#L9t7F2U4014UXyWbn4VEZ>CGj4) zI`z8O`ZlI7?;3JL5H$C1WLLRqeQd1#;c~emIZQZn5u}+R=!6z7Q$rz{;b0c6X7YQ8 zn<&x+3c(AuxE>u7*LoC;=|0KCSG2Mg3s4F7`1W~0(BA`{b(qQp zI^Cs$#%Ds>Tm{nQn>R17e{d?{g}o_J!XXJK`&$#F)nfa_U7~ijunI!PoE)%N9*3qtduKbKekYxMn0K1W%QfD2KIALeIzL$s%;C}ezdHVF_t_&3D zVTSsoP#SdoyO7XWpjmB*$Dxx{na`RF92d8V1X+tv_B*j`e-ri(2q-V@A44c)`i%{* zJKF+WQ~dSgh#M&(!4lZCEYXM)sL#AUaM($Bk*)mfF z=56In7WKo5`Zw~A`LUh7z!WO#-I?!*miLy8@|eivXjo6-<{^T2Cp{^L+$-+?3_EJS zn0r_fk^ooZj$P!t7>gcbvZ9@eF+v~MJ^k|kEnTB`B-eB*KUO-9e)5!aYsqWO{pUw; zrv#QsTh0(-5djvMmrtH=9NcjoXtvWt(lmek&FIHIEjOD$&v!$guX(dH=Q|bku8h1b z{XDmWzJ&(N?d8QH- z862cg>L;oG-SDHsNLbtYGWSvkn@p1!bI5=?y@%Y-n-7MzuhY3|m&>;Uczk^a+1xI(Ktq(t=EY!ZFXVNiO!g(tVK!)|?F z*N593VDMkTL4h?T(?92F!$ZGknZ*RaI`RQ22Yb4MSrU}ir1Inv?VjlQ5+;;k4%>HB zp!$AvBB}!4!a$`0ge8?TgXe|$qqLTehtMX%po`9_^t!tAZJwhTx*(3w%u$F}zJ zg=@T$-Fi<7O!%J82{`AH z${}q2t-knNSI21IYj9v4C~`7c6wk8Z8iLTr`xla`On)n;`9hMYf2SnZ9S@Jp5gk=3 z%-1U?$|*KXo0Zu+#GRzsJ!GJ9j>pvycgFm-N^2)a^O*OsGPvA|#PM;Db{$M`S?A6p zzE_+0q8phRpY;TLKxQWIr7OWNW@CY$<<*v_HETm4JoBgz(D8a2)5Kr*&dNxG86P{q zpmI(DK1COjsh{;A`X@>bY--g>$(8-3n9lk_4E;5naPzKUrHg_q*!pHz>@2w8ZjkK7 zqZs~v^#j1t$?P(K=vPexxIP4Hl)u#tZ{PAqC0Ajljnhkid_NjJvgS?py(=_UO3n%9 z>S-dpC7xctLMh_tc3NZVm9jbryBkdvy6Iqk`^J+39OEgKjGXX%5#Vi=(vZp)Y&9cg zYG_yn#ZP5?K}^`Lr478YPDNXro*Nk#ESWavqqOQ<@#bM6HN;yFR@-%F4*vaU^Gi+C zbvdo_Th#pbhF~S>!0%?IN%FC`Uqd{8Cj8)aI%F{FijK5nRUQA3PXp8Jy2H%t13fz@ z%W1LLL`cSky%p9YVHdRax)YGH{3x&SJr|tyTisQeZN{~JEbHik^V!qpE4WPXpf3s@ z_CvSOzE$xT9n?m-Xv`Ua~zKcNK>`bqBHe-LA@4na*}! z>8G`&(f4v?az2H8x`Gya&0jR=%j5GN4y}dxx?eUDLP{=xz4M;$4HX&8Jq1RK5AJrV z4FqoLk2W@y+G0RVrIFb1ssX#VCgJsAb;~;W8hH2+)x}#}vej@beW~RNR`?r&{GaWX z7ii!^y>dHNvPmm8tvu=qiv zBd2jH(RR-(erLYX58zw}jA%R2&xk`{v`N@KX2F7vX^Glpt@5JRg*@fY>)m5L$Lw>j zNSs0{nWUtdLMG&fx+0c!u0mS)S9ZmLEa0WO#MQ!=`*~t*!~t%IiMW6EIEI5~Z5!c( z%4OAn);D;r} zF)(-5?o`}znTPc}!Bbz{-+sLIILjaBMcjdQ3S@Rn-bRE)Iv|KjqGlx{26;V&+g?@> zymfef2CVqc9Va(|)+mdMMYyi?F4Ww#1*1%Q?0r8}kEo^`e;m;)xAnM$!9!u@x-{X~ zb);tADk;(ZGRJZvlS}RaR1LV0dlqD0_vz@jPqF**if8@0&r4=?+3!uSj}VEg!K-Px z_wZ$DD$G_4HVxS#)-m5mx()y1{aWC^-O1;pWaV3CQ_6QxKfHJX&q&H=-$7lAQM9CM z7ZeK-lv-<=Or8ks8rGW2&}h}%8XT4TgTA~vT}VVlr>iJX^kB~V-A3+m2OoH+Mj=qS z+9?w+)Yb3z;gdbn!&*EmKWUd#eM+emlJjSH9!!6jF#9*VwY!$K{TyM>kLn)2)|Jm! zGyGPZAi=|C1UjQe*9Lz6)S`?}%zszuw_Nln4GGPz2s(veR76U}fOMNtzqt4J3$4{c zPc@{B;zaum{-*aQvm$@H>R^dAnqoi8Ixah8Qu|A>>oT9j- zn-f5#>!9Ih$r}mbkcSCDZnkMZ6Lz^-I^dH~C_V*1A24s-*03zLXiHN$ddK>rf7CR# z^1G$b4JP?~DnXGZvm`E4+`4~8UmQ;Go|{;~EMUB;FLrRNyM=q|MKq@Yw+uP^d@}*l zQpwD!&UJ*%HmVYMHm9`e!88ha$)3W1`ZX6{lGCj(qjD8AEK8`I0hd&?S^ZicO2$~M za*UqnsC{a=^+|Jt>E|B`NUV^}l@RM8Z2BOX%V@T%&Sk*o+$9I&Qt;p9dCGocz7+SY-Yg zaF`{hoh);YLiSqFt(f9B^$APtDXMH!6xNzOw-0nu?*r>xacU6sA=&9?H3wGJaSnDm zoZuJ7m>+{}SFT!_$eCG18ytppKH}SafabT6CE+T~bE%B95FW0AA3!P7o?#{x4td<` zta=KXFKt7zzv$;n$cRVLhfdHjBj%*BGw2f7uPH$ zSsWz<&D_FhsxaIUD-|ER2US~hNn8lGT50n3qU<8-RXMINoW&YCA0TN7EsWyer_LxR zjOC&vOU@Z13wYhTlsK~y$BT-FHwKJ8PhQaWof*$g%OD{aOt zoJj|nI%JPseN9rU`bl23x?6l+5Cs)SKV0f*w}G~*ah4bnYM5Y2u~SRe@+`;SV6E_7 zeqmX?#OZuOdn(S+US(T+8oHD?kX7d|;jFi&eFYW&zE!gO)T0MmOrOUnYPZf#x)(3E z%ytu*?iQ6yz_a#Ji)$9sllhHRajELH%x|INIMC&)pl4BsCCCdYON&%h++h8ct*hNB zx9&gCPLCX5D924sEOu8e5HOrVt@kF^c(y@u0v+=J!FVk$0GA{M*o2qpQZiyS2fS_^OtuIuL869c`yQu;d#u_h-H*%0_m-Q%fM&i|CvcB}gq= zsUx&@E!G@Po9#vVipf&zDm6whC!&Tpi=1rTunL+j0WzgHMFAmqrpE8>G(NoHU=?ID!u)VmL;_qt#$u-lxOx05n#z) z_M&`wk!p5j_BwldaKDn*==}Tj(cXx9ufqP4NcL;B4QRiQYiwM%^H1k%-Qc`z7kTIS zO<4A%jxZRcHrTn@i)Nba;GKb_{WNs z`GVlVCcwh&C2NMy}eN7JGRFPfFRD(_tf!$#eRc&Jovrk zHW`r1urPA)U4@s@Cd~_iMH9jta?eS!^7bpK(IAq2r`1f+970a}k-S+EgQ8uIm}`D? zDQ-V5>$oGLNx@WYRKZns*>Iv~9G--38YtMS8ogxPTWlZv-kG9Idn?;1xLKgG>O(NC zau0LksJ2y8OzxbhMkV)0w3{2Gx*fRmUiw{Dw#2UL;9N zVvZZXS_QL{*l*D_r=ynC?y_ylY&Q{f?rzcgTGP}Dl6W2$8gZ?A!Q;!gkl48#W)<6( zYO}8Y^%4e*3AjJIhlIU-=GMPra8n4<6-5M9>(vW|%-9lKRiVfan-)%&n7cBu?mNm| zc~W#Le(o2Kw&OnGb0qsj+Cmsa3B?g@2(2als4;rz{=q-*WfD+($I9go(kkZh#@#+I zVGymHq*N5@CDL$6^rN3MC5vTpT9616p;)-V<}Q3~R*MeOAZ# zs~-AqI;G`_#pkqnXOQsx>(mwQ>mTW2ymotuhfGxJ-zs+bQ;~j`Hyu+^Id6H%>=@+| zFoJlDd{6i@Dwo0eAZJGJ5(N&QRNKZwpUX z(h0^YEiFw=#Pzqn-dk61t(^9kN;8AVQ}T2tO%TquKTHt-1H(3Y6%fhk2}%FaI^-4w!}igJTg7(Kn)$plxeCZ)7?-BwI2 zkWBeQc0jev*-Jekcds}1H-E@y=krDl)jFyw=j)bpMW@Su%AUun}Iz>X#PGFdU zH1`x`N}7c9ZVF;avSv1QVyzu$3`+(NDIk-GHp9y%zCOqbLL!kq1k?fDF6n`kwG#Ns zo{gp$;9Lh~;n>PzX_Wr8Zp7jarmU>sA$y&i=LZ-+{yHoYYOkoslwx>)FMu4&HNRPz z(QT~R)`-du=6C?&79&v(NOj1HFr0u2{ES!l>fRaibn)}bPG~F{6Z7->FUrzbiIO#` zMO3W<&DY@FNk}zfK>B`kmx9OPYC%KO;eD(u0G*hYz}&qOfyGkSc5`E^-Q^g21NJ*x z*6ryyWXE_V%c0?tci|J<#mUCvZQ}3?{rFeMxf&+fO=4RpHebw#d@V=+W}?@L%b1=n zKzEkIZ_gKxGjT!nSG+JU zpY!WM4`Ug?PZ=uXADWvk<9Hp9-gd;-1$cd(Tr&giFpDmx)#=?8as@P}ZJ14Wc{l$Q zK1BBZawHsV7n%6U@5$w4Oly;l)(k|lify=5R86a<6gByk-)(QVJ2Kx`r?viKp7|by4;p}DyDwgd!;&Mn9)spn2NZ5Ju zPQd7cxZ%X#F&-Fc6_XDoS;533)tbY{08F@!|43aAMe#JQ!2x~{#tFuS*HlkvmC(B> zi6y}h>wcXPD5v_@3pwiMW{mx@DOfjti;?TkkKZU?^XKa?Lr-$l&ZY-}0GgsYJNSxC z?1#%;cE}s~yA3DzXGFQtF36M~#pNGtnqyL{#mLA2wY-`0T#W;Vmbl~UTzA{_rQM6O zvR<#Zp@wXUM+w8#?PsYa%J-bR`rCZ$;t{oTqJNX_hVgHpVO=Zt=zwF-?Xjbw(QEKj z83~g*uGE8Kzz^MNCa#F5?7-2De1#0&i3fF&WBVLE{?KTgkzqSGK zI}oo}|5|~AfTvUV@7O34@flOC#W@1v36nORQre7U-jbeWLrQ^W*|)?<7Xe}&R?_p$ zX%KU)cdh!NqR6LME&y4vuQ9}$YC7?XnUxfrNYJw1QFZdI@%rL9u8Xx&8JvmX`1c;^ z?vLq1-USFd;00R<3cvij5|}(BWAC$ z7onWtAgpxO3H3O)2kxkiLEr^GTAJIquy`RGf$$MU< zBf@3H9v3YDpQBeQpqBWvxxPW2hxkzq!1y)4PG0tWE?IG|tS*#fgHa-Iq$`Xc?r;#I z+k#SfFC15OJ&yRA^q|#5Y|;>1OGX~4HAlhX-}0jR z-UV&`el#TRE_y6BX$TxACK?oc%@ruTv-V#uz|yWRW%^n_Ma`mYYT=Y5-gU%EhEw5H z$ud37(JJ@Z5MzX!rgr?@4|$jmE?`SLPgf>kl1j}A^kkyvfz zR0Ky;ibgFoJ{JxKkjIl7psI*eLOz!vFT$p8_{grj_0L>5NRsp0M%1I`bLkm?GL&!dB5Y z|JVs`ewwM-oSRENh$@Hr9vEnoFblSTeI=Mxvw*9!r;?&GZlsl;CD``e*tt4cHwu5N zPDQZ)Y!Z3=Kx=+Ai~mb>L~rJb$Uu5;mWpDD_oY>pMq)9V5_(7`pX1Pxp3Z+YNiLX` zUd0uw$iJ6DgQH z+l#Fz$kxlj({dVItu%Z@FY_aJd_1t-**s$goQE@-a~G&m^wJ`72YqInY?7Z*UPa#WOEG~>GJL7m7p`5=>eGPs*@2rTUNqV3Jq!9RV` z(-0trPzD^0id4XS&{~hn6n+aEtGGFcs(^+t8J)#VC)z+OfQt7jS=T9l?3W&fT`X1H zW-REJ9_aUbYc|SYsGhv+b!?kPAWNzkjY}@UK;z$!2XDrZSB<1=B`TYvk){K02%Llwd{l$3Zu9q9CfKc#lA>}LP`iC^IdkPyFC6Y;O zg1W>Xi8eV6`Rb60Lwsf<2Wy)Ft|7LY@R}+GP5SR>G+5-_Sv$N5ov3)1acU~QOhbWGNLmpp2A!uqQpheA~g|0T(ns51J-%gyaiJzsS1 zq`b;$@DvS$6`05{RS;ENQZzDV&-d(D*uY!1KTISS-@ zN2qNKg8r5VL&v*%s*HSCubj=Gp_v5jf7;e4a2e^Cptqj8!`Lgtr8l4VjpZ=*PAe>l zcm_Gp6u}?ZqPQY6tEAP*lQ;IOd2HA#7Q~(P64fg|gFrOp@)A`t!&)wLmoX>87M3l$ z=>;X6{jNnB{*Q}d_^+h_=wG$c7XqzpcBzSD?9_+hB==~3ij$QYn+;3a| zb-JI^!0H3)yx~zqLZeHmu$#>Fx$_rT{hDqJ0cjn%mw21W!fF}k?$N9oR7|iVt`CQi zb`aUL4iR#mC}~2&F-CjAhm?lYI8f*3^tOwtD7)@(672kxujm<5XRQ8Ju4DiOBM!H+ zvx_;si1Hu-kuL;0rk&Go<_wcxJXhiz8a&CK?R@KNJsedCfAdEI__+*>9aWIO9Q^Z;oTYC{R%J@AC1+5q z!e>fej$vPNVz1G#fCwz?7P%iZ%(Hoaim9M1f(R-P1~ePq8Z`JK$`nc7w)#gETgb7g zUOZmeu6_Q19s0el0&B=Va7-`VG(fa80-3)Y=dR{Y&AOxa5s%?p+2DzEg~Y+*@0Uua zM(OGzwG+?A2R!5NFe;+c%*V_FRR-NtOSSfLNfksln$s%;ZkPCR=Q6)}elTxm39Od# z`q?Q$D|o6BopX8=YMIfGGfD?>{u&}6jdu;Q<~-6^+S~DUwW{29#6{>Gv`>-YCzbe= zA}c{NbHt)lE%Pg;Yjp$=ADIqQ-ixEQv8vcs&3Rt<@?s=4`I#!O?w%ncCm|f7N^-88$gdL{VS*n%d zL4yyP%TQ`VH@*rLIJ%aN3Oc3MJksTTpBWPe*ZquOmKyMH`LcN0+|CMLgSvL?{YVpx zKmgPRlcZ;oQ6ud^E88bh5=Ukvo9!C~PPHvn^$4Mz2MfcHJh4TU@Qh7ES6Z)&Eq8t% zK=(1%py4s+i>pQTSK?JwPNb_=bPK=wQ!f#aWh-y9T~_b1>`atHgU=$I{)ALzg2O`e zN!=;>ij^JdhEJ|krA%3@*lbcf*+aqYujd$=b(@!U_H5;~1|8gph)nMai5l0#lJ=S##qdk~Qf{JG1#RnRt2q*Vw<(?cTwff!b zZ^vs?f;)Ux)ompBTuD)*-Bp}(RIsi5voaM*pXnH?6LMA)0v!A(Enn zX_*txG(i-B7P9!jy=y!Y;v$BMXY*tx%PO2=C0FoWu~ob?yoV@p**v=kJ&-XoupM?T z>6yQ?(9zQf!n~I-Q5e)GeaT3h<`FK8;Y)*imYEx1-;aiH*)X=04%dP>osfdq0{D` z3xC8A3?&`Xv-;)?uQ#A+Lm=E;-uGRs;>Z;HC#>}h15>94EW;7s@8Rf zsx5-7Q<0r=U8j?-aCEXsgTnTQoj|yP5UMSbk^u6$o-I^PKOTC?(39|QfcXt_MF&WG z3tjfd6??Y$zYsN?_c5#cY;n^^V6OqQ{tI{CbW3TpQ7Cu&@vesm6gVy+SOH4$;A zPSH$Z?_mU|qr7}UF^E+JKCb+A3l_28&d z3OPgDbaMYSIvoz+@%xVV3~RjsjhyOhB-Te%@6_a@69kAPT;6DaffEscfmHkakaT*^ zzuebcgkO8R-C(-R)36P#SgIm)KT4dOxJ4>lPI3OAz$BNPu$BHXJ*r13g>9M8E(Q zsi7}Lc2*Je85y-OMlXzej6j9HP{T709-1;}f$FjJB)MPgMr4md^anHnSYQ8sjlINO zSl0{*SI^YuUqWpQc!K$<=41m`&g-frQd#!rW+q?)R-)S@qRv6qZx5H}v*B|mDL)do zTEz6E=kpI`g!7^B4E>(UZrVqSh~Z+5$jF<1!z9n>KX#QmBEf}>Y_EAm_G;I_2r7}H zl=vy(3h3Ka@Yn%@8J9BY3xcv|7Y$rf1kqUGBgBY1G*TFJXFWrnfPNT;R7bQy97km; z*(+X1eZwAQWb@+6?e$t_mI`<#1&Jsg)x#O16<(|YY$G0tY&iP4r7Ph*^M?al?Jr1U zy4(x?fpC6|nst3B%dUY3(E{4Mg06CJlT9i1!OXlx)L%+T5tMf&>Lhm$%q4{cUb4PR(s+ z)XVlBnzU8Ja(c19<<=1Z(_m0dZ`8M-RMni=Nl41aQCiDqUtj(1#R;LLMlBX@<`SJs zZae8Fv^sS-xoe;nWWazJdj4P6;80}R5Y~2Y(Mk}a7EiU+gfxREIehr7&)!glgZHSv z%dLGQ4g%$u_|))`zjnt}CBI|JClQmci1K6s%z;f}t~9|_-H&1YG2Is7C(DfHdrCF% z(h(=|4itQc!w?Ax01NoYdYx)g$Ys`YuM`@fC;{tLz<`NK1}4>=Fbk%KsmvW7D@Ov8 ze*%kl`kG_IeFJgfCj9YBLIhCP3$$f_0Tput2(v$$wrNqrQV5M<_;y^#;cWob#7U;( ze|{>Y!myV4f0sSqzO9h`|AU{WRTBQko&WpbFH8VKm)DU(3yIe^mg<7=1dQtG_<6}D z)lV9KJC7z~Kh}xvckTL|sca85P32V zJJYre+2oANqTc>Jy9(%uK=Sl>6MIzml71^FYY!07jrF_vt!?MO#ccQ1=l%r5Lr0b*vKfKEc!Xi36uerLLe_`;BEr63_Jz-Po6-j0{5aa# zJ1zorVoOUrFVt(iO5XnL7OMPKh2#T-g~UD!1=!f8k(7Onm3m?i^LgSZ_A;o;Uq%BEWjC?=WGdC?EC?YQ=KXsNO2<6n80i@aXfRr}s72&G9{ zq;Uc2;iK{U)uH?N(~RE21QZm(na;4sm~GDO&9Yg4cr*1qCmgfp+Kd09b$d-bU-FHa zcE3Q~XN-`4h@nr4BjGfBY|QopJ{)J@IF;Klrxp6Y^Bp1w@AxDkJr*H;-h*W)J;dOx zy2v~Q{Ln8#8N(*X+z5Qq6?N0eYPX&Mv>$lQ)QHT}XPNEgRRMm=WJ<-~5IQglI{z}L zp(Q5k9<~=k|9mvZpe}RY{v-`%{88Nw3l|RvVeIIo+2ko^xW_H2i5$=c+yMdv8e8=; z%E%1)T3YQ~d*x#{$fuXX(d<|HZcu0P?hbw$FO!?Ej+K>D-3+^0cM=#J#frNjKe+PhxMI{h?1;z6zT=(wqv#?SDz}P8 zs^&m~2en4|R`t z4A$up(ZBMqImb72Y^LZcBwD6WlT>|8CC99(q|r<{7J>dMVC4C@TD|P4qF)RRUmnwm z)tEnxg&)aC37XPK4O`MQ7&_nav(ZgXJUim(7ud!p=ek-5 z6Ch?>h!M@Wwp)yIeo7Vb)K|X<>USgSPml8Bg^`Z4J2XUlDN~KORBPOzr;&yH`15TJ zp7Lkn$!F}o3oWAeFof)4#-+Ij0X(vCV;+Z;%th5ZElXuO*hF%yY3Qd<8~x#xXvH}> zFTGEjwMM=V@5(7Xjik56pKmcGA?f z?bnMw#-!lD2^k7Cn49g0rgH^!BSHiwb%MZv1jauWbt=D2UUuLDOpitP*=hv<2XCtx4;;Jf-$ZooxR*-mMZ@PxXuvj z=`+beXNkg)D!K!ON_>g>L6(YqYfV{gs6dX(40DRPrce)u7H`ogttCRxMgX3o8?97D zHt+=goCdJrZ+g=#yy$GzQWX#$HYN(Sc0HfoIMQXx*iT||Glte*OoRm%22wApGobew>@N{3a zLjg$C)0$2f#Wiz1>0G?1Dn`8XL|HIt+iV1aaF9+E38;>YTt{(-Z620_WSTlGU8PWt zs;h`gejoo7e#1Ce=&pB~TCGxuqr*{J2v9yfHA-(v001bONv8tAzvP36Bk}QQxojLj z1n6``EMpy7?sz(kz_PTak_^~DUF0HU7Ew7y%VCwuIRpfTqh*l}qXCdJ z(Ri0}pkGDBSc`*z+HzhRnfXZpkxM)k4xckoO<`=TFgIM+dR3vtGY>CO!#2_+KJqPG zmy=oRm#!=#^*`YJL8E$(9~&oElA0JJ0#MQzk#QTtdRYdpndyu;H}Uxow92qAyY{WQa) z6R7O=(azrUU6hIl?e&(OC&R&f!x=+*|03*FsDOcqD@<{3o7s{nTa?uP?>LCRrILR| zommvl9DK#6joCc=RUPh-AUg_>0N^af#2JC}_)}~oBkRy5?kHOss&TM&0CGeKC{l!` zMXm%@Se)YVu-MGhMaWVV(^1hbh?d`cdn%38jMc_I)|r;wpj7l>C8_*v5jjR>`-x(u z)(Vmnm9><)8XeI|CYmMzSIWi^+a|F}j8z_UHP&0;(P~w?l74`Z8IKs#GXu3!aN#vp zmyyD#^!FEr%Zf5bd_4H6lE4NirpvuL^pcq`rep1Fx}?=DL$32HF(!zWMa;d1b_10w z8_5}Cs6XS#auNnOwxiXWy0R~;dG)d93?yYmr$6CU5TM-TgHUIv*~c0VoW&>^bBMwP zg049?8x+zD@we@33Vs?5wW@y4l^}tN^<>IM<$GKYazhE#JVBV|l;;3?+nSIt20M<3 zK~(Y8?Xc+0QUejm_HT9LO<#Tq{f$Cebrgp)%k<7oIi7~g$5E`JUP&nL+-Q6LfcXF> zb=}tYyFa)42gl-(CkVD$LDVjP1$Eyg{q)gSu-Vnmtp3*SI^(tt&97^UcSw|{x3hz< z<=6I?bf>w#^tF+(KD6?cGnp5()3bF~t&cPp<*tGvNg(6sbO)ZrSp6WwKzXn1IEY&C zgRrcP3QtF8t|ucndZPE&I01IyBF%sp5Yc8k8D!{VKBg(RKQqrzR;A2>TNSCpY}0?t zXlbf8h!hWF<_l|TLr8jrtMNw#JDBbow+B71a-y(GS*B7sNhilRN#IE54{Bw1q$YeR zmdLkCt+i-;1m_8Pf|`NG7) zv9No06w`5za0|gg2g&NK%(bf7xw%jso=&mPk>BXyr;XGEZto&QSf8*lE!v7^MY50& zO-FG*+D|A9Iwv;mU|%fMM(46UkIVVEZ{-3Q0ny<&*d_Gl=l9$-RU+>@4F!Yq5#NL8 znIC(Y1H4~0zu2NNxG6o@!y@U!P+p>-AET4JCXMT%Wk@5tcz^k*$7(uqS=lphN@8X+ z1AE}Nk&?i~o>g+BeQYb(Em%j#y_oWC3{4`#K@{>J-l;f4>60n<_V?1RR6F(TQe5~I z0D3S!Kqhie37a1bdAwk~+kpDbGlZeOvogsI?o)`o@MDX}EdV17X|1NW(;S{;bsW0e47-pxn4B&XFVZ4Os_BJO25P0BAngOvOgxk{^J~ZVH|W0`9dSyb4owfu#2}+vw-kN zF|!J@&W$IY1~wr#>)o}kdo`eId?l+2i?=IUR|de%qlwPM7NzHT8MJk_OaQ9X0xTg^T!81Yg0(+ zPyvl>`S&%U+n#uU+ATq3Iec=8@i5J1|10J)e^kx9f!J3bq=9_W zYSn&N3C&iNR{fgdhu7e?3a8IZngpNZOAf_=U1}x)CC=Jef#>6;JR`AS!?6|=8Grr) zxMVU~&NKI=iB8Y zowNN&Hr-&Ea{^;1vrwEJ{f7@=1XnHiKd2jwd_CiGsNSPw6ANc`A_leNkb=w-OfZ7y z`%2LkMBTddWfe3*lZW4p*ao?-9zni%Dd-iFv-&Uxl%j7Yq;BaeOWoaP1w9H9ln&{% zP5J0Quh?d@`9#^9vBIH-3y3@lxP}BBBgMCA4$X)?)yZ`vmGH)N{HqdxVSDz)t50if zKEYR$8ioa!hC9P^C>`t8eg0J-Q`V+&1T%aY5Aa-mq-}gGFg*%0pefwX3E%7fFBjm{ zOEjrTNOJkn+;`mc2zLyO>1780b1ieCn#{Bf1!3v3XvBV^8;i*a+K?$wD~tO^Y?D+c zgxxrWu437Tw5Uj<5SnbN7Fl^C%T(J)`h`OrIE`vle>z;*u;qb|`!4NYme}bN%z@X% z*ytVBA)mad#F+INj}nEF?2H=Zy^hXMt5S_#0t@I-P+GP?$ zo=%4T6pn!u50AF`%&02(d&Eq9d9PCc4*&r{{=Q`Clz>QxU8nrfDP#6k1*->H(thoe z{}`Zbo4Q{*vCgm98F<#UAxL&on8TKHb+!`>MLiwdg*DLAzznc>|@4W)#9Eb(o= zod)LHo;;{;j}6}zV@nJ~0tf}oFuar^RjttdL4ZTx(qjW#OB-l?N}yk_^{FV{CD+X` zn}z_Apt1xpZKxs@3wH?YW4XM_(F3DgnN_SL0Ap@3st2<IM1b|6FfV2~x zNf!5WiVxk@MUp)UNwL%UwFuOw0Gm4nCJ~?Wr1RQ+C19*Ux_r07V5!Trd#LNRQ98Rd zR3S-Y_jo7cpQjJWHE);fr5=|~)~rUbYpMVOB3q`Lg8_RQu8L#gGp#sbX0~!YX+TOY z72?L@q@p^S5F)~srsR3)7^Y&p_xAn8i-C4vhn-13SLMPe0?}`UtBH=K$bj^lxd3;)IAib6<_jn;M1cH+FtFH z|5|MCGuRgLb^4wL$-|jU88QcbIO}wJ^S65+`UJ&d*V5?iH2^CB;2&--%lYcwa;SC< z`PSYKz_*$Ehl+2BjU~A(0439#J9%P11#;DocrvIw2Klz|eKTX+pnTgUE`8s<5A^cz z=q3{gT9HE88%HBd&7*+I5^;M!WN8*?7eDvWLTj=*^+`HN+7yfh>ALa}^@(>#5m+ct zSpgfYNW~T@0`{|7Tw!(4Q|u|@MW#1sur6(6T<#D-yYA@?^t7(REMU^d>Va|F)20=p zL>aA2Y4<-U?WU%e9g#6P8G98O)q*9!k=ZUiN;ZwqD~QSWp_-%j=`c2PU^v`iF)uYFfG_jxe=BatI2Y(RFF zAyot`XL4nx?)8oI0SI0g^~d7H&9_~>To)1cmkLDM!-6bk?w<-U&}=2gxB9lwy{mw4 z;if6LXBB}v%iu60Pr6~8?MxfRw`BO%yU?FUT5W z8a08=3ZOy|lcPitShm5zGT6%T9%E}SzE!NCWRRb3aPA^iR$h)c4=8%R`>PmI0BQt~ zLZ#+WZ`ymyGD~p)s@$uU9@*5-buVtpwYu%C#dWV&d?szrcw2_^P6WW0fXHmzb(9nj z++#;@52?k&hz@$pcGCz6j?Yk1idDqQXa}SZfmVX_IaBevA6;+leiv`NU^N7LZjwF2 ziJ3tvS?Hu(*FCenxYX(GrV%jPpTq3`tv8|I+<8w*pZBECd{V}3&z$$9*;OTLvdno; z%J?gqGSZtyNY*F#3YDDq6glTTF+)gt?g?||lUeMf*G3s7Pb+}RZdO5hk9h^9 z%mx}t*F~?5O7enPnRbOf-wS|}-dux4dAAF);^0ovR#G4JyS5H8Rhhw-+5)!Kc3|7s zPHe61K*=j3-+KvA0fZ=HQ)RXw-jM9z__5u%{=94OrZZj#L6it{W`HBS>eQFx`tz>A z$>S&BqV3Pb$IrVK=gys@m8MwmG9a6H!LCbj{dph8v$j1Qh}y`yU?k-NEJGk_Ve`mV zY_ILa_S#O&k8FVlFUg0EcO_6!8z)bkfa@;!Fn<5^mxE*o88tCeoyCYhlCHBmxiBM$ zw)O&H#Ve8UGnR{JueU)iLQ|DZDXh2EcA)H4GL30!qyiB6*i`L-wd!D3Z3nJD?;8B+ znQwqc9^wf)GoV7e;*^)+`tz>AsS~H*8Cx&F$IrVK=g&XcV9kjehHT<_JD-E=&;Kx< zvv83ftTXMT%hl;iRKn)b?budZNMVhz0haBwwX*A*|c=Oi1?}CcjnX-!OObU<$L?x=R;@#<{;r;%@a#I3E*{fi4Z9BHs7GgOtU7ZKQy7_QI zZt_C8bu2dWLDa?xO6m{1UHG;iwnxpkf*^e{ck0s2ynT&oxb=W9 z`H&ZFj7;8GVtC|X^T<|gsV!h@Z2=?xD7x}_w|0^p{N@S2j*p*zEl!_$JlM!X{qZWm zuO4?fu0Q|7IA`|f!0woxE4N^*HSw(1p<`}j9-eV2O4{H2rOGM576sT2!nbTJ$)2~{ zZH_CiWR{ZlKkCksTGx(yU6RI4Ie^<9!$~uU>z+yDy6zPcb$=%YAR-8l=lFxi&lhH2 z2gQoi_ukJD(7B7E0{};WV7+OCveqZ<>PJX#8ll%N=^Dn?C&~5yti*N6bvQ~)LcWMyz|sIQ+&WDmHdMu!UO(VCfs@>3%vKNH{y;9 zKaaaE`V#hD^kv+3;b(Eiaxrp_RrdUJ}zIl7+b6Jc+&I}@PdVl@UxST*PDFErcNKO z0zm^mzv&6Me8^2qjxk;VP6-0#($63L3^hC?Uf-WYmU~EpTuI zJ8RqUKaP7YE?&3*QP{*Y7M_l8Ui_~(YtyNa&4ZAEP7l)wW!QiWoADr_h@dLu6RF)P z29Cr&QCEs2)-T*y0V=|~&b%Up_3h8P0Y5W!8X#LatZUu~{^{KJ;oWEciM9w9VjW?& zya|^tT#V;$zYtQnSTmp$p0WAKxP0MaY_HDa>`kZR1q&D9>`iBAtfQ9x@*LEGpn;#= zbUH5IaWS4Sd5X47g{xXQ&R7UIYT=ae9=X?=wIqM3{ zSLO`91jW+9wG%gq##i?R4(d2#>SVlN*TwjSE$74*Mj6&2gH?@lP=_@6W!Qua8jv#7 z;Xz$nGMq_TJkeCzl|+?jhWyIb7?LZQiRo^?U0|`?2#V@>;qGUD3AbJNIh-?nma$Bd zwmOD&&39oFY_9Djio*stYH4d?PzOg%Gtf{HCIg*L1|UFNeJz$@E5R~q=`f?jD-{?X z*Crtqbqv-GNXJ4fWg8rM~VvO;A}T+Jv2?v~CBK$b*F5{`4T2*r0( z!yKvpaGI1wO`N^y3HZ@7K8>F|>kHU>(U-CB*pzRB;aQDk2o4%LUP*AIF;GzptRn0j-G&$LelDJ~{Q^{| zq~&eYHu$YVsf35)Nj3`Hys{tM`YBK*F2%PVAO+^aQHno+eDD3=ixA;%zweTu1vl2u4+ zu|D-mKmbXwh~}G8Z10tFE##-}7K6T*p zfDEvE(`ndN)!uD)uiSxpsMEG(2WQRxJj$gp+;Ze6SnV7Ji3;LIjXL<16MqfwJnIU4 z>49(JitoQ2o>#$>XP*diQ443zoQ0~W;HJa3qAW@{b?#?yU-KXUV8pB7=EJw)<==b*Zd$qx zCr%uPKY7CM;lzpE__>)UK!t6PU%@?%`*3glUU*c(S@S;!k39Tv=@vvP0t+Cl0*XZ1 zC!ctqh*ZOuYCJ3*olpLRUqj6w!5`oBE_~tsF92Q@w;Z_xVBqo7XJV=}5o3Mc=JRmr zwx{Du4}J@0&z+0!to#_e$4|tzk$EsP_O%Y+-j!QptRLtc!trCfvAMDd%V7hz9KIO< zqaHO4)&ig0|L<4{R`KckzofCAIt|-K<^clsF5iwusM9uO8)wd*jcR!Uw;j0?EA2&) zsKOB!@X5oL>Kyhr58x%=x&ovkyz^(@gg2l02RLcsc)aMVzmF)W!z+#9Nn4%*BEoGe zKf$5q{QwvXPMtpy5l8s`;*TI@1R`haTvOdhFqF?TqN%pPCB=969eX4l zjtbj6F{)k#HGc#ZuN;Ss*f3Gn?s#4WXV0C3k|-fm|Bt=*jO z&ojPe3X`iRkoR5s^8L8lGvir{BH#oAz^Rb7ku6PykgAWVMUO3Oi_EK(<*O>s`p?>w z*}|eJ*1+{Cxj!F}`9fKUwo@rq@iTHP=Z?{}w`FE#x3N3Zia<~wAI1DyW1i6KCJjxc#k|J-sE{!>C$}-XW;z

    &bim{ipa2(~7-vm>=@fX@bY z3MJPCsoVy;;JO@b0bHq3F)_-@I%A6-3%$V!`Sw34Nr%q#PHxzAE5F$P3Z8CX!qdB7 zWLDz>YMpx4CtH|RJq-k`>{(0B%K!qr46_>Mn?nQ*Z}zR{SL<))`SxWz-S!gr9@Ukj z*thmzd_RX99AxHw*KA+%N%m=&$JmM{l5UC>ov$IR3KldSgs*&dX4;rjJA<6c^GfII zSO|`ua6A{!Ih$U$pZAVClBMmh(C;QeSmi-+;dSZrqI*Now(zfjyrWT4PfzTc8ttP1 zDl9g+X^EpGNdFz4li%gEC%Y#oXwRO3(?A*ta2g`taKLHU=i&Q%F?VVa!~pZKW1`MW ziSfYlk$+(5R0O0X-bUr`K$8XOC`$+Uf)ERcz+VFaU;$JJNOS-m0@NY`(4h;)ZUk;Z zU=xB06@Z2Sm52cIXagdQ)QRA}2=0pj_z(i906c-v=+GBKP@4eMg+K*}l(tmJO#yf^ z-!NuQUUc956M@%1W1eLiWxi$F6}Fp#a?P*EIff8{bW9nukD_)CfF~VjHxh!q0yGwt zt5s3FSJ1+@#%473=sqvj1oQ#SY1!GkV)oc=wyO`{+tW`!khrYr+rYBUSHMaDim%T8 zBG>Hub>cFHr#Vsh1Zp84>dEbn@QiB-+4@7==B-uNBY9eNeFY`6<4 zCC7|A9DwT%yNV6{TbNZljYoDo!-pO`of&o0SbEZfJhJU6PI>fmraz=a#UvWPD3+9z z_Ezbt9_i~EViJl6#9N~E+Ww6Jtt&x$d~xO%`04(aQ6VevQQW=#QBD|pBml>bK9s*7 z{u@5M>{9-8&^64dnT927Hl?=lvFFbw^7xy6X3A>|Vo7NB@S?CVv=! z*Sc17+EZsUD&EL#$KJ@4>In!T`Q6&T@_P4LetyVz_~FW5^LqOVetPItTs-d_6tFY3 zi-}du{BqTwxMay9{&LLq?AtJ#W$i0Ce9S@s7QOllzW4IASXKq102K)x1YEALEY;^1 z>1_+?uXnP+eDW^rwL^M`Qq{tHdF5i+34VFtBF>+221+TiD$fy5eS&zRnZF%zBeQCZ zkmYxq{>G)t7m-osFaiKK!@=VYVL{y-ZrFG$hczzXlnEc;%EWcF^{wNA1y}HmIp?va zZv*2JV`y+{d9mYFPJa4xRL2{6?)|ru_Ok5Gb~3wmI`n*MPf zYki&*#vR4iUcQ>YuKz1HA9Eugnebke)+D_YSHJ#ie)h%#taU%%>q_}Y^1aPXLexb?Ujm{mKS-h3Z9KTjr9 z9S+a?N>iClyON+15@}I%0Ai!JNKf}#zOM3Y`5(3E4j0MRYzHswUJUsjc4j+x`nbPw z=9H6I*T0G1E&M*O_r1wskDWq=73cZ){)6Q`t9h|=Ip3c9WnSx9&FFX&6B1)s*0quk zKKW^S^1b|e;Z>Y5@<9B>>*&?J>QO4Q8 zP}hU|ekkx%$hS%WaT(LXE3&1Lf(=$q4e;%M3TcHT?h8nVoc`Tlwpuzu-gT zj^U-wJ98*>fa4m_fFbkVhM z3A7Yr`|6U>J_r@n3%oF*IxI2BRvPc!iS7HE=1OR~07XqQKou`d62(6*P|*Jujty>;1X)|3FBm4M@}P@Z{koXZ$PCm ztTtglUZX|l6UKWoP9u!n6UMiOQB%}`8eOr|2obg+keG!Ug@y5+@U?H^JsGDF0hA(; z;+fJ3;`;i=EK94P?SblEfcemXA6S1C4mbfwB|K_9U(^d3w!92MA5h|=W0G+uW4uAMWmUXV=x?%c?Mru`dy~o^&ZAljNd+zx#tGm~6T=Nk$#+x`{!m(IF^5=E8k#|!_AwdT!U^b)o`*KZv z*gw7fdb{O{ZtETJ4G{MGZHHY?^5dI%`Th5^pm70L&AR|c*c|x8$2j285A(|n|HCJj zUIf7XJD=pp$4?~XrTNCnYiYQ14j)_mMW$Cx;{1KiLInZh8sqg`w&Ge2fATZ{ezN~J zNyJCv6{tx`VQ5`rRq@Sv7cwz1j?-WG3ghou$h})1Bq2?F#NK?8_dNVj7I(bDN5&t| z!ls4b=ZhUj1ZNJGkY)o=F^WyS8+fVxRiuziub#-|2Yj8=CV!aIp8gUC-2WjCXq?9n z7hb^?`(MoTn#r8A_%g=*ZC`F({|_py3Su&b>wBCu?IbRqcMkV&dz@*1KY+(~J{R<# zX^W>kEMf7lt&el`zfK|TWjK4*f74tw!AP^h%7yZw2I-IY}_zbUhuVT!<4&ejOoI%`*ar5E7rP{7y`oE6kk`+JX{OMZFev^&c>Y zLPB!tgb$+8{LiM_d7^DGqvMSnJNi)Ya?x1pcT+5U-~;@4&5azxNX95ebb8e(<)dD9)VW{ea* z>*aX=6Q}c7>vJ5^xIgb}J{CvDxp(_xG~Kz7iFY4CXRe1u`(4baiY79?Q4_px`{R7< z>2uJ)$&)_7MavekXyq?yh}Ch@ zk%1;c5go!*cwM5B3B_ueQT{>@RfcapyEsmmP;9a@`ahGbLPl$*BW#d%G;b~ITFIf0 zolIxGo3o~#N^|8z-aGC%t~>DCywS6c+5bA0!yY|_H+t4mZ6%1w7(xravESD?Zp>kP zd&SS#@Ba7FA8CnX*=N*&+J{n&R|z&H!c0!*!SKOc(H9MR-rxDkYQ&Bk^lf807*naR6H177t?kS zU5nn)#n;M!WY3~PB8q66O=enfWfE<@wf_HirIE&a8UctJvD#iy{|=$LS2l&VPs8P5 zWNjKEZ_%d(AU)7(MwvI?QYr#c0$Mf6PV%ib$jEL<2bMsAx4h8#f^h~R0_P0cI9dp` z(3CJHO9AW&?T!K`6GBD*1VMl#Uu$K&=@mJR2<0_`zy+SKlvK(%V?Y zWOt^OHT@fT-$H?p^}G&kwkQ%jSNOHGLa#gN^uI+a6)v?xig2S_weCQwwUqh*esZtmsDR&zeoOpTBn8s8|U-c8K(pA+qE~d zw(Vt>w!X-VyIwSl5CM=<8c+GA-US@HymJ-DKX^JnTl#|{z|fu9O`qEjz^+sqo!#rX zXUoIHWsDOh9K(r|-$!evofle{fp82MRNx8lEk?W5HIb3zu0QO`2<2~iCv@_yKpo~+ z8~(ysOD^PFZ~T;&OO6~twX*LqfQ@AijTvgio%vs3P2WcHfy&4|+aG0J+e<9#Ftl!PYALdL2xrW~Bk53*5ZoMJIgSrBABC@d zzCQn4etXyt0NAf#4$HgV0O0!vT*?m@UdE>WEu;b!L`T{jJN8fjZryk{TX(PEu9k;P z{{>rZOIYNU%dH#lW=Y#}cBFPu6RV;=RvXwz4pb}r=UN&inEc%W4`5QMc9d$f-zA3= zA#eH7!G(@~+rnaNax;qmQ{v9fzLU=H45(wMCH+UJDk zW2m$f{AvAdyu9NXUhi1RW80rZV3xx{?F#8N#3p;N1DZnG>Or*CfM;nCC4tfvt-|#? z-Yve}>r}4&4A=vSU>kVrmU~&*`6{dXHW0UBG*>k7k>=w8_|1l!S=at5OWR&#S=&oE z0UgFwG;vhZLegG_ziz&ZO&zcDz|N-tbKd^m=A(&8hiTQ5_{T9f@PX!IkU}uOZYCN< zZ@!NL105W=jxoAi8(!En*22Fv9 zSQtS{1w9xbPP5uZGOnn|aH3ZwBPhHIR|*{{TWW&(Rl7>mT4+(EN@7`TmRXgS9+m!H zm`Q~j&%1X%#>*{tfl~#s8a}o3V$PcMF+M%zRDQVMWmq!CojV@^0`(w2!;kj;I+xBo zo8N4_g(@q-!ut96%8%5!d~F;G$XFfqPAy3xbt7cSwtHGgKwhwtUkQ45$^Himb*+pqruOzXx>F! zKKqN@u<=%6(&3tmIC=6%_{!`r zFurOMuLPSituwq>}=qchjd(c=y!CLJUuctwR3Ckm4Q<$102RxlTM7APs2l~7}V zoe>43UT^30hyKsh`l7k9@WwzJeeL1p`yt=MVG}>hf%Wrg&vmgmxs|nj8`+lL#n)z^ zO|@OcJ=-6nwRI$cDZpxr~q8Pr98%H|2`>pP&O zm@(y7Q({{#+>!@~*?y-hoHc+r{FJ6+F576*N98yVp`7EAX_3 zjfG<;g8AA*qln8Gwy+QaTt6r`B)}lL71Oq;#|P0(mshtexDHM0b%n6qeyeC7#qrPj zYVC~mc(H>g z)s&bB`1b82yX2}%b7@K6FB*e0O|Fk0|j1@$U)01;>kMp(xD-w#ZplrS-!A~>joM)*OO z7dVY5@^#?{-w&Y@Mr|*&`9f%A0F^H47*vVV2#nZ_!1gHuW(7nql{gj9f8dxcNTnc4 zD}k=@JyDNB7TH_)p1s9#>9drs^!MVJER;xnWZbbdS~0Y+NNb-X8yE6;>r*tuM{&fc z18IoWkqsuz!$%#!`=)%H!y5KSY0Z5*pWvvbg8;ClF&0%?bKIE2IcN4cG{qa4TRVe) zZhx5GOdE+{B9_9Oj022v>bYRf`7G~V#hu$8=Cny4qAA{h6FAk0N#nviCe4tR$N} zd|~D%`R2Y~raj$GUA&I%saCcmw{z6kL-^|4v)ItLg_*U}NP8J`8XEL(+=@eBqa}k= zKS$c2{HU)!Ipbq=q;|2o?N#n+d4w}(o`$Pj{fA4} zvgb|yx%DAVpZpP;;tdgP9btpkrY|E}7XnFhCL@JpOuUJYPCNmreSUKAcWH_@aKVx* zd4B7oJUjV=9NKgMEy-;>u=ze_Htx%=bUWwHK7-ADTezd;0X{S1R7S@eh=(WP%4cc& z3IIMg^K`m09bB^Sx#pRPN{1sI;#NGOc}zM+4W{6vu2c=tw*?5%oaxQi5df*mm(xAs zsG1$dmGV1mY$0u)+`X9Yd>@zW^LgIv--tx=`KhO|CB2iS?Mpap-0>Va>R=w(@d*3Z z&*4*(KFXVYn|Pyl9rJ4U;kou@>`ZRqkkNRHFiuC*kjO-ph+4e>gj-t{7Fshu1&dLjR8d5BL=KZ#?<9nOXG&ISa>H6KCN z&lwt)?m9{?2hr9H#wH=v=)!zT>y1|K?epzhN+Gx?1MEY|)5JtGADnOkb#^t^9ds3y zb_M4yyPVek7SMuQTkhfVdFKOg_qIntxsjyak%mXZ`5QEI>t+G)Li@`s>v)X|=blT( z%OHdNLI@-hfrxkp1eP{@WC<$*(J|@ppp?dgU8cEXl|!QiI=P>Psc#X$|` zaBy1HB*s>bi^5$+YgBO1r?lpQolkMayf5>ux#!c7>7*fE&yLit=n$(T+r{FJS2?`t zKrWc|IbIpHkTa(l^=(^NJiF@!GJcl0732QxPmobA^XvBE)y_AlajJ;RSTKL92y_bs zzVDJ(F4JqK@cEgib9c+X=*jmRn`anAuc2+)i1uxRo(;pdQNU$UY_|#^1sn04(%b*O zv{zsRMxwemY`(I?cW>18_LL`lz87kHrMHH?QJP`=*)F<`JD5akQmF; zyI5i+o^uvi zKgVaDy^#Ai-Nl*DUCd7ozJk9UcLQ2$PI>Yiezfv8?AtJ#^XGh)CA*jNdiNS?>}r(u z@w7`BYcN~l6e+^f; zJh1C&e!S)ewkNmn%k?+&`KhPzn*+bc)oXsu!c4k%rb@ z8juCF4uUa9N#H4umgF`@#~Zohm>Up6u(5v&pLqI9{BzUY;8b(X@?X#xtK-}IU&wbC zTugVams6iSmjfH;^Q*(YkEc9V^{nFy&wqn`>u1rG>%rHG`#0XhHI4JRVE*U1>9}9A ztbGL<9c>;vvt6{M+au{~d$yCj@8bJr4isfJZAyS|iz?4@CIhVi&pxaDeJ&rn&3+5E zjeAU1j4jC)PF#F0Hy(I3e?8r5~uz&p=*7R-Q?=APy(YFb-;^xhF@xF0K z@}Y6Zuq|x_GfHXhIQI8Q1lO#(fd^XdXJ*4ZB!XR;-F$K88BDF3z><#Te09lpP;Q!( zm!T`yV@}J31;XO0mw$wXdsZ*)UtT@D=cYW&g{DB+|}|B z=}aeSY4M3C&*P?}f5E*c+yrQz+_{)Pzxj7Ac;VaJeC#i|=8!8`-Mx;NcE7^Js_}t} zt{5IX71CClb>EK*sdJ);Z-o+@oxJ+@Y_&@_*aZcO!rNNl`Yt;%ZA_|c=H8?Kh(NHi zXAPfU@(mu{_6S(j;HCJ-)(838oG-97wUftNp9iagl$WL}-$U9n^Km$T`%3Z9wnun! z>PcKW_Z(jBTE&}v8;!k__UX#^(3$JTS3XMnv}HT!%yoe_wl-b49+Ga7yq`C;S2@;n zuHw`u&gHj9{E*)t`4iBZZ!G%(%Fmg(6R}695v4!NT@OiH3`kbCsInbrA_0(k^$*(H z=kjqoZ2w*0+tQ@VT!i4F^tSKPST&K)PCb>bd=LB9&E|-vgJ{j{rYqlL)Z{gE=DKOm zb>U#Mc;_>G_Qgy2$pM#h+fl#4*FL8`dp_;CuIQa>S6t8hx|y6m>oe>~x3Q$-H5QJV zj}WlAdlesl=1bgo_%%HB!8<@}{^2$YMNj}%ZwJUGn znu9Orw}=0LjeRXVz5U5ZLj#5bPeXv>GWUj}t%(x`zNN=bx@uB<+oEj)e)WCPf@lAG z4?x}(k9%)Jk~M6b#R&3*-+4E{(;fh!GRkpSew9#6EDiD;U&)co?G+7 z4z#brUXM^x1Y#m7RR9#s=K>62fKmjWf`3AUD9Iq6Na|ypEhu5$7X?5gFjESu5Mm?| zc~%cSNDP!sVBTKNWx0x$3kU&}D3CsdkV-R9PZchP5uywI|7l48mtYdcKeaRXt zP^;W?su zX6O0g{h8kwzaUd9o@|>_+2~ok<%!+&y8~jt4ME1w;RrjTb&uPJ@-hXqu19M{Pp+F9 zr=*ss}=hOtMAz5ne8ghXePF%)GdMWbxB*LzU%ItSjIKn1j#YlTuY-t-QkT&kl z)46UcV+|zi3Nl`Xtd}KWCxZS9X&sz9XpJRps_ja1zAZ%XoeZgT2hyoR2+PEM5*AGr zjV1`A_UOy?Q|(j{vto!~6W5>ZqAFfb!b*^JQ`9)sG$lr}zGnlK(&iUO{)n??oz54Y zxr9Hj{tFEW<7u$ZO`^4;)~QAy=y#JS<%1~Rh--|myN2B=TiLHZzwsx#Zi{GpS@Xrc z1QO3nQyp&%)X5;3Pm%L;_;$z=H93_h=jW(#YDjx&@?H+*=cub_iX=|G`F?!mQ5&m4An3~* zd*NEA8jVo{Rm#KHKBMBJ5JE(BMGOaygNwHTprT6w2^Z?y{FT*d{n6Dw+qE@(mc3!- z2~Ji1A#3tZ3(I@=_%^J_9`l4h_MF!=dv5?#nfybx_dgUsmF5u|sciiAM*OsMX6*b8 zw~VYZL#II&b4shtT6d+j-)kXi6}Sc9Nd%tg!qF-Uq(2PU{1gUr3#CsXricKE3N3~V zbPA+TMnfl*>L?vafJ`R@V9JleSeb814H{1bz%7&@4FISJEGcbbR26`yuuzjVh!0gD zaSNnRp()1U7#eJd=wvmJm0 zA?eDr7nGp^iLfd_Ym)iCfMyP^pC_&R0E=9qN+=R(Rg!koq;vfsY^0DR-IRG>Sdkr5 z0P=DDJe@%-qM#w>giC`ZY!r%)bbItn3L7CL(oWEm?Fzo7k$*FUgY0h1 z58nnXHTAnfh^vEB5T)ouvBUOsqh}93Egvzhy%JjMQd%22ih$Nys}frG26-es5v?t{ zvOyjMDf$X%4at0eKx-S99BH=?Gc76lRSB)VG-{NMX|#jz0|ufo)ZicC(~%{orR=(6k?SpYSKPCwEZg zR5Pn?I)7aIH~#kK9au6(cdjP_?gHq{nv-=~+JR~qMKlrwlJgi9*rHe^SF%;)R7NTi z>YY6O48LPll68}0^Pz`diLfd`gR5P-vK@t)jcSc$ll9VM-Q>VK(vJE*uk*BL+5mwN zHsKWRYv1s_o1!9!U6qh=deXbWNq}%bT1a6LlMYSsMpF4SnOqN8F)S+q8v27VBSIe6 z8q12~t787Of_8);u0P)gS|fxNsgc@NWx&UQ^f=#X)(Ieg{hKv^-t^cKCKsD&1fgjkTfbJaEHRF5TJAl1vg|*P#6@a~tOK=l9>i zAx#Ier1LdyT=y4{F$9+3(R{z5BX$9gT1e@T^D^Yz6bK8~%aJCD6gIutUO*v*4MNZv z%qy03$a*<4dGn4y(izOHmawqwO8RrX^au49gXV&g#ukCb!CkjUU|hntz5wlrN~~hO zRa&%&te=y^QdVW`QZORo|2jc*w zbPV_ln=;H8FL%8sP(1ir<4Mq#Zq92N?V|uZM62{fm!<5{*zW?68i}{PD7_ot=|5ch zG?MlYmq!b<^sy=w*`$~rT{+}D$v~15ZXscSqvUZoJQy{ zE>x((7sgo%fJUf#7sY!rabI+>@C^8?Qv{o{;N=0jnQe6`cnaf8MIslC5(EBeis}(8 zvIYPK>Ul(7B#fKFAWK;2fa+c;cnT#`1NKnn9kW3jQuwOT&IN6gR3i(S6|% zbw*(@QsET5Tl`l9Wg0vx2i_}PAT>xVkTSYqz>|zfUDOmIAvhH)SFRKif|Jbwqf|5G zEa?<Q_FSoDYpBwK5B#v~DMSNjw4vOkg1n$gVB|yam zTC3uiG>XlZORuF!sJG*Bx3uiSzABa}!cyU|*im_UIP84=K3lyrs;y-t?QD-4j)E~G;^ z#xc%KipPg}DZDSj@lsl5NuLZwTL8}%AjQ;$=L!1&2toJ0)jtIOrg!H%YCgA^XzOAgZGC}1Z~O=C={BU50CX@P zhvGG5cvcM9t6GKQreN;0WWdV-Z7dm!ew%R<8>n+=OB2z_8E9w;Z3nlTGUKCUo-HNA z9{AReOB8+)-wKbdmMi+D(sA{60xl25x4K|@8uU&X+KTWUF?bCWvM5}oDB*d5Km^(W z(V|+ygHqT7%X<-RRX|UBP+cuiIL5RY8)21{HvC+;b`-8nh5b|byP(~ov>%3gr|?Jc z4WYmn0wv@q-*%e{U$64~T{%Z~pq$Z=Dqt+OkD@g#0 zjEDCDiBt%VBt&kSgSQK%Pomf^%7DMZI8P<3da2r8P}v}_D1W~&>EIh8_@FGzr%^HG zQtvymVrmg>J%3~5ZuhO6l9g*u>4ZM$@8AWX=y#b(ZRDqdWf~BDV~D(E7oH*NT>7nY z#g>AdLFI{jHw3Wi4C)dYy zulyVWgKMON6{`-^Wy;X4@S8)F7wY7DQcRfp3E`}{L%RT$CAL_;>Xp78$6J+J3^lF? z)vxfKA!xgozj6%-3+dEEs+q%;Pnogx zwrnVLnR%#exg~WNqTNb>wrJ{WXdVmf0C@AyJ;`a`9>3#l*}(mq`Bumn+fzHaYS~pL zqg`!4lpf+^{~>()w%3_q_|}&i&k_@k`JS+z{hrw-XkstCaM>f~ z+r3?vN}mtaw$9i%qcmSpoeJ^}_st>d{Fc_4GVRt{<2gv%wx$);@4}58>UaCJ z;X8BRGT%mJy>rs1Jp!mf-z$@M*l{{S5cRGAsDko`%(Iv67Cyq#6M0Hl9A6N;^ev=8 zKq`}`)2>Lh3e`RejYf$`9ZyHn9-qkb90Y(Q%m-0$S_ob@`Ghhq`i$L^S#_dmBJuAc9By_>Fa7GM=;oR znTsJN&oD4;L1BT-MCo_RT(h^}NuX37^8H{ZkalJH$#bX;)80(xBmHK{J*~CD*o8zd z`%Pm%MMdM_4MxE`g$J(65w&=+i3C6jKx(x`X4S~;Xi8~Ya9wU;ETV6uMkDvww|m@- zmK$RTl%EGT33jDX=_;z@$Y@Yl*Ma&B^-j6*Q@)Otkmy)#z=dM)f?xE`p2uL=-%0>B z<8xD{)dTGSW8?euwy1TxEKkiQKEfSYY1suohunniiT}#n+Y`^K0?A`x27y3Ym0(p8 zO_)(0Wlo~w4TCp9W+A|Lli=sTslp0_ud;^&j}guVdk3CIN?WtCc!C;Xi-`n43P5VM z$ebDxSqGQ3XTCMpd()=iTLtfELQlCMkVaw~YbbcPWYQUStZDpQA7~GpS}f@dYDc*` z3k05@gM1R4D(pZFeB^vPxLw1K@sabbZv^EN+H%cxKo`I?DLPjxwaaq#G-4x^HV#vE zcvx9Ti-BjutTAQoy(0&eBdGJx^(j9mhiwa$c+kO4M@W3-p>w?;Z0vaL+i26s>MDZ& zDH~*|N-iLMv4#9#DcgwBzf<~D^t~bS4cUhOQ0dd2+EezUWdNh_5JFE#Zk#r%`gr3g z=B=hd#xgs%kOzN@P&=g#?4h*swUI!%fNMr=;O9XHL6eLG%13K23Z|<-2Z3$TN};t2 zei$$}^r>!yQO5Sl(`IN0h1S|fYacKA&x8fm8YN6nTa+enXKo}(LK~Fkfi{71O?(NX zHmJ4IT9|)mUn`}w!q>hILJe!BjpK^|C~B=yN^7OGR=%lQ@Gc<+)EEHetAThy z0=44X=C^O+cqkWq7nFx~GXs-;xpy!_DfG-(T3qqi&qDidP^U6=E_`_pv>nu@(tJhl6udkF+J?t&zD0vn-V_Rw5_+r5 zXzv~8+i+YD*QPRUEXTLn_Xc=g`9tz;;T%{@4^s~v*d2ai<|n!MfJ+%)InK~;1bnN! z9CPbu^R%-3-^6RZGTDI8vatv1{ zmE&7V_!cnhtXH(wYA=H>4fI{6F9y-J>|8MDM^WCQ^>Ku}P&94}rJK57oB&#Bl<%RG zhw@#NGV7@4W*Czg&BX_OolnjAG!|C0whqa+<^GOfE-0j}*4o6~6-+JZCA7sRa=}63 zNHN5o0?S7ADBLg(ku~bdVe$^5Z~5(I`831<;h-}1(57MX4*L8^+8@0zM4qyB9wMLc z5K@nKJUMEQb>Bl8B$3j0X*Kz~V>W1iho!X(+S5hSClz|f3vGcy>5~ou+zN=ieuv=7 zj9v{!fnEy(!lK}}8p95O(+CtHKq^w*(*#EkzHv~lfg+dXfxVQ{1289aSuTj`>LWrE zt>D|C7p72EP#Ni4An7U!#2Y46sJd5>%Bk+XZRwL0wPHI$saVL2mTDFN}!dGlor1@@G6dOI+(gxEw-@Ok!j<~mDll9 z>+>L_c{OmaiV(;kzLLSOp>vY3PUg7^yza>$UXb#=U?-d5L(Ru=-62wpdo-8AjK{~{EoSGGfBEhvVM*lr<%AG=g}QcbKc@_2B*$pyA02Zf@#hK zU=21*NQ4k5FV8u%KE)@dok(}Cn>RaFVb+`=Ump_@>-9!vl|U&y>&* z7jcny#uwGW*BdNXC8ef*k9<2EZKG^^Xj7TL!=2_UFU<)PKftvIUWU?|3zmMDms(#y zI@M+~t9(qXywFRoj2w9=quQq}#(2tV0yY6$ zt+oE^mE+gh?hrfCz2w`_d-3=8zm)$PcO11&4UTl^%ysdDRlni>?T>`po8L z@{E)D_JJ3Yuqvo_sz|wMZr^k-KV9~7##S_O-4WkoUC&1D-|`4KH(j8RBZByp0?+r* z+Sp5m^L^yxr%eBsU26-+za#JkljmMF*IBb@&43$Vt=FoYjr6S`CeaY-|J3&B|Cc@u znOA_uCl(X+IbSyeYlePl&uI{l0uVacB51R~#~1(!qIgdQ&KgtzP(r8WrjiDS5Gu=s zavEKr#1RI-)xkFrM#vPnL5~&<6NooZrwf3ZnIDRPQB-b0Kwc4k$mA=E`D?ykXx9Wf z{8j{ylpf4nx;*$1S{OhVHd2=dS?04tNRpH=Dv9AJunO`H+5wne56dh4rtpNT>+>FU zH5sR)nZV=BitGD(r(8LHmlejhD4om;eu|RY1J6qrT|?@H_47HXaX)^);cs;0y7}h3 zFLB>7f8dzMKFO=Qmx7d3#~Tp{l5|s8LQ?5elkv0U zy&SeyoIL$RzBKQ%T)*OvB0_E?hjz^=(l<5Byb9fKU?(AIG4@ za&^B{H2TKrUGa;97LGm8HO!+m63L;B3)ruIHrKEHGaibs&pC&Oj=PD&9yyuyU8_LY z)CB5@{cb->`k%b@%$Rq+NaBpE-8>!yi0RV17$GJXbMDXL>N@P+Uq|B|u3LvjmfY7sAK3r#4wRMZ~m2Y{G^+@Yo}G z+8dBD=(_lUK;rryceFgfm{={JoPH_?joObpTK>hW?XR#QwaaYKe2jF&6(Mga7dMbnmFtJMq}DXt1{+4q zx4td#OZe8#sTRvqNvWuRNBMTRYev=&p~UsPnV(`|qY1Ko=8V&Lsci{bDdJX)xb4uF zPZGB(h)aj0m%>*bRrrVGc4 zQE8iaP&r}okB#?{cGEn({b^7hwpB@$U1`3rJ#v9&!ti`h*ubHmkCe6ovkLoCR7hn_ z29`$8ebr*+4M2HId|R~t(4aN@*3ROf#{IaZ-%rl?j4@X?f@eh532iM;R z7*tm@VF<~PHH>YK;22ASI+qu=vdOy>WJA_4LI|piN=EHba@G)1RyrO(1oagSejA<7 z?Z7ar$x74h|Avr4Qf*c-WDjH6c?=;@_9(R#js8LDqbkQ}ZV+K)TzSy+k8DG_5jvgW zn8o<&b`EIWhlRZ_am%Z}IlNxzZNu6clo-{PGvQD$ za+DVuT!S05+~vBv94=rW6`tL_Pp)Ulc8xMWXoPZ$tObRLdpHK07S4M&BB0;Gy8}Ik zFvsBX!j{|K9;{%Z*YV+*r}Lu&zC}%@hJ}4EF{NfAzgqD} zE`I46?mzZcnkpJN_^x-56&W6T`=98~ZRhB}oytDVdvW^oQ=D^ZgygoPujhg8$C*?; zo~^ll-gVy@96RwCt~>k^CRBH_bnB~}@yLHMWDW7iiMP`|w2{8iZ7k?GgsvUyx#f*N za`v2$QfJokm#%v_>ya-rYL9ZxzGrd40beF-WVv_k!+iRIvzgy<2)}&u)jYfTMOrFb znA0?q7kZcQp1V%xgy|>n)1!U}z}fRY#+>GveEIPU`0-Jfuz%}3Olk6i7k ztaSY*k-81ldHmUy8YT6FJ-^mi``TsO1^}d``=rvFrKP7}2%@|d5ge&}P2qh`Cd?Fjo+C88i%y*$LZ5g zVclRiomK7Jc*GC6d+meFYo5)rt;_k?L!aS2Gv33Mhg?8QMHA2UF6N^TeU6%JJ@*`c zE3fshAg?SAY1@xi`&aPi)&Ij6=Y0xO7~JyupZMw%-$nx8Jm4#QZNIaTLU8-a|KW2F zeV!Ah9>A@ zfq5Li6q3B1kE>~}zrJG8NDO1jwlI^;tD+kbMjrI;Jvq#u^;%?X5 zT{I-MJV_#%Azk}}{a4uh&`)L5y4R!OmC%?^oYaalu8L>w>y!}9ad-SzD-?xPKJ@9Fy z5Il6^Z4Bmz`RX$lamhj7;E?wDWTeT3FJ49Oa3815aN3049qYON=&N{B=OJWehF`w+ zJI;RWTnr%*@f{1PMojekn2h59s4}!^8%zzp&uFz?jH(f#bfr$nd(6DmxChO{waahe z=~cJ0PvdOfJL&Drte?t*tB3f|>@)e{{Bvo{*7Ib~3w-R!udrokBUc^zecm(acq+|G z?q2^OKU;n)Hy?gEFZaJreWs2%jk8#?5iUC5t29+KFpwYO zgnLeB&DP~yd(_pOIQdv|D#yhOuj1+@*Q14S_fiYzKw#kBb&v4K<&Zu(d)diwh3=8eiS-ECALGY~buizsdb;9^&`M{fzl-`|#+7r#NZqapYB= z?>uuEKVAF_GMVb~CoJ8+mCz`IMmZuU5-_AN&2DYmeJHa9@?$WdVw{hI{W}^^gomu@ z22>#bv3^fPypyn=9bj01xkoyZ@~*@Kg#>KWdSJ8G-5HHg2;13hxn>1P>l+*ev*Mezo&(0f~0sxEKqx;o1sw3kLnR?1;JABYa` zuT@Umvk2oSznA@+=CG{)bsp}1f>UOm#&ri@%q^>K=k&+V;iL)2 zaLN2{^5zN0aP#4p(>uD2GamaKBlakhYC36jH}X%c?qG7w1e{RTlF7B5OsweyG)QmXAF6 zdEPbccrH5pLh3WMbX2!Cdw+)S@BekKc;)AO^678z!Ko*6 z?ml1Oq$wxzlY=j0#r7^f{OH+K8I_E$8b?FMiEuZ$dV7=u299nByE1H?x zv?py9EmRp5bX2wR@mcR@dfj9;4Q}MklaAr{M_+Upp2A(P-_A|1IOpZw{L1gRYRQe< z_?D|Uc-;P+^T@e;{Qh(38S3$uE2i=_fe%`1Y*V0+(}T&flFdS~!LZzf9$!h|ZB%E= z;H|gMAaOZVEKMY_k0UH=0+1E;P}xkSd+u1hSqqhoAToSz&ZoHY;PZK6^Yfhcz$fV$ z*}`v+zLw)ByoHYH4(@r|tsLC8FQ0$%TU@&MCwyx5XF;sc{b#XmpxY0f9V=HkWs0_Q!SX>^XUCwoLOZkDwp0@(|KTK1$feFY z5m}k#`lEl$DN|42V-KCf&9DBBA02u=@1Axtc77yQ&Pg?$>^XTpCr>>NfERmTW?Qb` zS-PzhEtM^dSR=gi?lXAr-_E3?x}BdaxP-=vCR!>RnNl~A+Dr}SK6MH0RjqvM!2hD7 zc087yE6v-G&bqvnx=9&!$dg=^5!*Fl6?P`1Yq3j1VQ-LkCxH3c2H_&GG2M>9CCMof zSZ|I#jb@M5vJArjtWL?gRQYuPrc{~J%AE?EP?w?a8Vm(m?^(LA#jiv|N@duD9_SHl zG&P1&Xe|^@z&&SutP_MmyFnw|PYYQ7oTe=W50*w+1WoyTn zaV#mPgq|eZIv6-YE8DHVt*-z8AOJ~3K~%AygtNQBU9qbaO50i~TWIYp(^IaI=4yjd zF3noG`>zVd6BH!bGoFIdAl#br0!Qc+W5#1p$)FJuv=k`m29AgtPZSI&?cQnmB?hms z1iC)2sI3+%+Zj${tTu9bSb7b+hbIIR>2#u<55&G%?oy`T9r0uCJLdnfEx(<2KKu!` z4EJ*O%nt)lV^p(G(`;;Qb8P3E_}Gm1VF<}puiVI=Ub>NMU;UMf+wmNFr=&YxNyUgg z>d(m8?%I1xS?)d=c&&d0bN~DnKKtkw`QY?-QEgT^UWt~un9^i^>pW)GPa~&tyt3_e zE?amdx2?JhfWLO#%Z&@KZ$7@~sQ}bvYnjtL8(S;hGT{iCDx4(+e_eGC zzj*Ene!Kk70L*RLll9wH@z6SFRo3F(WjyivoopL*4*NX3^B^ju!S9#<8AT+bU$9R7 zzr&rX(75MYfHvqHkvV^J^P`Vy8(XaQ!rLbX1c~xCfsaXPq}Jr@JXx9HuA^__j-!6Y z>Vb8<`=O6xDT~j{Jk33YzLC8fW&&{Hgkv~k`g;JlY}xhP{?bj{u>3bJT8D;FkDuDn z;=HoRDd*XC*XG;Wa;8>*=Xw@1^AAVxjb|_BV>3U1Aq}Ju9MC)mAp}Qs9K__>@mR{@ z*`7uGc;OY?*>xWPx2?L9n_s+!=Xw?)h2)^NeK=#*d$E*7YgIF|n;g2|I&p!&T^qV@0d zI)S&^S^lLZlY^jQ`}Q8g)*B6P%chSbfw$53!F(gU-K78vfybg@t)uzdHdWaMJ~aJZ zXf)@)a5;A@`wdqt{TTqqPdu6@sNzSrZ zoc%QY?m@ywbR0}Zz#mrp1+*?4K~}8&LdR*1z=a3B5hfR5o+# z>whM1jk*Uk2kR_Qe(&ciaeul1X%lYiA4CrH^n>mT8&#aD6B;;UG>V+{wk?!&&V`}598$MMGYReXEl54mmW&$#*ZKhRv! z#GxGrGw2>_e@E9n-1y=Z{BFe^0L-eNj-~PprD zuf`dSujv5b&EpRTcOO%*0zNeJ6ka~GM}}!=j(Er1xdoDqERY+lf|@CBJEWa4(@jA<$V_ zrIF#ijjNXrqE#0va-3^SA4?fd!EDPhB0RVx!yxG@$9RJBji)edEcy>KT97~&8D75yL?KwlhLN}we6S2<^XYN32 z;l!m-cn9Wso*q%yBjwC!@?!4d7)cVX z{n3Y$uV**~8`yFV%Y~f?8lfqSmR%tTMcYg8KJ8L|IK~=)kXq>`%cdsO0A#gVJz~ir zsi+T~xSrOLB)!vxB_iIcNYf1namG_$;>7W9;T;o?;fU4)S<%133GWRY+O{8~)@&Zy z_!Mgf*3yu5?0}*C5C|ByhTSqa0rL&v9Pl+{4P%&wb3kSyZBCJ&?^(iz{w@#(m4>so zVs^s}##gnma(fp~Z+e~~YY0P_3|Ye8L)I`DRhVv&3R4(9-G{Xwz^FaKgXl{!v3zLODO|hcMn3=WH;_^$ z7*p}aJX%tX#+Fo7RLBVgLZBOp)rM7ois4M^KoaUR6#CfxJ1aAc*rS~B#FzNkj8i$h zb$fsQfTWyM|># zr{>krGn*H(bzlRS)lS_4`!?^*jM~X8>08Ez!42f?JObhH)7{?$Fq|I&v&ucR6*9u~ zHz6Z$ro`&+nRJn(64&(@P=m z`oAi&Za-OJWO<`!F(>@(G|rph+JOH7KoZXK9?X4@zq-lr6N*3rkzrT4~$yI@wY=%j#5N znV`395468@&k2X-M=IA!X(hDMp7%*BcPXFkS#+*f%U!;wTso9vXK9o|;NbQ{mJ?pK z7c`pJ>E=;I)x;^+2!Gl{ zY!#cOrF*39wkoB(Pl3DG5+HBzxpeDtzVO`n4CIHn=HLt1qkcLMZhR7e>zDtA1$Uju z=b!lwS1r4ddp0}@z;WY`WPJ19e0UGXgJCP>1c0zcXvoy@=5dE{Oy?2QXX>!Dg|}43 zVOe3gB!zHJZC4ggZF&KKd)Gh0k$-t7A9&!iT>a87Sk$|WnoO13*%s28?jXSHB>IN8 z@7*g8x2&uRi}hu6+6DJnGJ1zis>iCbZ1u z!+V?pIEp)Jk1}kJ&{^HiVI7BYOvmAv((pY|9$$nm?0AquI{dXpczW|fz?r>1@-HXy z(MOzUUaxL@149}PKXrk_&LFSAtBpfFEbe_7LmFJV@W&i=+i`s3>F@FLmv5op^&mPp zgfH8|jq>Q#(agr_Ol{wn{oCj9*@wTz=O1zQP8~J=FhDp9jsv_6@->aOw$@mJ7OTn# zEy>l2E-@OHl^AamcwLIOAsT`&Lb{*eok^3gpqvr(ylM~z10!2_dhgChJbxv{$zBrjCR7>Qmq4 zlMjCxfHzM#0x1n=J}p|V;JZLQ_+@kJD%C>~N*jkO%3G&n!j@!4GvNb14NI>PBPv%? zZ^z2p5bc^Uf75yE$gRzLr<_Q&S;cQw+|I=df5^GdewV+ke}tBbCf?k61j^ObXxo{$ z^BmcEB;%@D`QD4y@WF@9X3!cUYh(!yb}M9twSBL0`^vj`Q^&!~X`00!R{RwM!LbwG z#QD!%#z!7J2Y_QIETFcK zdh4pcaOB-5apsd><=R(&#jN`2+_(NwPP*^Iyw<;hqsJY}xXM;6ZSkh|gP7AcpHrqB z&y2b$EZO=BOL~{^%C;5EYnsi1aR)QKb$?Eu@g4@PAr|#4@eOLPee_!EoSkQ8>pqy$ zVa1-IO)WUGhpL2b%zd)T^cLwP4tB^|+2G$NS`k33u1w z39XeEr~&Q9dR2vA_dwrp)IAM>BXqqzJ5F450uch0R$6;?;KF;2rN#?a?mlX_Bhqdp z?Lu{Wf)m^Gv}1W72LMs4i0SHhqLE=luyh)4FkcYi+;jQuilCw3@Y4) z*9(=Lard-j+(BAKnq2k#)y!|5%MC|e#?^1S2!K=X`4pDBL?9zGptV1c$jA(c49|8y z%PU)!bNZg|WuMkLSazO$TKC4%Hoe1Jxair-vFtpiJCo+NkSdHU8JVH2vYF@B-pBciui%OU&*R2Jf56ulUdo*M zncRBhHH;p9847sUgP-8m<-g@!laAx_dwq;EW}Hg*P`6W0!enT;m+M~nH5bnR3QwMN z2QT(51zazl#`ka^(U}!zIsrpSjI@^1I`1VDv3lVQbBCcfKFn9gI1Vo^(OhgaIkw>hoakz4L>i~ihI;&J9n22F)M5#W*)}6aeZ$r+l6y7GL z)hK(EaW#`TeUDSnT65V;H}KLrCrHHlk*yp*;V90W`F+faN zjx}6y*aduI_J^o3ooI{#;p?C&Ot5qOa`_)PZRUFz%nx$c>ia+%d~M&eIOMn+u~eSE zk*$39*&i~eWj5gKqCRuZ8N6?gcQ9(_7_vq<@0st@Kico$jLB}9yiI@|i{5H-&Z(q-Z@Ai`NFg3(^A>Yh5LP(VQUyunq2VW6)f*xi3X%Fc=-6+Xsv8!<&HI6 zvgk^73~lDiPoKxnkGz8W-~Kz4)@;l5bJi2*vUbZW9NBTGLyL66-g~P!lva$Z8pl0v z|1C;6I`~-kGhDs+2JY^YZhG0%UjNHBRe`1UEUbLi5TegTa`woA3-pcx6!^f@Z*F- zQ5j@>S6h{0Yud(&9m<@>Su|zp zd1>2gY#Z4M(%|s61E@8td1CYPSjy(Gw*4`MNlxWh*te7&BYo6YwlcqEE_QyHj@k+Q z?&$0I`SRcLnMc0_(%_)B`P64>d1L!(##OZ<5G?F{iPp+yX4Ow;?cjR)b32&Zv?o2o zeZ1Dc0ub1C9w`lu>^Q_3RHJ#ZcPYcxFbB5n%V2(pMZHUDt88J<#y!|DxQUhhE1B6i zgK^buytefXy0@>Tp{kVw+xNwgCZpCU&u)5=x=amwH}A>jp&nk}x}1)hPG&Srb8)OD zZ;vvqaT?R>rnvjMMrp2Wat0y;-7M=}O2(){xJww5>o|R&q=70VwcFLL>%P-{n)iN> zFOQ!%I8OX|+r-KPM@<}mZ#ldzN`poUgL#d!sWGcqvh`JVjBdj;vK-cSAQd9Rqnnpc2Lckoi*GRD`8XL|h<*6divnjLG{t9dppl}#+`dySqQ>u9Z;z`iYW zFoeNSeu(Ebzer1EGkZ2pXZ=7otG2CVV*O;M)=gr~zH>Ygpd*8dumzF zr_tnN;%)rBC@HcI)!ThF2G2Ve*%B=)l# zpGQaoAq-T0kbT?d(_Ynz)`~^F%jg~K#x$##*{}!Ws#_9?^7<{jH6R_&KFB3_SB zzB|d=z^g>VIFdwbn;Ns016t-WWRI}8Z<%{sgQm)?Vt&g!lvebOY++ng8*2s}-I`iA zm5DXuS+%2!HQT$`qj3gPYbUX8a03~Up|PT#MSaWIqizaK6^*>mvzQ%Q-r!9$Pv)_A z{)L-f{Viuc@HtGgin+~u`F!mj+|1I=i&+ryr-25V@ z%({D|b|Y^~)KwuN)C~(&J)+O(x}f|2d9Np5(D9yuCiB<*ot4!(rLT4JEyY{s#h&%k zX{&7JmHrj<4)>segInj*l&$Bvz9sbMwzHu9U`%OZE1Tzf7t@q&U}pU^q!0{PLp-(a z5ssexRvtS358Tmp58qpSHMN-nR?YS^!BE(5s%Uf8^Z84XjJ zQa_1x0~^T7EDhN@7WXb=kA|rn!|c~Khf1T8mwI1jAUBYBzF%1Q<7_a6 zpl*QGmBad|)fadB5XLsn%gF zox?UQf6tR=02M-^$^x?*L%4@2=7*e*X0^jd zZx0j#j4BLiV%s^eMj$`HJNEn#e?9hQZh7NRobmAIKuEAgowP<4>^um8X;wS?k*s0o zy)Yp^1TuqZR{G@GTA}lUc%p(?v)DW~!V`(AEgZELpPx5aja1pz;(BJaiB36GnKDoi+$doZUJqpe|=57ijb za5g<#&b}65Ryzl8+9Q5rDl*kb3~V*(@Gw8XN9LW)FBe?FRZD-)7oYr=!#j6vJ2LCk zmk^j{4VFC$_9z(6IWo9=o=l_CuMk`1T^YltLkfYN8w6>PF>A=%qYiJ33Nl6o`TP)Q z3t?1Y8X5AIOCNv`WXx*k@MKrEvSuYY%cVtT$-4RHJUQ`$O1Ni%xF9#@ndu6yvQ6D-zS{vgjp}zlh~8 zuq;;>j7rA~>#V78JiC6IAdxQryyN~XYY4mpU5yGdZuGx=03Rxkf6%uy$#``ixXRk| z6w{Az`D5jZ@-~Po>2F-Ul?HV?`0sITxe9A3s_-`UfB+ z8ME45dRv6Y{@-DkM8kL|^tR46s2&#QuKD)5OFgj3-|F0dq}jZ8%fxK!&gpG9b7hY> zCdpB|S8v@QdWjpoex) z#iv)ET?U54D|KmK*0eTS`TiYRZ?DOVHjQ%%27b^8EwtkS!f6!*&UsIsZ(0YI?P={D z;p8+8LV593!HEM{@J9J*+zwRZY>z_t2j*&mo+ljrOAj4A{$tOr?oS9&er+QS($-MaMP(KYg9NLe&8CD_em!` zJ1+#Fl_m$R6?SeMumj+g+jM@y#S_-cyoQX3?`4bTkwinnH;HhKVeh?i4%{?r3$Rjx z$ixsB!l@f2Ox6sn=gu|v@nYXHgm9K*3Ll4d3@e;+nlfA9wn+>(X8EHoN8=wX4ybH)l(OK-Y!B`RA+Gs2xCZBSOkhkCN ztXt0H=*d}ni?rzU`s>7qdr7}3ycJ2XW286uEgrqk`OoxpA(YMyP!rVQK$!%P3Cf&@ zP!rHm?M$LX$1ff|{&P8l>txv2@}JOi8FdwabH@1^B}LmnZ%;e00if#|ott>k#PuSt z!7QP-W%4#ed$D#V`t0&d2HVa6E<+d&&%89gj;gTEqMb<(uPvp(Tf?lvLQrE?Gq-gv zYX;VH=?mAeq-QavYYb$}N}w`S-i%SeFTlYas;g4{SP|Yv)9kF?Y9@>GgwPi`A8N>S zk6Ms<41WLsAOJ~3K~#E+uxUjS=WU`4rW8Pfl$8is>C-3>7-lUY-Uf9_1JVfaNu%r$ zx`#G7eQnP|q}v8N#;jA(ht* zYI5tf*s!-^s+L+ip=rDkh(n!oIIq_vIeu7O*v;ks)5>2Ci2EEm8rS`!uyoJ;=Hc>| z1>zZC0HRkjbT%B8RjN(c zvd>Vu-Itow4kNj962)Lk4J;rg`G!%&vzuS!Gdvu0A^J2(1yo& zXwALO47O1b@7U6CG8SV$h1S5|W9DrF+|De?EXiB9Dr^B-FlpJ0hH78{pgPCUpsiP% zmYQQ3B6Vq>->RnMo$3i41HHj(%=J)8XN#sOUAJR0o>E|UwM;>rq55{aP+N%hQK@`G z3LL#PMl`ZAh@%7@k;lJ>-WJV&7xdONoaMa7-F~w3QfAyqj)*M&o9V4Gn6$sqQ3(tK zjAr@=HMMI^OV9EGyzL&n9Xq|=Wf)Z~>RamewHepb6rtfCp|?@q{-c*#^R-lz!xq5E_k0(0JuO$zb_jE zQ~Jks)iuDjG82Wa#Hf7$Q%2aK<#3l!Jtj78oIMM$HF&}Ga6%Db-tC?BDOjNbXYZ3N(}+rpx~B=9 z_Y{n}mvkk0pT=rL`4RU#g;yeGL}@p@t>fiJfRKR$esLocW|gIyOpTZlgf{bXqhYH} z(!-N<$1^E3>N@c3HZ=b7P927g{{~=PT;5q8rZh1!_0AyMhfTp1cwh3c$tbPpc=6n4 z5h`Dbw#L%x0&Hp>MG~jhd+=9B=m{iuCK%eZVYUZJGc_xXygi&+7fHMg)n%N97_L~E z5@2JvoI`hwOkE)mKoV_{{Ks?_P6-(hlsV82r47R+NA3#1mXgg@SS&E1NEx-XKgU$`ujVB>jruk467X%r`=7k#c*H=R&k5 z;SQzMB(_DdH1YDse*H8N-bV7(fI^SUTe>BfOlrN-$lD{adWh2T57*m-{1f?31V<^o z)ffoOY%OM{&hbE{;i3d@6X^)U{X_ItY6MIf0AFwSTe5x7P^>cSBJ!hyFT(F*(d2?< zD@Lzhu6RA5H6~tP8=SCA(A!A8lstPbR;D6#OGIyzuCd5#ER8PC+t9De+l2bo8gxcT z2~(ovNvW4(W$+>ohObbMlU$Y%Y_abi4ri9FtSbT=%Rcm?h{s5K-%G)iiz^CSjuGX+ z6>9z&=?*g9If zAQW9;scFv zJtcR#g)5P_(cfU*CJoqpIf?K#+7d^3n}W**L#sJ-vQWS11wz_gvFwOCh9~=-9~w<3rjsy+oIs> z0Bowf>M&fIY(?7w5jCJ}nq44&?HdjhpjQnfrZJ-`vIuIzsnDsU|kPhQa z)Z0)QqIbOf|7g9{Xly~_5QeX}x8JUnz*r?MJvO~1Kz9E^woqspnccSNmP&7zN;m$W-u@fwtcTS?M}#R$-cG-UZpj8Nn2)|_Qz2UU1E(rA~BQ!(n`izC`Ed{AsWi` zI3>U)qV``F@e~#No`|>Y@{;9d{IzF`0O4-`R)>=5L^Bj+o>wU5nC|jd#{AGK}*5ED)^v;LU z1iVi{FAn(LC+}}aUrLv@Y!B_Gb%RD=P;}XzZ>*IOq$1Ji3wWK18BrQiJx`wZ$zfM< zIzlunl--b5y1G^B@DeZqE5)detOX9tDY(y}k4cSLsN>S*HGn$sM-&I)=b}r15}%9U z43#fVYa;Fh*rH2-k{b3RIFsu;kS>Z-7rtqsK{9o(^Y`+jJk(WI^`q#Lc6?qSo>zH1 z2-53asWW(Kb&ycTw8Nc~(g0z{2UN7=$o6v;y zmLhsP23hp3G51Re&n0;~hPI$&Uz?b=TzQS;Unb6?6P78uC2)4O2%$SvR<#9_De{~1 zd3sQ09A}{vguE}suHC)&NeA*z{Z8`t7)%jdi3CJoisFqqj(YNr5hW{I*bbL*BM)TJy-}2>w;lQlmnf z6*1R-S_75zuI!nkB6t%T^V0d2kJE3=)2^|WX^iWY&#SrM%i+s)bt1~I=m$=J4J7R zWMDYtD$^qU&#M3T_9Rw$)#yic}pgGOlO7)#0tC4o|I;0UE4uOS#T zLgUX8c>A7$73$hLzW2#9HloIa*C3S>G(t;(a=lNneNTivIXY#}Q!u}z579kOXcB`) zXp+58!u33P-X|@R>G0tbJ#iHFkvRb;l&a5Kc5P=6%(Cq@(q^nd^MFbS}UxLkTD z7=~_&=B+&={w&$TpDnbc7HbSU(2#2#xXY(ESOz)zqr8pEc2u^acclCx5m)dz@-kIk-A-F+v;j(s4)KS=36eDxH5(0!%`!^E80k&q z?M~3^JrteAj@E6G3g3smYL0E4!wx&}Ayp0ytCPUF{ zj8PXtAB(kJUb%|(iwSj5ULc<$v|bNHu{AM9N`c#jm1ovDh}ni69sXeZwXeN4ptas0Eftr=Gj10^>~xv6qgsbN7gC7TG9Mr+1$W_Zom>z6 zFV)+iz9q?4F+E7o+jQA2t_P*`RtwQN-WcELWxes-jlI$q8=YmF#dRS{Z>S!VcTMct6UtqnM;Bn-?^Y)pyJbiiKF2Pd zlK;-YCYE2sziU7%gjD17w29+NXB@wZFYN;a_F5sg9)Oh-S_tKzG_MQNSUB%V=y1>o z_lkO)3dn&nm+qBZwx@CILJ`>Wl#ppT0V+!77rDlK-V-=W_e2~v23Kt9UZh@Q`DqYR zS$31wx;nH>s4`pGKO(GkLg_-(x1`2AMotta@<;0TAP!v|CW^BNOkvu%<|CF^c>b zMR4kJzDKVjhDa&66fy8%iw(;hfSs?OWSDUN>EDBw0Bp3T-5RRs$OO*!EB7kuk#ZpN zt0a9I@&au;lmvoCXk|M=BZShtu+=xm$@5%E9g&It^;K8MPCG$(8(F+4#BtPNNt5J57wuPLu*KNWNO3;{V+#!VS zl7W+v!{vxK>i@TqwK&cKO=)S|Kax7qV3|C;iF6g7wbp2%Yb_BDfv&Ts%KqPGfFrwNBZ*QVMaHN8G9|Au;-Mr$JO z1lWIjz13i&IxR&*@RNX5|m8rLBb&x>+e?mZzMBYZ_6;jI`(%Yo+1pih}gmX)) z$-&@G0ET2$eprGI45xP?C_)meoEPPKUy6MXUMcuuunBO9_zJMahGkCrG1QL-U-Uc0 z>!@h?1sa=dm8e%j{(U@BS`4n1qF12v0&Oa--O;<}Bi4Ao&SeJ;i=bw+o4i3m@6&Dw z8c{O8$d%@OveR(L`1_slKB-8)Y5B>xVW+G*rFC7)=mwgA%>WB8SUB8v<-|48j{;w! zlXh{1{wUH(7x0wsd}1FG8{3`mKK-+1v7>m4d@ow2QnV`26#|qITDLuF4sH;-xq zXySvV-LX;o{{n)PS*8S9)8(P?!7-AJdMz@cy^TW3)l%sZpdtx(N$*n`^8I%S2mi(02oD3`bYWWD{ntn?_Ie-x)E3R6DLvFmMsw`jDG<9eD$ z{c#jPKBrfh(ilb=RS281&N50TG4f(}dY^Uywul(~bG=Wy;C<7DUxmiVYUE%zQf|3d zNspA0{p*C-n%8PnXzd=tE3|T342KjiT)7a&i$YfMGnjL zU}4wt3m%jkxTEPkZ%_ya!Veq~rK8vZzajeEU=_aiDJ4HIz=d@05Do-dpz_sr&T6h6 z&Q^wJKy71<%op}s6kUU@wfjQ*KR!(0Id~}Ju5M)Y=^-#HUdsCv#Yv$|yJI73d27rA z^_4(w+McJxI*rmA=q!ZB*`}z~gr;koYCQaXoqfGBFM9m_Zv^WxN^h{fBJ~iYg~BZ7 z?g$7Htb?5m2ojT5A52pgZv*8I?)eeX@(_ki>kI*-GRsDYMv7 z{Yv4jU#_6MrVYlTI3u(Q?Sxadgqk3(Io?0ubM2BXJ;K&K;@??slX$zk^foFl|AKle zoRC_krR=G}_sU|ewDn*}Z;9w_61{2i?a3kuyiH7_!!$=o5AVS$Q@*{2px%-ouSIkr zb_dFzx>qkvUZXS;k=H11qc{_34b!ExYCzcGsEng>jke_ul#wzs0L2czHHAe zxFE1>FAzAQB+XG8-F&^^6iN9B9Pd+9p0scbC|e50)oe?su$5g~o6psRWKjl-!ub(E8=FQi8Xk-!SZ$g8-29w}Z3vAT01l3En1pUXt`m6HXkV&(~Y6(5MOH zc)i{S`x?ZC7GFq|lqh+bGS6^-;QR%hKD>Z&(g@S#SM!IzUg-_W;g+u--aV zs54r~klq?9yG?4*EpeVVT<8PDrn)+r^g13ZqT+4tpKUbjP5{-HK+`6gC%Yl#A?{jHpMug%eq=aKY`FSaUuCkO>UmINlW=ng$fL?#2TBtEk>4ZWJl@8s>oqhl(={U>sJ|#7# zDFd;1qh37!cxM)w5lc)H#95?VI$;(&tpf<+jdVbvnOqmnjq@_GLgEj|02Hhgd2A7y zg-M||u@fpX)0swVDcpkdJ|-&slb+DqN3iXU>NbFE7`d4Bvurb?#bk!5guH0uhm!s zM|cKF+Oj?H8pRZEP}KVr$S>(i^FDcolb6@dc%STm_bIrvF*xmIXOyz)Gn&fKMmk}L z4HB`{nIR2mNU*W-egpKBx0JxUbsR?^O?cKgMN4Cia2zht`xH!^l7Hd3fU__IopO7$ zM#~#WlRAr?02`w<@)-Aq6=>B;fzXY4a-kE~rP5telZ)X^qBrncbdz$iI!J&k+d~n> z8Gub*`jU`;5>Ef`6y8REgRlt=aH6~>;fm3bfGj2_kq;UWAfz65OUo_3k=%Vj_b^(o z6)H$;f_#U{gj@D9H=uiEOZ%>a`c^_`V>nZIJ4V?m%6b42UhQpn)NbBZ&Vh8s64u(eQl`BQF@8jL6o<;1aA}5mf&qteWlUrr*Uv5F3C*F zzeu@5!=hsSavH5sTxt0$jW95Up*kX^K?%7MWiqzNdqs=`A12|7)n_@lQg9~1gmI=C zPCkw@jHe)M(eLbf`BTdTx>)&zMhM+L)Hl!;O;_qFX-Mf)wUV;G8`*F8#z5%2C&K3* zMU9D4-Wh~|fbkTqfRGobg!ieaHz>jTlyrHAbj3a5${tu=RJ8Iz0g@%;q3f< zPeJdK7GTSQ_X!z^fEbtt@p0QiS+&Z_H+0Vbsqh1gRBW|3qEwIY8gwsR!f)zqSnvup zJb{M#|FierQF0Vl!}qVcd(!S~)@oN9l(U2)pooM(LMDSmGC7-UjL9Zg28;n412#4W zg9!$aM6^LfMS@U50!g48HfV#ic~W;*y?^w~?9A+JkRLzid%ttu)|sR2?&@1N)UB#p z_tvdWI=-}LtdLx`1I*}y#MQ8l9dQE8&IX)VIn}-{(dA@}M40J2_M}z5RQl8XQXeGz znQlcaiKax9q;#WHza;(%wMQrwNQIkjz)Fm@PtW@_`1XVcJu!?)p^X%|CY4voKj?^K zBFseDroy9R+0NQv;wpBRZ95g$M1)dhn}kpL_Nt`9mNKt}*MJ$y+bRyd%wkT|r zN2+kru@q9uJwmGB|8Mn{|3$q`#3P~X|8;t6E0A`c%T)0Rx4KU$PDyfzvest$CO5-W&P==H;U6qSnJ@eGW$|QQ8IyIvH zx4ch1rmLqkK}YXXC$NM9U1bQ(HK1#vI$qso?E^p$?n7@2p#@zCVMSY1=Y~jUSA3!` zaP~Z@1j-W2sVG$`o~J{p&&lxD4x=-}$>|I_JLf72Lv)Wvm;0R(@#v~PDN@^y^G)<& zqL(ho>y$uCS`VB;S~-?dnSJ*A$OaAq>|3xeocE``yM?733T5IaXCx#^@#hgGo7;G~1u8LXrtUDppdGSie>>B)O(bfMLo zQdS8?flB%2|7B&1-gH5Cr?Txyd+8KbnsQyWSE)c#dAL&o^~qRF6qX}xT&N^>LlwecD<#vDxt{ze|p

    nKWMN0;{GlG z03ZNKL_t*ln|hmCm6RYUE73z)B%Bk5WS`lpESFz5lxET8!MjN?ds605%B3mWX){Pz zpYNin#LISDCI+lK<0?H4otNpPT&LYucl4)&<)lD24CRZ2^nt(^>7l2;x<5w>K$Df| zO#!r^ft@B>UhL}XyeEN3N*a-V!k?TpA_lX^=S#)l$YdDlj3`C2H>mw%=a(*NM7KDn z;+TMkg0!Bln7(N#MpVp#k9nS?XwQJCB^qTZw4@_cSYYSaNN4~gfdB;dRMEQNzanY_BfQFtHCY4(iyYoyP+u^T?zMH4%lh&NO_UKAJL&m z_w~mwCnjG{^+>s-*(`+Er~M}bb`NnlWZ9-E*R53)B_Nr`&v}J*^lS4_QpcW5nG9B>fsX>;eY&x2f%68pU+Trxji0YAtDzX0mkp52S zO7c2&TCNjVDw+b_3(^(?x}+h^)kBX|OSPsq2O;DKe>ncU+w-2Hh{ruCF-26M;_(0i zp+&tvUBK+NzJ#kovIvJwC>&h0G!k?Sz3%IZ;hYw~#1K57HDV*B!0*wcFr)24bnShT zs-1tax&$2?M)!tf^go3(ebSa$d8TO;0Q=%)HTGx{OQ76c4-hGTq-)4ZA(c$(u!Kls ztEW@S9!$by^b9jiXkFl!9;TFbJ8VP>jFiqf4cx@eTnIrR)C_hQ!;^z8ZB(Qc&6AB+ z_aK!-Dv6#-dk0u4FVoVHo~9%i0+dvJ%AYUy?7Mhh7+}!&s^)Jumse^Cq)LF@X&s&O zATC!xM|1M3{0~;KBcW!HCb}mFm*$Fh1)a97E?{=L+NnUH;&Ru7Mxw&SXwroqpM2O# zq7ls-(=8qeZA(eQ!A1bQ-dr@HC*asaniA-WV<|!Cc$E@;lFLOZG|hEDK>rRCiv&;J|MDt!z-$9E2ngJs z99+7QTt#lym;UoW=-^1|+>s%)!LkJ9x&(c2DqC*aW;ja`-N%=@IG z{asR>LhCrp{%?4n4#@+X=4GdS^8Zk8HGF8vdMm6*wdOJ!g%G8k>1|pZx+s&Vw+e+V zW&1+0JE4o7fm8AUgJ?nY1SU(F2;& zfA8RAE8FRJH65QP2T<6`MvIS83GmXjfgX-CiBt$@4%bT;Rxh9;_B_<$s&c!{11O^q z5h89-B*E;;Ad(&F6?)hBrGwdN_nkQQbyh}2U+SF|NGYyx4#kVjRnvUe9sNo{q}h4p z%1J4wAmWUxxU!>oB_rRx_bCc5);}e*i?pb^6qjh7j6KCypq*W8PtfhM@_SULUc?Tq38)e zK-dl+Vo5Aw=T1poT9I7C3Ko_pe$wf*h8C&Jka3*Epa2uM?Ff;>07+BJF28K8u z>FI9Y^U#i~QVP>HIe+Z=JTT{B2ITfKu$wZdVQnn_=ULn)LONQHl2PyoJ(#9nWT*5%9ln%c`dDQ`K zjP__)1ecGyg8PqtkbYTZn06$AkaRe9!UIxP7F7xkfGw@K%o8W2N=m|32qVFW3R$7# z$$L7w5-W+mx228W<>!v0@8XW5?9R(%eD)eVmC3mVr@UM8VR7v#Ov)=d82UG zU~BbSx`|dyCjmnk7|!l!49!3nI##3&({@5ndX%{T$+J_mfUZ3E8F&~vwfH$GstlRkLC9#KE@*_JW5%1 z31KUo7N$sPv+X<*D5+3V6>cu9?-hHsWx*B`DfazO^|sSJB&5Phz_$~9MKBA?t1DdXu>4NsvNMS9GP(+oV1@m8Soa-r7=?iM!k98&)JxC6uTaBBed1 z!?!2nQmVXSauCsb-CRELa-^~enjuh8 zBQAkY9oj%D+|;&BH)E|-URx%ox6i)g$Aef}4bn&`pV;D47Ozt4MF-)E{@l(l#>1p? zDKOK*N-o>8Jx>zsFx~oAlJ+~ra5kJ@2l~39U)rGi5F>6w4EZ^bu;3+a&@vFiZ$pf@ z19U$qlMWg8($b$;rv}mlWjpvL(Vxi2C@d*KlYP1O&@%V+$Rjl*Oxsp1T#ab$4>G~{ zQc=Sx#-teHDdBmsS0PIkX1k5s=L{~saAIkpp$nm;;;Aq9*4+8l=1MYMI;O4SOwojf z9tC0B3Z+2T1h!P@nm_|Ar^iAmFm%T>jD2rOHF0pS%tuchT{5~j%O?aPXj<~ZSJvFxnN;%i?uOt)i#F8ZGc=SYFroxnw$q5*nsb=1N(kSBPK>)4 z|5ehXc-a^X0SH}U=eVVvnRJ+(rfKy+EvW3Y19sv)bhsA^B4&VGPd3+%y^`z3UWQw9 zBa!@l)63kk>`u_#2%#eoNF{M;E{C0#iHfcyyL1;qX-H*b+GZTSTXSJclMLO>!^b>8 z&smq>c4^zvPCaZsE9r z$8heVOKA=_qH6{&&4s2ptAnN$L61&ullh&>=hy(5=6&MdP6${bN-G5Rwtp@vr76Q0 zcshL7&14}~XC%_fX+uus_tO_3mE@`=H}m=KPjS1mv89DAEi|D=ywe)w~i?)n^$E0c&7=7uA#V(!3W`RUu2(j2Jc@bW1< zJo|ngSn)8QZT}drC!2^JiSx;&yV|`SN?}T;-Pv}8jEvs=dgh%VG+y7dh}za#bfKdO z4VUgpFSo8_oA^vgY>V=o-9s~gRseOwo=Ene`|ra_EZ6>#6$vr2a1{SI<}rGC3&?i+ z0YOcmmfx-WGjDBskB}Wg7cQi-v828~u`yOQe`-%Q8~J8eia91k)I zL+I$5v)E&&v{jGpcAnYMXF}lCT?E1{Oevqj!ZThZ!|h|)t`+!<3@qD1MGw-|H9gL& zw6cxe+Y%{dp(R4SftvVhAu6RQO$=Pg->6RYHC1oBSaweHZF1T4A$uuhqyI%BZJay$ zr~G>AZFqDKnXU`~e)HucJpRq&pt*2quBhIc*viHbE`)FQI9&9;a2(= zkL7`5?xnhQKa0L!M0s8re?H++o>}`Gi#9Gqcln)pL9`E!*b!%nrMu`54wNX@u5?T( zuw{mlcJhKWfD*egwVA@L(ZN%aM$GX`Mi9g9LzJ8eMkZ)pz(%h5Db#!lx(=EfXKo!` zc#IobHmK-8kZ8~-g_5!0G2uK{rt`PvcIc219An5aHpGx$A_}G2J8qbRE_-RA_(jP&F7R?cC@~P^R=XO@KAsZL*_uVF~0*lh+X|5 z1ok;}+5vFqAx7K=nt`f#3uQJsN)R0j5PFm@>EJ1hD1)T~L%2YOz?FwK;Sp%rirlyW z+_~-ebdZOQ&|D>Ly#x7~34L;RSC0&-bw5*9=Hp{4G`&HSNUeSOCF;ISN>!eMSc<0(dHG&XbHuXI5Clw_o$GaHc??Ymp(+jpOd=+D z3@ty~ZFme#RJTN|!Yq%g&9r5pC2V8pqO>s64N!S7XcDm%x~5^;azt6K@6)TM4)VD* z?GHHIRzPp->qwHVM{eOg-tw~PSBECrc3LS?==8g!ltyO zBG+SR4IxtogQm*PbZeO|U26!MG8DE|QNGVGEk$D}B75cfwZ^b1uYLX7Dnmz9A850# zojo-Fw6Uc*)lDI*tRT}RGCX=~*pdxxVTk~LmRrxyaA~zI5jzx#W`F3Z@g!4>t~l?b zauEWgOGz`wg>WTz075k*M5Rz-uu=&M5#h_k(9Pm3aU{w2_br`l+c@0m`M#Sw%Vu^ z2%U>ZoWr1;{s3Gs{4AF3U4d)?I6rlvQ!Fs}GkQ{Fwepdz!p(Zj6FJ8k#W4M{t za0@=eM@dF8wz6psw~&`vNOQQE)^H{iZS{Bz4<-I$6pDZuq_(vdpYCDKpgH7cScHXW!FMG&|e4_VCNqTt;7@Rwh zFDh2?!ls27n!)PowPbtq$?;^<8VL|E+sN_ckYV^}4!0ncO>stV$5V~74l0$zmNuT~ z#5r~(N5~G-9BNJDWj@_s9$vxFuDG^eYi)>Hakh-)>>5 z=z?z#$J!J;(v?-xCd9AEC_*a%9OwG7K+D+Jt40lB`l(xzp-#*&PH zuPkb4*kHAQQRs9!kp{;o@)bGdA_pPoFtm}sMuln|c%gj|X#sCB=$Veu6WR~D*MYCQ zQ4MQR;d(^wc+~#IU^YQUf3QOiTz8&h^n~ji<4s1K`ZLOKawRzLYCmNC60UXgBT#K>!W(_9dg9WU-TgX{%di4=x^8n(cpX)xMg`URt+@ zkS%fPnwII(QHbNm^~rg1{;2ZuT%SiN#iH+O4&46k_f>mpTg(?OIlTYO!TH%AY^iTN zab#iM&)(dy=U=NU8=t@Ai2f&!F3MF3UR_st@VZyOt!R!|3L6IX%5>*uxLmsr2156J zw6!j@ry)#^&oHvx2Daq1Bl~7QF@IEPpB$g7x+!R0`{s95?|-?gY5cI>zQ@iOTQY56 zex_22r@!8PV1HA{y7ky0y?^!oru|R6zOnAXYp0i8IH^4En%6g0zOlZdb;XTG4G@}8 zKi0H`$CqbkT>A3b%B!aJ&u@-cc6qkXb;t1|dIS7y`oMxy4(pTc(uFt}w5($uTUJqB z(-wK}=QB%&6=iyk`or?QJFA;aTzU#$Qw%7jK&Dythz&NeQ75L%woo#X>5?*|k60pf zHOtvRkx{1(MvAq)wur9&C$7E-k{X;d*tS1VNTe0wsxg;wblEiiv3Vhvetex1^QwE$ zbPr>DkLC0EZ}VOK7Hnlxn9++Vugqma*)*P=^8|zQ22#^j%MD9z=dI1JvtY&o?woWJ z01cr=uKf5HG>2PQc;YhvoHTGQU!C_U6JI!*(}&OJ563(}jwhQ9wVSwd@eQo6UXR=G z5wXJz%p1r9Gw-G)+``%KT*8_iOQSRi?wWQpmyf-eosBzr=$QMsZ^c7A^7#YYdHgNh zc;q$Q`srQ#ZPk<9arE6Rn0Y4v&EXbq|Lh)~S@TSMf@IkiCl5W5D<)ioW!qdj?gFyh ze*ErCzPVxt)I4Fhc-2q<0_ac6uT#;pm7@9wfqsyl8@7fdpWXYO0^AeL=8-US5_GsvjkqnKVkh4;68Kp%e}P9Js>cQ3mir6m74`wenD zS!8?sth#I|RV~#F$r}W~vnM~vh+ackRkenfPk$Dd<|1N8c<75q`R($D(a^bj#_ilP z^+tRyAJwh--r68jhzni&$OGclELa}!Lx190r zMLaZf0cQX!L+{v{^T*1=a%b8d*fjn<6uWfphE8n}0 zY*z-q|H;FgHEKQ{-Oc*y4V?MgK zjD6Pwz3os>(zhznlSL1HZ9DW*+sQ1dPxw!v}N4S64 z1Nhuo>G9~wfa-v=>RJcW@ajL+TZAkQXn|bdKxI z%ZI@R445(aM1DE(S{CpAj9pE8`FQ@D)CCSuA3DHMrIV>@-Oq&|T+Q;GpYW4mr}D~) zPm|^LV=J3yHoVBqpZpS2S{>_FlA-xS@aS%~)c?pIzxpEt!aVKwlM(fTUpf9#9z6Qj zWP7vuu4WTgd~iK$_k6*uA#?ftu@5k|=r9zDJ3jw4{d4(gU|G^3C^JH=7XA8J#%5^N?^99rTPT{JpA_EvvKJzmR_=$=5PxqzH~YvGnni(PNc1?_M#jI4uTT#`aDgY^_EQdb}Oca zPy&UdW8#JM>*7v(iAKFtzlGZImZL-2#fVAoBmBdVt4@J%9on={p=~>I)tO)vAjUm` zD47pRqW1m+_1!HXLukY9LJYnc3?Brmu)n(reaxc}uE$<78FGfB&sc)0TZY_xC)(si zpm`A)ebJ9yhrRSDM3xIN@mYj_FobK68*fJKdlPh@V~90<4~^eK?s%yE96SZ+$9#zj zRzjo!Q83l1d-bJIy8_(VXd~}J489tKj%wM4T7NUz;Hx22i(UC1cb zQbM%{@v@;1=isQRz4zq$yKI~slJ%czD8U}PY2MxmNEV=p@yQFILYghv6; z23&y18-xA%@s2?zQp_JEu#tE?!XFA*r6gp^?e6MX);>Tt4(=181teOxXG4jE_fiRL zo2(qKYsP@QY^C7YRTT%YfE=$2pG%iPOHLbF;9qp{gh3udXlFdPdiz65c2u7;u210~ z=Z`K&*M!>;T9(IUoHDX^UUfq-az#<@AkWn9rnkorKQ5S9K4Wk})~)Y+Up?=cul9buy)KyNF$}-QrF(RtAr(Hirun@t z-DL<(A%)Mai@}9i-l+rgGk4Xrg~Fy(ee*M1!+U3WUS7Me<)M$a)d4JAv#;^2N0;sW za_7Oo@S-g5=#m`wfYNNw%ptw}U++2?*je3ZqH75uk+yJt(LG?c6xcEi?}c;5m5A=K zQnY6YluCdE+ixo~H?OFUyx3>^7VHZPAu2>H-V~AsY5^pjL6LCT(k8=`%k1(Q0KD|W z>tKa&`+DPcWg%?~L+E4}K8`A#%<#M+Y}~(r;rT;&`{b8sj6{rC(o z*oq9pN0!@U0q09bq`r? zKg08faP!h%v7z>RPUt^}x&4p9=1N03ZNKL_t(^{y6Km z6lV0sk`^A_&6kzmu(574N0(2hEUSbgipMjy_h>%c@d?*`bQ4GYb1r{b{~TFvKU)v( zVENuJdHR&6Ic~r)ob<+7+_&;!?wE2DKOJ>8rWuOzPl2?U(|;COZa*(x2ibRrRYYTl35RAumr?wkFp)fR^d`~W9=JRFsDpppl!mE23 znA4x@C*Hs>$6v$EEAD09zb@vKfpfWi%AI(0H(72!<9i*(jZ5#~@%2wJqjV~_9r+8S zvdJ*K49OkHG37_Gscs_~hL0Cd{s*Ib4d>WbPv+T;FY)lq1{@WKYykIDg9s3|}ZhC_!);tBkU)KGd+djITo2T8v zEt7xFZJ*!E{6*(;;^4X5cl13d+7sKPoeZhu2Qj_w<1gmw_itc-YYi8VJ)iM?#&X8! zGr45k1$?k|G2{L^iNCIXhVquc9~+o3Jcv5loY6DaZH7{2M?B^eK@{eNIc?jR-&JCsB$bch%puA)PLm@qA)LfQ zeKLD9W5`KN89JBVxr5Nq=$lnWpN!t<2y#5xj42$+yW2kCk=1{uUv@dyjK2(B_mJz! z=E{$L&X{K=vgpV6xNgD~Oz(dTf!Lm6+WD-Zu>jpbBEMqK3ToQwIJW;xwp_iDUmSBg zd7f+nt+kvs^c4Pf{Nud4_20~Vehx*Mh5UK$@0r|pIfCN83K4uC)dubq{9ZSliV;Ed|O}NZTsRu)fbD z5rj)@Gb4KP?w2IVrmHV@?-;>i%wN$?-i9{&Yv=vuyTHgo8~Q7>kq?5W7`5$T2-YIT zK8h$k3%TZe&k3b*)u;Yy~{D{19$R8dsa@94UEaHhV68C(?rqr4Qr3P{cSC2hX5u>qA*8|O_)@C3xEoX9{a^6#?Y0*)+ z87?E&=hBr@GGa$JwLr9|lAJKQcec-^>rbqxta*3I_Jbew%?(_3L|Ng?0R`DP*3{ob&k3W8v%M}|^B9`;vq=MTin82BFTcli?W`gBV@q=~ z-ri8v_~?6^>QM-!Wb_3Sya2XRj#p7SS|$@ZyNG4W^PgW+`N4{v&BX(9y_%EsU2Ump zHP`Gu5CYg*+Zy?DeMRe=0}8ySjVsNbKCr+yx;V?DX@b|*RzwA8cHcNO`|SQ&#`Zu#^$Q8xn=s@^v>wT-sXK=F#HVqW|fiU_EVl+%F2qbx%ja2 za2p;pO(VyXjR3x=_!@w{%@ur8v5Fg}{1Si?e=+Bdn2+C;NlEWw%CgHiuzv$6MPY^$ z=@zm>(E-xI$+RQH!gV6icw0NVsvXeZKHs^7t@S_R(LEhI^VFMk zlf*=^#^c!}!j^r-rV%bRYKsZbI<{}C?}y!$!gfB38yeln6&xek=gH;Lk>}DFZsyCX zZ{pz{Ck~jybL*ap?;lyXWfAXfc$JAo6PVOzB7?FA5NfMqeeHLgGkhLC!;4gsEO!>Y zeZ7!Uq6v)y!2`VcT-=x0=kHV*Wb!F~WA3t3SGt0&gBa z88DmrKs_f8p38t}xZzRdQ+aOPb0{UTZJQi#0hf$DkAuMmzOGzNY!Ewn@bSE~?j@G( zSxL|e6S9JQx@!sHri1Jm>m;&VQ@M_vRX^Z0GP!KRg}AiY6lCNBFur&!=Z!fVOIqCX z`F*V4{S`}%&nU|qh!BF3tUfF_<}MDj)pOnZH?qH}3coiOh3Y8VbYe&+TdB}&D?^Yx z+18b;w*}QgkefWYBze*pzci3`T!wwKN;!MTsaVotV()Q`E*K8L%+je;v{VA{!sb_b zcjL>ftJ%m6+0+~m2%%b+_YhG(f`jFehTx4os3e7*{_}w4}Z3!-oe;jQ-MZP-~h|F ze8`29f5y=K!7SeKDSul16ro@P7#{ALemelSetH+1syE<`hJdBwct~M;Y3Yph7o`>)eA&slD?+9I>9x$u7tA6*}FNZ&qS7-`7Quge|9r#s@DNv zNgJgUy3pBFzlA5({DtwwSV2m3Z z;5K}GSNlCDzc!yM#$U=6<1gmX*$;B&@YA^9ol7`%=m`My@fY#ak@NApGZ|kzmY*GQ zCA~9y@xaR8vvAGx;Bxl+oIUakrwZxp%QP*so$lx!tNOqJ=Du_?8}@v|l)IlN>7lgf_Z@X`rLCHdgTkD~2Hbl+amh((~lmIzxGsQ`r} zcpF7T)k>W@lwJrHX^p1@NXdUkr+E!uL*qIplnzieAHnXY5dE)m?sxtfS@AyP9)?zQ z0+@}6!egB9Hb9iji-yrzs4c%n)va;7McE@9SDK3PG!`CB7no%_$BZl4t z?tEz5g;w@cC!9{tK;#^TYFOtOP)SC86qeAT>3h`HClL8Z!myj2a612BMEMzDHX%1H zfW{wD`#*!c@s25A1<>*)AhL#{surWR{tcB`iZPP%s&4 zmpLfx{}i?LMaR=rKF*>O&IB3Aj`G;PeI3Up+RY3}GF# zjJ6t#mVTK2Fp1|qb)T|at7{Hh)lFfuG{@_mG9V{&&G%KU=+Sf{ril?XtRj|D=t9V7 z{)m8S+u^W<7Hw%?>^|6rfp8g)*G3mY4D6NZjaar?w4tiu`>NKUvnyPHOVfVbc_8@n zZS|G+E#6YU@REt;vxgRCpEjX1Cmc1*@_dFqu#eySU3GJ4<<`2khL9xzBDPdWDbNjp zWy#oR9W<39V&c*hLg!FI7eX`!OndF#0}(uWG-HIbdDE@wBGapDF*)IN8*gu@3~Z}u z37>yt-<;-n4Cgtd*3ytPb1N&Ml8CfulBa6nfa_2{cMbu?(h0v6#Nq`HN4Se6bYN56L_Mbk?Ha~8>4{?!$(U?Ew5~RmAj9=gFBD< zB|evz=hwf4ZChx%Hw~Oa=+qNsB^46Ym%U*xqc8!~tmU@v$Nsy79gP7!gvpq+LX0aK z&&d3t_zWN4U+@KP-PtI7Z23$E6&^;wa#ktBb{Je*JPAO+3^1Z-Ja3=kcpW#_Z^5m( zoXy3mop)Z{!#msl&9A54#`P1fB+H$}XM2{hwrVxFy*xhWVa635#xFj-la*UOX6o=c zfWoD_7@j|bh;6cP(;KX=T7w=-U}A?ETQ-Sd`9ts+9=^Zon|OHDoPo0#ReTt`8~4U# zWS|o^1YW~gS+k{$Co_jv=ReQD`~j@oy%N7CGd>yAH9eaAz>J69$moV`75(RPXHcBk zJL(u#hb-G9x!QolXQPq~Da$1qg+(h#}E!hvvui0rzzaR#=1?QyW%?I)x8YKA4Y4Wjel-> zot;g)IlAvr1VbTbu|en%Y31aRXYu-J|KR(&%~ZG6pb4Fb9l@=+@kRGI3Iv*F5KGqH zFQ=T=NE@$iT0}*2CC+r*Sr};yH4?VNWEehY@)c=M`(EF60L(}{i)O@*IBhlBe|QWJ zZ>)Qn3p|%`-k7twYv%2obJ$rtwd!deoO?f8>$g(fydPa?MC=GI&4t%+^wzDr@w)x- zBqV)v%V`a_^4i8XsBEfo=tz^oJymZlWPd*1=H)nNFO52Li<$Aae!GN>PTV@{lDjdY z{+ov(Lnp>Y!rw1`w~%{R{1%t)qM~6pQ%fcR(Y`f;6G|2PC=%kZev|mau@A8A;0`YT z*R_NK4Inh`nQ<4#4?d1Zzy1@?uXzT|m5CPBuf#gj8$UfWcDgm7lAir1daFRH3`@$S zy)+(4V@OaT1pQJ|i1!5F_PWxPS588d6%}7{<;OP>krC?JYB;=jVh8XcJA$SeWEf6z zkgydYL-X+WpFF_{gO20VT}#RJINl3e+UR<6jxmVosGHThSFn1|7d-mSpLy-{=b2JA ziKF_>Bw{)JNAJu+1cHxueojqm4en@P8_#qpG_Wl+&8Z_~hQN}z^u+0@!mS(ZJh+P; z2X{G%#o})i7+xo;glOhf1K!^JE;miPf$Jt+OIgq2LPSM*0I>H3)b_W)4Y;E;n#~EHMm=eEo$T_30C4BAtzTqhQHlQBLs+OQV>@TNUM(h>Vng>ehH_ zzjPr&tr7c)l{@QRJa>H7{XZF6))qG9S3lIY_ASZr=D39Z;g;H#TW1aC#F4#oUK!l0 z;j{^*IVHJ1_dnO}s}HpVEl*UDUAm^>c4^yc+9F%)T0;}db2A?PWNY0Qo9kMqjOd;D z!~SLyDHReX49N2xGjveq`)jJ2Bf7wdDr!x0$lh4l7~=R5{8-x-zU=ummBOWIhnMDf zHq|tl7adWacjBnx?0GW=Li}cTPyIRAR0+>ClFmv6Mep!?I=lSBaO5s@50(2*v zpa7iEEg_IniI}X%mgRW+_RsU|t!*)%|9W@x1E(HV2=LfvTMx80wApwJ9XmN|k>hnr z@ji9tc>+3|s}=jm@=C&4xhkBMl#~F&U4a#8LQs(UN%DR216}BZ%m7b*`*&uS&*V2# z?%-gskrjKEP@2=9LSF&f8+QVrX-?L!FdAQ0eFMOr=6zhg_}un~Spu^D$W@(kEMH8a{tQTQRFYCJiC|l=uZY+tuWVe%z`t5wVXBE2UO76_l@;gPW=?30tM;!HDlz1a9KhTo!(H>_xUg;ga>qNFH z8p?V0(9`f4KA!pRMLyg88B$8l9d$OR4L*t4eP<-K0}yd1vuRsQE}cZKH;0G5d5jNs ze9R|jz2i(kRdk>OJi3R1|Cy|>-r!`IlaAN%tdaBZ7#^Nl`z%X$EkP>D1!FJZ zcV<2eT8_NP8@ zfE9bbWOCV&+%WlS9$x+jMi-BwCDe)#f|}M^9$x-?o;dlBJbL0ItgT#6U0WR)t_(U% zntCi-1w!dSQfObnKC`L5RNL!J9Miy#uDWIz84SrCi1L^6_%RRDH>-??RzJbwt?w{z z(1{#gG>+#tE#&PV-ehF&vD5`>nOf>hfKMEF9M6|d;)2oV;x)Xito)it^auhWz$J9h zU3^=!fdip~n9}5yC3jQRypJhmQ~0KOEk~72VOHOxxMsrTys_mi4l5kRxucww#RV&V zM{}fwS^bW3jBq96e412pIPY$Lo3AU^GO}<4FKm2;Mc=>9sN!*ituW1j20ShwE*-WW z*v6`g)y(KOor}hv$LBjf<%;o_0I+n=aPsW*Q#X_O-kV4r|nU;o&LL|XWdM&7&sX3H&^}DhK@3@i z_%Fyd3Ex;kXhFaV@?*nxXQRKeRpxo_En z6le9Jz?X+qiYvxn%*Er*W67?i*h=Eny)*P;K~D+6ODwo7qmn(3C7aj$H>+^s9-g! zeifqcS!hG9!QSxDbL zbiQiA-BgPnGSVhFfKJXg!kO56HSMKUdmFBPef_SckYzu6_PBwY?w&Jx@fDMXP99j8 zxpZA+^R4e~+Bd8)!?*dKIinvuX=M4QKh`zg`~DC6Q5srw(#Wa@P8fd1#FCs{dz(U+zr41pEo90?mrv=p@y^*pP8d_> zf9>nNjTE$lrSY;wQmDW(PC`D(0w51Tr*~{c}X=26qHNj04jiJ-W zmuA0q^^{U{DPCH&r=_krY?`)|udm({AXVdHXIu$Q#2bZ8*WRZNhZ76ud@5TLD4{U3 zHQUNb>fA-9w*pNxiiEb*!DX8gFC2>>cj-Rf-|-RWesDRJtyTPE?w{Ct#Rit0{V%4J z97!-5N~Gaz!W6oPmHWQp#?S9yX8CmXUA>vgt2cA;=<`^*dns%7f6HA{Z)VZFS1^R` zY&h24{8;lHAMX5=DWylU{QQr2ck91+eDzBwuT|HWRmT)CRVi^ij@2uexkTifL3 zPwwEUwa;?Vm~+{A!)BIV_#xlbZsL@M^Z07-m#o~ok}vkH;^d(x@b0;b;^})cbRXaB z{fe*mt>&gF*Yoaqi|`sACta)(@qs1Q2Ea+J90)YcD)BTe8oiezmlvB1svsD&N!6ez*hQ1p?gmkhcLAG&&46Oe{ z-g}41Q5=uopPsPsa?qVl;gll^AOu20nVdw<$wXre*w{E>Y``RAY-7NH4aNkMb2b>T zNFpPU0OhO;(&fBiX1afW%guYl?yj!tDkn)z(P)mH za0GED!5v@R%i~KQtpaQ~CUycUgDwm+U)gPrm)k zw`q@eviRF?&~$kne>mVqG@)ZlhoqgPwz!sKrW{Gkj&bKFck}pX5A)<_kMg(A9|Yj^ z8K+qM)=_LH~GojOL=?C``q#A z9T-AK)3o%)5n6x^otrr4mG2QY!Yn&yF-_m!z}0*GoStMaKltb6eBAgMzuE6<)?T=j zAMJiA4}bjxjXhg=;@AiH&3;#taNN-3K|R3h>)vEd+d9sjeJ1xVyqjwlUBm0^7je(w zx6|^I2L5^K^HfDEkCOaToTA zYu~tzH`o4)yN>=7%~x&XpXa>H@PaC&V`a;29=TRhp*gD9N_1xhiqQlc5h}B-olh~y zk=wz~^W@Z@??0Kc0|ue+^|90fH#Kh9lCbXX zJ;v=gr_VZ_y++Lg;HrIo&Zh6L;IMt<=9o?$KL2we{WMo#-xCMmZ{-F3YKHgs<0-erGhUd>#-ICnAADyDkx<;-92?XiM5xmVCnfEFurswH!l7iA8h%MrNJI&i%-uw8hNo6W0ndP>5 z?X^mQwmGwBnQ__kznfQS_HK%)*P|V{7Hz>2#I)TwAR;3@%T$i#M{_Mv^2@7G+ZG`v{}AKQr7F!?OD{Lb%qcmXA=apCD=uM&IXg zFZ{bdS$*zuS|NlgkF_kVVThL))V!Q?h5s_;hsmZ>E|Q&lwj(@W%k8<8rE!z48((kI zsTolctSt?h8bT-q>sxxQt!;f4mQ>TnmWE3rrY@CGA8l?=$e8UAG_=VT(Liz7)K_fn zPIkvFi4YL8WJP7voKzVN2!UviSm4C zP#LYDzO$az-WCi!!1Q6$Fm!_@^`Fz%*Ur=5evV_N9mV{+_T{539}zJld1;xU^#GG} z-h0Z8CK?U4$cpfJv2!;*pL!C0V8SjkX1xH;2<$Y&2IZ?#lCTkGa_I!(cAT~C>#>!4 z&?=w@m|W^w@j4Qnlm<)K*4MR0# z#`cYjEggdpf>q6{iJB3{mW?H#2Uy;;f?h8n^pJU*HEAmdX~=@mV!N{7^u!sfH>Ms1 z@2R~A%efVlkvdX|QfdB;D;|R>j5Ph)V(qMM{u(_H!O#p6$v#TLrA#iJfF?9zR)VEl zmvG_E7jWl+zvGXe{h520-cL9XWo`Rl$onXU=UP=u31{Sy07GLm+Z$rY0*kCd^cvyPHbF}l!M z-Li(#a0w%eM$**VL}OPY2|Gz?xP-}-lhDzK+i_MmuffW~F_*s{lXZa;4Kz^_J-hEa z>t9I~2|X}wuIjU2K*;K$%56W`gN_-#{>2cjPkG>`#>5eYHMI7%Qs3Q>?(1*y`c^58)@urWPI5;hD9rB?sez?vT!+T+t%Soo5>ZE=u7sozI_8y z+C}2tmnD&!@Ifo`AZ0y5qA^F zN528R0S2Rg*u*Xk-yHwmSwB@=n||8&=ZTj_N|Luy)QZei)cRd1Wm=&^BM^Zy&%I3p zB+7{)j3ThRQQa#+7>L5DZp6CoRgh?c$Y?}(lso@fUC^_^b8&N{*CBLpV($A&B8ql$ z-|yXo2#-KHap>LPDo9$;gKwa^Rzji$QM!xg8YfVFn;_BZy4Xnvf|ZEy2*Ar(6>Ee@ zEyy^kXC3HKM8P<)dfa!d9te~niYB`-tZr0a9im`7NDI}y*3GF^Jk3=IV~uV*v>>Wy zJy_jtP>JGc9uBsPryfQ`$3U_J)w>CT6^O_PRH6-H4X$N2T#bl~0GUK}ttHE)FpDJ$ z1A};Hutz!a;P8c;-yev3*{|(@A{DxK(n(g+k-wBJ``ajC_mg&a+r&FNG{7PsAmJz+ zsnV7$QwU7MU419K#JdOx=psFOCLM__A!xWhM5!}cmZPv$YHI>a-HSiz?bgI?=_(fK z?Q)TIax!6M8WGS0x+YKp61H+DFaf3}2xuCXlvolB0SbYm6sFM7G(o~WTSdTdp(_uz zP!QDJq`e7S5x10C5;5*Nap&@Vr&dL)3PZ+GcP*}8w6s1(B#;?ccT{;wwNH7Ijl1=h zop(;^5UGm>#y$7yu%q8Of6Ewm$5T9UtY&sExmDQC#aK?(PFU8JJD6ns6eOHDIKIhH z4`6CKNvjWpM$ian3?oXBuwv;6MAHIpQcfq~W?$F5oiynXFv4h>j%6otymK32GlHWW zl2$y8ifN?IU#Tn5igw$iRaQaXgpFqV_Vacn|H2uHd}dxJ(0Q#Y|4o46GNJIR^5oy+O7PvO7` z`*ZvIck#oQFV9IL>tpSZC+a-(7a*f%QdUMTi=Dse&eY@JBei4cjmoW)inzDCI>%)AY1&e45wE7zjbw z2z#OB!BLLe-w=e&u-7Nt=tDs>gf4V9GL>{NbQ4VolD3-wQWF}sV-qw&n3{p*SR_14 zs}LF?JxJV+qZC8}VQk0t&Ibr0X2`R={TsYBKo$nq%i)E`$4+1SdFpZauj7u8R`PyO z<>|$?%NaNPxg94<7KBF7bFWO5w45X|mEaHoPJ$oqaXG)=?>g@M;$FV@;ss!Y(2Y=f zapcM^1kJE-w_3S`1tR-GbQXej$;u>^&va%%C8whDn-)H7=OZEe~(!) zH#xT+NC%XO7!fRKle80Zp@%n&khGI7?==k#4JmC*J&06} z*C+g!hmlmI=TN}V-SH($hQ4u|25Hy!6sJMo$ph0A$imSR9rNTU;y&}eV>>pslK?a{ zO-DKwX1b3j&~?*2bE-0RCcUxHbwf_cu}IhLpQ8gt2tzYaN)q#p7Xc%Pp&7*OIMQ*@ zG1NGGQINH2g$-`nWUIf_Kt`N8;`YM+w7vIxwt5m%?VC5a|87mP}+qpr^_S z-KCGfRc4fO6V)Qzu;%D)81J-2M)&eOc|j!{kM2TqljJG|ju(AV3%KM`7Uq~+36GraRs?!4xsKpY^F9rhrneHP+AsM!yh|t`#QaSyFP7%$mA}nK}&T z>z$@9FumR>rSLMQr9Ogy?^I%{DnHI)BLhnbaJ&&9UM(vJ5G5hpg`n-&-0;?Kx#_K&-GzCM z5;gQeec(w|IG_mvQe(LPet@F(Bwh8XO}L@$bSg9iK|kM8_k~8#ocwec-SuT#IW?%-4EZ&-W=6pzhS`Vy{cyb#wkXf#Mrf#;`nrskC z?xIwlz0?1O0yPx4S-b_5#1uw`ek!|cK=&`cRAxLt_uWtJ`{k*~*Dr?Dra^GtUYq>a zzqP5Ag5f9-s?u?C4FgmQy1<-QZrLz!_wDbRyy-bQ`nwNma}6!oH36=g8zO0ItxWQB)VUk^ho~xhH@=e zT4DBW-8ZME;ra10-H_-0%SgTBxkBnWYr5Qa<-VTg{o3@yO)E) z3<>B{{gN&ZbnTELrHY#BXzPrjC!#1La~@|f>(hYYxYG`lnR`P??(4sDquQy#U`Ww_ zHo_&eR3Zxx;aPHgbM^L>oSXqwNs+e$1_D}Jk0sB#{he*Da-|D`h8v0{_gLFt)~7V{ z#lXrFxOu1i_iRI{SaDHeb)s`>b#SE z&I^u$gc>ehsST*ZHYEXiR(#cIjvG_2*)qE?ZwGe2#b~O|e*<4XKZ1IQ4ec8_;qen) z_-2@}k!R2zB5$|bU-RPgpX;xw>pwA3_g`EouvAFKWR_2UJg7GW60##ZXU>k{>)umo zZ+_i~@W#ePyuRjT&_je%vY~u04+3*Qxg9EBeYXbW?e_Ysul^w`4MTwWA6bNvM{cFU zvE*>^=`M!ab%_now`O&FU~FxJa70$o?ZN(U%WW>)?c?$PW4VKdSIKYa3( z8vtjOTlU|8l~s0oG#V;>hEO)ck3s08NpwRWGt?@F9Bcw0S&(c;kF_IuQ*jFEr$nVD zbw`Q*N|YcSK*5c=BD_vHK#&S0`Y8xfc^{dvTuCy?XMI(rPibnN5*4#0eM#wBax^yx zgA{JqH34W!peccriteOC(ov`Zk`Lp-7EVTqQp#0aq+f|jnLRZSdJ2X{IH(Z~>KRLx zk9fI3BNT4uaPWdgXk_8+r;#V*>BPNR^mGJ5ccfidAd(eX2kE5AR)pwGw*y7iE@19r zE&baqmz7kOJY|*229)zRO-@piT2B4Bc%)#e9OQETikz}Sxw}@8P$`j68DS%wSt$D3 zM0T6{DN(sN^n(EkMZ|~@4VMxP7P(O))picD4n%+a^zqZ#SGOaT0`2og)esY^z&Xx$9ku>%cr@>vT6hhCI+kE3p zR{a^;{-@;Dl{b}^+ad9G5V=j$LkS$mp)cOyx@;k~E4Lz-xB1HcujRHsZ%s|gT7OFt z)q!?&u`Nq(bLpCCw(oxqZ}ZYA2j9WQWOC+Of7!wM%XVpyDeITptlUjG{MzCEn$x$k z%1MciMnR~Af^bQe>-RuoVZZ(Y1JAW6a1@#?OYE4Ftt9_oW2chZRvazum6rF)mk2g* zxzuNna{e;eR2;b7x#jZlJ^iXkfBs!q>2moJ$@|MV2}pK=og~ZSDsTI@Ps@y$4S_yh zUz1XfU39hRXYb2*?U-v{EpfTl+Jf0VjbvqZf(*p~78~J?ngd#%a^CSP1+K%qBI(Gq z!scgQ$kfqEQ73)7zpJ79HGf)lBx-8<>&sjEvaC45gP{Q1p|mh;>^r+WysW-6xxTS0 ziJ@nDh)DGSf4lQoj#3JvU&se-_fTB-1X*~aa^UB~!w*}4V@To!g)$M&asktVMhm*r zfTRMyMcO}ZD(@_T9nTse^pvF~?_}Wqh+BOi9fE;^j4{$TV0jhftvC0-0Bq%uOmu^0 z5)QbQ41qu@hj^j~(hER92y`Rlx@Y<7%{u|5$d<4ERNc}c9`7bI00TlNV1_YuGYh`R zZPQ@iITKV?y?G}f-z7lU3Z$&Tv5SGG)FX+$MU$deXevrh)ZOjUAa9vL@ErtinL4NB zKO3P3T-Okl=jH9dlFDJhxCK;1DyZ+O=kvy;Zn=CrU0%DkztcIu1fA!de!R`Yw|@NU z2ZR1sE^nn*mn~}r`{;^yTrQq?V1mCryg^BKxanun9t8G4{d*wZ3fwaZ$+T>Furz~E zAPV_t-tT`Ng!+vEnIADLhH@-|fha*e$lenVrq}A@le*8maOpX1%2!RlcINP5D7?*u zI~2K1!|~&huK=zKnB$BfNfEvTpVH7aYcXO%sPJ}q`(Kb-fxvc>SYG1e-13?cCS-&% zgcDN4H|j&g zcf0*N>)rso^~+hlw)x7(l0Dv8=hRJsW`qd(U8?=O9YDUMk_7Ys`%F5N?szw!G%QJ{ z5cs$I>i{$pL+&rxxb|xkdCK`OM#0k90DwI)_efiy*cN?aL+gi1Bxai3MN3$I#l;M$fwT? zftDH8ZAV$nLRENkoH2eu&6p_AmFKOjYsXysCaR?I?)=RdT>>QppwbFRHYPdBlh|>$ zJ%GN1Jb%H2va@y{UFtYWb;d0xplPBYWau%=krzLd76D(iS%X_^fSt+dWXky?n}(PvJ|KBcnLw>%6(Hj8eEkG;BjkD_SU&Uga-t zIZmsgQLk%aW)}TYuPgWP`t*uvTruxQ)D*fd{XK~uu6plAmTp^$sfUncT*y+@J5G{A z#~;Feqxa&v#WxeT;}~8PpHz}XzjBp<;fo96LntXN%0gw_c-Sq}bv1DF;y++12PqvY zBNhDY!0Q=NIGmDD3665u(6*7^zke$m+Bc$mK`c@S!Ic-;$PEdbsb6^u38j>0{Byf| z+)gmDd;&k&=SP%;ODGAIkZ=-wx%Dgl_}*=_^t57Vy0^G+TbDW$m1=J)d21S~Qt8D= zs;(go=ILkNw=KbTs}fqkk&bi9&*MAZ{h!yz}Jl;Ykc5AbRI z5=g;-bl>sQSmE+D6@)_J-WTL3VENieo(1;yCjUHTc9^#cgj6W$j9_Uf$Sf~$E7vN+ zcz82$UmZKL2+O)RFuo{A$|S=gm0a!~TMrZ`xPE;QD(t>Y(e{*s<#4~8((hs>pv zX`^|D#;M^-d5Ly2ds6tDyCITrX*C1 zK(M)U3pXvkg|%(#GG~EPK@do7V7lY8f3Axs`X{|tH*wpO zNeI`VP5wOuhq?Khlm#8jkgNXyR;R0QxD%rLEqoT4wDl0uiEQ0Pjc>fqwalnYv$JUJ z)#1PA$$1)9dP6w{Go_4>QwQ#SArR9pM=RR}%p$if@n+=8TT$EILrgy&eW#xxzy2+1 z=~X#Nb$xiJcM(%<_F2xpsdA}YORCV+NK94Ae_D|Oka~Lqdau9{nQU%;gi7K+7B1z5RWDN#Ea8G(&td-Pc^r8E5p3;lK+_C@dcfOp zwNOfV6NJdPnFxXM7K6Ib-7M=0Y{#N3QpUIEoQWeHp85JYCYDd&;Jq(nM%8qV`}>K+ ztr%Kbpk4BYbT_)6EuHiLlZx=Cyg|y%%VoF`$ui^{+G5Q6uh}x9Syt9AnPUX%3_aeB z<9o-qc+R^JOV^$AV8Df1YC_7Htb{wMT27KH_xdT+HG(;5ar>Bh2YLokU5fm{->RldeP;9q~?-aupvX zTsd<2)<##n6D1`H8Arp5(IXuU%^+X|-RNb~M&{HPGD0X6aVw4{ba#;}1OeS-z@610 z(yITi`gRuC{!1#bWkic7hXY@vZX1T&qI9h%9Z59@_J3P$1p>>lY3gYvY=${@ikma$ zl{K%?mF#vStSQGG@4PWf1a5vo001BWNkl)1w|;O3pVWU!(oP~##2wom$22#kg{c`Bx`}05SYDsPQ?xWRHv+1+`I2Ae z{A|B_cqa! z=tfCNJT15G>LX+Xv1}_Xi?+0Iq!&CxGf3J=49#$@&_0~Ac$?d%yaemtZqbhpLzP>F zCM61G3iHW#WRr~o$7`Y z#~~eULOGy?+;^2EZOHINKz7S(USlOn3nGN>hA;QOBOTZ3r3Kt*e#%?72=85`T(I zv|&cNxOq{7)0?b#^cIE}NFxvJvu@>CpQmsZ3MEuH)+cJiuqi*&GS?0(QiMAiF=8=< zrGw`LCUSBXeG}`G-?}1j&pZW8{gK5RIv;sydF#xbYYLYB;(&?ou50c+>c-bMAz;$f z>gbYRA2xnzeMdZ&l(MEcWS)B8$BkDloK}AFt|N=3Qfg^^SNuDVEoo}+wdAfNOF{s} z0Ym%qxjWa4DUX^TZ)}SlJ*%d$D`ClBzVLO+%kQu2nJ_GDP8?Pk_-JEmVvosH;X6*5 zQ~Alp)_6rhNS{_+82qBHBYxgPpS1LLCY-{;p#F!GcPanY z{?NEO&G8c5smwr}O!jfW*aNs_!3}Ka+{n>SpT<`kKLibmiboO+ghA-cAF&&E9{dLi z0tIv@y19Pw&Ahke1D-qnQK}1uk#sD+yx=2_e&Qsy^)_+Gp?_rO>X~fp*u>?pU%}^F zKIHhBr*g%fms1ihVO!5O&VBKFtZZ3HPNe#M>4ErG@E|7iZLal32Fv+9(fzPj+n#gPo7O(M;(ux@BqUKhH=5O7qM#F zau!THfZrT^9hK1vKB@bZ5k)opYwcTH|JF_3?x*Y9Z%c=dw|vZrcO1{2Gxy=Wi{7TT zw3eiuWZ|?Ux%u#$(1pgf-e#`(=dXEf`9HYk&}%qk@*zCA>?sbLawvB!zJq0rU-HKQ z#Xvg0qi$hh>K~bjS153771SKEqs@#dXqBCbZMtI0 z(04jBum_!}{pIq(QQ$ZZQL}(!rYr>DN3UPO^Y1+l|j(^BGqwf<-R*qrPx-M%_+~EO;>9J7%--4IxnC66ph`Dobt@KnOrf6 z`xgG0Wm~`Ef|oAkyj{-Xyj{-X&Gm0FZ{%*2go=4_)yrJ>&P~`>obrN7ezEsYIBe3v zXhP$Km9H>s_zY@GM&n3_B^SNVb&GCf%CN~ab~R#4o1#DgHy(T)2Tb@D3V34KliafS zHd?!yxNP4aa`Ma*d2`*r*sFF=3W8Cd{_=TZ=ivV7}uE_mi5 zntPhlyY1PuQv=heUw`-py!HNSjuX`4POZO)RS{^_dSXqwV8Z`GZi7aImCdU-{jrlE z7-9K$moU0yB&R)lE*uWTIEzM zY4O6!mpNk6App!BF^6}*`#yjE_--awOk`c#dS+D5;I4(Y@zu8F7@E%95xcUyc_lx5 z%(zet_gCiX-eCblwHLqal#a}S9YA2>vOk#Dz zQcjt37FX{3GlF`6C%%4$+djOLJCFDym5~a*`_lLMs^JT+J@8r%n{)_&{p@c{ubRq+ zwg|SgDG8PE+e5Brzp?w$+SkgZFZ~EpGq~mOn|WcyOI-W)PkUP_Zq@4~~cMDD*?VMhx2@5gdj}bR(wz6fx#3P!hHF zPSl#)puwnNsL%yI4selpvf<}0e?xYu-0Wv`+Qb8(|f`G135->{& zbOXRNG(mC5AR5xkqo%&|$dbsncOO&s-Mz zXriAIC4BJR-;fMTlF=H#ADa?oYMZ1YAyPXv%5~8JjbkSrfhIKWTJkr(s{fecveA^4 zjzKDi_E;yHFquDMcV1ch8ozu0_ZXVaUk<&MNoC`CV)@hbCj01!cX0pGhY$!}IptaA zjo6jHe0nd#qt!fg^j|q{#>qT*^xc$%i@D{4+gZBxD@uYzu4Tw;f6`7cqiP0+OgNBd zSG>r|=2dRk^%Tt%#O);Ik#e3m?P;Dp70%dVs5aNVKTvhVnPm|QuTznye1 z2TwkTzkl*~UikV&3Ifq=3!L(O()Sdo{s*s>0?n2twv(+$&56a(#Rio&bmqWJ|Mxxc zwb%d2I;5QX|`(Me;hulbgXC3!{_8?6?%}gIQm6y+Yj)@f$`O61)Gkw@J z9y|FVh8GMYX(tf*+MkbB{&F5|2R(qEC2+a0eSB3p2g+^0a!RGGvVHP{W}DPRgV2;O zn85(}W__~DWCwZ}n70arAq;AZM-eTpA`~qrWCq!D)I4?{F&8NnQ8UWinmOz;d^So+ z#+1}Dw`LCK?0g0vZuyAX;!*r^-=DKv%^U)n!K26B&!zJ&V)3RAcGIBwd}>@#+6N<$?)cJf1fXSefsW6hf^TDOQR_WLRK9CH@|5umnY z6mv(;;f&d*@!rP8Oeh=AuMfJ4=~YuXZ0cd$y6_M5S$+Ke?OWK~xrM?&VU~R7<*oY9 z@HWF=AFm{6mJIfj+h|W8#{W)km68~mju|PTG*p&OoLe3$MT82_g~1I6T+6Ta`5Diy zc%CmBm-3e*Z|C%#&*IL*|H#70hx6F7CwX@H^K>VAcxCl#0MvCh@WdC7P!ufWkckH| zr)D;VW+A(coXa_L&Y~yLOKYr+9Pm)kt}_V1JbW;2$=+l3Bx*!>=!E+?X~qfM_v!s4og~kk_BgdAqnS~?6NgSZnDT-u zj+lHHb4SkM&`Ad~x_Bh}k6%DvvX^)=Hb|dU1JY{nKt4Oj+cd8P!j=ff8HsIW#Q>K{ zeVb#^EL6_9p6vyfNY|YzlX6fpAX1B{+z0e9s^vXY&jz&VSD@{5Ei}FctskQ8{71yN z^U-Gi4l(jLWc>@sO^>-2slv&KvN7QD|e&M%(F1=&eJoybWSo5hXjJ@B1ti zj6tor2TEq5@9`iaG_3!bD1h)VM9Bz5)EoYKHfQ)E6Ns|eVE3ZFx*65-DcYn95EIWw zp(85hqK!Khl#PltqK!NZed4*U6)l|+S@=GA`cBs6mXml!Ey=|E%*wuY*dk@C?quH@|9zRNDvvv_&UtE|}iB^$?V=FkZTvS7?Ug!B*r zJ-~*Jjl8t_A2f6|X7biZg>o#8o_r*l(0K5Rhh3K^M3z8E<>tp2T|5#gC8gm~j+k;d zA8h`R?nFcd#lO8L5zVob^% zu(o70NhisK^6?xp`CvZT@)>u3cn>pbW?!HN8T{zApYiINf6|@oq1fs}DTP#$ z?qs){)K-yBvbwHq9j82T7VF#A(H`sM;@vM~SV1K>z5RO{TQ{<;dmAH)YKWK->bmL~ zS2m6X6TiiIbI)OI>pD((>`a(RquezD+ZOstr|6U&}rdBfM#b=I-xnEA}Cp24dt zUroEK3`nay^7-#tDDt{$rC>V}%~54i$zfR!q-wzs_1I#Uw5w0Q_tgM(dawt=H_tmU zE5^8zF?@8+A|#53zI>b;-@BPUD@L#7_HXI9u`p7R6jRA=@A>S0u6+Kd6o-oW?%ea4 zST>QuKoQ>>w;#`~c#&^Ec@`*1BwT`&iVJr;56iZ=`t_@sT0H}$pgq>kK4bRcpos_Y z+M3t7@W~4hfgp26?84F07BaSK0$qu20PgzeZmxg+8fprwIdje#OskxlPOPm7jTKF+ zc<$>LXzgkB0?`aC2meXyQ@=9O8&@1P%I_wm_Nb4GwYC2OxAxr2w?W+IVyQzgX6=l(FUG`SD(tvAlT&x4&^a$M10p0C78k zquf68Y5fwu_soSHHvK4GKI=KAR8C>cu<@L@)3G%5G;_|A7tq+giMb zoBz4o+7iuHWm1wYx0>FJCK}Mi)ckTgFuwl{-lp9Em77Fa*K}Sx;{^=OpsBZsV;()3 z=H3=ApZ^0iq4QDwr)=rmLc&gRz_KkUHBqf_Nfp9TiK&w}rx@4q;Y7a$v1;&Reu%<}kj`5sQEi{2)<1|g`C>%DSk$H`QSDzL`WjqoQt@pMM{z z^Ime*U8pTDA*Oxbg{y~AO&_4NkbC4KSng7(Y-dE%doG-g6*wPWf~eXDt$IHw*$K=- zPif0haRy+2F5Q((wlVlm{t{e?!x(_3PXn0lXRS*sf&aym8PeRTuQhB^}x0z zUA>kH1q|J?9h5RKvfG33aNpJ)m*|?%Jf*c zz(Hho76u3!F;wLVyxj^X$yu9W$mNYKq>ivGfi>Exrs+KjJ`t-M1+V}-QBTUjx zP*pgBQ)isWhjkzG(Uy-1q?L}$4pYbo($d??5f2_sOIrhrzV{Xv&OML!H@@#K&Vhs# z$95c-6u1kk(vUm(Z|!OX1KRppy*Bi>5QWV!pErELUU%$E&p0l(nGO&@W= zyz^K%eId=>*@C2Fxkf?H0Q}sS&(qLaPlI01xsRX6?-t(79moBN?nE~iKXnNYfBF!S zKs3`Xd=p*n<)2K_J97QyS_sd4>Emto`?>JG$wZw8LGM;T3)0ZGk&B=G4tIWZC*Rri z0xq3*5!dg36(4T?2&p6rH;9A~TG|KSe=S=7HlJhv< zyzTm?i|f2J+s@)Tw|=GEe2lr_i%LU|=t#(PIN3q)_21iJ-YU0jKo8In@8DN&U(dFl zZEWh;LQo4}XgZE`kaoi7vyL0N%=_8e+X^N)()9?JN-```0l?;tO&}$KU?F|6E~<(~ zVh96U*o1?Hn3{<~f`pQg8%w3Js}VE}N@K(Q9b$3EW%)ja+}(45PHARRGOwsf&Yxu|E=8iv#_Kd zN{6ygDTby~7B1zs!+sA!u(D+}UpKAbH}Cw8JCD4T-yL!zaXZ0<&tJ@^^{z!)7diyV zku$e~*1lHo&c=Xy2B$bsMA!_|+}lFT>H|%%t$SSwCn*b zD3qpYG8^~7c{?PR%zpm|?gQCvNH0V%G#yLY-1zRz95?MKstc-!m|+51z#BIem(RZx zp=oUH+{~7aExfhSm-`jpBk+QQU&M4S90FiQ}ciP8(bGfW}0nKywD(7hVERv|Y>p6V zXw!cM(|(Eb`42#PIfMHe+#^+vmqtS9h(NjbtkLyRv-(iUE`(V`mL(_I0Y=abgaM$L z$Q8Fi;drzWN1-41FVv=|(u$X;-XFbsf$N^wxx%Y2wGYlmI??2htE z%_=U(3EJsio6mJGb@|=)6s{F2ci`f9TsiKe^5)meLu zEgn`BGLFCJ!}^17d$-QArP4JaRKLI&?qz5~XkIEQ1t=jzD%84CN+>V1x~>TjZdm|R z*ID1(-=rQ4eHP@?-cH6ps8%v zJ-<7kpB92l{;Sk~g)f&>D$kY5lno|?5wf;wA+6g_3sY*N44Wbxl^#@d+z_~rEq?|} zT6}NL`Fv~Kfh_v!HC|o!2H-A?rc_Sl>{(~6L?qa;+s z(x$Hfcyr_1jK6g{Q}5V?@4R>k4V?|Vx9NQ*|8W`*FMEv16%*NO)E+oi9EEF{ICSDc zj47?<-p?MOH{OXMbW*#5ndZBT;etQ`<;B(M-BH`IvAjWGLiulW%7EWKt?eG4HX*W(| zS>rMS-o)a+gsxFrHiphvC%gWBE*C#_35CHzj+=EXj&$6pNGTVfRDa36QWK!hl|i^+ z*y~c(C;;*G38pDUZB`B&KTLnye01#R2Bvb}$-*nogsn1g1aSD&g$ygLW%;J1{Bzx# z02spXf)QAR^bq6A#xc2kBIV&SkM5Z~M^Z{OJ&37gpJhqd2@acjI8!PnamfppvB#bJ z&>m|i8i=yKbpx9_>X=bIoqfmdjR0nj+L;5r>L9f-v6JI~glb=1r$D7_mN{KCPhD9qGSu&bwl~V!tJfr{01p9Embs_k= zX*mD~PdteK$KIF6+fh{cf2(@$ySydI%kr`V0og$|LDm6eRYrjkl|@is1OZXRWl+)4 zk>8A?;s)Z51H+=SBeF*VBtRgL4MO(3U;aXybxxF{(O>m zyX(}cQ_DG3r_QNUv&QcULpJdKX@`Rn3W>^S*W1vcwFk->0i_hnwk!wZ42MrU40)py z`%c~;hfg~cE4IFk4gKqaXnsL?ycS6e9N2y0?)d3*KgZrT?Spx1=HY|0j>6s(_lD!x zwe}J9ZPMa3(!MpgI=-#rwHV)mLQ&KWkwfcij?rXKs_|`np}mv&Hf*Jcz;OUn!OHEc z(O(+Ch&_T6e}6ireSap-zxQH1uKr|z)!zJay< zYy60g32uvZu6qd8EB@5+1h4gNyy=AFh5Ozy5&@N!jmVFStfPiXq>B?wsk@INQf{QQ z`t-^_A_Hy-e8o?|7Jn0H+Xv*}n}O0MptKQS7QA^Mg?IlncrRW6Z{0lrRp34IA$Tu* z5}*p`^z&*8OxH1hqJT_3!!L61O|XF_e%iRheMM>f5g_?Jz_-5!l((W5NJ0u|4&*73 zL2|o;ExHlzBZq;HtOA*FHn{6I2U~w1-23)``^XVsFJBA3^(8>cqPBhwlzS zSnphL$pj~%;6JhfI_I+hp>Q8P8s00{2aOdvCs(nIRCOL+&%2SQW>*mMIec3KTnZ3r zRU=H5r)7(jsb)KijyZw3st3ww9Tj2g6Gzl-kH?fPDvDkQfFm0I8y-=DgCjXj4#G46 zN-#0!O@&h5uaUgCdRzIjqi5reiw~c?exT@@nk;2i*`okyGZd;w5~Um@r%RHmNRTNA z2qA5TLOV=VqD^7HX8-^o07*naR3K0TEmT(|qEO!wmenK*?h#G$)7nghZr?WI-um3C zp?^7TpU!39I(2IAV9E7I3E{pwc}&5qbXroxJ;ba}NkJokgrF20^_TD>YAIwgs8Xh~ zVfS=R4E)@JN1@6zMu@>#5VkL1cug_!=-ZFsi;sU5Up?wec=D4EV$+!$kvDu3@`~*% zv1PayFKt|i56?Lb^FR9>CYb&%hau}2E^fusYv$sk@B1*`x^fZD`tN_jPZ!*ZD-XL2 zM^8TzE_3nps=0Xhtw-^@kKTsO!<#TEHyMjJFU8!o&wZz7?$5;wLTu2mmU%il(d$e{Kg+1>_O~%>^^wzGf!gq);B>3MPAE; za#9Tfkkzu_)kP9Vo8AVA`hD^GrZ-S>O8Ae{zK_cf|12iwCd2Yz)RPvM!jpM|05b#2~ok`AYd1bCyJ z&PX|2(AU9lNsUMB55Jt|pFJ{y^N6~v0Sw3}{(GC2$1CgR>@%1pqkJ&W*-zkM6uKKUD1 z{gtoFIn?0E{lfBN^(JJgHm9nHl{FOYBJNytH+lxw;pLu% z_`vkTvEa%Vao6kj001&drfPx8X*q!LAd(``VYH)fWD9P2;THV+8UGJ+KlcpQ4{U%Y z8(@qDidTYyfp-Vr5>?)+Xy)cH>a3)Wvl*FE<=Z&jB6@{oqrSgluZ{aQ^veAOWSf?U zOl5TECgYi9kKu>U-;C=%_yzpz%pc zdOos_g077xD(m71ZNU1aiRnwCkw}2r4uAn_7x>$^flv7e$mG*N_P7FU@i##a`wgVy z9tSV?0pMT@uL9lYUqH-h;Gh7r!Pndlx z-Th+F?$dnGO;5t>{W}oM1pojgIHIq%gDW~9SB~s+KO!IiPzij?bHJ2;fPC`f;MVq_ z?Twm(r}|dXiWRGhx7Lu&+d2kII05q{Fe0sN1YLPrR-}~Dgvr#+Wx(VSNWsmmtYSF{ zfRbGI65aNQuVjU9Fb*&NRf?s(L-tj7zqV=3_JRwE5Kxe}HV?a>zw6cBO+%K;I0tk} zfA_-b;lZ-iv-^ac^2*w6*5sTadyHZ8V9C4cu7!P+QqntAVqbq?$+ig@Ro*aA^2#pw zHFv+ZRhK2wKWy=*-s~%1dFLxz7OdH3ZyG3iSKj$@-7@RZrrS-A;lk zsc=0P>xX*q@QS~}am%>q{>yN}tYa})9>n^g9_%%K4(9i~1c}JF=CLp1$yHCoPzc!mhtPCeuv(nUUav0 zWBKM~$m=<@>22sQ^`n1e8$NNz`FMZ#!2tL0zDfJwU;g217$^_G^K8hn23^vycKcd< z=I%>jDh3SMsNPle@Y09jcn;3{!zXa~jKi^Ua3hATVay&k3v0Hm#&72T7V}om!-BO7 zpz8)U5B1_3k9-3Yvg6?~4==BK8S_@ngQ=LcE^D*^ilqB}Ms>}iy16b4qHh}LWQb2o$Q|&AvCWad0Cp|I-zC=Iv+E7EI7jzx@mp zDuYyoX}ldqF;OSMBrRw}Fr0%(5~!{ZI3(X222m}w%VrqQyjpaqREw}AI%2OCTq;#D zQ0m9!4_^fiU|Y$*4@M#q9M{Gd|N2!tyZSlgwH#jVS%^I+%)z$8HfU7AUzXmFHT`R_ zV8ct$v>--o_JA9Ps*Pt(6~x4njK8oV^+TLP+S zmSkiid~0k~I&F_kws#TVRvt&1HrsO8WV;)}Hv5OVDLbfXh8xcib1T-{gI^b2L65S53qXs8pu?_vMtN;;oCoo)8?E4MN%|>v6?>S7FOY9~kp+J`#@u z#WIJ>IaHaz_5AHLQ==%_44{CiN+>xDE(0>E1WJGr%Ri)%RV8?gqhxbv5`|2Gg3X}F z1iCE2VGIR_LzV~(nf~CsgF1_r$5yTHw?FcMnc0sVFg5dy`(NMwoqHDzLXkV^nJno@X9tuTl@!LSxa*(ME#yu1(>9XSA;LbT9$vAA2*Fj6X1cdaCuBBNz$IKw}hEXD}ufCMPrU0c4+ovr(pydY0IVG~YJutxybLUnN|YcSOeXwar*YuFF@Dr28QE;YPHfi(Z69wt#z3!j+@4jj<#%u3Q7Gq5m6485wZ{_ZZTQUdk ze(KueA6r;S>wf5i#}<0~?zDymClfb3Ufwyrt$pSwl?DOsLD$`M)b?ma5-I;NK+$e;oz_df08Cvo8c&a5>nrTYVFXoC`vPbAU6z z4e_jO`oS##|Gp~E_LU;4`ZO`ezetxm)iCA&2`<-F{PLZlT0d3s@xU>S`*@jC!&?k`>*e#G!g1jC& zjO!6d0NNDUhYeYMOf95fC!U4`bs8oS! zbVhKQMn~NsR*cTrq~>3gs>&vQG5?qN`TSe4Y|HY%8Wo-V{YzCTGFp3mYXriAg7_{1 zm2!O#5?HQfEU-!#|?k|CKmN9@?A~>w=$VX$eC?IVa~blrdPom zN`S1IAeG}ifg57psF=yaP1?dDEQFs(GN__%&Sdm~FdQpm8gbn=f6>WN$7{kenoQI! zPCgvmx3no{-K56BArUFsZ%VBVRH{NX)S#L*q#3QP)&`s-t7ZYwJ$yk(?kdgzk3=M7 zjkfx*xZ%I?Ct;!nD*GOd@+9=D;9Hyr36-I$TF=Ds=T{eFH{b>W7qbZClrV9BiQm&M z!fNz#_?AU82*~2|H4lDrC`5vychqoHA~RK7`+|FZIOD!+pHh1#Ajs(X=y+iqiljg_ zLSsS-A0`H}T0Yvg+`p*RA7`kRpHngse$=FBL`I&}FD+T0M%lLk-^!}mE9=@|7*2M{ zG~#%95<0Wmyo|Bs+bWF!G8NaV7)(aVhT7Lp$Y}XGoSbt%BB`v`+Q6*!X*TF<&i%eu zjCNmvb4u7Uycu6T;d)$f$fsbr7QXWES8?;)pF*m0gMPR1tpr6@drqJ7%W~!0F?d>{ z9-m1#YdF^mX%M81#`;uy56`uJdbsa6^RGLQjZRbqfh1|rjA-<{id%ig=&03+`Qh^` z{R-}Tw?yV&_+j=5N6mE){&Fd&)!zN%1_@7!Iwj{xH`n?!g+59IgvupZQG4s)2;B{o zfs?>Xpbl3W3l;Y*H)==d69q6RN3Lt{E|^qubTJCd`w(P!KLw8kL)7yo&lO>1o!t zN&ObaE9%om<29Uz1Cp#lQT26maeS3QU*Z!KiSZenc@>h<_w8u-HjXNd8&rIJi|A;^ zw=K5qnD%WLuCA&9y=# z_(P;UKm$*gD&HpYuc#)?VACjKm4^aS25i}nfMq}Q^M)0aYJLIEL;{<`)|xp1R!DE! zHfp8*q)B=ue+;K2gA;kxhVfRRO`Ie0w4_L}O?$U-H!}gY&QbB{Ab`+yFRqAGl!Y+G z;mV2bk^&DD1|In&4%Sfl6u8LoIL^2dB?@#AC>xQpS`aHZ0IC<|hMCilgXno)El=3; z6rmx&9Zm`hns`0q0Va|Zr|?t7QIW!~teVz{mban;z~Pf9;~m_M-OJQSs3SI{MH9B@ zZxt*g)OjpjP<|%t%9k*4`M46w7tt9im!J|G#Qz{uxfatg-%q0(yKir|{j-Dr_r*Vhde0ih?lli%cT!os5A&Gzx9 zj^@~S9Yy&f*rwwZfTXCdrkiWS-v*Yh$;gaM|_^erEo zz6C`6(pujVVR;GV$6-e)izHcwZkRpx0kb2PWXkANLb&g)9`^kHKghQfB)I#}e>W8) zSkpF;i&dI;A>XR1t(%z$-}Y_nZ<9Ps_Rlq<*4Rn?8hjFu&6M=EWL*v5Q^j_sD?0=biwjo(f~-S_Bm&n;0EFPrzJ&-Z=5-W*%^~@ z>Q%#)#~%i9(1Ixhh?C_;1zo9TsgOf8*S%HzwZv6es8?8#phnHWR zh3!sZt{2NMSlpn6zD=0aT55wh%#OA}0?e2mQf@Z3Qt&`SrC5X$46?3S*|yI0VGw8I z`fld2aoh_>{%WuY6XF(U5iWp`W)YTN7PQQ_!toJ@Z!l}N+P5NpX;l_A%v0lA&CG9F zj2o+y_KB}tn&-AVIU3b1xxN1P^DTh{n!G-HH}WmvkTuORa-AC@Fx&gPndjww4}kD3V%K zo*Lk4SRNq=4sB!CTc1X$5T%7}*hUc6sV)oE03xrg159{Yvq*X7G;U=~aOy=AlZw%Z zhpbPPgzzpY57N?DpLhVAWPKtb%M(w+S%FWmK84R}RgF6_JQdemAsrm`?LeaLfECK*EPOr)|9uZr$ui72=UxmoH?}7ge?@v%>-bD z6w$6=oZK+Z@OvC*@SBA3#&M*fGssi#4v<2qhhRzMJ)usb1w%rfM4_HEsSp5^K&Gmz zYuSjUab!E`0_M>sB~VWCtcqJ8)mP5m|RU}Szcq}SI(#a3LJP7uV>RmAq{$|M7lezJ zW{V+F9noStG-%tXb)muRnZP$K@ohsMM3iq^!AS{ZsyMnD4Qp>PcN}-!ZszNrB$L*Di8ot zD^X*iKmh`pMxhusg(WFqD(Ur0@c0Kx6nM4-F3W40V5>eYDN-_wsmwA=c+v={SAWk@ z(wV2oT~e|1N`Qw5e9R&R60{W|RoA3A-a4Fur%uTs3HLFf{ywJgLql$R6`YA)cLM7Z z2mFh2Lywd+auY01Kx6AuyrDfx;8CjSF4uK${SOJMR*MOIg+f4PddvxgMXgKf7f=Gh zTL)8lj|skp695+r=4OJgVIDE9Bo5n5m`2`X6Lq8VQ@S+)u|-(JJOWx72bCx^O&^jq z5>ce6gHF!b6y~~h6G^mhd5W^b-xB&ZO&=t*TWc0Lad|t_;P6kfv`_w(U-J0cte18sLra zZL6|?b5Kcws+xlml_H9iWGkIu-W1Puf(@fknUONym$ z%`q?PMlYOeoAy(b1~Ko);Zw*0o}gs3A`7@+t_{)J@_20|XOhON;BPC|rz9MTtU=S% zwKw8;JDiO%X+}0fWzKEXFWQ?e_(!2+G=!<(c?XrJI(h_fi8Q}6^{>kkN#~Fx8AY2G zC4%*F(4?m|*S@ma?OM7DSK^Q>Zf7B@Q&`|9T8KF6&OKEWf_M#yujzmge^ZDFL!bn( z4U{J!7Br%PYn_meinXZ1tRaOgUd@VPR;N5wn3C7phKA3Ug)<~X+-s;f)qNJxM|8ts zhUxT#S>mOQ_hz}nyFJhKjcj4M!#|n{zFp-46rUsnINwoMf~GXKBFsZS>TuM^qf~;b zXNI#%dqk099wue>0M>gw}D@W2Jn$@joToaCuQG`h3iY~TWhW_ z$#`qAbvPtdg=Uz&le)%jkL2Wh8Y4{Q9s{jhPB@CO*t8v5U4)_4c1UhpVMImIGZuW? z>Ud3qQveg;TZuw5%)xA1E;4Cz%kE+>8^>I)#J*}(4k-TN-EMViRBsL`G>S#<+@4C8hq8nvoGfrfHY<+v(bY{Dq@M5>Dr=74{QlNsD6pMhdR5ohx zDJSa?>`q;TG|ZE}PJ|L@MrL^YxLJ|Db<5@1+;KHhaZzn`!jAXt7))$Hi@Sn}IO6bQ z*tcV`2#LdtViCd_hpZ?tGHsjhnEr3oo$aRqiMebFm?v12w$`^hv>@G~MN2Z?cm5{} zDgXc=07*naR2$#!ELlV;g>Gbr#!cQkx&cxu@5UWhB^4LuG#hmd zVJh^DJ>Pt6i+ zD^3B9sOw%xF{v9n9R4T_ThHpORB`Lm4k%ClXR&oGOd|&%dy=Yq1KB*?5(aU&+wHnm zn;(#XM=gutdPUxM^&)I1Ow=LRcT|{Hza>wmjVCD%NmiliW^aDqu1E-FkJ&R^W=o0g z6rykM#IE32EJT5pC+e{ruRcvJPSgUJM&p%G0*PwS^-N@;{j*oU*Wo$#bhmQJa9W!G zFD$~wV7&S?waB-v$|4@{tzq_NXLLr+S}^WTce!0Vv-%$2Hh^hd{x0KNqA^v=M9;o) ztKIdS$)4k&x)4f1@BfT|AV}_4A^sM}>uBa$VY#s%t?+H&j;pA8zhY)0>nPlFP6i;; zz^nwkX_bOqZGCD0+o(>$^wGeMzW%~2EwqvE1gC*W@){hn&~2W{e^M(_#BJ~3o;uOC z6c6D$p6Zk+9<)OxQXD5BgeO{`NXQDqg4ojygHgmklOP~O)%q0JvEnTpFrtu-7;Z)g z2zZ@k$H$*w*$TR_cD~E6ck+Et0tJfupQ|_+@rg^ScLIF~(^#oDARCTkWY}gyk|Hib zGAG^4@fE4Mg-G4+&}0#iTm4iwiUop7l!r7C>LQ^g#1V&25UPT_@1BFKQ5c~J2rETF z9!)c0sK&Z|`SImYCQ3MFIGzp8IqJ0jgf{SL9|gVfddB-Up`9W)>*|VheVa7N2K6G5 z_k=o$77VS9*Mvn-!|@u1i{m2%x@s0x#fa>F%8uQ^9H-l{ttihXwsC0D(kkCJXxo+p zEC^^##kcX#BED@n9(f8L6x1o{N#cW6`WAqynb1^y^>i}3deQRBfDDEit{daqCbA27 zk8gK5-v;lLQfOMHs4IG8SDQM84(7U39Vd2%Cb8cdjBg&x(6pUuPvRJFHeQ0iVx>;d zwn916L>8qPuZZRuT_B%&TAKyK;G9EIRp@%A*HClY!fD%z#Wqc+GvJkD^rlq|NOPEK zdJ5&B39MM>ZBf~22or-Hi~3jbkYto;+eio}0Z;)>-%deE^+|t5iWw6;TOG&Bstw8r zA{R|pxGTYRFRXYG0ECh{<`TiiaYk?p0$o(U#H?N->k|R$?!StheL{?8k?PCqaYta| zW~{XLJq5JIafs?&txKf-0c?mik3iKtDVJeedESaf5pvjckGKl+JV;a)2-lF{3)52h z8yDz^e~Z2I1SKOej{s+7$i?%f+3AeIzS|D6HlL`Yzd7g7bQ8LnS$7rLqk8!DE359w z!tgPys!01+rnk@y2a{3jMLZZI~xvyu@i5?M`R2@*6EEV!wANAPA53YXA~K z?Y`1@4QJ(k5D`6_9nrE;MT)9UJNLZFuH%5jC!qNFPO4KQdK2E8_N{2KQimg%*1D$w zFQmD9PKZMQ+j8HIMi#|iIft&BFwNZhZ-p*e{?ocUvhcj=j%Pu*C=B6#xAARV-;O2U zrWjlA4!#8_r7$zuf|<*%3xiR|?&8etavj@u!V!+mguYGF2MPVQ%L0P5EQ>;T6YE`} zM^JuZn~h?;3d-e-L)J8yncSB4{P@T^N;j1WfIW$E3&DC%SZ0iZ6fl*-Qz%a<;hI{X zg!GI;$!Z7}f*nQug;{o}jW|FgaB2V&U6Brv|D;x=EX$ngluZhRRH*oUPeQjnpw4ZN zLu?tU!y9`Phs2nQ>RTboAdwug|_i*tZ;A{20( zLQ}bv$$8s8I@_)afNw6jM{(`)6xVf84Pzgwn^5pY-UWgu;r-omkQE3`)`@viOw?#1 z%+umTi^@~v8wWUprkTiP$43_1ecN82MOrOs>$G?~Yv9TDHp5 zT+7zMqVPb2HmH6}-v)ji8o)=s?LZqO(lhqs^&LHbnSj@~NNLDq+qaxN`|9Y1G^eu^ z#iN|Z?`(`eX)P})m4Xzo(JH1@o&<1-bngV^X{ReraTpE|3PyA=rmjqf*nd(hQeH`$ zVV5)lFhm0|0RG}#kcp6*62*gmtte2!hOM^^E-**42x&F}@*rZLY7AvE`ORUlqT_U1met|8P6YS6Z9)3Z1Qtjxe@v8z zv0RANW^E|43QaS&<~q6~A(SnvJj=GqDrY=W)~FYxqiF*n&2b!}JgxEVSoZC%-}nfA za1Ke5ple3Iq2(iIEsCx))hd_UJvX?E2Ji8$5awOYw;FWK+|t(372#XQvS&GtEpry# z@EEI&J)lLeh(sK5_?_< z0PsSV9Fg)=DVwnbIt2K=gs|fAyQISSE`6 zLUTE{tV$%Z`{~+phv&G{9jgqA1cAOY7GceBVkhrn$7vYN;zL+&?8jIv!W!XZ463Qa zG%|g=wo31=YJ())A=r0RDXxBNVY~v-dbPSx;v9yNfuR}e zXN?~hz4(!PGi=YIV7!5gPy^fv^t>Yr(Iot%S%keqd^;A4u*x3-fHMx&Fkl$D&4#W= zHb7*LOn01eJA03Bo8o+T^R2!H-G+w{rg8bZYz@&& zzJ$MV4oV3OJ!5OKwl0m|CAIKce0o zl41fxURSp0_H4S+0Hjo;mTuWk=bqGUl_mddR6LrVZ+WUw)hK90%~v6v^(oOhB*0P8 z0&1>qzAIp2yoVV63T{AbeM-J{x4r=8SEf>_dIBnCR*h1Ey2R<@m4Ef^ANdiqf0$mv zq-=(jawd%k07h8{_ne82V@0bc5_}}|J^l`W)Crz=T`PISI9nFx5qc69VTm+zVI3m) zks!<);SBw$(j%f(R4$MGj<*%!g9KoKtAT0ew`zJeva?OVrg+@ZJp`X=zKzS7c-ij;zKvG$|1RI^Sr~fzx*Ks^Rgt=z zuh$6Y(`+|%W;G?f@p=mRHZczuwtecp74oK_Z=21FaeS?gS1$ONMiz<2i;&i6-`4Rg z075A;W?RY3&nKi=i3;q|5y1| z*E7hsw?{5)ePQvvlP$Y6uI6eTqoZNj75Za++XB5&JYgIO{VK{Eo@+(rk7B&~^oV(} zK96{8w;B*6N^AXi5%w*w1QE%V+S@xL>!|*FF3n2{>jJaH<1&J4>=cBZYkg`(fePT8 z)g2JlsV>{jwmu2dIiP01Ev0AXMZdSw5#T?m6e+iqon{yHoa;$0C?}wysC%Oh8UdhU z>Jce8Rs2b=djalBp3w%4;Gqvmik6>9LO`Lqi0U{Baxk>IP4u_LYzNZNr;IZ?Od0+c+NgulHT4zi}6 zsAC^>)r6+!doRWNt09!XzwY5Sr)*8P$|Xd0I-2zDdjUaGEIz8BP1>sZtsZByzUABx zp=_ubE2rinchQU#My8ala)%o}`_^Q9`}C)!S4^{yLzJgAz9mU8DaO{A^sNw2JkRL) zpef%5JMWreK-aSy&%r*G%fO(`8ECT>mZw|R|4hD3l*f^8V^pU!II%1ER)Vf(EK|<+ zhSR)qX_{3kb-Io2kP_g0FCfSc$fD8CwSv5yGpLFQ(`eh?)*iJYbHb-`ur9bI@VJY> z|Ku}IXTgzyKt5b$Vj_CzT?_IqkMACFgpw0|ZJ?s|pk+ zL7rfcRSi2L*F7`{8WGCFNuZRaR8BZ*iw+)B#1gGfX+xG1w4^}A%dOCrXnm?`oH68a zns}{lRWKlv1JMn-L6^Ld2xg9%Ww$^%V*rsNdEz*HQ$CNpH=KkLaYWzKTPSKDn%`lC z>VgGzhUR# zRUGfyHtIs3$8qwCz>e1;={>n^ca(3d<1o$GLJTI3zfs?|APZ8}Y0UYSgAfWs%Xzx2 zNBEX_r8dvCryN+*#xGL}e7xnN4k?Hgr^@4n?>!>*fgQqwR;WY(pt0|aq;QLi;g4H*L;)sh ziQ=?|)~B$LCSun@5sgWfCjcOEIvQA?;>uIyp_IS_F-<0AbZk66uT}-X5-d>|-05Yn z+&~b=CZD>AH2h64QA4C;AS(DENJkCMWiG%u6iE@6+hn02qIpMM349#Uch7UdID<^( z`TziRbVSQTP-qXyJcw6`$}BL>F_*fiodf>8&7D$@(^uJc zn5bjvE^~dCMJl6q8L42wB%~*~ztWCZA5T0_i{mAfE?i(n-s}5;GX_=Fk;}GiYs;IF z1sP|UVtaPZacoGCoAYhF%w}~RU2qR3|3N*Ob^CJbIKmO4FVPqu6U-^OK^sLWl!x1Q&LaR!M>poB*A>}0-W zoWW!Mi36ERpb(TV#F31%MpI*&g?#IAsH%pn*}ly%qd`O%ce`EKrt7-?*|%7~wdRtE z`nHYFOG$Jl)h7fifaW|Ylzm-tV>e&Z3q|V42GG5Y34S} z&UHjKq&Xwq*^H!k10{eB`q70d&JPCtFB!nwZy6>rizmlh+TU_uloWv1g1di%?EfK8$A^0NFlTt?9 zYkKaf0u;g-7cg~hd!al@bcx;n5IH}^ft<-`TaNeagBz=EBoD24v&$+LCOUSxLcgC~ zG(mu)V2uD??USJIYX~a)*)JXpy(NjfuZscBuFv5(MhtY;uON2m=1st zihQ=i>CASn34bpRZkt{z6|rgO_3}LKZW}6(gTqh_C{%&v zT5vokYDtTe$$^pb2zZFCO-+R=se*E2FEJVIG7p?FbeJ6=0Lo6eR(|TXLUP}ZhHp88 zrs~LNJNtL*+C9Rz)<|KxWtaVWCe5`i&|7(S#3ggMJOsoC22nE7 zDo<$@r&eG`XLS;Sk8xm)rpl9$-p2JN;GmKQE@wu#p}yUm$mr8lk^1GT>vLsGn_MbO z9wanYpeo8!MR7=S+XLzql*(H?Xha&fxCnk;A8}7;eX1fEh4m>!pZ~cYHeUaVLMIe* zF~ui>JY0N5=)~KuvPzCBPvC*|kb!1QZs$xI+1V}?wofUQi=B>b2jq$cmB&1koDxpi z>lDoDmWK!Jb-VsR}uf#c_I}9^VafTnFPa@$Em+K6)SpI z;OIS$24fyxS@%j^*-1jZ

    p0_klQU=3(F*cxBzocy--En5tPP)IH|GP)vO2kW1dQ3d;528E0@^4?jHrCphPjkK_E?K8{BhJq$xNqC}0MQ1=gU zGbpkKQ_l`%^l_1heYRuIER_o?_ZSFB>l0g2na$`-#P5G_JqH~|2hKbAJm|6x%Pqs> z47#j?fMC&vS8?$NF2U*ho`H*QzYtF>d%V_;b@YsG5n_2Zx^i83|BOTN_cxz`+m)# zT>BbsI{W*${Fu+-syna1ALri=GjV(*)0$YH27EA9e9Jk5s+us3?6%IfNfExaEPGa| zR8YCcgZ;1E7=L?wK9-;ZEiW*nCFF2k!muU3^6kGVK=?=!G++bXQuwhA8eaPZWF z&}Ovb`Bl$DqG2mTec#rSIEr==-#q1;IRCHMpkvk3otSO!u0Sq#33^+|-A^MDSX3|mVO zTc6Sfjc7(=Txm-kG@^o7@HDbukq{1!dMh6TsK(@c7K551MFaq&d~(?-bvlj(n!r4s z=RuWKeCI>o#??n(36FUgv4+uZcHsOwF2tR$ybV*$pjaOEceW^CY8l9q48|D>Rsr1c zcWJ2NyMDNq16fmGswPIt!(a}Brm4_m4MPQgmsyf1Je$E%Ev((X7K8dAHVAQ&hO z;KJX25`SI%1mFUiMq#K1IOlL&7nAaB_{n)c$He?Z43-9wQBBB_f}cHgGj6>92J{X4 zJ9(-C*bX4cz~;eTtm=Ck1BC%tBY>rq&~EAg=NKsZJ9l|g!HDI61sl$?1mp}21iqza zxa1)4RDmP|o&yjHw3{jjAs8%J@EFi$${?J<%;b^Lvm0`qxuI~sxs1&$yG5BZ20F_7 zN_Iv-5XW`UX>{VtCti>7nQ`baI{^6B!jeeMpaT5?^jW!sHwjQB~eb(k>ImfoAmaKxmaBJ!oH};FLFsx{S z4FDy(jJ>+{!jI1WF;19s0tQM0AOQMCw&M679g6{P5O-aCH%!&U-Z$_d3+t*7wBtB=EMGf^xTtCk8P134|{ z%P8()q+IaRf>GI-=|oqq3t24-&*2!heQUF6=uoHv1nzgLtm0e$cq6Vp;R|5g!%%qy zotX|?{QC>>`<_1n+ya$>ypciKDWP0ukQE@SWiVJOfV+UA0*(W~1rFQeK-_TVjac0C zIS?5ZV9R{>MgQL@V@mHlsu0%SFP6nz`wTSAaA z+F+_i#MRo#l=H6RO!N7cK)4nXjFp|SnFS!|4+Y;k?OQlx+94_`640FIwUx477rSM3f?5kP6Z%LSb(Dz@PX7|MMyyEm8Z(?0gH_!k)vmV z^{LJ}7EpE{Tc5ZeLtc16aRifY$WT^|-quVUHr4g4ylq?l zJwsK+6jecQxfYI`c?7@`@|zYa&-d=xhIZ@>q4KL$ms;O|~?j;oHn8oQ0#4eR>X z;n(wjje=Ex$32|B_vtuckK-Xz8PBeqi~eFij^E>WJo)D1cwxnhICK9qap<%|@X+Fi zuzd4!eEH<-;4&9WH!Z~h-3Q>|#Sh`{Z_kCxTpT?85PbbZUqfEc+!;^}dCRkGcepFL?~}SHA>ZR{W|n4$Cd0Z@3S~-t+;0b3FT%7jVT1SK*=8?nhS3 z;h-4@l#K!HLkTvqinE8#}9Ww^PeM=diRdzuR_*!<6xpapB1qVM4A8!{s6T?z!J!eg6iilIRX5Q61~~Afg~P>RS;$ z9v>gke&CEDW40q_bZk62dt_LVB80P|p=Y26N8WT8)@|L0qvsrn!O|f1ow^r3e%L3lq~{I%<)!;@ z@a#iy+J0x?Z6J0RRub_5hxE{Tb{(^L;q~s82(p5*~l! zuXyZ@$C1&r8gI42x10l@$eQi0rbo}dc~+sFF?VXQG=hj5t4Pj7`Wk}qRQIEPEJS|S z%j8N}`m*C|k!Rj=2A1_M!?V}S#m5dj8+W{P2mZX^FW7VH9=Q0(OQ6X*=B{`ae_rqx zxSp?Ad7cZ`b0Jd+*PM72W{;nZwcFO>H}igl;bH+FoO2XDdeGSbI5rOS;Pw}OkIjR9 znAF~dFP-!mOvrV?c5U4L!te0<>LoaF|KoAm{%3$OhX0=bUs$;IwVHKNRKFMxCT;3e zzcrG{aoHF~!u|Dts%pq(ItDUIKC+HlGttVl6Js{_M*MYKgZO0iVq+&LJE<*7Bn3r%Po4EDpG?5Woo%78?Hqia8e62K@e6R zqAl!+6aWAaSfA3k#Z_?!6G+5$FUj%*_#-+Yk;Q{Vh$8L*V1mFCb;=V^=TaCYLqJEY z?ULN~s^t+9VbE|p@EG!Na1IXWDriSe8k(&u8^U1a^2oHZQ}ico2{8f8s{(w)^3PRv zWxMdv{m#Mziyy*sOXh+Y60&L*zx=0P;A8urjpbXGW6p#*II#NwTz1E0xc2xj;Cp9$ z58Dgd(O2k$E^F9c>c{o}a6KH?!ZWWui?jAS3l|-J5jG8N!ip^`@RgIkiVm{_MY{-7 zHL{{}3(jA!3`9=faq zb@%rM7-!fvycI*GK@_b5kON%L#RW%RgfkC13!gdWGIZr9;_5$s4kzvVA)ImGNAT5q zzJ#k!z812i;EBbLq0MZ^4?gh|yxsd27O!7~%TKrxMZ1id6K3Fw6R*Z6e)cgu`0~T} z)n&iN`5*i=)^1%5k9ioE8HZC3JQHnZJN~}>8EhNciXUHi3)c0m#?SuxBQOsz%{*EKco%> z@2&?=_FaGg;L77Z57%?CN7o)WXzGEuImF+ z!LPAq+iG-X#^Ka`Psdq5IRj@Md=}0=_#E^X2k`zG@5ib8o`%c+@LB9LWgjrkU?@6{ z-s4!@@!}uhdJLM3dL9VTE@bX-{Tdw>ui$91U;+Tne94v1j&nOQ9jn8|4UcT^wyaWz ze}`0xzU4d6w=uZ1cLEXku2(}PUq?7-+QB&UfHU#r@+a`*%THm>tleSDkPTa(WIOW(Tf5;R`Ti1H6Au;0}EvAE|Af)S_Au7;Tg_ERUqwWZP+wlpHDj+~>eFX4Yw0YW zy5K1;9P=Z#?B9%S+w5uGgPAzbWtwqrJn<%eI{s(OUNMt>ZF^HrgM{RqjS_e9l)jaH0q9xOlM@C{pgq>cf)k?9G+OU(3`#pTV4^b9v^n=}bHF zd^Ydhgaqt5u#-J4`*{6^nfN_HTB9vocHEU*`qTxyy5tpnnwH`4bW3jq$TAd#%FTj6 z$>wx9wZ@ujqVaIZG+iQX=2><5kAIDuuL?`%U{oXnllbLi#5AeGoWf9!>Sv(<&~SbX56*(uNr_PNi^0B zXJC&(-173x{O!W&e1GT!zTEOTWuY=YT=zbGO8fELk6&PS%Ps<*0H+;t2IoBSLzaH? zIX=~wS&6i|bgH-6Jj?FCvSr)J>b?*HP4!V+P=27ipd!PLDhyQAVn&M4W8~hBo=rw~ z9S9fLP921UbjZ5pK)IOUUBGk~mpe@IOCH#+_~Qzb3G3EHr}Djp2t)Z+j+DF9(~_=h z4eeo%j3p&DZ3_uG@jpqBWlI^K4Ek&d*_KjU_-skSmLx1$%3a-Y!JWi!Cve-glu1Vx zGms=F>YkkGyx6vcop5$+TXGzy^iNt!(wOZ;C7rfp`AO%=vZPEWN^+bhNydr1C*icD z^iMinwuDH0GRjLhPm=8XPx8P_{7>>nO5<~OghL@oexD>26-awe>!t5cKHd!8NIY8K zF+-L>CXycq&Zl@;wrv^r%>Na(uzB?KKk?CZA8_Nun@}W~QyWiV>Zo)0$LG&;+#il- z=Binocj$RseAFe}cH(WU+p~^Q_m86SH^cb#yx(9X_U=UE&i0GsY^H9+0KvZSJ^*H| zoXMGgIg<^0))O;g2x0T=$Io)ZjOzh-{JlSO;=L#G*t?GcFtBP6M>HHkWkDr>``2ID zvUeMrqG8(>vLtbA|FKxMO=Up^eJc90r)>}W+V)Xb(hGpEcdtcF&R8YtuA4d~ffD|C z<*R)9%cazpH}LA`FZ0QUPl*~1{om}{!XP(Mq+K{aXr={+jP06 z4Is&n(^f?0C!-ya@otB+DH1A?1(WefZ(GjmimaeYYHDFskrZSJ6guV$9)IsKM&8@V z=6#zvrr)vDm-eQq)!DxM!MgW3=ZUG9mc;{SJ;=7^t(^Gqcy4*+CWclI<=pR`%WGe} z&S{TMVeD_m^5lDuGpuGf{VMwNgFl_j?v`C_*|&wG?mLW6)_+XM>+PVEWZhDWx|s$^ zcHPqX%D&L(O^x#Z|e`0M+B<2Q5e1K{qNcXH$On>uF1ZIho*x|zn>;r#TU*U@)%>$ zWAO;b^&7|F9)o%5%a@q(#SHd^_c3|MWJ-%lx%>6I`1_~N0&wli*D~>eiCi<|Y5-nc z_6nyxb{b!7`GSl7aS>zxIF=h;xgL+=Vd9X9oIG+07moQ6b5_k^;9Ub5ao=#BU-BG& z%~>^=G;|7=AALC=Z~T}aO}~Hxkprl*v&!pLye!+coO@>7iDjGoaq6S|>*kNS`P7@x zJPJ|W2^-xOYXb>%!|^Y}y0h}y5_J~b*Eg->lBX}^H?!{J=P&*YfQ4TzVA5|Vv2fKq zF8$jD9QT{C-1N^I@M%6KG*09Phn~W;BhP2n(l;1#^8iNPKA2fwyv}`R|CYM4dMIplw(EQ`6MM`bpZWv~uX~&N(t2)u^=EwX&F9>8^4$!o8pPEvT*;(IPa+&|=j!9G zp~znhfNsV(bM)y*7^XZUlw`2!~YJW+@eZtlesf|MEpA3rg$PY4W zCgs9pq%2rBK4ilRDNlYnO&unxE6O}(Y*)D4^V2`w;8A*A-1w8H-XgIACGx=ukQ5&V zK4jD_oma{|b-lIERQj|=Bozreqn=5ET)Iq>D&Jj zgk+YNhrSf*v~oqlfysB@6OeXl+PxKZy84u;OKSHY9p$ArfK&%LS9|=D%uYT-$T@hGH2y%6xoTy z7LDtibND$tGW9WLFQ3Wy2gh;zpm98U?i19N)=^tr%aTo>@c!C&@g=u*C3zu%Kp=$8 z+Ffh;%iDiu`iIY8n1&PW3i#9f-}Co{FQNvWEhgZc1A2AIOPqV;g-jlC3S|Z5MB`EB zES*V3K`BpNGM#}v2V*7buE+|b8x93v(aQORBPMb{V)L#Y%vm~ocT#s8BdF0zko$~bwbXBLsZ?EcM>;A2r^5-c`96FK9kGX(hZ@XHdu!W5*$^4-4R3sz@Rt@5u(dS^<7DIXr;i!fqd2`>)6hA$R1{$fpOhyJ7 z%0lHlbMvY`fy#LC^D)#S1{eh{rjFexid=6!eOVaIAxSY9_I;i?!R(mC6^Qm5%gxp#&3zo3Jk-n4M*Ej zhhN<~b6ePy21*eAVwQisj4QwTG0NpKmmP5#4P^~%-0R$3Hha}<9$fSQimXx|ETc3~ z%9$h2WI)9L0v;ccNQ{EQ0@TES=+%5+k=kY=5`QE~A{LJlHx1+dn|Loz1GPYw@WP9?eTZu&m9a`7`!x%a+|kH)2JxSTtpT z{9nA;J}1JHjk89cc&y5*L%#$fVW>!wMBIuyE0_h)9Nvd5Y<3>l&NctIl0B_^DK97` z;0-bT;^+8!_gb!e_Q(8m!cRG8%(>2r05Y1Q;Z?mv;}PP9g}2M_%eeC_?U7qxfi4GX z7o4_j6ABa&@)hm&C}qu=;C4gAXp=3=LQ@V>ww;upSGF0?M7NAeNeFD)qM@vwT`jwK z=s{eaU)4XYlS=%Wlu3JX(x=8Vr@dY~Ak%LI+ZGpdNXIW8Imfni`Nb=08 zqWnh!`MAH+Nm~`9&d*-;!jBnQHNO8@^p5!?1b8p+&%M77Oh@HX|Mz# z1Pv7pfaAFDZgHCMtmSX=(ENw+$O}$O}*vg#(cTXiAu?p1q8%`?gbETt#cF6_27JcT6gG&9km1Ji6%= zXaAOvC_*0tCVZSW434hAfM&?gWhhQp?MBo@wT6 z{-+3+I$DuPbJm=Ha!HXQ3Il3J6rr{QO*MKvTogB)?O!?jgcB)d#u#032#=oeD2ul& z#;bTaeZ=X+j2Itn{D|e-m$GipIwlOBKyze22#6XnemVP>%w9R0$-^cy_v-m<-Tw{W zG=IbLZOZ|;>4cv%wC7MJ4V?slCoz~8`icm80(fLKaaKg4$Y12lwj#5$)oJIK9(@@x zBgWk`@8RhW|H=s)g5rTl#2ZSo9fNzV3@*7`a*yA7a7cl#anOu3|DlQs#IpqZv z2qE}n{YU(I#zRbh?f=A)#rqP--Pc^6GgZ||jBQQ5X^)YO6d zE{to5tjn@+rl;|3njnjLGY zEvuovtezFympj{a<59LB*hXXR2>$1?zhfuDshu=*0&z1=&=Vx+4I%;Cnw{qTvk5m7 zH|?BDX6rVisSGy@nqhaWSRAGHl!C?X`RMqjqhkvIvqEqPixX8L|y)6h8Q(REC(b z6@6%rwK1x0B=?>ETb6Hi0x1E^T``9>J6Ch_|w~ z51rI0gGUF`CudI*rSV7z$HFQqD7OnjMHv&)4vg6g5$T{U2X_u-oxmI{?Ek;&)Hz%l z-n=k2lCKC#n=IsfG3S&8y&q?7}i!Q(WpWb(uLBsbz_ zIBX7_tjfxvjha5RL49gu>F`a--1m1c9k*`#s?#<#tx>V_&l5N+0WhY14E@UcQ5Gy? z?e4Yw-k0L3&_T?Ld^%kZcK8=_W<@Q%^AslNu%mf93s%jex~Q7^@&-x+ zWjwO*VSe(DpRn`5Hb&JSLdY9p{>ry#i?urUMW|k?OKMoRdoA-<%%MHjmYT^G2x?2~ zh{mJLUH%q3n|GkdGIgbOg!QoVY~L=TW-C=iReZI5B~QKmXPVpFSi55x#VU}$Cgt<%SvtaowiUTFomDLmSg?N3*4Ay+J0mE+N++!|c`~Gd*Gvihq=NC#! zDi|^3*bU=GOnJN-fAY|}GH>(0&R?@**{G)d+mPj~i?lO@>niY6>v4r~>$y5JEFraL zKLaK)xb-Tor!CgPtmQM=AKs5D%hZJ@K-}E(Q!7|E&W&CN;A8CoT(7&=D%eH>WH~Y4*ddDi>|N324 z?^undsQ5j8qDDKbcdSMT!8@xLF>mR7R_<6vZAl%qCAA!g9AL($FA&z-I-*r}B?s3w zo0ZX(Y_suZ8Fop2+qO+vSrx+v9=-ak;b%To049gRzk2`xAOJ~3K~%sh(7xFG!3Aq} zEF00(ygd~S)ivcQTLzBpa||&v#?y&jeEtUeqI(H>Luj(bg9{!YPK0qoUeDS<;EAU zXVI#KG)G$4)U=+EuKdNW~dV|dT;x%6R z_%(L6Y-LF8F#7fAgJH&*vG@gA!p*31?xpK)GDz23%d+XydniK&95Lt8s>X%MtWS5X zZP>VT<;APFFRh41+Yhc!&emC1n5-||X{)x4BFhP#X=d)qxomIV!OES>sVnJ4d8nM} zA3e<{n-(*?b_D$^`yop*|6KAsmSxhTum_)P{Ft{^%;WvFZ_}ruF9WIu(zCdlMPDu8 zmCs&A2%BDI_3Uik&XUcavU%?&-d(+j5p|FSc2x7{ zPZpxLUgI~`SKF~&;Cf|2md)9v(SH!I-FBdIMypO?x{J#lCXK#t>qK?KG0N_u-Ql|C zkt764$v~oNk5B8T-1$Q1(0Os>FJ=0M=Z=48sd)OI3uR9{CdE;@xpgnOa+2+xr_TAL z_dv~VSMUDt>$emBasGyE z+g2(lMA86OWd*Jw>8NRq-euBJl{e-Qf;eHUvB# zG+Cof4h`Bd520&iMQ`LYBduO~ITDukdt=J+N-uLnhv6Yo0HQxQFeVL{NNpeZUs zKt$IuEeLv@XS$&ijXU)WdSz5aMK|Ka60DLXux-#3@OwSz@i@Af6fG3`WJ*FkIp?Ue zxo_G--0{MV-2eJRgnSB?Wig=tC?=k8(W`eKb?sEZ0C@Mn=A!w_UY;@Yi|0?=uybwK z7ZxAv)-G2ZxvzBVl32+JHey;3@_G|1P|hWvh6SNSn`qa=ST+Q`UZQaw+jig;*^!B9 znnVpFp@NQFgB~w2Lnm%Jy9H$lECB&c#-n+N>M``h)k8s#nvh}F&QnfC7fxhn19j#* zA_49k2srAnlg$&3pLXMQgU|Y765{E#bB_9G?SdJzm%iAuwY?=btbJFqb%n|L(uMKS z-HSveNpjl1VWea&0X|j1qdMWGqwy$l({aSSs!ZIpu>~lS)15jx=}+88r>As9k|1tE zP*YG8l~`QINF1q=N$9JrWXkiuvIQuCE9Y4UoN1a29dtM+9e4iUe|gk37m>J3WS-bs z^6tAYyz<7E&mXsW*Sc?|w~{0!cxvF)JkDwk0%6;P<6&$Yf?hue2q#uYJgSOM^*Ps7 z*aBGskD{U*CIUwmmhEg^_G^B0Lq|8wRMi8TiY07x!zSo)BHe}KaTFln@pi~Tk`ng~ z=^1R(6z80x1VrLapPD`{_*7?wKcdGl?4+(bXITx)Agr5ciqkjfhEB|Icp=MRTcD{9 z9lD{T8yzAGcu3rJWMU@o%K`!(02e{%zPZ!BAg|uqHj*rH^qA9(@yDL^lWT|m@UbMs z-`39__pjyiUYfmpMnxprmfCK8FtW`L-@QILpWcS`FsAL?pQXwwx~UV58>q4)mzWVt z>6QcpJYPPg97+t&|*88T=k+TXj@7 zuoBN@$tg>g)0`;RapvIo&^@O(^NVGf6cv{-`GiY0jX8AE=@-SW-uiIA#cEWKLHc+1kg>L>f&nN zymk<A{dw)f^t4_aGic>2RWw9i))(X?}dFQJsU|I2?X;jM7y*b2SL-_E-sPay5Lqt}1~Hy_HS1 zXWWjLMD=#0^!>Pb+Eq$Ny3$)Z%kRJ;<ycEl$)*h~NEri}SJ7yV9N_ZlKf&mCB2RVa%?)Qv=y0ZZ-56;XpdTI1!I|M1{bl7a(XV2xN z^B_~FTn*NY^7GT&SsTm2mGh2^p_Xd$0!{N!R#XuQ27;T@i`1j7y>u(;i5qb|vd2}n zoz>}JWh=QElzHFjhHSHFP3C9nex5d)FwoL_jm+|rPFg24cSpAQcy=(WPkD4JX`mMu zR#4>6JlELV-r6&wx0OcY5vNb+OtxLuqMgoujirj%k%O)@Re|8f7+b|CUQ{ zxBFz5dfSP!ZzTn#yBkXzGaM-!skdLVRAEI)9a?qcU1q7dbmfE1o1c9DJ9M171M4=H zc1gg&*W0bxyTW$GALyb^0!i^=C?OPCUE2+8uBj78>LocAlY6za*=DB3xLAJ44$cXZ z&=H)$)k;hul3X)vJ2BtTMbL=OR-UqhRirMib>Vu>Wx3yK>mI4F<>}?w*>L%`?WK^U zmFGrtV#Xsmt(cQUChvqL6$BKDLuylhX;Lcm`7U#NkM_uc%5bF3nIY?H3y^Th=tgHQ z67;A1N|$%iBl6`MVcB$KcI1X>@Y$x%umyM%TU0W)WTYEmE~&GQ*DarJ7}y7ax3kV% zmOzh3`E=bE*aCc-Q%8X_Xe+Wp$X{X=`ie3lf5r81pSH+;zhxSU5XxN`Hs7K?U2fa! z2HtK(BkN{+$&qaWuH#5%!dQ^faOS0_`vyx6-5G{O_Onj-n^lC@8=xpu*4C@MUq&d_ zNW8tFHPW2pFmzkCox&t=btQ*x^abBmw%HlUl@K@ic7{I{=`F)3@0{i?bv6y=Tgx`# zBp3RMV?lrB9a6D)Tc6hOexGHU&QS3Gs@`@JXL1!JL%Ln*SEuy+FYB!UpC?FBptP;N zxPN-&FFB@%d$)$0Gs?|7)^?|C*Kw%}Idp?h|Bh@$VtYW=0r#}LY*}~RC;Vr}+Ai>> zLrD+{6jK-~Y3eUY@r+DG>W|rqWLvIP${C$HE$jbL=jq?7x0DOg6>L}hfo|7d5&~2| z27#z4>~Fe$!#(A7q}GXeFm8Bz?Qg?M+V442M2=Ml>1TCPfhF>W#mnQUWUMyjccO&U z$=1TOaz!eTg-c-)-QTvCz?Fj{3x`OSNv5EsL_OS{rz9~69ElfmR-fc#nNr$&?zATZ zT-X9+dsHc7(2mBVJ;L#DWjNY~oQ>@uJN393Pu*r{FRCnKmdi13JHsgfrfp{I-*-zA5HocQQ{dB_^BKBfqbivZ zzcTBURq(+YVrekn)(}fiB?T4uJ%MdK1EFy8+19OFeQ`tY)f#C|s#!OT>`u!6ma@&s zNU5AaH*{=aJ7LY0#FpM}8+aW*B%FRFZrFHK8L#R|;L3hCmuAbdh{jE1$vJz`5d!@` zXpD7JwgN#gP((0L*yQ(mGH13ev!P9I^_WIHF%OuBwv1>0LD`DTJl%|??v!%+Z>OKn zyTvpQP6_9(sA$|s$jIw{*WGt9srBE~TM0@E%kg^yTZ=++B>A`r{JI^lZ%OK{Ygu{9 z&W3U2LDziBQJ%D~5{}O3rj7)7RiAVA^dKBFAp{XUah}-I(I%We+ajtPDSedO0!QQ> zYtu5jlI?$B;=@5J&@`DsUy1Eiy<2kuw0@G+jt~Z!liMyGi4)vbO_ZaL_e6Ul8^1AwM|1tHT=>i4$_3t6N&C^!y=X-im^l-j~4 z2`S^#L8g@XNlUgZr9RFBDf5#^N$1IurQAz>h2%utOMKFCW^64?M9E7<-Af`)eq87h zwv^*U$+DD+x(CkIz2wKHL)elnb$l`iPVgiZbuUq#mBkAQBt>#QX%YT1n36`josdT| z{J8+xE6HU=O3bUNn=^SP_lU)#}gP*YUH@ajfJ){J0O z?I?y$+N7e1xq z6vC#qq?X2-;WX9^$D?>ta<^@pzU6&stZAfgMc>4^G26A=>^2yU>kO-DWd2PHx&7oj zv4sSyE+!T?J7z}(Y4z%w4{q{um#s+A zoP)C)NeCz@s=((h*wSArOBrPCa#6sx?1tv{eTnY4bAENFPF>12yS-%NOw$h`1br&{ z&{)$*d9V!AvfOpcjn)LulKhLr;+%EZRObJDA?F-%9?^K*ITw>Hhb-K2!=P7bJu`nc zn+K=;9vRiS*!5fLZAL$mhvtKkt!)bmLd6vLi}sZJD)waNiiY-ht8AK1aNNB7`VZ-? z8_uLWWJyZt?Z~>3jI0~UfT{sRjhJ(RZu(ZlJnbdPN8OB5SK5m=e=>`Qru_j~Qn9UM zACOMaSq)k0f_QklB#Y;)7*kZGE|547)dCM~V`LyPo`;7>@ViUt7h=et6roeSc+*no0xRNpr*Kn*KT-& zKc4>>imYK-mMhIUV{LbM(b-s=_W5^YD};?l^H5Y!uB)V8@!)f`+fh^~~C%3ng53?Polm@s=V`Z;)rF^U0 z5+phtyCh9{j7|<_^+|}_yzKj)gy?7i*+q8uz9$mzcQ~6M_i0RBreXAc=G+faNDc5QWmP< z*#2YLuxCRmqEs>h5OL^PRLyaNj;Afwifvnt!6d+^$%%+l9p$&jVoV+}kr%Ig1)t{U z-Z$^!m#^MUaln^wKw{{I!#yX8lP~p*#Iu0chp=th^*FZeL<|agy-1QXz{lcFiHZav zpNF^+Cz^-?r7BKjv9NAC2bysrhbc1nJqqENm7pDbnsYkWFbyKQ^S)ODzehti4Whae z*~k)3)Ig5{0iQ~9*yOOj!}$C4FZ1MrKk?v<$0#e!RZ%-}&rnIId~ZOjPhXKzOecMAR{7*8%)M;k(dv#v22q&r`*G|G3Nnr!Qam1g->2UlVyh1 z4CSpG7En=G$>*DvaO$5X(Hd<*2#6#?=qWO3Q5PNOt34LSjyZS995;A8aYIMgA`!h! zCz_C(PX)trE;SxEcsw%}zd+Q8am>JRe7Wfh4AVl_ExejTvSEQHL%`c{ZXptjV^|Iy zDPH>&Cu(CBFLP!(^Y%dpmr4pNDGU~D1(MprPIi>*@n}^z+L}i%Mb~mlr#;>H==2@; zz97AG3hO!}dkyEU8|G6Us^Hm=p5fA`FDB^qV%viDSR7Sx^h!6JC|)727g=(`q=#ei z6zhB*3BwZftL)FX!Q=UK!(yWCHo8Zrz^|dmGErSeH=T%?wy;xrYZ*{fSHw{RkD(}7 zj8FBlKODhGESNh{09E9aEc3T<*8nX4rhIK1ib5rn7FIRYw)APDB$cHahEW~S+nmXP ze0rPlo9|3--P?!r-?U5$eFgmWN7EV8=ZHiBi0(w- z40Tc*;&N`isHt)y-0Zwl|Oip3)3kytw!T9d9{ zIkLu8ZU+^}Cohh4SV35i@zd|$$epL$i(wg@@z^QMUN)B^pWhijO@U99h+85RVbQcK zN7llLjM$?{Wy0{u2w`*M^Ec2IHc>SbMTSCOAx955mQ8y$B5a%1c7vc_!l!zOn+6fx z#-loYa4a5AMO_SdrLcK+LI^a~Ls@ZE)aUVK*iqucH$n)zhh(-V zOYdAZ&`oD2`9;e7nJ52XaCHuo2QF`&q%QJ1;IfCRPSba>Qg$#YP=-*oEnIPh*)_0x z%Iiq!F{O7)yXi6GmW5@@8EaSB0VV*lx2dHk*T{Hzw(U7tS7w5Ab7l3CZZ0n2g*-mu<|Ei8`eH-?@?)oj|kku^J3r@}is zm+?ycVASdOG(T}O&e?~b!!z$c#qO3}7^cm@p8Xh7GZa};*xj;|55NAH0X>q>WOg?1 z;PcH(uq>MshaFFmzliP4+gP$;3Brb&(kezbj6qctS|SH{|EqVXEUecBmH|0q_NjXjv79OueN@c zShvg+c_>suQDIrrxZ>i}a`gLqwp6r+n|riJT02&wvJK(%@7YFJCj(T@tWox$o@Rim zikfPM7asW|-u&`aTBACrj699X!YTk%MMDx2;iyS>PboY6!X zlSh0XMfOlpP=;X{MB))7pe<_9ySyid_Bk8`e6s!{w(Q!2Za4;6hD(g*4w1v14Bj^qB`Nkzg z^azUUHl}VEH{DDEfh*RnGv;(tk}Ae%EEF^7&3-k2X+uMb^2BGV}E!*OExaXM8d0T z96xG2evco+H28GmCw#NJiMZ(;MUW(!6Gx51tEw#7_zB@yjQ&0PGoZ&HKHvB$Lf9PM z_XreOVNY8Vo0~Rr=Zss}zJD7{t<6*ymoldRk*KmpTeOwWHhey>Gm`Z(UVOWPeqAvP^u_%po!>KFl z#kT!h`NfQz+1av#wrC4c-Qv(bBWS4TLs$>9XyttBN_#P^u93}qHnL{>I)?XZq^6{n zFE@WqTeOvlBgbM{7K_(?n3zn2$!*NYS6J3s zLKpc5gUcNz`6b_+z1zd=HHm!4U7Wyw*CG3sD^8st1W7@7OR$Bu<=?@S*O9X0YC}uA z?uo~(h-1m+U48oZoG0gTg6r8nMpm$j?;>bK5>H+nbU0G!j#Iasr(|Z@D4jQG1PSXn zU(kqjdWG{WAI)xySGJH!3l)N1b$dfmLCV+`LU>F=Z#WR%OUANz3c#fZH<-l77S80` z@@>oceA$<5n6RFab)ztCld%Ji;ej)M&m#*TCLD?I{1yMCzN{X@Hh5?CB3}ONB>=*) zb`GsSjQKx%7hBkz_1I}Fx0d5ioUJj8I5owUOdLL$cUCWAL(_UL9eV|1`i$Ylk6z=L z!ACIt^5>{6t;4ho{3@*YD(*{Y?Jp^zsuA|Pvf4`@8SB1H)2`_F(bwe zf4_Ws^aViPeE1Wv;|RtqC#xDP<~sqSB3Sq9xah(_e%`(IK`dHzZ-@}$3m==FN8ohb#@-u!4Z9rVsMWkEZe$* zlZH;<>s@Oo3>2eCGO>7+fj#>1%w^B=y}m~hGn~6^9$WMX_q=`wvaIl{Gk?d`CtQzV z#o61o7a;_uZ4%ZEM$`@CA6Na8!8Jnx_;}sFIQNfJ(Tx}Yv3P`&hEL%BX@B63mwwKc zJ)8LZ)ic=9yq#z~Oy8;j>}%W0!CAlIq4OW(?Uf5ywq*s6U-}f| zhKwhyhuPo0mnpv;&$^u(@N1fj5tg49|85e(M$;q;eWiHGJZoXZV?82zdu3br!2gQg zCJ1!Lnf5VEgOAsL#Png;Ln77K@?f#_p^V? z=bM)B!nLpQ+L9Sed*p2HIqP?PfA~ahec`9P`pHYYdD8;kS+#&u?w^1vgGA=#%Xtm# z|AgKOn^3TTptqpSr)n7iVkFCMXpQXi$BkIx_LYN_?ZG-vbbnPQtQ(9Sa5zJ2hVkga zKXPcp;Y?_pM15HutG90AqGK-QniFo|vrV6JXv5(=GXMAd>h*j1>!p9=ltWG@W<+U? zwsOt0m(v<;p{BH!M=yMeK|KcpaNc8Qv3A!Q9zOriy!+Kc*6v)x72~hrk+~0Y{oiil z`bigZ?+<^+12gZVH5}o^pS(i9ssTun#5=1NaQR;@Vt30<=c4qqD*QKPD+Cl5loRj< zx0e<6$T&kI3#DGNW5pugf^a(@)g5~NSDdHru1>kYc3P(_=cya8|9$5v9k&gh0@`#1 z+2`5x@1V+iMoN|C-YxCIgDGt13{rY-(piwZaH5i2$~yA|4udS&Iro&lzfnqjl4T~B za+A(awnLIU_tcpa<=kcEggv*c?6Xtp=blI{&nC}2Wt@A$30dxb?upd7rzD-pvP1>~ zXZ1;vU7V=&Gf!zW3%d)NldmVb6?SQ-{{KNRr=z-uv5|a%ZnxI`ytX zsV2`ZOg(HG_grunlZH*^?KKOTvvdyLM5tHGwz%Nv3+P+fkNaldOXc-t-2KMgsmpJR z10~!#`3`)VkE{QFIdhiJ$FF)*1saxM+~D!_DC)^epFGc-U%U#y_lHeH02dv5F%1=c z_|@xoQh8M=zk2;nt{8t6y({`~=gYTIb!8d%y!s2yKk7&PWYW)hWZpycy1FMDcdzH} zGk?PklWyR!zTe}2K6r*6SCnwsUoPad!_H((za#nE+fUHr@)E9l=IT@s1=;IG=6!grf(Iqp{auZaw1{j2$|jvmThl_ih3-yvyM80N8WsbdtSU1fcsv)gQ*Wq#iObzJ~=EGXsSj@u-x=%zRl_K zvQ4=%9@i^d+V_#Mgq%mV8OcSq9kZwT2kcy9OrS_IZP8Zdu6T=}H^}$;9?9V9fefx5 z!r~2!v27b$2t2Bn2c|y2_xc{mRnJ~Z-3>kYaQz4TY~szFFy#9jJ8&FVpKv|zt$Bw& z*Y{%j`+vowdN3`MkT<}?=l_AeRsA{g&QYBD(Dyl_|Iu7_;$@h2>RK)5j0}!*XCwk( zMB@=oxqlK*%zuQkf^sH~oI;P{Vjei}PiTt93HKbq)Q3;OwryhZ2tp)x>Ihd}epg8d zK`2l}QLuDhK=EaqeUoH*w;OGmu19kZ_#dp^CZBa7+brTT``*N>x?yl=@532UcL;BO z`5G^M`cHIIXTtEwXkIWa1Jg24WrZ7_yNauyy$n@RnR@s%f_{zlyVh~^y@ye9c?nOx z{TSaLHi2V?9GP;4ceU)|FN^*Jz{vX1)K!%-cJOh`{_;&~OY1mlz_C2@?vwQVaS7Kx zb0tP%B`an`nR3Wv#tj+IE1$eb%@rkF_~_Y0^#~qW?pT2mSrz&Z$yW%_G!G>O6}r#s z+nAAQQKiRYl`Y}@o$76lTwP$kz20UMocZ0fOjJeX`V)V`pD%ojhVni<`OcsDV$%}t zKJy+<7sf4mHoJM+?CAw@(lonR1alX?I1?>I)r)4-(vB)kC0`Vm>y$z z-Ebbe=t(y0UPt}aHT-GrL)A2!+)U5}DsqjXoc*}v0e>#F-X#JS?I zZ5vHiICa!%7?#1`KYW_ES1+VEP{J_-#)08XU;+&6F^K0roX&!kbGhx*+c@Qr(|Ksl zZ|QY?52pUf7;dPDsB^}9Ij;Yk3TbL4sWQ;~Ef-uUblgb*Ck`%ubD{7e`z znXn#a{<63D)5VX`v$%%Qw+!OkM^5Lsp(k?jahEz5{U+*=l5IEm@Li_TqAG&k;8wp> z7*2mKWT~#uk1FCVIQwza?8ojn2rlQIa$vfXx^q4#RX``JPZ;Q+Y+{Al5t8?jzU_Hgk(w&@Q@KWLgYG7 zN#`kh`<|Q?G$QGUqzAMhK}XUNNv%S4a^fuIh;$J&!cGesVWnM~n{=L%4pb(Rbbd&w zfDbuABcw#o2)P?UBSiOUhJ@3X;FFasS4aq?9%Vj?g4$L|>YobPxw&b5c}x#iwMAMx z8na7>-t|FN=SR}W{Qi)WxMT92gyUiEc4Y=TytDcp;-=0mlWynbt6oO} z4n&#}2&RlYg~=mMX6Dj2c7@^3t`hW7;OKe)~oI3h+=HK={!|O*;SJsOy zdp5KCz)mhW_7djYx`-adJ$dbumuQW)aM}2)n0?DaN`fWqX>CGPR90_a#p1Oq*wVBK zfDcx`!|E+t*s*^*0E23V@xA^>W7!t>oO3__bNwp-46YqU&=&&W?G+1HyJ-twZCe3A zS*U_|+#swweRVk2PHQ9;YoJ5ii9OquCDn1ClDQ%kiM7}2R>U7m8rx}dOP6c64k?o` zoYP=(4)H>Vft`j^k|eyEmw7AR;+y?jIA!DyIQy`3&<&kMtLEa79@(a>0i}{##(3P^T|u6^M~^v z2ViJzBdV-*)F;Kbj_r{jtbUiTHf&&3g7+bB0fTD?QBzvWlJ$%EVAW#2+_;3*+gIYz zyqSFX52pXGy*H1Og{12}v9R2}uanLP!XKk&SGFkZoWw ztOdeC(hq|%-nG{s4ll;P&yQvC!ma=r%q<%bM(9A21+wmAq|wauO!rLRRb6*g9udDk z@~F(L%&O{{o}*{#`}xdtRYv5?sCfAz;>COMp22`rB7^?)P&O^aJUiREu8x=00(3)f zxCn*u*3H)--txoet!I7CIT#17d)4oPQi@zTi$o-jmEtlk-2OW396cSHra}}XJU#m) z?%VYsb{%>i0Fa9HfD!|R${POe_x=Ho|JTQH^?BC<0D5D6&gOwE$hhzM`;aYX@w(}Y z@z(RMMJk%cU61_$zj*o=DAtPj!^=K^yFT8KQ2-FAfM4(aH5T&=c*m=M2S2_2m)JTm zg~i-51ZrD-0^akZ1P%sCR4~vxsz#$Jk0MpmDqCtsMX9N^mU8PNc2wjx_@DW~;07q6 zxZ$Ed#QQG&Af7+;EdHN=z7;Vgj@O@l85n2y)U|(wZ+-B)pj5!=BWK{j7w$t{tKqVp zZ^T8XT?$E*@a;#wg=~2h0H8As7f!zxiAWOTeUtdft@q#$F1`@}kccGk_`XLmk{QFr zXIutKC|)@9JWd}w3$H)(G8C%?JihNyD}aL?DA?6z|9gHEVHiL0|1Ku`z_ zZf-(-_5Ls855DkTJiPlsy!quthxDXfAUZG z>+3%cz?=gFxPKdh-|?de#({y%2olkrxvglp;{pKZWKt4Tz^J1m<-oVp^Rs1LffG6o z8e!E9Q;a+f@YM@?AK|SV7&L-6*E9R4O&@JQ;D~jBGmuCRn4HY(x^&o~&w&uvzNbrX z8OWE`hSo|<1EoNa?^vh#p2FPrfW`=DgEP_yNa3ky@z%2y8}hsm_dmbe9$@CZ3L0pM z+3*&wdrqxjH$l=^wRPmWw~jX3FqoMut6}}~Dp%m7KP{j)K|Pvwt)AbWD=o+CY7G?h z@LdV4exuamIGmsTCXHr#D@$xNaZ5LdHk6m>;&fc;U zkL~*n0N{z4$ME2;2f?935+r=*;cw#SPyQ5FzT#@!`nFHvyC3~AF8stfxaboX;+j`p zjoYvN6u$G(AK>41kO0~&^v1}iv+B1e!(57aZs9-ksr*s)q#cFvF!KQsNj_475L z&bo2}xdu{2j9|~wOSt>#pW@xGyAkJ1yaErra4%k5coC8yfe?baR!2>*ArVPJ5+pza z`VxHrfce}UGI8^BGLi&TGuVXvoSIsN!F1Hr8t!`Rhgd1B0EA=D!alry=j%g$BX{}` z0vd`wW2n`u=FV~?3C;mZC}K+7WsN%e;M`QCdJ=uv^ZF;8o$V*q*3yMaeq^nb1+m7H z=J4v{wcyrxz$m>R;@KX50a zQWRhK$>;IrbFRQh&!`pI%Y0BoieUHLEPnjx_i+71@4;}-2o9{w;GSph#{T66yy-I+ z;Y~05E!=kPr|_MR{t&m`aT9byM^uX9u|1FCKmFy!xZ>Qm;Fh<20{{5IZ($*O2=_dF zKN69ax#%|>oSSDYdK3Mn{`j!RZL?AVLe*6$qKtc=xewKP4cETvo%rK7{AcW5cmWUXx*s38 z>NZ?`{a<)wfmQ6fCwN_5#@Rb z0u_;tq`_-|7zHAtVr{Azkf;cOQgfbU+_5G}f`pa)8ov3fuj7mF{h#>o6*r?V(T}_S zus`FP=RklZP{#E z&>F3s+g?DO@Wymd&!Z5vs}oYMWjA*kG=j7#chfiq3R5T;h|&WhCRRsZ_0$~j&cmh@ zXpt(Z^}%Y5^ykW4Z#w1fv9{P2rvSG-+jY;cT@tvgPk_e_&Z9(G3QNQCM7+e^ZQ`!* z-`qQ}*luuc5>B{sml9>`M@_DKP62Vb?h()Py!Fs<+iT;x=XN!;>DcY`x7k)+bb~;* z?y;>;0TL_5MVgGDCK8{|wvLHHITx#`Rd4Hpb_$$p)(2M|VqKO6bN4@?Byh*CzJ(t> z{(bz`*>A=N-}FHz?+7IVZhF&)aPIiIc>KU)$d*?ji84egfDnSm5Bvu{{ew?nEVBil zzy9x$iX@>K1{mkyjNt7TT!(?wAijF4T|K6w{(Lq|HA#;!xpVky6frTii;*?Bpx zI{$5W>cDe2n4JX&@V?9c1aExV<#>AkGdPr+gCr`TRDeiDD3Tc|&{muz(Tpx+D?zKp z75wz^yC91)I5?i#|17{c_Ac&1sb)sllttO(lVH*i1qtAA%CC9#J8{LUE``Aia2I22 zpY5m;Uq~Xd=HeDLm^QIiTCo;nzC~6i6SiAyc;{{+-tQc;AX|OG@sp?Sf-FktOZ4F< zPu+#8T0u;XBN<8HVD=z>^2A-}iS^*m-f}zs_^KQ5p*MX5%f)5<^4WXv*uLLDXF9Hb z?Yr^5x7~o--}*@afFdc_ySNYcKKF0vP4uEtui)wZ&m$^DvFqS7&U+^i!3kI*QW1i6 z=1#HtUafCFvB{L4dREW$`)a*-21@t8bFqYYZY&na4OS_SbrT_o}r4WcETb5k>pZmWG z0^scNm*bbu{u>S~FW`M|yb+h5{U$tl;8`5Z%|R9v2tby;dxoIM@ws#=T5uH!s!^ZJl~(}9y>D8ee7V0g*Ewvt^%rpO9=0MX zh{`cgQ2fo0{{}D4zkrWjc^fX8z69U<&3BvtGfy9Q7K}6OUztHZui{@G{}D3rUYt95 z9v*!0KI~s!ge;nKMqEkYp!JG|$O@4~0v@kyLHdKNh6h)PiqVs3Iqr6^=k0R@FX z1t_8dMI^ZIxnCex&f=moECKYsiNxc+tT#(4h(F4%ej-uSXB z0M0SHx*xZG>!Y~ztjqEF-~S>Q=a^aAi`(wJ89#sO9uN@x<#m6HJOA{1;GE-@Z~Q4V zUBjPUeLDyt$dz;WqyP7M^e6lA>EHQp0Dx>Mi}(KhbvUrH9|u=waVR?rN=(Hz$(Q#M3JH|ISh%) zGwve2mhZ2r)!|%m1%iDZB#;NzmjFH;Id2<(2+RZavMAvE$qR5WH;3;$awm4p?Smi! z<$4akc;;?w8`^<0Ms{NN;)|GFJpckT1;Si*7TMwocF(_nzxw_s@!{XP8Grq|pT+YB zpT%5u7NuGl5|uEQokgyc1r>nD_C1P!-~A9SI^z<2|JUD!S_dLx3?IMd&p`-5wzP`( ze(85Gv%C*;*;yP|nE@dbAGzul5JFL`6>#&{K8SyR;St0XA%qD>51a#iJ;R7c6SLDK z>EtU};XKN8eOtD;j6m;*V-^w5qe@hxbc$r;oTSAh_&(>Zus)MK&crtVArANkc_18-ADcjOgDp8%w=b>Tv)>X z9(ewj*giCk2cN$W&(1!DNB8_1TL-4_ z;Pdxd$>d4!?>k1|;1ERteaS({f->VNW9nc{t&ZeNtBrG9-kZH2+R5#@ELvW=ZoX=U zf$5=XjP{J-@tH^QlPB-O-lap}9QgJl-^9hIUxHU}zYx0@UNqKZ5^kVOH1|I;r* zq!K=G`G@eO8@`N}7GA{NPyQ=rR`x*=WH82{>pJ!>y@W&AIn=Zo_OH%hE_(oqDC5QX zz4+J1euPWUdL!<6`e)cPzZU`sKKzyU;q&kP2i*4dPeY&rUO4zX?!5o&!B)Iu1T$Y_ z20ih<9Hm}Gs;(`iA_Uu5b;Z1JqFJAs8n7Pg6Y&!KKZ~oAV^?J9|)zpkCYr~ z%3uxP{sRxb=U*N#eD!a?v$P5d=2|^B_k`*9NP=DW&`_f6#seYwlh9BmJj8uy6~T@Y zI4elI*jAtd9@l*4$tm!*nfqzDH1Ce`JpnDktT#v90{T8 zJa^&Fraps1kG17pWNx!8GMF zXoiM}6hTCcfN>6k>89HnH!T1JX7Gtpt%R5og+wJV&QRCt&d!x2NS0-WgAi)^Su?Ya zts^tWAPEv=(Hy+Fz1zlgl&V$4BT;8Z&0so8wJKy$gsSOC$KtU0S5vEysAyV*0C3Jw zs8kS>B}kU#f^&vKwTg%=SU%qzx}ia!rp3cx1`K9E6dHX|S5#ItlTU8l zyRh4Iq4MyS2k_eb-ZDB{$UUtVVj>kmDTStMFgSxuC2(-4S{5~m3jqHIcgcOHPkc}BBh8bF@QG$8%UxIfe7Y#BC9$TihBr)}bBA4a-+`xp``#Dt{>~TvtRz zL<*78W4`vTsXE^IrWj7&Ki&Rn-tz6lV-pwHi1#omlNLwXW5`Idf#&4v&Al!I%L_Qt7j3E_G03cx8fUfJ#T&Wo<2uw?|J^xEo0t1JkYhav1 zpcIlIneziPAP|bGszDYgB61XfNylJDvnB5sqOR&VedmSMtMarL1|j$vsiG z+YPhpxgG-mb=^!k+Re@Y03ZNKL_t)JN+|^;6cUwC*XpQS2d6nV6F3q8s@6EG8I>Yn zjG>}cKnO9F2}4KOGJ*=WGXgVtr4UrBAX#tEA>WuHA6$)S}>TCecg2RpaLXO1mny( zzzbq7=ym%ZLQQ4EM?(@sD;Z_uIezq~N05p4A9P7sIJ~^ICs+R@ z+-euwQkqjswRMfm|@Lf{(i;`RCLwqdl8B#!Qc$lnt4`&5aJ}rr7#!W zmAc6pph>#o=Iz_7n<7TCV$RqADM&P+?0wdkQRm1tE{t>m}Nku_81RfmU!S~6wbSE-jF zPyw8CR15=AQO4K*4@riHVf^xNrgd&+T&T39`B9d1|ZGPKOB-54nSSwLx zelVavIgH*|pEsvpRh`I|vhixY0zz8LZL?C04VBx#1-XTqS~WLusQ>~3k(zQ@tydsY z0kR;OW1ThLn&US>Kv7f8aaf=fW=tl-^A1EM37W1tQQ|0}mJ29HU9C075+az%xb1cv zFF#EeILtGv{i$Is<&)d8R-4R~%#;m{&i2Ze{kbJ?Llvf`4_2SIs%w^;^N=Y!A{AZl z1Zl_*%nb^AZsOcjs71=nF`2_Ug&?3>uK?f>sR$14(4d5(qE$dGUQ-b0x(?0eKQU!J zBH8nvHI|3Wea8~^*|)yb;MxVLanBJ6g9+OsyiCDr;Ka8vvymaoJ%qc~r;P&#L zfk4DPM@lVdbwG5EsinNmoYQsyT3epD8Th~nN5awU24~l`Mo16g0EAhd8djW!k{6cm z2|#nGau1HKww)=jk6|}>nxP`jzh2)HK1)eZhg=C;d zK_nv10b3mnAy+62ma4_k)xxs1*ly;}dfh|>2#v0>>WV~wW>86?3sh;pMIKY&VbnGJG7s7(+Z7LsUv?k|=pxgmg`t z%9WPm)mj-8$5(D!(H4m4v6K)Hmn_1|3*S84co$6iZke{}i5C4vo6W!eu}}!$_wfW{ zKyPXQiCE8)6iF?+%j&i2_LbryIAb8R`90jQfFS5VZkw#j#O!l74SRm1BAhXS`eZv` zOonG3H>pc5K2djFz_aP%#_?91+~Ayp3P68q2oWVQO9-iX$|3KNPy{!s;GjoIc{(~) zr_Pn9lSy&%f^Y^z`%%_}vPy;d_II>Kz^F7MGe)*AODVKH08oow@Ci zmI_oSZg3pLqd+yaE6Dm}FYRp_Ry@YQHWOEygPQ7AohQHJKH$Y#aNp`{V)~-B!qVB_5{-;0oPj6 zJwd^^m9He)QxXBs&NijORJop4O4WjMP~XPkpP}GQb=JKQ3#ikUx9fOc{2RSNZEgp1 zVL)*Ivk&5Dk3VQ$BS10=B&_I>M;nX-13e>%O0k24MsltqLD#j@mJ9QydyV6&X0`oj zF2;@qZ#$vuEZ!-=IKKJ7x1s7lLPn%4EYJh{r20^HDfPtStg*_h3!a#MmRK@2*9g6`4JE_ zB20O5D|~Kr8Z^SB6JmYx_qQ*=2jd_D#Yjd$LX!8pZ&hpRu*%d_v6=^^)aOpH9>vM^ z6ZIw=%-vuNNXF6_Opg@gNWyE8(%5)eFG1BbBxGL@krPcRZu$HWy6%a; z>DrO=mIH_>B4SGWW*rSM4h&{Sk%{%q?~KKq1zA3iq@f#QS<6LeLpD6DkH<}JTeLZd zx5-F=wQ>`IF(4JsU?4r3Pm11rC5EAom$V{OO@}PYt>w0*QhI{OZ3~(w<(O>CZ9H>m zI+=8$sJ^sNN~x+gwpLyRI+5Frl*E32IU$%3SrHmn z0mv-~9ijCpu>U%>K9S}s?do>IuT85wxxg7{Y!HSJnJ>xX0ihSyhbBd;RL9h6$w-u{ z+-O*LV4K|=Rv1qXBR7JSk&vJfoClY=EjgSwGJZAbKDH!>9@cWbN!>{p=dHaEHLx$|#%?r&kia?`Nf5_v$B3c?}E48y%L6j_*YmzL}K9l6pHm|=i& z0%tYVY7p&oFb}*pVBmE#02DyXQ|}--h&4Ti&)A6GE*{ zt=_dTnrOk>lZ3C}9HJm%AU%qN9G`I)%|85aMvT;k&CuroVeJ95Tp@Y-X#EzY)^+US z&g*W7tKnt?=OBp@Fe!fUth3Gv$k@3)G$~SshN;z(9xK!g10pD>OJWSyV%||mi0K>C z)X8BH_kbqXy)Y#rENDddxu*s(d!h+*HSE;-)cUMexZ-2@pX=@qI~@FalqdTJV)sX5 z3xS|vk<&T)QgI}s(yAhf3+}rOu5Vk)FMt`kYQ*Nw|rYufoYPs9PWe=8F-EonZ^@ zpoN%S(DwQ5X@&;HIEi@6I739H=!s+yl@wowb+R>AT1plwYvy77BRPQX$2#RU(1P7c zZv8Y}Z6?0&o)0GxZviXNM0x~@sLZ;Rk?&`R6wOL)S4cI&BFV6B;yv+7tXP23ns^O5SqxCi@VN zB(o7I;aNu^#z(19A7s@fz;mv~l}igT= zT;8-J79_+S(j)=bPR>PG173XROb^-J^hwLZ13ZCPHk7i9jM1HN=JQ8ymm zvizvHWIESQZoUF$FoIM(g;bgY;-p)=mP6_ut3g*?1PdDoTt$iNswI+;N#(pQt2=yA0cC269fmLes~ zjlS)M$9j0X-nllAMjM*0I;SFU4F(Kk#*ma!^Aw<Duw&Q-k;O>Iwj%wX(s1&aG1c zbzAmvfSut;m8X+Yaq@w121I&LW)W~hoY@GP%@!%0PUOl=L{(>q_(N>3)A|%1G{S3z z;b@WXDM*2GtV%A$gLe=#A_zX~Q>SgVpKG^0jHZ`H3nk3sy4QH9N2juWCvjN=&3_He zkTHz)$B>Cjhe#yq9HLw0JgG8u%Sv$(%;11v(e{|`y%TRs1|hDjTZl<=$Lrr4dA=O+U5W>2&k9={<4Lu$7&l zi8_$i!IN;Ha(s&LmT@2v>%nl(XjvkB#$BeX^{FZ=(@L#^n3ZECRBpp~>naPCTOa?u z{5TA`_0u{<<<<_}J<>AM%5f;KgWng@#7E!rPhuDh80p=DbUZVkPAi@$ zs-R>`Dhh$uatKX@d9BV{?!Gvg|v#d=|4CBNX~2M_N{c&|6UuTyUQ<%c7; zO*BqDxdrEtBpHM0QKX{19=WY)m2KJbGBjNSx^lbez!;E7ayom5~;1dqA_m z188!CvqOFdDNlixC%ce1wL;wA5bm}Y(DuWPxaSG55$d)VPQ$#HyUv$2EK5y&V&#`= zD3vrk5wK041G0$zq==X(d0Y()1CwjTT&h@Ev#b^kKCEjI7Ep(HzIQNDx1rh5M16{Z zF^1mM0OC@r8k6Flya&|4ww1ynbVKv_yXz8HBK2(l22k~^%!?(XudeYe^SQd_WVAFh@itp=7&k3Kb~HR2 zW~yrfN{JK9z+eOhBc}Dou4nzDj5MErA~3BplmLW)b2DdD)AOukkc1NFvj?uW``hep zuia+9;>S6l8w9#_kDW8BRiwcn8lJY>u8~$6QR`ThnGKJd)+cHZ^E)G^^@+Auq5yyc zk(h+OC^aOXs{!F;vZ5B^`Eu6G&%#|Qs_Xuy9ps<^*uR6teFf`Xj9Irj?eRS0RG+X- z7z`Nh-GZc&T9g?)i60qfJC=(J&~+`CuRwd=`pXf(+jfhwu=fSN3ENNe6y_}l2PME* z-y~!r%@9JI1lsv}J)`OBmigSA$BKN|a_fS3F&4mwAii`gw=KqkQw#F$Vi27{RkvQ#Xy*dxZ> zQG_G|#?*3g9)vBmCGHz3G~2X2lGBfaBLi-f^VkeG8*exX)TBI@hO`3-e$GK)Q0fxxmdW&f(s1M3mS*xO%5l zs|;$aHn^Oh2c<&iavM;7Oal3Y(K$uI7!Zpj(U%&ki;^_sF5A2JKN5;SCP`%xW~a5X z1|3D~Qz!iDDo)Md04EeAJ_JsLy`TBaXEx-`_b5^ooo-tx=t527jWG1BBiJ>RD65eG znnQov-cTqwI*#5% z?{X?d95<5vYqha_DVxccSK&C~`uNr^Ac%*zVL!2!aFSA!scJL293U?>woQkGVeTyoq<)__!9El(_D=ggM52UA}Y zz0Gxf301%X8WDC#Ic!qz4(2VvIfpC)1IZD@q{KnEdQ1Q&*UHP8TyYhG?f$jV0YMrK z322;aqUHg0TP@nV0OJNyu^uGk9zzk7gYGg8WBXEZ9$Huskw!%ijyNZfkC)v8=!XZ! z85Efy6CXgtx7aT0#UHJoQo zgn%Gn?@Je65MZEZ1PLXz%DC4Zmy*~Hs^(*;uK}>b+6ONSLy5!7mX-}^TgRr;Rh~Kn z1LR&*SQMNH2in)~3?4;_aAA5rTLJ#j~Y3JV%x{s~c@ zxU~nzThMSGM;ecHfmuNuSO?apRym{G&tF&2hz+njg@F)E4kRH;(o5;|MA^Pv&!e}l zYZC`oXRXOIV8XUZtYtqI>EY&NCY;gqw z5jK{$UDvLo4#NP3Gh>KK@thQmdKP2^m|iR_qOR2;2~tZ1rYpB69vEXtMw7_I`WYvJ zCuIR8!emJ;$8ue{-IOpGFx0yRF*&hJJ@=`5@vZsP5Y>P{Eiu#%vXrd!aQP=8pqJS_1NQ|JQ(L9evn*xa( zE?kP#w<+hZoLtP;85p=_#UZY9Pd??vZkf}<0M7a?PjCfoXsTygY}#3$oacwQ?uEJB zF}Hi7W627pVgB`&H7QR{yPK^~<|%!*^@$t}>yx*A=AX&I1Y(MC0Dxu}F-_}L_1f^# z+M!Svp$$1h;oik=y4D@k4;PG^KHCF{A%k-6*+t<@AFrb#@`($B0mD6`=!x~LDqguIj2n}tMT$ca0+vNM4BmE? z<6{Q`j1Np9Dn@3f3GoCY;NX){S_9V#fZ)pO7e)xpY-v@uYkfM}FhJr%fRtLHlrFTd z-x(Z5s=_ZH$(3{c%SF{NL!Y}WM~?pCyF1kS6p%BjX~)G@o`_E|vC(13av<1p#KWGu zPU{mheA3Wq&)}I}T5+|&Esl*40)%@UU zVX3MAkBRlE%hw|Y<3KW+#zva{U zV++D`ki;0clv#TCp@-(LyY9LTq3bA8rIN8VTT;`@Mb!WyrqW{gIOqgP@N?ENOL<-Y z09Vc=8@5+lkk(?uZG9rV$@LDg!Yw%2x;y8(xH=exxLb<%WCcQ8L1-~jql!$?L` zIY|zxQJKB&y6af`n>vG| zND;=ilT3gO|E;s`|Qu_a@(_S za4b)*cJKgKM(S3aj;#^}0E}Ze6GL1;S>UqAWJwIRZMC=vRZ}5Q+E6&%2%5N$an7a$HqXotpqOyRY)CdT?R%D_Y zW93?*XEnbFk&w=K%i&#&b$NRnVRq`|;5I0dydP+swU}G2^r)&jKA&Bu+;(|;LVz)b zs3Kw@IRe7Tes>ws`Id6EkjfR7t>8brSw`J|o$J9$l%p8)fVy4YZa55sW3XogQ6XB9 z2=yesuh;Xv5za<=c^+tNU3RTcn+6OJ<4~o3P$KSaU%zuS6e&(8RYQ`BYxN35+E5gl z`08?PbK2J~-&0uN2p7U!_riikv{jxupwaYPV*MB7w#U(&|B4))pb>`ygJDa50{zLz zs!ZWIv`#^$m-2^DQyG#GvGc*)uQ++`=?><{0^I80?ZeZE$+4MC21UEfsMRw}*C*$e z_jz}sTPaTP*6F(c96vD5kyH{GO^-t+-XJ2BlLP5-LnEK^ImED-Z>t^SRbl zr|WKe{GeNDM*8Ces}MxbI!X}aKAF$~R+Wl&b;U0E8gzAi(+*7Bm7lOzV?PCd_ga_S|&@jRa@*zYv4hp!lY={uh$K9_p9bUG)@rMAv6}D7?IwgRw*#pW2%LKs zWaWB!+d}>zbe%yKEcY+B+`3)h0Z)0T+ijP(#|#Do2788)NeyK6GM`1#wd9qA?TS_q zpcc&&D}g-eTAxl>a0ZAm)TIFsfxfVjq-{k?Qgux3UoHUD&0SYQSsR8CpgaK}fhX_K zY)r`uc?tptKq$w{8WxE4RlDj064YA@s!i@-mIMtrn7MsFQOm2P}EC7u5ku z@p>$aUEUrOaLz#~Fw!%QxRP2N?j;p>xk$wwLUkF0soNnCXT`0sHMZn)#lHWeEy0UKz~HUFBGgTD*m!5%>Hw?1zT9 z?%83>%?rmi;@**fb3hR>-W!9+sV7@Am9eE*vX#`cS>f%viJZ7#9N0QEji?xzWdh0D z*YkO#bXDJRU}>*q5C?)5SY6(pxG)T0sAm*$DPH25*VS6&!t`SPAS(4rS8g{UI0vQ% zrxBsbfi!K%ZLx@yp{rB-7k4)Y5b^WYKi4*0>*830afXOYG1fByfs;M{at>))tjz;P z6(Ax4*O5&(ZG!dVDFY6YngS7&nP_@&Z6hg*08rz#jHY37W~HKmlZNG{$%W3=Ejn@A zJIs7f+(Dy4J<d~cY$RO~03<4n7i!hmTCrXO7=b4!AaMna2zog>blq!bee&$O9%;}B zr>!B@C*#Bo8gV$_9C2C1_Q4bgB_5w`o$<-l@*--gj))|7qdRRfXoi`uWH>!qpa$Fv zvS_7V8eUwR2WLKy+%9i71sDT%jP67_nwll9#E)Fi#tW5PI#*mVQ9L(iD2Z7Bx>F`#yr|~mYvrsN(=BYS z^?mH(!~kPJOpal4URjqM|AbvOD(y(e(P%uDPdCtpbLjdk?g7bPuwg zz~CIv>cBv12uUTqoJ?Z1QO3t|<<XlHjp4%2eF3 zkUxlpwS%bE0A19AdD`Xk2?@>tO*8X@#iiH*T-KPh>qS1XT3YGbv(S~>%?QQ-5MVGl zf|x9L@(c-_OwX^)VsY&tDm6e8eZ1|?wI?*{8Za@CKw8PDQHdXLuMJb2Ptba58x~;HS{tWq-}9IiA#3A4zg$`k>lL~U=x6I27`0Fa@)nw41EtEIc4R1eOxz;fyv%&xb!Rn z$>uG$XY4LcWEjjqI^KgmWdN$K%|y^}6{**aX-SrF!PIM^8yYC-@^&+Ub5n0Rck(r; z>)K0j@m6QX7S37kw!UeIXDg6|E^jvz3`0jI*^9K)2hCvnqY#|3nyQ{Ai4tBpbrB3h z2c-hKbM5AVsvCIKX%~V(SX60kHIArLCe+mlN|3I_rhs7uoJcJwb#bDBa2<&DqsWqs z5@QA~x!nke0FW(fr(L>p9IxBn7uiti8-oqYK75quoe+pbV{|o_pFOme6cV&IkH{;o9q4; zBZQ*M+sy_7NfK$HTqx&C`F*KWuTxT}6i>VGv^U^_@rzE%HO9#gf=Dz%vui7}i~Gyj z%oz{#(h_AHx~#bS%g+8lu=)q0fsh|`u`8_GD;Mn?nO=j0000< KMNUMnLSTaMT%>XU literal 218369 zcmY(qcR1Vc|2 zSI7*hDS<1;mDjd_Co;dMdOBAshj=!DH`iRW4YjXase#d6I8p%bX}tBV{jOYLXa4sf zbAgWn|AJKb=)Si3Tl<|Him;p56Xd4xp2y=-)A!93`r*_90$uvlGIEX0&5wP8g7AwB zWIDGRLrb|IJhwG?ymo;Kc3#h!2~y;y_SoBl;vu=JS*bG_!Ej{)*jPkvjDG<_KoMYk z63~;2v%`hUQ*sEA7!-x&?Dit9gZMCwTW=%qWkb%_ki<)>3nNL=`8HN_{#-^QC1q~0 zeV<=*o=`(Xp`e!scuh#u0+d7#A?!|B_EZ6X&5W_S%pvn9omHXWYGD`Ns}bZ>myb7a z-h_iqGq?*1oAvF+4J)DSxi{`%s{?nYl7ipT1%QLJU$o5hYW`bEd>1GGL3_e|5 z600DhHq{XU&bJXO=U$hW8$Eybu21Z14m!Nxk9+i3B63D{MXzwUTg~r z8hS|>gXiMZz~?{5&?%Xj=R+y)@Rp>@IVltwioMNmap58h>H+CgminU(C+=f{WOR;^ zy}RYxL7D0o6pNDupvC4;|s=VF1IEGb%Hy=2s>nG3&9wv8KY_peOU)WRzf>Rnl1!4CW&76 zl5D)O2aNkW$|1zncg<6+P0wsLj1)UbQmxJF@m1jc(3nFrA| z3?F`Q96mgB99}uhj}-Xru#xn~vvKGBn~OkhTO@%s%x{lY34feH6CWS{qp#mHOTi2C47P zKOO+rtL#dKV1>72f_ndbnA0ppm%wP1;D2u zE;!@G%azuw-e`XD36dk|VCCW|j%8yIZbzuYwcd^06I<7?$q8g{ITZVw?vhPVx-=rD z)h(>ImJnYzEl|1t@VDR7XvY-KE}YdySiS3Qui1kwMH5uQAcPctW00!7;eTFeNk~BD ztV=^xJ602N)emXE{4w+!;ni-?8i}-vE(lN*s(x#nPH+!UQQyb`W(UJddI!m=C*Z~* z?wB;3DoP!UyibZDxMB8$ePJypDFi!B67@Fe#`Mu{;D9=)b1FSl65{s?z1dVuvT;Ru z(oRVZgzWaDqCC}G8ElYqWG&r631~`t!q|4}1e6M2bJDz`kss2=1oSlV2!wTeSa7T$ zB%N)!L@4L`aFicp|CKK&2!onN3k{K#5i43}iI#4fI>Bf=yfyBO#}73{yHsn#-}zm1 zYH2Hoosm~5NNb(1pzrADWbJI9V0gMR#QF9F!*jYh7ysKl=5^$z!Yk=qu1mXQ-@}lLQnB>{In(%dG7O}c9aCc{y6~Y;#?x2LVl{oP(MaPX`zrN2 zRUu-s(IX`FCi-UkOXv77**;1{e|p`suyiS4g5z5Y5?>9gUq8;Eu0w^d4vYnFB|uic6$H;mj5{`&Qn|972bVd}@f z=$5)vjG}M(s{6#4a>ffP*hYwPeN{B5)JaIRQq8K=$&NjhE7_t%;5UcCt=ByYC@_%! zrtxPF@>g8G@>wR~rXRb$aZPZoxE*$JYBiev?5TrO((ow@o7Be}w>iK9zqx%&uAblj zXh|0BowN@MAiJ=%5BH7ZuUWo&DyR{M|9hD5LqEegdo+%Hx#@`K^K)N@_YxYkb>7IS zoHK?b@WGYg1OBOE$eXj;CUSO$RRiKnQZc({cI+r z()fl(UemK%zj2a_SwmpE0NF$wHoxoE8^k_EEm9oS?=wU83gp zRYN+&b%adjtgDFYrFBpYUjiE(Nv)32!ngY0sz<#?5R-lrf9?f^n8I=x4&SoaOmF8rEdkRt+*yr1I5A z>_ISI9<}My+NQ3qF47aCT=0C%T(Q9M;Y*H#gST;n#yedgcM&x9ax8E}VYI&ABWSI4 z6FCoFM|v;Vk=D|m+sWjNBCyOk+kyUjkE!}kGD_yE^a3n#|JR!abkG(6O5ZP={YhMB zdtF5LXLt)zAJM7;wc5G`y%}Qsk-%iRrM>p&*zu_Dk@wD_uJ^$@r_$-crEYv_{9n}i z^vjjS)K!(<)+aG$ApV#KQ(ts)U~}4Zl{UFhb9^D8;zV_vSl}QOUax#& zR0{*74E9G+d@u&moyX2GI8RU&E9Zte`MWK>JZV5 zUlrjs4#^@|M3Yt_w-NjyO$t8=jf^{I{_M8rmvpb-pXY3h-Xu7$f0%23-0W8jsV9}w zDjK!d8`tZEhJlZI6BE%wn6%5Wlm6Wx3&Prg_iif&3P9<4V_Bs){3ot3eke#4fp4Pm zNLy;A$BF|AMiJs~}Rw+@6be(bwojjNf2jDaK3jCy!? zI}eIKnrltit|`6CX{Zk>E;>4zbaSf~?RPpx{&;9XC8h~`h0djk3MC)iY}_Q8gJY4z z?7a*tM)+!~*MYX}GdFA-3PM3D-uoIJc$x`-VWJo_caU7E1%4R?;A$Y74eUY7msDel{3~JhrN^&vf*3`Zk|geu+4e=y%IuR!Int; zCC9J-++@@9`TU}L!auGEWc_;66tTFX$6;tC)A~iE!aLmdmf%gjm*iinUmNMS7 zKD(J{NhyEIRB(p)d$kkVP4VA5lav*f2*Z0R4cZB2srHIhlmn(Ot9oNN zZA#Qj6=Yq4^0XPMEJrL2%!YIF56dGlz3sl|<;LK-2q zPIe~0CMH^2d8vl*4D73pA=)g5KW72ee}9h($hF_ta(N!?>l|T-WntWFt!GupF^rC2 zk3D=uL8%?kyjnkc;+K88*H82(cqNr@#SclSs#x;M@IohWEL$2%9T=!GDWG?lX(Cim z7ag<@LR6ijFv*h2ewq=GgT;Puc6bS{7t~G@x1a0NBy-=c5|vq@E13{2;lk{Qs@ttT zS?yQ%3rzeiIgT0+@!TfOdxs2md88>;A3Dv>Y?_b^R7--tr;g3;je$(_F8|jKFhYd>LGP3=WFcYJhyt% z4>rL7P?OVST!LdsT6vlD{ofF<=9CXD;cSQv$cM21o331BKhZKPbmy`hSAIDMto9&p zP$_Y>weX~XpoSlhc%Ej{QQ=qXfDIl{XP<2U(Md}wDw1h9nR-W@)=Q~&{S;Sj<8U}r z_Yjv)`=6_gZBx~`SI`14Y3<;PQy#ada($qsKcsZScA~(KR8>Mm6OkPxIv>yhfX0@@ zhABu60fE-VWi`3nT+a=t#;$l&pG^P72q~mDiOTrwlhm5ND6zI;uI?W{J3Sr?-akET z)o1*cmIv!&KSi?>Z=TEMhRL*bxptYRB%SIzR>zNAq$ED5Gkxunp18!>J0+xaLf}jS z^JnMJkrH|y=vwj$#i~G}c`R*Mp805nw3~tjpueTMOHrY;-@Kw{{p;jGnkj=*l?i(A zKy4Lqf1Q%eSxU(H8|jP78Lsec)x`#>Nf6X~G&A(_QdIUu`P?XLwhc%AQ)@ zy1YV-F-p-cvM;nXnu%Kqyx{)Gpu_}@d9{;a?v87}6ZC~Qhjxs?DEt|=Strpw?5iC? zjIy%)G$xKCV%v$%hVJ6(1Fl>2n)OEY+@Q|k0D5FXvPfjn)aT*C;R}|Fuk1fhuaSrA zJmxiMb9E-u{SZ4T72ydMIYD7d=0qDzoB0)X2)P;?)0?I+35nfa(1TbpE^%c~!~IsC z#~PJ4E8Z+!?}guD|Hi(muO1<6oBtRsjb{3{w1$pHOUc!@1K92=$*tf^n|tYQ%+}5|CU(*e zJ;{CRzZu^oz1JqU5&RYIvlcr9ZYGU_RVa%{NjO=OJdVXTY?b4Yf6{czy^*uNk>FiP z#Ier~9A(;IjCr`*I&FeiCtCf}3}1$Mq48S)O9}ZWiITiYhC$zqSHHO9n@B~3!3@Gg zG+`9l3C?!V$H(`lZE3F-B8Cs&f~>q9RPL%OGrq#{A`2EeAl5PG8O)TT7pQ@6kIdNl zGH5<94n{KR#p<^F`PwH|5A&!}nW=AD(AsI90OOF|V6|L?Q)N=3O0J4#c2oC=a#_%< zo&WaAv}Tsmf<{x~EVw2g7kch<1PBU{jv{5WEU=YBm0MLv+(lzRS5@%4bqg5;w_O-> z9dagvL0a8e@UE%`<9gAP77gFyyjuXK3{K0oPX3BA+mleg$6mz8!zh6Y@)-b_$4|{s zpbgVronTpfNiRwrPon`e!{0t*gJ*5yS0EJz@ni??g;AhIfNLBBlv}L8mZmVNd~Wji zd1x;>rJhhmT21f(GzrYoM@!^Y{6oDMZ5+U(S>V0TEMj)qQ^$|JM8e7QsNLA07xOJ zsm>iU{t(_hDq4mYIBlfMF1$KmzrTHt_E?tJ3cbp2JT#O}Ikiq^n?Z$=N{kYP_ldAe za{i!sXkwO-`SKGaL9}8-EO}7D?bjp9JJVT#Cq?r&*y#c~q*MIm7ZK(1?zw;6fZgS9@6AtuTpKxp`F>P@$zYM_5uHD*x(Jx{H;AaAiD1yvRH7DIj>T&J@SVw$bgpmH4FXCAC_xcxFQ{#T~Ft;wBa zmWba)+)TpOUQZu5C_Mk(CDyfcqQ8vMnnT|-As@F}-QL|c8399{mk^vB=3Ih?c@=}= z?7i$0-4x6QWlVeH1$t1BfU@Wwo1_;1h+B$QW~m?NKk9Y}&zK8~RUq1^Z$GmSzY?6f z)qj}Hip}R)Za{ajA6P>eex>=8)VL{Fq9W7sR+no{-Yi+iS%t8LRB4cRDuALO?nB^N z@JRBN^_Ip&TSZ{Y#R%~YXh@Uw;J7IVQ2{TY9onGqzqH9<)Auw~;NX5KGugMMi}#ZA z|780IDd?u1KAi$DJ>DVH=D+s@;PQ3L9Fa#QRdrQS1%xo{zDL6z?0&;u)pemK@mj*Y zx`MrZbmp(BU*sEbg6ygVc{*4Hd7nn5GF9H@sHE1YSzqd>vr@C2A!o}slBCXbFpDbv z+Z}Qvq?Ey2eU2k`hd*4~UG2%d`qosk%{zaV*;<>bHM{plXxZhBY~2)x{@jt_wYSFe zFInf(>q!?JCA~eVg!|7g=Xibm``-_likB_C765sH-o<-zA1N_jFk>!}*LQGp0R0v< z2XN&X-jHO0_b?RBBE4=xiLwvo}p3IzWV6RG@dyR*m zpzH}2c$&@DEo4XqX&zUc=*exHkAv}IE?wka|Btu?k|quU09C1p7d9kG0K_FIHT0#^ z#8zuYXvZ+PUtJeZA8AbxY5Ue91m&v>_I5F!Pj|rEpj)Q9FrCIj8giz6>JmBYe0umf zKRl^pw(4-~{g9u_@2R;d$FFmgSS!1Rf;qfpL^t^Uajr>ky#62X7}N#VY)yzEAZFpu z)-BzU{_qKiKXUXzzj}Z*E+eAJ<)l4c+H-E$0$dyd3mP&{95-+xde)ahfs`)w87sq}&W{NZVA2x73QfA1f|@fBP+ zIDxt@*&y91>y>V*1gpzkdW%OYT;+e^)TdoJJ#MPnHuEoA##t_vWEmE>{7;W}PRoPL zV!yC&k%UR+ZO~y-cRk-lNb!SGv(U=cE8u7FsCDrnEe>~xUG#f>X~C?QpQ`24Ze?4A z(umOre$+=~vXiv z;am*jxbowm_f%NYwWDn~MvlOtn?}xY<1XGX6V&P;Oqif~!(nMEvz;ET7TKJqtMuJh%6F65xn&`27dmVfzJ;|o2tLjE^`(xlw{i=Azn zt*lB>yH8~)X|2-YL~aBnw|RHFUaMJd zn3TEsLvrypc|0PV3^0bIw{&hZ`?N}$tAMC%Xn^>K^@iZzuMR;aCyoKHl z-jD~QdsB~o|G+=r<{iD|rOm$%ir|Gk{2|2@P=3waq)Wfi6^(WxcI6HROV4V155S)! z03$L8=CbspCIX$4?-Ck}gR;cA;8w2b`hdUQ~FdBYXRrRV#e(t|(q8d7rjU;ONCwIgMGahkF;)MIx}+kvS^Jq=%!P z6hL|C?dO^=r*m}ojM~w%Z%|sU51Xhk#pq7FHlk`0(hW`o0N1$035RCszVk&!?($9& z*W${iP6GpX2x)Lvw%#m4vuI9AT?IK7i8RKx4ycFVY0B};W8h9GJC0=lyo7usmT_6U z3kk>~RQfWO6RiMmY5=;_Dv!UdRX3LCIGo!mtsL)*`Urnlxjpv`u#|~xfqyw_b_-JO z;r-P{Q=R!Dogp3V;8s#BX@?`D_d`++fSJFJGZr$0ip-)XR3ny)$ux33{kKiM*C7ul zAvtre+ZTFa#RViDmrKF--amj+wlYC4lIk24EvzKnuNuYEwrq)F;!wXn8P->Wj$5{TfY z*y5mhl55FwFkypBLRE15NoritR_~{JeQs^{uu9eo{~FZ`AGh0WYc%^8r~4>Lj|~w& z6v&rVoHVRsN}3BX>OUG1AJR=LEY2VKWOhR*vD$*&S~nrnsa-!VI`g&uG*^oEeUJJd zvE_Nbf};Jgvvi+-Kg>@`KMr{Tl0l#n@^@=I;Nt#-^B>c&V)0cD{ncsx)$~UR54WCc z)NfghP5&t>Te_x`bi++{!nNe9&HeB^wHF>Gx#XH;^5znT6T&W>&LtU$X#nUr_wO4> zEPuB8ePH!A)AUXI>;Ke9a?w&s6uWFW;ka_irN7fNlq-s%(tF)foFP>k&!E32TN!(B z=hT!Qd-R4zb)9_=AD;-nrnm7(h_C0Yzv1>PUdmb4yOf1t`(@N(etE6%f76}sRDZV} z8tA)NjppOv?>XNOI3@G#^o}vj$tZT*WHe_E_(jcEIV*eG_}4+WhVt$hZO5Ct87Z{q z4eeHKFMc|VOLIMT`+ZMzO6_HQU(Bub7rJo|$7up@8dVoaI{elVOs1x@OdXn1pl&r` zSvHz{*Qy%2cz;=lqrMQe()w6c{>A!-*@ahbvM_8Cb*4 z{CpLo?U>VKiCxsRdkAiqGC*oET7ME!1A^+|X}&jblI2)RZ6d)W^Gj!R!x_9DP)JkF zUXu_UM1H+hwQj*5`F;>wMl2&ZVp*zBrov-OB^)*;Tcthm4jjLlrZy#IZEmt})y^)s z1Y=`6>raB8EYRP>bKpLp3(k!RUI!o^p%wr?S$yd%`28=xbtBz&6){j5zlFmgLpx0ZN~w`F*`J7xX1G_RS`tWbd!! zar&9yA>L}bCu)f1OK827AIu+w=|!6Dk}Lz@r`v8wRUEQ^b^)D#(wq`ng0t~s!~@PT z(%cNA=x0pD5tH%iNOC~ky&0A8j~@;|e$^!%Lx_$B$Qf@>j<&x1{q4=m{ZlSG$N#vU z{1@h3Ex6sU$y;w~`oC1bRv4;w%#X7SYOeG@GCUl!1$B~#m(>Au-kcnbSe&|Q&n(qqpZ+FsTA<88wt{`48Qr8};*i`T}r zBQ3LC25a(CvH60`zqZt(rAzuk$aH)jMSo{nbXtm=dD%kE8Jm! zu=;WuM!%=-k2$@r(a71DjNq6{WjlI4dGsqmb9+QyBhhJz^6x3<;z8ogX?O}O%Zj^% z$^D6#z|Q-ZlUm&}H&-|fobKiwC{#V^CTx&5-MIVfmgabo+v4>Zb9E}RF5lL>RdN=@ zG*hSJyQef(P64H^6+eo$I3I3yQ`_XmjD8r3occPJ@U*LA%w*KHBKIncqBu|K=^G6n zuJ;3~^f4b7gM0J4e>n~FY1Yo{=!%xp+uKFYNO`t=32>8k)olpvY&eO~ut8|Auy{;+ z@y@(lVUCf!&|w{Sc39LImvTIpa3QCJycU;3B!IRoPuW$$n|}XY@y?ufEgRkuqm=Gr zZMUGiS2-Nbm$oq}kPI&!Hh(eqtfN(mIRGmB>U1f+w?};^zb`zgj+ZAYHqA$kV>hv8 zX{Fl~Y9^5{QyD}P#VXK~%d@Dl@9@A-c+yJ8m|5~g8)EvZn_Y)@42zqQA3$x`Wo+%V zBo&;^o&O`-4ik!N4qtjda^nRD$B!YWHl43SORHB)6WR@!gDV;CXLp7Nu(dm%Ha$;} zzP(`^5U2i(J><>qH6iaG>fU~+W=vXrxzJA+mR+OTtYA8;x!v)7Ua;eE4{rF}AynwL zFW!b5_n1VFmulW?RqlDlXl`ttb_uLEG<3V3c?&XKvv>FhVXX94%4f4RAdCmoa0Z+A zBjq%qh>94!VdC>xV8v}h0{oF%6fQW$SC@XkQhX7qeF^XEqd40uBD8NnPB$}$Uj=b< zAWGTkW@fq1D>l{Y`W8hVrpSMF?BWJb`De+z5H?r+r3WS}4{wT+BAWS$7^z(G{pkVl|@B^|$~-w~(_ z7r+iiZnf5(D4JdvcY>`6sH{4;$kYHh>RKo9qn~^R>6lS2CckS_cF8g{o z$BGEhA4joX*r7%54n0QufKK-+0fHiPGD6n;1tEEW=??^z?^g%_;ese9Sg#TENoceKs@h-aWO$|au%KP48Tf7 zH_iNU00_U4eAxeKVFuisA1c@#XG+926|?=c@HJkL&k-qYa(Pn~KETL$luj;6d6kFz z3d;B-R&=UFV3M28qR#JZ#b!u%52y-A&ZC6Ow76GY~}tO#1|> z?pCpEoXp+%YgHH%V!JyHLkdlbl#S|J^rj}(-sgqtgb1kBgkMVUSe6P-A*fZv|1+F` z3G-eXH%T?LSaq|}=8kw%c3rww4KaH4b&{rHl#7dM8^7K;SvD^nis4u#B-n$X^KX_& zJKO|-n&ezI46T04FkFX6i`2q&5}Wh{-kvF!R4=Pt6R7Cx=W@Sz|A5B*N2Nl(h`9UD z_v>ZX<)2&YnrM6coE=e+9g8niE=NO6{pU960yHh|4jKpBzL|z$KIp8Nyq4EXO1#gj z82=`Ft~aC7?G?R6w7hu?JM-UYyFx_vqT$5ft{;AjUY%Z>*0EJ>E`8SX=5}E{d35s6 z*fZV=tfv%l&mH;LxoczT5<6HLc7q(&#fmJ@S6W(G6o zZmqdh3p!o!ar_Xg&Z4TpQC%bMzYq@U5#4{BVyMvdl3SD~;O2CiREJJlwl^);Vw$oe zeWTo_iO9VEiZ}cV!4({5<_ZWZq`{ruET{wt z8fZQ1<_Qg}guZaus4n0gSAIwM{BU=w$@rHTo+hVUW%Zife1qoRbqqH1-$1fF!&;0x zE%6WzWOF9f_0oqPo8#>W@W5S5OwiH7R_k-Zm_J-(ToRL32XB@FfCnO+NVvbB;kE&_ zD5*s<9kpi~)wN8O1-`Q}a!&`9NckH7>1kn6RpWA9&7J%QptAs(3b@=xiw@MR@oi+A zjwqM-O|Wh$FG?a%!v1p`bmey++;GXsR%VNqED;GDN5B6Z@!_&HtpY0d|%Eu6U6__Hf^|%uk%3Bp+^S=@cYC%gmI%Uycz~m zu1AyS$cm|u{3{WHE%Pi0RO-G*C;)QR{F=C*IG^|lpw0$-k<~E>zKAQ%0r-@}-OIxP zz>`MI8qaV08QXmzBrD)cPh|1(O`<#I^g?)(`pueO$5!T-nth=N2|k_+*t-PWUOnBjH# zFy(7{Se5>B0SQCN2CYnSxz64!>D(MQ+K;p3i~gE#1FPM)db4I%S++<4hLdlY=od<4 zeD)F$vPs&Q($X7>htlS@foxZ;b$59Rmfs)lY(1NKQ&7&S8*d@vm_U0Y$^7}QJ`lV~ zj8eCf^lsF}47n7zNX z67ugSl}GnvDVm<0T7JB%Nfi+p?mVuq?%oc)Q=A>S_eqwH{{^6O*go6&Q}*9g@h}Nl zdcFU2-`1PUKthQ^m_m3Rew8sgv#cAN6a7Meq>0C^j5!9I9j+63QERNFaoeGXNk9G5 zRr>YpSgsVar)3P&pR;D9F1!?xKAn~2HkiHCX*Ly+`snlC{SPe0FU|!G+qA3+f{>AW z`yVW|Kpk&J1t2TNW860l;r1Yf8jK?{L)KrOsts1N`{PAG;SaecK zq*@@ZfG;RXMIkGL>X4bie?$* z)W~ePc@R&*XeEOMl#u>Ul~N@eMlpD|cg+3VLhr&Sl0)P7sP$I6A}K1y?gvn7*d;Rg zmx+DWWTCQP5Y{5p4d$Z|C&M0w*aUhl<%SK6@8566Hx-U=MciBGZ> zCTJbmjLQO`#B0F&Xki3ALF$hs0VzIcp{!Dk3EDEtAP_H}TX~(Vctv3Kt-Nb}lg!a` z44bzOJ?|Gez#itg00Dv^`1adhGd`~mt<|UMV))9R>u!JFxR{Yc>#h2j!@dV!fLaLA zL%TnRzxS$F%)MCv1{4VlXli7^-0S@R4XBv!z!Or=zasA_v>AAWVuE%dD()mscK~+) z>4&KbzxI_x)4Z+Skor9j6?-xqY<>9o%OTe)^FKM|W>g?z_pAXjOp8iPivONB?=#i( zj<;6M7v`D0n`;FgJzM7joQ`}O7$JSmeStmR6KSW@YtTNj`_lxbs>jR1>Vi`}2ZUS> zVaOLYV&c1`k^F^FL^9ZQ!EL)ED}bxUR0HZQckmUSiA}{3!gx8jMf2_T+}eA1xpuTr zmCk1@GKvtVmb7)S)(eMy00Xxzk=(TNOC0hD8vg$0|KIHikDzJ^F zlUsnfa$~jCX*Vc0bf*pk4_$tXn;GW_`GFpzRJrSMPwj1WM(BpYBvt6_P?V6}6^6h_ z5G*jVm_G=pGreEW7%@qqSExICnD{Kd#i!W)?`CEMQ7fphP~6|pBxvNjl;P;a?TOu> zhfbQ4f#W`=-m~|G$3?{Q<(|g>%q&e9;u$en`yE?0Ywm$^95iR0F?mpV<71LH8L4n0W(mq5RJk`nlu{6gyPyvv{M zx*3-lLLK=fH|Dx{u$hFugWPip0c!W3vnJf&A7oa2LvCQ%r_4>~FEW1@xjf&Pckewo z>;^lBa&Bo*uWHPi!lEb!Wm1OyRQ#(9X}S1$eJ@Aripm8r7((L{(zPe~j&BzB~5P*9WJ7Sg7 zc}I?Lt>D&E2R2d7PwaiN+e)9aK3%uyZ>~XS2?%ka#swy5RY`fGWpQ zAxfc~OSeU6&}zCYfRB7C_+s>d8@yL)iB=>)(qWN#yg5AoasDO6#VAtWfkTUn!=cf{ zbtC#A9i4n-|KxO ztVGN2MH=Hp); zEZZ=|n#J|=_-A5ZD_g9=rY5h@apQzzqc_|nd-$yC@PqdsFc3{+#f0)ydqoj&W8eTy zOZn-dKo4uO0q1I>F~9j%5@Y1eC)Y5K=dADR`d^HEn>~wE1h!#uLz_ z*$&dRZqiRo)qfXNx2U!7QLrBEg5%@7vA?f|AHvyFN$Y$3Naj4J3!Syt}ILR<>r*GVr|0GuUp{%{t?;@%0}Y^?yy zojN-F=5^t}AOycJv*`4D!jBUwK{EYBUYcPt_Ylj9U5_+{*(uMr7VfwVvj#_kGd+KR z{S41@CtPXyDqqJwNI7r_1C*zpxcEaJ9VN{U2UqIi?P)KXdl2+Vmp1rzG-Ia+Z5d%% zi38Wr>9pGadLr1es&*L-wkNEm_YvrpG=o6ve1|;4QD>hu8@{9&0+6u|=z43*$sfQn_NpR&KGRL=sYQ=*`We5oNDpNj=kFO{Z*X1_ znt$8aviU}7oZ(gzy_zPPE!Tecy0J#Gp}br5qmchf=v6|=s~QqDBsaF>>VseFO@PN6S)!%+8g^_hq%s$S18@rmgasMsGkgX6Y`c7q}K( z^-i6QKeQ}VdSsiGkct(pH_2z-y`pD;)Q%4G`jsVUQd>OSdsp3e$HcMk_52%~z%K$> z-q(m`R})yVx9;CSEdQdY)8>%0b}sy6b~N~e%HPmfG|>bLkUOxd@Ro*hCxmCTqlU(f z&&*}mXR1BdtVb^??M-gkZ=cj_*ROtgUZY@!(o*hQmR%J6IB34`ptzmtfUP=qONRkK zIwcDGPiMt#W3DB+s{^Vu!Z#Sdo!T@fZL zjNV&&2~Hom^9%Q)Z^m)8u)h%DjW7@j#9ha={ssT#^BN$I|o?6@f|yF&BYm;j>&n;Giol4VrKc)6!&uc0Is-sYobL3 zeWC0)Do(&&a%$tpRHbv#9$N})%?Z=ztu2Q@<#JPo;Tck%WMmIy6?1I-JhRs5^Nzos z55IK+mjrOZC=TJx|MGW#-;SjdNoyMUxPtf)Iwfc!q3dy@)P?B(QYe@z6p*2wsyhXi z_7J8RaEyT4Mibf@aJ^i0$cuQ6|DbAIWnQHb_EVj+3)Go|-|GtIqeCXqvV|eFY>&6q zU7LTlKVIeY8!+Ur7_!P4Z7L2rvdAZdZ7cZh5c1DG_0$=7@I*^>2vfy8i|@em=fKH> zOXOQzsoNiQpAMi(m4<6BBg*H0N)Fw@{h8&LazlE9PK|+=UaPsRiFs#VLl)%HZRMjg zq|jCBGCk#IzYy5Dr9%n!DS1Ce`MEBcA6PyeK0hwSx|1wPs~n#r18na6m}ShrU(pzX zpC>@m5V$kcc^9RGFGq$G9^$6XVNH7fVup1<%n*TgI;}zgy)PrQr-yP?tT$0%>yU~W zcIAq)AT(vr-_Y&$`q)E(LW;KeqJ6bGVYMb5OW`s@1;hg8{fK{^;*ojC%tnsFY|pB= z4*rae5I8ro>mE|0sD^pK7fOF3^Fzz2B&n2_=dk>~3;np(?#Ay_hJ;?r*}0E~=Izd3 z>2(avSqn2l9*yec$(c(TWC|MIeIUxv@M_X-)fkd1vx)t1 zbVK+06dcsD+_LVt;}w-zT9N;r;Rd8jkU{>bwQRuBo&9J3efTWEmi=PTJbvmTh0gfJ z{Gx`b{nnWaPgGdsFWDrW+)a_D zWZSNv1tza{AV(pL=3IU^BB}QDD~4aYJ$r?0oXBMxYaIFI#+WJfBs}(myH1BTQ{#|= z%kYF@9nFPrC71!(MiDTyl&1F7(qu22&i>h!8MR*&B~}LgOUEC+Nr!<*yYeR^==>IF zg4O&>dUw~D$gF(7=t8&LJ9-V1^1rQH(^({}a}*7jI7gSu8gfhwIW+2&-Q(iyg7H|s*=K9T zRos$jBu2cA>c$4sZVw-t1nH@>Y21l6z-N$p4%VIWlD;ps_CRxNhK7~1k~cKW-huh= za{Q~N!rn2IBc(p@&_-n8Sc*uit%D?4G!P=ORQEXd0#e0Nn1*v8(z}WD2LU@ea9RT1 z$}|K#Q;A)s>EVgP#Jta9AFF?f$$>szF~m-t7PcRqN)Cki9D42&L!vk>TomohX*0hP zj;AJLpNnSwjjva-9{{Tr0mUL7OXW)vveE0@3#XcosMJ*tlzO+^G704LwtjUv@3P~X z%?K+$0Y`^l2%UDxjT`HFZbsO}vBVN$Nt3huFUx@?_v=J2f;9499EhLM5IY&YZbjf8 zsLbV1RkBjBp7}mBKK;;e-4Z$-<|yIX7>(r%6oxC=|46zZEo(R~Fh)TI@MC{T&c3jJ z0Y!EEGzR9o+9LmYzHC5r2h{6&y1xKpjW%<(dRrRnR|c>M z4tHoyPI~CjiVt(sI|tl~jNuqGQA(vDJKs-1Xarm&>rd!7{euy`iLV1n=o)y^M5EL{ zis_ErY^|N$OAjr34&W#~DQA_h|AN)*YyQco+g-fea}#1PW^*J52uOTUnqC=v$L%&0 zL!>7QoO*}7W4N@rHuUSDC)4v9X0JykGa&lS;<2~3F?S1EcMk2(f;rEAv7iy}2^!V$ zaO+=r0Zpjp*HcV(%8TjIe*k`xRPf$4&t5=fCXcc#TJdRO?AF>zWFXf|Sqtydy1dlL zS(68n^;(&8u9Pq-ISbcFxmRj0`N+xmi`vhuO= z7SVCic4oy)OA83U+u-QASlx0%+Liq?e=Xxxww%beLKgw=K2Az`YwH3F6Vo3%cdv;@ z-}t)uo2$}@+AocDQwtBFN9@+<&Uwv<`hdFUPvw&0Bh~D8;Go|QR%7M~u=fBT;V>NU zes+=U`@y?uLr!w=RoOzv*y4v%j<{D_S6SRjfEra8jaNy?;EIV^>VL{B$;00>E>j_d=o0Lph<WZMES{3 z$)N)K1-v)p!Zbf`BZJN6MWPm7ozRlX6XRW)j4f}~5Ouf11CFIF4uHli%g|ZUF;ynLXnf(&$oyH8xqIKmJk~dE zuSTDG;Tgr&KvGN(ZJGA2at){}F@gH!I(JIq`$FbdUD+N#tHs8g>DsUnD$w$BsnFzJS9TrYNXP&G9H5NS@0Bc?Y zKkp!%hLL16X$VsV9Q|QLfE=ODB~AZPat(dI9`LGLqe@x0j9V5o4u&mOcul4=t0R{p z-d8aGb7E0|$xFBsq+wFHo_bgiL^4ntD?SkPhI3&n{e!xKdT|^;$Qfjtii`jqggN zJFHL_Kfk(`8{+pLe*Bf?y~&$Ry<31D*~Ux(5_P|-t<{e11HP&QEa*fG^0)t_jT8D8 zRo>FTg91QVp>J?NEa>E)r~EI%l!_L*XmEiD;RoW2{T7ucA&*l6yhCA%{BO!yZ+zOi zvQt8VO5tuBd+cBM!qUO=C)Y44PS?+P6hj~Kjq#mG5v~88F$+ck5#>puQPGeJSF88T zPm1TAkqd||N)E9ujLK_?7%^`dHyVBx!By%8U_wo5cxDN+ThaU2EeaZWGY|TSL&J|f z*As8p=pOT!g0u$B=S|keBlKLDp68a5BX_C>f5n0WmS%d~wl@}TvHhRHOW%t$MNFM5 zYeb!d2O)PCWnVCU2EF}6>N{PQrTh_ZNk$|1<#}nzjW^z31h`Y7!WGJ5_3xZ8uUHAK zoN>ekA=rmsUV7?DQa!I}*LLqNo79eTuCW;y$z0q3QNSrg=4p*|X3nzjMUEa;RKMCn z1LuFfeb(ty9yd{E;Hy>crs#fk@K6lPaZ}(GU(`PYNYd8sG5t?ECk2)sc=PYQB(2<1 zy;}`Bm3Q6=h<5`C?PC*GlP>==zDd~`uMjE801nKT>5EvaJWT3>r0s9`lKkvB4 z58i9+JdWfV>F-i&P)H%As?@S9m3*vbsl-eS3IOq-y--iQRgE5&R5)o& zA=UlEuMkX4RTDQL|7;5jgSV)M7|%pSz>+CQrGV*F0Hd;(s)~xLD$)SY1S4@H;)*1K zg~`L6buOJ6+Y>tYwBa2wWdVlqDexU2m)~A>MSrt@{@tT^qK#X}9i!ueh9<@H7cPba z+?sIg{=jT^NjVF)7RLmWo5f>X7Ju-N3Tn`*EFRkwA*yZz1>qO>D5;IR9Nj7*xIMgB zpb?RGYH z_&4Rvq%_&R>N@05QfQiLE9Vol2fSeT>eQ*|h9zWcc$5a0G}b!Z@WeVkT-_9x)q z%_72Su-m_f55PR%@1$CCI{!o1Zj8w_l z+5dkWqP1+hA}fAc4&gZOsJM9nld8Tw@XFm~*aJ3!!;X$iTsXbGoL6VCB23T$nBP-< z<4T(`9sb1(aZIy>&#3gwz4ymj)S3$VgJ>h%x{MNs zyD|@V1-Kmbs_3t2$4;Id!MyFl*K$VH!CH@N#GW5-q?>=KUwr+pz}(;+3uq>y-xitc zykpY&S~hfTizT9K_#S`W9k_Hcl!Y%Ui*oX+P(<_{R#ZPl^p&A`r-qt4SK!o?NJ2DX za#p_^J=TC-|8Txh{NdYaUVvDZ$hrL>UuJHWcRsbc(Ye9eiQ_i?4)=F1@l$Sq;EI

    %F^uf!-YdA%?x=IK6bpwj@QLKNQ(>&h)jUGN`4ik8*G( zj!+QE>it>Se#s|GD27zWR49$*Ynig5=Y(s>m(aJxLbmiFTdIQc(;4h@I($OgoMaSa z3OHI&vh)w3iHyS$I*KAE25Sc6!WRNN8E#Z=xNchPdQ5|?S|3uPBB&U(dUiv}I3?d= zdS5Q%fZGpNY3y5Kz>Y%pwo%?0Gf+%DvDF*ew%1o=anKrYH^*pWtFB&?h&hxHG~Z_uMD(xGxtP!+KX4jwW4Q9J5H=sqLztQ0N$3z~x% z(->9aN@h?aBuztz1L|ACYFI$2uxyefnZ!z^8*uRyPbCgD5Rci6R{b7qIn?v!dX5tn zsVLqp9!mNST`tRjwn*udvpU!KDJanmi-V}XSG2Z2lwi<5{o%F>z_E#>E8(=lWMCfXLZTew( z2jA9qDZ5{mupIv6{PlB*9=>`3Koo`T2C01+FXfLnKx8_9YqHnzKfGeG-SG|9T6#O< zAF+J00npZ+0P;P+IX5E~ma9FHmTadQ1QC(_RyvM)oCetp7={CAnrEt~H9I*&y5yPt z+5`dI?%JLsGUq2GTfcyWg|dhP*dKlqWI7$b(&FFycV3#y2mZes%^cPc4xy3zkAtNg z{sB3=9gx{P7>0Pa%iv~VhM4yEhix{j)5AyU>k$^%e$)QWtllzv8C*>1zTEP^i#A9T z{cmvv&z`}sXW-J5bfOiqYgs zrG;ulK^u2Vef*>2+EQ}|CQCUmuS-;?}N zCu3z)`bWJE@Hs&sc4Q~KWrIqA*^yCdGf%oKg zvSA*GPifAYagR4U&9vT%O3w6;(bdcE<0Wt?onVav zXf?z?6tP2o-#KZ9L6Y>D(jGxswFst_MABV!n8Ji*(PjJI#MKV#ZyFSX;0BZVBI81H;JXTi&pZwOTFJE zg{Buvvaieqt9L%1JElufm&jWH2Zg{W{BNY37P~mH4nZ%Oe9*|o17d;>@mixl-GjkK zn2K|K4985zWWNvnz;jG4BD?W?Yz{}~&Fe>fjxk~(LUFYd`14Hjg4v$~ zMGr62r#_gja(Ez=f5|N7U%Yy@Et3yybLB$j5a17_fRlp;-H;Bzks4sEUvEZ4BPSp# zGe;f$$lLt@b@AkN8k|IZRHhGZL`s@iZKRTQFY#?Vu*||}$Uaugs3M!E^`~zCJS6%d zPEyY37)k0l`>>U^T&~<&k`noT?pRPQ7dVWXh3h9O+Frx65tCr>z&*)sKKXDDRhS`$ z??ICFd~o!JkimJVVB3Am_iCADaAOC4syGofKJr8|Ohg47#-G%!Z#h1)+SEaF_JrU{ z`miPAuTTcTfe-u!fxmMO{BDG6o#Uf`tggd?yL@|M>R;8DARxBe>Dc<87hhRzT)2yI zSvNdxY;j)j{|uaw#EdA6xTd6dhU}*hQi&=*`%_B?SlO?3zl@P>)X7>%NVRoy#9_yf zOz0~9LHw#7?hr=uH4nPv zwk_^5K<}g$0?c4cAkzh#v^fIu7^%1~-~cR915%?QDOR{v4rpBiE>~~7487et=xZ=o zUQK_jWs%Mgl z2_mP93d4rwlw!l<3?uBM3Z{3BozM7*=W?IDMy)iN5%6@#6DH@3%-{JS@t$Z zhFyPJ*Wl8Oqn3alY3)w^yD$a0LErN-bPvs;G(k?0=G(nsHbWt;*^?2k@cXtT#bK4-T)B!ia`FjS* zkrTB(aky~EtzI6f8jDNX z>RnKUGjjBm(Bi4TBeIjvP-SEjP?BK!S32`t@{1*t`qTVqOz!SYniwqkZ@pxdV=m;W z>VOCir6I+|GmKy*t9t#S<~3cPOBfmhxa6zr$)fj?Z{-GW;%sh~lPGF&`|*KVu=#^= zsiel37apOo;g)3?|0k?;_>M?u8LE?U*?%T<_9m%8`(1U-^cs{~n|silvi))9Z8JIU zJdFz09{93PsE}vR0xy#m`Mg(3An@$ApM9x^c#;_2j|4b52lATa*QGp0BZ%PvDXQhkdfA&Rl=v5a5jX8jc! z&B;B@4DOtv470xBpO=ve_w9|>`aOGF42;~bz|-{&`2qe0XxbQWKkUi2GUAYP!t)R* zg7DBd?yn@j2BipvErw`z{Qg@~~<@nUQ4HrJubnEjW{q*AY+`>HyhSw`t#RFUP9A0F^vDRt;jY^kLo58!nlBia?0dOEPEuqL`!DJqa9lq(q$#gVJp85O?^n#wTbo}lYFKuE zap);bqFXcg{*X|6?h|G(V$h*WX3NBL;MEQRAE9xWomub01x(cUctH_7D9VHk(k6R3 zojU`v(he>NG52~?QGUA!{DdFJrkrzLJXaGE12hSDXIjBXKP?~mPd42ap)L5YrFMQU zC9X`Qd!dX-bWdW}{W*|I+fKq*bB`|>r&Aeek*7vq;(P9dw4wd}G(HxBD$(*i;^i?3lW~M+Lg9RL zVg?DxuTB*%=Uq%+(Q5ITBl)4y8KP(lt=iV|9~CAq^2C>k${G7lgXR*Za+6!oP@jkA zn|0#XzB>Fcf}mT*BseC-L`{6!ZgKI}Kg2tQh5G_;3+*!Z`*p7N>mPF z45}is0)oZhQUk3w7#Lg_;au`)g_25iJ(iwWs44P>%2X^2Jp^tFgah(eEEK_PTvU~M zuYUz@3P0!AtsZ$Y;DkG${0QltLen5&0{BreSTh@jNPtc$yz)X#0nlr4ijK~Yj9xp5LH82_^jV1 zq{`;Iz?g&lkcmfN6Qx0>1#x-tf;Fil?C$ebwfohx>F?{|zaD!^?fS<#04b;$gd?lT z8Tlf9%_nNjH@Nj=1F6w8dF!<)yAS{c+VNb3vpZuM=S>@gAb#{! zj#I&P$8H^~a>CFUUexZwksD%xK6mfpjpu*UMt@UGbsCIrBz|M0Zno0~V$GX%pkzmY zTR*?jZi_*LuK6?j!;Szgumr>(g75^mU)iY4JTGjt1z;QX?(tilTfkoff>|(;J}|D% z8fgO?Fxn$^Cfn6vR_<$c?a?XU1q#mlb;@s9G!%CmbO#L6?T?WwE!vTeNmWw+fI7Yy zdEkkBbF=8n?{mFeeNRVB1n$XJ+|Kg?(Op{epoiQsgp{qVdaP}+6*T>^2K_)a&jFt; zzvYD+bV2kn6u96qr!6l6671gCg03RUzwL*#39OS!6zxIfMMSQbK~M?Q6jg*iH^L- zStdD-BNDTH%GMJvOhttxR(0|p>aF)|>t7_a7?nnSj4s8G*K%XXeNHsjv-qf9`UNRN zZfUo7U+ILmcblZNr9lW{P#hjvIKT1O4XSE5Va3|Oed9vKIOu-1G+_Cu@9(ME>n=uZ z<5b$<5wn2i8@siA)awY_cz+p(*=M+Q4Q7}x%&LO@+QotM)RPPO5Q zz8#(5DG?c^ra?-wkZE6uLW3{jg^51gP`<7r^6}8l9ipX9-U`$o1W?0v;7ng2O@Y7@jA-QwLy|AbxOj2*)`hbIy ztdhX0^!1#jlH{k&!$(1zBYE7RxIKDUSti0;kI1mQpFTrlOz6WZ$lrRHWx|8TZr!Cm z0Bm@VB);ed$Z1spbdqWlPY%x@03l$rIYZg|<;1)>IY`|~41;I*G3iM*ifboC+5(Hp z6h$$O0}YR-xzz>PBav~v^?9(`%!(h$)IVuV^(s0iVrZUtPYKokx^qL;=W$?wE<77x z>Nx`R3yAm3xyH2};jPthkQp))7(lQO85|BbAY|m1^)y-o-rx-Wz~3Ytk+au*KSGQ<5$YU{G|5XoZndZ+A=t+Ce|H zYPrt@d;)jm|QXi=fnp(-uycWUjKo`v7_3ghF(VQ(`fr?R#yqwF7LmSSWo zmj}%}m$7y(RtHWunYeFdrYbsL3q|$mH}DO$JVR6lD+C!Bwx#n14s|EmSqzs9%Sr6Z z-L^JWx*h*fPmbChp*~!=>N%;nz4NYX`mIvh#s}N|K=60t2X&tg{RH_>_>P9_)jVgyaI5{hCymEM&IF2f+3?k=F!K)cj{ktn&pWmZRghZBsnu^5_?}(SMSX~UCyB7tnNSQ z0qMfA{GV~7fsv6@GDY9Up4$$`HJuNaG>K3cN3*#2kV!dc7yu7$1oE=>#ahx>K4{Gx zbgy@q2N;#~P6Kdu0KnkdCqESDCoURh^+bP=6MudhXw*vmPlIfB%$1(#y_0xNXt(1u zfz>@Eli+zu;N5u4?cFFb^M3xsS>)wh1c;scUBt6eVX3js)X#8@&xLYFH3CG9yGi(X z%pPw@b@|9qKPz1HQaL@Do67UeMy=OEM?i_)%w7^}|5DI@$&JCnYVHv2SBC3r+cn>y(Hg!RrmHQn+S8%D3o0GUGnDxuINfZrm zwDKGcdWMC!A7GTD{=u-q+@i_{r0H;0!VZ7 zi+6)T84_ujazzdy8zZm&{n!*j{wo`Kv|6GTJRj&LbNhcD!B`;Poha0>Y49T)xW@32 z7JWc1>9PI|xeroB4g=D+IyU7r*@teQfNlWQ5r(M>cO71ZY8=RYeJ3P!TLWBeyXl9%I1=%3PHSUsL{NS#ZYn?4bZqJ z&LgfuJeTI>cJxIyQ&yj01`@X-4y_N5>Zc^pFDJj0=1BD(2AYC4qy#~|DZ2>?EP)ly z^6zwR$?|2loYY^QeG5SpT(&}Gt8Z`U1ROejL1BFXR9CbBdwFr}HS3RJvE45Fz;7@$ z)Gg#QitX3+kxL#(NJcfJ&6o1+wp9I)^@z-_3h?J=2sW$SF5O9DzRgBK*r^!|W^Z!C z1wxM|?)xcs_$zBTByPgD$9w#9Q+&c%)lGG>GHmlAw+#w?+On$R0Xu^zu6>22C26wu z`}%_t^&zN3| z>@ie=T!Z+2voHXuWFQZJiYr1p`oRDR>_DJy26#DivPhn={T7J^rovd@cJyy_=uCoG zw>Vea3c=q(yo?a{v~Y&++`R}4;$NHGtYQq_A^^d^vZFFr<{7>Mv-&WumDU6~VT+xd zK3ViSh{a9=*+OcNoRN3;q*>4AK}KpYo0r3S_(H;PamR+<+pq4i zv~18QX@kV2@*#G&tAb+@^I!#TdH1&U(4X?AN}Tw}Lc`7OY44`MBJSYP-mKP$?F}b; zI*5c)-`N{`=^Gb;RM)SnOj{eGIfIP^TMn0oL3R#)4~6OMm?aKDzAYbpxg%MJT(CAmVpz}q1FSxntC z*@`n(KP6+LR!mLCj>xufHtxM&2Pa#}5to(SGVy6m7j0QTd9>y(SwlB%SyoTdcOBt| zjUB}pl%(f>asO)W=qLg|ABT=2xmB!zme%W+I3Z#N5=+k%FBI*IaAY4TbMX8Yqb=Ji zpQ~hvVjYrHs8gw-ts`jsfm=tw^1i9dI%vSIWlC{ZT!ZgMjU1Dtr?mqaGZEwm{yIY{af}|HqK3MQMajIq5v(_zHJR?bIZxTTr&_QX>)skn)DrvGsFJ# zKvaI%`G>>lz+?T?0tzw=KCUu5b0T!*PpS3NQ*%>)8*-*+IN!Kkw~v|o0q5uQ%?P9CbUI$QS2p2pmk)7U`qdZ?LZD9u~jXnqR=z*_6 z;NmXG!$Ts?VVkg4V+8UeJnFm^$?Zni3<%em6M%XY-amnSaO}nN)B)@xTnEO5X2sJZ0M`k*I7#z0FTPy4PoET?08~tCw%nw@ z|M6nW2`gM@4+`)m4diVSHy5n+tFO{=8Yp;$XRtkndH-PZ#v#lzEvD0FjiY$HSFUBU z*W5y9VF+u}&ZJ$~4asLKPp&Kfci2}x?pV??tHEM&j+&#LaYkA`ujSvRn!fFJZG2&$ z=kS4~CEQLq|A{93+uta5ng-LV4LTOx3(sZLG!4|~C$JTs=u=~(0KI1cyR@v94yoa@ zCkAC1pvx&&iSix@VWC?xXiuXVY#PlhXP0AOeZ7fkU&>Gu1byPlBZ1+xH7Unx7@ljC zf^MRVlf%z|mJO{sJ3+srg7{fmcH_vmwDa4xNUeOecJ%=XexT1|2s&gmLxlySWI@0wN14wz>bhcg~R}v zcobJcAj;!Jpz++6@EIr(aEssGp>z0R{rlldH@BEg8x>hPP1at_LM76a)WXt4ZYnk7 zZzDYViNqd;+(OdWbp-3EFCv)cr0JE1Fv=}CYxQeT>j;>BnspDZA9Yf%z3m{on|>>C z^P_tPTFo(LKb~dm)ZeoA?qHt(#Cr11CvWVuK*z@cuQfBI%061V4A;>09lBy->=jus z;HEnwzH2bS9)&Z>x5bL%J=0PXjB5Dwa72MG9OdQ0(E_JM5*bSw~MDh#e9D&>7p1`q|*-7(x*?NsGdx-pON^p()%E%k~XD3XVB zrTq2n>CPn{;Eb?}K3&la6?n_M`5FAEo6i#$NiU!JbhjNpko~8TrFbY;rjo#Evt|$$ zpXSJWrPF31T9j^w0>DC#qJE1Y`$W=yRyDLButKZg3(Pa!Mm{5{`$_OGiz+_dKLX9M z%qhmIo!mn$ZdkleXjlG5<4jg%iR5A zx%U~O|7bItm(6$Y#ny$cEa$wK*p)WlXlCV;X%aK(OLQ)N2s|KUf?fKl@UtgEk->)pR^b!6k%hg^Mf7W1~qs#H} z6|lmy84!w)VR*M8Q7Pb!KZI+3dv>Q+pi)IK=C`{y&1XSd9psY>9(*Z0_sLX~OI(b- zvaM?J`M{6a!0tA9>v3J}oeONxg;quPufp8$BF2h)A6_AVPC9Y^!7497TtjXWWP1at z#c}8COAP?O}gm zxC`qcIfKMIW@sDh=Y+r72UX;O=veb77#53yBy)4HnV2-n`2A$EW%47;XHT-w6u{2KlP z=cmoy8Et3jxpo_M=kx?w*6Cj0LQca~CoOLXvhv4+wUZhOb#09|3aJ`OH+iiEWeM8hk@qzxE3ZmW1S8!y^j7|535$< z6He)aM|R952`CN)TH;vfRG=)ismaQlgMMR2Q2YUqo?A;u44MoJvQxXoXodequ`db` z=ccX`EcLPf;<+OW8jm;pHuPFLEc5S+JLKMr*>Tq5E@7V#*8T_)_HMPLZ9^uy*AXmX zoLnwpAy>QwZ;ad7PS+ctayKV5vxfpua^&ZWv88hFlb6~u|MnhKGle~RtxtZ*A?}JP zFlU2>eZXuKOd6o}TnK|BY~Kb?gQlF-+C*<@GHTi4l?DKMnZs1^&Jz(c?5{1PA8YPI z&-LChhO^;s`bL?QgbE6%a)rWT_gK}+pJI{lmZpaWMgLMXuthtL3dO+*@@0PHA{Ji0 z3X0Pv#;zB!)kb{s3Lttm8gWC&w?30%VdLsk6&bWOT1PU+42M1lNfgr}pmHPW?ny?` zEE0QN(}RsBPl}Cu)hIOCbE4&b4bn>cMdmj)#$kC=r9}sja31x%$S0KX? zJ^w>3@;&}uw}CI<{=aM#ysJU_2$(GLeGK9FeYfq~mU^ua z75~>tQ>78H(`3=6|8sfFPXz8UzLvS0Bb)9U{u;JKG9J)f48M9d+VH|Npf5a|_ShM4RuoAK(^GfIwaBrm?kib{fF3+N1Zh&N@-rk2~pK z%5;j6Y|uXg_JPw2jQ=dhI}Hi~wK#*;iMus;Y+YbX=T$4N9=U}rxsQ<`xamx;9hTGy zq^AndHrDUUCt9%S=EU);yB#^^}oVBFoA7hVj-tjKV3eV@+xO>iK6|BVJ9tW{dWx@SH#AT-^HiovZ$&vck0K(o6wf|O-3HarrM~4;X2~T6 zH*;o5e0*O9U0jGtgtbIj?J1E@0u3sh5Sw72ONN<^2FC0ai8_7Cl1PUy$7&q3f^hs@ zfzlY+uIr+YKKX7d9BuOC$OP5NnJ^?b_2UCxK9orciViRTk9TOccNQLndHvNk7Y?Tj z4kEU^|KeLdGwF}}oN6INHbgFnrsj*@6qhhZKLKQz#g>A((CljB^sbszcZ31 zpBpHPwnn`m>g~mTC#u5X8m%Rn{y4g6R7u5Vw*It_3=>CFfQyql7X_W{Z@gUBkXT&O zqH<0x<|8o{YPVRyVJ_aK7iSSq7j(~yJqw^7q=gkv;( z_^#As^1Y6|j%;Z?SF~omHQf4_ZsZTEz%>bRE22J=u1`hQ7Wg6DT4fWUIWddXT~gjL z$5WvYc*I1^t@cG+8B_^1st*uWUTnpw&ovRGEtrZ)soXI{VV1l#-K`Sj)KtX@kCcn# z!(I_%1Oe0q4^Ll8@cA*G@Tr|;-g5V!m7t(#;;~b5oyaXqOTFG?;&K7b+I4l@7=f^S zHRfP4bXJGRo+;KBln=fcl8`T?Hf~OuZ#T5iB~!h?ioUoZiiVFr3~ROfnk6P){l4xm z&kM7TlUGH95ow>{w?xqwBLw6W=rpAGFkY`;unxpMMRX+B0@mR4ja~zmB<;fDsG(H= z>A6OF0MwQMfW-PgAb(IT%%wAH6G*FDPAUNI*w`BX_C7Rz(BBwje+;ULwinOUlk5k4 zINi@ho%&THF9%LQz8H#0E$|Ihy&|2fXQ{{);PgeXw1K_+dt9QC5&apg zdwGp-rAR?H%qA&iH%Gy7onODm?vf|jcc1dTd@98HV;1pU$)Nutkj`3EUY2BEd)`Gj z+SGq79D z-?sWfo3mW{*FY{_9;{BjAws$DXAvBOUmvvAC5s4u70!{Amvt@>RXX0!%zrGdw((Q^ zX{@gCTbg2ynP8f1l2?UEr4fUBhB}Mrm&Ik-%cnc(tnxu(I-2%9NrhR1DrK(a%wJ0j z5f#m04F=XY z7j)WF`Vzuwfr5UdYEfN6MyzynO1(qD^G7t&jBXf92#}aT0Oltf0;P*yRHAq z4y2Kzv5lL-yz?j?j8P~ z;BX!gl2v%ANTBqXZAk?dLN^o<{GR1`U0pF3)PJ~!l}8aCS)q%rSQ^Dm)t2;!!5Xs- zKK+3w*S_DbRUxlmi5u(5c9Lv6ftP)JN{NZdIN+<~BxzIy1_DaNlBEyR4EU?cm_9m6(cE@g^^{$rlo@j z%FpNBi|1n)po%=D)2iFP+*Fd^ZdZcJ$; zch2I&-wAbty1{>=!n;-hK+o@~eN3zr$%QR3n$rJ2sc<82V z{vSwO1565ze70I$FI8yYx#nuOPv?cLRdx|9^)M zcwn}z0rHW7*lAbNNAShYp3enbKpP%zNKE2JpO43RB2hUZd`Inm$Lkd%W5$`4*DH38 z#!XO!oG$E7p2cJ5n15;GGFrD@z5ai148bfSy=di{Thn|GZr;}02YyO|^xl*}wu>$u zRsnwV7r0aa8mqF14}Z0jYwR*Wk)glw z+5=f6RKM;MNou~4B4^!lr(`(Xv=bT9egC})>5-9D2y-1(bvAewQ(Qhj%vSGuRY9V0Hj{9lSb$*uS7ewRsfac>;P?}oREFaDwHjDxmh zpRh_XZRaoN}W+lum{udmFno(l0|*Wrw@gETiiwgp>mhtdEg zVBuYUZb-$MS&sTU61! z(US(QU$^Zg=&hZ&{g^x9r=E$G(_~2oy?sN^4d(SSh@FX=%}DH+ zdK4<Z{(pU}cnjN#<#mSSddF{46zZBiBqS3DKedV~7}m<|cZ@igBB zGmR*)VJ*j5jVNzix+p(j!9#H|L;V>hG(sEtNlqc@-GEWt`a(3``gi#(J~~D`T@q(J zU5c7?(!c7`)WyF-gS#H|cL^A#1}6h#Hi&8DK?q4czWx(e%jE4!kGMq~biZmS2_vVZ zI3d~L9RnFGgZ!^oK;Uzr_dv4M+a<+8#@Ek=*LQDu!ajD!S0f&v>|JjwDL&_XvPN2d z!c7eYXyrl2JTTqT-gPD*CT=;NLoLQ`arW7LI4AS#T_^obs}BIFdNT6AtgRT~bOm^1 z1b`)8T{*ilt}7Y~lQUX`ifH3*E44gL^U`;#_vHZQ^LKT7C+By1Zk7r|P6HU{<4IH+7(A+4;z{4O zB21BU9t61*fbX( zhDCX{ulP2ed3{`Ag6}xq%C9KMtRaTK_+BD4-QvvvLY(HgUJE9uTxk}sQVB)#l}Xf8 z-zlCwf`41_kJaQdtP4_0dg1a=Y z%3D#mg(%zv*!bF$eWU%9KnC_8L_hD$w=fyfYcIE(gYs&<)3kKaSEqCklc-7HlZEF$ z%3X#Y(91Bxq{d}bO+9lT*_9QiQciiPx7c@%-=1Fs+cT`w`WWg7Bzh3w-T|=CliM^f z_XX0xaFN1K&bECcx3&e~9=pvPfs1fL&SsUD!|Iv~5FSf4^D9rM$KILyxY}_dp&T4v zxyH4a=A)}} z>h@s~$=R+;jIO~bZ%DLvslnOSjUMhr)jfUclB>E0Sz$!?f*XfR^~p}e`||V>swKv( ze38jAtIVKzDCXtr#Oc?WN!+pRzf!aAX>VLME zEL}Tx(|J08O8IJ-M$U8CK?JH;T>fL@*oY@@ClvMfp}zg6kCNSMoNt~Bj6%z zrYPsz!Y-r`#x^EDA4EBqM)WZLS8bY^=&-@kKo}LpR%4z2p9h{&izD zpieoegVrT#N^d5@3j}TOmp2|C-Z*`yLC~A2qxSe_vYVc7}^sHzxUWcgbxcah& zp2P$Vy`suNBkt3})0EmJ=}kh%)5Vy6Pu+p4NXne{#L6~lk3K7bo+|m5|4XOA;Xfbn zlu7Vp@Y)z-R#@^KS@vZec^m^*ci468EUZgwQZB<32#;x*+0UGq7W(5O=y$K)_iwOT z!v6?rQOSnOM+0roqtH$MrQjr{B0AKNN=TM3abT$h7b+~*O*ZM{2i zQ?}>MZ#)Ij^du_{8sri9?V$DEFzjLe+I`*KM?$%FI;^xAC+uT8p^sE&qnPiJ*Ixmk zM;2ipmAaPd_)%#&31sGGg@$YV2O%qC53(Js{@aIkktD= znVz{i0L)Q=-#2V5J8k;#arZ}>AjA)bX@)6n$~2e*Ob=L%I2L z{s(>^SM35;bXF~tk4_^9%SDWr_gDv#sq9@Zoo&3uaeWU%pmGu^!1PRM!Fo zSt2yUS6mW4EV7(4z{SVp{#`c}d2 z26TKaSo|2h=DNMe&!uIWBT|cjAv``|kf~|BUNgmOK-kL%NRGvTlVIMz7x@GtcGw}+ zta1SikuPA0n#>>8&tDzM@fq^MwvXuCCVe}hCx0i1@}*Zzjwk1@_&WWv*V~^%F*`6u zCc)yRSOdF;^+dc;nb0ke!&2e7ekkX|?U4QAZ0w_o)0D&h%Y=rtQUsPv$?NY3X~Zm4 zM0$#jhVgAIRGsI%g8N_O<0I)s`D*ee4@RqwR*&_=b`f}Kh6NpJ8jR*80wC+%FL?xfZAjtjoG8|NCf;pV|+=IOaAJ#7Oy$&LzhHyd^$`vO zJ88=1!`e?&u%h$9o+jwDO^D~h!BnHh2u?T+q`?zoe^xqG|lCdsrp<0GC&mvayy z_|*82Y~Vty?9}_Z0ZsEu(~IT=E+>q(RX6Hns=!YcuH{cO#|OBCraiZl6JqtT9rA<- z1Wabh z@2nov#c1pMS0$b8n8ZKyUy#neEr|Q&&^@D+qOqX5i~q*7WLfpiI5-+An_@{mkaIf} z{H@S=ftn(s%cjnfQXA5nS?VFeJ@~f3l&0)5y!?F;Gf;f*x9aAJ>b`oS<-4NhG3@KV zD8F|(x+!Nr7W#Z1+U+oJYd&f4<~f?XdG`DIfD%5fy4;t$Z&+or?)J>b17b0^Nr*y ztCEg)58SnYFVvZ%T%dio zVwt*eD@eR19dyh;n`Pl`p;;>1G%(GyfTk#$r#yp{=HY990}kgeI329<;L!pEp= z#y-}0J>Y!c#?!&W)BYwXP2K5Zn?Hi5O=oe*$o;41Q=iGmpZXt4TSr;_eriWtBGpgG z4%6u0l4N%tNhMVGt}y1qQrR7HQmcKT$2XTLH>(FCC&5TMi^wH?`ho*WymAojGO=nL z)rXA|0b>!D_=a7MbIoAo{eLUA>i-#zbxq&cN^vf}ke2N$6My;UoM^O4<)ead7N^p2 z>4@JWFYbb)%BUg`L%|W;r}vo_mK6UaNc;MZ=;r)L`0D%)I>p}1a#czAbkdb1sG8{| z*cA?iNfoqI{{jBbOr3O?*^P0V9jqFJSfFNmHPNU&#s|~A!;SI%zLu{i+&i+}=0~{C zRQBw~XHjI8e=+pZfkdhJm0Rum{Y``Ss}m0WAN&*CnZxq_ zcci_)tbKaX>zp?+5pGh=L*x0sNAn~HNFJ~qV!gsaI>o$yJJR+T{tP;NBt(0w319)I zmg*~Q(u0|!nxES{KMV@^zpAEb_2n*JbtNRRY%I*KoSvpd)a?J&Hs_C_^;4$U`{|w2iDD4U1TJOQoYOjQMgUsdWZ#yK+b0%jjd`5AIU<|? zAfUqe8vJg^l`eT>SJ{oKg%@<^z2+ee!Jmv0-)lOQzNQb!UB7+noSN}3mkLia$xQKd zL3K>j=mg&cmY-EPDq{p6uAou#+`Kv_J^kI7ySd!1op;^wbEAp+Mi}H5u3rM{{^gyB1Lso;b4oK(j%4R&F%Vz7V>!h7y+(xhQ)eP1Hp(xP7Tq!^02(ywFMPIg1f0M?RmKPV zeE;pZjyE60CcY-6s(gHg+J(+y31^hTNz^|QJB zpmK+za?LqT9?Zy*n8Be!n~C1rL@ei0*CS&6xi>mPmI(l z-qtC<45Mx-@0?F|Aj{No2EkvYxVvMI>FkRGI{C8X@eQ#>3=B=q$c{pHXrB(C$#XO29dy~Wq;k4Ft0AKOG{U^q9LU@&Zd zd7^98!E+b27_lvVVOHmwWkF zN}+L=qr+yr9mG;9n7_mffw2G~Ejh1TysFSplnr$gsV(De^mpU6kB;K#&gW}=IbN3D zBs(=sjJ~*w^In7GwG;tg6Fjij_8T775pGux%f62fBNVZrRsS7M7|GPiR1piubl)K_ zJyDls{$NV|9{@!`y1qp0;0&Y&szf$Xc_Z~5N&hV-{WdFX;`H5UrOyUrJ*PLZ&PuOD z!CE~%Ro1}UY49$-=Z)4&;kByM;k9aW;I)`3-)9ON8N{47n@yQ=wR*cfei=Q@({^gB8TDsBviu&q%Lz6}EvBMQP4Lh-rKtvG=&z=?x~U<^#bTR0UlSeb;gC55dZ zyic%jgxkr%K%@|e#ftFR5D0NQYrywUz87W!+4nR^N4>BjueRyT9Gyq(^22~79?_b9KO3aatsa@fh-+p1|+3&yqhVXNbc>ddSHYvVz_X@1|WHr=JY6?E< z0?@Y*%XuLEcZIv|mrC@80mlc6vxna{UE2aBmX_t-Gxt^how-j-;XiY~g4KW3eda&9 zkGSPNYoJQdZ-PxA6jb+Dq1(7DO-pi}mh!%IpG~CEbJc$~nGpO5?z8vcvdGZ9khfzN z$k*c?$kXwy&4rr1nU$F@+@~gM?zUN0k^6Z%WQJ0sia_OUG3dYPKJ$2MG#vUqm5rfv zilE#4^NS#8eK<4FVcSEudr$8}!iM_bvnIev?YGwb zbh%Gxe77RqCY;rM!tQ=rwcqMKQF@&plw9l0))}=uj=hI@@63P2eM{{Z?iXL_1tnIM zg`f@i-Mq0f^S8C0qFMnQ0 z*gPks`^J*i?+e8z6oq_UaFX2(Yk!9<-(~OkW*{@)l6&6jh`HyP%snA8_n`aft^KO| zs{iD7@a72E_w503T0iV?YPW+d-rxL@O zeH?R-H`YaJlB>7n7gvJM%JR%vs+%(|%@)s?wx*m!z^+NZ_e<$uM zIMjZs^Y;3$)_%3#t99S*zpVT698hzQaG%wF)o~Tof4a~77k;bQ-ABBZ;Q2a>=N`If zB46ise$Ue`b5Ef>-FWV4{FYzt&RIUD^8;T4{&Rdp?upMZ_np;#v+g_A{S|liRbr&KjW3GXEyW+E3?6qrJ`Hr|0H* z*key0D7DO6b^k?c zzbp4ur2qJyQn)NUBoE6y`Fmil>G;-`?5*E?pP4V*-`nS%EO(}SxC$2JfakM5gr8QI zg{Oz>0&B2Rv(+j18hV`;YLq&owiBpHiX5r|Pf}~c^B+&*Oc{jFV&2T=&gl8`NAT;z z&)}!em&1dDb>K-#Jif0cd+*aj)s>~Bnue_;4h3p(zCCaUv|M!xzj%IS>;CcKQ;30kRL> zlP=yKxD#UM9fmuPpRsj4{rMMYJTD2}?7kL09K0Jo9Ky*amc$46xSgyBHBhsDv2j8`U?8+zuF%j0m!jUZ` zSy+z~W+(V5upqUbLya+?b$B14`xK%mOtEl9VG2W&0Si(XlI#IWgs9ROo>*|QBLmb* zYMPo*cq+N9EL7c63nrhL24`-cg~Q(+fq-Qp;IY`toJ3H7l2DMcgeeL_0t`kJh_oyq z%9_kiKQt*XF{2dZ@0k^YR%Xc4Da&tp+h*=6l&2f>pRVZ0+3~H*c{*o?yq(?#zggb= zN)4P~IJ!@m{!91yl20VUw<22zoIGdOMo`zVx5GCr3J@bYT+=cW(4c zj*pHGg|chPGl%W|m&b{J09~CVezy3oqH$hAjh}kE8yl1IUw``*hU^^%9t*tC@ASBj zSll=LXYMoqh5IylVD9t#4(==Wnfp5bUAXTsfl$c^_tnQ<(tURR%qt6pKFS5TJD}HH zvq0{4Z*6=x>fN`P`NI7y6|%gOyUkn6^K`-I+rJ5=MizpI%~9-^Yvew;9JZ+noV<0K zjiddx==4$uSP_g~i^(&&&-_=NH-DDy(=XPf`)1vj{+sUe+K;Xa|5f)ZqWe_m$%SDj zMv5&0_~G%7P-9JPD7&(pQu{;9+K++NS?zb*eL~|sVX6DN+AloUp}J3vBxkjseD_-G z3$Z(Dz@+n2;n>aNaOKWbsF+v@JXia$^T1i{*SYVt8XaEc15J}!!h*|-;qwPyz^W^2 zpvZ!fP+~dOQuKS-r4`}`1DyEkB$S;|4m=i?*1IqLH{2%__g&V0@>fCUcN$RbFE*|S zn`r0l@)qRkl=;hS%`%r`=Bv4<OY8-8ds_^t{R&U5_M1;L7ItHmn-?moQ>wbwKN-<5$5?pt#YLd_$}JT7vN4?5E% zsRi8m=?+`}FTef*eRlQ-uSLGhr>Jf5@a04E0*XsFEoM8vpI?yYOFipZSh;z2$*+u=wL;%*WLquZ5D!%YZk2W{EXrp!UuN zaO3e!wmr{(eGdJ14}_xgOLFJeAsY9c`OnbQelNB5JFENYsr`SF`;>d~vE1_(}phMil(|lZ3TRe7b8>Kdqqik3kr%#e2Ir}9MjK`9FoJadA!9&4=y(agQ zkUf>)-kxx{mlO_nad~$)=guyZA9jXWxJ^(qb$cjh8|Nl+V=L!-VhiW`mJs-EGv`|Z zYY_1bfi;NudSfu-E37{+%9qF&xUQQkO2gAxIRNHoho{rCfART<4}F;Vf8mXHcfDI@ z$y8d!;_%kh$I-a?L4eLb`4e>z6^^}F2ae=Z-~>5Cb7T4&aa+Jj-^9ZZF=hk2(|IXm8@P=<_x>RM?~>Aze*TcI6vg$t)qgu=>AwTl&mSi~z;(aV zZ!1Jj-2;6Rk3ig{&G265CGdW~&FpjOeeWQ&9q$do&!ug{?RvfMHU@1Y|2I%&<5V_H z@jc>o|J!>jyxwOkyp5m#cK>aVx$joSTgW@2flAw8Vr`(lZLkU6?jzX{<_qZxR(Oq?tkILtW(po$ zj5)7NHgYt3vt7;(nV;os|2h=t`2hss#F_qWzKAUtqBct~OeuupWLy%kz9Mu;?hKE9 zc`S?s*mZd~4A}k=jM_UE4t#b{Jj!opZk&ZmYoZ`fZw!Y(oRIiom?)Q6 zflW?=@G-jDm6mj6P0)rgMuiQb;J>Z{_^d6@f_{1Y{6H)+{y0%7hmRBV7_EaI^Ggim z;JW?samKoetf5N5jn+ZSa`;*bWpu^rpnXGN;I6?CJU0xy7WlCD(`&rf`ZMT0t&e`w z>$%#SJw~5Pj}i2<7fyIftu6~*Ykb*f&^mkt^fM1Xerz4yY+nM{YfG#u4JB8VVb9S% z(z?pxYiV5`bfwYC(ioO}*<)-S@;A-`&sE+~e1#_zTV4u0R(P?WS%4BDio#PVoIIBl zc&)&ogp^oT8j3D1$tbzB42CEQQ}kyz-jIJ@VOV%^u^2&s%Qvrp_snuoc&-POT8!ad zgem&>z>3ZHgd+GjJy&#YN${BOWerdcA*u}f6E_QUO-iN{_Pzz);4!rX2CesiCegV& zyzwY|vwzeR%F~V2{%j31m&@7yt*f~@(`()WpP6OY6*FuyVYqMgUv)nmCkK+SO(vn6 zA`L<;pzjjHeVj-jz4)xvvxz68FP zJomu!fgYFsTPG31dllS11Drq*Ud#D8z?OtMiBKjJUU)8eE#Y_)asnYH5ey9b9GdhB z-(9(H_g^|Jd`=Ja9#33v$vLH=;D8*Et37(%IWy#J{rb#I!I}QS%onvkZ`CYs=WO-n zs@yoy&e`@2@EBGADs8F)k=x?9=Nqd)w|%`J<%<+y4{y#So>>Qt)-;6*E3kgc#t-^S zu7{)hbf0Q3K@OAm{5*)jI!(1Z2+CvqC8yc@h5td+6j~o*KtI!K$WL;H>L;y}+z;Fk zf^PW3&|~J6c|Sb<0jjS`U{}(!W+}dwz6a=ie3HrCA%FRIg@nEb_;(5UMz5#Gq~qk4 ztoICBA9^O;r}veU&#B<+$SBnd^jdI6rEENO5r$%uZn^p`-egQodco5oM2YlXq~F-v~A=pof8EA{;*~q z@|ygl98+>N)qS3u=yeiuo!mWn>lE7_x^29?2@1?Aisz6w%S0uXmw}q=>%z$WqoHMD z8z?aiJz7$h*M5Zj=kC*A+?3+(FUK6T0=J7@d1|fwEDK@YDS^;0k}30)T8cSlQ7I_0 zs3a6$cCGc>iI{C8gW3G&qjIV{lm?FxF2r;&T!#XR#SNc7A0f}_`C^!VC=3-e#peuvy6owvDf$vpP#Lm0USk?!05cW|H216=!$`<8*Z zhmg6aK!2Wl=)#GdZQh)bDX%s69H9U3)s$?jVBUxD^Ng(UbfqV6e$thyhiVHFoZzZq zYNv*V>Lw}i@c2Lt_~i%lyZ7n+Z{b?@%wLZE43%w+Z_&1 z55yTfNsbmx#!9^5NDWNZAk{QG>G^%(@OWPsTe6>%si}$2(Qtm;JqGOYx$SBc3rRB)I779zKd5X(IBRB=^;JONo;N%}J z!29`d$r#4TD;d5A@(knT9=aQH4cH7hdai;GyDo#*+b)1!YmbW44&d>#Um$!`BD~dh zK77!1DP%*k_goFR2X2Kt_+DzHX6e5jKXVUMn064u=U(_=&`x-(-*(oBq{qD{CPTo~ zgHRTi*#_=_*L!b;tOIvKwvTo(J{YtEGWS>qZ**D)nLDq5tke+2$3FOICwz#{XU8S+ z9=`XVy|&`M?16HVQ=sgGWO#qTc6hVTHnu+EeI#?w4e)xW<&1axY=rmlHPoQ}U=V&D zTk@++|EK2`*081RD z<8}_feL>#uw*}s%#%UkXNW~?iw`ii$ve!lvYNAr(w5J05c^$ls$AULck?s=NNJYA> zF`t5gnu@f2d`C`1h2)+fY&Nd zJf5k-V26_~N3%CNWN-WC&pF!h$wq}`LF{UdN*J1ma12U1!Zt>Ne_{}{+t<+&OhzP) zf&vqYK*?F9A#_m$T)25rJj1WhsIevi{8j}(Fovf9ED+u}$&A_(3w3ulWFaSVV>Fb- zpin-s0t8{5AQ%S(YDzCM0ib*QnUHttImb_E8# z-Uovs?JG40=<^u(T6$lxp{Wc`Aj&TH zpIk5iGkI7yye41$)0K+M{Bh*=X4q01|Q=e)8|Vvd&*qHsc_f}x0@a8z=3#!+f6 z9=A!wA$R9@ASX^XvbTTZZjKgj)Dg;4-Dm#OpUvfHm-$N0PH*rg>+~`Zxiy+y(dWv4 za$gdPlLko$P8h6&qbHnTMi`@_4VrWZtq+9?40M@!FWt97o{&dv_jRx|SbJ^h1Np`j z#0j(y_|7g5^;S28w&> zPQX`qF=xqlf+nvtX{GZZc55}Lf#+WwzBUNYJ9@v5cwMO_82)FKgrYM`LYc+*IDVFN zpVmoE)A?Rwdjf=Qhy;)2p6nc;bAh1s(9Z-rUuYXv<3t3viJC-3mzIRk4G~anYfXsU zPz5}edO?Y0UQmWj9?)|;!hMO?GBIJ6h{=NiI?usL(IOMpSi*^eBNXsC#^ga_nLsGs zEABJ@H4eWp=zfWrUXZ_UcGf)2)gd$FX!YjgyiKf=jm+Vh-^ri4? zK?uk3h}?>kYV_V~Nm&?~I$D^6S>xx&&}d~7@S5!nVe2CCHBqb<(~{ixL!an=gWZjx z-tI;af;EfR@K9DmtKgW^bG3KYg9=!u%i$zc`cLNu)l-6M9XUpIJqDeuhu;a+x7C7j zs{>e_rSFWgxEykHnAkFaA0GVx)mGF5&!uHqZTG{;EB%=}IbL;J4M;$*XMVa|Z?#bTbjm|mR$=s6-f|gfwJNKkj_gOt( z8v?t&*e#AMj@85Oq4J603-={aQ^$}*vNTqXd*) z$-fWiH69B+q3{gM8`FzHDXhI^mYa3I*piY^WU&W3_OY9)GWRPbMnQ?i=&^90H;=Hs zBW0HQg7-4qPCO=MmiR)k`6a<)fhR<+tpf4ut3!q5!B7~pO-Z_H+o<;{)Yx=U`&r#5 zl)A6f{tVAOczzbc^OxnG_E^_3_k7sm%>bh zN9R4Eb6@Ab%sp!6ag}>`_R;4as(rl<_7z6(Tf-GiAosZZ=sL66BFjA3IYk+azU%0F zBM|2;p7^~(>y}XNFS4`*`wpV-hgh5|lv@=Dg|Xh#yugxqB<|)OLS`Q|^SH`A&fF)` zaG&|Fari}{x?hrVPoEEY?&(Oi|MiI;37P(foW~n;e`ANt@BKI_>l&Dw4W3PZAD&Q? zHKiu7t5R8Ww3b-vnxujhYLe1Y-mj*h{#;dn_YdHb5f4w3W8v}sYVgZ#^Sk%{_h;ZF z?!%`m{ozv_(;v>y6VLG5jS~~$*4AJ!8k^K;+>gs6P2kC~mhd>W0c$WmP6`Fy$Q10w z$Myul6Z~xU+M~_k3BLBx{up@78lBYetc*nA`lu0$>)cxj9`CLIPjFw@>kl`?b>m~S z9;4Z*G(C3*z~jAmKeZlyMl*bUV_a7}JlYk&w$pqq|GdZhE8}P5axX&ru{#hyt0vpN z$0@bp(e5DpEPNkrdr}yK*2Oqb4IZU7WIRl+0rz)>!h>DGxTL0P7~I?ahAh@=Av8HlRi*LCsXwP#t0=$Do~%ZNN6hKf7;)o}12zQ;s)S zL&t1}H@dEccl&LH5BhI~QAt-}-?dw??~~i?wbkYyhSV>9gximvLBB2MaUJU+cHR+K zaO^95{0@A5?eF!e%R3nSe}XUXJc0H2df)N;;GexV z!<&7#v8L;mOE+N8$G2eT)tgXhMhg6Qw+&Eu*w2`%l_`L^^5IrFN98JKc*8XUfU1X8~{3^UHof>KLLvkB4CE6X7j*GA)vskqvAT8NH9Vf)QptKNpS@X z(gX!+lZp)aO8|0Eg&IYzliI;^wZXc*H{_pQ7`#`MW8M_O$wBy%%5e3z`R^$H^86QQ zxup$wEb?R%kdn(wL-VATu>H%O@Wq2K;VwG+&BJe)M;-QcW^NfxDLmIlog9Pb%wg`> zvpdZ5Q@2h-kK|rZcp*-9HpQ}Y@erOr2fs^&wn-hB_cS^1Smp_}(fuu7Y{k#|0?(Zv z;PQ``VeE7^A=VPy#0C)PMpClR)Z1T~^O*;UtwI)PA;lLs+@C?&B^AXxJhgFPW85A;h1 zhQs6;ebl)Bs{AiGy9{_tD+T#_WrG|z*~r-`GknehT~+qGWf0zfC;B233GUZwblAIPvdjJ}2Zw&r8Sr~t264rREmpEqR%$~23pw6}itZ80uO#s%v zo^a&GQ8;?z7}n!WtR~L9FdII;`!W28HTJ8AU$eSZds}@rf%IDG4IdpIDz=PY$w}WU zo{P({2{pOh>rh`f@LdXg`{+AXi$A~rIs3k7u%i)_Sn36(R+M2)t36-uWlocSw7um0 zQQVfBPp}^1w(iFLjN6FoURD;yoE!&d@%xGP@mo9xwtc<>Vm4NVlFM+?%>H8^-t3%e zpWG3WzS#?3<95?$fBE1m*!|@mXu7incr5W`uL)UK2{wPe#rR%nwW}>O-`xsQaa-s= zw(|Ys8|*x4vZFcVUr-q8?`X)j^^5yoioFJS_WT(f{^|&%U@h;Q)C~&HD-O+fwPb%< zee&ihw*5cicfnWq`TM_4hIYFopXhT5P@z1!>zmeT_M|UW@l>b858?(*$Qxn;9bfaGq z#4V}@B^Q)tzc?OrbTF%Z^zTbjUH@}EjdOEAU^a}#YMD+b~ z>CR=$Ft^$HOs`r0=|-r&xfT>(T8f=N!;g<-pLOrqeYQPxyMbOLe|Z45<9SAzCv0s5 zY{T!DgWny3gWn#4<~v$J@r9*WS0p0xZA00yE@!Jb%7tPJVj#Q`q^%ZfL)! z6L`$`gc1wz++S3NEytgjgy&c)I}auun+%m#M#K7R8{o_TN8Ve2M{%z2|Dor!ND?Rz zA?|JjcP~_F3lw*EcXvVv5#sIycPX@#LZQXo-QBHz?*H?=GqW?Z*+A&&Ip_Pk{%`xa zW_MH7=y`^D({O=L}JDH;$riY6H@*w4bQItT7^~Zs3v8ivEt#_K|ih z15K8-5cNPH`SLdF+vBOGjv2gm7`zhwXkSuO1e-kYBaOBT-nMuhw@K^V$A<5VK+XKR zVju+{+~93@@{d!6=Gmw4XY#hl`!a1Uz}rzE?SuHB1#6$Tb-r1n)>n-rU&Xo($*n5R zE^D#!V`Lo9qVIoPtdsW>Ki%Ae*+0$`2eSh*LR1f=^*mbNW6JwzLsKOc*8`3@b`9b7+dKr8VH_`X+9dB9jL8Mjwt61xQy^N`V7rB9W`5m8f z-x^XtS_IoUC{<7bQ)61He5df4%%>9DJ`w@suXlfv)kbyI?ISq5qye68`4CSwHNc~v zM$1d2c5Qb!uCJ;mhm_6m^O2eO{qAo3`RXSA_3I=2@$3?Qx&Aet?&^!Dn;Xz;KER8u zjqqZ}SNP>ZHhzD2gkF1Fy!Ou**YVrEeR%RiUp(1R6EF7;66^Z?-X8pV^BX+g(F3ne zEW{s=PvFm=@8ge`H}LE2@A34<0eHHpF2qPx9)Y^00iJ(D-{sgmdjAjj;EBt&e4Szg6D}C0pi+Fh< z9}l;DM8AVasWukxf3~|1e!aF1zdt#RKYzJLJfO$t@$&Lo+}-ps9;~m2hwE$O;nyGH z#mNNxdjAlu?=HRWK7M_898XVW;MT@ZaC>zv+!KLn1KeTON^pp(<<{!@f}5-A{XGpkA zS8+B>Hw&DmNjMteFjc}{ut}hd5Vf1K3Fc$hV(glu@+K#bU=3f3vZI!x;-rnRo4gU< zpO#(Tq8;N4Mc&^1>*qWs(M zzoU87W|$3FjE|Fc;a~ENwf;rs@!OL(#AD<3&8eHPpRfx57_kx!7pbQla_gM>9nAXW zA!yzf`Ypf7bAj(p-=u<04G)xd;^rgxOkIsq!rr7v)B+Py^JFj1r&{BRD+O1gOImOa!RIv}i`58U?B4hDaE~&%sP~5oDq4 zAX8+@Xdf%jHSqhj>l>0y-ysL3IwqpThYJN}jb^l#_0G+3WW%5Gr&V^TkFB$Mqe6;FQGT-OrCBW{BKcY@j zJu(4R!J{m-rzaY>Ef=?<9({*UDyVBw=d$eV3VDgX@y)2jmBQsVZp#EQnvx4+rTuhu z52~a{M{#|!{HXv~BrgH(Kf8}+*)8Cm>W^(#zmw-e6t3R!eyF{;9!@_vBhLkXyz-MU z?n;~f?F@Ltdn4mSR*~1lJooTCzF5&3j!CZQv!%a0m$#dL;rmPa%P1&q>&0(SaB`{q zOy5?XT!mmVI$T@?WCUXo6*St>jM~N{XF9Ix0{cbIXuYZ}e);_uc?q!Xy!v~!?bz+( z2#yQIgl{Ivb4<5UYsa8@`iHox31D@N{v02tdVYxS?yz5z1u3Jqkq@D(hTruCLmF+tQ_N(F?VzQhs<9Yxbm&7xZ7td^YoS_xO?V{xVD1lLI$h4+u>fuf zUI-wQ&mq*~U(|wD+xW&SW51(qDU}Z%RKw!aOXMYmTlT>m*hM?y3o4kkmkZ(3OFa{P z;F}eI_8U8ig9oM>7qd#c^5BXHXIzrpsc=xQv-#-dBm8ttJ>suznTN9ApG1XvdSxmY zs5r`0@1^NvrXP6N>H+pWQ^~ zb=}~S?2fkUJJ9R?ke86}xVT;1WWu=Zxv>`+N3!H+`o;lc)yx{=V1$2G5N7=}N7u({ z+v8V{(Qng0xF&m|`En|xG-1+?OFOB+SG}6j_~t^jGU{T`mLc*S(=B30B-~@Xv4;xo zq8i`CW#ERvaEWolsxxckxu#poj4zP3FI|2nU7xdZbX9oJXH-k8i8W`|%1cbQ12+z! zMaD;Pif~2ajAnSO`K{Z}eXlzxtF$W*ub^>KGk7laQMJsP*P_+ASZ?&3w<)>ccAx4D z`vI1)?`MHZ-3=r8RP9r%)U(WFyZ(~zaUE%c`uT76J;r^%((h~ge%^k*SlLE|&PvNW zlrQ$%wU*Qoef{^>)P4Vk6B`i}9U?|krXSBV+*HoEU3qc^9oKY*e`X*WENLX3EA7Xt zKjGFh)!R?nIt9&hKh&*j;QGO6nA=3$DZQw6_TD+_wP)=nm zIv87|&JSEa2)~3tF>?CF?=R%Jg&Q9r`*6u8aHH*E{e=zkT+{92oKNvl!6&-w{ZHI7 z86I&y@J{hV|IGt&LvvFuS_uoeQ46T>@e(x|Z@;&8+@2S+=JYAMMH-rAI z+F8`M?`wHa_#X29lJAkUUtHf~O8Z6o9@+cIzK0*b&iAnAVXck)P9HXPUeXoL@$T@< z^g-)&ZNL2G->{0c&Gb`dL;Lh>HQ-&_Ej!1 z?(k0Y69*$s+}GbETHA7t#0{J&NZs_B{-}-r#-y6TXKvu1q!hESB~aiqd}( z+7BS@`$Y%Bd9)4r9zL*ae!k3CWh$}Wsj=>b|F2WW%<@5`)wjPVTH#sL`*@KT1QDDn zK`IBX0&P&LMF~x1wsCN34E0xnkM(@ZBRD_R1*}iV^PI`4f~T8mi_xP$UtBCN0si>y zSDann7dKbb#Ph99@$2~v^7N{2(YD`dTX?vmAD*nMffwI>iQn(5ms~M!w|7m&-Q@vz zaZs)E{`mb@yt-}rJ-@%ajR)I%;OU0ic*&zow>HPG*IwUm|N8JG9&YQ5C+lnD+4`z@ zby~ft;_u{lUfkF%Khw7-r?PQ-WlcO@R};^E9E3k!sWrE@{r=l8xUlL=+*%fj2b({^ zFSmEfOA5CaH+SLM>K3>~>%FtOzTo!idbqVpW@SCxl)1sIkhs30F0L=Hi)%7hmq}ca zxxBQFflIV+XD-TIpnA=i^W+T_&gB=)Sq-L^YuCeEkVDwpX}GyFF0rR!2ajJ@g zj*YONB4H;}X|k3LuqDKF(gu_swHl*W=|`|O30nh;5zA11!Ui#db<+v;8m)i)DH*FP z_nzR&-N%@?>_=D*$-$OWx3KU0P0U=e3*8epqgTone0y9qYI`o;L8Y9=U{sEeCP!fm$f=k^7dhTSbssFY;Tw zkb_g6-#-3pnDwUOc=jgTdLrGyQ3(U~oV|fXoA%@M4e0{?O6!-k110+BiqWVEJI~2; zrMBb56-2H73A<103wgddSKaAL@LvB+l;csX+R>+l0#u^N@YFa!CFB5AB1d8{lPxGa zNFfWBG9nBem?@L-A3$FBU}9(v%5+P{J1rLQWddNnjXh zK8$vZfvA;NM;Cxzx_=2XHqOHIO*3)nfjUBG&dz!8Nc6&_AEdj8D(%9(3&{E@8{5uo zljlf{H8o=0NO;70Va++UfaGhNg~V4ua26R)GB)9R7RXDaqOMVD6A{YtNC~BFJ@XAb zqkK>+w+;?zj*#EEd-j@F+it zI)a)^K2zI3jr>}I>O@F(DEe&fs|#4itmhG|o~W8v166aY)3iGLG6K04&NDbfWkS9~ExLW@T7nz(TiT%z4jBeymc>uO)Xr=xB;xfSWV({b_sMR~5&PTo3+ zdWj9-66c0#JJk@4*Z12WzhUj+wOD>&1?~IPfbahEduW{2l!|6QwRoVSK?fHTR4fFi zPys>&CCkXgLm{Ym2oi;ZR4j<80zW4+Z?D|`<_Agm~QPxA2yrEh3uxMDRcbRjQ`kKSOe>pLNn~Upec{QP@&G?X#vIypw$~=cl>y zT(#{yw-XsZX5z?oedv*WI7fu`lXs|h6u^7E}nBcdG{2mrPe^B{KmSwv~xRr?FelX8904g9d*ua!q*eg zGXG0#KD}A&`;^8bSa+WL0pFe8j=oF!i9mhN^}RTF4PqK1>8E6Q3B*mV0_O+AEz%RI2h-%aQrmZN zKT@`*V$;#h;#$2*`}WMY@DBGy{p5zY@kDbGcNc%nwr*G-3E?;5OHTG_BS9 z+v=aU$I9@U7K7|9*<@*_+&WbOWQ-k4Cf1=6I?(0N!`S08~qk?`{~$0 z?|t+_GoqUG$o^;Tk+rBBUmqXkeWE)UH+t*7qyAe;e(~z9)iw&rmDa4djCd7J0Jdb&ckax9w-~(uO?0>nQd;wMF0mR@x`c z8}u)0|8>4c@jOgzgYT&;c^)I*!+wW@(vjOn%Ks8li}@iIeK+>Q)ZNo?{Qe1ft~6Mp zO=eqh`G|nbVC0-sZ_;=B$!*NtJQw5EjK{H?>SfE~_a?$6-W{!0x6vKo8nj9}5LGRw zh8Qiav=cW^V8WV-nEmx^+;}YYX}s->*)kRmvCe3}t|R%T8~FOf*O*B)&5-3oF=xvh zTz#l|=!89qaE)_E=k;CihrAt0`->$QymSaAuA79_N7i8Krs;59=#FYxHFO8gj$S*8 zF)PMmHvJwx>wp^%avHpTDAhjFWm^oshdqz%dxEsSNAW)Fb4>akIVdfr?-AN(otx6X zR_lsRwfZfRVrZXH*2x%rk3IGMJc8Bya{1=vl>^I$c6)xs#?NCaod0D}1w4zj#mkko z@#?$JiI#Y^jrq(3pQ?QOi3vW|^UX&FUJ5>x;M485euQ7|sQcxY4=>`z_R)B8U=n`4 zv>5;TL-G;aZc$BrBC9SQuBjnLuF^lYnEwZPk81~WapvpscyNBJn8)qqt)Fm*f6sB% zzy0>}6I}i&5ob1!!Q~&qai3m)dCOqjUJ`^Cd&kl$^?~i<>j!b|Ko%Zd)gQ2ZcI6wf z?q}<3;g_=+@?5Dsrv2O11KGHDb_@Q{9DI9u^GDoS-3X6Y1>?nW^%6(iI3T@!ay_w@ zevkT_e|~%oS66?AyDO^U*IVj=$Y=M?;pErTadOjmT;7|4TPN1wRKdr%v7{KLP@bu0pc`k5ge;h95SHbNSb#Y7P=5nTd)E1o2tAz{1Ib(A5oRv`?8!tDYSqHCMz@I~X z?2XJIyo$BP^XQ7WFtdDnS@QqG)^t{*63xP{nKh5VJ1xScaCO#JxK00>*lfU6#%0^L-?q=y4k!Nm0jY&2L;SdWq;R$4VTe*uo|@#b>?q^)u42keH8_>j`1+-oQM_?8_3W} zMfBqrzo5aqbujCbiw+q-k};7sXc4f^TLrV;+4vxKyCGoZR

    ?EPKSjtV1-~#cei( zvfPH}?}S;;4AhO-stZ`##crbc>F}Sq(Gak5+jjI49Qwz>tZf7u&s`}#S7}k34x&VF zde4mYR0OF<;n(arO-3S`ep5J^ie!9!^s>A}3Rvq*Ta0)6rlahzB}4(SSkKUWl_7aX z@Ca05Fr$n@l`#aUQixi1pdQPCnKBs?15A;wr+-@U(Y@Dby@NARrh5|J`7j(MK8!+% zX0tDvRUf2WhgBTKuGGWAx>E158!8R3gmq7I_)K$0gT;+RxWplAVaQA^mZ*|l4ShDL z*YV=UhJi;5D2)rQ)3?rG{OXAaT);Q72u8oJ`{QQ-96{s0c?1OqcJ0#Iq1>eMczshTNa?^ zg4(FJs6Lt`HN`0^nz?a-6ZZ9dn2)i*yOT+Gw4>n0zq3htGqhXL!4R-=TYg|U z+^2b<(lmR7eK+6mTexjJwh_KF{ZVPE9j0!cCeM{x_ky1AjP}Nl*VW)EZD%?xMwG?7 zV@kp|%pYg(NyP;h;;ph*ONaZ-E~ihg-w850BupM8)>zorUr>Bbd0zsMOo?Pn%w4;4(rA zSGmA`llJQ^rXs=!4oyXHnok9Uj=HGLM8^_A}5JZ(=p92Ynv>sYothYEHos$HhJ zq2#2}u$fZ{o6oA(4jj5}IL2*NuYtzFX4mX)FrQ?J3bQN1E5aL9;;O?d-Ult0eXa{w zCv2DqoA65Lv$-GXTHPNcexC%->0Yp(;eZw?ABoXJO5=dFZhSpB$GBqZ_p0WV?apzs zGaRQoA?o{Rd5N^FLvBa0J(vznsox<26E$cH2c>urkV%g-LMa+d6%V3-V7-yI1dZILZk-N~I4{iJt&UXYmig60LoWv(0QCpN^s>*|P#Gk4FTN@6vP z-KJ`i1J)MlAHhE<5PRjbBDfdjeyiO03Me(TjQDprcV9Z2;?=J&(Yl~5TI7AG3s^by z_n#dAo9UG>Ve>@YcinwqH$vuBhRw7}7`1Mc?l+FxI8Ge2*myw=aXE0Zo?wfT6HCK+ zo-6iVlfIV-mRI><>7OP-yR^{iqpU8&;ET&?>79?mk!lz6FPtz;l5Y+`~PwV4GSr zaR60&eqH#{cMez(gwTX)Xp{F90_Fvw?6~()esV=roJM_neh)Evl^X}DUu1kK4tfQL zSH>>-T}oTAe+AseyTf;uKRoAoBXhqxYIpCYeejv>hbC!FrL#ulw(ih+1WgWx?HD__ zOmaiyx6y{6kN5o@vpS(#R1ICgy6?h1RG(G@?++`FFA}~G;fK-+_7=c-x-043U#I<| z^{>}HZ)dzsdd>2n0{eZiud(T2e%|`CvYsS)*1qa{`k1e;L`Ap_`5xaH(n00o_@1Ks zeSP0wIkO5TemBXmPv?Ua-In)&YrF?0?VMuxJ8>A=B%vv4q}IftJF3@M^xYy@O|pi? zbW2o=uYrqHgmZiG%L{y-|0SxVSHr3MYVpY0V*gQVVI8r)(AcVIS@4A}I2yQe5Imwi z;k(EWT?)F25#!ug>w}gKhWA`w1Vqw)oBBe&goDzSA6@~kg+8d7Q3EILsiD^SyBE+Z zxfNVzxWRdjD=J4-!3U`=MDS8CyFR|mZ%y028_G?s0IS(Hu$g6t*j;h*yMaU34N&3 z7ka;4->>xhMfUxs^epk0v`iw)i!WEV7MIH6 z#(j0){C+4st_(^}DUGl4+Zk>G%KMX`xDer8blb^_L9k!wfB{L zt%X~-I|7B@k$jKN^Zd7c5A&A3hbf-+8U6Yc-{Z=@r?&+v4YY(+ck^tLyP@Cbc0ame z)8|oE*ME2dBooIXqSQP{+%yEo7SO*}~UFZJ`TTNo4rfpTFsX&R?G0 z!S%xhIGouS*9xlR+2*GB@ zf3L3k7!Nmnf`9#@`hdICukKB5h=cLIIG!4UTYDGLPm=a;f6}^dem4TQ@;veUm>RJ1 zL4ot%N8rb3UmQvd#GS)xV9Vk0#q~XKeQ9m{_E_z|@0|V`yJ*`vyvPwp6TNXfvkuN? zSHayao$#;Uq(K)P?jBs)7vIgUfIZ>mac*sInkVHA&+eSSsoeUwzN7|jF0X?d9HP=^ zXt_pQU7~WOK+omHwQx!1V!jFosLc7inu2rGhZ%D=N6(q;w?q5hLhGjf^lC;h9>>@M z308O%S>f!80p;9f+5eAP;{^>$G!4IO_CW;x(L4;+1M|fwRS~96-2_)2l{$5!z*)u+ zrcRM?oU#E9ll9m$eA@n`4T4G&*XyvIz-%Da32Zc2kC(6-zg|#r+&WYs-W|FEBUh*f z?D?x-(QwWxlpL}ImZR68!r0Z=cw9B@$FANbgP91k9?5ujU>-^jU4k;hm*bs*i%}Y|efaDp8qHn>v!0n~7QM|7 zu=49W#H@o^r+EC6{(dgwR^ak|HFTS}^aq%APeGmVuXO=y+eI5_eyRvdZ)r~HAC>(L z%-Tiaz5cnVIBYR?ol^~X@;8U+dnKYx;&w8q()a!C_doDu_%fKajfDB299o`&Ug_V_ zXGqKMKYfAPQ}gi8-l?!0vY5yx@+1Z;F;CpFYFS`7uxH=aH$Bshd|Hp;SQh-q^?F>3&Lk z_Uai177P+$U6mBR>u?}q_N%Apb8$6#^=ORUIu2vL8;hu)q79?v*cf*z=!EM}u8Zf~ zVz+z2W5Jt;4 zoQjO0*0AX%g{xK_En?05%`6n{bF=PcF@cJV->s?0a2{@pT4}YU0(&tP6&n4U(th1M zDjm8hLdMMZ8M12uD~n9xvzc8&_wvumIR?Kqk0L^XQO^Q!R;IEX4))o5A`RkEuJ zLbIyEFD(E)HuTg7tZPQYd7%qJvO*D($u}Sig;%lOZ5Tk z_;nLdX`USx{G^6L51&6oM3De`IH z%@?(R(_Cjb(eLcIw6o#&a{<&VuQxm*Jmtb6NP>z6rFali9&I6`77k?0nMInZf_7wt zGEzbm4rK1N(BJcQ#{VyA-_(3lXxBpoaG^oCj;A7{mnCfbi6Y~t3Ln1bPm(tj8MfWb z8(H_YxMI`S9F_W(LuC$Em2iplUL~^{!hclzNe(W0F6kvsvF*6Fvo7eEy?Kr(2rH*n z!N>WZ=&tKIf9re^lm;dTp+)Y8;<}1ToBPc?5%$dbVYWPngN{dNnfy82BHU3qtqNQg zxglb={#unSGCst}uhmgacc0!xr!*doRB0ylm9buEoJswzCIFqdVIrz?0H(P< zYTn*F3|vK@P21Ga&BMhh^GciZ&0JKCtELNBXKk7dyJ-&ait#}p>2lW<^`PRKqif+h z&kgnw4w(DBdgHO{RBVUNuLAc49#jwq!Y9@b?h8H8Dz7zWZ=Wkh`))e7SzPi(35&Uq z@0!z1^y^*`KG=Eb2Qi=9lD$jFo7#yW*K2_{vJPkh){A@LG2Ih`R}VIf?c>qAU6Q-N zdaMogw|=x=c15Gu#=5|i1HYiTA-aHd=IU9n9aRZ#v)$o6$487@RN9(@Yv44=8NLhr zOzYhkjrRR%`{KTz!_`Xt%E5+5uJ$s2P`-^hkK$nMi?bJOdYRi2lJDsuA5qP|WWu;I2G{y?84ec`l#_Un9!r{oaqxT206T7GB+oaeiu{i+UlE*G-= zJ*KUn2Ae6i@Qd{q!H#ddKfL({R7oN5O7IrJX`i)y5lOyo$;qYohKltoPt?(Te89X) zR8@E`@`hiWzfSi{_Ai0`3`cm!_zHg{0#?m-H+=aBxXt$vm+(;9))VC0rh18>%{Rs$ zj$uwn(1cq&lCWufGdP7gW8En=VEy6j4{)344v%@BaGB?dux(-T684B!(J-bYCv}_WGtF&#v#f0xsJkP(Qebx8Wl08o?8PmRp zpDVtHVc)}k$0yYn!?q5S|0PVfYY(sCi{vk1JJU{tiXP zzj+)r<7|hyU#j$`5H~H%p+39sx_+WR z=aJTYHeU7-^s5hFK^!q82_kg_jTcr9*xrbuu^h&Xs+@I4yOW779%{m&x<6lhO3bkn>>xS zy7s3WuD)1a3u46TH=p9w)=xBiY{W+rTNFOj&_eKX3x}t~*9spP(M)1q0e-!0 z`t*3wsBgV-xB&a(LvS^}3ZAa5iI+RO;m@C?`i;ZO8wWCQYx@|yI4~8@_D;dCkLAnp zkshvZ8;`r1%P4XC`N3&CJDG|n+k4{v@+x?^vN|5Gu8yZaj={g=nw!JP<172(WU@Ez zudI#Ri~Vtb*JKffa{HZX&`ayPHtsE}f*Y$o#&0jw zvw&_NNW!HIcRW23CC>p~J-vei87*)=D+o6WLU4O)AO6{*{rShAIJdqZE@TGa)eY4j z{7E(Qvui)#!M^#pweE9V%?-l!ykI=qtKRhVXYz<=znO_^+s5Gj594ree-!?ZxA&jP z(;dtE6qjYpb@s=7?w1eYlr;XHW*oQ!asv;hv2)(h+>7RHXKG+~`Ugs0>6*o>2~ z9=BG9)mVv&M1?VHbd)FFAH4?e3|fW}%hj-l1J(w!R^r`(`7j^33h$3viH*lqBb)!j z37GdzMwy{YQI?jM8McDV@M^^GIEM!>)FXi0_y~q_q)r5^;cH;lIR))gcd7yF^OtBe zYdOrirJ-5Ww@?DsUw-`^ts>W=M9*}T9J~~66ISE&E%o%%35$1%QL=UBZPEv<(d%e_ z68xvG!L7$?z&bE}E6lnipwyrOSdS!Arn$ar(w2iT>lBNji+_^m(8l}d8LE%Z#yj1U zMR;n~CktQ1ZlwZ1`YaK!PRhkUd!)c}P%bP7=4g(GUr zN&wnNAw@>}SRvUo^lxXt)N+CGx`=*hDBU#y?=+uBx}MM4er{G{a6eK!k6>cVEc#kl zQE{R}$Jky-->HP-}8-<1x}xg6vKQUT$GVVj2;iq|)_J_UX7RbE>|z{+7NA9Z(M;0~WS zAG9iHr3+E}=J$m&75tuyJkc`0C2enN7|=bZJKAJ_rMnj5>)NJe0#TLqqBp5pJ*A-e-^KGu(#=f>B5 z4d1o^eqnwhWc4HC??**=A?E)Zm{^}b87|-XzHl67L&dWN71?6sYMNOkGi#FlKUw?S zXxVrwH2&ZM+i9o`YNgafBQCIo_GSIk_E1lt=wH=-9m7D<&bb4}8ZTX?)aG&Fj!@C8gMMER+K$}9+!08{f(|Me6r>RsRETP!LP1BA5!7#pz9W*1 zyq1L;gvr-H1ps3x22AMGfGJ%U2UF|f&!u9+ZM+i|8B}2RqrSbH#evdwN>?Mvv&jc)M136VNERkuG2zv~&XJ zVm0I)$t(0dc)zIh0U}_{>>>{8`A7L<*JU-(TDET)oTfOzXQ2~xp9lvkguTP)bLM)B zQH4rdy?-^FNWZ>ezNU4rU_$>KuzJn#M5TW3!=^X&{oT!i6}1KlksUX;rZNq}q3GIkN>#)0*ML-Q)5cVA%3u zaG2+Sp6h$bbKcy>Zx|2%7=N6+r(TyaX=f7L=D8s#IS9ej|9jK6^X0NH#f>SIHelHR zvCVnJQy;prqhT2bto@hvhexCb0+Is|oD_^5mo)+F!R2t6?SK)R)k_lb$iWU79mJ@) zkmL{qCkGqwiI=vaAE+2s4nQl7^{BLq_bwoGK`6Xqyb+ubjNMn&&|%sBW#muX5D*_A zJkS^UU+4nXVatZWW3C4-Ke{Z>A%C_r9gb6-;Lq3Lq&~@Gp$8^!nJh1r`;WxWU_Z+q z>rScx>$a2I;6BA2z7f9gSm1$~TUDK3zIPe*BkIF#uG?Go{iby)Fs13@Vq$%~{qZ*A zNM43LjW}bcqj{=XSu?)LiQf10w*14odl@(nvqkOHT7`U%*7HdE|4;dz>TmQttl^Pap}UOB?#n--erf~wB>KQJ(Gv@PRL{P6UE_m9pQU|<=9w+@0qfEM zu$gUxjpx(>1g~q{7gvj{h88(3u>1OM-3VK5+8W{f-SY^X9|%9v=(3}Q@3X*X_wly( zNzNzmi1NgSGq1nSrP4S6<}*pWBfSmYM;T>W$oCj~pW^r)t?o@}|9_-^@tO45ZsX)| zRrWn)8kea`k~bV!yT71flc!Nu*Zx>k5l^CQ@M2j_y!!Sth(Oh3a7ujL!ieSu48iH< zW<}6cVp9{D#u6JF;Q7X;`1Q8B?|t#$5>9O#hkK_r16Ii2-rF0F`zxyA#hOsO+&u*U z`cto~qT00`vvH2L&6k?NK}!4cm&bT{aTV^bYmSG@g7IY6Xp#SL`}x^joGfUA>v@&& zWNjThTwWQEb`Hazav#pugT1i6A8zfKD4uis_2pw6U(yy=bAs@AO&vU5T@!a#HNdZr zRUdHs=wh5n_P~=v>cR4tkFVosR#V(4sD}H?tK!}_J=6^9kKb{6O+TDV^~9}j2IAKj z_r-i|`~CS%JlGeGtGSi&_^5iY<8_Tk#vaaXg>xApxVpF|uH+MW5|?Ez<<-EYT#1WJ zj>H9-^GtRPoD)>XIqJ`tvodF>Ut>-)8HG8OQB8u+K+$kggYh!yJ*L-pn)=wwsX=%Y zRSAE@TH#4##V0?Euuyyt=RN;}fVJ7QdL^39y}&oLdZ*bORP2)@f>q}!8{sr*J;7n> zdJ(89I2c0Ib+DU2QyJqx)kZ-MQw@Qt9HJ^gs&SagL2CKY5*(;9 zN~S^^u>OMjGgsiB1M*R3_)3%;u>u=30c-a6$5EzFD#{F53X5SY@a~``7^}I4>!sTd zF@4GRXdAH#onzMG@e67690#l)&!^Apn27c%JJm}BJbQ_TvzEcEYYLi1Zq)^>ts~dM ztVbH&8(2UE-b$RgtqEB3cZkugwdZcs1*~61(R(^3z<0`O+|&fDgEPK?S?2_l9GC~| z5e4}6lv;=+a=_Xl2Ez-~fc5U<=cq9u8zs6Y!(wnAeUEf>NZN+qWh2J{YpqE+_(%67 zSPaM^vWYAWnXu@uB}1a00*^d3LKmhIh9FhKyibZmZ-rzHNv7##ibNUBJX7yg*4;N1 zrMtxAAI;~YM3Z?a(P+-ocWMkCOo}fLxh6c~Jdkr# z4P4ly^XM2p#fRaeuzN4<6{jS!sqeR>pJ9Y5w=rwRz-hjd_-r;)pDg|a_vGtxv8INu z917?8&RBg)4OqW9{SEDeX-6DSJK-2N%-x}$k}3k$*apIgYmLm-lUqfwR6VJ>E?`aG zkqobSo(PDOO#k2wgAL}1N2DIVeq0oz2QJZXA^5lPbH3K;7fD~BU9LKUmCaqx+#YbB z?=A|A){9%~0@nVE`@?y*vnYB#&;49iD0R#1hF0mV3^y3#qUZFD)7W!<5B6WA&%Q{1 zNB&%T&eKk5ozXN_KZ140;vsOI=_-nf;K*Pczoiy^so$qkALs<9*-l9LNex&JUp|b` znW6BU<0;GyzyH&?Pm#YnUlbz7ZPbcUaGCBR70k>$GDXEH;b`0JuH9Y0^4b@4QeLUK*PmUVCPU_q0v8UzbO6J z&Z;e_l|@AbQ8SZ@3Yi+2R8TM(64hxZs8Ee|luXt1s)8!%R8Yups3k}XMdh^0Dyfx) z-W6E)-B;@a*5NBhz#+^5fk}blK!RJW8yaLc(2d%A@caQ9MmI#QxLUe^=o04?fvl`(b0RQz=DC;a@YI?9^c?#sIo6di;Qvp>`YtYcS= z6+sS%K1$;NwMuvuct=qY5FZH7XiqHsK{Z_>V2!K;r!Xf>{YDK~xqxXA*FtP7ZVTPe zaY;wRX?|?Vx@UD4Aygn06M|@oLWM(=zl2;s=vYVvMNx%A1RHtT%!e1jdnv=S8s>?Bb#V{)F7ic(l^t;Bxf-xe*)TWU&oFQmd)6qp61BKXT$i0@Qd>k+kso0o9=)ZUk;#YLQ@Q1 zKU|(81+4XB>!WQ!TSLIg{o$#br*!+4eY8(uUGubSPFFNbZl()Z`TBPr;U4gc^}=U) zpQ&1=Heu}qaj?lZ))!4Po9e<*)_LRj#=4Qa=Wd@9+Z1n4$~MK%c{*a*2vm)%s$0jD zbyMIx%Nc%){1CJ#2;W~+N0IYEOYUd+Zx!~v`nTX~fLEPY6<&P#0Qwtiwesy54n3E%KJ`T}mF;0Y3A6;1%YD%zc^i5;f= z)%#Y%X{-}`=M-~aA?sg!{&aU#>RVnMT(Ie8{-olkr3aGa%?aUq_*(PA_t3T>!d3P? zq<8i`hQ7ZTzDL{l>-&9u-_QNMZ=x?oeLcz$N?v_*6;n1%G3@90;AH*i`f!eLM$dIU z#XP0)!6??NqF?q!doJyvd3(`4ue<2yPTo}m*0}9)a1C=6`v49(z2m&`-_p~o9U+S@3olh`;~sbm|AB3itnM%^Ob#% zb$8Of!OU-dn_5Auxn#E?z;8~n9PZHMXr2wzTobMhNBTGR+1Wf+ZMrR~Ie zrZv`|QSW8I;k?!-DIS~Q(f@p4c*{BU-V(dd?Z(vAQ^|XGLi~1B^SqA>nI9tU7s+=| zUN;%L&+iu3T-G-BRaK&@VAb(e@*L?5Aj#wJ7YMH=d;Gi~^AI{O6g~@lOoXQFdHz?v zr?uBwd(E2`n{>c;r(sag+S-=BdK@h*6LP(7PX3Rs)rMt&9CT~Zl$ zw{XBJ?OUXPwJ$ED`{PP>2+pnSB(6pKg5INTJfijLmf^Ugx$NKXzrMi3Ylm_F$^ksM zdJqq;9HhtliG8?zdK>nqx4@b75M0Tvfy*LDCC`#0aZymsz=iDUIIoZ;AqA?{1ZOj= z64h{q`ZngY5vQoH({eJ6sZxj&GSc$Gui<6d^@w#7C#i3}kP?K4QI+r;X`3|u_=ize zeM$04-oqiQ=>PwFt-+M~C7R5>BEr=svr(Z>wjo$`oG3G4Jsf20$FCFE$y8#-ahSRm zw&T{qM$1@Y%vx9r*1$?(^cqy8X$6{A7_}PZHN4M^T#a&qRbsTMV1$I_$d#}du@Ywe z3&>Qc*CP`F>-1&#XWtx@8L}MZhAqQ}qpARNIAHCSf--{^i;&fF=o0KWs~+|1pSS^L z&8NZa^92Z*xP*!*sbJ@T^`kKQy!P>Em-M|lf|Uc-=}TbNDG5y@zE%U)-+o8yg==8e zEgA3j&x7mOynJfuaC-0<$!fU7XHyC0T%tT z2st?ItH6P&79})Q(1)jj-YEt|fZ8kBh$KBd6N^EDN)OFr9j4wV(NqL=TJd8Pu#E!++3Ppf8X%ZV*;o8g9Pan*3}h8nP@>_`#e zBAb4%C@*}O`=vPI%#BBZ49gz|hcONaoEeCqnL+TI?g#Iw-Uyi;BG%Wnpo?MT9S5vE zvU`YN$ZMe&TIXs4RuXr=ynb+);UJ2hmRT)zg;LL~o~RpH*AN2m&U419>98MR5C5tD z2%HuGzsbJvoZx}rX+dzC?21p5KNZ&+QyLfET#R_n_eM~-egtdE_7pgdcNB$q%8zQm zdhF^^1WpNr{Sn5W9(38R&5N+9fk{c)Elv^KfE69licAw+glXP#bUOJ zd2fPDm(Lt3GKSdl(Q6T|R%laZajEiVe1UsqM`LE))nXhOvETW?g5yAI)QGPpMsL*3 zDnk1@{j1uqnNEd-4k{!R(x{lwK}AI>6%zs~Bn(g?k)pz*fK=4cKs=gA3m4AaR(90| ztb>;hLWLO>;I+sL0dfBLH2+h4e_0J_xaIE7h2vyLREs4|YYrOZ?9PVgL=X7Q@I%n- zAOy?|fcJDS@i=&1Fnr0dJB2&JX1X}T7FkyJiZSZhb?oxE`pwIXW4VU7c)Y*9xp-gtNe&10I2 zQAAuccU)`~ux4}@1+Y{^kl}ybC<}%Q1{pT!I+Q{|i=k*RLN@%qb4i1yFs0Qu@wWP> z&*AT22vI}bC$FC@M!~a&o98yy1+3FIP8a`Pfk^?h>;v5h)>)fp z!Ev6W{&Pql?Q`10KHOd$jN`C#v*t!Yr*EA`z`OvA+Mr&Sjsw<)u?^8Ur7?XkDS%;3 zOkXn%&f}dBI6DBrb4b^-{NX*r3zg@Fz=Qg&mRXaeb%||y8I;%45X4;8ubl8-n2<*I$F;55cb1g|EwZUWv8z4$ujeaediYgXOOU%daZ`4E!)Ykf~W(!1XG)G_G) zb-w3q`hKDN><@7Hp;T=0{(V0cdP-ZoXR!#Hc~pL@C9QM^t4A&!375&v2$~m!5bB2m z=J<=hOGsFV=%=d0Q}LwL;EG|)qs^p zu+lOf0m~sjhqv00fBF99aGK_Xw)yHAINVZprNCjPgXqiI5AoDxfeXIO`vMPNO8o%$ z9rfnagZVIXlp0kMGrv|xhw|ytmFHF#2MPFq*pFA#>k=;AzXY}uZQ(}!2Zy-qfpnJ$ zC>Rc>sZL^4u+k1)IfRfo!El`A0M~i+KKiZNAeAq16fz@31h;EXtd-|VBUs%gx``3h zZnNDm>uY_$T5n!Gxbn4ujr#sV{k;|wT74~l)%TDl9EaF|`gXqNDy-UD6eNR!^FVgqaEVlNmrb@m?@;+MM6RPt)l~aoLJ$xX52Qg?{ zx16rx0IWxZI~E^S@3zjD7UN5pSk1A*=*^?$xw7Yo`4n!GToFY30roY%Gw5$eh<(8v z+81P#zt+?-ye(KyvqI8d_3~JJz^>NpTJV_cA^P;dS%L7G?gM}J_|v`7GOeY-lkg3< z>d&o@($xQ&k2S}ft!l`B?#?;dACZq+;4OX!d!)eGf#Q191$!48`q$rn{|z6NSf`Tswi#DWSsG2Tlt_z|;VEP4a@@6h8#d2!0VaSeiw`5@lZXkQ#jsez*@wQwY<8V)Cf;z(+3 zoXM<-+l#BvSBC zw!`BC`Vp+hGMeIgPAG2Yhv3fU?zAqcrudWgM<-YI!MRj_+{_KZ`6M?SiSxz5^yWCd zX(C=}g4UY{b8vo>dda9?ogiNNtZayP;IAhO6DZ>cM2y`ipOyi^NPZ-Zt7#trv%}CWF`Dc z+I|#K;pL8@WtG8n?0eYz^Pr;tV!+yHM$Hn9W?V9BJO}SIo`Lc`GsLO?B1|2>PGAUB z$E`&r4Yp&MHLy__qawo8(W_BWVU&ajQ%9~c@V-pB5fWubtQ1%dS6BfHEyE*zrWe4hLp+)+*n}r9)qu6tg4HnV zk|@GnmoZCqmk1C6Yr7cKoV89Du(sh)w%sE5OjvFdux=5fRNw2H1*;)>`hfN811Qlx z3V!1YaPO&l#P8UZduS218g3)=(K}-Y9=%XcOX7gF=J-s!(>WIAebR|E4XH5it)Lxo zT8!Y7{I2rCzHpdo5BD%Pw9NQSS19$%?hEHBPWb-3S_E-8)jqWy0_XaZ0r5ed$l4gNq#xR( zwT9gkTYQ%CnJ!=*oI4oKlborj@Ip{npgv&TmJG+S_Ef+)B4MX`^!@RR#~7M71P!Aa zqDfq1j94`sZPMF_fZS?yMe0jju;H*e5_s+YwQw8j3hx=7@SR0Pv%<{3h;|(^eq^?M zs8DwrY)eIkC8&@<#r9>El(aQ-CE2sdlCHhiz0^orF2Yr(fmWy^j_8r-3z+GoeJ&_i`!wu`r)XTP=|_hXIM|Jh~D|V@QZxM za4rN|ENYHMaSipM)XH(FIH3aiF6%A!DN5UZ_B+}hK11W=Mp(2v#t_tUJ9+&CYR#`n zMY}zwY*t6h-FSE%&7(dL-=715j(Hu_K7<3-v~FpDkCvWD{BYTxghCceJQ$ z)7|`n7}?#u9D?Thp*{zzM%u5%S|{CiUD+AyPpbh0j}%JWnTQsd&C$A`wLV~7HwnHA zy@i%P$Zlo`R=7>uFcmITMEWQA(z2%dfOXSMIL@)hG|iPi6)tiv2b^U z;Q$u5oL$+ln{0zIo752$9I$>6+YBD0)t#5r>vf&Hc>*1?J0O^^0~g_kdhvBIVC4X` z$!-k?`rOZ{sMcO~W$@xbLSLQ{9{4ot6C*8;hw}_ReclUAk{gTbdCO3XpL3J zR?2gv{YtOAo(Ne$MelrH)QYKre#`rzLv9D5-$scIXdSAr;dMApb)bEx4+5wd)&;Bw zR*9g^X_f=#eyg5+!TYs|t0thqqWbtSr3DUMSFg_>_e~u9XZWJtqPn^O>gCTb(K)#@ z>?YZZ(f&KmtD_Y8`hIN^TccTAQ*od(eYbiba_{*)5 z^q%4lI}TU7TfnND#jA>+mSNvxNpPWIX4%EEqE$D`H9WGG0_l9~F<)lB(h- zO~82M`Vq9vZj0dPAOuDSpk7j4jM+FEpJjat*9Fd~or58}Eb>Rtq5ybB zdf?S*Lw+`oNb8-mmh$BG0CdIOTvfWL7Xd z=X<~}!dKkbRB5cOuTtBfMM`r7(Kh^P+Q(u9yV5vdDs`g8O}6@?DO?_fWr1zQ>w;PboVyXOca8e&KtpyOtSk)7|n9KCs|4&|306n!ca4 zZ_4**wQsEd*ZCer`^EJ=g}jf(_jp9RVbJ^Bp-xmS;VVKG2BB5v7Z|>JIDEpqg@0FG%Lf(uWcP;8Ja2R;=zvR))KUE$u=-Ko z+?rm`XJYVviMPoL6W&LU-0p@^xxbOW`e0!*bkFH#STB3NMcWpk#)9fXd%^RA@OkRz z7`bYM@clmXyo%|2G~TDUzUP0Tea6(f=yUw&^V#=^k*nOdcPewbTy2Bzk;B#Z>pxpq z@zSr+96(v)`Qj>4uquL7ZJ62=uQn<)5$HnH4ezyxZ~y@R^hrcPR0`TKwEht!&j+xK2F@^PRd8A%RpOM42t29ZWBBt< zBL)(?=@cMv1Iy=iGjEmSqZ;HS>efo3eR^AuP}ln&%THIe&vR?|HW{% z;j~&M8cw@pCIToaT;j#;!r7F%q^iQi!@5Hlro1WvoPqx{9W& zP;ulcRFEk@f?0|875MahnXYP6rk*&d~7(P30SuuMd|JdDBUj?Wd`Pnz%pl-YHoh{?GGHhd>>aHybuMj zawz~2u+CWqv(_B)v*0pni9TS>*#@((B2jb3 zYJI@U?`abapK(iZ^RZMca~qtpS-Qzp?+jQC%E7lM)E#Kz=Kc6*$0+=xYXV|6s|5wO zXRm(6g*&og)cl_NPhOzbxOBYJVG+!Gr4k&R%He5GQzXH>ha8^vNHmEdIHkX@F7)iC zB~DM**uNKLy*=VlszWs1X*LTb8WIhr|7uos@OV;uIYNZ1b{#CNY`R*mwCzDVqR!^< z9P5nQsWqje)@fv@7<#TyE0xTZOwE*Pf*LZ_$xKzJ4LpE~f^I9j=#0snO|#)eW;vA1 zly|fzhO8N+3xd|4Tu)}i3pxAM3%7H-_4Fo=+&+wBcaGt~%lqP{I(6e}!#T_Wqc^HY zr?~Nv>MM_~7;c88Oj%RImkvdR$?v20@?N5VQJV4|UN0LMel0g~`d4^eDy*I9yQw1` zwjAFAS1M|&MupZgX&Jh}DH?g#5} zR^n7w?J3)Q1f5UyKXl^|F3C68TDUa=6~~sxXUU)7;S2Qu%i!!maGu~uMTIAV<_6%{ zO?A|_2v|qi!)1yS1~1VYTpkg?r>BlxK3d!*{L#xt*n4>|zCQIe4qZDWPRUZ*;Iu(- z8bJl~bT7jDZ^M@haE8p54;AT-18rd4l}F}TqGFpeD@r<>@!b;*;i`4#GNY}#TmH&L zhGTy#R9_S-4lJr#Ed`ntxakhNIw0h}j03C()WcgKgx&BYBrl*al!bMFie-8_Ud z_s@s}A1e>9gxypd%-kxS!hM#OZ@aLK3h(W>r3s(DKeZj+lfCdkVl&)Uu3JeyY25O$ zu%BEBl_P?&QxoKHdq6r=ZeGU+8k8nRu+FOqhiP`0vPl!LKDbWBMpL-XaE8k)Cv?bG z?*uFY*3_SR&hs*Cw$4xspTK~yA(gKAV%8*88S&iel0vTFXd zEow(3KFj3rQN2Ftq%{-Z9Zr2nd;pqdHm3et4OpkHp8}^j4)BZhM$?QYx`1`&h8b{} zSqam=QAa8(2AhMQYfn@!!|l%F+h`H_0cp|}<2Q|!=Sl%<^F=g&hAnz6QSX?~jSps> zxN{tbZ&82vNa_z4d>aniY1a5W^D}+Gnl}(`GhE;i?v78=KgR8+nt*l1I5ZH~(_#UBuO~22G zem_;}_tn0i`h2(Rz(jbV*8z;hUmMyBsR>euum(t?4#lnS8sgLqQV6;Cx7r5bbqcdOn z=k$Zi3@0%vw0&MX@)T;o$_I2gp!HqIA-^BK*M$7b_AV8pgk5G!8Z`d5zC-(iOAjxJ zYftVvzYFyv>*<1czRc4R@{m|RK8X+F znxR>I6J5YMV)1a;PpE{DupnJX&+YcpTewPoPwa@~cJ%TQRG(apJdYDRX1ZbRQO$Mw zk8gw97#DFM*ln5%EL~+(TMg4J?(XjHPATs06nA$h#R(KBQrz9$DOyS)!QH(;3GQye z`SQHy`<0WNoZRFlcQU&>Gi&Fj%Vpe0*>qkf;<1(6_-cOiOaSH^K@>awxc115-G;MC# zrkmo+1fe`{9{C4#WE5i@TT$>U^WwBlfn}l!PNF?K$gTNTiADqO|R*NjFm}ohAXD3)uJzWqf+|1NS}q?^VG9pZZOn@`J$?@$MEV5<8RW!}mwV5v z?ni3>!#r%iNuQ8U;Qkj=VAQNbAy4@hD8{n;<>PI>iNeR8c4tGS=ltb~PKE-iv9?ml@`{XynMJEyG9;vcHkaI})9jWe3^m|DwM$hwi?Ivii3J2T*Pt(|uE za*SAOYquVcS0C;okADur8a%U&ziQb>j0AOeM6szz^i8UDUmjf4 zfF76Kxh~iGbso-owO+1NuRr^Spbn?=b9Hq=!)i<39+r`qE^qEGF2~QrI)C0?Ymf-z z?}e^`(TfR2?`rF2LuTz??r%xOpnG~iuP@}#J$##fc~}j0@S8(RTMsfjZ4V;#AhF+d z&**MULeoPV5oR4}#}Nw8x0%SoX>-V#d|@7RpFRi)edTeX3p#$kDmV3HEk_Loe5DL| zc|mS;JL?~3Te}?ZwuV}Ul@o4}FuBOS|GUZaaBkcff4Sf0H2WtOQ+Po!OvQCE3qB*t zGh4!8+UfQbr^7#(V-Ow?%VqV9q%2gbkDDJV)2+CWrq>@*%ElYgr1Hyq5|6O{L5eHw zam!U?8r8ZnCY+%P7TBQjr4u$`aOJ9cxVcZx2-3`Uw;KVxzgz4&_5UDmDB#0`S

    8 z$>2=XPKR5Zt+iw;g|8MY&C>gs(L~Ck2&z-^XsxFdpJr7^4W{doA^HxpK$#XkGTa~2hdf^oaLBO;{5-lY*p`Y27jUWa6Z~E)Xx9lH zL$>T8=W=F%ZbA`;fdpCttg>2@+hiPFMdXJeitk7SQ~xr3Qs3t)*1YD(3o%LB-6*9i zziVn8eRzM=-kP{nEKeXg^SsRw>09rRb1|Zpera-EoIi_O!_tN4M{`D9V?^7k>$|y&*hJaIa9pKi>Lcn@ICF`6C$)$4^attKEkhP z{FE#0Kn-2}siyyTSMi(G$CI2Xxu&{0O6PpbAD`$Lq;-NU@xsS6Of&?R0Xx3g`;x zk$(uE>8VbfEujssQL)+v;Ykt&50@w*Efr2W-7aSY)}Wp!BH1K`4-+(>1I&VMNLhwchu4>D4ne9z`w^k67T8YZt(Hb@n4zM_M=0_ zYXVGSP=E_fi0|b#%L26+LgeYc=a*SKkyuu_a{+g2(^MfZKPqtIXW1*7 z&NoN1!e*^N`+}1sZT(I^;BdMCWJ325VDi5)jC^FhmftDvCZQVO{V12 zlxOs(%IuD+Bd>|-oAps%i62kap&eY^{(AI<_DT!Q$W`mZHG>kvw*xya-p8!6ucT~q z6ZT78I$43ksCuPrME7E?Vv4Jox9&4QXlu<0JOW{+ak>I%NX`~0+>15bv81|*DII_L6eQu)^Xg0qb=6YMS<^HnhRjEFj)WF-rHW{haxA0&5CJBs31*z58)9AzBD)qm%s;PKp6s;)cHD%yRfMcrxq{q14Wk;kr4b}Cj%!WjD!hJ68?ZO%K^YN(2Mfh>C!02 z!a<>No(IoRBF;+vq53>c6UD3Hy~g3~J-B)CO$7hnc)4~vQ63?AN~nE{ z_*kMM*mPWb(*a@OqwyX*0@%xQub$T7z>1H+R-^SQ@DoVTwtV8Ys0<^Sh_nooiYvl(?i%u%eJlMH<$^=Xd_lhIp{hF!Eac~H>j0; zWg(LNuxNog=B<`4U;Cv<#3>yHQ^!?a*&xw`4q z$QOf{*-F+bqOx36MN*Qf*ArNAW*>A*N7X(7$0&6rORp}g=``gZfvOn@PSVh>Dqpv&q)$d zM7ELWCQ!anc5{Y4hbmlKOvm!?CjzQzV}?d&gyVP>nQC=y&9P-tF-(NvxD^1l#wcY zxoYL%GW4WXn5i(IludK~WrV%p&lxKHtX1;1n`x)_bjXR;Q#q`a+%(ZnMzpzqNvtF% zZ{@w9RO`sh{=K(k>PIzAOblyP0kf8xBx39&f$O>|!Lcr}pnAOaiS@!Ujurn-R(a`_ z=V{a>8ia71_(BnjU&SeohfTryc20}Ag9HJ!)4X(0Ytcs|_Lm-RCq?+W z*eLB}7o@_+0^|ZR>H_r}~wlUs_Hq``#>D z%;7I`+z5HXbe{wcok&oHe+=YvHer}&>@fAoAJyH9k^UFG8!dMy*C6r@*!c`Kx#J~W z{8JOvd3;qvQIf)mH{=Ak(=CxzLwvXm6K=Ai16>0mw13Yw6}UF-U5vl`i#6m{G_O=6 z;91)_TguA3lsI_}o`YiG2}m;N>OL92xTrOHp32C{+e8chyfiu+e+tQmdOxuT<${u^ zWhEoz$O#Bw=Ro8Iq|h8>DOTDCBVWeorJmAcWKKp{S`zbB$}TOg226PlCN)k*gIrQX zTZ|t4CRa^cCuDMkzdw@JB_@zyborm7QtePSZG!1|U);7^Oe?fOe2t8Z9EHp=@pTt`Jc1$UXXc{G*ZBdz!}2SAsV!2t)+;`h z`kU~@m7FF2ig! zV;%oL#Q>>(fA1}^)TeFk^VnJ|k6uYf635?;9c8v)ZZ2Iz?2`FMq%F0rQG0=jo3ImI zrUk6pa2|xxq!-tel?vWp_7?YJhKJ-}l-^XhL1&qM8E)o~5At&d2@@2Y!G**4j)jK` z2s{^bk1f9&-N@!iDN{`bgSei8Y53rHXhVc~+bgZFupVh8T?K!koXW3m%dApyu3#sG zQ4!Jw$ncA!J;Mi=cJm0w2BXzGI}BMYPmq%c3d?Q)D-EjabF+*vM9 zBc8XuZ)$S-$x|cR+!H;g;~e$R*vQkZatZf3^SX|g-KhVd;L$c)Vk{w8m!A{g5qPpc z`;+J?U+%UC%}%F2%LOsNJ60#t`~Mr!!_@Z&S^U!yugbGoh5Wp41ArEw68Vcp)xpFg zp!v1fD$xA)W+Bse@+5Ay%QWde+YT+aFZTYdq!60n@*c6_QFun%&VqS2@0*lK4N7en zBjEe2CbQPjh~2XsL|>1@g)Rvm1kg{XNZ=OAh0s1Jh+mTRAcgdIe;e#lsLNlb^KWRnP?QN&2S;+iDDFTDYz*znEcg@XeT31 z?zr8C{WZD0$+fxAVQtRW5w-{Ks0m(xruCD}Lq>`y~LlRs1r4 zo8u)PY~t>x>MNHTEuZzvjq^HWLN)7w z=+tHQVZ;;)1y9JC=Yz_SVDv-pivKL|yDuw}h4XS@k znX+@E54;zfYukT}%b&^s8Tj%pKNhUA1e_6_1=7E=t?J*tx33DF1x7FXQ_A0qoxVQC zh4Qe;tC&Sq;eA$#^TRY4LBb6hlxj=F6EAaBUZslTfG+GsF^`6dIon)ujVz~D4M#Sz z)m}ZtaodNirF(^gWH%Olc^xeUA5Rn~eWc&dt&FKbl#*+q!>U9NYB%z~7C0AvO%ZjP zs1CTqFkbMW$J+^E14yVo+!P#zo*$Ve-@4KgUW^T&>hWn=D+^p-?=FAeS18gj;<|D- zunrbLpQMs*Q>Cxx)33{XzJ99)X!!?W=gF_dim!$=V69h(^t;Dkbu#%5hTUy#x7A%# zVI-GmG)m-mz4)yXuFT^PL$Et%7B&HjYwnk#6Ypb?pKqp-&_u;{GRQ08@c1IjUxOv! zrI=8E-N`?!TE8D~RY+S)ei?XSg+lxhP|sKRLK_CZM^cR@R^yV#x0;B4T`OP};Cs(bx9%19}>Y9kd? zq&@jShz%~}v>AnF5|{^qaYGSxogGQL5quvDH~TUiw{IWFqB3^I3fS}B0t7MlzYZ05 zuy*7TMmvv-_m*?$c=-GBHc**F)G8~0!7Tpz5c0S{fYu^a4Xea9QZPO@o)@h;-6gG?7N@D9D^ zJmSR<<`T1ofx)OgOhMoCZ$v$KX|VPAWIQ?YE5?C6zvFj2zup;;n+XylS=Vk`86h{= z!tZ=>qcd3%#T;IW8=TcEZIUP!?_Q=l$nfs@TkqwWycD?C!QaVdR* zc%XMj_Rq?OkQV`WG}RUIHgF?V0>5}Vf^qX6#c`1I)qCzcG!A`{wq>QUr@kcR;Ja+5 zO^goocu%9O`391z5W5_Eo zjT5eUFR;>?g}#!EVHid>qlRbpru^ha)fh)ND&bA46vfpejW@FU7Wwwb>(Ba{Ws*(K zBf#YMz3Q(%54UsMx9FZga^m|@Nk{1K<0OrGKNo<5*wUWN{ErTyJaGO?gxT$z`c-Q} z1oK}v80FTAIab)EJ9)^(|L? zRK=P>dp#s+P6BugpX60aRsS%LSXK)PFGiHRlV!;le^vOQ9TEMKTjYIp@HIhR>B%>+ za#lC3N&>A2xO)05CZ-D|_y`2#Q6zOOST^eb}(neLXu5Xk`^3O5JG6_1YC|!1cXrkk^u(KY9tCdM@xB- zDOrw17bzQ3tGMY(#|PW*4zC~b+}G(7V{l=dH!Orzn+XtLiMZ79&Njt+4dZ+~iEYt* zdAHB!^DKpyP}}L)`rOh4y6pXueiZiw)xfdFS3J_O_Bqy3yx95cXq_NbD*4s{Zinic?#dJ}!j` zz!kU>Uj#ZsR_M?PJ?5RjNk=s7cdHT*Wz^)E9LjqeN|#UKq0)u<3^(3y+e#NS(uLeF zi#U`3tR&zf)1*wGt0KFJo0* zMct8wY(`JRKkW;1P>opaaJfj=;KhVjEyYO+JJ3dq0;FTNzFm)sixoTSnj>aInX9)* zOP@*F@%w}`)za{Cpw&xW5n4FzH{p@o{;MegsTa~OJya`k#{yJX3Y(YoVa8Zk4kHX_@A?U$ zf=W66!fTP8gKK+XtOoj4cVzu?=LS-@Q;S8QYL%M8%}u-Mk$`U8!|X*(e=jT1V)HrL z-79KYASTa0dy#%`QrC;`HwPw%=)SOy~`Nau>Bc<0l1YkjR0h zF;{p%KexJ~T;gtfhWK6O2~tv$v)sG-i_BRDKuxgTmG=a|424!AsFTf{qQk%YT;upo z73O?P-m;(PJ}jNMtVRy4{l^^6y4)?gZ+y1+jOUu0RS!+hPX?P&>b#Ca{7BAP3=YP` zLm{U3)>T{;Z|TpHzh-a$_B*~Sti>MS>q9-we_IY)hW`>j1uS2+V$LqBTn5KVWVT%h zuO_sz-`#aJUS>(JojR=ADa-=no&ts~Zy_XS)VJf$Fbc=1{}kqYR3obTxs6%7OdXz+ zp8&a1w*bfY-P&1kD(a@n<=+^UuZVXSKH)Bhfq!Q1-89xd`y1SGB`SwIK9|Cp9VWKJ zZ0O%G*!Tg|!yQ4QE7?!M0UM39r$}pa;5;)n=Zt5kHJYWWm0zN)_bgbImYA0X)Ew62 zhwlA_z2grp-NU2ft*iEjE&d^U>d$&>4SNHJVwn2%;_UU^_gTAvB1*vF&TxcvM+rSX zsgpqdRU!ar^@8jvm}l|!RT)IZboWfNe!&Ki@F$=B@5a&e>=`h4^I?_KWR&Tz1|ybi zr|r7EFkMnt{2as!H2n&axVs4&rKRLKQ}5idNc2ACjuc&bP?rAHMe$Q&+x6$1f%A$s z_(J5b)&ucTPb2?bwv0%wA}N)e2xE7%4}H8>Nd2q?SFY-K2Z-^tWhvh=x260QtEHWZ9zpuc%l?l)Z;0#RC6PPIRH+wh8HySq8=wK~7?H^yCqIZ1Dw zBHecF^~HSsq|qKeFT9#jg}4a_9cMn?sp9e>9fql3f{puyF!u-P@yiCG!ATdT_~pLj zTEV_f55o|>{|@X7nlae3%G0KK(ggux4#;x zKcmQ5Ekk{5iVpVSx$osDG z_XA7(e71t9t%E-B2y-LPguYk;%v|erN77RKtkdV&*05@SqcjLhBVRCQNaSu{S@_t} z*;pRCev1uVN>?w$B;Qf*ZtDg0z+BE~>n+GxbR4s<);s>ni6g2yN77pjK!U05&l*)# zOCYS6-oK!y${~%S^&>rwyrQ9wvq^fJ;mS%*K-8SGrH-^<_LfAgkXNO43&r!(Jki0< zKM$v5wkZa`7_DL~BK>scs+d3i>7Fd3cuZC%p6p`;OoYF8lmock4kEXeYq-=ouX~b- z&B0G1)zaXPJFXR8eqY4i|ML^5Q&)X|7G5>0X->+ZzElNB-Z*rWg@7jpUgd zW&_S$wBVM^&Bc1R^4eD<8gVga1v`CG#x#kpj1rsbIBW&mIZuO<*Q!VM6*<l>lo6MOWV-2{gt zWL(Y8TJ*$}@*{~=F6p%@HO04k;+!cXnBg~;pJ(~ejC>iEi)OFYD*1iamiI?r)6NIB zsyx3bUj|Xg_p%_hATD6HwF*9*YT~1*VTWp;#eT~~i367!+E+4nL2QYY7Yb!N8C{pN zFW2jwB!Gc=#Uq>ZJ9Q!kHh+C8D6|5he&N5R@-9`#nNA}J-gm;)S)Z{H$cfFc-sFxv*c>Ki0yU%n%@&m8|lmkB5QSDK`1f7E8f?GJjqiZ);2SBFU} zuA`}iaFn^Xt3=4?Fhrje?PDGUP*cqki3mQL)U{~c5o??j_S~#T936aE1F%mr-5e=J zbS(QB4UPL7A)CF4@Hg&xJJ7TYN)-X7QMG$ypBgUxkGiz)?bPW51r6s$7VimPT}5&v z@Z{vDV~{bhBwfW35?ama5^gnC8yjYUX76ZHy0(*QumWV zc=Ek>*4#T;JIqq2Qk+0d(P9&fPQbF&ZNS;n?z9)F1)F0bs!Od8;V_5Odkc)xh9>lU z>vTry1&&*9-)gbSzZ^nX2ip#xV@mOI_g<@j0zj4hC7Xmy#kRsE!Z_U=xUARzM>%mxzla>U$M zbv6rq; z=g4bQ+8s{wQ`?Rai7J>hqioBRd|oa(?P1W}8yj5EzJ}B-q)k|t_n}}+1p42G_FDTI z%zR|N3}Jg(zI%oCy&cVKLsDPGsrW0Zaj6LwA$Y--W&OWzFVxn)xqV7XhVCcJH)C=% z^XHWKJmX*%EA<@nhEOJ^lOre}oImr?F%NOo96m;iCI1WY0J{rUxvY)8{O*OYBjcCqMO^Sy1IjP-TdCMv8;}1R z`vO39?|q&2it}>E=KaPGlpBO;!RBYrO8tnhe9fR`C$r!QqrIfG*Z50LX^_$6c(iM1 z21%(y{ykj{Qb4Lc?JM(IILqYt^kWZ%lBYK#{!XExvU8Gp@pzu4W~FXto`7y2)9V8kU=$YnN^6s_l~(D0e)>Sl zt-yxqD$N@+gTb9fTGnl|EP?_%ge`m9v>M#1h6X02DtW0IWG#WZy7I^>)GyyywJ;hp zRJu&e^e(MPq~;Hx3E<7Fe(k#3ELS!^2COS2w`Z*|b!D!oCGa6Awqxt#sU5k-B)(aB zV;ySqYy5k|+x|Yb>m%qxcX8AvDp-B-aTWpUHxCtB1Mw5sm&`h5J`4ibnL3U+gsRhy z!H7}iG#x3Y@y5AG&YU=x@CsgQTe@*key`E6)rqIIB^Gdx7l#qLlghTRTDji|PG|+MBoJfM} zJVa=anRZ}3MVGLK;opQQiN2*?g@)m^s%~}oIa1_WM@j9|n|nyTP)MUtOnIj=^J?2S0O5Kw6$sV}Aut@rMcGEd zvlvhS$v^kgvtsT^dXuPS7Q^<2Iz7^mS8)zLhi8_M)4(oDP2h$`2cV!EbTC#0ji>t<&sCy!!B(ukG*_CG|Cjg^ z<^@0;i{V&}UU98$7{rZsI<{5wktPN`Gt#cyMI>#q>8uZ-5G|XG$N|Ca6Y#EO%hY$YVx_;Co`7dp0>7d28)<^}UTpEm$ zhgY)A6Iuc|)8d|=j;!#xEMaQtI4-U5gFNab9)e+L&KM>RC)|#4szn?n1XaR*Y^rtr zxf2-&CJ&}e=*l6rMptt+os7wvAk(GBbdBk$Hj=lR}iAs~Gu0CHVLzR!hvdfX)E z2u^$ZXrkTbJ`>W^=3W+}vnqs-U3T(o0Vs)&Wul8+=gUF*@1%7)Ye8H_NBZ(J@$Cxn%E)i~_=9@X5CytzuhhEoap9)aMuSBtqEe@kC|IWS>lQR@ zbL-(%#Zc?TlGo&*>(r9^{jQ4%C7PIH^#k(bPiK7JX3?R(`tH|du&pKDTkI5U+Z!&L z{yfla^5f4()#%LxX&+=a`|5QoUIsV2FF#4+a>;+;_|>Q)w7yH=?znGq--T2Nmu*o$!cio@Q%2rt zn+F9HBe_kt48@{z{jCtca0X1jZ#REPl~G=x^!+LOPl?td{Kr9PINN}`OzAi$!L+`P>>=(33FCCMxRRVkGrS|f`|;d9+2n3_M#R5Rjm zi*UuV(bFl9!n9%4zO9CIxd&dD#})K8VS#^hfNI)yyp%Os4+#X^nEq4 zDWbQ$--Er4Sq2+wtu?F%e^YWiv3z`_@4ESmp5{dLh)7tX`w0P4UTx;Hr4)^FJ4T3@ zIl|4O!f?_~ z=s}^2vPc^qF8t;4lt9oALd30jn;*19YezNbHe&{EaJByx(gQLm|>0E8-tB z+bDB3H$U$AW&Ssj4%Z>F! z)-tzI;(*SrMmKcKcSGNTYKKW5xG}4^vt7szTp)sJcTXKs(9)#H=@9=v=RMubX;_}ygn!xLBgJqcdtdx-3_nRWFF zF;v-LUOj?s&(O*Xb|!h6UZwY!>2Lx=JB8kXvEkb}183uXnZdpodqrXD??z{AfRI_J zVD2KEnzbNy0qFT3D%3$05fN`s`+A-F*(k zQV+t>dF>8s0NZaA0V-CWmYv_*o`lN1b%>qKVv{4)9RCsTK#&KX4xe?v7lH#Y?GztP z+P>+18V}sdO+Qjg5sEY6Se`ruoM2|K)Lb;lv{jV^X(TmV*q^C9F+qhHP}DN3eO0 zmkdE&FN?=)vEsXdlq^6dn}$N-rYF0zS^%g7paWE>gd!i}D^d9?sOlY>YByZg4*t&4 z?d%_Zk9Gt$cy62r$wNfW_(J5~hXRD;OU-qRgd*<65dBPJE{Z_ z>^V}pXiT~#=4+16{t{q{nQLl&uhp1)y}CJm(oX73kg^Z(f%F>};zfVX^OvTB&5P+1v2QcI zn|;lCO1}Clvc7L zSzHBv@`P))6dClphzTicLc+;VE34z~FvSpZYIV*{k45?KwUB+?jz6A~zbWY--?v5< zMf!uFxD+xG*T1-GZMh*xND$c|89_6?AgTAg8g~zo6DL~J`$JTXip4BQvL}?a6hlYl zPM}1CGC5YeyKQ&Grc{@UQKj6zB90d|{jiuis`}r&=G=$EDXw`AxpKBt_SCXUm6AyK zv{RQDKf1EyVunwzp9X;038>ndM*KX?e|zy~!+h7|imfsofyTAB=DRcu z-Txr?LFWH5Yx%M(FVMIylRr+dS9zIhi@H0MjBqB*ST<0hCl(c}xQ!d2R5O^HD(xt8YDZ?$AY@a6`$em9gHQns%e;U>vu;X$<)&o1T0 zxZxjRR2GR>lP6~3RcH}#Ku_DMY7XPpu=&F8r|vEP?@<7|Js8tUXo&iYE4+B#GJ1pc zX)L#}&1cnO{Fd(!a6}VJ07V6Q>Niy!x~Nh!)FFAL-W6^~5*2y*p;QtbRaN2=T9Wc% z>$DbB0+dF%;QT8QVnJidehSOwh!}K1BZ{$-ZKi$4GC$)mwG3qadQkJJ+hXr^y7wn9 zX!=oN(O+?^g-Gb$8eI?PHfUzD_}NI@9aro0@-SP&ecRKrllfAJm$ld#UC#LA4hv&33PkRjBh`#mcmhT{+a7_W4=9G(C=|6S*<(Dc=BM&xHiOA<#W z=g-}C9ns_R>`x-7O}SRw){p$U`J}Lkqf>)(z?l%O)eyAT+=VOiLB)4D?JAJIU;O<$ zCUmn_C(nQHNIu6FeU&TWEp|q{G50xmIn?K;tNCY>^RTD;VS=2rBe@iPfQEUCuOldl zEiQN z8?drt6>HAv-Th9C^xu2_Dzqg)+U-nJ{|25HFLio)lt`tYr{|ia0 zzIN05{~C0v6$8qpj(5kQG$Y$NV%Ra*>1StHzpiW1m{d&|v_h(7EJe}HR1U3?we2#Y zy$WNgiaUTljEN&Undv7jI+f}-u#31;JQ1E}v2NcS?wQz;TmFS96$N+Qj+fr8TxC7& zcQRr0iE7P&Kz1z)uCiYZ?l%=BRw7$Y`Z?W5s=~yZ-iY-?&&OwnyjM<4CZQ;64OKYu z#OuBYc%wJcv~LUe_B#v%UXM-RL7{w}tU<@1Py-Z9Z31=96l@x&I4X5)(Zw(9M%&DI z40ICWv|hp~SBsv}Pu()2=~Ptgj7U|D{C4kQpvddsCbLi~bq?5GNNe3Ywlh5Xu`p)qftXj^u1-RafMY8og%=30QtmtNusL+|eNf-nPzbFq{7czhP zc4+=VCBS7i@i13oJ}3)f8pnHU5T{H4Q={shZT4F>L003V?4F|rrlxIxP0iN>M?|&% z=$6|xvu=Tpiri=edC|2lipCGlQBq;y^#1uNR21gFN|>ttt1MMs+Y<^7gTmO!Co9Me#5 z9fH`K4e5rffIcR(0F5IV0s}TfYp9(whb3<3-nD4zgv{vYp&4I4=QPN*$PwSsC!h+b zMV10npQ*2Izbe;G>g-SQHU^#WIta=)_G@{s+I3Bge-+b~7IH`v!55Jd5s@=;(0jEd z#Ssw97vsEDu~U1=k$H2wZknjF!AGVxZR_~U(ri_i5VM45Uu$O9S|KN)X0!OFXX66n zxHTwoN#XX!eO(I}w@Q0_r-U{!8UyjC$zl0cFXh>;jfma$5 z{6t~Xy#6@EmR~(WU1~eObUhtYnD&Fe)?n3a=}p4meW`x@Yw7kg3=yqK68zL{hP>-x zs|K;7`5Y7hmJdN$s}Q2CG}@G~6#p2s$xtK)Mt-(ZA3|IxQ?I_p2i(#iZrc?NS!hj%1}&;yp^-(O-^&1$fZdM~s4U0*6j7@^j>L|ZVQ7v88P3pLk&x6? zd$ZDzR49i8y#E78ID?}>>yX?zahdm}5EZaSPB6tg@ZNm>fKUE{2zmr?c?iQwI~$vN ze7l>g|ITZLZD-0ZMkWHY25`8h-k&z{yv5BLCKF~ikX9EO4hLib-`qo6Y=PFVsrP!X zWR4;2j%V+CK=Z?YuV?=i-rZp=-E1@0pfGvJd&Yfsh(5HS{>L^VA~b0147HYCm2h7L zFG9MooUd;M&)DCq9vrioADchaL4C{6bh&FWtiNPU7brPLH}X(Js=yi95y$`ll80Js z-#MU%?^1t8KLV$nlR!Tolml8Hdb^K@82@(&z6$XR`}1>Qr1920Ih&~ZRXXhA-as=nXyM9Enq!!l`=a9%Mi9JCgK-9nAmI6H{j?Kq`-MbD4`D6!XQ<>b)+$SYVAvhjrm9T z{qTZid9YC*e6RqE5}jt9f2ZKf^ZfP#u7+|lvIG5SJ~r(HNkJZ>aT*5S) z*y$CsP|L%a^CmGKgQqUd9FYRQB2CSNG^QFrmo~^lQ(m+Js6jpbNivb7pi=bnipHD4 zIPg*aQk3p~3L^LsG!tkm?D9_`FYhAK*h|=?Z7AOG^K$0>&r{VD{cB1FlUJ_xW4dmY z1yZk8*|RHVEoc0()`S%Knrr06Hw5PK&>BPmT~qWMAbHKcO0g4_t*#TL^8FM;8p|x3 zLWzC5Y6kyVGD|9r+MoFa$xhi{{3IV07bB{#6?N5;o(eLie#pXZoD2+%>+JE&@=Qe= z{J@-`#T!s;UB=~@RS)N#&hpU;flHQ~_p!7D#&E0UBKZAM6W(wYD@4ZYQb+`s`m?^| zIn?{J7u-0j@o2~gZ^TfZWIdaQf%-*XZu%XWwF1%2-3b_Ku>M%?&!4kti(c5sCR^U8 z|COjS&aJ${apUAQdHzfN6(~_7ryZ&`C{Muqxfl(9!~%zA3-}!?%r>lw&H}c-3whK4 zWki?d5Ix`Re*w2o^#|=LGOw1%h$K${9RuGF8aTe$2y~1c_6qSB zPhQ)AR%S$p^)<=D8^SDp1vx3iQTkHzM5XyM>fAEvpUEtY5$Ll&x21<_46*{ac={0B z!YMSXcb@wk41cw~luD!B_?JDzG~W-7EXLGNell)r^Bb&;T=lJ>wT>jJ@$Ar5Jv+I( zU}+ESTNQ%NJlZs%*F?qb`_ig?SxMiwb`R)ffgtznULG<}$`#W`$|M%=N!#D3eJJ2w z4Ml}zE9K`nl>FRniAKQC!1JK}$KIwuxs@P>L^CJHror{sf08L(Tg@K`j13=*0Jfge zCW1R`Dt|`N8Qkaq9U8>g1vZd7)HtZ7M;M#FZj82HJkimh2HKGHTC&c@ z%lscx-yN6a`@LW8v>dsz;i_D@N4ark!yE~&9Hp75r74aaNUkg`M{ZNm+_KVb6pqb25Xq&e>kQorp+doyQm_SWzsA= z#~y3wr5S=b?*%*pPMZmw9R_E4a-WnLapE)!mQmz1D=dTL67YBJ$M zW}!YMtl?cCipP0)d*acm&by1Xw89>+?>D`tE#H&8=r8C-Ep=ITH@-BK{r>Bc%$9He zu?v-WMh3fM3{kc#m&NEj?bpAM?K6fLlFA7-_Gt$+nX<0_b*Rv!R3Nf8V z$@*ud5`Ux=2$4)T!LQFGyu%zMB`cYJWm8#@owfA$`F=Z5LiVR&joQuYAgA3XZf)m? z!6c<;N!>h7c`}Is!|uvm??vmkHGePH7D#swcfOQ5EzNEs6x*m5ocKiNSZMc>1MB_d zk%%q`zY~@{{iN#t3UK+Uk5Xp+%?mhEM$HQqvm$z~m zKqr-SJsI(6TAH}QFQ5@YeDOA*ytAgDRrogQmjJwAaHVSBSgc?~H}iY$L+^Y zkvXPP@&bUS6I+-R4V;uW&>YGc{I6(0^T*Z&mPGO{H9=yO=<(|i7BmH1D{t9f<4rZTZ@pdEwcL0GK(DqD|L)U zK78AwA8BJ6&h50sJRdU%owrNqwwk{kC@SpE%qHBYJ$U+C)al3)vQS8vLYGL;sN2tD zUz4RkB*yyvIxG^V!$TjoCV<+{G8Dr-;Ya(##;`RAi28D}1 zU%Wu)G2UFi(V-io7zkrVeTG)6 zHm!JhwV}=J?uXV7UUsu-05L|;UEJ}E4ib^uGU1plJf?T zPhbTNi?rYx_k=r%&%`-M0TUnIlAD!;lvmC=W~qwvlL9PniGA2|a+kaPvL=Or73o*@ zH+e3(Z0n^BcWjWBRQLSUK70IQmn(lg-hOX+o+ZU=bSLab7e5gQ%0_$Gr5*$ z_%BGGd0cW_R>nP;`iQqUW-wK~IF{#0+~8Ri2%tTRFw5uj8|fEBm=t)<@sxMo@=(l_ zR2Fr;r+2fA`)0{^D4)=~dF5@;yI-On7UqTUGhMy;tqBDsj~K14M8)@s#?mjghATT( zQ`arZrzqm;pFN%*h8}VamZr?3dVzzYlPj#{h9)0;t$W#5n6a*j=A!oz0qRuk7T{sv z@Nh1qi+?o-5>Va0C%=GZ>)tB8<|z;x?lNa@4FDt90X$_DLe)|#2xU$IoF#Wi_NL1~ zO9&8G?*(I|hiHzQM~5xLt`rP^S#K@iYUS5eo7v2xhE4+{eDb5izEG#@RkEC$d)6M5 z{PvH94h~k2sz$;s|4~&1@XH&5rKB6c<>)S+Gts~n+I!K6FZ7vZ%Dt66Qg<`}o>r&M zSpne9fMO~(sncIGhjpxOk?g-5 zg!(%S&(ll7-Z0Ixl>>!t!%bnw#i=ic%`#L4N z&d)Xki|Gb`Zxql!eE~*X(m(9eok!aL86t{<U(@=syAK!C3RN^$D*+s z#&t+h1CD(RcXoj8ed~=wH$H)=?>^Rb&iKim$P0|aJzFLK*#F&R?mj{SpSFH`ESja) zQK5Z`rxKU~7o5fU3xHQ{ki*I z)`i>QO?k`lUgxVNZaE}Jfn)Cao)vU~`R6!a5sMr%Un zFc@i^vyIM3D7<;m&LXpGPA2y8J4SE}ipyL5J z6eK?wO6X`6y!Tew$m0{({B=z(lBxVo<{f|c&x_m;-jYB_Qq-6{yI0_&>1vaA$E4hmqEGNm+S`8}=(j^m2Y`4EL8JubZUdZJ9 zerX>x^XIVo$&;BhYdq1PkV`n!ZosdR|BPtW+$^kO6@I!tn_v24{E|JY)=Ac=+oj8c z26?~p)h-HOIH6_HbXHKVzOCs^qoANlT`rsThCR*>ddg;$FaFxx$G2eW zoTj*`Qb_*!>l#@%iQT*>@8~M$a$2!0eAHRAqWq9HN>b()yW_sOERkV(f+s2L+bct@ z@XvZJk#P}hx>>zfrBL}MQT%Xa599n-yy>7XJVyj>XV(E=m*lM|bb>#n47ta+FOLv^ zM=*Zf616Zpec3Cq%-%7y$oBEYYXU;N_gx}3n$6>%Pf|CMDASlLqf|XQ^u^3nT7gtL z#Wflm(zUYf)L#SA)(qnGq{)AH(MkmOz(J2RYz#5kLu~BhKQrud@?JT_K3@oH% zl~bWTp5~lh@#98W&sSU9Ng_utEcgr?`42qE=EF^S;sqLEIXsURO1w;G#F0KgLEFwR zN2RAE4_rqPE(KEu1NJMbC`Xmg^LS)#qsA>M1V-m_^K+}vmxz?LL~FcfI*xY{twdfU zV!0FCH)s5vcbtPjDfHkb1**awqF8ijmYy&n>V*ccF;wJ$Yf91|0qxmuIQLWpf%fj# z*;6Kin^EqF?c1F%`*jxE2X(%(LWHmSVJQKrq2a%=Lb`Q513C?qmGy;Y(vc6U<`6MN zjU>>vj7|}R8BjS~odi+8AOv@Uza9BP?ijrsceynkzZxM<{^G4-D@DTRtekk%_({3Rot%I+s43)7H-Exj&#pEh#T1ih~%_pCBs&cVw6 z{&fgWLo%fy2V)6mf^^j<g6pM11cu1A0o0Ep)i}Pva zhPfGLcXz}E%S$u08^`4CBkWwZcU@d+?Q-(o^;y4qGG7;iN-5V)V_ppd-Hg!mNm`6R zoh#JlhlD6j&}2{VDlyOR=x9{jPOm@=Rs=ZZI8ggnKxLX1!RAmn z>$(H=Na4W%dMjhHKTu~xnzH1a^PJOBlmmh?Ok*E+c9dGV=eDY#;2&~l*@Na#gj9wI zAdz6IPys&@q+?USK8~=+Lb8vG@PbQ_274wg zdmUnfyEu)P_O$#&ld>AGHBzFWnMh6lI7oZud2h$=Ef&XTMDfB0ja6Qp6}A>|ut>;J z&gkyly53Bs;Xla+=}ixTK&}5_%2WBIf!(MndqgH*aeQ7pk}ri5e4D3;5145G2>D0o zy3)|_sq-?o&hVe?cYT(^W^rCzJ^0Ou;uKEH_u{H{IZr=mTv0315EhM$PY_(>V2&ve zH9FCG<>#@|y=(JaLfms#-NO-CW26PtR?F@TOvD_9i4cEw6>dcu6PdChK15!!Lp}O7 zjpvOf!I&1&xDHF$3w-b2%l%Wv-<4dFmE>2}Rn40eh-D6>(TP_C^npq*tc$KaCGr~A zczgplLFMvy9!@9nc0yP}a=3c8MDxj}x5%d!bqcgD2~3)Ebgd~q_Cw@jr3EhS2EG;9 z4;mOR#EUOv=e?g|IfeHiW@xD&36Ir(CBE6#TEuv71xC?6B<;{Rztp~l!v6v;j%UP4 zT0NziuF>o>NIhyrjKJ|>uP9N^$!F*>qZ&=-dKo(>gA-n1R4y&+(oZS2a^7t~Im6oC zgKBPrYF|93d1wo~wG|t?b zGe}q0r)ekoapuk(sw;TZo!6I_orXfKd;#``x%R-q9 zCTa%7&dMt#E)7h%2>$}5Q-aI=p9kdSj4Zb*wS7N)=~T7TKbGx|)osA)8U$yPgNG(D z3QxaMea-_p;m73SXlXl5(jDLfwD9fd-&4hRidPjNb~4xCv~Sz{4%}9>3BbiErHGLE3j0OiO>%bqle}+-G)5MjmvO+b7GYXUB~dn~@7M ziZndy`jU6!4b?2rY^zR<|Y@=^8^eki|Gt6}^w@FnNfCov02Spq7bp_~5k9x=Wa zd7G5KBG@kKQNy%XrPcm>P>TuU`ff``^H*U#yv$TzQ~c?WN3n(#OC!0KRkn{+-x~J? zjR$$Y`K$6<~MF@FL!J^NiI5Lgx{yV|4T?;j9LoTb3 z{Ie(fyU5G+0-ubYDs#`h-Rd0MIxoI>!2RgEL}>3wzKQK5JC8g|oFbo5*|+FO4uj~- z+FoOQ?jQJ5N45;4owypMLofTsyFB_8Kg)&eP}MU|pB*+Ta5LGvHK3-|q`#Mu(}j%% zj@4b!?qK=nAS+pAWt7ih4XIy`Cb%9x>|zk)oRmn(11g|-^uCD31KA=9Qy@Z00|@)T z>%%`Rd$HHh-^YBFBz-GwAHUJaWiQHRl&L2E!Bs(|NOHmAwJ zdB5ol{C!ShV(&cd1%kpbL|vzGGzI|mdjJL{3OW%sbj5J;B|xM!*glgc@-DlcYQ@T- zG2ao^cT3m0kDXz+4&!0yKTu~pIz3cI@E0pycn-Y*cOnXg5(&XG`=DN`ERBN809G|T zn6bl2#?7}c1zt}=u=K7e<|kg=)NMS_Olb!`KbN?^mNcn$x#HLUOiNg$VxBN~-_Lxi zAT4%6*y-zEL})bm@JaYSsPNw=9|=wQC{ImLC#D38rW%j2v*_I!g09%{|Lyc?-sL+O z7z64O%WfUhHZ;CQWp6T*w-g6eC*=9{>qr-9y9sB7dQ%-|(lbh}XZrA~v8AQpa+zU{ z@pv|Qu!;Jbynn%ch(N_>@FilU2E6G(W%Wg381i6I8&a94WxCy=Ax}bVd=BYRB+Y0G`oZClz#`W@Cn)hbr6z{ybI21R(~%G zF&AD>FOPR8q=liaDr>7XE~-E!w6L*W4&W~=l#O_+R47tv@Av8L(=TGIlF>eD?R%ecriinjDW< zmL7J>o16lhv9BA9x_TZ`@3*HmAyyBZXFn!m$Qm)Q(ww?c~z1bw700{`VUz6iZ=cZQ?fQ|rxV{GC`2 zs|$mH%G;ybJL&Q;T$tp=;|w40=@wsLrC!|57WgyHnoh5Bhnd?y9>$sb$8Y>mu+#dy zZ5?vtKlKP=w#uaht`cH5Srl&V}wt5J0(`*7xfWafopk9^QbOc>x;4A%)h3xV`sh^xYXqz@0;AGEU>jPg{Vks@8pP3ad~te091RQ-)W|w?wLCy8iu)CSmD($(U)gK^gGOgPSp{+=Qw6*Xks0 zcTV4Fam`-`ORft1c#vqT;og##lerADt3AuGGb3{`5czc7HEVE8x5N6=t*=>-uXtK z0$t0bJSqM;sEW$SdgRA-c}Z*D`&A7tCw<9G=?07MkFj}Ic*5?)-1fm2mX+ODsAq15 z1Oyatq{KfX*bkjC#CvK9RH!ykjjjG*+FPpDFTnk}5oU>ugqKj*w=O!I^XpOWurnjOW~nf{t4}40nFTe|UuoQXfgBj=mX7;ZYuTzS zbUyThfyYS2pki;BdYzstx_-O8>RE&7PpNu#aR+PxgXtGFp6Qbd?!?PR@}(r*w`>y^1EP(k*(j`(!;2`74I*3 z8@=kgz;k;0>RyYj;*S_Tru51;!=DVrN*))~*n~L`focL)O`7B1{WX-)-Dn9V@kRrx zx(_R>obsxPHTs&M5V$(Q^Mlrn$93JbYh)d|9Pss={G9$i#yEkvMsp8v=3YcEfgEoA zrg2~mQO$}}*#u8#h1neX6}mLtd0cC&@JIs)l{haw+0W$irdk`i(-45A zD0uNg`gB|N8fSTPlz>=3thGity&{M}H6^kRQT_CDTPV7~Rbf#0Ir1K=otqqWtN>Kt zP0iE8!QTV5*%q76XcX(A)A&}sypJD!_5bVm&_>(-aL=jb8hOeuEwEbHqV5&@Z_TVw zAgM~0=4`C!tKrc^I0j`xo(Tj!CAyP0P>3lmeEX(WC4lbpC`JiHUZ5PGsOe$=VwIr3 zoOe0eDz^`Ql$Q-p$LIvag2R52T6E~L?`{Ak`DEHQ?4&tZk zS?*42Kx=mzW~)>jrnOw@JIJYp|56Nyh8T3}e z{D-_UsmRYNBF;RQe(!d}seMASbK=2YBKPpb@xfU14)Vp3&fLD$0;_iO;+y`dRI)00 z2QwacagyFt_lz)ubJ*XT(Q?zGeqTY;O@YD-25z_L=nmMfXw?m=m;PT@++U`=XM2+$ z`6H*iAKbyk1}PD~_aaM1eU%SVB$H4i4!LIK_O@TvuUW)wxEc&8NpMJ7QiK!h2!x$f(rg`aUBrs}DCbPIipEoBW7<&-Ps#}PQ`3EF%sWZpznQW%7X092%+@fLV5=OQoTQTP- z*P}u*W|sPVzCG96rQ1C{3}7>QA^paA>Ew~RSia&dF1|4l2>~In{3ZLt82iUywu6L{ z2SYRn>#vLV(b)p?bzKy7LnB*Ba$~VEGex8yhHqb@DTbdo*#sKfpZ1#p*dqkh2I!?* zI9sr^HR9TD;^<5aVVGV^tZ2XB4ZYRqL*{O;NC-sep(jsZ4We)umLv5?+{7F7&zQF& zBUri2r>vv8X&JlK#B>Ydfbq?CozSaZT*zYuM-dmAAV+;jqiz2ZTJOl)fswfxORMk_ z1(8qTbqr~j$pQ3YO7x~+ffgd3V)Ot*T~|B;MbbfxLQ|3%yX^!HKdlSP3(<2EUxurL z&L;?o=1P!(l|zu*UTx@#Rx%KI`uxzf9&zp5(CjXP@FXlXbk|F-*<5PElBfhQ0tDP; zS~QV23nz(9rbPRJ7I26@n8EQRA<$$=7#}22M2RM9GX$q|^pc+CC-SmjbYe@O*b_;i ztK@RcqWxK!tk8Lr-L&cFH!jEGQXUb>IjltYL7jQ?WnGHMci?KjVKl9N9XL1VB#~F2 z#sLo?ub6jjRH9P#UyvlrQ}X za{r~SaIZXY8gx~fV|))>lxKdL_jFpN!jQn*T+n{H?;;Fi4yL0Tqs4ghOdee)aFwo{?+evPJbus z)-T=om>zj70w)t}wz)2z;V#guE%(whVjzX%J|<ewj z@D@DGZyN!%M;!cJUW57j;evzjysr-ltlH`Ry((Ek{IfRMADTy*3?{7Z$KFWa*c|vc z5U7EXo;M8Qzmc%PfrjQtEoWon@ z7^avCrD!(Wz}lYz0%v)u**L*x?QOZmZz+8*{K=#sqwc_S@zbti@nu1QXtrB{ne)cc z32esKosvG+b(&i86i6yqNS$JcK`0(~mdKkA|2UhE^|*|tm59U}e;0E}7K^mr(B~J~ zpM3stA!ZB0&|H|TrS7>e2WleDA{#x(_n$o$S+W1vgr#v1bm(0`2>vX!Wz=v@PIam;xE%F%K0YlIME-oG* z0Xp&8e&#oU*56x6&pY-T;iW{9&Hvre!OLan-#0bwD<()#b;+<|FCl0m5xv{~hPZ|@xprTN9zY5pM=inhA2cgaO)x4zBXFXXGv>u7DwHdt zm6P$n_P<3DfzMO0s^p1FI6_5us7=mj1^h<%ch0KNmZ|*y@kaMwnhK`XzS9qWu2;6d zVuy6}7YKXVaQgnryU~4UPg5%}$CfJzT~tHPo|vM3KZ((8Lrdd7d6uhn-|j}QQax_5c=m+{~j+n=kgvM+CM z&bwp?Hd#0t73H`KmgKnenJe7VFqbYfO^aD=73f=t{IS%mt@#7b)6-S&__zRhXN=YT zYA)-OW*m0#7IelRFQ<5h6+gDn7AgMMmE{yB=(yylSLSZ%xHciK0-evbgYc&(STHa+kODdpz-@7tM0kmHm=m1r~drGe*u@$lMo#lnEOcBW0|(B%1UB z?v7QxiOLj`U^TNbRnd5e>`8sNKarJ_OO@cydYcK$Iwf|F6es~QR z{#;F7iO}RLq47ZvU9+u2RI}$q-I$Oex8n|SSwNpIZua_dh;=4Juqk;M>D3-WE?gE! zWs;Mv7iTbaI&QTclNqM-pMdA?0;iOm(oy?Ddsx@Y&GF_hW5qOZ6r>YK0R0izr#z^3 z=~aKwN(A%Y4W;FSOcfWIK!m{AKe!C7lzgE4f}F{J=%z$3nmeHD=r+buqBp#hc-l$B zv^8AO#FtdL6W7MW&LY-U*bLKuu!#eqH}P(Y$j)= z--q^c2*=tpV7)aWM;H{IKpb_^9L0%zr@o_k5%1Df0P;>@3i|^-IpHFn;|*khMF&hR z<+(OF9>i<1pFykZUF7v!F_lQlb9&wPzV1Hq;%k&|))UmRirES@BkdRg-jTTE{hi2eTsYgZL#AyaUd-@y5zNcOt#H*CpU~e{gW! zz}-keb2AMEsXXUYzq|*xiap~OvzX;DqdSfO9o`qSiYpq(DcZ@Lwd}ZD?Yz~9z?ei6i!7gvqg<~7JBzOQI;X-&9SFq-y-~cBcpf9Rrl-%l1;dh z7xby8FXB7Vxpi~|y{fRiE&dR-SEEk|+)_IWZv9E#?JdgO`FW+$q0I+Oe*oXv*uIoT z2|@i$a3yptxH(f+;QfKLs~bdU!{5*k^?Qk!fCgHfXszj2c8I){kUZEe3z>#Au>?}l z_~ldo8u0x45Yc~yzWm>x{G$u^EGkTOqT|5e63>`b{V%-ZR~_?LuOh9BgumG`dzO6~ zlUEn2!VNOlu#J!0>1iEizvEn9E?DsA+?qS-;$|D@=;HO&wXt^Aw-i_!wVe(HQcyWA z*|CAD)EMCP+n4oUaQpf*Wh42Loh-V49@~i;@KL1=Q~ArT&}~Q~{beym6>JtP z;(9#ZNyxi97dUv5uFR7nB5p?uz9p0Xs;pBR%+Ui|JjkPC(^EXp+t{{%m59-xl?#FgFwLTp;6 z$2h$(MgO*pcZ#WBT|DNQ@l#vc4IV|Yp^Xz@@Y%)$n_>y72HMhZplS2?#+7B*^MjqW z{F*Ej%%yN=vpa+kb6X8_Vbm*^)x>6IH)HBr18+Z+Sb#zVRy8bO#!C!&-Lz<%-#_Pu z6H_-fUEM3%Buj#j!l4b39FPvB0e%N0d-%hR`*?#rDH-rrKz=|1uRJc0QO{wARDmzu z)&h^qk9U=sj{i#zo-s(95*g0C!nE?ps4`QxCz=mL)JJ{e|1o*5P8hG!n56ELFI#xX zuswK1x%U=xBwK0-D(}`%~SXVm3+~_ny2IaJR8pY)RbE z;ptZj_+EupKGx`<^JE$+ic{O?7l@B_m{F^oQUj{;A1~$vIxqDQqxj%92Dfj)*b**c9VZ$oq_7k z!z5i1|5B!2jnjU%-2DL;cDIx^Lmzfyi&tXR{Ky|19*xiI~9 zN|-1@HOZ&rL}DK`XDN&U_UzrU<_KB87jgGJZ)xdkqC%^H_e5CxcKf8NkBWhmIVv{a z@;e?msAEFT5WaviQ5Shaj3tKBINC>WSm1lCKS%^Ni!-9rcQ1x_Tvgh$lH)*LA6il$RNP&EJ2i%BA@oD!7V`BHwd&(i+S8M!gkQQ|VbG_92ZRFFZmBMK}8{MK{q;&%@c0Z`AvSvUwNID>0UpwWhI~ z8aIzUdqKOl)bb4HaAo)hr+C@RfcAEYLxLgiYA!+YmwJtPMF3HwfIbAG+)R9)Ms@(; zJZ3zX^Iq!4i$Nq1!}9<}wso%{B?dKU?mx?LP5*fOFl)Y2)dW$l-i0q4j4>gpmzwIDb25-S4+}kAZuIp`g@K%SB~#*XsK54yfuAtp}I72hUo(?JpCD zq?g$zH-jFfl~I%&KFRE#kurOv-ybclvU4&mUSNicf$w9)yZw3_MYquR>}NvYjJv3- z%WGG@kdgzx5_P^yQ-1m6e!i3t&>whIZq=|cawDih#7yv`Q?)mw#k@zgu8D>WoRN|A zeGKABn8$3MI>l4%@UuXMsBG_=%F&j1lKC2c_3L9b34^qrE%v%H(Vrbi-60W27MgxX z#GM$VYJfP{<6sj~qaiS`L9tS@#Yc3R{z zE>qQpCz4K*C}2?O>q3^MmW-!@u`Rvo_6L~w(?Nt)@&H+oPA&=4;^}9h6__=dbHtyZ zM*tl7AJ|I!_9Yae4~_@W?mzUd6;FSJ!}h_4sDXRVPz{l!8wL6a=S6?0MCiU|fYDB$ zn<+iWx^d~jMmHyzc@z!#$Qm}`Tx|_+3HtPe)K4F4VXm}29)Dx}^+jIq5_$<<`)|!& zdSEu?3;?Q~w~4$*Bn^}QTebb)sw_w685GgxTPmL>&&KWrNMVO@&O6k8`tH+>0@7@L z9b{t~qB6c$APfeyFl|4P1LrczzZ0o}AN(0foyEU?U<;LqkTd3bftE>KGD5j zrpv{%L;AM-H@yq1w zFrA8VV9>FeD9dj_Hz7FN@U$#gME@SY=KFa|c4ga{I?+iV^7FvR6Y-(Ho z*#5yRV`JB~bn;E|jerV~n}7r5N|gNd^KJp5ds+64J_rS4Zs_@hWreQfFimdeYvIx7 znJNk*;@NvnMYCB3Hr?;=tQD-}yI5(I@A57tM!0sdaLhjcb5t6eRrG~2)o^1brfcVl zRJ(I;BrEBy1nsl2Gui2hiThZ*jIceq9DDU1f8fUdda3^iOipDrBF;K$sVAe|I-$(WNkYQ}w}Gi+tJ#>E|fdhV;9tg_6L zQ&S$StV0yPL zY7~-Boq%Gk$3txfQ@LaYaHHm$rd+aoUDRh#_`~wlaq2p>-A+Q99Z;r0lcu!E>d9e} z1jjzvT}Y^yL`RVp~S&V%-S} zxXn?4DB?079(j@DV`vzWk#2~>0!Uzz=I-ab<8<~rHHWJ3f>=6pPhfq|IR@>@h6}g#-QcvhAxMKla;)Zhxw%s{BUp36yb3%%Hd)b$;tDZ7Od2j!?&8`Wcy9?w;J}| z|JoBA>Jh*5>w~~QdOUJMuu;7xxAM-o@oj=z$6XFbCx;||CvI&JXhr*m!iu(5&7a^v z@A{p0vnv`y7^^r*_ZwQ~gPwuH1cQJlDLZBJ$wK!qU6HXRE!yfs_=xg*7^>BUTuP?& zdrVtos6-3yo~frl@qUXXDb>xxF#FUQ3_Wv8zR}B~LsE#~cTG=08+wxe9g7Q5+?%uG zo=dplu_VWh1euGwzC8OAC2;CK+3f0im3Sjay&5BDQ#z&@Bn+B;4R|Mdb-omoU5baC zzs&hA4YpAR&)9fbY1Kfr#8`(W1U6_siK!pwVr#R&UqXV*?2A{Et;<803Ima=#WFy` zD%&=L$V1u;_*0Pu91sYSSd)Pa%#zV_L*m}Y^@H2=jIVmW{xo)twtipn0$AoXBmV~v zivpoYoo8mxLWd_#*1=i+V&8|;c46=Z!OoRJpsK=`Q_qN?kdv?U0hg%{Z$_fa*oK`3 z%A15#@FG|HoxM!yvoJD0c}cu8HQrV>=dtf6wmVEZnpF!N*5ZmhaLZ%60s($T{^)&bRy+@IjT_W&Fi$DD&pkLa>PV{%hWFec;_I48 zHq*DJ;~RamyGb8fOLOno0k)NisSJP;|3f#xxzqnp7oum3{bn}XnQ#it^xoVsr5s~3 zLge1oFoC1*5Q3s@~OSLVM1T@9yOTAyQ{(nz{P$YN;$6H zXS{?qQ=KX1PjEf?n20*8VLUH<;X&JKao<Sno(2K{T5$%C3YPy2&K+F@1h2TvsYPw+moC;RJL*dHeR2?YRgFYb zpH%IlmoKsh7_BZ$83e@1SV`WvMYP1}ly{)wGk?$G%Jq$9QsnRRVm21eVxFIGRCb{? z^+a-*UuwIOYT;W}%h9vm4Ldd&bbQn_vUDW{auWBDs&o2?a=8^-ffm@^Q$B9n!M=l+ zG_nyz9!LhcwoBpAYX>Lkx=$nv9q_po8|s0-+noRGn;cg>`{A1Nc_Y!kfB#%@U`4e> zF%o?jVghs;w&VSf8t`}!66q3fg=C9&fuvO&c|%aH5G@A1^orGTdPvo#rJ^?Yi?BG0tyT-Xht zrhLL)Q$(}A_;~b3ExsN4TRg*K&Y|5$r1S|kE~BDhX365eA}(hWRC6rPU$f_;be6Y3 z_Ugr*{;OC(_6EWX^bIxvp9{WDj-cxT9+JkXiM9+PD}{veQIP!&J465UsiN6@cv5V5 zGTWloq|rTkDuWcSTl4Ke_}lZp*n}w`%{#Kn(d5N|4RXaVu7kisz5=a{*;(V8cF*Yj zf17o#`IME$^pYzUNhyIceawNn09K&jCXTuA;qp*;gYj29dKcl)IK@g^Kp|*g+v>@4 z-m&`hwzJKws9B17f8)FVUA&f};mFub0qG%Z9)@wvUf&={5W}`;@QZwTAvqN1m*!;p14L$RLI7&DpZRqlI7NO@wU5at^J;*P zpSefx!9tpS9-$Hx0U@7mCNvf0umzLFJKS8};9h<{`sGin`MH^>fRFpoQK)%TdMJ`y z`Lfva$8%0@^aWJu5rseWO=EDqH$qpLoa73S<>$zAI79{IxemDyS4f%RA@UxFUiD|) z?l`dRN9m1G^oAz|BMhb_$FTQ;+D8U;F0h1^hJ6@rL-;u_<+Ye0%R(Rf@10RFLk0l3 zV4+nvqkr7muD0I=k}p^h?NoVQ%i0_|0BNy>nFv(KVIIVf;#b$^Nnj+p;Z6Mb6GED? zclpuJu&vVB;LdB-A8{@Lfz7rs1JS#XhzH2)cZ7MgO^a8*_}3l1nx#q0lUHI^uQXbu z70YCl^E&J*k5fnGtjfV{&nq9~pEs6C3ju#(x3IfI-;XnwVNtX2y|v8juKy-6CT3IW#vZg7p#?jmMemlLB(jx0W1ZXIjG~WM z$>_(Q2F5g8f7sYR_cas}25t`$IV>a30t`Wc>w-&xoWO-{sR%Z^<5KkRq&KyAvFQvz zls4+!=GKp&`*xK_-z$mD?kvw|HlZe?-Vbk*ib4EfF1xB|{x7?=cwOeQn=b!MHLW0^ z|9&%@f0fw!^+np1?pzI5rfbcGtmisTh#E$|XXE>$$Z%WgOH#@y*vaAae1PQKFF?ER zLd6dVvO=?0IQipG+dquYht!+&+@%KoUJ}K(HTEuF|1^0W*fZ^cu8uby-C1W(_84iV ztb-l_tauFy6piEBoFSm`?Q`gDgrHC}eH{qZDFQPKMM2=aE*ZSP10igO)`BrA=*1G+Zz*D{R#_^VB79;;au+l9cy}2yd|&(d4}3P9-3X-R`W_w zX!{{0yA7F8+E|EcKa^zbW_X}3kNsWWie1%Bo&r9{BKpsT);d9;Eu>QV>G{TiH_6aV z&=*Sde&}YnNc6!aHwK#7VUX~NeJ$SKYHZu89P8m`6DN*vk*xszMd{{TUK`smhQdWk z0~_Pu-d3aU1%!?`6TJ6YY@XRPy7!bW!n@|Eqo~-{Mrh)TDFUd)XNanS7Y2HA-C&WQ z0GbG2t;f$63d_;=NuYHm>74mBXf{GKig$7mMCl&;Q7I7l8XdmJP?#3~83B3(cB%c5n zbu6?UA6`qJC!C)}W8oX*{QBZSYH);ZqbP8{G^jv3YcOACdML}fj0kuipT~N0;&=~` z)iAsZp1BhQiB`XW_cAu9hxiYByoC+wKj{}gg}m+tZYLw+uD+KM*L zIi8l3@9N+yrpiWBN#21u&v`$TKh-590+gD? zVc8r`EJlGVFZFe2^O~PM zqerro(Mg!MxcHX9t0lym?U(3UyeqhqXW_vbk-34FDl>Y{Y?T|{4au0s#sr^Ic2Eke zmB?4W)1iU)Sv}y_x3Ctz;qU`(>3ycj#km>L=01xEx~N%aDh%SGt3S_z;>K6WC1CF} z@=2r6w!KWU%*#7jaI!=Ec^X_cau9l&VXOT7_2&K$_~opI{ft2hI}bE5n5Xbij(K^v z6mth2y&N21eSaylzDbZF)s?@TY3oy-Cj*@4Ltrwt9!Cxu&Kh`Dlt42TS1qyZ(SCV& zuu_MLXS>f;x$Xx2mLpkDpRDZTD|aP5%v>U1j1-Zseig@B$w0JmP+4yIGi)sDs$$r5 zg#(b-0(qG~D6Un&c_gr;3jILfDSU8j=u*^%w$E$d{IG-SrA0&-w{8hP5nH-nbhzF` z6fneG{sR_{1|)0y=%eZKi%su-Cr>61s`V1jbNx;nI~e1bU!r18jcVUL{M`$BX*mW4 zUdj#hx%t0+SN@L0Hxuj=s2wk-b2{_9yt1~tf6ynAu=|CkXoB`jIR>4Vn%wEHmz19b zefPgTPjKJuhlT~FRf%FvkbN&TJ;xkUmrJ2c5 zqsDBYQ!Dl}_@n)0M?4b4waD$gxnIYz+=<#%avgYUshK0YocT(~c#$o5=8@eb7g{kT zU{X~pqP?xkqWJo!r00mepxFfbkTVDcp24nf%$x2jWZ@f;BdU8AKg$~BuL>8^#&h>w z7p*}wV4aJ9HElrx(qGfr2a-En8cxxp{2X0ZW~qUEdm4q)@VZq6E&1SB6;s6VbDem) z548C|_ERpIBniDH^R`q3-xWQML^CbiHSQq%DxSQIl@t3in2mbWY#~Sx7UsvSA{D?F zJVQ2~L6q{;rBX__un0c?fpH}zce8Og3X5RmI)k^g!R_UQt~_Hi4bBYM z$vIn=uwBo*$+mi({b{A#_F3f37N~C8QjkZMw4onCNuppcRp(WScV?F1@?e(EtLp5@ zPnV|A*Hn(0%KX#W7-ongM5U3*<<^_*-FrmFjV@27wGW`RKt>wx-jZMa1id=rk#-ZR9|jj9xx86 zJ)-QvPK3v@Zrjwxf~)XIhSg8?W>x$u+gb`n{f539e9ywZpqN?`MXYYXvKwNXVz(WA zDuT2Re}O(vl!z}rx}1e`#@nPc%Smlj70px~XgIB8J+^gP#Z@-&CAbE!>MIM*z_|6t zDt+9{*t^n`Nc`RhT3<~k+W`QYG*->#i#wgQD#spDG;g1Q_P1D$Y28sT; zq35rf94K*o@pg0^3Pmf4Drqc6J!o1j_3uA=0*Bq1!$DMG*leW1s3P3ncTvf!dK}2c zt?}lUWvK$t#UNsvgHCrs13@3JueLmgW`bEYuJ5m z4dRtS%P}I+i12T|YtkRP#_AzHCCng+4$@Fn7IND`)fh9utt7uVI&`$ex-^90c0S)$ z%8MyKjYr_lh@z@oKk@hBztjOG0kWF@&SLhr3D_(oya&38WpqRnIksxgeoI;$9I3hJ z5z?ztFIJ@e?54JW#idGCcE7I;DS>eNyNlN)v8+>2a{mb5B~Af}G`L*4grw+& zK*8S!-RujBefVK~%{yEN{@m6Vkr*WE(`!&W4Cq)G$-RcXPM}Juu3Cvsk<>~k;*hs( zhUFyfm0wT{&Whc*1Fh{EBh=d`aK-i%xu#-nIb!!_zfOJgHUUfc?Fin-x(nWBc@AxTy7D?M4?hwbaWVN;X=2 zq?aY3R!lM)!Fa$k6!~I_5F?WE5fa8-w&kPG(N2+RP?*gY{pW=hs&U;^%ZU9S;uapZ;{YTV~R% zSZ$N>(fe1u_tT%{P8J9sktEZ-NR8e!tDqr|C612eon?;A!Ygp+zU8Ni#Kwc~l39{j z2k?)pr2|U$w|^Dhw-4HT(OZ}$k@+BK&ZCo`r|{s~N=MiGsCc9@ z3A0r3g&`OHh~ZHNN`B3=Kd@vaD4h>`gtf0vOGZ9?I#fu-PRC`{A5QHTW8lKjTvhZbx!>;>({G|Jo+usFJ*Y@akT;TZpW{?5vStnz8ilrdEA2r#WUduX zqE4x+-I^*NW`DPIFX={x&ny8`P%d+!(PnBwoy@9(QLUBqHG=F>*eXa2dnCpb*|@{~SxV zlSwj{pkFG;!m3B=YaD{Ph$COuE_j)lT0~Eo-GO^tzmfmuXoz>snSnktx%cJh5}Kbs zB=7AGvxPs1&5~dE`ZZN`NeuT*z^F+-C2rIv8Mba+oNiikN64s8e^l7$a|$eLUO$Ce z0Mcgz5rZfRJScWNUlLHfCT28}zh*Y8HOg1P(cxHcxM;(i0wcF7K0GH1VMSP<}~Jp>_HVfnC!rKb5XNU47Dgws;H=x6SrFPI-G10xhv;Tj!0hG12A5kHQn;&pW9 z-MG9ZGW)v`I6fhA7$3+wI>n7rk?tRG>cV$)YyioU92v(BwhW>V49U9amC{4DnaIiqoOBf`SlZ)_g;6-x8S0r~m|RLT?6hY=G?Qk4}`qQejW3 z(#s6*V~iy4L2PSb5EvLd&SV(O#M^&n$kM>oKd8GXs^U}@8&10z%~_7C>f4P=|C8aS zHr7FHq83UPcY8Kgc{cV$Yiww1Y!&(22UyUh@p{Oe-$RM~9GnNiqlt1{~=^1$np!&zg0*BV! z&4N~pj~9B=T*&Jg)n{~L z`0;|MU-A2AWOAJtZ&)9wu+SLMkq%=zYGXP&&(Ci}?qOf?6mNR(&YiJuf9>9I z%b^yg2fMQjixPn3c|t}=l{Rq4WhSHdAXZgtDX?sljDwkWZI2yaMgCf<_*hJdmox|q z_^6+!PX{eu7?NE1emv9SDn@Y{BR@{D*YIL%-NHZvQvxz!#baR}7(74l6CRml{Wk|m zbA7T-=L-Le$eKTaD=S}h^Bcu^iM409HhD<13%mtIqkT4(ZY%TjAEk8Mi7 z#`irKu&&9-wD_eehS()!S>Vlle@$55ndAz?8-eB0d1Wg1-;BbY+*1W5grQ_Cgh;aV6m5PqwCLGf7V5$+S%mw{yK(aTde_&uxd*Gg znXEN)avL%I;f$3rQgkLKX-I}iM@KT%myDIv7e3Y058AcNUA3Pn8ZYR^i$rwe!E4HE zpeZ0Vmi+tXKuiF+odD5^MM|~}A0OV;`9S|TAh7a&1Y#GkLyPkC&F(;QaL1&%X8K8V zK%;KF03skL$BxQvLp7-Pyj0zXxRu82VF}JV#rJ0BB$&WtuQ@lunuSePBax)Lj(S<% zZ2jlmQeSZr5h1QkT9rd^7(5jQUT5!(QnjbTOsnoW-`t(1!reFj)7B#XB0gNBs~kd_ zW+ew_XV1l0mLMu_y@?1q6U6JtFy?S@v@uhFqn$Z4jG0Nwno;mEqZuvifvd-<_!lm( zkeD_#bi=|r!tZ@I{(<)2b?INPvtul1stG@Fxb>ww-C2%Eb7JKeGdgKDde z5Z-h_bMLQ$a0kK@Sfqz>qvvFe!A=&DDX{#2a>p8d$vz7PqX#mWp3uB>DSDY=^wZ-x z{W59WQmh$d&#jk!l2TacvHxuB?bcZ3EB6-}-}cv%0uU7?Qwhq&4?4!mTQC5_LvqcSTfRANN8@rv<-{S7h&kRRN#vl`rD1C7x|HL53*>p}Uv#-d5 zEd%I4_h)^)hvIvjT0%-+8*$ti*p;R3v5E8ZcH?XQ05|rpW!?r%0rUA_z%wNIpn*CO zr|zBAIkDJdYu6g^kV_Q9dymQRT~y9WzT=q=L1BY5bnA0+=8?;N@snAc8S&JVmDJ^Z$LfuVJWbLIsNLSjFR+6wT^+{M;Tb$O}OAxIkYQ#L;FN% z-h5Wl{5@aWI&{}hiGJr6-#?68asOW0Ao862_tIuAayG2|#!_kihFip7?t!DBut)Rf z{|e8*07&5(7=Q^Ffu;c{ZwtPxLq$$fe3rUd$%$*Sx#Bp{;CpcQFE|8V?ik8ECmF?6 z@I=hb+oThoXs}k&adIMwIF}{GczU5Xa{8y$E9%e0HO35+rxg6Ueh)&|u$SFs~=$*Ml{`4Y?G z04(0@e#17RtYGSr=1Uaz^1)2&_;}*q!BD(^|G|tLE@qGaam!Yu@cB}MZpzp+-vJb$hp=X6!Pq?KI)wigE$gBs{C0^XVr(64_kV$JwFHZhlSZC7Au zCYM#v%rj31PzL)AnLTXSf&thi3+5#fZ ztx;sEaJE!?FNyDmjHdaDx|e*B1ih*T*h5a(@CCZHg`=5tQi?#8huNOeUWC;1bbKd z3sd_Y+2WfZVjz^!wXfnr;JbEnXD&<~XnbK%ChMhnXnDLMz*_jvx~Q|6xMBV9Qe5%F zK>?Ou)lPsrBum64;>-jO>U01MTOcime+51NI?T3`2KGh0KYbf9V2h}6&leSQB*ysP zQN5=fj0mp=aSCo#4}xI+gN5LR1|3^`><>9ZH9fLZw1}8JD&~Sm0zLXEE8KL#x{M0L z&s9dBY%^DzSH3a;iKPP1B zaeTAE2maTNa4#I>=&&!Oyh!HI;(tn(;oUxf1?PA@lsrPT_&x%)Zz2iu0X)ChfxkG02Q7i*0RRf7RT5~sC`czF zdj0oxJe5)khmck(YUtFLAdHCVWT>nESPC(mofFG-Q3jYlRu^`T&kDArS9tPNqxR(=#k30QRdb!%REY-g=h9%t~|htDyrB?_;2E zNz$j3^weqwXdg{dh}fDsAOOFr)4FvRlnh||N*NgO;V zr0mt;_kTeI*Y*E$9wdlW@!FGEx1XxFgt0!pT>b*EmEJe}-C?^hNAnYR&hr?iN9E)J z56S{l!&+O1a;POp0H@L(Kj|0b4;2IO;?s{VQfQs)e^T+Y>V8&10Wm14f&`TN8VsxB zM!kx^bvQoCckIb55sVvcyEl4W<3zT8wey^a@A{Q4y6Hh#**)cTO=fT4PG94St2T9P zx8J+z#&l;LC&6O>%7Fi!1PhppyRcVo(LV$^&d7}ymiL>aJen{64X!<1q{s>u&w@O~ z2m5T2z4Ww$gfI#h@u&7IQ1sx@%TjX1r`-#^wejzdJ&LR9|H-3tkxK=f4>g1G$5n&Q>^DOt#G zOUjMP@;Fa1Tu9xo^j<@}AIT?$*TZ0ds|5gwaGV>BKJY1r>6I=S!$1zGSvw7pT4m8} zufqi0aMPa43r(7D5SWUet+ygRnlC+dfsNPWa@KS8Y`2bVH}!1mj_1}LE!G|2%>rX( z(4}5#lL%_f$dkftG!M1sy$)>nc{I?qOo_ORPJAd6(|v#$zPe>OsFHFFvVX>i6j;`! zz8!#FEgaG_-MU@V=To*ifrsH`S_n4VPxyyy0XX{+_#~EVqgf8ym5Us)R73l6fCR%T z^THjzA5q(!?&55TN=4V{!}Vb2>TdN#JcKRjmbTqUS^evFwRNAS)9V)SN|9RI#Eh=^ zLh4gH@5aYB4ao*iR&eM9S_v8H6;C8C!w^gvC2K-PwWXer_GFk{(zE)K$*=D*SJt|C z_8zQ{M3Y9cKuo`P^G0MWheg)VQ82t`vYfb4z^92(5i(4 z9qsOaQC^*m0~M2=Qf=!~ZYH9amah^Mr4_66i(1xx&an>3NjPva;Vi5al-Au5~)pA?#DWoX2_a4!qgUIXQ45`NEVEcJYg6N(f3c567=?!wex3|5Qg<1cu}8 z_AiJ70d(Wj4_U$7$MERbwisk3Eue^U4EgGviw}9sbD!9Z@QFXHd}f|_)T9rxn_7);2SGa(h%T@)jH;3%XU9a*`$5TAbsA12gjln>o!7Q}0y`Ptp72li7zX(EE&CDU_oK!$w^Ex3I=0gT3kZf| z>{AN2>;fClY-RSe;?0+UlGUV=m&8tmBl#Vdq-90s=dx(K62Ro&(EvE-b^(ruW7z&r z@M>dwOcqzSLjGDvZ#7DMY5i$}2>o%U$e6kOTWMgM`grPJiDMC@k&Z^ig(A^ibeMs;-- zVY5;^7;^t&;XDXQGX z(yK51Pd;E1j>*#MN_|OLV@d7eZw&xQtceqpd?E1}N7}vPZwGo@LAp6e%)k2eXG+%l zw$|Jev5+gPi%&F|OTFZf#Z)RR(IsTRXpGKQ%9rYT54W$*M4nY>lH{?jKJm$s5T7HML*LyWel7vuYv%hh_#jB! z&DjP4BJ;gp#G0#St>4;(GK7ir5z9X4o|V6J?qAL}9fRO1_1_0;_#~WXrkQFh^8}#0 z0z2R1Y%_e&t_&W6CUG-}!~_Cp=X;Hfa5En`xYJ5Qa_cXb5Dc?Hy`!sCT*xqQw^X03 z&M4+$r=pm{Evv;k`IjyKo6tp;oG9Jxgd<(k*sMmdrB}|d zQD##elqQ_D&u*tR+BIAmB#S%SD)^^(5OCZV3WVPf_sg;PkxJi^%$-4De=|igp|Org zvB&J-W0$UVJzo?u8Q`I&U?FQ~&H;Hf<|b!G=ZmU%uEpT1vVGo9*2YatvxIOIksj(EwBrx9jZrNqWe;P0^y5*As%W)gQ*2e>keK{MFWZ-X_ zHzJP+R_(1D=L2wJr3l`9p1PhmgkkV|*{Ef1^}&~I*1rJBM7@;>NLLbYCBe|^0J!38 za6Hr`UY;omheo2zbK!-_-S1jk8c~*LPD&v^BaUNswK;W5=^7$ z>Ij~Y&DqT>_+>k0CkF9UG9DEHK^J&zP}Hc+_5@pun*xs4q(kuYXhbt=Qa-r*@W=R! z@ee+b>Dclx+{*t&$F6=cmG|0;o}HH*J=|$!Vq-S<`JKVGP@0S;BKGDybVaJkTt#kI z7yh-C1{(imriS(>^clW*-?x5elY6K}{Ix-kXzncWYbv7|n0%!@#@ZvJsFL(vWZ}WczRif~GU!&j z+c<^aLVbB%4*z;cT>naJUMDmwtPoLzIfY%ZE}5+*6vu2VDq$MUId-8)#VDyuN{Az4 z;p4t>FmFVqL3oC4{969TdN7-ptA~h5czLR}>%0Qrgoz20 zqh6UvsZNkY(+S1d#Iy>F%{g7$DzY+5o$;r2xo;ne2dw-7wp z$<_FMC7-G3G8YuX;H{&Y`Hw`kUFN3=PcH?_bt}UQ}rI8ni#GxqkF9o{pPyS z@H1agL%Hc-e{M1~lR~OwBJsUh*H5KfP$YSkj?)Tl!SO6M1w&ttRfV9};M((l8iHNV zYaQ(kPfiYFFAe|Vj7**AnxEY9xVEx#xyhR2kMyP#8Divhtwl)8h)29X-HEBxKMx?m zf)exxdqlkzfVCa3cQp1uranv-L=fZDP2 zI27j`?r{9;$z+YI@%@n96On?sPmlVYOuM>J91>MN*~3$83&Fi#_t(ac?y#xRT+&WF zZ+LPj8(YQNE?;+dSSeaz-}A}g1$luZaJwdzPp+l@zC>#zVopgf2o10l|6%5Q_lvIj zl?uslHhE)x&{}8tcttfN*)(Klg4?jN;CI+)Ak7ze-CN2MYJ;Fxg7h?=#6Ya#fiFj; zb@jI^&{9imsONzeQI~iQ^?6^8s`O{C?=C{rzk%gbeO5-nQ`5GmTugxtmyrW%%MGH) z4A_eHqc2)!O5`ov9z%(g&wSStq=oe~_jza-(a>sU>s#uRHpN3<)hI5U`P0nc+iO^2Xy>5Zmu03%{Rg|z81fnC(JI0+_-HBkKoRyh zWlZh4ll(_p=@`mSf2KuETtmbZ#n6o~J(XEm4T z_I(R3K52fdyXnj`77Wg=Zv7%QQZjUkKfREK*wr=7A>nBB}7#Gvt%^gdZjfw&`UXt)2- z@TEJg91@TH1AbAjLJPtmDD9yXV1*T*9`OC>q-ClzN9qGA;U7l&o)^O@mLkv@M)KU* zZzPO$b71@Ww(W4u+Q$}|7Ye*E`{E8krEl*Qz3mBf{ssqymQj5f9II9vvRmQ}DV$N|?0ve5vI3^oc$$rP@${)|(NRdBEUSi^TpZ84M%6#^9!z<6L zif|Kx!iYi6s^?0a8{P%({D~D6B-gCOaB$E;PO)L6F1NcwvHH}#HO`4fCy86>S8eyw z4M@m>X|OPjg=ykrRWjNQl{ss>)O&}M+`*HWg}J$pRQAPY4rGY0td)Mt++r|(rB8tC zY;Ss=Qf6HpZCq*Euq$AaUw)Uh09z6K^_rE8ZWPRD!{_0R3?=PTrFz(cESrFZ`_1B@ zgzM}RJ|fI=j%zmf>b<4lw+jOT7fLMhkdqxUOlt8G;+SrcBYw+WiS zwMTjGzUI+N(F~;?qo6ga)`Fm_)xv$ztLW`lO?nfODzxi*3?GRiTKtQO%tc8&mMej` zLurg~95bK?NSsX~jK*jWZ1dQeD2+F&$Cz24z`Q6$>u?Q5BVE&n5a{SjSz(gjcWoN8 zg4RAC1fx|Ztzb8LLelKc^YnTx|C*Pm>zy}j>;=CM=QunM^zAJurK6rOp? ziV8s~IWIFn-TWEUF`vXn?tR^FuzAIklPrA<^q&V4=VdB#lwRKn_bFXNYo$VZJ`U_g zqc-J2mU1$tjFxhgU4>|kW)&?MqKP_3W{X_-;O7+-4b~}Rq3@P=sRkYXeD>Ozgd1)# zml9=7>Rp#FioQkq2PaBn0$1$b#9Ii6w;ewkf}1dc)S+}NUd()>{2jN#0Z{NN8WqKk z9=UbYj|!wL3C^0c6I^SCPy{}jy`@EasX4Eiz;84x$Z zQdq|#f(tT_j*MMd4~qv6=Tt;xODTSDbVSt_on;HvG&8?`q0~#a=UzA~=U!O*6ns_` zw)gzPkS$~Gvd^EZ1Srx(Z_w&T z`YHj(a&FH%TizaIx`IZ(0#PGb9djzaC^KE!9jfyyK26psgc4Re+aStyZz}eNJ$d4& zO_bZ13bs>|cyz3D-p{$WNFJV$*GSai)}E&lUD55nJ>su& zRzcGPU$o-utIt^D9HE5NT3YO`J|vfABp~fuoHLaFjrnUU8HsgdMe6;n!#aI)Gow~m zLj}e%x3;iQe!j!&a6eAfb#%$MdhqR7#2=(_foVha6cz0mDIbT=#6z?*=I#mc=5>aP zgBzXR7ngRXC*Tu%-qymfwCqUlyTtXSs~;Bj53!NNXn`qc-eo{-tJ`s#R1Oc^ex!6W z+F}f&VlfEz~WCDNuse%GaX6HGb$}^9mY7ZN2 zRy7lQ7cm)mUMs?bo2-c+6xn9I&Y*kYAwkfd#mqD6@PTatyyBz9hr^F`r@ju5DO5gR z3ihA&iGpWA`N3GbJyhC?<1v4Ng=%oWm^{;Tzjw#<=U7(GZGXO%*2gMJgfJe%&o>iR zo84;T>UC^^T&BxVt>+U1bAkmsAOTwiAg4nB+4Y$ussV-ek-rxHj#Pp!y3&^dsng}t z%~^8~@9orDp9=GSxOI{QN`6EfI_WdjSdCTwsYw{=Af?ND`rcX!#|0V6x3H6fx{TR| zyKJ>6YU33iJzb+2rj)X%bkMBg&G7Y-?cXWnGc=cO0t3f2S+V zU@!U3zi?{tUFZPjFLxjsa=;Ts%tMd(92DDVikU1*&SvmyQ?4&=`EY!)9%Vf*8(F8s zSA$TPVo+72bn0AJ7l!SUOF8^`#n)tL=Y@r9e~L3){X|F(!TErvR5Tx%7(b&LFkEy} z5ldXz&};qHaV}3z6vO$|CjGSRVaIeCEGrA_WP$b_%$5n73*R1X{=WYFgT`2Bh`We< zzdK;4L-fK&aN_Gt`y z16Ruf&W7F|F#Mxnpy6L0PGf|REZt{6{ay2Cx#724hc3$Du@hfWh}mYAA0IG*SHtS! zmx7>7k!F==*0unv-7M_Qz^rHZp!M7*p|E=+&i_z-_p);(j3c6z_rZ>{DX^yjGVjYT zWcySW^y`DF*;!@hN4*~zvm{08W*RI;99A$G z4*oGAWJ2M)_O!OReQkq_Q(nLg*k~M0o;3h0Y$du|XX9w`#V%iT3kq8!MG~&Ig+WeU zadFQPtBeQluHkb zd#at}+VI-Ro!+4X%x8p?0dHXE_%2M7XD8WVCyeiRLxnZq)5K|i?u=x!Lu)gS%)bSq^(Od>G>{^tu!wpdHiqAt8nB!)l*t|YD~BqOuwzZgsMw1>Ni#nvg@ z>tYYy%?8M9R_)|UIdq3X0&@hpptbr1t+X53p3N4O6FQ-9MfE~I24R^?Q(x2$Y=tTK zw0>*&vRTgOt5>F!eJ6O`PEeNSqQgFo(Z-Q8%KM`4lkK+jvxFNp7}*y8g08JQvmtp& zA1+uWrJt39tfD!&#Id!s?6G{`b1uDJjKx%i6)*6NPL{Pc!6^Y%A<^CodG3)u~c*P zQ`S#)1KC`~0@z+BmAWkBR>!{GAcZext%4s4JyMo}h%J~d?S6v z>Vx`w=68IUb)RxXy%L0+HYqx;pE#aX7$%WY|MHJOz+nPVz)}fFAOcDN%Y0`&VjN?3 z^~_=R)4fv3Csh;u%djWoBs4(dQxZTbrGT1s#;iGn#|VgD`o=xEpK>cbzVBgvqCvo8ILyran!~5l#-b^^QkmYV%r|W)&_8VJ?y5K}z9C5Hikj?B`Ypdf)V+ck)gWbl~+UcIC-3_@#YE-{2V!ej(4q82AJE>HKw5|A}CbLDE6w3P32 zT$;nkx{9#i%k{9#y$Tk#LvKc}-;}10w?|OAX=`S>+pqW*Wgc0v_BbJ2L{GM{l&0g% zudwSt=ffbk`jJnwD(vBy>8nAtNbIG?v0lD6KWD7Al#Qnbc zNgAWxKn}}R$Aj__b|gbMx&jJa;S;o?nkG8YIyLF$*WzZI`2Cta1(6@JFmZ(Q1K{rH0i8`GDY=Rdv!v6BcdFE=2X3Zl z$sU47ZlpO{QAv!U5EIZxk_Qs@yDAx5gy&5kapA&%@8@3a=hQf<+nV0~0J6oiVN?eH zE^5MX<5eTI@VmOZpU9?f{+9g;eC(_nBOdrkz3+Ig!~?mPuhH8dcwp9xFJ1eHM|6_& zF((kGlGo`1uCwY*+Wquxs-E8`%DAf%bSyqHet2p)_4c;{}P~-yn89(jMX8M+n z$M&cG7dgTI%WTuWJr;m?uaHrI68hbyV-gkAV)2G!V7C`W`dtSsiq|4u>&&*@_4R_HF zSLuzS7wTWQKRH}*Uw5}GzGse~px?Tdb9fLSv41W5q=@Wq*3Fz&v2ojGSufqzZ@_(; zS4y!{mIMaYKjz)BCG*n`(G~u#-16yZ<{LMC+xZQ2@YRXm^|~5XD>`J0o{$aWC_rK? z$B;K!|Kbv9wqA4zD-5y)zBKB?Pi2iU3s(a=}oM(QN9(IsR)c6 zUp)9*Vc;Mln0_$(#;B-CQ{T18-jO%RiSx!*}O9&ZkQ4By;H=p3FkJ6TW5CIeQ7iqnq;)&7iw9 z8^*kNu}SyMGva%&Qn7TDB^%9+7Ma(aQA;6uDq>W{A8sDxL}uc+(=k#3)8Y>EHa&Ox z@$*_j*z+0k$W-dFa9X29DtHNN>0vm9;P&LUVzc!n<>k_0+JM|VtKSxr-GLnFM2#g; z7mmYUFbR}FK}Ee+M6)$>zb6`m97n{MwB8@d*=-9dlA!X%InS(9P1I+Bz)-ZTi_gxU z0$BcEK~>sytkS4!t*Q{xFgjLjJb+C8-8%Sgl7{G7lt420(9h z_dzVZD?92aVEfDEvAijgw9==FR4OzmzL!nT9Qw`h)cK;<;?l_8uU#S7q=krrv2J(3 zZ>;PsM2vG*9o)awz3>9Tb|;+W>)|uLz!l0Q%l*OZKNXmJD&Z>Uz<8$FICOWM6sc5y zr_ulkr}>$!OiR79B5CRjxErCjMb_1!WxxA`vy9NgY8txY?) zVsGjtud9d%Z#9YjwiOGDs_m{}IUhuy&879LJWg9DTB@AZzx;{?g`@bR%jRROXO!DL zEhmf9d!W-*(ci9e@0=%QQ=Q-83Q%qrG7+N_Fp1n2%IcsL^2*$VTk)(AW{SPbhVlLz z%fTi$4s^mBOY5EldUMg8cg<>*F})oZS&a~y^-k*DXSA(h^r)nv;*Kv<~ zM-onu4IBh*&cB=-)8P3x{YN9U2GM7f93|a`OIY7(#5F|PO&ydoO9y)pggV45qZJ;Yrhi7GIPztdYD-)i4ljV=}n`jPRNF;oh2<&e3 zSf$?2Cb#F#vxeAr-#lEuHaK%+pj&(|xd>JxTyr#-?SLybSc!d zPzxQMcd*oro+wVu0aX|6FWI*fEPFemEUvh>g6*6Gsvawal`#ag3Lfm}IJuYcSXMB| znNwzn_bkKC`SgJ86N66)VTNgC$)8gg6-)&L45_t?nrM_C=GPWA&vk@6rZbVP_EaBF zKOfT2G&P{6JQg`o+y{{GJ}n0zc?0B@KWf~Ue%h7kZsA8+atQ5Sw?X(@nAp7m{JLTu zmzHuI)t>wcr55#P>ro%a73!`uXUY;}PT@TWClni{=%>eJSQ+Ji`_Yf4CETz~@*Zu? zuj$?d_v*T<$=g1yYo3{8(@gm*!J^}G5B=*HuD_#QXA(jAkIO-lh}szEQ7X*vo^C%= z=PLu3+RRso!2;C0A`$;$cE3*JXw0ZWYea{>I*VKZJ?l@XZGK$24ArelzH>{o(zkT$ zx=;C*ifPWkh6Do^?)J|0kqbt5@zMaxPnMsE_1oX4R%8W!&Y2cIlRDrDyeTO|Pym$g zy{Qn2JVRb>B1JD>9~4wlVa;1gD!vw|YK@amGM|T~R1U-!`e*sN^d>OsR_gz3&3^+o zm~5ItmVK+O+TN?ukpIm!@zR+0k_1teRqNz&J+37%_wxY$l)6_IwMC`lfMI1q?O+B& z!1eg82L)6~8z0nkh+`F$IPC+Ljo;4DKWVTPWy;L?T{=t|896eQQs~__5cZCoMjlHs z-^k(npS5<_UHjkE%tv|;usvU`vW#C!Q>$(18lFF zuJWbAywfx$M%`O&%w%mT(TI07Lo7^+U##ugX-~({K+fvIRDR5*U#EeP3zsYSU5eMe z)Jt_N)F-L*8Q;X7t=##v+RYh~A^BLd-_h%ou(Mk_|CQ+kEOpJ{guOsU|8wOCudL2P=3?Wb znB1^4ENS`wgO9ZGKUTV3r>79q^t59ZH9QRh-9a+!B!G5O7M6uRl{LpbiFY4pf0&YA zb;^HAJ5 zBkN)3&&Y8pEB>py38?BxdirBwea~gk-}Cl(B4|#VoILLDQR4*lA1%b9f=383FyR*S zTt7vWkcvpT1;+=)IL;4WllS=(Nn0+2{zpt}frQG+je^}wf-@ZlX}^fq;}l7A(0u75 zuF3cn@x3#e#&i1LGqMhIzX%y-KMwsy^9rB=*lFhwSQ%tJHziD4`iC%_^8#*1fc=+ zOr_mP;aqwOmeAwA4zh4kkB99^VHHY2PUg~kvet~sWI_hrx# zkep>`MlbkY_=rUHGnWO$6EZ-~fBIPaUvm+=dt;P)Z-`YH%{h)(f9&0?Sc1DhGSB0~ zf`t+;lZ1>UO*E<1afrkS5FhY_hc+?<(0El6+osNW@$?_OTx>kE1A1VX*pV3bC*cOy z@H(YAyqaKYGF;FY0phMjiNwdei4meV7Rt7*IE%I7y@2`cskCz}B_XxhJpO~qz}Z>| zV!e`a5#l5@T3R=B<)7}1Q1r;Sn~&pZfB-92!)g0pktFp3D#iD_eu2SL2MU9>e3JLd z6#zm6TFCqRZT1fPGC;=nE4 zDscCh%Lpz6Nw?Z-+*@KsA2g&Drm%>*bL-52Vc$Y9=RUA^5@jsrhKgQnI3C`c%3$lx zte-Pi3Oc2)@^?HVWv&ufAuu)mkv?#Kh{T8R>Aa>~hm6*(IP3i1>5wnB#rGO2)B46Bb@pJ4%Z|0{ z8EnL7+Y8DSQvJ7{#W$NwdGtfP<3=lwjhw--=o~O>a^|9#=lYNv0i$?rn>p#RnA^MG zUl(t308rD7FX*AKfQY$th8BrXlj6jh7g?M`@ADK_k|6^xBu>t9Nk!j`QkXna=&D-F zC(Z8;Zt0z)3Y>5Tk`{^7ey4_3{im5_%Nr2v*|_4Kc%Y1TVo9z0+n@D6I?|G&fsz}v zZOpn}LNgr;Vv_4|4*}3jbThrmpIN}VtM`rbaym|Ykkt6IFxxz<$hZ)UAW)G00_cRI zj@Ie}`_!mAc~`oWYvv^?K&@A8SZx1^Ni4ygqg{5+Ru$mdoJGmv{mWO&an z**thfCFNKqu)Q!&Tjd{ri;X!hh@9jrfQ%b7fZ0Y0alcGG8-QLctC0AwU$(7YK=QBI^M6>nw#k}gFyEehEbo;#9%HbvmF|Bz>@Xz5 zs!|_5J}D15Pm)TJq}0dmS`p<9T6Q>rK6L6~4~t-qR7}=s;oFns{}esUKRjs@hIk4X zJxcp_TFGqty|ZQ8uo{cJj&?{t2j_pfu#ZXebC+|Mbq&0QlJ8}tbvh-BMPS{HkCI@_HcP?#@m zai2ZY*WaRNu$RX@4nvd=ruU}j3g{f*XE{;MZM`bQL9t`orc7Gw*tdb6nqR#w#YE>b zg+JW%2n7~e-2h?j5nxVlLu53*yPn6dKTC-SkIUoj4(OLK>K23Uu z-%HHrW_#^p&OVT!^K(6S%j>(X3L9ZR*x`@>-aP7Cg@vy}Q9mmn!Qv3Hmg?VFBO6t83 zp1u5v{=Vly?nMg|)GI1FYnc;qxgcahVxNT2G)01S`Ju3za9$5sE3dpMym@?*h!|iW zK1`%XCgCT~k`@iRs?dyypQ#Y)6`c}9+Gmgl_HM3zSOBiqs|H3)pAXy|H`xEE?-Djm ztv0P}ohf+Ed^gE(cpZhmC#L!1g(H`+E$5aixM+eAq*2Kj%yU$_ciQ0O1%Xlto9=a> zXd(E$cVk6LYb5!Cy~wb0ZL+KhheQjOJ+gK&KtlH^vm8L|M{ih)R%Rpf-YsF-d)?2= z&ijt?O$cBoS4K4%14;(bZcCq`qnNmTicFLQ5t1)iAh}7#)D|u@%^c?d2hz`W0ry=9 zq68)x*=PrF#wLI>v|qlt_;S;K3AqmPk&NlE^&0rCe7%}FrhNlqK%ir_!QySq4uf`4 z%VfqrTVZ##?tej_D`oX&9t*i;UOQ3MG46SWaML!{@`=<%`>Fof2y95VMTA}Er<)N) z7C+n8?2O>%5hxBGQwVeiQ-SE?HdameJbz7x2p%%pxjy;Axy2?B$GV;BFFhEU zv}dr|v`Y4dDmsBaUx0yT^xWM}4NsH!7I5y@W!LWxoZ@Py4AaqTUUuQ?TbD3_bJoFh-2Y7hfid>46{WYj z4Nv3jeCTv3xaeV@l&=7_j{x-@fdr9t89NkolROi(N=19WsJ$?NJO(AHQ-NAzLPY_! z(5Ebl-W&a;cdT&_I)hHXXc%_4x%QpN(6oi1yT5j#`8mUiP7BDKYk%vs0<$}+>0$n1 zu!m?N)YauQm)ANVw%53s#7T3J5V4CmH4TTj3)6JX8s39Vy)j(NzTb@Z?5h?g*AbMH z)@7TPErdvsQg39Vj@$5u z|M{bof-Hu2sQ}0SUMpInh49yUr{hH)b5+eWc1MZk*Y!Ug3csInT8~(XNER2^s8Ra5 z8R>UMBW)1mO8;I?t6`wYDc0oeb9#|=t)UMU=#kf!T~c**93F zu}r%LlM~-bXw(c_5=FI%iF~1LzS>};!F1Ox&VfqF-7Ou|NuJLPSA_{^p zA9x<`@f@H(3)&vtYzg9kz`#x^Hsk9?V?T07g9EtesRgL11gb#LLZ?m3oO#3~acRlY zv~zG~G~F(0BuHrFtLO1`R2iyVDh8@w%S{qf3~(scB#KM9 zBYY=6s=Brvc~#m}&~Ukg`o^YKIlqF2=Sz1oDSE9~9b={M!Usj&2X;>=r{aWjSieZD zhHpW9_e2+E&G5&*B_gN2v$3fD?2WpG2&7RjcPcU=RlSNcsRP*&is0L0hAi**fPZ7{ z)Gp^}{>50P?hdK_H;WL_+a4dj+F^my#4#(#!{gd^f(26#a9w2e{{do_E8b>i%M4?Y;w$YiDz`sl zx%!2)neSFk^xLxx`4v!#7f_|LImhNKHj-rSw@<=Y!_pZyN$3 z8EVsPihq6oS-10qVKy7e)~{_Kn2OUzB9reZ;rAfKl|8HyQ%$^e@l3)wKC1xD=moBo zo3kF4+*?H!r3i!aq?Bl@zty;LVioVY0%4{=Q}~9ehjosf49u#c zOeOplL`(G_c7!RXJYd~x?RV|}fH|dyriIW2F7*-|eneT;-oyKwK!oc^YlwcMCmY$Le?s^QEhfmpH&V9wYEWg66ISIg<% zol_s)7GG0Er~76ggjV$@b2jb%%Lm15x18zw@^vb@((M+58U2O@wv@t)-`-Nf~sj>d1C>%4a2OZS*v zh`x>aNbH~hnazh~b3fA*Rm~dqXWB#Vj7Xvms`G#WkJ{$Jyp6Y1UF`fC+=964NuWT1 zNqAK;xgqJ7+P#Bun$wA6opo7WKZkLP9{yQ|@pU34Qy}I=zkHJKuhhh`p}-6@yckFcpP~7P(g!%0iuiE<1k0@T03O0hTkw{ zbGGW0Nj@Dv^5Fc?$i-%u99*|{%n?!x)CM`7SxlsU^O3$HW9(Pvh9Pv=A@T=dpa^;$&m^xg;K>qyt*U;ryFZy5U++Y7Qc+l7k@3C=Sl1ai)9WxqczRMO@Qqk$pf2;krv{xaVPVZOs_Z;V+G-t~4Xlf7G4}Bx18Z=$1BJImR zTRwS23||^K{iU!~(tlxduXB%>wZZ&I)Mq{t+onJoBg*#g6-L?%nG~-Iex0Xmk4P)E zkQ3x~Exn7Qeo5s^V7qndRw~QZ6n*d3@+;fnTiJ50<;>sNdVF63YF-Ne|3wXrVX?;7 z_}07DWfz`-I={@iI0aSiCqSd!Fe3vBkrTGv#|>1!(Gq&UpL5FMyxnWGdS7(k`s$_|UU-im_fZ=}7&0q8hQIG|1tSvDDY8vccS) zuC_&Z@$RIBtOnBjcy5q&m(1kFZXMalrPFVJ#qMz~YJ40}H`p z_M@}AT|VBDGZd+rE1Wt3w&|z4gu01oqz4_lt%_`xL##0{))Bzi$(#bRs>SZUrdT&v zYdt@D`}a&SO|(Hba+*Vt$z5vYQAQbOQLE)(X9taPdS@E z;(8y%X^J)7(D7Iitmo?Q&xW~>*L^wgzoF9xO5JVVm+(P+4V0fZzn5`-PTeN?YhbpY z$x2jBO%*KbsBxUJt+P%+{x7YsPzf5pR{&_X_kIqNvFP#IX{3Cv<#8h#)rws;PYYU* zx%Fkl{=+6*L3RV%vD>vg#ae#HbS3&P3x;QOZeMm0-+7q#h(?O?`3rY;xOJ4xGbOtY z$X(Ki9_yLhO2zN?{=B1Ua)2kZXv)h`$6uS6(hh~Iq|%r57Eh+K7yOVP2w}>$S&!-^ zumYQwJ}a1Oy0>dg5HIpetel>{Tg(~(({8IR-01bX7{CA0PO+G@Um`zL$IED)=AMqQR$bY1@WgkCwtKD}38VVjp z^9|LM!L>T!f#Y<0#NY1tfy-jekbhgm@r9BWG<_Vbx2YRQploozz|Yoo`+9{NiQ;l$ z$*+VBU0QFhNq0s7>Fuz~Eh>S@7(QKZA&RM20aq`;>8+_juTkLAQ#IL`f_!Fk`^_F7(I+ig&kBaFt z5I!Y4cIS?u{wwYIi_9l-zet1m#CjT) zzqoYe38G5x2>WP_BWkuLYV$bXr36UZ2^CnLhr;HPKP1&&>)4r5t0@o$C3a+zSiou3 z?ztDEZKfq4hF)bjUBE0l0^$yZ$y4!H@axz+$GjYFn+@IBWf{pLsh5gp?{{}~cLBR-pdb4O$!Sv&zlTW_}>wXes}qWELCLH!}NCx>AuIuj(1Nlsg;s)S+*CP z=nh-@swd^~BES5|Vt1K!Qio(&9WXY)C)A*dQ%$kx$?>%4c^%xk=4-0*ZR0ow ze9JQnx!H|b6bmCUm4(!1IRTjzwf1aXV%hu+5Xf12#Ig+yDOsruDJy1L=qWS3B@FEbxz+}kL2V9txGt8BfI;jtfwPVGz4 z)?7OF#kJv<|FyM{{V^y`TFp-~Y~Q}9uhUs%EZsz*e%sM zGoot4@BdwGSZg&p@|E{~jR>5PJ7yaJuz#kTjcIRH?kGU)z z7%9ciJzSo9(CwllltWB0X&!PWou%JxHJd0hur$X707^p}66jOSf$g6sF(7IoIousD zPbKhizQ)bCg|#boIylDmF&j?FvrrJx;e8!tkc8k^cvzoROX4#KVVG1Kk_p=k!AxU>j| zbZ{Dwr@FQ&1-R8-Y=|oz9S1X^YhQeWs*_wvkE&7`#4%B7P~DANCD+d8zGY<{DtWT; zyxDMNNU1k;D3Jx@8WCHJX9qUnZoADg=W zH7Io@L(Rs;$}`_u?0R=2(J+fbVw8KFt&v0Oy(@$0J&T@0_UQ%G!+cBf5a{)x%bDBt z<0$4Y6=B$E6%~2p@WG;9one5`p~>ixdW%06Iu^V`nP;biG1P-T27;$Tr+l(ZN=_PX zNmJ+ESajC#Qq4h^Qdw2o^LUAKM;pgut#&Uvd08%Y<6bN!OB+z7FPW@;8*@xO{#}Yw zY^S(-*D)Vrwl;V05Lsq!w_F?kE_!}@&Z`GaY?;W%im#ru2?LydMFEwn`V@h2LAXGqs+;rLM{VSV$!$HHHe zaK@LIGk(Z;9SR~u!d8PCw@anT%S9%^PjA0mw0>7NLbH9kvu)8N67(BE1C(@joV%o0 z;3rMfY@Y55o~CKBGYf3>{}RU~5@>DIATt^H5HteY3mVjx9lLLMB;$AFnMjY$8@u4M zT+h{>Cho65Z7BSy`bT9LoatT(>Sv`@9Zx&+iOiWwS>a4!h9MMT&jGh(1>9CE!WDXM zvfGL(6?JGTt#i3&u~EL@Ob(*I_I<4CWJ_XjDZDYrDXT!X9euS8gI_54)o#oAuGBM3 zfUw&EGsbf>v(0B&&a0#Q2=h)&0aY#*$t}A47y{EaZdlgzlpcd#c9|TUzsRkHyBz!K z`Q6kwd9|I9rB8y)_+TGaHS~l52ZhzXb^OW3+ zZ{gnrd&Gh-=)*m^l)$#-RH?bShS9CYF|ihp;n(somY?TJ`o8%eanQax?-vVi`B&Xc1% zEUWTG2;LW#I#t>$&UplTsqlyn(d=}gXb9c&gZor9Zy0T>i=WL-Zo|8Yo4urz0ILJr zg<{k1naf_1N0o2li6Gy00wg~xT=nxM`$c*Qm6&3shQZd{!Vg8HPQ zDc38TnN=yerkdhDIZgg*N^p8l6X3Q)A4@-j+C!8e5I`Z)9}|^Z`dUlOOudEE`6tI$ z`Wmsv3z>a(TRpAYCSye!QWj>8p6}mlS=t(OJN{^-!(S{19G$D2(%oN=m3D?*eWRT3Hg=yRm7m9wflVO+g};t( ziesfn0K>e*87|BkEn;|U;7IR?p`d zT>hXeJczW4pALyUz8>}1`G`y(O)M4Wm56+Ao7bXYL<+5T(xDW&<8f=n?kS)T(#S*h z<7SCzXX@VFmbo4kA#6#ol)& z?(5PGcEmm3pW!yJ`P@lc+#UrT6WnEAeo3=W-rl!aKIy{8`dbZ!{EjP{;GTz_bjB%u ziIv_FQ@bZtsPhhmO754$KqDQy6N@?ZJ*A4X97}8mj8pcQHRA94d9})E8d93G&hc4C z)a>aN+r{$5?1Fs$_Q3Ym@)9Q_%I){R#8u7=7un*dKhsk=G4Qs!wR&1ddA54mNREkl zt`IFgd?H0wo(7bTY;TC5gD>9gclCG=rYS0#@3PYDqF7l=A~z*`^Lq*=vuB1(Wy9Q9c{ej z5a{xB{OoL&%Ne{{u}92e5#IGM!Hr09)+k%)@o6Vy7PG6B2|O3Efz*znr9eAbi~3I- zsvC1tSoGR%Tc(j+bIJJK&wiJ3r;2G4g%od{ z%Nr$RyPl4Txi(1E9w0trO{>w){2Z6R&=R&FIfGldka9y2!AO51bu>UZg<(jXa(FF$AY46{;#q3l<#S~(xSt%X1ImSsUr->;zH(Vk}@(OX%0A^&-Iz1!$F6Dti% zDQO86+;d@3v++!j48%`W7E|TVY*lx;`QlOS867(96vG6Os#)8%pmV15`o(dy#zH(z z^t2B?Ii7iBb?lhTdFQrWJ2GiEVc-{Yw&BH)rKu6VV+;-U)Wq%R9&U@zqNsHvur;zY zcQwh*v1P{&p7pUFtMoqu>$=WD6N9o9-(v1araF3H_q%Ai_EU51YC zm&btZjf0B$%Y>guAR(6EFnUnFD_LkRi6B$%U@W^YrXj?qOQdGO8^hg^jm8?H2}IXJoWEu97z4$Jlw_4?QmXd2NtY2CvW~xv>ZKJ6>9|HqZ@cC>_TFI}lt6!uq~% zbqDi+?}=jYN*s*aZOn2Jmm*h zc1ePOz9iu0^);7;`Q!V~l>IN=3VG;dpbsLHi3%SV)$;rO!l8Inw(wQ|@uU~7QWi}-XFV(YClB~m2aN4Fn+Z!8n6HV;vYFigJriByI!&RJ5 z7Rr+7h9Qy?-oCju9o-a=OvzB(!#-jIT_xF*9EQIg!8~U-+s^ObQ(lyhE~WlFu!+G4s#Cdw8?32aVsZQVp{Dg@VR-{_)Ns=%+Yv@%%0~NA zYSHe2pAe0mZ{Dm^K}cK*#MptuC29cZxkG7yMwO~e9ac|TvO|FG^l+T{FO1)l$YB(( zm~vcH;Rr`T!C_?{1;K~>|0BN6kDvSv6xwCg|poo$nC>5}ImH*oN5XN)qZ5&$-D%u+*TNQ2AI zk>y;IlCQ?unrB0WBG`KTXD-`x56MnSLG_FgEr4ZrVZM924I{t)hq>&t#*W5=Q7TGD zp1oTrtlojcf2($TWq5@pBUe;sC~dUi3=dW}l{v+e6G7Dp}K%xlY$jf3EL zlXD!7k8bBrNa;TYRBAH)4(b3h{qEsvb9OJ*ViVwR?Rm&+S2^@94SaPp5A)>(y%nsI(>5&kcK~j*ee|(jScbiPg3jmYm zX%5M;%6W6i(oaW34k}^rM(5%?r4rrOFAd5Sp2XL>z490gBxWR^@;9+hc`ez@u{CAZ zHRnLl;Un5i^A%iX{YFB#$`C~#z6G7e8TnqiFcq)k{GHIR@rMupde~|@Yk2MELoFyP zIA%Xx=a`;I>dsdu)ymRsJbM;kiROxeEwK^$o!dKxj@xIpdX^sh#sRQGM+vpUk?1k8 zO$FI;7Q1@*;)QorNA&Dv5Lz0KE%5~Ch$ZF8G1E1YBCob706 z^1!%%#R`6>Bnij%XE@z_pu$tJKWxuAzy4!$8#Rt^zQCGc7s!vxdPdMb{o1sF-buVBw~( zg8IVU4Yr+n*=vE`C9QE8nF&5D^tzuSoR#hgj*42LX>;JMxu@=~jx-lsHeiIRBX+-0 z+U9{?;C^Z`AwSn%L~_y7P4^bFf3VUh$?m&~UsRrnO0Pw31HYM7E^rdM$+Y8p{e#T%BvZeoepV;^{a^|$q+)ck2rs7k2=@@5mfgFWD zD@#NT&qCCxvqGKzwTaJ`NCGhM+Lrkw&XY=kMeC-`$JE$}*$j~a!e;<)UpiKa?J~5= zF&ye-`z2(_@!5R9<4mjPIm4|E4C@H$bS@0*m{lf!dD3h_iJ!?kqt(;xvA%&JvgoZWjD&we|WvM^3}Qm&U@CJkCheGQ=iw7WL`RT-L>i7Yw;${fxk^s7ufqR zx4Q+l(v(QED$CotH?~#$%G-Kqe}=SA9~G;Lv)^UR@C*VI*JAy58I7Eiv$DIFPPsa} zMxe>IC7u!d3NcsJvh5wM#?PDTB?F9jADS*?&Oan_oNL=j(0j9skFrIwb_V^-9I)q z^kM9FY|f=JlW(&$L))piV_`)CX?hoB)H9tWd0SbR`Y9;>;3U%GXkPISs$lLV44xIpjgq2 z@D=Z=T^6E+Ylxm}j$k1{m;l75DB>)0nz_a>b1jo?tz(DxFJ?vW{ML9tgsI@sC6(9(X^dO6-lmLpX)MbV&wS=R z3Jxo@E7pElK==>`79L>mk`k_3!3i&k_cqFAz)H}=cAVbD`@n0~2F5*A%pbb7z|Cy3 z{revt)&F_knWA0yQ8vvm^XG2*mRGf!V+aS_oVQu>@W*ZQCx2!byWdm(%|4h1D8!5I z%Pu(h;p;F-qSK*1@InQP2zGltx^eIJoZL64_>`YIa$F0k>R2o*jY2}DBK-+L`u)9k3 zLSO3?xat=NJmG{J8|PvR@*J*NCW0lp!F)&1>Z98sl)F41C_TqNa`BD6D0x3l!|hcU zX`q8v^sa?%0YT-H(oIekiQf@V2xy!LMM?g>-Qx(8`v2x|y)?zRK)j5Mg4z*u5OHtw zUQE4~)7$Y}@NBEF+D0VqGmC0J5_jS1Wc}A4$7IFOltPCSb^i)zP=U~ZXNY5n-i8Pm zw29HK{u?tWU!N{*3A!bF(5;8^K^|LKDr^I>^Kf{3zF8#_2!($*>I3~=VOvduy2BbDY>|(^3 z?RNVBj`J&-%@-zYh=Vh&8OF?h!O#KQ9H>;HtQ=B40zt0#)I-5s_K~C!KnCnlPt)F9} zhREX&p7QQu7DudDF71MAL7s`id+#+4Xu?ewx%>uegAp$_J~fY8kek=!3LTm|@|zqi zSw|YIj-HRm8R90MCPrkm%Js`QkXNxJy#rsFgy{+it7U(Tx4oBqP!n^R7aT^FMC4%%;HZGlR2kj-+aR})(Xw_+Sju52 zB?@UEmix>~(Cyb*Pv%x&`(NmUbo{!o(t=|nNPd{XHJ|yRkj|8luDoBQA5dvKVMZ6S zj~AxQd#>{6zPsv1D3Qs_axX0yN}~huU>?krA@WHMKy}``=t!jQF%QY13~z z>^Vpoz5-R?aq2%BEyI1ix$aCc8_sHNv?(_+XXSW#hD&G5nk-mFT_f`s6qRtlwLVDW zV5Nl2MS;6K;3`k%A|uW*T;zgpu&?j)@{?&;9Morp_RiFiSb%4nkEA{0N1rbEOqQ;^ z2wq(vj{pL$27WzIeHHPS5PS;$mCCSd3fsYAx#VbNm~tpvod+HJmtB8(Jz+fCLt!5P zhDgv96N!^zcw41n(ac1VnukI>xp_1;1-j2&kRLub}YMjweJa3 z`Bp@keQkqq#l>MHR|JwD82w4)!FhEJ$sllaV+19Bufb`pw?{ZPXnBAdPc%8aIw> z4%obEJn`oKUvjqKc1WZL3=c*hUGcZ~s@Mwmc!i`(N%{E9T!nM8gTuws{qAcXE_}r{ z8WH?px5Gt;?_cMs{8()q!I2ek)acJ7DH169u z;$yRpxsPFC0+PHlgL3oJV|13XX>0Z&YzYa|^R>rVX!SU_FCT=p3lA4y3lI4W zha%1lyI;Ke{oBkG8|P2k6QKP2Q@McZ!QUqY+6BTCCzK*s+LS<=rWL`$2`7RrT2>Lc zP?ESjAq-U%X5~TFW@0kJV4^A$y8ppr6gu$N3sPq7ZODz`~}q}`x)WG0Ut zf3L&Tr|99rUW~kHXG7c~vgP!QEgOE={&PGAXud%0%SV+X6KxOjLxz-{ zE`gkc8mq`b>F{3zGxl=avk6jKz1dDlkASA~_I`h$wt}Tp*(bgm0J8tKrCd=~J^~K7 zV&b){$dfNl{Z-qp!Q(bhvDG;##`?xgPos-d9qPSesWDv?I^qgmSYF5c=jex4JB2(1 z!eT{eN^oD6oAA)}Fz`9r}5D zWLE?dori5u9TMFJY+H1Xp%7Wwk!U##>}^o}^p_4Uuj%!0J@egbHem2PCYN%jUtxo) z%3y0mlwxRL51l7k(uQeQj!%Qs0;+cTrMpoJyNUa;Uy(;C;;Yk%BVA1RCTrcj3m>B0 zP4jyc!n{`ZMf^Gb{UwOGAr16;!Pvvg3%Cr?$-rQMeRP8Q=HahD!w~rTneQQyI2Vsb zi>m!W5eP%Rb^=UfDE;mTB#F=nD)&4x77C(0FHjw>x8aFGf`nXrFln7LBMfkFiuON=ad0hrI<0wU(G{R}uCWAUU(R2SisOPcI=IXC*MfqzOQ`H z5G*{A!QqO57q)?It6|#alD8DFUI^oA@_WOz=RTh{cpfQEIAI;g0}Iu|M!I0EWG|o@ zj;NdJo6?`=jpZ?mgqNBSbel1{+opA4X}GQFeHB82XOQR2 zO0`!o(QIUz?)w^B0)a_IkQNB$C;yk4`h;)#FIwc%#Xr<4DK^C>bFV{>eBUtu0|>g4 zrCU3L8Z2flXFf0p6K@EhgQi?<%~wzr+i_XpzkS|eiG2?`mNQG$@0Xh^CPvUAnn8C~ zq?E^;Ds2PtLqGq(QD6leCMd2Lit2=Bo&wwS`rd`xrkm<$11~`ZQxYfFqnUoQn~qbY z-+yF`BOB~!kNj(qr5sN)GaTq!uB0lVYd<8Rr1}1k5S{1Wk`utcV7cm8U0aN z516Cj)ZaTxIfniQJ=s&&?H7F;HavO#jV8y5AspjZWu5&xez`Jt@H-|NhMI0IH74Vs zJ+*VSw@Ee8QHR)4z)jwnhYA?aFS=OG&3C|rsf2le`#QsuEe4#ppj8=~WCLxr>9Y&LF8C8^t+VC zk}wl_eUxf2hzd_QS)s0S<=Dx0AN!-g&M1|bU5?pC8tKfb8mWiVhYG>ddJ{watf5Ct%-=~(CTefCoZ znN~61I*idm!m_IxO(i;}_sc0M{|^B??AZJ7o;(qHV_e2Mc1GXtfGQK4N34YKJcu~m z#kQT^RYmhrTv9(&{~>;JxeC2=tC*BMTsC1mogjl1BxTenRF{d6chArxeKG4`**H#p zc|Y-4$0KaN83?w2NIi=psFJ7uA@@PEQVlbEa^%+6F(a#lK?>pb$Jjqp8%(A2o7=1% z`~iB3iV5KBlyn#UXknHSE8d?(kr(7H>zeAkPYAXcu&E=5hb>Sz8jy`s|ICZ>f8kQ< zDb9-%1T`kNy*n4=fBukPei7SQ5REChe=b%n|B}>Mm!Qe0?{r7-w~Uxu)V^hxIDEu20SeiVHDpH?5E!b}Z*9-K+LD8n6Q_;~s zJ){j*p)?#t4`dBIf-N`#6OO<>7QXMU#`;(CN6rGpg6ydAzZe&hj#ySj_DYkyIy`zs z*Nhuwg{_RN>qMJ%%TF%Xh!27IpIL0<{+K@9pxd^)}+Ct$?zChLf51s0P;t z4gJyHd_v2|wqG${y{kx=GYZkTeesGTo!SMo-8g_b%?=u!`(XY+_JiPFhiLd0=s;Fa ziPeIS$cy*13-~KN2M*@9j40jhYB(*m318Y`x<_4?9FboQGPZo81UFXCt2qQ17)BYpKw+LF#HULp^>OyVJ0doYrB;Gv*EhOmW0mgjJ4 zw6PG0vD;lWQ`ReHV~8Cnd@PxVP!Q|}1ZF45+x!Ad-CH>C zZs%f^7G_BRfnxePVSt+DfPwUVl0fHg=aWyDFKXVemSEiv2pEuOPqQMs5KXAAd(nZO;wXBx@QU zjr)1OSqEm4;EnswrS)MU9fr(|$5aA88+Fm$HTd#UZKn7)C&P|%m*L5tsEj<1}j}L8jB9uL!h`*mFSHOP`x^#8^UH=S;GZ(8gG)Uvr-T<$DzgE|$zYvb3?DN>_5MdK zy>W@P+pS`z%usHrRoJXho7_oy{u@HQf)Wl5yMIHSWDrz8{Zh}+?~69afH(2T=lOal zlve_9b151HP}1oP63pLQD8M$oY~| z<#KNyt)i5 z7eOKv?P*g3sj?Zq6$az;K~gAOV0{f5(Rlc;+(L|Lhe35yutOCV((w|_0Bjy`?RTdx z3?>VWb?_!7aTKhHxa<}B`oG{8&@~vqE~#>buuu23cfJ55!}^TBL9P&aVi>ncH!o#? z;5NijDv^RHK~#U63zGY6Fb4f|R;aA~o^xqw!zY)|S$f3SvQCe5*2C_{pa^ayC8aM! zv0xR#|0SBH&r`z#jThUjpEc>o? ziUw~Dz(Xn~06?+RfI{G?^!8_)uf2tx&5?KhDXwZoxW54}C)2lcr(t_BQv9YEeQ`DF z#x0cPHNP7p{QLrLF#iTD|A+n!Dgp!xH5}YmDs9pwcON5!Ek1y8LPHAP>|8-`l4w_lESLN(ZfsS7i*~82CJf$=-D~$b>wdfRKlB@ z(BCX`xG;67cd3wLD3acC#lh+SBcy_DRLt_!*X6+yvV%$DXqmNmz<;W50ZYZ;4&GL# z*9#i>H?-Bei6Ys)m?;!m(%@!)OcU@;px#9jLrr1?KpzJGj{4F--Jm-dx?^1$bFrXR)4wE`(5 z7%yzOWb!mmCz!4RZFE(p`b`a?#eyiHa;q*0{aY}|lsU6q65IlzUfuxaF)ca3yj zE>~2U?j};z%)KYAd96rf-B&#$EjH(njQn^0SH0WgG0_P&JN7<(UP}!&q%5Pa<90tk zoR&q)Cq;=vJ^vA%*wJalz8p42i)JbEp)R7KQ_Ha>Q)}|lj&v7n08T||Dv#8jzC?=z5Bjh^&X|Tspy5eD93us zq95mrr=-gESv$7z%ogPlicRaIycal1?}8_dRND2U;ONr=kKycnOed^*7{)R>WM8^W zPW`y~uh9=f%@1I_&b9U99kzhsc=b zEC0Xb3U=;2R8Ow~jwLSWx*uE?$DPlujNHSLWdH~?6eG%-PY~Ozc-9~Mory82mc)p)Ew1c2a{}lY0(c*zF1-~&ROE10tO|IH?=}~K0dcoxcL!@Aa z>qB=k44Xf~t+!h3&Ie*!UM-5uDn#R;H?jdka1T z9xxa6{4REy`sK)VyP$xIj#%oIspj@tH-)*Uz!!3A*hbim=EGG(@a#1LT}aU2K=`94 z?p`v$v)ZV=aRXR(jsr@?rYE^0Ab#c3Ihx3SLAgo$GBh+W`5k?Z=p%*O^ke2{Ij|{Y z#EEU{ar4&xI#(Z={D*sI7bsKXP7G~LSgG<9rsyh}18#@%nnlr1XmPg2^}y!&=Xx7Ep~ zt)l__Gd_aMA!%CW+^Pll(IlPEhdpD@F2jQd44J~vBY^(CiZ%NX?OA5dY}zd;oAw%3 zQe~_=Eo$Fft^IXAsmJ||o4@yhvuIKB^fZY&yi`+(B}0ZN@D|#TOE@*&*!1)Tp9T`$ zq^u;27;S~H0Xx{*jml7Tm@czV>nwE}NR$tAZ1=@=Q)1d6U|QP5s^fLz7TOlFTa;c-51bnw!=WNXDru#~)tp^JY&>>rY zkR1zDzd%owA$W{s0|X}M<)PDwOtUEGcBK#yLL7%DCSeBU+}dU}P!*AFCzzor+LW!} zyyt6{M{V3hT*wF&v1!eUtD}~6_uilmE17~H_egllDaB5vAJPaPT|)pK2uQYU>}0>o zPVQKBKLtWbXjv*+1s^aW^BvXK*cYG`?Gia#z&X)v6ML^Pi$wTlrI z#nQ{%0i*<*tjhr6Iv$o5@fY@;Mz(Y$v!}5qpzbwFNq!~D4>5bzXzzUhSHALxqo0JM z(d>XbamSIeHt83V+d5x>-zAOzr8i-X!ReW31$U@&Sp%9^5i;})Gt*u zXKqBl-A#|IOY z0L!|f@U&*Xj$ayit%yCTd~I_z{-wdIKi&aI0&(i6KkMgRarG0@7Z2c*?i!Avxio!n z;c#jG&(Qf2kL5CDK3%|LAu}ic#Y$&Nk%D8#sD!JW9vEtBasCFzzt`Zb?!F64yIGmW zr^6#=Rkk>F!Y#=C<%D#Mc$7m~-52V&+WKG~vEuIAdw+r|qagT-x6T;~f9u;}>&Q6y zzh!}1^oiy{3W4V?kKQ#sCzz8izj331Ne`Mds6t^rhc9J2jW-u5U2?O0T`iR9g+`K4 zV73*gkz+OnC?ZZKoN5%RnU3OT;EkE>XejrnMWG!E`&ze(g1`e^N*()L@zrx#9jr^T zEp{d!4xVsyfrrA2L1O4hc57ov;1(x_CBV>W^~Lz>eNs0{wu$BK=a7X~85tNxcrR#7 zcDjjquTOk6eWonO@@52VcKLg1PH+1S zpH+w1KC0w@bP80m7sJ|!gHL5GzY+_E*cgS5R;O@mZzsjSD9e=Z<>RDexlp0A2O^Uy zSBE+eMelvD-uo&2p3ImFN2zC+{QI<7&*M+zd=K=daZ^54l-02_N!O#p3y`^OT_RLO z%e07v2X{lKQ^hm-YuPR-Unl0F<431C)cNT@C5K*HS^8!6&Zf!ABx2ZN3zi>@DagTy zoDc$txVe8#50g7kdf*MuvnvaB*|36Bz~LWm{^-W`v^w-f9QQTJush5^o`2Ou32Ke# zX=rYrEiKR83r&^@NxasAG@v3>%t<3AVQGqQ(XTeWXXI690=gVL5=BVV7EUVXvu|u~ zdL4x7rY5dLanWto?N4DV!Hjcac$!a^cHMLRO;clR}}g8Tq@I9ua(F>hI+xMTp+v+<=QHM}tpkuG`b+@SDRkLL?V z?K6Ou$F+gGg=LhZ6e^l!dUYqZ;~$-QS@TFE-7!mi>-JtTO}1qkMGx^3yIoo77Lzhv;lQ zwhl}8*~-?#H=pew&i{^EP#HnR1f4fL>neL6lz`yT)`NSW)_duL*dOiD12ot^P|w;C z&gM?RFw*N_QNVOGCsh9%PgU>rhY#Y|aG|Kta6nS`2H~`b6P>p!b>{ zO~%O;E1c9cB=u&talCZ8ljHR5JCx_#jjX%ZL?N*j#HS)Jbp4~wqn~;0fne$p;(Anw z#)hH4IR%PKVsTJ`8vMeVWqMpS1;#js;Nw6^G{3&xz(JT<06a*PnknSx%2GXNA z`8h+65Ja(>4je?_iE!vR?_}06NPbn$lcoY48*&jpGY@D{>KF}3d zIAG91uq{ydUh_G7dNU)A?dHvNYpK#4z{{T<(;6@D}*;--HdbGAYukJ*v9BVP%n zEdx}Yh{M8QWZ#anfNVOKhXyu z)8qDK()?=+v(Wq#7x0eb=(u69H6bIu9M*tCQ3w8O;BRlv6`b1hqeRvYN8SRfJa*KZ zrF?Emz1MyS#{(-3(zSW6B_pU_Vgyk%P^ZlO&uKvP*X{e-C%4o+zG+z})bjcD31S-O z%-z@5KaZD^YAt4@2~8QwIu&|pS2Z&d6vA-pQQNUfo>}{6y|n7PFEw+MhgUm-A7+YT zg!x)l2I`$ML4X-{vaKhoBrCGC0|cduI)wI}l)A4`+uX61C0;>G2%`(gLp}zE*z8(e zLlllQaX=^tpUVERh zw`L?n@r^{mE_NOvA@$ofY3s7Cye+v6(@w|#iAhkkt;R5CDh@}x?m`F+^Xr9pAZ zBj+VSN)#JgE7sy(WbQ&@XKid+5E0PLS_ksEPh>VP1SB`f?(uGCQqcK!YyA(YCuZL7 zB91Xw=9Qc>@R;p*n*LbzTwN_+`^|doXo`? zIWs9k`-=P_hX?Y1Q#`Jnu;)brHc;1SWfW9*>pz#q4^&FN6w%Xn=>&BgGovy}HXhE> z@ko9=`s&2tgd?33S>LwArdI{#&+BvEhPea0lsV|7OaQ#9_FYS%N#dmg0i$yV*%${IJN7^MH}RSw$Q-a1NG{_3|Ksc31DWps`0q}mEV(MIlvI+) zp#zn(4kCw$jX9r^Q;~BcRt^wEw1 z`}bc~N}t2~b$UJ@uWz)eD%FBPnj?{V5j&3u&(K#2pX_>8Q|<+cEAc$KGoe!Zv4#-r z`FM-NcL$5VY?^585l+7DS3eqY_Hi2oXoNVm&rzEhgVisXAB{vS-dR$A(;m2tq?Usa z?j$oHc^#d682ZT`$d{1)v>m`-rw2@r0X1QThn^h%M2R< ziY5>}w=L=p_x}=vb!;2Q;$dd2o9{=GsXlcNaGqw;p;jAk1;vcGNmY8GTAy{`a}w0X zV=L&3!49<1;+N{pfL2CvN+`o0xP_Udp}Hm-M~QY3+T=?##H5A44dZ=2Xz!xEJfS_i&?U z`k6w}=d``FU8HK+O}}=8kV^V&LKld+AgisgE}sh;U_A*js~NiQG;{DettA&T^lINf z@-+5Qr#H&{bn(r>u%}G?*>$;}s)S|bDW zp9l+Bavz|rUpZH>U1-%=qPoZm^ls%aKjkH}KFDI9Lg6CpCL!{t#rf7vXmD}hRor;e z{*boQ#;5b(fw(CD{n*{UL93p)K#%>K3j5%RJibATDeK%fqJ`aQdrCmTZ-99srJ~EI z60hmYcK&=50mn4}oo$$8=eHR1G?}}wpB6>Tz`BPTfnSc3$8!uI;HA<*70V!JF1xWa zY2GJsR;GSGWUao>MQ5`5G+Z=5J!6EuFt_$AU!-U-akGd5+|pV9aXs9^obyv%=n$VO z;?{g?qXCkX-zV>*D+0&-aD6qlqe}3Mc%OiUKpCro;5Z$4g7+UODQG~bhgqCm-hPKV z$6c5=Oop+X&y>!~b532vH~+dRt^FTLb|FFb@Dd2){_3^+Nw94Vc>?x;0mX}y6x%ht zdzI6*i>x;KDHNr-*C>Y_2X|$<3F^1O^^wA=?@sK$QMT^YS{oK3t zxMYN}8yK6o=18cS#rai#Io?@br?TVeL*i+S6$pdcDw+W00pnJWAz7iMiU;afWe?;8 z2luX8+NBVC7wNYB)_=r!L&QJXyC)FHH~cZdahfz3HN1if^oyJ-XuKlbg~A6O zyCyoELRFjMZm2Q|;R-PW4ed!k9-2Hr+Kj~T=Z*!czm-CI`2YyB38m>XgL}m9_AlyR zwHME^Lp3O}8dwy)kjjvVk$3CEplU{(9i@!rQd$&C_>@C0&w8m#;_rQDS~< z$bgRCfBR8Gs}=5`b;x0&IJ!Y=gy`senKS_^KuIqR$%wXc@k)4>S5Iq&ehVh7#t4*^kOM+g`afYMu7 z>kh=#QVplBaYCmT8;O9&o{Kqrc!$!3nYy661fB@E$Rfn`3KbR4j+pWAl6Ii+S zKr;dJ(hl*O-9@~a*XBJY4M2RBkCOQToaVfLy!%RM!S_n+R#>edKEmSs%yNQrNd zqQk5uU-h!{FCor$B(~FVD@5`dvh>TuPUy^sc zd@MXvGF;Xsd#9;zlRuBKz}qfM3-iRVM&_GWP&c6xtzq=*ngBRj7n1j!vxMnbLmb%5 z3>tL=0*{o;7)L6`V>rTY5RC6aCRgpAT^3q#FS}qpByPb%d82JJR*&RL(NKODqO=IJ zQZiSbFMqF0zqXz-HDMo7uRcrc2fc zO1?%*(d-^sRIQ-O&lB5e4g_s6Njk}H=-5lBqodj{*e}(c9;tvh30iQR*7Ng3vMA^j z|86G~Jrl$hbor8$Xs7#YAo+{Jf>=As)8BO%yHrYe=~eUb@zq$c;MhKwb58^u+Z|5Ew%M3#f>m| zzcli6Fu?-+xe`gFqu=l)7HB;or4h=0X-+dqXnm`OWN@32JAsFj;=nQ5$04r8{=x~l z#k%fIkU1Xq9B4ySJElnKSEvSkt#al~n z0)n{_3C3tf>bm`C#r=VNk+ySXt*Lx__X=*3ANIw89m~Cu8c)rSFRl zim9X5t@+6YCPWftYmG>>rZ9I8=Z%Jlq6^dd@bS%X*@B$@WM8YzJ;PJ_MV&0xehO+# zl&P$^=TXd7brC=Az|A_+-Jv@{hf*#w!(tr5H^wxr-QM=kEJx4LK52tVB`yMSG6bwp z0GU7O&cljk2O~91FXMBO&>nXsyO_@ApRV5J08-)pU`DiT#>Mx^@9xY#-3O-+W>{@f zT`$+{&F;)_Xn;p{uFZe;UiJSj9zKkw+`GJ~7?VWpDBl(@6+bauY$1I_H^XeLm?8gQ zI)8!|7Y2=V5E)dO^FAiIJ)sPDG}#=@HE$Rvb~;Y3SzlTDlKN|1f7*yjwr%dxJUq6X z)eiD3rfuSwIn((*!R%+6r~>n~&36|%OPp`xmm`VMzbUg*v7@qu$E4j@w!i49gHgnb zI7_gMp*}X3==`wu)Xbr~*MI|?iPmsmjk`+Xk@lS>(89+9pP60LQdILuSU0+SzuUfC z{9}#RjzPV&tF!fL!`MM1tSzjCSNM8 zx+*Jnz^Sj4!JM|`gJ$2Mk+oy(47tq&uZofE*$P=dC)XlP$s!ezcbPFQXT0j>7&FUp z=?%{P^y#FAF~`t_v}c>oA80b3+w?=6Xh-67SnlUb|Z^IUADQxmSDhdwV(J8co#P&qd> z@s&u(J_T0WiIxz`dyv7hb`|izU*m26HqwKPhGIpKhLCOk_$Uf2L9Nwa|_c`mY$pF>Q zjP+SnNu(vIGbJWkHDW@HY*#XrD*3cJV++)HyzbgaY7Tjw;F6|49=vVi;G-#Kxcdp; zxVFo%zb7HLQ(d_*^1+L$8}GN=M!#H^pk*viC=jbcRF9Z)@9YN}>iUv=eplz!cJgZIlJMKi&xh1slF$Q(4kFDzRMhMo6UV~XGpA)+t# z$_!?Tw^civysZQjOmWy*05$Ph}Y%x{CW)J%6moyX$eaO?-_VvABO(F&TSq>;`Tgv2!Ul&GN>1+W%8tC64#2Wj7dA?!Sq#Tz)b(G@L2$F{OHi_ z5k4D>f&1isUnN@i9`c?3)MT$%dZE(%YL!~n?d!sdF}uP}H|)r_*cLxjqiH)?aj-7< zSfmGRkoYhqbaxy8)tL%njB3SQ}DU5nR?9=ZTgQ zhKk=>!ydOEVvAl9b+-w6IRz5mM%=f`qI0zUzu8HksR~-jfS_qgTg0kSB8cCFOpOWj#KuRAnoeD2QX{a zdX-;Cy`XMam?ky~Vi`IO=A&P=_-}+amQ{cGE?gUosO587d5Ccz!Rr_GANua=B0K;# z#)H)HXDtHP)#2Lgg=)gB`QNcib649-9m!c7LtBG!D z_0Tb@;q+hU>%1OEbP%TqRq=)bSc)*z^DF($X#E6a2aHr*bi@AE{Gk=U@xjZJNez^* zRH!_W-ex59u-3(burYpCoSU0hwSh%lSUgP#8jcL5C(*6-*RB1o4btbLrCn`bmp2ur z(QBT47WIe}iv%O-h}iq#p=ThHpFY#Cy|wY-5o-Xzv3r&{4Bq0U9zi=v(+YXjzR!I5 zE?LYL=qUE}YA8^ojSB#P37=g8WEfx8b@x!n=9I;;OR`X7(sxX*Zk(pb`jZZwtAk;+ z@67gBz>QujTX=ksH;6FbiR zP)1o3v`Mlhd(LzW&OO4TCV}wPUOT2AG8cMbD`;1~yA<_tAazy{TjQN6G&*WLD}oAJ zms&;1`b6;OZYGapZzP_&o?7fR+)h{%i`qYlkupdv9#0+VbL-)eK#Hh-V$rgO3nP=w zvN1zZ$t5fygETB4DRxxqgulN6?z0QE?k7jp)9}XXeZ#so)1M^=!2%9j`RE zF6=>=AzL&)$mntZ{q)r-tj5P+wYmP=GZRYoH&n4tVc&C+$-jzjk6t}Cx6s-AeKfrA z=HHFiZfD*T6od>T`bVmfNEEh@uH}^f6`oSvQVYQULTUj zV`=gBU`Ye6_nn4;pH^!F#y9;1{i#Au45*mv<{uUQDdUm!8EGC#g`MD-_a%B^#-WRoSA40eeake;vJA> z^0fqAY7;lPPx{PKXW+o-Es)23g;T1S?@m{Mx#S)x|?m;KDaJt+G8(C@LYs+;W>ue#Oq4V$}hLDv(7b-K(eGwRdQ;7DAG}tFz$lWNR`hteh5F{+!VG^CZj_=Q?%o9kvRR% zyy~qY_gf>M8GAn~$J~dCMQQ^n|46or0Jd7me9Vh9ab)HgYqt&S;EXZ@h1!}lvstmM zaC|$SBChqB{?~b`NxPx^RTjt=t^rh%XLJldwu!DqP+Wz*RO)%)74~^uZbC?%IJpuq z9&}rC?ZvsdOvK82OBnVJML)yhLI%{e7TWeQeQWgG=6Us?wCalceLtZgZu+YqN@9Z0 z3q~w~KAM4-5=!=cozgzYX;sRpl0DPeeOueSNY$jt(Fx@d=bYrh<(5DpLTK0Z%21)f z3oVsMA8kaq6jIdQ(zATF14g_d_;7YLRo41w5UXUPx+&ZfVH=k&>)Yip8-3ATz9_ff z$xm|LA`T)w?Z z#_}!gw0^qx%{2I znp+?3lLt`AD!p>GcYUj~Wy0Xk-b_K!@G8VG^j1(P<;S{=*F{fXJCL!#&}{R(cj*58SK)z1!6k zzcz}lU|xxh*n_8Y8+zt`OSiUcCd*i|&Qcjz9mEYt9D6q5$F!b*tQJ^0I$hGu8J6}R zv?|GLde#>wh?}rW_LIVI)#1WuwO-3~b_(BRra?%GWbz9p_>)sj4O;A4{SKWXJl1+D z=k+0Wx9QRhv9x81+NiX;6W_96Sr$JTyT_vR>Wwg|a%Ak*({F+ivTqrYP^JZsZmGFI zTwbksCY{Ha$7K4{mY^uX?k_!diY4{xgowP1M`C%Te3SwDe*U}sfxs*Ac@}3z@D$Fghnw;y3;b1J-6*V-d@EisPz z-9?rY4${OxWx6k1kbl!>bq}ASW3LqEyae*&(^5jCPmi-?Tm!Y8xqN)!halEZ+1Kxv zV}qfD{;>O*l9jb&QJp%^;h0~tn>S5y(cyyFr7@wnH_D`T@hjbPd#Szj(3%9l)6-)< z6?mI1f_(#M`Q~(d{rW-MsUXxXaPBMAnd>wB&N9Uf+#q!C zS5ur@X>qFi>MPJ+GbYG${Ty3So}cEMP!{b2Dr>Z*>s1uxWpVygP?X1!V_y0@#?jj* z-3x(w>h%E`gnZL-Me4u+`Eo%oaZAY_*fL-_Gv{ zuWR#%B)TO_^b`@yj4yfBg{@d_tLD2^tHXoW1TuuTb0s!Dn#Wn?#WI+69^-tiIMj_H zX3S9elxJKBXgmOJYdF{skm6U9aP`g+y5pmyxmG{25%eyAk?2rsial{-S4wm<9XKnE9 zXXVFm{R)@S^?A8*rQ}&z^p3x(5Hmh=%Mbb9Xjj?jz0UT4%te!xPS%MC@2anYCt!#q zH&rxm%@JvnUHLY>`fDadN|1cS+sbrzZTK8(d2`B^(1vutNFXOE2uqg^SKA2qD(Q}f zXUMfIn|p`vTKfhqEzf9e@eY!#q3~lXwdDEoOKK^9Gh(xy**%#&)ekpa3ZQ*aZ*-~- z0EI)(5ljETf`A|vwT5zlbse<5g^ZHhf_tk%dVd07lT0ApetCw_z}lppR#l60UnRfU zzK^fXf10=4W>OgQd?;`BkiW^SUSxrAo=mROl9I@nL%%+0`@O>;a8_sOmU#0rQkP%t!V$hlK%@dF-{r`-Y?qUb zvku*=c5Ahx6n)nxE@Z4z>)R`@kQObL zTD64oN0lZelUna=^n3#3c;{T?-)xJMLi+67rhi5JcJZ~X(6pl4+l;+4Q+FcH-N#?$ zK8nOKmGf=H{PMf*WqOu(-Nm~Sfh6)Y;1ivgJb-iZ5YA$zt#Xz77hr}Hl$PJpyFBJI z6|B!KZIoJvj?j7fD$Fxi`!j-jm%no1&EtHfOq;hqgYr~Y{0Q60Yx*{)lJ_-NjsAoJ zCU%U_x_mr)dFih0(sC$WKdj@`n@Sr*L;>y{re&t$&V7@)WO8h_; z8Wy!T`OHuqsM2cXyAF4m#4G+uH$wpLSBlV7KhCU}P; zF8LNN_MG)ri2Ygp`4Z);7i!)4 za;E_t7x6I0AX>){wE&UFzihZT?O1QAzbaQ}gkDqYV!fSv8C-_GF&zXB+m5Q{I`5Rg zmy@+rWt0NRd~VAmKBYZCrMJH_H-1C;-j(&LNYI!^0oA!BuEYI+w4o*77@q(!XX4ow zqns-fN%?mc+dn7pvH^plK220CAGwe`_R7Tn|pk#k1HL>m>`h4<7u2wdMb7+>d1^7m$HQ~J7(X(?krHAqQ)HP!Jv`_hfzKg|&L z58>w(PWfC2BE1Xn$bsG4TXl~6xqhW}IchBhUpaa;iS;lWa7)wMq4O1rVV4x zAoJ=4OmJ;>;esD6MW}^nJ+zf9ZrDaF@AD(EnVg2cjQG>bt&ED76{`v(fpA=trFuqY z9oKxzf^z9)O3#b1{fzS6Faa+A<1&1-tSkPIxznA&Ad*fNMpe8--oFMrSZO2Qyya`K z*$7twWB%1CWT4nSz97C&f>;-i%cVd2JN&6F+-kR1>W}=!snD(oQTh)V`CtFiSzukz zN_jVm1_g6?nfNmON|YpHqo3o@4`k8yEsA2V7_qmKJ4L|!J&fG{glI+;OJx4>(M)HcUx zicg`DI7#Z{tu3{-0$4D`s?^V=rt^8#?U)ii31mB=v?>fdPIoim*THdxjZ=oWJuZjt z966nyXr6J9c2n5RkUo&$9wYlFC@0gG zI~n2bC($3K?`|JTP~(2k@l=ib^?0byP?!XAybU4bFQW;`e;5?}=>c(}amTvq*MrQo zt`%sX_;7GPhDCyseT`#u%0lm>h#UUVp@+_ z;F7z%$q_veS0v^R_~I!%6A;}_Lgol~81}t+!;+lvhnubh$Q;KyQu#*vW`X>#32qvt zbDj|)gAk)6VJhVyjgkqu(+9S!oUI*J`(RV!)_ExPWKHSu&GQfWw@B&-CJr(Vq7H9? zVf*%OWof773)!`Gdo@X0e@RccbliquUSg5mP>LN4p}q<3EjJRN7}WT8DCv&>eNGk` zo+pcCCaYf0o?R9R%8cR8AP&-!6{utjb_EUQW*G)P-BC&xJYvCx3pG?`cGEn|(4N&zjdg7dJkLABw=FrWB|2DPV=P@3;i|1Xlr zFE@G3;3@L@Lw%yYKi99sm)T!E79u!Me5@V5K{wbnr)1r#Vie;JncqZ~?2aveY!>N8 zbnAUyXpwKwxM2Ef#WBqiugfx%eICI79U58jD9)iJcr*e(oS|CO@o3B)GZ2VURv+5w z9vJPR=Gp$Yr=`{17vzYr=`K0nzZ_j$rqbhh5-7~=@%Lc*3gq8UipGg&S7Caykv-1oT8Vu|4 ze0&*AsXhn`BfWYu(wO{?(l27^X*Yi>JH~OW*2fJeg^ZdbMx57QzqDoUQbHn%q+*0f zlaL|@)Sf4p3e@xM*3WPd^0K7&=)Mxlos-gE&5Hh_EtvK_<+x-xaWn4R5V{V*UJ+Ct$)c!ljqi!Yz32 z9BrD2XYtRe*c{s=+l7;Z4o!O2#$gc3?2uSn<#ocTBc?jXlefxU06V2@i?_X!mUpjU zSC<4*k8(MQluGrvgMZgk`Rwre!J|`wbI-N}zC4Cn*;^(1J|=BB&xV)0IT7%}53_N> z5J#U@M)_NUPX2OD+vP6CjUxZPt$iUpadoIMRo==lGZ?np46c0MaP{if@4ZHroNgmw?Nb`QG#6FNYs7&3Ro2qy#6-0|r!4~=Yu|>E&!u=H7z{i`3W%|@PlRF4(@Hqj`H-UwcQ44nw zMk!tQm_$rL2ePqvhDAhMgJQh{fi~I@`No(bC2t8-hRZ-8c{=iDnK1!|U~$n;u8J zE$U@tfi&gq6{ey+&T~H0HDU++9d#gUyQRhif{!xT? zdX3Xg*f&Y7z0eWM*y>g59a7i1q=l9)t58hsA1WCvW=!1clmq=MNdEgf);59Cl>)B? z1(uXmYV88oK2MNm>nFY!B;O=ptS>rBc~o4{5ANd=&wJYl+4@o7BQQ(jF6ExDT&cx) zTB{~%2Ygm4|I%=UVw`r)^kjYEZ=O$zj^SKoeGYY&{Kd)V@Z;{A%yIk?F1wmlzi%l|DdWpah&TAKH!?>)<~*RmW1F zXxPSEEB(4UfiK^VIxg53TAiW(F%UTjW>#k_KAUNEzkqd4XI<`p7hs;fKmD|X>?tQl zfTK$Lc>G3#GqZh_~T0dYAw zw`);W`Pa_fs2s^UZl{g}N6ZuI_Q?nNst$yRqF8GF&F-H5y%gC^Vpax-3H$-#F_*N2g`uL+=OJw8%~=Xi zEHwGZk?GN@$D3~vTnctgiSroa!-J>JNE$gzjrLz!ZW+1?>oGmUwkt?auTZ3R2k9RB`}KdvS&J%%8q9dxzdvb+rX-7AI7sQy<%p#fovCKNZ? zWK_~OO|vffr2VQJN3A+u%d1>|r7;@-GtYJjzAl8sZKVAYkwDU~gPJnauQ+*-k#}u) z@s2(c=N9l4HO;S5+9qKLrqx1zA0*@6DydneJeWnFgq%)zlV#J3o_cBYb4hNG5mtM8 z^xnkUhHbV6yTR|HS?X%#Iy0#Zz1xBK`#Q_`KGX+Q7x_ev55o|C3D6USG6 zx2#=7Vd5jko3JtIZ|PP@s+Kpz8QS_&KEaGPYQZp}msaD^`gh4Sv0R&B94em%nhMo) zYh+^;Tq)YRwvDEu%DOYYwsEnepD$lA;HOu9V0u5RxZEd6kC>4@^xF{~4_G36tHYjoP zQXH%JqtE1%592jYd;9>M&uwNSG+DL5da;joqB zM&sX&yTdfdb2DEjhL|^6o+eg=)b0_$mN;Fx$}R43s8rcH_Q^=9hr7A!+4((zKFK`B zdkZbP@bWD+0$L;cW)D@HBjWR%?q>u;^2u%TVfhYY&P2JPkh#h344+>@aY&1g5H4U^ z-)X#??GQzNz84Xsae4S0dV%zjDpg zGAq6nAA=1$E!_XM>>7S!(+`mp!hhq^l{MZTC}c}^$fI$0X&dbPw1sv^3LbnhJRulV0C|w zl5R&d)l{71PF@bYil%(^-KhCti3DwQH)g+A6>0--VN(^Nol~)%&c!HCXs&B%l;`zT zqa4`HP#C)`R>%q+YK(Z|O{&Vh&=^|;#!ia%`rv|`AZ@2ZxOo+aWRL+Td5p(W@>(si zl&|T7Zv=eV_Pq&JI+(RyQJqMuuxpi!wfGD=T4^5*ST8*^Wz zi&e#UfKi<^XH;jaJF|G5rhGs@tyF*B;~qCfX(3pDt-_)8G#G*c`TTut1oXZ6Y9r!T z-lo6FoE~4O)lT3h*3gkSDR<;oW=f~4OYp#eYi&wKF1wZP3(mPekXv;SO( zdnQ#s#ILYYb4w|8<43@BzzTY0p14X*9LCUxs~3iQtslZDhLfG0Df!w;M(?UqDm2oY zQR7y>kb-FvP-CO43$<>e+@K*7^!y3PR^&JE`W3s=ShKTKU~7bX=SDVV@ zpB@G+|B86=1B3InLq#f>FBbxjyyCdk_X5ihFi89qzTvr0n634~6KY)c?C8Y)%*h}5 zy`ce5BrVH)-MPmgPpXXcWgEV%+b!KyQCM-?{T}z>$G#gsWU8I(ueAP%$HH^7mg9D= z?{E_0#|{mqb%Pjm6M=%tfkt1WeyH)WJV_Yr7;gw0N#OIe+{^$$F;}9-^Yu`wBB3by zc|3CtPxc=M^C~NYDzaXen@YQf*|T3q25g4P-4@A~58DF#%J&H^89R}JMTg2x_};~l zmjd@vEY4-`^IDVg)AY3~$5itsKaolL+)d1;%B?hSl!o))5O&1SB1}(w?T-hAkV<`s z?*foWP(&At*871d%XA4DrKO^5tb|yjMQ1E{LVv z6sx(P6A5iYp$?TEekmN#5NImdYB}h6!uL#GW67!5F~MG6!hi{Jy_VacmHPuez1w*s zY;EsW3*5-KEV6YugzKc5jAl_Y-G~0m83<$3~4s*8x?%Fq;feVh*}H#`oML5kdW+dM@yMbIUxd1ytZy(3LLc6 zPbZA>c!r4YKBu=aS{m(ts3tEL^!IG;x5h~(2rNmVguG3XQ`+-%eS8yzUiG+ z?+HX+p=z(*FDkW;C#Tc5-supJNVUW$$KtKOjE_m(6FNuh{!!&UcERv33TkP|lxOM6 zxv2ZXHbeSz-(c)zQvh+L{3?&`vSYut>#bcH({}sxb3}f35PR zY?i-vEHon*7!rQ<=r_dnR@PYWHvQz10{*Fqdn~tBZISmKHgQ$Ab~%U{1r^Og=SIP%=eLr{=j4Hl|y1ae>M045 znh)C5B$0Y&E63kV5Vgx~hA-5GY=oLZl*X6AUeiuAi( zt&j!0zgI7R+s1Jax1O*0HvgQQKI_iRPdV|IV4lqQOX7o!W;MSK1=`}!m`hC1M%+n&4 zW5R6hWt(gMW5B<^hqC`Gu(1NmrG7W7VTh0869@b~4i4d8;^_il*XO9Fby%6pyE(rL zI2HWty(?{t5#A&-?uD1KsGq7)QTA;kImfk0$J6ce+V0;<-dl3`i=a`;9o-6@xV_mf zhhGjd#VX*viNm>hKMVyLvL)XZix^>Yn)opmm^&d-`tKpH-_770>`wp7jGVeCme6-# zB|1ZNn@PZrcbxV@W3pR{%_M?vpR39=?8=A#@7lDH=>u;vWbr3pg z3aKpTsGvGjao@KOutOXHvqI%WP4Y)`lbiKz7j7s0fmUFEFBuq+A8d;c=!mWMzXy?O zfZ_f}i7dJ;UfEt>#D%CIc%4JhX1kR?L9phKS*nGrK|2~Ybnz%zU@22<^cC@RCu3*Z z;_O7wwnt z53KK7Um~7Lhf>7Pc9@jXmu^B_g*oKQ%O?z+1LeDL9>eo1!qH-4M3X`*$lAqx=F0lCMm#g1~9zvm!)^9CXCc|f$)P{Dmcz!=t}O^zKe zsc*UCaT&OI#sg*8aZ#2-{69)g(!O6ud0W!$@?08)IjN#2RH3iVrY>B;{~bclwbA2T zeje6ozY+20K)oGU&Gxcw8zzpRC*7mjn{R#tW$MO<#GkX|Deis+Z09*%{6-^P*23@X z$h$Rbyg7mCNCr%e4#MvZ7l8Mp3XIU)O2h+XC?!DaBk1=$@~Pihw&x$rI6Rmx_u;v8 zRYJrm$?W?tXAPr3$BGZwR0KKe$eY*<87I3CV2oB5bIy6xB`18lxYEaed52M?H$hve zlye^w%2f)d7L3UA!!?6X*$!L|9sNIy7|zZ6&-Q0vB6ykYq9KqEuo>#bZNN!TrDyJY zghYKQ-`q(r*byB;=1BZrurP z8#irnEZBfDl|;`Z@8m2~0qLw*RUP$HiRf!O)FrwUYWy#Izj&95k^CoMe!dAP7k@F$ zm)T627qrkxRa*;94sYXs&DG#f?lB2tJE1+5ENM_LwLkQY|8HX{fN@NOu#rLDo3a%m zjhC$Nt3BC06ocKaj^{}Q{$B8d>4$XW_CNr>>Q+|e!{7HxS9JF&{XpQH1|qKR1Aw9- zq8FRdAScXr8)lr*<3?f>0Wtvo{UlpfFZ8NyPwv^JZ^Z#LysuB(A5y?S@7V7p-E308 z@feU9PdrRx)lSx9LYM)?%~$<{UujYe(zngY2=vOC5InP8u&e0x@$4> zBA9-Ihq4_IzWS4fN-LUveHeGWJr@L7PfrEWO5rNtPKmNnZ?FDMSo&9_idn2v9bK)P z&v;^_vv$7C{LL9!^BuUW%!-`%J|7JVNOl|-ci6dVJL;sLrIJ)6p4x=-~l9E z1;?8Z!oN}mDPAfVhOxxl;lS&S3~ZD480Trr{g*1XwH?kCpQmfjcJ;{J2C;}g|`ePrRLj?bOD=MH102=C_ zHEQ22IqtD%I*!<{w+%7-B(xE&BjwgKji_5{hfVBVsu)r8Ye#9~alD0L4e_!z4!{PD zYm)}!YdHic4ghk~lNT8(YtzWt53?WZ2?a@n_J21HZrg6GMdrFZJn|((=#9=v!6ESc zjnXO1&@MB1@%Ytz1;sdUaW2CCL5%$ejgj&nG{(Op4Y)CU9P9cZh%_P)6!G>baM*I_ z7ykpvxR2m?tII)bIaL8z+0U0DG{{UvQ4_lZ19p=fv^G2Ye~BqS4drX>5a$a}xJl+d z0Ep4p0W?m#SGT_#RNXFXRo1Nc-kO$xiFE-N?0=$*faUKGKsV=~_(90Vybabtv|3rZ zSymAP-$~~pMwr*$_yb(Gyk^+|Ke&24H$XsW2+h~xpz8thl=Gwms+F!F`=JJwJph*l zVWan)&0YX-;IK>J^|3wky;8aI*e@Xx!y?0#KWbxw>0o(hxb};x8iJ-jh-#fjyR$KQ z==8JMBK_4x4!vBzQ>pk}#_J$z3%rm7CkOyz^j_kCW^cCG&5jJ8$UR%yTM|qMq;;eF zB8q=%6GsYF3IEZ0?TGotE9~YsWsTFOfF6*$j5B z2SomnW~yZX}gpL&E#0PNL{$0Y0I6n0u%n0-}4_ck-NH>~BxnaW2-yDNBK?8Hy!t;edj?=%>7U(I2!5Pg`H2jw`SM7-E0oe~&`Qzw zmtOy5Dx|{tUi71u8$8F#nzw&2RbMF`u9H>K^M8<^%SOALWn;nsni>w-r%rH&AV8wo2{)q(3pFt#$J^RPCo=%Tu71!$g#>KFS8HWpbI4_qk zfw6;RM3a6!K0*ujsQpp91r^;=&wiH@e7cp8?*vBK?n37rHbpPYP~ht)uDF~$b+MVv zJ%oL&fY&_zP*BC*gh<%VbAk||d6xLEZDY%;E6gdy# zh^6rcm{s{5_>F341nFmnZ|e zewg^-#jj77TvyCDI$)#Cw=%UemU^E4=3o6;ziE_om&2>v4a*O%@wZ%=95HII>CGV2 z8((6-aR5K__8_h!+2=CuUh@S8E1TTSsNU+@HRt8ON_T0Qo%oCwx2J=id8nGxBB{e_$l{J2I~`XZ zR;qccUQ?i0+U%qSMncOivOAY0R*zg6+22Hu@D(|3;m3KIa*}~+(q-l{T~{i#gbJi~ z8h?;N>{phH`D%GTOTIUeU--}mx7{}r?_*SmRmkPvY4Z56`0J`@x^DZ{`Chua!$OyM z(T*s80aqg5Vb8a#%Z7E}ga(AO%`ctkfvr1g#5rV}%*~sl>|Kg4K%TC;cY`%?gMMJL zpt!1o!Db|Uju4r+{V_<|s8WPlw>V<6K4QLJII^94g!`fFX9n1QhoXpfFsROy$B7E) zu{nvLC(qTyPSb|*q=pA+E);Nrt4GsY8Ulq5X(sq~DIwd<=erDj$QaLM>m$$S4}}Qp zGv!*|ad;je)B6qPNdA`5#g7|*lUP=0o|R*c3kDUE?~S}RT|FC~zN3i-11)T{ps{o3 z$o?QX@1olN!lp2c4$w5Sm;QPBxqN_}2EVwO=i&i`&^fhIzUfwKEERz3$b$P6`{JxF z(zpL+cfiXH<0^KrQ91w~0OmHmtI0)cwXEr56BWh7M`l+8#S@~iXSKtmL8dM6_IACb zP}(W=@g|-08X>s@Jwn{r#200(mNy@dUIDi9#|4s7HV!4YsWUl67ih9)36er3z;PsZ zr$&Kj1wV7rLW6^tdUd&88#tK~8AbR@oa5j04}(}@$4=z2i~W4Fr>xgf4HQeWhV@-N zE(1`;S&B)|Sl05mUlOb2!BbSW_8;T-_}T;-`UUXPiD{d zWQtPRUG=E5GgTbm4hM?|AcM11-eD8nhoV3c6p81AXueH9(sm#ekF84Vr{cF{a2M4+k!oLXR_e%%~R-%HA~iTWkuJ1;>5P+NALRYgbr zV9^w4$VVu(LYqn3dpTMk1D|=28dK>|$|3NOfsh|fce#7e$e%yXV8!4lk{tq!_5$hO zLEvQ$X@~CuksB~<(>5N3Np6QCa?WxI=Bg&2*a~rxw1XO-_pSaedn=_$01IlcrvQos zs_Iaqx7xY@cz3Q44#Q4VbgJ+*fdo51UjawAVz4$OWZ;nh=BWT^(K4JHv1TdaALAEh z=xoZWgt$AF8nNM4$J|-O`{kHFxYm~c?LvauddLve5^N#u?o)=x&`C>+Y2_oElOu1? z{;b;W0TGwGg6U7=U)yi7SHF!X)q&m+nvB8YS8Gp{E+Tr10kYBV5wfG-;XR(B0q}w653Q zTXLH)Fc)5HTQ7-rC_y0@jJ_h?WIy*L4Zw1G)b{F8qg)2AH{aC2UUzOO!n@8;5Ekm8 zR#L%U?BQwUQNJ)je+oS4Wy|({1Cadjpu$K{jlS`83o~No%+y*KXki;ep`K~qEr(3( z(_6F4^N8P#mq*5szX4i~Y`W8El@u~S^-T&F<>~FS)Mk3okRI6bXi>|J4esT1Jv}dR z)4+CNkOqQ`droa>h#P>*dRW8Wl>P%$z60@_3hK-EySIvc0MROlorXWBd%*aw{O4@q zWO{5ysV^Jt>jfI3AlLYm3~0TTz*w)i{UA*|yx-@}jQBI<`#)L5Sd%!V9QH%c>s5{xevK*LQ(2lHL$qmev^T}2kS-+0Btv^tsbC! zf3optCvT`bCky5r7+$=!6nI!LuVc&WA*?*xq7LU}9_XmEa>UzxX zLb?&!9?zyoq{gDvWRQqNm*MyKa7+1d8$JsDDt+R+kp%&-pQK-{Y7RQL;z;m1y$_9M zpibH>x_YhzmFj2jklJIaYq?6YA-yaR(VbyV_c>Sb-2ms*lFE1^qupY&!ZPrgd6PTO5cp%EUwnCUR!>>tjg!l zw?HQd%aKGLP)GadgTk^bQ}jUA z@k{lqmWEY`~ zMuFIz^?mHpnI+kjWfjVtQdbZ0Q9R=n>e=lGC(D5f42a)yL{wA7zRgN zD4o4D@KWy9L!6zmFPMORBk6rRu(D;d@{qOiRAuj&m3sQzTy>guN6vwHSw#QE^ZuC8 zH_7jN3Td+^)iUYfE}tbZUt3#z5_X^OXlToEjhwNUR1+%na%%q>^Nk=x{&1P{0Xqra zqO)p+k`)11lG<~eWBEXWa^8(0tCISL@&@&(A1S*r62h5ZS;ZpuUk5Ll^wwXTyhOR_ z1>V_gr)h({eAHImQ<^(Sqa@d*J)lp}oliijm{p9B8F-(zCEm2}r#4S=;r2l0GxjVWgK7VxY3#W2;b(x0ruu&=5Nje35o*iT+Hb>PFbl4NF`>m`TNWZuiG1$??; z`_Aj9O7-y%^1T@AoZ>GpE+zIInV)(n2<(p&QJ-8cDcxaBT5X{irP)mDgG zN*g{7l$44Rxu$xKvMAe65|YVYA-vz%bGlkmUjcFTefFE-N5`sv?A1(DqI{L6TJvj1 zXXeP0?VaKEJjjWW1V}>IFo!9rVm$WzPE5%ee``Xe)!@%> zhsJ<9>MbR_?23+T8@g~ktF7(6(hBP>fMKxnvb=;qFTqSh*$dU=UyoIJGRO=~7Ap}zH$KS>nO>ZuazTgO}qn|&Ki=A`^51BavzHdo)z`KDV5Xu zPb#aqgUXJdU=l+4-%hRK4p*!y{b&)%c{?V@4hhWvZ< zK=W~2RNqB+*xNU$H7!u)mIwI^xIAcl1P0Fx-Ku?|<>6KwN4uLcuv|m83{h$GZVfh8 zAXfxQfF;eGH}Q>W#;v@=mnlUQHrG&`xSspvDc+Knwi_&lanceCP;xalzPHd!0&mB- z>$za3T+!*+9#uF{_2D_uexP7%0J07lu6;~GqMtSIZM@iIdf|D3YT3JWdUkujYql++v0Qh2s`B;goh z9SC6b&a;@K#8Z#KZV=rPs9Q+xGu*fEL6PmIt9z>4R!Ld3_O{*wX)K#o4fK%<{>j@K z&F$K!!TwKEJ1uhm*w4MDTek%;f8kj6L3PG+U3II;{4|*K(RIuc-rw5(nH&d%8+@`U?&;z3jZa{2S7q%4nF0@jWUvpc$Qec;-{ciEc@Zqx_TA zT8SJwZdvQsnB;8C%6@W^DO**_oOt1vp+$n}s7#+1d|NzSeWqZ&^5D#Xvjpcw=Rh%a z%JMA9oX-mveDYfd?lBGHA8z#~aye(IhAf92JBsoi1C%kT2>W^a@iCoe6n?_b9X^z& zM(No{ctHjpZF{zs$}$EP8yRWQK%H z09IKkFOl9-eO{CzRPV9UTeFN~nuYh&kyK(P>bStgb3_et zIuns!IBa_6<$~o|ot1y=RHQRlHHc|2ntfmwHK)`-U7atlQb%2$d-iqh&T5EBJ4x%D zbYDSEnS3^%;k0W7xl;>L+lL*6lvSfG?F8H@X5 zkoMA1yTdDlz3wIb1>FYch#~7>wd3Xy*33gIsdw`g`CF!4=0>GR+1KYOpt+2wkfc0n zzySDIWBa+*EXcJ#p_kYks*6o`i4wbl{Unch*Pw<;1G`=oAJO23SW!oNvWVM)%R;={ zGF3!e_ z1J}ZYz2(Q(vT{|*)yHKEB!MDk?#sbZDlYjHzA!<(yyTSB znNRgX#(LSGxRVvKwSgg4bEzFj3q~o)Ja>ZV>&Gv)Eo6r&{XKazF|Q{`f0qM%MQ@VENleL7dr z_|(}f)8;~Xj+@vega;O^?GK0mj`|sGm8* z&l!-N=GaO?VcX>k;A*FUf0F_LU=39<{$l}_5Om=?*u#HS$nLA|wb5X2KTo`oqzWd9 ziq4(oX4y~WbvjhcJfoP`aOiL+_g=sdqK}Vt?+o-I_@?TKsGC*q(fRswhvBJhbw5jU zHE#qkM?=ecXyiyN4{zaCH=>PDXTkPVbH|`hZ!-+kw%d|Jv+hM|MdmlYEBl@nHDo6Q z%t=*jr@ONM7A8AmG8v}f?1t^**7qt|0JToo*0)9YjpS=fOdDr%!2uD%ipAJ7<-HIoJmkiwjRm@+Y0P{B)Sfyj!5<&9YD(#K|8#4xN6yatD$~h=@DX?D>h-KWMJN}il%rx_UIP`kq&7KV zD^0GrNRYbleQ#w`0EWi5YzlI<6b}SSQg?z=zHmlGtkvPS8n`n**>yl+lXPfiwfni^ zvdZNSmAeAB+Ri-YN!H$>Bpkr}M6ij~dc?GHv-2*G)DxF<#X@3NX@h|#|=W8tD(46-O-Ds zul;CBuIV>QpZi=?-}^D!u8ceM^gZ$OPUGuYwZK_{TT;@rpF43TU9=O# zH<+X}eovqo;o-0Rp|T@;)Mp+xd~#UYJ9Hc+%r<9IG>KpSpaP z36PqeJL2F%db>!hBX!@@6V+?ytPbW>JUC$b*N_L}Sgrex?p$$j4dLb=YjZagJx(P> zfNF99XvGR+lXebF(v0-Wx;uCt&@{QaoIH#e2L>XEhW(Jrsgvx+qoOv?gB z>bUPSsjIZjw(g-5x{5^r&V8K&{Y5vG73t2T9A)AhZmDV;@92y3u8?6(=C+OU4^ol0aniC{pq9L@3by-GVxwc_uV~kcXo3x-|nLD{_h;D|e0mt;l z`v<1?@ee%4(l)q0P77E${!0gh@CBFpp-C3yP8MtRh<}y$3@Hvuhpj&~(K7;8W?$=P zm(=SUAi0dcbCLtu#+_}LEsG&|7NWs6iSq-eqom!8_bn8;am_W!Q|b=?0{JsSRHv;}?JuaTBJ z@Mz*j6wvwEFW#)s%zm*VFJx`Yn|6h_e)b$K27;$Le-NzRgX*MfCo?=t&*BTcWRI~X z8t}@WT!Giv2zh!NQ(#Y!s}fD?bn^YEZ=^vq*fd~760@;a*`2knf_xJn3c7;Y&7dk| zP0FD*f$};cQN&#&*$ZQG?9{Ku=l-h-J&)*}T>j{g+)o9_WQPLq>1`AyDgJ=-(z$4R$%EiQlDzlp!Fa~dO_1)iIuAy zAz8Nm6m^2=Ih6JMh@wANl-EGDcNSS&Xb>&&Y|4fh)VI#$$drk?9lK6nUftn^mo)w8 zJBYBJYta8nnEAF!D&#J1BE;i&Mj)7py-Tg~n!*?2f|?da=XMr{H^|-Z|E8<#qPQTd zoV>;*uwKW>thFydCbi&I<*k*O z=fp~n<97LKV%AIOje=|I;0K-0d^pg%_h(`scD^3&65vZ4y<3(n?MQLt6}}bgYD3Pl z`8u$^d1G=*<=}!g={07ECwcYgp%9Gl6X-&WH7@ zg_XnhquwdzWo!o$%6(Q}l*u-oQOrKZb57-Bw4!T%J6yjq{rwH`QEuP)GK6p4j-7Q6 zL-w;sR$SO>JZOA+3&-vXIoQO%22+ci>8J$`_;;?8rI+0N@p&~>0?i5^ztfE9k#E_n z7+r8cX#GWVO1*Z7JjQAq4=T-aIk&Glg+Y-6eLk`-pKf|rpOUuo}9DL=d9pS5GKT&ghxL%EibvjLS{zJF@vOzPFa)@?Qc;x5K;MjQn_9$vFCV^=9 zL66#T*39Y*jK!1ZnvazXAT4^@)0UxuW&Ce6LFQ)O3RfI&}>V1gKKYzqH zn1JRP@CZ0ryz34vDj0aI)#)XK<3J-j=f9MTvOv1zGaQms8~>|*a0A_)RgC+EO^Il& zwoIuP_p`)KuNl8E!E^2!zl3AGW*kKIVk~f3rcPk`wja|sQV6#kXb6c=_zojNQg=WH zt6u{t!CkdM>e}POZuVt9%7@BP-u>t*3f6ceat8ng2rXfF;n?t$x>d9^_Zs#shHuvs zwZ2&0J;Eg}=cePpnBHNv^$dqz-Hcxfq>#msu)9JiPSQ7(-+``1 zQgl~HcJ>qSUS7%D#GW%azQ)+_SpB#CYNa7_x2*Db*WtJGwi8*G%YAnOCF#jacQul! z4e>~u1_QBZ8+D!|pztm69%qs@!QfGW$YRWu1H@dpGb=LjlcNF}x`TLaN)Gq;+I42Z zy3o=~!JvKXLyqg$B6X|sc&|PQX6tm^Bp%u;sVGzGzq-cFB~RJ?F`NWbin%ZPjZX!8 zE3vsYY-?Qygtx_X#kM&$A~tZqQJn7|dvCvW@EiU42 z9V=_SqE8N;GNN>h4CP3+bwlmFqWsIUHYu%qWm~Yl{Q?4aw)62MTh&qL-ClTw^xr;M zJ0*!BE3oo^aBht;0ap1-5Hjs0MrR#-EWbNFxXB0CJdK?vSrb}& zC0nYZC!evm99%fLYOqmTfTe5mbjF|pCQXZb4SAaWh`lAOJ^*7mK5!k|@AZOCFfrFo zJ8=f{VJC(KhIBQ5Y3|3`tRvreN&>jRyTX5=n3+3hH%3*Mm+h6v$2CxuGc|ESJJQj+V8x;0(o$V4tx+BgYndiX?uaKmCB?< zg&oCE9rj}q4P&Kc9o*<(qW(gsY1eKC#?7tb~GXNCiGr=Ur&(j0>>S z!{F@&^%f(rFfm$F_B7d2)+W#0$a|tl%=R!n`!d6IP>^8rst{AP0g{1h@9oLikKtrr zdnZnGXW*)6dt$h9+sWk*yfVJasbZwo)`9%;Mzq7YjS!*j^m}cGAhnV;&em(MXsiLg z4W>j?^?8N)Ha#ou>d| z4Y@7<_+)&0cwn?b!wsk}p<>lkDi3wMfBrJpckOm30uq{gq;mtzB8w?BDU`2}b1{OkkbxUZ6JL$)OEH<_E=GHZF0j~y=D5ai|b!nNT=4k(vITiscc ztaIGL1xCjJbXrF>O{C; zPG6Mq!Oq%zRaMJqHvHsm|+t+u1hp~~NiUv{9j&fG#!wrJj#b)q>#g7G+9o-Q3rEZN?q&LEHiS*T z=2|;+?hXpDJc)kjK2o%)yS^Fhku+|_?bhpvz_rxt?9+@$5-l2-1%EMsbf=<4UCu3g zJgR201$(Ucz|_kxi3WB?3tC4lL{-&jp~#1&02)*o(1hZSxYJ^!N}aD%2GuGB zqJbcx7mOp`K0Vuwr1Dih3B|&$% zN?TG`FP0Oy@aKRI#<3w~C8zP>xi32m#N&3pxYR81{I=Peeg0RMOG$3qVVI-m^Xu7E z(?!FzdkyzNf+`S*7IU`6;+P>&*q(ksrD^D7fOt07TB0xShE2e@5+RC639m)ESDr+? z?SYZEuAc`4+v7{-Sh{}xK;s61D7=-?yn|vba|!K%oyV zj&$Na(n;yHXaFK`b^h>JOQ>Fy^$1#&)lW6rM}naAzS~ZAU|O}xck4&1h1VthtJs!v z>*Cf|OUrtRYhCWzxoq2lo#?5{=X&?hMdU4TZ%?n+e{;o4{PYLbjqyWZx$u&G$_}?% zV&NWK`i*2D)0b|<0d4Pkq@C#z8{18eUqF(M6D;??a44be+y08yAuQ=7+(-TtW}j0(>R6fIe|! zVj*fKnl%H0^L|jRD$iN%#j$WAiiG7LP{>_W<2*RCT5rqy-W=D-a|It4+1nMXFdxOL z6~VewyOFJf(6$-~-SCgk9{3+0v1@Ykr@ddTza}+lbK_0*yy)AsRf@om^Q6d0NZz_j z;b{SepUqf+zrRtJhd)^)O z*#I8}N!dea-$!VnN-mlbG5NCWjz!B5-DyK37U5bQ99-Rtj|EJ@`PlxoAZ=hQrxY$D ziK6=Rfq1E20dM=l++5oRL~a%85_N>}75TZ~(pi>WM#~3Y@0zT%mE`KPY?}QT8P4`n*y7MVvQ-K72I9svF^4?LeeG8{0kM;!jb1SrMBM z-;I17Ngf~dZ#JsEypU^WJR0e)1F=&_7;#Vu+97j(i}^T!U#YO-0u31(W6d%ljYZbn+rWv+woY@4+AEZ^sExaP;BG1ZZ%tU!%DdGL*wk` z)lz4rP(efpU)uXM`oel-=I8mW^@poE5q0n%VULgDsccn(@bXCJf+g0zwq5ZK^Qy*# z)Q;t0HLxm|8{ujtbAJRjWFe3pJr8)>*hxZTRm@I03Ac1vB^8?PeCw^%Q*}R$>)_oXO zCZNb$M23u@Bgge1)@EZ;B0JLP=4C@~>)7`tXqPyV^ciF3W%z5cLC+ zhYqz9+(OVOSA=){Teba9iiQnM3@g?|x8`sxYDL%}2+fwjNM$c}C&-nC-$nSd2>)?k zr{x&r!-1BYo0a6OOi~RequL33K?Hm>=>S^O1a0R@n{YerG>a>*R{J%d@Hhg3lO@Th zI+Vwa$;!H^-lZ}|r~(nRMIBk%LVm%Xh+E$|QE2rZ_XHZ+Agvy)L`%wAsUO!$8j_wZ z5S74);ZRhKT^pd|ztt-+VDZ2N^eAxIxZMQ2BUy${=oo^g>O$|SEtq}m@p$}0y2Z85 zFZ5cTo%G3b6ruPCYgFIT_Gzb1i{Q7zRZ55qG3SM8$YD^%ZNmT;6-|x4yCg$2UzfIW zQ_7}|acf~$vBZS_z`?>JkrF2CoU!s^fc&tJHt}H8O>?Ade1~YH!n_=l+2X_j__Jww zi0#|pq`Z^b_#72)x&K7k%ZK{{aJqa-kyszem_9iM@`E+UX|r{|O4asx|V-G&Za!l{|YU8_XT zF@#)*{0N80kIsA?M`WVM5rOaS3(V|IA9vgGy?4>1c;*``Pp~y1!d^~22iMRmJ8kqb zS~Hpm_aV3p$&P+q1DVv1ZY5pR)=3lvKRZ#aFvzw03GKsiPiF4zFcd}@xVksH;-dt< zW2>b+uAtZdYN-aHdFz)Q32BSTp~sfua;t?+*KIRIEKC+-UOkbRS5#GWV!8O~DS>z1 zjSrPw-*y%HE?#c=JZu+ByipRK{)Slm^B#qd3<_w_y;Dg!CMt{|V(rBxlp_%3IrRwTgO|x6@@u{>rLXyxucB{|)46#1J-C!eAEt{0pmSiT4e<5l@TLR+ zv#Ms|Q3sMLIs__Frp^sM_!#&@R#G|;BknlgimIr1coLgw|8rkSX3lx9Yg)MV|E2&1 zouc<8ZU}zkKuZYH61@42C|A}Z(VlNvSSDSm_b%sdYEJU_vVD$Cf=2bcqAHK&IM)bIIPATz70YZPZX_=Luj#6mJmOPyoX>sD!dSQ)y^`@_Q!LRy)#eP z)RaFVA;$FL@}m6sKI+MCyK?O-f4La^r3q?Y)HI%BWfNzDI0~X_M5HB{v%himZEM>yd~t1ipFY|C_CHhgiA9&yP%8 zOqv$nyhtzU-0zb^2t;}UMy`4^3GozI!B7^pWveY4<3sq_BJ4!U9)> zw(QMn8Wbkoq9k90US3q253bp7KP<*|MR>)4Pe5f5mI5)nMzZu{%1s)v*u|1de(?2v zzsIO}Ckp#x?oGO{?x|wGd&z##4x>?x;Ox+Q7Cljf%}YS5v$v1M2VoNZVu8G3O$?$P zOo zF|(k2wOh*f$pHAwfqIeEA(9ESj0^{lzzNVvZbNwkJ?^uARRIu(YHY--d4|LBLf{3} z^Crh%6Prc0@?L-Guu)QrPdyruIV?$E5V2y&qF51{++T&@>l%*87q|Io^GfQJc{w$5 zF*~?X?+I?TxS2X{KkZ#4e~CU6T7Ugp)>vhTCQe5iqGPoYi5wa>0y3DzfclWcN8*_M z5U&m^Ka`e!;yKP9$n5IwaK6B|uK-uqau(b9{wiPEmw~q;YCkIB=^mwpM@d~(8eY2= zq)wn2O@vF%j9zlok7LnX3=!)3dv^P&n6U#nxy7urI(@TcvHE#oBU*hOj3c<@;o z0a%j`<>3;7phI!ERzJ^UIhpwK3{<}ScgXYKkL<+KBaW0%bvTSb7`Lb+EjmF~UU*Q7 z5B%>ZdGHuf47}>!EJ$SA#%!S%=BoANP4*nVv0GW`yTa&~a6b$hfNsHm+0r;%QsxWG44a-{tE=`WJsXQ z;68J1u!Cb9=nG1^=p)|&`X*Sgg3w4WPC8pX9$0)`2 z>w`4WW3ek2AAIdg@E$A*Mwv>vH4a^_?&8qXzc0Qic@wBXK)JiaJh5E%>s-YN6^cgX z0;mg@$u%584$(DvVU$XRn=RFB^$X<7pYIF4#n;zCj4h;|S22jINUPGl1uudg4L}}y zN3U`eta3Zy5}A(LD*UD4V4-8vrt3CCtboP~3Tv_3o4usXi|01X2 zfZDaqPg)7*mF#^GB4?n09A$wsI0c(d+!~|gg(m9=3&LsAy0pJu4P_I=fj=9ob5H{Y zK7Aa`s!?Qn2=u66p@QIvMa}7yP&YBW zWso}n{9EYHJ2!-M)5O(BjFBUe8JS2F6$i z^a#f2oo^{x213s=tEjPIG zycC_uR*P$e{qY^qj(#e$8H6r=kc_^fuMMR9pMyD9R*kF)R=ZOLis+s>UwI>f8D3(n zIp3nu4WolwuUr2K36t%9p*x4+6==#rwNU7{GhHDNY6XJ?M6l)HViRVb6k#3)v zg0cCzUlng$Cv8P!uu%}>yaFMD79cJcQIwEw#$xdq0V)IXA|O01h79T5IeO3(f^s10 zNOxIQ+AnM<%c5NG5HNCdLynz0iVJzyS5(AVObFj_i!&f7-R*@=zhyL+|VMZhBRZ9G-;V%3;?!?a~?sb$$t1(a2 zZu*glIJkTu*9*DW8}Yu2AN>*~h29$e;W7DeWMoFnPdo*=Bb2uJ)IVLi9qf7UhJ;kaiMTt^zo*bYl|MgM$Oau}Ax6 z2DNS$j=C8Em|^9^23jm_)mce_ueZK;SeqrD(RNJ~Jpx_m4n(4iSO`diYEU#+8v!7; zGg_ffA-MHPdgmcj04=;Lpem@x?YKBIOzYU^NITH?Hg;gE`OU2Rx9E2RVt%L{5?~X5 zvwqPTzE$c^Dbf$O5a~Vo6gr1eUaUHoy*v_!2nhM(9 z0?&{eRbZTy1ti@k+WKgOL-iB_Ucdmxy@fIUraXYk@iNKUnp0rDtSg=?0xZCmp$0@H z?t=;}@Db@4cP@RZlCJ5x@WxRjE06wt6X-&0|07t0EDF>;2ErIOuDW9JeIeCJjz`t( zV!(VXpuBWMOnnBzuKz)g@`|BgpJx8I?+jScM=doI<NnFaAS7+msXC11)$yzZEE+PwVmySI@8^d;q30fw2hqQ1&GLWA2XYq9=14T(n zz!d41=)O}}`t9n3vh!)U;>GC~K-ptXEA{qmPqM3c$^A@g$fw$5%;3A27^QVk6B>R zFGhgGkrUrl2v5EF^%u8(IE}@Pxh{Q#ZOM~b5d<=TWh+i_KJp8`)FK(6^v z>jSXk``!K@hq0D{YcCFL<=Q=H({yONztyeF!Ch7M%Jk$eCFoB7l!M*~N+^x^LXJ+- zOzQSM*3r;{MaEo)Bb%>Q&eD)-dFQ{ZALdM2jM{Sr3U__w&z_gJ$#D#JIK!xOlX z3cpB20!?~I7j`>ox3fEHodV|&3~OK$1dZzaP*Jw-y6cfn>a#Ensk#5tV(PspW);i` z5_|tkJvjYx-v$HU>yh8KZ%ZwT@EEp6igl6ep~as7V8tJksXp%3IF|^ z*8;uuf0z;AoQGlUICL@RgSp_9m}&Bm>p)(KtU!~t(W-|=x-GdLlWZ6;smeoaUl!K~ z3DOv_0D@@%L3NN49VZQz-5WcU#@l=1Iu;rTN*?87s0oaqB9+%fcDQ{#@^mA)ym)2= zaIj!S{!_SNu_Pn+;LnV3TpNM|K90B?8Sml48tQ=0+>$HR*u!f-X||EsZ>G57sFPFF z`HTuEe!p1>h`k-){l81(n8Fmg58nUh6JW0Jkggo&Qqff8K3UWB2pz|SYDN_tmk4tI zSP{7V^ngbmXb695i>!TAh4cOkCa+g!)=P4VzSI7ksdrpx3GtU*Q!|wW>$Gr(b4QG^ z2YYng9}Q!a1NhwA3hAUz%{v3O5PHO5bqYQSV4(JU5J21z&_45uW-_96VK9k}0ab&C zoU!|70u!*0mPKP1BHhZ~m?+uz?K|OYeU%iId*_oz(}nZOfF3WpV`yw;*2&z?vDElu zYEetVb5&j?e$aa|f#{^>M~MnGaODO4FB5mYD4a`!R{j2F2%N;;9`;i?d0x@UtwZ4R zdk45KlaUiSCVWu;fWiBh7~?-Q`G^Gy0+VUbK!s8TzykCvi$ie*!^}17{h~k{Rac@5 z0v~)&e3#Nqh7D32e~#MD7j~NO#;(wW=WO~@?ZH{#|K0AZYk;31Sn8Vn2n=bh8Rd(2 zM!4UHdaA82M$yJ+`g{X^kyypiX$zdSpTyz}lHUM?1K2!*RDz+kucmB@o)2^@zkB<| zPaX*x?(w`^aB#u3dPa+uws3Lon4AOsAeV{s%=l!ms0iw(#{2%rlBFXU+^qYTg)%hu z2x1At7^~O`R`Kd}s(~CHQ(Zz@9DuF-w&lVlQm}WXhlPt=rY9+ZFCESdmuLLdvj16J z?N?e7zyWZ)0bQ@4Z4BqYD>}o|69MrrlTE~?qxx?%dKe}Kv@ZwlBB&E2Y^n(zsjJcX z3?6a4KP5$5i)57?HS;Q_@YM{qWL`g>=S=fC*bE{F@oIp&(53O4LkMvHdJ8XN#>s~o zP^mSUQ6FisI8a{k70GuF8qf4Rs-%1LN`>Nc?dU2b>cLdTdXdr2;{fYde|_dHRA)e> z8Soj>#UqZY;8?=0T}L&MKFK+jK2#@?y4h*gv9%S=_@;OHa0$o|=bkNEH6q4#D|J_| zMmEWhxM9MLo)l+z-#r4OLB974n@#WrNmzzqG?eK_b>2O>Tp7MToZKsmG%~8_u-mo< zuS^-T<|H?J^GYe*#y|WH?y`c2ckKq~#3z40wo7>Z;@%Ny^%o&~)Ls}4{Y87>Ep)oe z=y~z-wwPW71$DS>2KE zq0{C%k_oJvE$N5+FJ=4#W-|@N@oh|k$?D?VU6`7xxWv`hl_Ra@aXE;lhIx5$V_bf3 zmv+k2_K|-2>!7bNcZI1LQj)a#JIM`CJ9jE4e$fp1jv6@v`mBZ!=Mq84fWWHAI|AJe ztfE;(cj)7!DaO*XNrI2_C|FBH7k6bqBCe8nBk6bY)}7Ra^{w`)Md#sPng4RCdwa&_ zywUkG{c=UgstwqJl&(UDysko46yX7=&5}Nqt98NXHtjuUjK_KfJAWKlnR(_&7QThk|f}kgAc-IeEh^{GQpW_Gb`wI z{sVTKU(+GPH%W#YF4+q8mvL{@ad9dxGZL5$A2m`#S$k&=exQ%TidFeUJht=pMD>26 z$2*tS^dvKs1lBEvg2T{{pxP(~hybH2960bN!J*K#AaDX4=;th;7C(57J6(Zo?i%hU zgda+8_Z?7lx@?K!I?Auyi1Ih?Z~4iEa3qj+ybV0>;_d)^_QDP$!Gc)*?prjs1JiBc zn{YOVpEP!|{1qILuT&Y^^{=3(o#S|cb^Ia}!%2ZGsim|266 z6;#c*Amh@G8p7F(mT2^u{HK6pscd!v6i6C4G@nw(lyTb_90#4fTD|5Xw>;JvRT0^k#`AC{^31@ zH1RmqM1I}mQs!p1Kg}b;hX7>a2;wYzWkL6xzX6dl`)tU$@K&d?ZDBE*DyVNsOVy`0 zPNSFJemloxT@|$ZCYSz~KJyjNJ0#*{_S6^uK$N|J|wI<4Bk=$yNJBxPhId zXIyB&-%df?n4zPGbzvtMF+4y3ifU()SQ+CTF(ny+5pyNifBK=2{xTwGp@R>HnWrYdvB4e;Q8k9uAmNw#ttBJa{Y4{Myh8PI~}$O5UK)iXANU;Xp+I#8UpDae{qM!V*Rv1SGATzT)yB(8L{?ZT+BHA*q6jdK9{}K`;I*i7 zxuTm(pR}MDPoEp0H1F8#237M9=KvX;il*w&Rm|U?P}JJGplfW|L(e%&FB~rwu~n?w zZTq+s4<1`=|8)5MgOna~vLhht$G7q%I6uKs6CWmN^SuV_98WUSvb-*L^5WiSE&;{Ch*hvJJ236h%I2Ob-dyth*i z7>$1#)k<}JZ5@Qt>Q2(r2YrJtBzYiv7oR0U56D^PEKToqN!B){N%<;j#V>~*r#4FJ9ne$HY={WGXeC>^AS6om}^3;GZ1n*AZY zbhXOJ6sq!A_2!rSeeVGJ*YZTTAqejkD~5X9!Hq=My@-9h)@fjia4lP;6(J6H==xy? zbUyn@_@1JO)_r=)V>b<7GFFSv;)c>F&vD1>k!7Q*oFob_r0xE^R{Ld~DrYRNH&3pJ z3%&ZzPmo3@wgK-k8RqY%lvV#azBq(0xZGP0_i@X zN+X~2L~DaI97f>>Z*Be1N{(rbP?Q?Sk^K$_QGOdpUlfAbh)r{@#_?i>VOZldv(5&4hGQ^La~3H(HUDElfWj@B zpnbmaz_!$frlsW>j{r)hn-XbW-Loob8C(B?# zG9gcYJVNn-Ei&Mo$fy8f<6+v3ZwHHBd?OWM4O-rXqF9?heYS#075ha0|6CDLnEaP@ zi}t>M`BJC#Acu!yPERN+sR^JkhA|%UOtys()gC(2CoS`6{g2or-N@1FD*0hAh6c#r zU9<#VBp)IX3V$12FIC)4r2P}naBU*B(Fx~C*1>S*{btKO{}Zi{#du|U zhmnnf^b6Dja_W&i;y^2hVsH*o6$hsp#$r|;s3&iigemtQ9MS)GRcJ%$<6-MR$DL+l z>z&CZ4;0-13Y>kLqhbnq6wfp!Q{-Oyvg18EvoY#2dYc%?J`Bppl8jNPkx`Bv6MChU zlQK)cGVKz`khJ}Bo|4jU?vG>24}sM>k8*$kdpBC zubS^fCyIF#4L%M0!KoxO1hF8CDHaGcL5{FwkgTBjT>8XV*l<_TWbXR~TdbS@xG!HX zy#wNQkhazBZ!Sa#W%)R4Qoz&s&Ef2^ITUpHgDL8ANz2i3~0Yt+8u_gfimayQ-J(=~g|pIzaU`d6FEg3)UoU?KV2Hlu)&dmzis`m zl>tipFISS*XV5yp7oiv|tV6Y7CQg2Z?QSQC&uOJu+zMml9>6l5GtV~h%tjH!QR`U` zI=*^?XE|iP9RB5{DQkY`G_nt4o}6!I#pbp`U#co`pdv!aX}s0Vh!bgd&>;Zo>^U$f z?*VEH@Z90bqua105)gNSF&snin8RcLiQH58e9I5(!HTKSX_w)b18!72s`gLqH%=?? z$ck%5p7wvL3;qU!gg<+RI8_}j@zY>BI~j9VWI3XA)vwhI|}AuUs>4Z`WORP{F>r$yv}6 zJ!?`IX%pvUZ!x^g!Q2VP>+jTLgdY?@AxF4@!{QPO!46s#rN>TFQa`3Ym->6(`0%P5 z8prI4k70h6SaJEN0@Y@3nHNR!zHdEQ9r(K>tKNa2Kl|Um zK%pXO#ETqIBzxrz40wpCbASA!g^XD`Zot)fFPZ?t+wZ~Ai`cz7I05Da=g^AVY8xHY zR#%X{D9nt`>@}P{MmHx^Or&ym&0R4QF?=4!0lx1gl9>IwbcCE0`2J%>i;_m39vf=hLGwE1l%L9`5Ue34t}z_%w|ibe4t)w^!kCaI~xLT zdi?yfD!$Bakp%Q_&=5KeFc?`t%37Q9q5^w~KdB=ZiXg`ohF>%R&s!o2ltj>!k- z-&t_RMk)tag`lDH1M^WHUsXwx%D*D*=}GT3WrLT}Cjgib1@}s%`$VzN-xv{+l>kKm zeco%d4?ZO^ut4ooURa^evA4edN7k`hu%KXU5nIm1`*V>{KZ~ba?Znt*ub%t6%wh|?94ntCQM=~ zkE6-lGhWK)^6a!q+ZvOOC_>I3Idwd8G%0EJwfDQ?y*=I=A%=f})7= z`(bPgECGAtKB*U^vo_9?UlfO_O!*=xwwt(&B!P|;ZIAKs={6H4sT9`<6Yn)s*Z^dW z_@C%Q=sSZXkBDJ5JX`T<%vSJ8s~@W2IH;uD)i}k=cyhIXC7yt(}JerVu4F00rb56+a#gjrBR(oxu+;?yD8AkTGQ=1oN@NXnK*_a! zq4lv~FO_E0PT|n$0woj|_)tGx-63*DK5Mm(NBWN2E`4WJrmQ!|78Tp!v(k8Yz$=i@ z5#?f)Pm$ux9?WM;aT)kxRyjIZF8g;;yHp<--S4I^o)bfAG;RrR@V`!V>=vGJ+|EHi zYkMQa?pE_zl@FU|n^L#_7>za!4tEp$751FIjv$11nE@Q&jONN99|KW4igGOP)kU_g zmeiT1&Cf|iO@jh_7+F%({=}G>DUaC^$9!7Wkj~R_>zP`W;P#h41V==bZY9mXsAPZ( z4=yF{kV**Yd~Ubpu@cwJ`vLbI{yA_=$DA|gPDaJ1#YD?dn1q4MoJq-~TYaVyKH$qX zi+uT>?R0s($!+N8-Dwjt2S^ZbUd=BDj0_1vkev4*d<23JuN-uO_T67fkUaCV*6Xoj zU?nnw{;y}N_j{1}cfAm-cZXwS%(cktm|UncrM1TU!O0?f$VbKK@MpnU4gYo#_tpLo zDgw-M#z78GCivT~g0>wwc+jzTG0l4DDja9EJLtnYEe#y>H1_=VYlT7EO;F z%bpunYoAr#JL2gy!jd%--M#s}sShj~Q5rKO46fE65|^wo*(*yp@OhGsogg*@Iu}iGknrEFCYr5(tWnrC>~Vr7mNoSSx#M%G z>o`W*c{*^^i8cCZ0*xKyoNeq7wYKw4=y9B+-prj;rMRvfg>>%>zUjzSyp1b+72)rN zV$$OwjI2p}6`*)XPh!8yj^QU46hrx8;K23M26V(*=|(PJI;16t;(oV1?4nekdf1m- zQ&7&%n%XC-hdNf19*vvuoP`A5eT1`y1Y3iyhC^U|(2N{yw_Z9Hak&J&pecucBi$2U zIM`|V6X`r)dZb5Nnm|KbhZ~d9`FX*LHh9b!791Sr)ts}2-*Mr2!0nie6ZU^v2%m35GK9Aw zw_p3V12d1fUc_;q<@d!ZR_W9#pWA4-@ry?bz4EYOTWZ8gZ|sN?nVEMFUs4CxMn1^A(YY4L!glZk7J)ZUv` zHWH$ZIYOL=8x9eDwZHt_p_xXDd0miT3S2x=4b_b;;=}l)?ZxTq5Yu#T(oL8AM<;ce zY}+s;gYUp)N#x5;ytMC-(0kR9EjSx_q*E*z;w3n)8Ke93336(FiYWaCwDor>pX{j@ zzR;ZYmF5ltbu+;)hu&3qOXufT%Gb_y13ST>CKe2z@?@&5h$nMIqzRRV>N}s1d^_JQ z@X)ax9k`o!a~iydGqwzPa3F46GsiC}^{?!Py#b=WSbTQ#iEax3L;LhVOhK@7oX|n- zFGs>EODEvx!yZuYa~>CXQfQzT=BsX_8%hmQFqGJ#G5@&YQkw&alge8=4SXDw7O$mAMa{^(FtJLL^4 ziLul}dix4JW1nQ@f3A?+sx_`RT_8o&yn>+1d=&7nhpIkq zHQn7jPbuo+xcMIFRAKOpupSbJi>oZZ>u@%fbQNR7m4rxG*9uBn;rdCiyc4t)AC3?# zw0T?GL1}zWdOU)h<5;blyuDI&lB%X9Q=_$!A{HdF8p7h-R{j;M9`7JPbVhWII9jtf zZ@{}|23M(b!8T_f(sM4mwI$edSZMuR{n6%S4@AK;sBCUH9xKZ;ZOdL@x$i($ig7Hv z?!yLd;R9I7jhY4OxsN54=LWaituIY`PHWZ|*Qh70drNrQy}2tdv;GO;>x6wqohwqG zqVz3ozSckQAg}ObrV7oaM79?i(|R^+SL-^d%A>#|O6X^U?@V+4S6`9wo~GBb_%+)q zfw7<1#U3oM{wO+$TtisSC~U7e3M%kTF z9g+QkB7KjnVU#7Ga-%0pHWG;U#KS5D=>oUNMj4a-&6&0Wyo!HKb)Eka^=nIaEKEs! z6`nCK|23Uwg_@1ecL+A2u)m2I?@k{kvB@!7b$)PGX*c6Kju{Y}W!t$1ld-N0u@u^< z;hZK5SUc#Ee&sfq=;A35IvE(@rLm}W1+7R5oJW^mAAUz7)vBp)9oqZ#LK#fxM_Lqo z&f>mER~MHWKTucM6j-|P8u3kx65NSPb{yGAE1d+C8#`N&adhCyN59587r}o$u+__C zuJa+9Cd&NHT-+wpvQu7jF!#7!>-Ea}06_5JDo4)owdB|m@*Obc)Z@L;`bkAgIdHn< zL>x_R_Ev=&5V720>oE~Kupg31zS!XeLlD8E5c@Edh9JSl6)T>Ww}Uv^_+YM=F^ zEz&|%t9y3M`H!@&HTd{oui6JNZNqJR1SnZ|5fb;Qni*y_zQny5;rEwIJ#CE7 z=TOn^tu)0mS4WYh8l!4567ux*z-o0qOH1d^w}3nMc_g85g6k$~lOz4uSJJib-H(D2 z0!tR-q^mM~q6i(nw#Vj!aitHnvdYpp!`h(BF#1pxuNIdMJ&&$fQ+j z4wm%!StH06CM8)q)HnkBU>Y+5h-y+U5`m;dZrEq$3 z&U3Mq^SCf*`n#e@|ElZ5;?KkSz3oQ-xNRok2c#UeWXBPPype!kh=vM46_As`3V)v} z=`P*11+V@^dr1oxt(LGx6-O&tjy;M>s?@2eYtLNXi)ObX|NM}tc+f5XPK#C*ClQQQ%2&`#LoZj+f&)8lXQ$B@QG4v~0pym6Z~VWd#mtN) zOHk;;Zjel880x2<_aC2Bw?C)_Uun;#p0BnB6*=uCKArJ{j_o)Ft0Kkpbc1C89a2DC zO`=my+a7zu*T>lZTIRK2!rb7!D3)2=9ufyW*++oioyR<22D``Hyg_Y5L%eL9AL{#g zehB5te&cZg>dFMgRe0b43Mhh+;%8r3K74)Y{8bNdW4y}lg6vuU31#?20XI z{%1x%@$f9r%MI#|6X3Tb31}XhQe`Lz&1xy7fi zj`)}224O^8^yA(U{qsk!pO`;8Zww{3M_j(+&;Xen4g1y1)_4 zOi3E8+4x-BkkpKIp74>_+|hVAl+LIR;;=OyTZR@%eSO2&XxuGw9fE4BVssaOr9Md` zcHp_oATLCO#*1BSx!#09g>M8zy?8@af2JlkRhnnr=Nk4R(Lrk zNT=#7{-kLqo!ErCEmY|BE!M+!GDvjO`=xi`YWR;#`L6vRczEiA^5O;s%<#=Mk3!-gGQZHZt^AZk^X`#0B$$a)e^;x_Dd*PcXzHFNe_>+yfjN^BXR zf=47_&t*%m_wxcUoVgpK9t?5r%=Fwk47#mZ|3Ls`@&OyKL$f|J`DbaMfqhr@7M>L$ z(CYFt$AuYzRwtg5>^53o4wwABS?R5EemV-h+Aa_=fv4NQdCbSFsd;f-ZcUT~A z{)W631vC&4tCT0zvk3MEMcRnTR&QH-F{REO#C;;3urW}2%&1cpmiZzvvUZh$i~c&s z);I`#4V0q-=(s&!yF5ii#8BgA46verU9JW;|6VuA8Wl;(Pia2?vsA~S-2$~=?1OQA zRstl@%u^f%ue8uOzB5(TP$(y5`|o=Sciw7G0v%;m&AOC z?R6G~vkEKft)$Pp2fA%{E5D4GH&Eozx9AH$+OEd^i#+D_dUVihI$$C=I>GyEUCLhw zS5cdDvoo%~i8SF_zbl-+CJizzp7u6-quC?B`0=}Iob;`N-5mrHmWmqRF8#EEJe@sI zMZZDD0gX?6cK_ocUbc!d-*#IcvmxoTZ)8Z?jGq1gw8tu$@n+ywBRkmbGF=_(Mr^J@ z1KeeAY&2IRUArUBm(eM5InBLa(AHl2(Mo z-&5yiHG+V;6Zza=cdNSR%B&qDv1XdNOdGUGvGG-$;^9Z5PFqaxW@S*H;@;dNczzTd z#$1nD!fNb4R%)&OoH~J5Bk#NNcviJ*qYT!+of7-iF!%XY?TP2R&hqr=vp5r|Xo2U& zH49?#dy8v;^31sbO)r;9Zvk78hn5TNm-1skz9mzV1sd2n_hk!B6P;d40LcB?j)L52 z=&@#58Dk}v^I%wAB4MzNva{fm9DKiz4-w>q>s}UySy{!|8O!vBizbP{a%wak3n%2Em6sL2bsanjVL(ti+MrF zKoIVv7yNK?zDF+7wL2_xI2`|t0y*OE@)z$-bD;3pT_oQaa#yI3>ihj@JLXoAy|2iD z&Nx05K!+~4X=rKjL2~AGLV5 z30X&9&i=|W{>{Y<+W_(*q(m%SLk!2BFAcQ`7?*3V_R0A zQ4cX!J|AkKdrfXrZj*rwTn=L#!+aa8HFI-RR|mTfN-HE5_<~9|sxK!|$iGyH$w7Wm zpSIroIvjnvFJrTV1~jyRXr$<@M72Y;)X)X0fl~8>5!Tomi_+& zM*ckKflVnlF#4WbiKr=s+sj4hLnZ?L+rTS)EomUIvSq z>oaR*XODNI$|`2DEZLNPF4B=T4vjb;8n-LqD9^lk&XEaWq(`Xx$bzR=MvR=r{i%{c z`h^;p5UHS=r2tQ~evA;YD)dVCjM}c)R>Q|Vdt4;xqppUY%v2{7$x@GH=(A@F?>nTZ zz(pJl1D^S4qp!%c|9hCX&0w%+15&teNkd82?0U@*`#zCttq5WUwO0wxZ!~QJ0MceJ zblw8m_4mrVF$J09one=5DJrD0N6yyhDV(qoBT7%BiS%YA`gZkrl4AR&#K9VLB;d_4 zMF=i2Y39Fqy(3_0X+8Xe7hXrWXfw#chkTP=PCmuE;Q__`lCC;WCj@L=IN#Ea_upLZ zJ!Pq1dZ&ZQ8vXwXL zv`@+dV%?=a+Ql|GItnIakj9Q<;5s+b1SHes(=X@8By3z3Nmn`7o)7D%JSWVMLdF;l zmBW>EvxaMFEr|u^re^iI%}dpxFK#vmsJQ=cl6jtXr=TCe?+o9qENPZe^G!`56 z$Zx(NM}_09qof#ffjJ;nSiz(w?u-3V8v0#F11t&D!vD1o{n{(Qt4GGiC_<%)9T(&Q z-PkIi=}LA$@KXuJxHkb`YZr-g@cxg`=f4-4@9fA1)xrPGX9X1lpvnA;&k7P5@OP$5 z|AWE1Wg=C5`vNA{>#{%DFs6nE1M1GM`2s@65vrn{7kz+EerP_za$SP6p1r`vsnrvT zPv~FV_H5coYKo;CV@(>6jR$b~*Gk}VyB6eSyc%W{-rsF_AS`U7(35_1O=nbxC!k?I zRq0E22c;f&$(HWhQ^g1E}C{RlD{j#>9`Q)8_9#-L)1(RMkS5w>nt0J-FF?JIC zU*8j12bQSKMcepzo=z;~=>oRg?y-%Xq9~Gg3nfRVY>|662RFO6iXQE#X?V8Pn}r{i zoZkq5R+Z?)a(@8}1DKoPZk|>+mv!aEx#Le6pnR=jKWB8|M3zN@u+j%fz4G{4_CJNu;zo$k(iO_U1Q;syD02GQ-F6`E|(@0RSoY==g2IWM(!gI$H48--h z2i%fnWh^^P3@YUfg>zHkt)8<_b|u2cUAonJpWKcg3i7SP!nXVeB3QNT&jMaEDcEqIl48{K-4pgIaHEZ%>HITB;Hc-;t0? zR}@FMf7h(j?Lc?wO$J1#&f1RKP^2aUuGZD;+ygsm|M$1y^2*liHN;2#|7#*2@-L0Z zKy}i$klO8A(>DeW0X3)<|9hWGnelfZYcn|4M1YSP#ZAvf5>4Pzpeg1$YK9t z6$Aaj)W5t|lGM`xqbJV#_`75?1qN!_uC04?!nE~2Vv%xmq+h0mqu-EKFgmO zztyM@y#HhB8?^SX@}+8gy5z>Mh~*M~e90N+M8}_1Y&+^Q9_dFIgMk%lqZnL6ij1kC z0ZXgDcA$1%6(LA5fl_Atg2JgfI6K%-EKLtc7nIUByQTB)HBJ551yCEKW~n~z9b`dA zB*JqEON<@kKi6h`+oFrU6zH$Taj}|mPyAi`z1D#t7SziWW(|F}zv36dQgE5Mh|AqgKlM7@GgEabr~K1okNUn}ieUH6l^}A+ zli;EvPffKsUs0EizT4Ei1il;m9t3tO2^TKCKBizfoe4G9GVwRKcSJPRolDjn-boRC zW$TRido--fV-U5TxG@s0D%TV=&74#Q>VOICa^e%so^`mQwl@X=M!J$w`zGnt4OxRC zPLv*7wYqHV!Oij&yC>sJyoDQP^~ko1L^+JKMc#lB1og z`_B=TZx#D40(@#`ZUYQ+`K3qG&TUtYf5JQ&W*Cr=)b0!npHam^HU#Tso_O1)J!5o4oY60&7G$Kc5B+uX)tZ8wt<1 za5KKrA0*z==cZDUJHb^rb8(!%u)6YM4gZgiR{SDMNWN9VEscly;fb8i8B5Ed5GQuR z_BRW~n^Akdh^F<`|8zA`B*B_n9j^KE?D`^T3BQR|M0HH;T1yUaISU;7@pmkzEUk_4hT-+ zTu(B*+v}vDb$P!C)cem}87b=*{T%OJk?tGPi>+&c+G0lnx4T`=6w=c!A<6J4xK78v zayG$4rc952*Aoz#JsdqQnhqZ)i^Z zVi=2?>Xu&kTYLpBa3lCkAzXus(;V2i^s#!*=qi z34e1Jb_z_7r?WmHiiai=9F_}L%j-RCpXEFCP{%}G^~*u<1;jABPt=(x@9Jdw(NuDM z46|eX*h}jb?H+mYQgH$Gi3Mu`{1ZveyuZK_ADiYVZeP2%?s`x(A^wR4*l;}bb9&(P926uKRt3JD{{1T zsWS}s$ZC5g(UiJg60ClL@bj+AWZc`xdlHdKi8|nmMJV)^Z1&}TV+WxxX5vRcLlTJE z03KWjl9e608@wcwcNV;A3|@NOmS=JvVi~ar;p9T{@*)k76z)&Q_|8Q~-HX%KgtdHD zHTCY2qT1VOXRIet8GGpoclk_bIM1V#gC=ApWe)TeDEIX{>Py~5Z-$X%p?31Fh;lar z^G(ebP0I;ugjeM*ShvvO2K0E~-IS=)T97B+Dr1t6eSRDqgu>4cv|O2TL}=j}?+_wrlUSX@s{?)(@>t{TO$qb{d+$ptT|5mhXpKY-<8{2L<)ndEE z8*+0jx{LVm(dxsbkw))&H%S>tU(@5ms~1PUc!)_TJmJDq-fAy?P*7!EMkp_?P2o=h zS%nGJ6;R$>z@0oD)$~W_Vr+>RH1VRk&w3YX`7tdmLw`9`_uVsC3uFUi!$s19)U-dI}LNDm>lE8j<@aWDl-1N$*E_ca2s+8@FOSG=9bh~%n zPVRT~m*Z&fxMv zSY>y!LD-(=^K#{>F>gplTYX5(MWsX*aI1DB`42$$U`-N3ScF(^$+F&-6?}?J-+j)bZTu5- z&R;pAP$e+%2p4))^UlIWc6V_Fu_4X}Uqn9~RJF`!O%gt5qvV9XRqv+%8D5|ALJ%z= zSA-R)(mhnRogLAhK7Az3X1#6S7*lUWZ@R9@TV-b^@E{dzU*{KjL`}C_e{hA$DSSt3 z!NVtgMwlwN>h>(v(WbNDBC{En?TM9VvVQrgd!~a6ncsl|{LmKT9w|15AxL;$4Nv+( zV*&5B&wtvHj(3@6)-8aVbQVo8R_Q*->iGdUj3V&mO)lYHnhDcT@~FgiJD6^W>H zYFjq-?K%s`UdpPWEd2)?<|8?33HTZ&&Dgz&p@n1EvB9zK#73r4o@qyrRg{I#TVFq@ zue-EW`WQuohgIEnHbK%^BGIiKbmp40@-G|Z%5(A?po{+$atJ?F%( zLBMuq@A4xhUtRM9ZWa12mw(ZyIbN`_)%lXzkZ~b;iMc>Pa1KG8!%HT+^i~=#PCZX_1xl8=!PW7fG zRyq2JE)`$K^V{{N8|hjq(F)F-Nr$Pr-Pfp^J0zmpIDzT9Wj7tmxEkhlvF91v&Je%Z zlxDs0rRQ&qLeuXh9X3qlwWo?m*j5LQ9NYA79M3aFN&cU1Q`6G16Pl+>zir6e+ZF289IoAQPPji4z{v5gHNhVDm9b^F%G{4YyC5?^XsGex!qf{c-*mgqL zeV#O{pQ~o^v>xV|zZh9CscGaNc{62`KQmAO7-worgET1^+@3^w8;$l<~>R!Zf)eZyfv6VS(py)V`4GCG{(G$6M!Mhj5oh;>67n4 z+RSUT^b<`vVhhqXzmB(I>wZ=S%!4uV_F}rY#!XixlYZ?pdHdh3)Q2FCsb(SDO4$X5 z>{Lp~iy;urZD$x^{W_tuy={Z`G+$Ex0Cdj*Nc5d}BsdqY1CT=pjrWlgkh^!z1>|M_ z3PGPC9A6+OfQNjl^%bWXJbIGuS^gKsB9&d+Bn~Hu@@|Yod<&AzVrf^tli3gxeXm}s z-mSTQB<3O@4IV^sIfulwgy?^q2+_|NiD79HdVYX4DgJ2eM$7xC<`8+xVI~iB*DuZI zkH`WFX#qXz!zYRmehsmUsx~`Mf|V(f^RyG>8^05n_q0-`d)Y;K^L|0nuXrr?6DXOMjw|#lO?0RT2T^*T_&eZ?;&#m5Y{%@`&9pyjAa|Z@OgA%}L-a21Jzz-R zHJUG}WixOyVYovMPCVir&k#*hnLin%(t+E~E$xkOd@{oU;(;9q)H=Tdx9sj_2)J3m z@0*O7wTM7ztaq>H}!w8cKw!917xhu-Tr!Ywe~s0fBgJAoK>k?CSsm`T!30ND8m5~NbV*&N$bZ~^%fr@GXKz^iO} zk=V_QZU#HM`iZ$QFi87&`b(cy4_@Yjesbp^>JsnGNr~(Gf2Tj)Zu+eavRmLR!cFBk zPEU>+bc(za!EBVe6M=iBvF!+7f&>vQsY12q9ot@Lyje-bU8o(c9CID4rZD%YfI8Kc zAr9QfaM4ca1=pJte3t1`fR(S*Y0|NC`TV1a&6?VxKz+FuWYpgX6tA|JFaOjUUC*jvi_3e$e-PxHUc6yp`I2Ydf$s&Q zV#l8yIBJObEB%7EpABi1dsccYJD0$nt;`@M z=kGZP{VNj%Ar)Bcwfdbr=eJV_IL4v#$VhHx61+<%F;pipItT)tUimf^UvoMgtip2J zG|sPfd``m;@;yLrW6}*&VEd|BH1SmVAF;>+Q^bW$}@cz;kSUg-U!oAGu`W#-2dp_WP5{5v{Gzvlj4?+ zN_F93SnyvsSLT$o7B2CPAdm`z1Naw>xik|RII)oBr@cYRzZHH#T%E?W1Z8RB1j?z0 zsi72E;9&sonaXMzce0H3F=cQ~{6{L@BJdo;Vs{JV!*3_^@7Vf}lhG4ork2rv2LKa( zZe;?U$S!=#<{#vABi)9X^E{6zkHS=YnDTHI2}-U zsH_D|VgJL429_v8CGt{&v4iEDe<5-i6{YI`vo}Zmd6HB^({+I@7kQP{&HMF?tT#s2 z@S5#&K=6<0#J&Ew?BC-lz?Eb9wy0I$DdYbnPe!sJd$H=(u2ikTUQnfRW_4sg_~>w+ ziCX--1_LfYZzrcbw^K7c-^T`AdWekZ^|-F}@FOK40I297(+)Zt_N4wOIsGgYQke&Z*eO#IF;x)MFjLvF^G{Ke3tfz3FoZh zs)23gmFQ&^zV$s4g$I8pF8hH})JInHJm&d;yK>Mu;XD7$`3tc8Er)K3K6W)5Y1$AZ z;D9r@$Yi94r#c3riQa42dD4-h;Mf5D@$H;<>QAaa{PJ8E!MLI@>1FO&bj#k-6N^M6 z#1Ay3F`jlimUKg!%BZ0=yQ|vhGJgv2HK?t>&oSgnptw%^&9L^_%F`vGj5NAk^MrxGzE7J#kA6UhsWw%x6nof{`g_e z)1RmBCr3YyLF%1|L$dKA*<#-Jgk;^nAZC(?{w#Us!&zp|6T@{GYGfI~BJ_NOO~2PI zWbaRNv9}295inrE>Gd4hg5Z;Tv$649ebQyB7S@^n>Dm8p;5Y)#JnIr!)H?-zdwjf{ z@-W5vT(KLu>peM6$PKX;DUwtd8YP$YjN>%_2d5u8EA#1}c+D*^?l~8{Ctq#Z9^F(3 zYFCAY9&H!5WaMgd6@skPMz>${7-esI;AS+P?$q()FEg-)BDnth?#KdRoNglb!NS*h zp!VRi;1w;R3;*z%Ruq9ls63`AU%waZW7vRORaB%r!+;A}S;+w9_*~uL_+@VD zQ;&JlT(I7@9NBrxz-BY>Nj-9%(ojJxK+y)bhgY{Oy9MFQv3I7C7~Nq+jo%Y~D*qae z0SSevH^n!+wz5<#y;gOvM|T-1r%ol(J^cwT$YU$T0z2aMDp=ujeNZ_yib#7#OR5xh zWBAgF_vg@_*S_|-A#!H;AT>y^Gsw!IjPo7wV{nF3C;1tu@L7>@aXQ9lR&`JCGi`-8 z=KXVKpfmjox&M%k@wru2t_+us=Q&;69yLnvUoK4W(p`EPt9%a8u!gvi?%lW#dRy3B z2kaDk-S&@1<>lSUlK;su`tn3&3mZWgWP@^WKu^>GU;X@4Z)aSqJ?iemuVHe)CiKYy z!&)va*`D@X%6D$+zDPgH!)yK&p2sa@>Az}w`Dh}C-0bY#3uPs+py@^wtN9nKE}Oa5 zm1Es*cSqt(e9!^p-CZFOk*7HUT)+hRz;>NZmiF_^JR5)lpuoJ$Z;{3l`=lqt8^4@f z!JE>*on%^@~y5Ct{i+)KTB7UBBTS1P*@u7{!|&#WP-a5_S2P7I)!z zZ2ieS1rFM@LU$4;=odr@`1U)eg@XqPYYoc1?Ev##KesQ`a+Jb^Z?M%~-(f7v~Kp@Pv; zPfrLHx*$o$t9}X61ix?pYkDW&jaj0QWFh%`4C<#67x#zY*3UYL3y&c}%wiR|`2P&3 znbE);@}4|pg4!&4U2EeD$VXu~t=F2rYM3^#D9!W8-?4q``!F#*=-jDn*-%gm{a3QS zllrU!w*hQnFNgwWZ=AAZS;D{vk^FnjqZw$&m1%`o$Dp&pq{daR<`;eV(%odE(~Q}1 z&Ma_ofsDNyy3ClhK-_e~Ek{e@Nxql*E>Ix3)i1FP1giu@77F)ewmmyqpVec%GaOf_^xE3|JSQu4^^{DP0fK;y+jeK%DV z^zVOd8-q;FKjtJ2UOFZo({{(Mc?kPvqy4%L>9)o_TrU%U1 z4A4;KZ3gM=AJ3on+w-3R*ROBLm1`*_uOn?iH6Ok;`1wV1JO<<7FyBEj)c&sUzf@ok zfL;rT^BFUfVNorCxZ4w{w*`F_(xjl&(;kTW52f&6&6#+QdJn#vz-iZmJ!2y=&sl|d z3kP7{)Ymmu#f90SkIC<1$hmE-Nwh>KtDxkS0gi!UPrFjdF>m4&mP4TbsWSkB8fVWg z=fJiK@Fx@kHW~hr1vps>;-zTvFG>x8e|$Sd)nED5i0m2Igt^Nr>|vW3>r0+;4U{g* zDFyhZ6seo~Wi_s(LUPs}gI;TfO}+0AoJ&BDmo87hfabf0Tq+~2s;bwTLo&EPTYj^S z2|A6{Bow(uR1^#WEPW+rP7m#RxXXJiHF_&ns_R3K-^G5pj@OifQn!UemgQRyadMcqZ@@3J5r5Qo7C3w@w|9NJ z2ZK!yzU(CRa;9cp22;N)kd)J@g``piu!5axRDp7d%0LT}80`W1WL;kw)wvWD4e7tg zv>zZ&1+O96yO^-8DKblOihc!!VXqa2kQL>wq4GKxYX~PkY zGT|SZIWu8*z_>rW0=|ejj;FqcSZtFudPWwz)Fb7n9+G8vxxJQHB%SW&Oinr^uRGwa zc!4#sdcDo;JZdIM)adp;OGMwQRgX6Oj%QXiF^ufCZ=R(|O>d#$4KDTLsReTfE97jT zw!>zM$|P2T7xc1(wo}p71epN<(9~C(yBa=^s12^E z!pAhpw%g?X{g(1wbn)Un?GV*nL zh8+6oqi?F`(%FsZ+EFwgzeGiuEtjErd7?7*FQdTOoWCU)^iHjkF29>v`xoAYy?`@F z8D8_(lR4AXR}MxUSNXni$5;CuNkYCpsAZdxdXG_=+U179Aj~E>XoDXwpzOw~(^1up z9b2`21RX`0<#{`&AByK%p9E0gh&@`lQ&o#YB=NeMWcvB|)Z_tj?}MKUgpVKibep5A z7;?vCvu-o-u>@wvCH!~C#c3w$)iWd$H@iXK)p#$? zir{qvi&}qniDE90J-GoC7^v8XCkB+X)?J4WH}wzJT*%I+qt9Dr3KY($RmRf0KK2R7 zWWuknS*=H^pw=)w?s*G#MFwoyvi7C!6&|Qx1?T(1_1Y7!3eOB@&X*)AMe`rTkf?iY z9c8g4Hu;W>?OKVolKujfscR?H?$ihf&1esEa!OQ3Zt1V24cpdg;a6!(iOwjp(|ZcV?D~gy zb&qNreOwb}!A?`<7CR#s_sj+x3Wz-R$S`J|rQaq$+JJv7>C6~rv*hI677du|*uc-* z_j0qDlN!R30xBYBPS${CXhX1=USCo@w?=MDAISjAj&XyrTNG3a46QkgnovT=KsS4+ zi?xywm^0&DEca=?K7}ocN63SLN0Ai|-yqxnpbZZ(G47oPo?ryPP%gU@!)IYP@)XM! zdAMID(rYQBzg+BbU97<-4dQS63Rb5a!|7cf6pM7$KJ%j9I`K_BRc19MH z5yLbSnD>@O2F6aJ_&zo_o%3rj+I)jvZ{7ThPjL1G#cDeNz+s?bpzhkL)amT4qXg)L zJ_>!j7BuWSt3;i*?-ThU^WJV{Tx5!x8}ZSR30yyG=%W5e`oE-u#hBS zh@mTlF|Fs1$+Tfw?{LtnkG%%vLK;s}OD$uT@a$r&qh$ZhbIUcXaxD;VtiU&=b-XH- ze>D=~VaHdp7JFylDFqz^pL+LcY=%Jbs|=g)16zp;?$hDyHx5Ten<pbW&f3od44O1Q!yg8BF8Q;Nd{eDq`sj|vhiCNrF zxFl%_S|+r_DH3+{AgZrYr#IcCq;JfkSkojip-D(5itGG`rG`=0HmF44YNR@9$svVP z;S%4K8S8K^?tCggpWXC6KkHO)zfb73yQIW}Gnq|`11iyKkRMpa`bI-TTO+^WwUsRz z+;=Fvf5NCrB6sROpLw$ObkJL@sBORX?mYKb626?~=imQ*Q&MdIsV`ZSeK%nA*@c?s z)*`cl{r&V$8a8>MiFOb-n|BU$&o8kJBzEz_{$cwePX2b+RoN3=iOBjOd_#(xWbs$; z)tC<++=Y)0@w%LbuSVK7&=pJK!uUqbIYP-NLdOkS^BJN;V&1_Z|(3a)o~&h4SXtuA_>`tFnPy zl|l2~thJ`mTfTwsCe-HXfli;Oi=g!Jp@18$QcT^}@cXvu535R(jdD)J#`|A<`t7Zq zgX;Em(2UEOA-DoiYtH{<$fm}{b|2BX4Ie$JLHS~nVnTL{ro}z#CmRciu{WF>0*>hj ze@97g1}UK}n4)Fr!mzKTZgs77v9&Kg!5i&o^!k%a0eDgm|Hvp3wTLs^9Ojpd2DShBMy_iVWJWCO#+U6^st57-)f{~aoFN4NyHJ(CrY zYrWGG|4#^>N$FwYW}wT*jWk4FhBEtopw+b3ESy)nN#m^lS}uiRX{Ukln&8`McbpVf z>_oWu69<0xIXXgwWKlmYl4W&;s?#5!5BC>@_GA1|-}RxF#ZhyWVOod%Yu-LuNQb_d3mN%MvfYENdE35FWNFZ5L73Yt}p$R8rC zsj_~?ff1a3SR*vC)*wDpw;~AkDNQg@HYgtln=R-CRf#VW~cab>uYvWg#`zLjS6s{Kyk6*|@V9eW$ZXod2b*CsEul zBGOl>T|?wAx< z`G>fMI{3f311yi^SSR&G|-tt+xmSg3^=bsLz(-Z~ zhJT*~Xze$NfsyVHCRwVEu-UBtivtjM{0TA*#SJ`W)1H_Q4hT9qdb_e@Xw`V2Ha-h<9ex9`JNP%~doqb-p8>IKrxA2Z0=j1}Xpu4-6qom#>i~f_ z@VOl@SLz@XTCI@k`>3sRV%RC~MYXzc6=OTD>aIXnpfG^H#dhG=YL@GV$}}puP!eMW z^G^BCh44m+k#ei<-aYBw_6=>4>$jg}g5FyxCYC?g@1Onr<`HYK_`mEA(o20d1x>&C{+D(UF#20O{9{PuaoS&3q3K#8A)A->|)?6(*D*ROuhuccQ0a!comgr@oT)wfv`1Q5ul zZR3xFp=KmlHzpsSzw#gwy{%(w)U2U^j@aZ+f%XAP&zj`u)zY&2bY<~jA+*i#@IuJp{f=@fpO-L~i&4Wpii++HqH4CEX@yvy}V*CO|3 zt$R830y^1h`-POqWB(I(@l49*uFq|E-rsN9s{`spE++Uhol`(L^rq5-DxN(l77o(S z+kYquOo}3t-UCz~n5M%dV3}k;_|_=v(rd=GR z!L<$Ne@hTRV1V_&Mr`Pkqx19NxRxLne@F<&MiV;9dA zs7)p98qf(d3Ez*`UHwTa3V)&=V8trToqw)2qs6EB zHKq#5W0GqXsMaX{1A%TIu+H1{99|XsC6OQxt6RO{4?=sM8x}*P9~2Lpmbkqo=Jr^| zKj%|`eW`F4OK^#KzrJ*%pkkFmN8Q4V*cZ`NqJTSsO#s% z2+oWY*U$q`uRWeH#XiugY*}GM3Vwdqi;QtFIb}o))yWFKVrwj{i)Oe z(SwOe{==qup|#W7li8`{fzgJCBj5gQ6sM`~Mt?C@etpm|2?-aj()O?(2({;@*-kN= zNKbFqOBJ%TkwPMN%Z>2oc)3DXLZK_(GbghPR7wQc2INu^UsipbHbrT@=|v3%>@inf zIKPrx?RJYG7wK_6)Osj5qbYsgX}0Fq4O&sU1}xu|r9z-Z(SC9(%}ep>1gumBk)~; zSL*^k4h5|q(TU|35qoW=ff&8MeM?sRgW3l@X;)aqR>09I5qTdAzLJl?@xGvi2UatN zpChiNF!I>x_wV&=h-pn6Lx?i3ot?&Vx(iRa%yU74tKcK0mveB_U+J0fMx33o zIW>rCO39xIjtZk^h3$umxKvKM2OO2ZfzR##=suUB`<5uuB20+8E&KAnxR9K`iFbf@ zz0)MUB?isrD>!2Kf&1hMhGD{>FuUpMXUp>T@+e+BdS=15`iASHa#YNJg3Z zFo&A~+dJy~5JFm6XSV)!a* z>D6fOv#{NYIWPLjuSdrUbLlH)s_w;e9QTpFG4hcd1ue9Jpk*{Jre1EXb}KT(er4;; z!Rq^_mue^%7YVFtkTWUFCdrHCg(lIda50;-f-cV08Qza`a&N{%Q@AFy6xC5}O%Vaj zFW^7YXncj5g)Qf(2Tr7h_InsgC_t!QazA#*KA?=w#qv&1XPpp)sE#xN+;?LCmTTB9t>E1u(YvHM8P9>(TX zV%$pZcxoKL2F%`5@@W5f*%?8R@}>e34$Yf<%quj}?c0@)UDlmZpv;IG$_=M!lgEup2+?Ke=eC;m@kUmj0o z{=PqIN`<77q>@r(sU)Go^pPl)EXSICD5R5wBuf+`(t_+IAv;;lvG0Uvv*jF1mWmu( z969GWzx(|hO*J#0-}f_r&1IInYg5voB2s39!ZQ_Do8WG#)u21EHh_;^LB70lO(Y2t_P}WRE{?Cb$tv1BP zskFsuz8Rap6mFP4YG+mn&WbsW#bMAHP-rPvx2AF?4-5H>W%Jn*;yqQZo3GH?DK&l^ z#%4~Y={yvl6Ysb`Yx0%ZrgNlSduoy(B%>pY%iNFS6C^>Z8jgE1=<-ML+c~BKDgX2G z(bC~U_RGm;Xx8FJfH}_9(AcY2PAjEV@aPYkM>?1itJU3U(iQA>)KK-W44sdl=RY!a zT|qQ)n6mQ(yRE93ll)NWojv5?|F}zZe$XywLTcf26iyr)cDykQE4kSxSs$5e*xSXZ=BmVIR?6nnqN z^JRdv+ycbMgriUZm;5BfkV&bPNb|4mbbu+ zq;ZJeq>$ISM$zSBqp*Xh%SITQ{g|7@qai3u3p4zSlCjdVaJ-^HZwb+Ti%X>f!o=HU z*A^4J9R|CXw}=lJ#^{=lX1K zd5wBZ98afBHC&QTG%DjJQ)lr+5Uhi&u4Ca9xg{#l^?FtuU+D}EoaaTgAcqcz;d3tt$u!Qx=N##6+u5T)aLPH? zJ$~WdQQU{so*+=Z{01P{)>=)O_b?{0Jn*LYg4dP;fr1mIhe4m1mn=r*)8=SvKeXTK z#V!9Tv0vX9hT*)$?uTf~z>vio8?pc?f>}J4tpJZ&L&hd>$En`c==hy6+J@cP)A zrJsHBNOsHGF~VqAM9Jj-JfB->C36*=6!?Bmj#B_r;L=*O4b7!T`(F3f6c7EVcFz&d zDc#vP+sjwRm1?q_?kgJW=Q{*qO2kaK8SxyM8%dL)I-ALNZ+7z(`*3zlma-Vca1KiH z%RVZm*Gd``Y$8Q&SJa=foy`hh>H2@|={IkH1bJ&2Dpmqx+o)qPvyZ-Rp5=zCWYAFtDc}L>{nzLm7N3=9X)Pc2 zPqiQLOmS$P3J;JHcz$YE25Fx$Ci2$%tyx+V-B$&#+FZW7+s!kj54|*Tn6meKTGun)J(q!l z0<#2Rhx1oY9TIP15|s#WS^#2$fb&l|?CUu<`f-Q*fdeitvv2Z7)nOWY!Ejkx{YxK@ z*17K%hRTm#ywiv{UJA+;$A$4Xa-qQZyDIc-`PL>cULM)v83iei#>@SRSj^Qj2DbOk zH-%7kr*(|a-JpMaS+@C7>RZOD|CSNEDm{@|1SCZxo|gTdY94Kjs}u8WovM6c_>B@y zREg(Q;Osy^fcZ)m#AfTM+bWTRp&jIgCP*gc(Dilsx(^-RN+K?pz!;I2I6u^OJ=zL( z1v9WKtmQftticT0k||JdswE6sEyFW+4_cAhoa%OYx(@dxSBZft8|i!&w8Y3ZqBe(( zMiFWB*HHxxZ26<(oJ^g;A=$*(D1uCq&9QHZ7r>whmfgKm)iQV!F7^d!D`;A!3Xy83 z0#rMgEo3RD-VrTMee3!aje_iSlM|%9?SwnOA>Y9}FH%cW)L0{9Y$h-;fKjvxkgSqH3<##i6nrv-hb z&$g7+;jjyd}nYCZ2DXS{Ga3 ztG}z$<(EoSZrBX5BE@~j{YaDO84D89&pIgOEhCgk(;g$c7&7I784D}0v*5uWyNO!xcCzUDMMaZlm#1+mucpkI4 z5P@eYzCm^O!{igh996zUEUBRzkJyH_4Va3Dy1*Gx?PD#tzHzym(4+W}Shq+HZcfq; zzX*0ktvzG(TDts))7@(~o~*k5Lk)+Li?46JT=9(L;R~`C;@qQvVYPFu2^(4Wg=9#Z zE0#$z2hli7VEpU+_2Et2DzJ^{M99Ig3(f{8?O2v8NY7P1nleZ98BM0XvD=nr=!=Ji z4dT*7cNgmnQ}hSs=^v(@$b8f))^UL6Z($Q3#!@saDf)=4Z!Du5oR@8W;w@e(57|;* zuFtueHaNedztr17Nddw}K7q!ezW)m)@5?5KQu#CNteZewLD{5?us|F0LM`*5)FHQc zeXUrdQ&Pvo#`LYnTv#>*xSr~6w;M_1HqG7_sp#=UJCcSx)cjNjTC~8*ftEEV1(xS0M68ECeiK_FeZ%ED>0Qkht}kuf3iDRM{rEf+j+y9G;}XUeB0_vc5^8>gk@Rk)vZeX|WOCa@rZ^ z7%l`2GwPEWNT9#LE%lyP9X|J)@~kOn{`RK|&LkKs?s#xeg8u4KZ1zT3N*y<5H$p~n zqz1N>zd*Vp=s`-#Q}UeeXLoMm6HFWR2D0fNIxK$&ouK_`-h0lSQ%I`y&<<(8fjpEc zDRe&TwL|-v=JoNG%VAQ4Y#GUWm-8bx#?L&#!n_C~X^Hl7@P@&b(E|$mXGjC-Q5xwf zO{Oe4mTq54l}m8p!9ftF|7wdI4H-n9BhfvJb)y_cIl=?e?5A$iY8koPdgr~fC@m6a z$fOT{1q)_?d_~05@oP$%lLa*o>;q3_q;>CSm2LKgN6(n_n=8 z#rqk_x_Ue~D_)PCY%z7FCwj={T`J#t?+S9mp$Z-16Uv{pI?!}xPEbnHljzVxh;t61 zNmmw@^&4MehFvc(L%HRNqf#q!dcJY%_q3R(V=G(pe1+ad18v;6FAMc~6+`!el1iNZ zY!~R8B+-je5Q>qdh^&K{aN6QIQM`CbV9kVU8QxfD`-03CC6?>H`F)?h99-gh(nB45 zCF#$0>F>9vwQ2LWXwbG4W(E9e14Noz$TQ%tMb@;_JWy&_y8%F!bb1dCYB5NdmLI`| zDt(QU9HMkMU$Mu%w!^jpBwa9?o4}DvNAdNO@@9E2khA1py?@r_0S8^UOVyhiP3=fn z=>ToIey{*_4PO_-`xWJ^9$)jFdiP4q6#~(Zc6xy;qy(KHeWu%bW>*aRQN=AoyqR`} zMkW1mtU|O5j8CjS?9M?CC_WzO9}E&4lpH2d1zMusuyXA#9uaGj{}UUz|Js0khjWtv73cZ z;E2>-A`#*?J|wELu0#v#2Uu7R$7P03LO!qTVuW0b>&}(Q%l?&joaKKXUS;RDe6sNI z#TWfr)3cde(>3AgX`*QYghL;j&YG#=V7mkxY7USnJL1Oel)E=jF+zFe(bhvkxFx^q zU@zvhmFUCcV9ka%bn&#)+q35R`kIB7c;}k7vEzspFx8CJQ#v>OFo8d7*{Bzdbt$d@l~ z&M}&9P^8 zwSAYfvoY@2W9(c!-5wPs*m&(Ie@6U9%#RP6dyx6cu|x4i?GLivEEvHnIrWcKJ-uTp zIy8{E7nmTpuM7pZ$ZBd_^Hq}x#oX@`ub*>=XG<;f#^AvgD}Ula-B<(DJjYNhyN+SD z%smtlE^EqbFSr<`E{OKxjv&=$RNS!B)pNpjqGH&y0ERs9R55$@Jo=Th@s1U8kdv7x z@-FT+EuQp8wKkEwy@ZdKcQa$u>t>z9PwQ5;eun-JwCXGd7Mm#nJKxIYBX&4jhYcZI z+)~xIYJ_3p38_r8x@SQ$+a0k!diT!m%U@c?$drv)XO!2m=Hjev5DyEkZ!m1sFkzJH zpU!HArJAfvVcS>7;3`rtx=VB6D(jjgZ_Ef{KC5DuPB>;0&XI2g$rK$$@>?FNM6D|Zbj?rvB0~{s33+&JA4B)B$ygWhfF5dL zES+8?sHmujlriU`pJ+l}1S|@Qlm8rTRl}yVC`UjwK^!6i@9@A2r4#^+vP~|%uw5cM zH+j4xaoAXy^}wP{@{B1(rIVxu=HRxBnvI_Xa>FT=!!?9Dr1_b+nw$?WYu&N37&+_Y z>EO`(VjcBm--cN{!+ituez4n8^3E_m{DDYqrc#d-eId?o+a+t=`i5~N z(BkuFX+ z6?yF+&SNL$ynm3gi*_G#XN2!->daovjqFv(efoFPsV>WO3JV9CLPFmaOVK2=Gvdn$ zcmTv2yFUyovK61rU9dxqj5QPDR&(m_>zFM2)SLLeVGK4%fs1jVC}5guP1ji7MB0Y1 zbrK(>Ih;`xgXms#sd_%f?ji*|(LAavZvhLg=&Uy?RW0lW+dS}y=$SGMMef(Eq6j6V`yZ)$Mvz=|%W-@pz z9L%#j47J<-$TY+Vep6F}i-ayx?5L8N%0c9jf;B0ueqh8e2g3N?O78h^eZvQqB-j*V zqby9J8op}Tm{HO5Sjd$)aCfREr!rbYlBv!@Fw19Y(!#r~DcN*gDM}I-;M~^Jg`Z>H zpGK)n`CcF0j8ib@1;4s4td(K>79TAnBR4%S3qbc3?meo|>3O`nGbDSQzL;9-#h&ykj>8(4CG$f{arHtA8YvN9Q!T31n zh2b;#ryexjq5Gvth9W?HyHbhru@$EfY8>l%VuZC7=R^}469AeoyZ+4~+^(kK-pjL- z&f&Z7VQx&WXZ{gx9WJ~hW3`01NyHtM8WZtf#9#8N>bmgU+Jts{A$wG{obs@P#iYg( zS28>|tdEe=H96T@pZC;C#N)MHx9XnwLV#c_C5%6iW+^BBzi01qZJ>Z@%r4zgl9L$T z1s8_ZT$!ieL_C$oU4Rt%o3(A}g0<}x7r@cu93F3{tg{RMEW$dN+*`<-_PUU@2qmp- zO}~fXgr8y=kDc>i9Ldl~MjuN!vI$$QDduTq-0-gv#Y$_)KV>J{B^JDkp!&PF?L$zQ zrK~&&)D5hcVF8SCeyyk{j`L#mBff7W8_@(ae>B6OBr%uXKUOTqSPxw(lohT23cM|z zEkg8R3g^n`i6M#$->vCEUctfEwy)rsfIM3$!EBl)m)-FLE>-U~e-`JhTIDLiRr0(l zweI~M@1bVW=Td4UDN$8MkL@N0_=UThiKK+&FChMyq((oaNK-S^?#^} zPpr32kY;ff+Ez8$baLw*Rxsjnrb#s|*S7CptedO6?z<5=7?v1$bVRa=kAB`eh|4DC zbP(`r2MtF(a?vgm%)y;N-Ar8`L#t)xCboZ3w9syCe&U+fTEH@S`|4CTDfnKlL7jBN zWbnQRc)p~)Wt;9N55rb1U~Z$aMKfKTpH&^51)=Iowv0&N?l8sDGUkV8B8P|MT@SX@ zilDIoO7h>w0$4i@5csi~7=-C{sn7}`X-)q8^Qj$LIM+YjjHe|r$!P&jZ*y#sy~;Jr zVhg#x$;-MFhKipO)$UuJy{8ZSU0RJ5;=V6H)k*@$)*kI_n6t}3Z@lUhnFpImU+U{4*Dp!Hq z4i<$>r8EYwH2S8vF=N@!?3vF3dj<@W^q>4^np%vkh^AH~*@R7fq}>^rOg3m;PVV^n z<18_if@n**QUe@of+HiX$tc11groqI7?N?rF|MsU$J=zD&RTyT*ZWrcrhR^))>}E3 zS~Hu^13DKKuMa7#^W=Tkt{7ru%y`{sAfKe{i(|Rw!9fj`9xX(JnFPXV-zSD3VDdT~ z`ba;;3pfrRF`p+^Ipg2Tf>w7HHMH=)qjZa4Mm%+=Z>pIuzihUy&si!Ax$xeNQ+KW% zOY6$3LP2LSQaaHSa^@N>;*^EEO-0g@X(!@Oheya5b>njlm336zb+@WUXgmKBHw(Qq zyXbg{-U>L{$mHU2K$WRx8e}6Qv6NHfsqV@9w*)Yz3e;TR6)k^bs?dNnIP^umOKi;6 z{b9Ih$>dby-PljI8_dvVZv58r>Yt~^Ka#Dn_r8EBBep|F_dNP8cL~h;4przQL$v6_ zK~dF-4fmvPPESj-YLc>;#n5KuLJTtEYJ6sN*9C5CjMcPAk^O0F3OHN$`5dlOed{S+ zKQh-4zX%PBD#=Aj=QGmer<6*DVrEY?VXjqp&0r)$i)ns?rHiaDu_AFb`cT^Z8%6KO zFh`|~26Wr5odEVmA<$!YLCV*ru{q`rXNBi6 z?vG5M3}IgyR2xlu)(sBpF~J-Pp8un_6OA~2Na|{6hlzn>3gLnVH@0_# zIJiB|gf@n+g?ZKG#bNw8oSKs#Zt$si;BGqfgg66wx2wr`zH-6LHQj?J$>y$}6aKuZ zHB=;!`o;D1kAfnVAdY2UTfNTiVJ!!XVGXp+=C2YG#?N_ovLZ4TRPxDUBjUjJ;k3%A zRisJs$9pi4`IYMYCrI0-eV1+Ol8X6B@~wLcZWN3PF3ZbV%Z=@QfNcDZ_04>NThT*UYiNK_k2|Fe~9#zAMwg71Tw%N z(UjDKCTFxA?_!IF@M<{h$0JHUKcC*9Aj50HY;J{Lw|rGCr?39SN9UexDX>` znr1hvJV7ZD=`ncVveZvU_UB^oGX?OS3c7qkWPj-By6w|$cUs?F8&|;qaeG_rHGF6N z_)pO-yofkh1HGx?>QL6G3Bf8Mo=@YiTrJ$3Zg${$vh)^$L(G~2!GRczq!fC-f(-6M zZ`-lG(Z1Ujd_PTQ{xWW<&dV${_gA$-;!+k55y>Y0W@$D)~i??7oR-s?fGGfr}3vAk(E2XDEbGmDa zvq7n)l+^Qf{K4q_*HuVeR6Ds5TXHiGVBgpI!Y$QFYK=WHW)=hh1>=PCfV2b7*EWQ0--qVzo z(2FeO7-&lP-$uk;j@TKHLXDQp>~MGBb$gd$}r; zR#RlBG(o`AWrgKkR?a?uU>xSsKkoM`;Rw8Po2c6j4cyVKlukXXpMgvv=lmK{E*qj$up8Zss5HbG?k}!Y0 zs<+f7{MNnqz8Vc9)G}0>x)_n~H9Xr!uO32&^y#J?nD3c0%B2^F2?ZZIKsRq>Tn^i|_jH~z?CyElV>GMxjXxeES zHnY5F8jDJ{RpXCz?B*G8vbVSA19y<#Vf#_I6rEkM`;3-LGsMDoQvYA$n(g(fNKJK) zBd&~jX{+fVPvpiZD$C2Q?!o3?fL>PnPl$^cQO2Yx0&jwoL4<;hdtCseEw4|DzM0SD zEuxx;U~^CbEnZY>LZKOr=Vm_3>=K{R4ex{HlB@DLeUChHpaDv0Z=(=T0*8omeDrOu zK_TdDqP?g>AZ$^Ej^O`_+Lc`M^*b}x3^*Gozb(L4zc9-q3RQUSek!Ny!YI zI36N?WxMZMOC#53$?x69El2h+AsVV-BfH=C-V4z3DE3UtN5AJ44(Mn`A5m!ZsWHpk9aOJ%R9{j zRoxb7tZD$dYKsmiUXC4{hhaHHW-S9kvZs9(ueQ2$;$8cq`F2@K=#Q3>^K$@@lC5p~ zN!oaK^5gUfxx^GNf2%#hTUpy|Z=IempuH!*`l@TisL&7;3}raHL3{GPEA=oY<~z1n z&h>g~H0k*f6>^26j2m|-D~WI3DP7K84*|D7s1J9>8)6t z;Mx@I zJEvM}Oa(`lysR`+lSvtgY975HN6&z!co9X`z|?L}!n)RJKXeMK0al$o&m4)0yAR(2 z&~3^?faC~`>l(XjAC8&MTdE9qZ0=J-M5s#@yNJt}jpEro3BqpNN;}|$!>4^J1;3aV z{wApN`B+sC`kC;NZJN6AYI^?x-AqQ`_)ZS;r6 From 5b80aaacb10bf8171a2d229ac9ac3c0e1f0784bb Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:23:36 -0700 Subject: [PATCH 0152/1214] adding SDL asset to library --- windows/security/TOC.yml | 2 ++ .../msft-security-dev-lifecycle.md | 14 ++++++++++++++ 2 files changed, 16 insertions(+) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 51021a5be7..2fb9e585d4 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -8,6 +8,8 @@ href: threat-protection/fips-140-validation.md - name: Common Criteria Certifications href: threat-protection/windows-platform-common-criteria.md + - name: Microsoft Security Development Lifecycle + href: msft-security-dev-lifecycle.md - name: Hardware security items: - name: Trusted Platform Module diff --git a/windows/security/threat-protection/msft-security-dev-lifecycle.md b/windows/security/threat-protection/msft-security-dev-lifecycle.md index 18ce55f174..6c23e09a9e 100644 --- a/windows/security/threat-protection/msft-security-dev-lifecycle.md +++ b/windows/security/threat-protection/msft-security-dev-lifecycle.md @@ -15,3 +15,17 @@ ms.technology: other # Microsoft Security Development Lifecycle +The Security Development Lifecycle (SDL) is a security assurance process that is focused on software development. As a Microsoft-wide initiative and a mandatory policy since 2004, the SDL has played a critical role in embedding security and privacy in software and culture at Microsoft. + +[:::image type="content" source="images/simplified-sdl.png" alt-text="Simplified secure development lifecycle":::](https://www.microsoft.com/en-us/securityengineering/sdl) + +Combining a holistic and practical approach, the SDL aims to reduce the number and severity of vulnerabilities in software. The SDL introduces security and privacy throughout all phases of the development process. + +The Microsoft SDL is based on three core concepts: +- Education +- Continuous process improvement +- Accountability + +To learn more about the SDL, visit the [Security Engineering site](https://www.microsoft.com/en-us/securityengineering/sdl). + +And, download the [Simplified Implementation of the Microsoft SDL whitepaper](http://go.microsoft.com/?linkid=9708425). \ No newline at end of file From 94a899aeea133898a0ed2c02bc4799fbb13d1d29 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:24:14 -0700 Subject: [PATCH 0153/1214] Update TOC.yml --- windows/security/TOC.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 2fb9e585d4..c0d8371997 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -9,7 +9,7 @@ - name: Common Criteria Certifications href: threat-protection/windows-platform-common-criteria.md - name: Microsoft Security Development Lifecycle - href: msft-security-dev-lifecycle.md + href: /threat-protection/msft-security-dev-lifecycle.md - name: Hardware security items: - name: Trusted Platform Module From dd1f7282b404281e943296ff770b59ad3fd48081 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:32:41 -0700 Subject: [PATCH 0154/1214] bug bounty --- windows/security/TOC.yml | 4 +++- .../microsoft-bug-bounty-program.md | 22 +++++++++++++++++++ 2 files changed, 25 insertions(+), 1 deletion(-) create mode 100644 windows/security/threat-protection/microsoft-bug-bounty-program.md diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index c0d8371997..9228a4398d 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -9,7 +9,9 @@ - name: Common Criteria Certifications href: threat-protection/windows-platform-common-criteria.md - name: Microsoft Security Development Lifecycle - href: /threat-protection/msft-security-dev-lifecycle.md + href: threat-protection/msft-security-dev-lifecycle.md + - name: Microsoft Bug Bounty Program + href: threat-protection/microsoft-bug-bounty-program.md - name: Hardware security items: - name: Trusted Platform Module diff --git a/windows/security/threat-protection/microsoft-bug-bounty-program.md b/windows/security/threat-protection/microsoft-bug-bounty-program.md new file mode 100644 index 0000000000..7dcc6cdd7f --- /dev/null +++ b/windows/security/threat-protection/microsoft-bug-bounty-program.md @@ -0,0 +1,22 @@ +--- +title: About the Microsoft Bug Bounty Program +description: If you are a security researcher, you can get a reward for reporting a vulnerability in a Microsoft product, service, or device. +ms.prod: m365-security +audience: ITPro +author: dansimp +ms.author: dansimp +manager: dansimp +ms.collection: M365-identity-device-management +ms.topic: article +ms.localizationpriority: medium +ms.reviewer: +ms.technology: other +--- + +# About the Microsoft Bug Bounty Program + +Are you a security researcher? Did you find a vulnerability in a Microsoft product, service, or device? If so, we want to hear from you! + +If your vulnerability report affects a product or service that is within scope of one of our bounty programs below, you could receive a bounty award according to the program descriptions. + +Visit the [Microsoft Bug Bounty Program site](https://www.microsoft.com/en-us/msrc/bounty?rtc=1) for all the details! \ No newline at end of file From 13fdb77a7dd40853652c47be8cea6827d9e49271 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:34:39 -0700 Subject: [PATCH 0155/1214] Update index.yml --- windows/security/index.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 7cb9f7653b..0223f04598 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -12,7 +12,7 @@ metadata: ms.collection: m365-security-compliance author: dansimp #Required; your GitHub user alias, with correct capitalization. ms.author: dansimp #Required; microsoft alias of author; optional team alias. - ms.date: 09/30/2021 #Required; mm/dd/yyyy format. + ms.date: 09/01/2021 localization_priority: Priority # linkListType: architecture | concept | deploy | download | get-started | how-to-guide | learn | overview | quickstart | reference | tutorial | video | whats-new @@ -30,9 +30,9 @@ landingContent: - text: Common Criteria Certifications url: /windows/security/threat-protection/windows-platform-common-criteria.md - text: Microsoft Security Development Lifecycle (SDL) - url: /previous-versions/windows/desktop/cc307891(v=msdn.10) + url: /windows/security/threat-protection/msft-security-dev-lifecycle.md - text: Microsoft bounty program - url: https://www.microsoft.com/msrc/bounty + url: /windows/security/threat-protection/microsoft-bug-bounty-program.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) From df4d59c47eb1e38f7e057bdf3cb893d8ca3599da Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:36:59 -0700 Subject: [PATCH 0156/1214] Update index.yml --- windows/security/index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 0223f04598..75ffc66f93 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -29,9 +29,9 @@ landingContent: url: /windows/security/threat-protection/fips-140-validation.md - text: Common Criteria Certifications url: /windows/security/threat-protection/windows-platform-common-criteria.md - - text: Microsoft Security Development Lifecycle (SDL) + - text: Microsoft Security Development Lifecycle url: /windows/security/threat-protection/msft-security-dev-lifecycle.md - - text: Microsoft bounty program + - text: Microsoft Bug Bounty url: /windows/security/threat-protection/microsoft-bug-bounty-program.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb From 15b3ecd41db69af3267ced632a248586478b2834 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:38:28 -0700 Subject: [PATCH 0157/1214] Update index.yml --- windows/security/index.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 75ffc66f93..71a5f7717b 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -23,7 +23,7 @@ landingContent: # Card (optional) - title: Security foundations linkLists: - - linkListType: overview + - linkListType: concept links: - text: Federal Information Processing Standard (FIPS) 140 Validation url: /windows/security/threat-protection/fips-140-validation.md @@ -38,7 +38,7 @@ landingContent: # Card (optional) - title: Hardware security linkLists: - - linkListType: overview + - linkListType: concept links: - text: Trusted Platform Module url: /windows/security/information-protection/tpm/trusted-platform-module-top-node.md @@ -49,7 +49,7 @@ landingContent: # Card (optional) - title: Operating system security linkLists: - - linkListType: overview + - linkListType: concept links: - text: Secure the Windows boot process url: /windows/security/information-protection/secure-the-windows-10-boot-process.md From 25e017370fff019a2d98ff5e8e3df6ce02fd201a Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:40:05 -0700 Subject: [PATCH 0158/1214] Update index.yml --- windows/security/index.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/windows/security/index.yml b/windows/security/index.yml index 71a5f7717b..f4a69ddf4d 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -44,6 +44,8 @@ landingContent: url: /windows/security/information-protection/tpm/trusted-platform-module-top-node.md - text: Kernel DMA Protection url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md + - text: Protect domain credentials + url: /windows/security/identity-protection/credential-guard/credential-guard.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) From c0f1ac7e36465bdbc3f3e7c306812d2dc32f2e76 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:40:43 -0700 Subject: [PATCH 0159/1214] Update index.yml --- windows/security/index.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index f4a69ddf4d..e11b7d5819 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -42,10 +42,10 @@ landingContent: links: - text: Trusted Platform Module url: /windows/security/information-protection/tpm/trusted-platform-module-top-node.md - - text: Kernel DMA Protection - url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md - text: Protect domain credentials url: /windows/security/identity-protection/credential-guard/credential-guard.md + - text: Kernel DMA Protection + url: /windows/security/information-protection/kernel-dma-protection-for-thunderbolt.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) From 6f00a1a1bc6bb6ce2a470f784bf4afbf647a2272 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:43:26 -0700 Subject: [PATCH 0160/1214] Update index.yml --- windows/security/index.yml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index e11b7d5819..d4679c7821 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -7,7 +7,6 @@ metadata: title: Windows security # Required; page title displayed in search results. Include the brand. < 60 chars. description: Learn about Windows security # Required; article description that is displayed in search results. < 160 chars. ms.topic: landing-page # Required - ms.topic: hub-page # Required ms.prod: windows ms.collection: m365-security-compliance author: dansimp #Required; your GitHub user alias, with correct capitalization. @@ -51,6 +50,12 @@ landingContent: # Card (optional) - title: Operating system security linkLists: + - linkListType: overview + links: + - text: Secure the Windows boot process + url: /windows/security/information-protection/secure-the-windows-10-boot-process.md + - text: Configure S/MIME for Windows 10 + url: /windows/security/identity-protection/configure-s-mime.md - linkListType: concept links: - text: Secure the Windows boot process From 9dc5919c15d4c393f12fc2ae322fa5cd8c8359a3 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 16:53:55 -0700 Subject: [PATCH 0161/1214] Update index.yml --- windows/security/index.yml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index d4679c7821..154f648ccc 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -52,13 +52,13 @@ landingContent: linkLists: - linkListType: overview links: - - text: Secure the Windows boot process - url: /windows/security/information-protection/secure-the-windows-10-boot-process.md - - text: Configure S/MIME for Windows 10 - url: /windows/security/identity-protection/configure-s-mime.md + - text: Overview of operating system security + url: /windows/security/information-protection/index.md - linkListType: concept links: - text: Secure the Windows boot process url: /windows/security/information-protection/secure-the-windows-10-boot-process.md - text: Configure S/MIME for Windows 10 - url: /windows/security/identity-protection/configure-s-mime.md \ No newline at end of file + url: /windows/security/identity-protection/configure-s-mime.md + - text: Encrypted hard drive + url: /windows/security/information-protection/encrypted-hard-drive.md \ No newline at end of file From e5775301938e210dcb2fe11f12a485b484e3f742 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 18:46:44 -0700 Subject: [PATCH 0162/1214] Update index.yml --- windows/security/index.yml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index 154f648ccc..4933ec3a76 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -61,4 +61,13 @@ landingContent: - text: Configure S/MIME for Windows 10 url: /windows/security/identity-protection/configure-s-mime.md - text: Encrypted hard drive - url: /windows/security/information-protection/encrypted-hard-drive.md \ No newline at end of file + url: /windows/security/information-protection/encrypted-hard-drive.md +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Threat protection + linkLists: + - linkListType: overview + links: + - text: Security baselines + url: /windows/security/threat-protection/windows-security-baselines.md From f2c63b041463f8d7025a8c5884a1f04fce842680 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 18:50:49 -0700 Subject: [PATCH 0163/1214] Update index.yml --- windows/security/index.yml | 28 ++++++++++++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/windows/security/index.yml b/windows/security/index.yml index 4933ec3a76..ebdbef87cd 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -71,3 +71,31 @@ landingContent: links: - text: Security baselines url: /windows/security/threat-protection/windows-security-baselines.md +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Application protection + linkLists: + - linkListType: overview + links: + - text: Security baselines + url: /windows/security/threat-protection/windows-security-baselines.md +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: User protection + linkLists: + - linkListType: overview + links: + - text: article (change link later) + url: /windows/security/threat-protection/windows-security-baselines.md +# Cards and links should be based on top customer tasks or top subjects +# Start card title with a verb + # Card (optional) + - title: Privacy controls + linkLists: + - linkListType: overview + links: + - text: Windows and Privacy Compliance + url: /windows/privacy/windows-10-and-privacy-compliance.md + From d2a171bcf97a391d5987bb71ceb511b1b26d96d1 Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 18:55:05 -0700 Subject: [PATCH 0164/1214] Update index.yml --- windows/security/index.yml | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index ebdbef87cd..df688f1247 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -56,12 +56,13 @@ landingContent: url: /windows/security/information-protection/index.md - linkListType: concept links: - - text: Secure the Windows boot process + - text: System security url: /windows/security/information-protection/secure-the-windows-10-boot-process.md - - text: Configure S/MIME for Windows 10 - url: /windows/security/identity-protection/configure-s-mime.md - - text: Encrypted hard drive + - text: Encryption and data protection url: /windows/security/information-protection/encrypted-hard-drive.md + - text: Network security + url: /windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md + # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) From c78dfba57f50f6021aeb825c791664a3db05749f Mon Sep 17 00:00:00 2001 From: denisebmsft <18405051+denisebmsft@users.noreply.github.comgit> Date: Wed, 1 Sep 2021 18:56:49 -0700 Subject: [PATCH 0165/1214] Update index.yml --- windows/security/index.yml | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/windows/security/index.yml b/windows/security/index.yml index df688f1247..1dcca94f77 100644 --- a/windows/security/index.yml +++ b/windows/security/index.yml @@ -62,7 +62,6 @@ landingContent: url: /windows/security/information-protection/encrypted-hard-drive.md - text: Network security url: /windows/security/threat-protection/windows-firewall/windows-firewall-with-advanced-security.md - # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb # Card (optional) @@ -70,7 +69,7 @@ landingContent: linkLists: - linkListType: overview links: - - text: Security baselines + - text: Security baselines (more to follow) url: /windows/security/threat-protection/windows-security-baselines.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb @@ -79,7 +78,7 @@ landingContent: linkLists: - linkListType: overview links: - - text: Security baselines + - text: article (change link later, add more) url: /windows/security/threat-protection/windows-security-baselines.md # Cards and links should be based on top customer tasks or top subjects # Start card title with a verb From 1599a3b2dad42fe8ac6b5cb7b9dc59848abb0f6e Mon Sep 17 00:00:00 2001 From: nimishasatapathy <75668234+nimishasatapathy@users.noreply.github.com> Date: Thu, 2 Sep 2021 09:37:51 +0530 Subject: [PATCH 0166/1214] Updated --- .../mdm/policy-csp-admx-datacollection.md | 22 +- .../mdm/policy-csp-admx-desktop.md | 640 +++++++++++------- .../mdm/policy-csp-admx-deviceinstallation.md | 176 +++-- .../mdm/policy-csp-admx-devicesetup.md | 44 +- .../mdm/policy-csp-admx-digitallocker.md | 44 +- ...policy-csp-admx-distributedlinktracking.md | 22 +- .../mdm/policy-csp-admx-dnsclient.md | 240 ++++--- 7 files changed, 755 insertions(+), 433 deletions(-) diff --git a/windows/client-management/mdm/policy-csp-admx-datacollection.md b/windows/client-management/mdm/policy-csp-admx-datacollection.md index c2de3fdc86..e86a85cc6a 100644 --- a/windows/client-management/mdm/policy-csp-admx-datacollection.md +++ b/windows/client-management/mdm/policy-csp-admx-datacollection.md @@ -36,28 +36,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -74,7 +80,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. +This policy setting defines the identifier used to uniquely associate this device’s telemetry data as belonging to a given organization. If your organization is participating in a program that requires this device to be identified as belonging to your organization then use this setting to provide that identification. The value for this setting will be provided by Microsoft as part of the onboarding process for the program. diff --git a/windows/client-management/mdm/policy-csp-admx-desktop.md b/windows/client-management/mdm/policy-csp-admx-desktop.md index 4baa5a5da4..4fb236ccc9 100644 --- a/windows/client-management/mdm/policy-csp-admx-desktop.md +++ b/windows/client-management/mdm/policy-csp-admx-desktop.md @@ -120,28 +120,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -158,7 +164,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results. +Displays the filter bar above the results of an Active Directory search. The filter bar consists of buttons for applying additional filters to search results. If you enable this setting, the filter bar appears when the Active Directory Find dialog box opens, but users can hide it. @@ -191,28 +197,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -229,7 +241,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Hides the Active Directory folder in Network Locations. +Hides the Active Directory folder in Network Locations. The Active Directory folder displays Active Directory objects in a browse window. @@ -264,28 +276,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -302,7 +320,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This setting affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. +Specifies the maximum number of objects the system displays in response to a command to browse or search Active Directory. This setting affects all browse displays associated with Active Directory, such as those in Local Users and Groups, Active Directory Users and Computers, and dialog boxes used to set permissions for user or group objects in Active Directory. If you enable this setting, you can use the "Number of objects returned" box to limit returns from an Active Directory search. @@ -335,28 +353,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -373,7 +397,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Enables Active Desktop and prevents users from disabling it. +Enables Active Desktop and prevents users from disabling it. This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. @@ -407,28 +431,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -445,7 +475,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Disables Active Desktop and prevents users from enabling it. +Disables Active Desktop and prevents users from enabling it. This setting prevents users from trying to enable or disable Active Desktop while a policy controls it. @@ -479,28 +509,33 @@ ADMX Info: - - + + + - + + - + + - + + - - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck mark
    YesYes
    Educationcross markNoNo
    @@ -517,7 +552,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration. +Prevents the user from enabling or disabling Active Desktop or changing the Active Desktop configuration. This is a comprehensive setting that locks down the configuration you establish by using other policies in this folder. This setting removes the Web tab from Display in Control Panel. As a result, users cannot enable or disable Active Desktop. If Active Desktop is already enabled, users cannot add, remove, or edit Web content or disable, lock, or synchronize Active Desktop components. @@ -546,28 +581,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -584,7 +625,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations. +Removes icons, shortcuts, and other default and user-defined items from the desktop, including Briefcase, Recycle Bin, Computer, and Network Locations. Removing icons and shortcuts does not prevent the user from using another method to start the programs or opening the items they represent. @@ -615,28 +656,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -653,7 +700,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from using the Desktop Cleanup Wizard. +Prevents users from using the Desktop Cleanup Wizard. If you enable this setting, the Desktop Cleanup wizard does not automatically run on a users workstation every 60 days. The user will also not be able to access the Desktop Cleanup Wizard. @@ -687,28 +734,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -725,7 +778,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar. +Removes the Internet Explorer icon from the desktop and from the Quick Launch bar on the taskbar. This setting does not prevent the user from starting Internet Explorer by using other methods. @@ -754,28 +807,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -792,7 +851,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment. +This setting hides Computer from the desktop and from the new Start menu. It also hides links to Computer in the Web view of all Explorer windows, and it hides Computer in the Explorer folder tree pane. If the user navigates into Computer via the "Up" button while this setting is enabled, they view an empty Computer folder. This setting allows administrators to restrict their users from seeing Computer in the shell namespace, allowing them to present their users with a simpler desktop environment. If you enable this setting, Computer is hidden on the desktop, the new Start menu, the Explorer folder tree pane, and the Explorer Web views. If the user manages to navigate to Computer, the folder will be empty. @@ -828,29 +887,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross mark
    NoNo
    @@ -866,7 +930,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the My Documents icon. +Removes most occurrences of the My Documents icon. This setting removes the My Documents icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. @@ -902,28 +966,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -940,7 +1010,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes the Network Locations icon from the desktop. +Removes the Network Locations icon from the desktop. This setting only affects the desktop icon. It does not prevent users from connecting to the network or browsing for shared computers on the network. @@ -972,28 +1042,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1010,7 +1086,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This setting hides Properties on the context menu for Computer. +This setting hides Properties on the context menu for Computer. If you enable this setting, the Properties option will not be present when the user right-clicks My Computer or clicks Computer and then goes to the File menu. Likewise, Alt-Enter does nothing when Computer is selected. @@ -1041,28 +1117,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1079,7 +1161,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon. +This policy setting hides the Properties menu command on the shortcut menu for the My Documents icon. If you enable this policy setting, the Properties menu command will not be displayed when the user does any of the following: @@ -1114,28 +1196,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1152,7 +1240,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Remote shared folders are not added to Network Locations whenever you open a document in the shared folder. +Remote shared folders are not added to Network Locations whenever you open a document in the shared folder. If you disable this setting or do not configure it, when you open a document in a remote shared folder, the system adds a connection to the shared folder to Network Locations. @@ -1183,28 +1271,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1221,7 +1315,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes most occurrences of the Recycle Bin icon. +Removes most occurrences of the Recycle Bin icon. This setting removes the Recycle Bin icon from the desktop, from File Explorer, from programs that use the File Explorer windows, and from the standard Open dialog box. @@ -1255,28 +1349,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1293,7 +1393,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes the Properties option from the Recycle Bin context menu. +Removes the Properties option from the Recycle Bin context menu. If you enable this setting, the Properties option will not be present when the user right-clicks on Recycle Bin or opens Recycle Bin and then clicks File. Likewise, Alt-Enter does nothing when Recycle Bin is selected. @@ -1324,28 +1424,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markNoNo
    Educationcross markNoNo
    @@ -1362,7 +1468,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from saving certain changes to the desktop. +Prevents users from saving certain changes to the desktop. If you enable this setting, users can change the desktop, but some changes, such as the position of open windows or the size and position of the taskbar, are not saved when users log off. However, shortcuts placed on the desktop are always saved. @@ -1391,28 +1497,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1429,7 +1541,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse. +Prevents windows from being minimized or restored when the active window is shaken back and forth with the mouse. If you enable this policy, application windows will not be minimized or restored when the active window is shaken back and forth with the mouse. @@ -1460,28 +1572,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1498,7 +1616,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Specifies the desktop background ("wallpaper") displayed on all users' desktops. +Specifies the desktop background ("wallpaper") displayed on all users' desktops. This setting lets you specify the wallpaper on users' desktops and prevents users from changing the image or its presentation. The wallpaper you specify can be stored in a bitmap (*.bmp) or JPEG (*.jpg) file. @@ -1536,28 +1654,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1574,7 +1698,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from adding Web content to their Active Desktop. +Prevents users from adding Web content to their Active Desktop. This setting removes the "New" button from Web tab in Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. This setting does not remove existing Web content from their Active Desktop, or prevent users from removing existing Web content. @@ -1605,28 +1729,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1643,7 +1773,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from removing Web content from their Active Desktop. +Prevents users from removing Web content from their Active Desktop. In Active Desktop, you can add items to the desktop but close them so they are not displayed. @@ -1677,28 +1807,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1715,7 +1851,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from deleting Web content from their Active Desktop. +Prevents users from deleting Web content from their Active Desktop. This setting removes the Delete button from the Web tab in Display in Control Panel. As a result, users can temporarily remove, but not delete, Web content from their Active Desktop. @@ -1748,28 +1884,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1786,7 +1928,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from changing the properties of Web content items on their Active Desktop. +Prevents users from changing the properties of Web content items on their Active Desktop. This setting disables the Properties button on the Web tab in Display in Control Panel. Also, it removes the Properties item from the menu for each item on the Active Desktop. As a result, users cannot change the properties of an item, such as its synchronization schedule, password, or display characteristics. @@ -1815,28 +1957,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1853,7 +2001,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Removes Active Desktop content and prevents users from adding Active Desktop content. +Removes Active Desktop content and prevents users from adding Active Desktop content. This setting removes all Active Desktop items from the desktop. It also removes the Web tab from Display in Control Panel. As a result, users cannot add Web pages or pictures from the Internet or an intranet to the desktop. @@ -1885,28 +2033,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1923,7 +2077,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Adds and deletes specified Web content items. +Adds and deletes specified Web content items. You can use the "Add" box in this setting to add particular Web-based items or shortcuts to users' desktops. Users can close or delete the items (if settings allow), but the items are added again each time the setting is refreshed. @@ -1960,28 +2114,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -1998,7 +2158,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from manipulating desktop toolbars. +Prevents users from manipulating desktop toolbars. If you enable this setting, users cannot add or remove toolbars from the desktop. Also, users cannot drag toolbars on to or off of docked toolbars. @@ -2035,28 +2195,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -2073,7 +2239,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars. +Prevents users from adjusting the length of desktop toolbars. Also, users cannot reposition items or toolbars on docked toolbars. This setting does not prevent users from adding or removing toolbars on the desktop. @@ -2107,28 +2273,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -2145,7 +2317,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the Browse button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper". +Permits only bitmap images for wallpaper. This setting limits the desktop background ("wallpaper") to bitmap (.bmp) files. If users select files with other image formats, such as JPEG, GIF, PNG, or HTML, through the Browse button on the Desktop tab, the wallpaper does not load. Files that are autoconverted to a .bmp format, such as JPEG, GIF, and PNG, can be set as Wallpaper by right-clicking the image and selecting "Set as Wallpaper". Also, see the "Desktop Wallpaper" and the "Prevent changing wallpaper" (in User Configuration\Administrative Templates\Control Panel\Display) settings. diff --git a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md index 470b11eb3f..9be53d2bcc 100644 --- a/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md +++ b/windows/client-management/mdm/policy-csp-admx-deviceinstallation.md @@ -57,28 +57,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markNoNo
    Educationcross markNoNo
    @@ -95,7 +101,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. +This policy setting allows you to determine whether members of the Administrators group can install and update the drivers for any device, regardless of other policy settings. If you enable this policy setting, members of the Administrators group can use the Add Hardware wizard or the Update Driver wizard to install and update the drivers for any device. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of the specified devices from a remote desktop client to the remote desktop server. @@ -126,28 +132,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -164,7 +176,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation. +This policy setting allows you to display a custom message to users in a notification when a device installation is attempted and a policy setting prevents the installation. If you enable this policy setting, Windows displays the text you type in the Detail Text box when a policy setting prevents device installation. @@ -195,28 +207,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -233,7 +251,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation. +This policy setting allows you to display a custom message title in a notification when a device installation is attempted and a policy setting prevents the installation. If you enable this policy setting, Windows displays the text you type in the Main Text box as the title text of a notification when a policy setting prevents device installation. @@ -264,28 +282,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -302,7 +326,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. +This policy setting allows you to configure the number of seconds Windows waits for a device installation task to complete. If you enable this policy setting, Windows waits for the number of seconds you specify before terminating the installation. @@ -333,28 +357,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -371,7 +401,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies. +This policy setting establishes the amount of time (in seconds) that the system will wait to reboot in order to enforce a change in device installation restriction policies. If you enable this policy setting, set the amount of seconds you want the system to wait until a reboot. @@ -404,28 +434,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -442,7 +478,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device. +This policy setting allows you to prevent Windows from installing removable devices. A device is considered removable when the driver for the device to which it is connected indicates that the device is removable. For example, a Universal Serial Bus (USB) device is reported to be removable by the drivers for the USB hub to which the device is connected. This policy setting takes precedence over any other policy setting that allows Windows to install a device. If you enable this policy setting, Windows is prevented from installing removable devices and existing removable devices cannot have their drivers updated. If you enable this policy setting on a remote desktop server, the policy setting affects redirection of removable devices from a remote desktop client to the remote desktop server. @@ -472,28 +508,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -510,7 +552,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. +This policy setting allows you to prevent Windows from creating a system restore point during device activity that would normally prompt Windows to create a system restore point. Windows normally creates restore points for certain driver activity, such as the installation of an unsigned driver. A system restore point enables you to more easily restore your system to its state before the activity. If you enable this policy setting, Windows does not create a system restore point when one would normally be created. @@ -541,28 +583,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -579,7 +627,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system. +This policy setting specifies a list of device setup class GUIDs describing device drivers that non-administrator members of the built-in Users group may install on the system. If you enable this policy setting, members of the Users group may install new drivers for the specified device setup classes. The drivers must be signed according to Windows Driver Signing Policy, or be signed by publishers already in the TrustedPublisher store. diff --git a/windows/client-management/mdm/policy-csp-admx-devicesetup.md b/windows/client-management/mdm/policy-csp-admx-devicesetup.md index 8816d46b2e..83ee93d63c 100644 --- a/windows/client-management/mdm/policy-csp-admx-devicesetup.md +++ b/windows/client-management/mdm/policy-csp-admx-devicesetup.md @@ -39,28 +39,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -77,7 +83,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to turn off "Found New Hardware" balloons during device installation. +This policy setting allows you to turn off "Found New Hardware" balloons during device installation. If you enable this policy setting, "Found New Hardware" balloons do not appear while a device is being installed. @@ -108,28 +114,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -146,7 +158,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting allows you to specify the order in which Windows searches source locations for device drivers. +This policy setting allows you to specify the order in which Windows searches source locations for device drivers. If you enable this policy setting, you can select whether Windows searches for drivers on Windows Update unconditionally, only if necessary, or not at all. diff --git a/windows/client-management/mdm/policy-csp-admx-digitallocker.md b/windows/client-management/mdm/policy-csp-admx-digitallocker.md index b41032d0f8..62334a7178 100644 --- a/windows/client-management/mdm/policy-csp-admx-digitallocker.md +++ b/windows/client-management/mdm/policy-csp-admx-digitallocker.md @@ -39,28 +39,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -77,7 +83,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Digital Locker can run. +This policy setting specifies whether Digital Locker can run. Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker. @@ -110,28 +116,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?Editionwindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -148,7 +160,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether Digital Locker can run. +This policy setting specifies whether Digital Locker can run. Digital Locker is a dedicated download manager associated with Windows Marketplace and a feature of Windows that can be used to manage and download products acquired and stored in the user's Windows Marketplace Digital Locker. diff --git a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md index 1151c3fbae..a15f2e874e 100644 --- a/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md +++ b/windows/client-management/mdm/policy-csp-admx-distributedlinktracking.md @@ -36,28 +36,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -74,7 +80,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. +This policy specifies that Distributed Link Tracking clients in this domain may use the Distributed Link Tracking (DLT) server, which runs on domain controllers. The DLT client enables programs to track linked files that are moved within an NTFS volume, to another NTFS volume on the same computer, or to an NTFS volume on another computer. The DLT client can more reliably track links when allowed to use the DLT server. This policy should not be set unless the DLT server is running on all domain controllers in the domain. diff --git a/windows/client-management/mdm/policy-csp-admx-dnsclient.md b/windows/client-management/mdm/policy-csp-admx-dnsclient.md index 6d020b3a32..fe4bf81f52 100644 --- a/windows/client-management/mdm/policy-csp-admx-dnsclient.md +++ b/windows/client-management/mdm/policy-csp-admx-dnsclient.md @@ -99,28 +99,34 @@ manager: dansimp - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -137,7 +143,7 @@ manager: dansimp -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names. +This policy setting specifies that NetBIOS over TCP/IP (NetBT) queries are issued for fully qualified domain names. If you enable this policy setting, NetBT queries will be issued for multi-label and fully qualified domain names, such as "www.example.com" in addition to single-label names. @@ -167,28 +173,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -205,7 +217,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. +This policy setting specifies that computers may attach suffixes to an unqualified multi-label name before sending subsequent DNS queries if the original name query fails. A name containing dots, but not dot-terminated, is called an unqualified multi-label name, for example "server.corp" is an unqualified multi-label name. The name "server.corp.contoso.com." is an example of a fully qualified name because it contains a terminating dot. @@ -244,28 +256,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -282,7 +300,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP. To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. +This policy setting specifies a connection-specific DNS suffix. This policy setting supersedes local connection-specific DNS suffixes, and those configured using DHCP. To use this policy setting, click Enabled, and then enter a string value representing the DNS suffix. If you enable this policy setting, the DNS suffix that you enter will be applied to all network connections used by computers that receive this policy setting. @@ -313,28 +331,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -351,7 +375,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process. +This policy setting specifies if the devolution level that DNS clients will use if they perform primary DNS suffix devolution during the name resolution process. With devolution, a DNS client creates queries by appending a single-label, unqualified domain name with the parent suffix of the primary DNS suffix name, and the parent of that suffix, and so on, stopping if the name is successfully resolved or at a level determined by devolution settings. Devolution can be used when a user or application submits a query for a single-label domain name. @@ -400,28 +424,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -438,7 +468,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured. +This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to Punycode when the computer is on non-domain networks with no WINS servers configured. If this policy setting is enabled, IDNs are not converted to Punycode. @@ -469,28 +499,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -507,7 +543,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string. +This policy setting specifies whether the DNS client should convert internationalized domain names (IDNs) to the Nameprep form, a canonical Unicode representation of the string. If this policy setting is enabled, IDNs are converted to the Nameprep form. @@ -538,28 +574,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -576,7 +618,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. +This policy setting defines the DNS servers to which a computer sends queries when it attempts to resolve names. This policy setting supersedes the list of DNS servers configured locally and those configured using DHCP. To use this policy setting, click Enabled, and then enter a space-delimited list of IP addresses in the available field. To use this policy setting, you must enter at least one IP address. @@ -609,28 +651,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -647,7 +695,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). +This policy setting specifies that responses from link local name resolution protocols received over a network interface that is higher in the binding order are preferred over DNS responses from network interfaces lower in the binding order. Examples of link local name resolution protocols include link local multicast name resolution (LLMNR) and NetBIOS over TCP/IP (NetBT). If you enable this policy setting, responses from link local protocols will be preferred over DNS responses if the local responses are from a network with a higher binding order. @@ -682,28 +730,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -720,7 +774,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution. +This policy setting specifies the primary DNS suffix used by computers in DNS name registration and DNS name resolution. To use this policy setting, click Enabled and enter the entire primary DNS suffix you want to assign. For example: microsoft.com. @@ -757,28 +811,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    @@ -795,7 +855,7 @@ ADMX Info: -Available in the latest Windows 10 Insider Preview Build. This policy setting specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. +This policy setting specifies if a computer performing dynamic DNS registration will register A and PTR resource records with a concatenation of its computer name and a connection-specific DNS suffix, in addition to registering these records with a concatenation of its computer name and the primary DNS suffix. By default, a DNS client performing dynamic DNS registration registers A and PTR resource records with a concatenation of its computer name and the primary DNS suffix. For example, a computer name of mycomputer and a primary DNS suffix of microsoft.com will be registered as: mycomputer.microsoft.com. @@ -831,28 +891,34 @@ ADMX Info: - - + + + - + + - + + - + + - + + - + +
    Windows EditionSupported?EditionWindows 10Windows 11
    Homecross markNoNo
    Procross markNoNo
    Businesscross markNoNo
    Enterprisecheck markYesYes
    Educationcross markNoNo
    From 4466a082bca38c76ae91d2796cb2b4f025139fd3 Mon Sep 17 00:00:00 2001 From: Alekhya Jupudi Date: Thu, 2 Sep 2021 11:46:05 +0530 Subject: [PATCH 0167/1214] Task - 5358645: Clean-up work Clean -up work and minor updates to improve acrolinx score. --- .../event-id-explanations.md | 2 +- .../event-tag-explanations.md | 2 +- ...ion-control-events-centrally-using-advanced-hunting.md | 2 +- ...nder-application-control-with-dynamic-code-security.md | 8 ++++---- 4 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md index f8b093734a..a87cd17fec 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-id-explanations.md @@ -1,5 +1,5 @@ --- -title: Understanding Application Control event IDs (Windows 10) +title: Understanding Application Control event IDs (Windows) description: Learn what different Windows Defender Application Control event IDs signify. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb diff --git a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md index 9eb35220b5..f5d7d82e37 100644 --- a/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md +++ b/windows/security/threat-protection/windows-defender-application-control/event-tag-explanations.md @@ -1,5 +1,5 @@ --- -title: Understanding Application Control event tags (Windows 10) +title: Understanding Application Control event tags (Windows) description: Learn what different Windows Defender Application Control event tags signify. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb diff --git a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md index ed001ad80e..134acc8d1f 100644 --- a/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md +++ b/windows/security/threat-protection/windows-defender-application-control/querying-application-control-events-centrally-using-advanced-hunting.md @@ -1,5 +1,5 @@ --- -title: Query Application Control events with Advanced Hunting (Windows 10) +title: Query Application Control events with Advanced Hunting (Windows) description: Learn how to query Windows Defender Application Control events across your entire organization by using Advanced Hunting. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb diff --git a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md index 9670e64011..f1f66a910c 100644 --- a/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md +++ b/windows/security/threat-protection/windows-defender-application-control/use-windows-defender-application-control-with-dynamic-code-security.md @@ -1,5 +1,5 @@ --- -title: Windows Defender Application Control and .NET Hardening (Windows 10) +title: Windows Defender Application Control and .NET Hardening (Windows) description: Dynamic Code Security is an application control feature that can verify code loaded by .NET at runtime. keywords: security, malware ms.assetid: 8d6e0474-c475-411b-b095-1c61adb2bdbb @@ -21,14 +21,14 @@ ms.technology: mde # Windows Defender Application Control and .NET hardening Historically, Windows Defender Application Control (WDAC) has restricted the set of applications, libraries, and scripts that are allowed to run to those approved by an organization. -Security researchers have found that some .NET applications may be used to circumvent those controls by using .NET’s capabilities to load libraries from external sources or generate new code on the fly. -Beginning with Windows 10, version 1803, WDAC features a new capability, called *Dynamic Code Security* to verify code loaded by .NET at runtime. +Security researchers have found that some .NET applications may be used to circumvent those controls by using .NET’s capabilities to load libraries from external sources or generate new code on the fly. +Beginning with Windows 10, version 1803, or Windows 11, WDAC features a new capability, called *Dynamic Code Security* to verify code loaded by .NET at runtime. When the Dynamic Code Security option is enabled, WDAC policy is applied to libraries that .NET loads from external sources. Additionally, it detects tampering in code generated to disk by .NET and blocks loading code that has been tampered with. Dynamic Code Security is not enabled by default because existing policies may not account for externally loaded libraries. -Additionally, a small number of .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, are not currently supported with Dynamic Code Security enabled. +Additionally, a few .NET loading features, including loading unsigned assemblies built with System.Reflection.Emit, are not currently supported with Dynamic Code Security enabled. Microsoft recommends testing Dynamic Code Security in audit mode before enforcing it to discover whether any new libraries should be included in the policy. To enable Dynamic Code Security, add the following option to the `` section of your policy: From f4d31b487e0f58220b1f916837dc8dddad1479b2 Mon Sep 17 00:00:00 2001 From: Lovina Saldanha Date: Thu, 2 Sep 2021 14:44:14 +0530 Subject: [PATCH 0168/1214] update-5388078 updated per task 5388078 - Windows 11 update --- .../administrative-tools-in-windows-10.md | 9 +++++---- .../advanced-troubleshooting-boot-problems.md | 3 +-- windows/client-management/connect-to-remote-aadj-pc.md | 1 + 3 files changed, 7 insertions(+), 6 deletions(-) diff --git a/windows/client-management/administrative-tools-in-windows-10.md b/windows/client-management/administrative-tools-in-windows-10.md index 6da0fdfdb9..6f70ffdfb5 100644 --- a/windows/client-management/administrative-tools-in-windows-10.md +++ b/windows/client-management/administrative-tools-in-windows-10.md @@ -1,5 +1,5 @@ --- -title: Administrative Tools in Windows 10 (Windows 10) +title: Administrative Tools in Windows (Windows 10 and Windows 11) description: Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. ms.assetid: FDC63933-C94C-43CB-8373-629795926DC8 ms.reviewer: @@ -14,12 +14,13 @@ ms.date: 07/27/2017 ms.topic: article --- -# Administrative Tools in Windows 10 +# Administrative Tools in Windows **Applies to** -- Windows 10 +- Windows 10 +- Windows 11 Administrative Tools is a folder in Control Panel that contains tools for system administrators and advanced users. @@ -29,7 +30,7 @@ The tools in the folder might vary depending on which edition of Windows you are ![Screenshot of folder of admin tools.](images/admin-tools-folder.png) -These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows 10. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. +These tools were included in previous versions of Windows. The associated documentation for each tool should help you use these tools in Windows. The following list provides links to documentation for each tool. The tools are located within the folder C:\Windows\System32\ or its subfolders. diff --git a/windows/client-management/advanced-troubleshooting-boot-problems.md b/windows/client-management/advanced-troubleshooting-boot-problems.md index d039c10c17..493bf99dba 100644 --- a/windows/client-management/advanced-troubleshooting-boot-problems.md +++ b/windows/client-management/advanced-troubleshooting-boot-problems.md @@ -31,8 +31,7 @@ There are several reasons why a Windows-based computer may have problems during **1. PreBoot** -The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot -Manager. +The PC’s firmware initiates a Power-On Self Test (POST) and loads firmware settings. This pre-boot process ends when a valid system disk is detected. Firmware reads the master boot record (MBR), and then starts Windows Boot Manager. **2. Windows Boot Manager** diff --git a/windows/client-management/connect-to-remote-aadj-pc.md b/windows/client-management/connect-to-remote-aadj-pc.md index 4d8f35673e..a038b6738d 100644 --- a/windows/client-management/connect-to-remote-aadj-pc.md +++ b/windows/client-management/connect-to-remote-aadj-pc.md @@ -21,6 +21,7 @@ ms.topic: article **Applies to** - Windows 10 +- Windows 11 From its release, Windows 10 has supported remote connections to PCs joined to Active Directory. Starting in Windows 10, version 1607, you can also connect to a remote PC that is [joined to Azure Active Directory (Azure AD)](/azure/active-directory/devices/concept-azure-ad-join). Starting in Windows 10, version 1809, you can [use biometrics to authenticate to a remote desktop session](/windows/whats-new/whats-new-windows-10-version-1809#remote-desktop-with-biometrics). From c60aafb28fc21cd797c56d4c94963e36da77c33b Mon Sep 17 00:00:00 2001 From: jaimeo Date: Thu, 2 Sep 2021 09:29:14 -0700 Subject: [PATCH 0169/1214] removed section about FullSync --- .../update/update-compliance-configuration-manual.md | 9 --------- 1 file changed, 9 deletions(-) diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index e15c04a0eb..5ecec12475 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -80,12 +80,3 @@ To enable data sharing between devices, your network, and Microsoft's Diagnostic Many Windows and Microsoft services are required to ensure that not only the device can function, but Update Compliance can see device data. It is recommended that you allow all default services from the out-of-box experience to remain running. The [Update Compliance Configuration Script](update-compliance-configuration-script.md) checks whether the majority of these services are running or are allowed to run automatically. -## Run a full Census sync - -Census is a service that runs on a regular schedule on Windows devices. A number of key device attributes, like what operating system edition is installed on the device, are included in the Census payload. However, to save network load and system resources, data that tends to be more static (like edition) is sent approximately once per week rather than on every daily run. Because of this behavior, these attributes can take longer to appear in Update Compliance unless you start a full Census sync. The Update Compliance Configuration Script will do a full sync. - -A full Census sync adds a new registry value to Census's path. When this registry value is added, Census's configuration is overridden to force a full sync. For Census to work normally, this registry value should be enabled, Census should be started manually, and then the registry value should be disabled. Follow these steps: - -1. For every device you are manually configuring for Update Compliance and do not plan to use the [Update Compliance Configuration Script](update-compliance-configuration-script.md), add or modify the registry key located at **HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Census** to include a new **DWORD value** named **FullSync** and set to **1**. -2. Run Devicecensus.exe with administrator privileges on every device. Devicecensus.exe is in the System32 folder. No additional run parameters are required. -3. After Devicecensus.exe has run, the **FullSync** registry value can be removed or set to **0**. From 8988f10714a3ec18b8f2453bbafb79b72f74d3a2 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Thu, 2 Sep 2021 09:33:43 -0700 Subject: [PATCH 0170/1214] removing stray bookmark --- .../deployment/update/update-compliance-configuration-manual.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index 5ecec12475..dcb6a6b2fe 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -27,7 +27,7 @@ The requirements are separated into different categories: 1. Ensuring the [**required policies**](#required-policies) for Update Compliance are correctly configured. 2. Devices in every network topography must send data to the [**required endpoints**](#required-endpoints) for Update Compliance. For example, devices in both main and satellite offices, which might have different network configurations must be able to reach the endpoints. 3. Ensure [**Required Windows services**](#required-services) are running or are scheduled to run. It is recommended all Microsoft and Windows services are set to their out-of-box defaults to ensure proper functionality. -4. [**Run a full Census sync**](#run-a-full-census-sync) on new devices to ensure that all necessary data points are collected. + ## Required policies From ad7d3b6a0ac37674265933fb4a6f3e7096b5fbbe Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Thu, 2 Sep 2021 11:03:14 -0700 Subject: [PATCH 0171/1214] add link to server article --- windows/deployment/planning/windows-11-removed-features.md | 3 +++ windows/deployment/wds-boot-support.md | 1 + 2 files changed, 4 insertions(+) diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md index 447473ea86..12f618fbfe 100644 --- a/windows/deployment/planning/windows-11-removed-features.md +++ b/windows/deployment/planning/windows-11-removed-features.md @@ -28,3 +28,6 @@ The following features and functionalities have been removed from the installed | ----------- | --------------------- | ------ | | Windows Deployment Services (WDS) image deployment | End to end WDS deployment workflows that use **boot.wim** from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | +## Also see + +[Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022#features-were-no-longer-developing)
    \ No newline at end of file diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index 82ad38d20c..b484c3dc45 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -107,6 +107,7 @@ If you currently use WDS with **boot.wim** from installation media for end-to-en ## Also see +[Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022#features-were-no-longer-developing)
    [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
    [Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md)
    [Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022) \ No newline at end of file From f97bbc28f8e619901d2be7985665fd0041d6ee54 Mon Sep 17 00:00:00 2001 From: Daniel Simpson Date: Thu, 2 Sep 2021 12:39:35 -0700 Subject: [PATCH 0172/1214] adding additional hw links --- windows/security/TOC.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/security/TOC.yml b/windows/security/TOC.yml index 9228a4398d..be0bcbec13 100644 --- a/windows/security/TOC.yml +++ b/windows/security/TOC.yml @@ -33,6 +33,10 @@ href: information-protection/tpm/switch-pcr-banks-on-tpm-2-0-devices.md - name: TPM recommendations href: information-protection/tpm/tpm-recommendations.md + - name: Hardware-based root of trust + href: threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md + - name: System Guard Secure Launch and SMM protection + href: threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md - name: Protect derived domain credentials with Windows Defender Credential Guard href: identity-protection/credential-guard/credential-guard.md - name: Kernel DMA Protection From 78ed63d27374f5c2b0080aa2bfa5fd0f7a6d7bed Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Thu, 2 Sep 2021 21:44:36 -0400 Subject: [PATCH 0173/1214] adding articles --- windows/configuration/TOC.yml | 6 + ...min-center-custom-oma-uri-start-layout.png | Bin 0 -> 54535 bytes .../start-menu-layout.png | Bin 0 -> 112528 bytes ...supported-csp-start-menu-layout-windows.md | 67 +++++++ .../use-json-customize-start-menu-windows.md | 178 ++++++++++++++++++ 5 files changed, 251 insertions(+) create mode 100644 windows/configuration/images/use-json-customize-start-menu-windows/endpoint-manager-admin-center-custom-oma-uri-start-layout.png create mode 100644 windows/configuration/images/use-json-customize-start-menu-windows/start-menu-layout.png create mode 100644 windows/configuration/supported-csp-start-menu-layout-windows.md create mode 100644 windows/configuration/use-json-customize-start-menu-windows.md diff --git a/windows/configuration/TOC.yml b/windows/configuration/TOC.yml index f44d4cea07..2ce55a2aa9 100644 --- a/windows/configuration/TOC.yml +++ b/windows/configuration/TOC.yml @@ -2,6 +2,12 @@ href: index.yml - name: Customize the appearance items: + - name: Windows 11 + items: + - name: Start layout + href: use-json-customize-start-menu-windows.md + - name: Supported Start layout CSPs + href: supported-csp-start-menu-layout-windows.md - name: Windows 10 Start and taskbar items: - name: Start layout and taskbar diff --git a/windows/configuration/images/use-json-customize-start-menu-windows/endpoint-manager-admin-center-custom-oma-uri-start-layout.png b/windows/configuration/images/use-json-customize-start-menu-windows/endpoint-manager-admin-center-custom-oma-uri-start-layout.png new file mode 100644 index 0000000000000000000000000000000000000000..56c6da08d16aba08aaa3f9f137e29089cf5453e2 GIT binary patch literal 54535 zcmeFZbyQU0+xIIWNJ|LPT~g8_B}fh3-6=y!H;5o1Js=$_-Q6*S(jhS*E!_-_FbtfH zzjrHf1$W*%1b}09HZI=en7XAQjvP}s3sog*5WbnGuC?r1NTRdNSPo0 zpnx=)jvqam&H~9uY5SNSEMW!^Z_;8MV}^V;*WmoDsqrS6`HN1twj6ma`@k}r{}2%y z9i9L1a-Mqn=f@$JJd}pyHlzmFBq87FzG#GN*W4pIe6=6~PE(Hy#LOgXT7*-FH;LS? z7Dc&Dl2K&-eZscS%@`g&-|cA7hzK7(iG3gb^MCogbpH+z+T$wx=Lp6Bqf_j;={|*r zfA^}$VAE(%YsI5Eh=tzY8A)dN@E5AZn-(tOQ@_rqrT^EOdWN5-`tWgDy~H_}d8lJ@(Jzz^{weDpIxBg)qOHsmJoW+zF|!eu-rJcNudN36_F}hQ{wY zJK>|Hjxr@0tVQBT|Er^2cE!jJ|6u9(qowypiy|h{|2kukT^4onVt=+Kctt|o=J4;y z)0vOICyHFmMsoOtZ-m@uI6d~J$wl1SE4N=J8aB_>*{zOci?)VEK71fbpV9Npf{{8G z>AYvBr;}G7B=2vDF+)QyNYbCNsXr}HN{#FM!iAuJ?X?%yuo4uVA?UE%qKtZV(4Ee2 zcTV!32B%sRC=k#}$f*CJfd$L8UvFjpt(l)?#mufP|<=v&Fj zSitP?2C|PhSng0#lM=+?FmA4Hg>PMk=7vJ5T6geBp;&aR;qla zT>*X;LnDa2J(i=Q{RiTJ0}5t0kXw4)kXI!+UFk%5VR!{!nRS;Cxfc(JggVWvS2V3m zUL7PA#%XE^+nibp*e~jLu%7uR*|W#*&nxcFB4o|tLC(aiF?z%G+w%<$@0QE$&)eP1 zh7J;sjjNog%Qhe8$wVFfH~L-I2*$*6l-14gH z)B$&pZzOMjkWX4#dfLHrZ<-Kl()@KOH`y%q*t^TpJX+5z@YyHq^p8bcbGn+*vn5vY z^-fb1D*@}#b#}qA%iO1Wg$2gT-uHJ%?K%ac#*oYD-Kl2E;Q`;%79)Id?yD-}8cEI7 zf@rb|Zc^iNAFROmhcTJ+I4(S&l`u}G79&4TKCW0}ZzSJ0J1Hrt_5Sv3+(@u43C)vy zguc-bOQ~D#)iI60z)?thI;YFl2>Fxat665(BnMuVbTO=zAVdXs4gANrq*c!ktmYu( z1i~+inK1-F+EH`guMRMf`@R0CA2r9FW=zswit51-=(caoM8h z$)0Dg`N^xh-2@tuh^zH@$-7@#mnO~cQP%t7x(^qcJhA?)t$hSK+G=#(rN(AoXvD1g zspsB|PCS=ME7KSqGgETl`hIjQrSKjRaeTZ4U(bNYExeygAG(U^LqHQ_+~Q`jvfRPD zrQ%$qmaDnY8?aDgCE6EDS(edj5T~zK=x89|G>^MGRW!>SuaJ->W^d_nm@$wFH@T4D zY|@#s9gX>u0UEaeUkbVQpx<81nzf=2WHCpdTz6CzeWelgKPu1hlliz1MJ%~rBENx@ zk(1kFCtmQi`GZCN;p4xjBwq6=pOqYVN{^Yyzo_1{rx^%U@dJZb7zYpU=eT6QShG+P z-5IjgQ#Vusn8B#SvG31z?Q&PMy_dT=s@lH~h2v4iRmsIk&y*WnWYr{jB9GeS1?9>4 zth;{kL|E)iSLrA~LcPdyZj;m~EKeW>;2*KcEP)?ey>_Vr_h*}UW-1McslBYJGX-7Z zu!vda@t!rgEcL9(MwfrIPGV7sy)gT}9I@HBw{nleso&i7q8tO0wkt=x?IIZz1!2}v z=M(i^lZl~#md#emnkAK(cYmB9Yy7g6BS~AQ>k9K|BprcgiM8 zL$UVYRH<1Em%Z1e#&vu-Sln^2*drzM?Ld12cs7o3ixcDoL62jVlEb*&Ey_K@2q5ArzMol>srsCW-!$I#F#K&{Qqb0fINR!_f4y@fMH6jx>JmaY(@{g20aB3BD zV(*SGnM&s8a)F;mldxL`5V-BLKeY1uG`#^T1RZ~P?CLUOHhoSAnCVBMq>S|j*mchj zl?S9ejiuzQ2TvJHKj)=qqvsE&^6awHH4)C_=V}=9*^a#9wZ)mQT3g7UR=r1Un1YiAC zEMr#ocAU4r~0C%l{L+iHJ<@jm>tM;xIL$8 zbKqMB(`O~Qt`4um(pH`o;ucd#0tzEl$?CtSThGymLZ0KHpy>7nqOrq?z+w)kvQ`@S z4DY(XTA_tOery3@5x=u5Pd{Y3T>($o*t&z}j_m#-1CnX{w9&V2OV^^``5Uw+JmMf_%WZ3) z&*0JsGOioh z>`Hu2)+R=`@=F$X`HNzolE(2Dsg?0z$!yJwF9az~5`ZcbnS)33b2Y)>nSXI`yjsBO zzyat}KGS0+dp^&dKT_g0r6*ysPkw!WHXSQ^ABGy(BcnZ~pu zDB2{y#R4S9>QyIiCnO5lq{?<0vXCs~KIM(klG=0*yP(0iXFP=p|p$_^23X z>-k#y)mgCgn1G?r_$f8!X}MI4t5f zB=BDPOR3Ib91$D+s9Up33(aI@wkRwRON=Oz6Qq*t`}h5B1WCZ353Ssg1UKKTe>cE| zg(q(tFUrLHnhsP~LM>X+t5Bj@F#QKLuG)LzcW(qi2?aHOOPpG4M*PQ+-|fD{h5{}a zP&ibN`rbx=&qS_zZ!Qm$l-u|#YKDzdv^cX;iuP#Vi1n|KasP{+NWxy%gWtT1?Y>&n zzs56#$*4u^^^m?f)1NFqIhJAM3RIUa%{6)R2q6&i5wFST+kDSRb&+3EuK#}ZEYtma z)aIhILhoxv6jP{{8IFG_THIwnQ|xM`Q)d?+BgC3FmY&Kr`}VchL2)ZjDF1I~%DKDi z({%7I)5ziP8u8cW8S-t656iIKFpwY+Q^k#p(1TJECyA&N^5H|S(Kx|F-To7n@!&A3 zlRE_5h=4xu)Y=0|T34!5W`O6-m2bZ?kZATTg)m2=QukS)UvS)?KWJ1|5{Bi4hHeEg6fjF0H0MqV^U;VFWbm?~w=FE6)&)-d#8Oe842~`;N_S>;DFw(*}VdVxmCaoR~ zU=}+ixorMf5>TWdv=a9ZUEo(o1EFhv;q@eQ?Vcw^4^#g9AaOqTM;If&uXAao)N7xY z`Y`-7W+2Q=2iw{amwFw|lLxwL&*50ewf){F5Vo zlLL|lHbhYHS3aAeJ@%yD2>jJOov8-*k&QorJE>-ttKVfyNq+_$^I-nv8(K)KS%2wp z>F61vBMl$Qn_BJ8U^sJKn}T{ zP%}ERAzk;3L#Ky;QrKd?e)ssi-0_*Q&BB+n;;4ZPi=b`ac~A@vB-#Z^2R!^OKd(X!E@|t%&x|oGHDzU4L-28h6;!42so5EvO zi8}O4oL5~H9v z-+hvLf#NeAM$%bCjr@%Fa0=Ip_s@7tjZ-t~otIwAI>d(o`%9P2;lE#%2#jDz7!4Mi z<{9AvN+UX^o}S(_R7VhAl-P=p7?%6{$THHO#=T5u?e}+x7sa61$t1cEHSh@0UUw)a zxMKy75dN3Up{DupO_W#|zGqu7X5PW|PuS0TfXG<;YYmg2WQ|~KQla-`mBL3g$NX^6 zz&;cR^GXW`O`rNxG5uO7LbxX@3t%Rl|?ZNyHdGLCOx2^PdQh^Tp^ z>iPu8_sUoTG`Rzz`Nl(GV%#e5kt(M-lJV1q{F3|*I)^q1huKP4PPd1}(4hM5mTct_e>@dk+BdE}7)wZ#B{!-?GELwc zAQPNYvBM_|qF zz*@0|uhvx}dFN_C_(D|?sQAQyY&h|1!;`bAqCDR59@re@tK!4zRkL6J+~H@Dny0e< zG%{PP!FZASFs9iWd^u4-_~C~a6N#a=B0h~&=29O&Ouv4{sjsfGV1=)pB1kwnqMBnT zqW%#bv&5hVmw#}geOT;s_H_8bAKWs%DpfayL_=zWLJ>9tA+2bq%pbaDKTk^BGI2Y0KH{;e%uf7c(FrnFtenR&h?~xc6m*y= zhJu)-Kp8!t;+F)&Tn#Tzmp8->!^IaI)Wo^tgsMn1iJ9U3#-e?9@(-PzoB>1xB9r-} zRJQrS>W<%j)Nb{gjwW!Cm#CtCX^{ldfSctf?s)P6Yh@vcbmo=fQL$k!ca?0&M<9ye z&zuo>sV`qlXx!&BL2fIs&mt`S8mxD zH95z6AERQ?YFaU&yamTIIi?}Xelwm8x*vREJ9{nSr@~|q&N*!Q6>??0FwQQtwK`Hj z$}Zv{Ka#gLSj$WzQDQOTG$>TlB(Zf&L3wRlumVvyvJH8-8<|0RP+)>#1Gpf=Fz|Xa zl^3j*PY@eZYde=HDWqv-Svi{cftb>rSZrAJzR^Wl;a(_b;`h8gd$(*iK;1_UzBH&_&6`pdY z_=a8Mdsv3NK8A$vqS(uiVrHmWzUSf#`y|ZCoNA4UVccgo12=<>$xh~jmq<_-wZJ>| z_HXGALwpCMKxXsnDheV4^g4-Bb3GNyzvytsJ~5wyi9u;gLSgbY?%$dAKR(D{v8X&L zNYAkeW@Jxd37%Bel&ko+Zun8uL{T%RwXkR7Dq55PVvwWZzp!$q=6MJW;R{O%6nVgf$g z8qIt+)!LA8Wlu^@7*dA$5e7IwpLc<)L+`gn-z^r?&y<_S5_~583B;YeUW>0hc778A zJH9SvH~Zn$N^t)j5;5&CQ)xm;8+^-a>bJ`raB1LQZd!){I4zAi{7yHAJ&$oIFKs?g zCoi@6lhxUcO22vYfg2=o+A^@sn5%VjzU#?OsIkcOJa$nNE6Lk;7m}}(Lcuggk8w1Y zS2T%_B~t@?4r&oom63U)txY22e2bDN7b_Erk!y|&r+xV@L3nSbA_5GPklP+JdFeZ( zO~PfUEXlYjBeU3NChYuYRM>qNVmEwo{GRHykNV@84btmzNx8p^@t6b$xg^XCepw@{ zJM-D<_1xDD+$ybrAS1HAeq@RroyyqO~Tik83lc zPg>P;y#v$hgh#+I`=_S_NCZ_QT0ceWWB$|BCxOEdjp<#^YfvuDqGScsvX8Kf_!HZ~8uSfDzYykawXSyWMFVNtq-Phgq z_OI)7rH+<(zj6xWzQscR;%#fn8O>`C1@Zgo5-t5!>nOv@O?R88Q6lcPd4{kTU}~H9 zs0&xrnf!KR=6^n*fYZ0OX>joy{q846s#jU@rq{P-zl`sm?`rYpw0XnT_IT@l&jjuz zvjaIN=zZA?rz?2P^1Ugw^@I4cxAj;%u(f3!QiKydzGa;a<&KA@t z?Zlr~LGM1t_SJ4;Y6P9PW8!H``kY$5<4(2lIGP3_zb+^q#IYH5qq6b(JbE#bQ>dhD zZ3w7^KnA{q^uKz4`U8uE!;oaI4qB?T?ltZ+_Se;l*YfXs5)NG|Ga$nsOe*?wxY%;C z`HLP%8-ik1cB096*2=0nrN^>Fc%5(2&v)j~q(VZ{UIw)rnr@AxPqeAIobN8^jq(KB zji*0&d8PJ7wa`S{kU+#`H>FGaH`Cya0gV^NxPl*ND;AnAvZBsbf;IG8J)%x>mirnH zMPK@zKNkaRm=~Pq@L4i{FSuN;M4>0=_G-v#Z@9&SJcE!jB3f+q-v69xI`o;>svmG$ zb_a4LCGVR3V0%dD=@7@?N&OtoHreQufi&K{(oM?apJYCFpSEF$gB=kx8{KB+8`lFJtI+K6JvFm5sxSIw%mST z=k|L>iW>t1--S|3kht;1wQK$5yWtetnm~k?a;5~exc>#;B`s~wdR}}?==>^pqXkx` zOAbXy?zgA_Zl&BADc7%ZU-x8g6N=FcL3!5o556mRfv6o{8b zlE*lSYCBn-`CnXK3ZbgvAI#M)fP>$;EZK;ruxUs)Pz@%r#v6J8eoG>=66uAHqiT*= z$>n$wi<(@4Vh*@N627$X#69q2RCwjjbV-t*D#F?%|I5%5Mk=Gqrtdxn^o zZ3{jGf(|fgz_^-j9c;`lMx!PyaBdsp(rNlD76(i~W;!epcV@mRY{#^p|aI_D*gYNB}{~~MKLCfC-Ssmh2#YV^04Z^7q&&i$;bWSodGI1NX z*(VWAE-SiZHD6d(QiREAOjNN=I|D%D)LNS_bks{d>^nyez5NF^We zMC~WSxXSLb95T5eK~(7NDUPNklO%&;kcouxXKdev9~2N8J7C42NMQ2O<_&6(PGt-E z8BMl&Sz&aOm_~(6Y`p5-NoG$1OPKpNPS(Fws`7fnP$J5(nhZ0z5Uypi01ZV&4m=U) z>$YER_jSFQwuepc+OKUSW9@1dhfAUAIyR6^maAt3EVO;$+^yXH3{u69qZY*k|tkjU63*QiaGtK6_f`Z3^WXIlQDbAe&^>KgCosMngsIT)M> zPPiuv@ECX4a)rk~4_S#hUMROG2B-zi3pK{?(>#p{=gqx|3YQ%{(L9}iANl&v;#{46 zle0-oT@)5FQ58RG2}sE_ZZ{k|i|lNuBxycow|Vs$MQ>P-oV7cR7#70Ge#PL96RJMo(|meo6BnA~A#_i|=&_ z%gUv5Wo4zGGlI#HgxgpjFQFQI0d7B*w&gUee>sEGh(k^fh}^TKhNQVR!xMRSYJzD} zHI_dU=6r$_Ax?}712ZtmJHRos@ZlgwJQ*C+YI%8l`xr-iWrMcKQ3JUI1mxzFkQ|v; zMC@+!oWXafay$0nI%T?j&vlMm?-W@3ACk5;y>=g0?FwBLyvJM>C~M&PWDzA&Snj+2 zxI^9yE2U;g;l$*@P=_|VNd}(;o1r!yEpke2hOt=j-2woF0J;;8i6w(dD|53+&ATzy z@g$rg#rJMu^^pnP#Ep(iMDP!CmjfTrQ;>Dik&g18fbAZ{6;zPcW^AQ}7;RGX=`%8#LOi*kL8Q8Pks* z^;SjfYclvz=!fTrWJZf$zGu>8q62BQVc<~|6WZzqoZ*>z1ZhY@ZY3vOL3`3GxcRj%mcu zk+Eo-xk1>Pq4?+U6|>m)!v2?3KzKU~rpryH!$gE)_~y-S=aw0A7(~e8kd+duQ3^St z1088?-7#U+*K;u{4EvjEE_oI6{Cvji5*C5np_>^&a#>Ue^NuH?= z#G`2<9CH$O20SH%#!W|}4dR=g8-g1dN?R5yQ9HW~^!5Q2dGX>@Q63s6f~4`G#yZB8 zAg0+GpKF^b)p3ZnH;-xk6Zh>gsfEVFX>uug*dYMn^#W@g%ma|$r#;!MCFp0rCeVtu zsFxehDg?>cr?0Q%WTQvZsGZeGbU2LW2CbtKY6`)S+ZStXBt7xoLk_))j z=s`T#NoOLXPIWkTygrc^d>7(zWYz(GR;pd``5K3`6ws6y{4T2r0NzX1iWc}mvFtbI ze{>+WkpGMR^LY!9C5~2nz7_!!d=g`>X;5N}@WCn}sd%3)_FLrQ$y?w{3dn2Kk^(ai z)~ULsC?X>VhGr(ZU!A;VV}K*elzn0~9DM$!S9fN)}J zABgFGx42{S*$(_sSFj`&1>_1AL3vz2v`bDIkWjgFs*QI?e?U`ZlWaZz9iAEJ9Gxg! z|L>Sp|LE7`kIpNdv9dVZdB`FsUh8AJ+YK+ zsg(MZP<$z8?gNwLM()+#r$k0*&r0xpg;J9I|0ejb9kzO$F!*`EKdVwp^q#EKw+a+; z83k#d4c?A_48FU@T=~o0KanRt(JreLaO>)MOZM#3J?pz@!iameWgL3p24xRQcJout#+8vW#_tIl0 z)#vVd+ta@1)@v0t91lSRMP6od^Cmjg`i)XNNJjZ;xu(FBEeQOCP1XnCz18m9_%gDx zyOSG?4X4msHwEy-i3YT_RUkVM_nvnX7o&>6r&0cbk^soZ@7)oPzKC)32A{EHNd~K?O0?ZY z-O3BrF*1BFlD}ES2$bx`KUj(9(5w6k+#fI4qSks4)!W-U>vbS@e;m!*>(k9d_C!I! z5*T1R#Q{X>SKCp;0RU*>21F%4Bne5R8x8F)dp`&|Mz`Mb7@Ji3I(~?ei3y!d`mIL2 zzN_^}n#TC!XBmJ_5bL%nc08%Xv#a?BpcK2@atripeF!^E+At*V;K9v*7hHTqy`38* z2`7W?4|X(~{VqxkFa3Z`jmxal`@}Gg3QXgl&$7Rh*sK34SR#eT=repaFyaAI#$OkC zppLf^pAwTaV*>m6PwbV=-_^?mfIK4Khf989TWRcbBrtJpK;o(R!UPq zI)RYOe59!NQSl+`Fa!#3Ka0!I!;t&k8A$n=j3)$;ql)<~f=qU|t#kAm7rs9}i}mC% zcU*v_iMwMsFSipS=TFlI8VzcFzWJ@#spj@kimbf6bf_xsAKehy??jTi+m7qzCT7tE zAY*5BpbN+Qv#Tc)^7hV>YBKiGd5C5b>U{dLnzJ&aCK}Z&v5@Fg8qa|**N2 ziP3A|j85PFti87<{9a2eBcAEqUxh?>|!UYD6k z2`G-=GI+_@*9y0ifMk7HGk$>)TEU?g5Sq?kxL%NICb!LP0&`znQj(2t^}4?c9LW{! ze?qNvvh067QQ@!Vu{*Ewi8Z$%y2cMS^c?L-;cKS21B}@2^j71Xlpof1<-kul-z8H-=o46iCD5?{2S8`e9{zuCDN9@facL zk;v6vjdFe02F{iav%f$b@9{J)vN`q>4p}kF2g$>wXn-EwlRrrM#UHfzY9oM=wJ$dJ zgGFz6$pwYL`wxD!>9N#iaEXow#vhittF-RA8w&d_t5n8ckYa7pA5ZDfPzj)m8g_J0 zs@Lc^G1;Yu_KR*MOJr-wL5*;)m$K`rZ_D<9& zU`bDZz`4fR=>KKWtMSc}nS@Ih7v?biqk7d07~uDREkbikR};I|F1s;b>{tg2wq>X} zrwD2^Uf!J(dpWLz+m0GNhax-FC!ffjW`zUG^LpMXIH#*i{6Pz$ahYnQ{+!D8Z7a#% zceyfKR2#~w1R(RW6^0EOMb6?4V%Ho^b%1IbO%|+$_$d7edp+CxwB$k7VufB`8VmJ& z%OXkIisJJLZSP#%2r8Mhfh;PkfrEkXjQaQ(haMn+N|l`u@J^kD?slgQmQ_}0P4IG~ zQ#1t$&;`MD0FxnT>Eba#yAcfJz>5H!jc6{V(m7==Md!JOdL z$K}Q?(p-7(CM?<1zka0%QJ7yG4gf^9&z|ZS_G{IEKv?GaD+DHMTYOY8u?k@jxl))*mB*T@B z*~wZo&mQDQ;`a8K74?|)!o9ttp8e6g>x@&8cC-9Q!g=oX<)yY}YQm7*_=v9u5wvSu zne(s76X8gP_{%048GEVEm`o)zshM+~9sV%#Zh}}^!{Kb5%Y!+c4jxWC0|y7H!t+crb#;a9Q=YrZHzK%Xo-b_2)zBs(6E}m5 z2F~5bnVps*BQ-Ng2owsb7r2_Aiz>PzZ#-eCMRFJM6_vT#wKA@pW{t|(H4xf^A)V5% z+PjlG%N3Nb>s{gj`P(o%B>4lAQ{5RfRkDwuk&7%O z_}xwh7y#sh19Nk8rE-0XnDRG=znAk};?GYKJH>(Rske5s^L^mdvrr6tnX(kF2NA4; zgt%o(GXOyA1J9qx#QAUs9-Ix$$@tR)^rb{)3_3Lx~Eg-foeZshnfO(gC8&^?TWxKFn~Kv$(~v_&j8h4rTAYbtNJck zR0c*w>9GWX-Jvg%(98n12Lta+1IBGBb;<~%XlHIbt=<_6D>-P;YnqvyWHpuFZd$#z zmS5#bQ4Dz^Aj*N|UE27GC(%z7_0zy>-N&*r_M`iKfG>hnn=YWYeu=8&d)k@TGai4B zQw@&evfilgT53y#FL~>@iz{hny1=idHMd3#wDD$uk}cOYI|KrIu4`kdKdJyWFWG2xx2P?-gFncRD%5*uwbGn;df;W@+$@nZ}a{ zQ3^K08BaUUfYBQ$b>R@}@P`(w*k#L)7;y#fH4FZSR9xYQ+^Z-r=CoyN&b97pW-;a0qXx{`7^pC`@0wm+AD>+*jUQo zNE&*cmVwqee385TDyTVtkFaf;4wcrG3!Ft)IR)4@Zy{7wHP5dZPas?e*yWFp?nj^V-YN;IO%;xQ zM_>+u@&Phc=WKY#1F*$3XK8EYGuZShHGu*tvc8zzsXuidQ523+&XfIe;dEqtZdr$7 zn4tv4_T+1br1043i&)J`L|uivqzyK4WC6*4S~IE$LGEf^1TzMiB-Ezlm_Q z>XQkUbC@mfn{OzyqE3&G+_C?%f%9{S4%>}T91Hujx7~LNAP9M>akj?$F=+!n0JhN& zz(y?1Me#I4jWZ5rJ5WrcXxP4zyi*@HY4@qw<6)AV2Q-`Rd(_*+yO#646Y(~0O36Nl z=?13Hl%g0wW~33e5n;?d%{rXiDdBd~)!;B&njPig^W{R+b5A=adQQHL7fX@QyHc#;zmMZa?-|Pbo!W;7>ThXM7Q|RPuYo#?)J|{mp!D;$f zZncgEs@>9$HNL(<5v)3Ah42^E*^X(33f+=j&<3@=M**t&`uJ#R1+D+e(+1{y?QC6C z2Xv;R3zM^Ss4lgZ8lV$uxGC;^vOJ@N8f@Vt8$wXL@>|Xmdm~`*+|5sxo5E&>1OqPL zvlJknPui#oF-q;H8Y@~0bJB0+6rB)2$r=o$9T&>QI-GCNC{9#vJ?92F`qgbd6;;X@ zp)=K5YcpITMQBaa@~2dQbph&9l_8HBAvRNZSX3%m-Xd8%U5`$=3fgLDA1JGC!n5we zXi)%mz?A6Dw2BU!fy=~SjQcIYD?tZBmt2z>-`qA!0ggIamiIjrrINF9o6PB+V5y7Dz-udd!*axTExZD8 zhb<3fgx_b18jAnuFTWmZHYf5hi`y`ee*F(jrGONx`4|I$ z22nZR0W|4zpO=KTjbGD|}|)D;7bte5&f$yXf4e*+H| zTSDm{)KA>GqQOp;OV_wRpDY2hYUqEH&p@MzVRX>G&TWK#B{XA!(1mG^et;rY3zr|1$*3CV=v7Pjihtyg~QS@HxL1RaSPL#0>m$YRh>;#Z!qJAWHzLDN2V! z&k$)ocjse6%vs&?40P=LW z5FGBgQt=iD-+Ap%t#O~fdODif^aemav?Hshhkh50=J3z%%>YD^_4v{EyNqEL<*fXf zDX%*S^U?*R92u|{c0zL}Ge;mf&8!ZvQv+w=c(idJKVg&iW4r&F^~wIbT*Ww9q!vFe z;Sdj#W2;*%WS5oR`1Tfa)u5%;&xyWY-0U14kt5#9xTcD3SnpVZstA_|RB!X5wn9k8 zoRH^-b&2~Y0NUg_9aQv%cJYU`pV4Jb3=49NiN1kJJ(r@KxfXyb^V06pvHfb<|G7OC z=HT{Xqm$@^nsYbR4}{puKMxG*o<4p0wJ>Q4c<(_dkjY!@PBORt==^<$9E9fLQ_oxd zt+w!y&|>k}UseeWs-@n%;y9HWiZBv6S^{3r@ItpVU!rWN?~22$Ga&w=4JnXlF5srb zth~Hgp!7i8fl6;TV*b?IPbEyjo`pu>YTQ2`qL3VN(5;e--Wsh2N)6lS*-AuFl!#=k zBa8q|=s+li-R!m>)LFhoi>z7i`vy5FSZ?*iY4tq(2gC*?5X`xkvXJ9 z;X&7%xI?K`kD3T1xR5O9=n0k;^JD_IQ6P6zQ~6V0x~=U*sV zcrc0ss|v(?PrrKXPU<#&myM=ZN+E-pxf?_gF;5#fE?k?$212<+x{@w9^u~I@$c^h- zDqqv3){6&b48WUA0wp(MuBT+;95()LbzGgUFL|%%*tm)D|Mq{%ZPFU{DVo#@VCdxZ z55J-+4yRODB5@&^0R%nw*n0go|0;A;f*My=0qCpDi4Go^aAmGtc3E?i<$r!q0+uoj zy0*D!SFl3nhaYyM^{bMwhTSea!NQXIaoDW(VgYf*x>_6z?Hst3wtXhUqLyANA$)x+ zfjr>HrPzoC3a?9n7nDq!BkdjgXWiR#)>gh0Ws6Xmv=M)vVTR5WfKu~6Fq!2ingxEk zy*{%7inNPqUtdSi313IlxK7z#tiL)K<~h9k#cIQ9?f_SlTottP1&VmI&3qOzGLvnu z^LQkmoZgXf8|Qlw-DL{zw@`V%JNI$C1fxri$Gi6R>wOtCOHVm{YsFH`2iPmBLH%6g z)2+?TT}vG#A43V~#KerpFCqn+=82o-sk5M$^A4>7hlxmCAVXb4_I&b;8f=4iM4a}a z%w6rz{G4YR40x~C8Q^PT>2`Hwa(gpe#isc~1t{15X*#Ot_?d+LBTz@S7DM=Tv+K^D zUdkN6c=sL|^|S|!7l?dIj;9tj?Wh8t@@@+)j{%weUdkjVw0H8w*5b8$sqQb+cdAZ~ z_sGE;9@BOOWE;7lpTII-oM(QYA5j2)N-wToz&_{D|Kot?)Vii zAyVnm8TCK`Z&nZE3m5Toh&q#C*E?g$prkftjFpx^`|6WZsYNxv0P&VrqaAqjLyJc` z-yTzD)^39*pb1b(22thYWsBsvDh!?NK$)FdjCx=Gj2| zwpr_)Ew?`NH+y>Bq&`jG%ELfEXyC!Kn4mp4UD16t<1va7G)YK9z0YscA{iiP5Y zjVITgITC@`XqdQ>M-H|}mJCpXl#!KT05e+!iaozKH3Y<+n(zf*aW%zXi>E=yFFO~u zJQHlQPmLIxc;&j13=Ps}Pn-Ie&px#vA~xH%;0r+MTeZg^(ZwCnq&QPSf%Pk*hw2xv zoub^2>Un;6ZL0&yoj#g*9_KrR#;raYsToYb^aFLGr*fNU+p%WX*?#h8_tx1z&lkNM zy1BnPmTWH%enrIae+S$ag>+;PweYBXzdBrS&~c!HW?~XxFkUUVFb1Pc!LzawQ*C+v zL%Rm*Xl=RC(3Hk^o!Sh4C*b@)$a~AEx|(m@GdM|*01=!JEChE579_X?ch}(V8~5N4 zEJ$$o;O_1&L4sRww_BU{ob&H{?&V{^9vQjdWZexdN-U{JT^5O%wmoC zs(i|7X9AE&E;MP)q^!jMr5YSqQ-mlQ@frbC0SXeaRm!J%yQ3N|(EGp3-7sRQK3pRHhkPj+oK$gAwKx|ZZkn!n zdQF|3CzUAf*V)9I=403H27ho0`=#D%xusRL+jcobdzlWUa2ITpE%0nyyoJE%-BiEC z#}A?Ha@_Db;$-N$#LtmP_J%SX8t*&5iQ?@`HCbYgEe_qWR+%rQsRn2HlY3AC)<+cV znC)(@Pu2D4gtNJ<=<9vXvsXWi_^i-pk z$3k`nQcF&+BC)z=HJv|8c2h7MOhz75Gh0S`z8#MHu|OwNo@p|vCvEodnp`TeFtL3O zYu-`$`gPw)xgn&N-T1(_Sfg%vq}4}}PjqUsiucF*wWvob5YY%)qF+^OHuJ$LP<>US zvfbUFS>;^(P?!3B-8D|;X6?$RKX!kVLEmhbwmXUOPM3PVH+JI1a5B?8@`8ED!LR%oF1?j${eCxvNPEW6{&HJ=#jhJESo~LhhY9Rv$e2I8JOvh;w zngz!CO!kzwAO7aWQc>vZb4RJlyj^0$G0V{H6zgK}hzg(y951#NpQPalC&3RAY@P>J z1?&ea&9dvU&MuJoMrNnWTOl(iGoX08_WV5o#K6ep{+wGvK;Nz37DghA-o2oDQ zBUxP35uSP^cFvWt4ox*sx(ZH1L3!t0^)31jw z>y}kaSihfq)TV_Ri4c=kpOE88M6|X-fqbP&(c5rQqHu6VE~vPTHJL2dv#&b)uB84Y z_Y3i4w${18Sdz%lm;P44(ex?K>9~*=6eR|tXi3tk96pF$UIqIq>Krc$6zZ#vZahZv zMdicrOA4ZW&e`X9g-vENiF_XnAGVk_ZA$6JZM4tkOgZEeXl7Y4rKSq+rr0A0^Gqlb z*)084DhyRw+%0x`zvro`77d>-Y>d!TrxJZ;Ilj)S%nPrh)HySpBn{tSiUN}CMSdrek997!RwBR9LQ|2rWb<<% zGp$Hmnmm(SW2u@oUu9=Z>n=Q2qhyh;S|YweJv_V=@%xb(bstjR5aV#XBQ-EPPdfzU zxNVUlv+P?xJO0A^hUm~G%RX0Q{vGj2aqMy>YK~%lXE5g7!*b@G(KKx`gYohwmP_B^ z^7S2wh<#ps;aA4vVrOho+WIN6rSgK(SQuG`N0TvYgVEFMA`VIvwfdS@cX2mkz4HsC zLhehJcu3e|N*z_P8P*y8J1Cn#2s6>Zui0HSTg`0kPPr?dpDhaOy|C7F8eZl|Pj#n5 zEjsv#c6IspqU#IGrUY@nUwCZyV`PD6@agzZIG`iF092uAu<2KCRbV%PD7wgmR+r?U z$mMKDxzVsFpYp2f0 zx@y@Gqm!AeLMC*BcTD=EbtD1dxlLoSH`Z6w)Hf3eqBQX+M>J`R7(vb@jFxUo2fh)W zc2{Et0S`3D!cFb6^KS(P=rqd(QJI>jk+BvReJ08@+}5~z4qAZoXtcrzeX?2PdSd3} zT+NbVYni*)K5qCR-I{vSxab?cR$p_n(%vm+oPFPSsyA(+&KAn27m>q5Rf$$jbN3lTSsQvI9Z2-KQuzS*J^_52M|}b8Dcw zD2|F_BCYEPdrU${u#=gP8WL!f2bf+v0qXLNo+luo6DSG@ zh}lMzu)95q_(ltCa2|aNaqE+guPx_r;WMtWlSt!r@1C?S|{lDVJ%%VNbe!gx22KD0mG0ab6U{uhs=b358I%E?4fUF$e?tmo&2!Qpr+?HarIqVxBv}$_X<*MUdcZ<78IRe^L3?u;2G3?E*j1WT^@IR zZ(sCql}8R51@4IsNPTi>8bguZppmPKQ8WQ~xG$-t1 zkRzw4Y-gR;owYq;+w~$h>kT(+ay!VcupdJ=NiMT^TEqx+Q*#`ua_{aC1Vwrn?4OV| z&wu{*O3r|P$fUpZhnx^a0WMm<8ow#$n&-RzZz}R0Ph6WXF8->f@;NwnBE->Zg;lD= zC3SwU=qzc%eTY~KJ0E68&!8_xrt-}(cg!yH+&LiMrJP?+1T{D>F@$~YgDU1e zPPmYfEt>Lk8@bVq8HpSmHX}ri9F#^Zc~yt%(QKz+;9U(u*)y7U4qa?rWeMuGxz?-X zJ4;Ss?5db#g6g~Xtw=<!$NI4%tkA#;T zkF`)ZPuBXN1G55)UQ1-8yl(M$3OM6l{UjB6I!oDyo+zL7!xH!y->Fq8g?RXuN^R-whjQ<#*Hl%!&$nXd%llB;aHF6;bz$^(V?ggcYQNG43;$J}Hcmt-iXPR#6wVUsr`zJqvtQ zr)zp_S9enN!r^~}^A=k)45h|1KoYHAC@~MUP~I$rc3sb~PDVl!YfF@-;Lm5R;vhrU#9BD8%tF&VaT!%ZfvqGJIlj5=C+(G1nd}ghk-4p<`T*y zO{@>!jx5u9Za(ARSHGBcR8HLObsX00$H}XVQPrImCgUe9kWU3Bv>dL<8h4 zCN42S0YxQL%~HINTskH5di9s_EaOmVbbPYstxxQz7O;q6uZE;A=+_8apY~v!vGE*- z3%G}53WS1Nc>_`_>QE57cY>*rls%c!XGB;wILddfIMhygvLW z>39^5Po(JZNA03K$yP5*5@}42aqO4|pU~*iX?NeoaYvlR%qwYyej!m3`$jHqqaj<{;LX)!(;2*V zrcr6~U11R7wq~36)r_itSG?E$mx=rXdtFezbMr`pirlL(tUmmxzdSWZGhi>1ZRbBh zZv}XkQ1o2B(>J0PfJmypih6h4&;DaNflQy`t&w#YK1ZQH6Z7eQ08Pt^`YVNl(5FHR4Asi*=RVob3F!b~A zn}n@3(KwrR4J7P@6eZ1mZ?*Erxp~DAsQ?%>1sEmxWF)bJiQK~Wq;aFafr~?&rD$jR z;dz7B8iaeA#D@6z^S3x)!`5JMzh$pPV}!Q_-tAoC%2n4?o6;B1dDFuqb#2}Iv4@71 z@!3)wD8OU+%4U%GAolu6t?%6e{qRVcUXJobf+&X4pcp@yz1lp9Kx+S&Ih!OM&1`&Z zF$xcy+5w4Jns$kP>p)-oe)CsasUL}v+HIaR0X>JCA-oHR2myl|dmSFqm<`4d;F;#@ zVV#`F{b?kR$#{7E=LSuDYkR7Q6L@hgd?U3cZV1oU>D909f~^bLVL`$;l&3h_nbTn_ z7jY%Z^huFQqnO{@+A!I;VvUu9W)*WLj=+PNG7=t%mJ2Z+IF9outgY4V(Dq*?&0Wpt z5B6J2scy8G>`g4Ny1+~^xr}*iDbltIWO7z3ZI(UTiE@KfB_t;U$!yY+uIR^#sj2V{ zgxoG|u7?rq;d;?Ng(WDP+=hGXzWymnyOaWR{af~!#pXA$qPERCU7NCF?5rskZba)9 z_q$zM*o=0@<&bGY-1)hvkiz(p(N}|{q@gADr)2>oWFK&RwVDYlwOem<$wTozzoJuQ z&W~~J&3!%i`WH8pxwa2!cJUc6HCQ)NG}cp6KeX-L~+)lbi!Cx1|TA+6m4^PATHqlnPT1v=XDQ1X~e?d{)!dsmT^FqavL^X zB*)o@Okd{<($g=`0R2D)_`vH(_apAot?3KT`^!Dt69J^yLk1+~19v9MGA6A9Ya6td znq+`rd@}3nQr$t5+(Rs#dd;D{N5J@TbMuUEK!9+i*(jF@Fj&?3`ho(p-7#g&Pr=VmPK{u(-ex&!b1a)>b*ph(mAM^5$+dTT<=U z*Ll{@H)CIpqYQ_@BvZKa%9gmhPI#bI(*-P&ba=f_=|-W>BNR9^l88oIb48qBXf6ie zVR1CIOq3VIYYUpj9|VPT51JaGReyU)(e2cC8TYa~BtDQH1pBO#NR-^j(Oyy15ON<0 z^@dBl1|)Q$$^6Mvz-NHcHCnMFwp2)9woevQ3uK%*f%k`8GO_C;vVbZnNeGQ<%?psR zE4X1)_D1oc^O5asJ$wGzNBPUnJ4p~r&iMkkS%JqwHV2bdb*D`|B8kC2u3iEw}hOun*}ii9px=E%?xK@$xu3&6ARyZPt| zXAU7>m&7)~Gf^{L;HeqS+z4C&4`&SX-vtQT(0OJ&Rv7m9*SNFQ9CLO_&~XEw|4krH zW=_YypeLgh`amO=tCE2TVw6m%6G~PJqyT|>OD5fkp+GGw_|-_-osn{-4H+oo=51zX z28RT;Ov1GSV2X^19niQJs#M_a&sFh(viazZA3*y20Zw3-VgSfkwuI8H->;L^B5vO=mujJr zG5xE64%iAN^=N?+`al9V9@N(_6o%`k(;kpvKJV~oqki)$Yop%rg4S?2(a+QK3Cn&U z*kyDont8=y-lu`P+xiMp=cD?0pCUn0PFCz6H%sOC2aP&rz%#_wsJCwi_fxhKK=h@` zOa+CA2Za{_VY`;#0;mLheSP2laX6le&z!K4YfBqlEt@UCxaH#Q!XeU9Aonm(?L!Yu z_}K@%WWS&lyNF*_qq-=^goWq8MKC20p2E!l_7x~Q&!nlxgw5(8}+(yt9)p4yH)q)zua8hYue{iF@(G^l{1yW1`Z1nDrss zWcG+h9lcmJPTT3U2=~v>yFsm7rdrB;lBW?+M)G^-eUQ*6RsoJZZ6Uw_WBH(@Z*YHR zkiaghcM%Aa73$B+4f=Ac{@Oq(B|Aqm9aRfpSTe4=Crh11-*In}$gVQm_q~JyKm52< z0_G}B{(ur9yVdfOkKj0|skP|SkfY|{y_~>gbolwf-9%%Z{345*XZG3aPeHA4Uv$oy zftz?-mNp!^HQ_KB3OdB?A)}(QxWnl!t%x>H_N9D3JQ?mjnheC)xlnSKUUx1ZHw9Ro z>*Pfs@&Kw2_G^ZdgW?6Y=qvsEe=Ej}{A`L-)$D&gXnlF8Q+e`>^e&_6s*BBqN2Lkn ze);0=f*}^FM-ouQ0wN%}JE1pJiqw3AYt-$L)a?t5#AKPqpD@Q>Ys{slaym*$_9t}p z%8}#27!iT3Hv5`(^5j@{e=6?kGWU~gc_t_Dp%2SAqL zR@!@KDXgtjt-0fVr7|8ddi9xw25@@v_y7b*rdpHx*4#G&m_ZAcxLqOArc;G^*M(wB zlZv3Wv$TXk($r>J(wMzT@2=)?EsBto)pf7EnmyP9*cR@je>z>?=SK)g-1TB8aZP6GJ-{v?rqU_=+) zs?26jV?=>wo!+ArR=z|=;7ns@q4xO>o3ZEbddECm?62v>#N@8$drqsNNhXA~32`U7 zvDC_?RxmE-I|jZ#&=s6;=(T@7V-pS`Fg4RvE8a^g04`F%tK(m8pz^L>?Z!suZ8VtzOs7WJh}IF@62PYs@;kzyHd{ zZzsE5$)_r8*MDdgcIOn2p$?+%vaFje`cXZSZ$Q;>*!H}R)WK-@K3FMq>3}X|$>XG{ zWqw|byUOUo;!MeG_Bf-=V>VPKqdRxW#98BNKlaSt+IrL$_%c^@(L`<9sGI&_7aVz# z4&tsEo`ZFyV5lC7DJ9FU2nPw_4q$BAW0k4+-uwv$YKjJifE5ZODJAtLHgf7>J2QrQCZzaUa(&mFXdcVDk*5 zE!kJVB0O*5FjeG!RgKS~DGUxeh3;A!8cTwjdfXPm3yRI{$DFh*s=%R;o_mC6E-DoZ zB0)JIhz7=F5onu=uZWGHM&FGY24wP?z*A|mxpmx^QDHYWZ47Yq@obi~F6Vn`bKc=N z+^W2|ytCV)G-2wNdO(w9{JZWIE}KcNx2SF}V%%IZ(9ui;5JNQ>Ag%fn*iIBVwPz`t zBbjnQ4}iH9ahhphHpyGmyVP2_1Ul-G2Iq>cd#R0ifPBOtbl31}t6?{=SG)_Q7FCY2 z0rG{7+RYTGZm7(u7gHjU3kOsY{HibB1|aP?-xO6x(rSFO>_|;AY|{KE(pPhq&V?9>wT~CpZYS(L?@;W{$N}A zOhON-&?Q4eJr-K+l9YEn#4lMN84jKY$#8|GWT?Yvq4os01C1)NV#yt)q;SsEgGh(~ z$=X1EKh_u83Z)Y}iLWO?)OleFG>yP8fp1B&T$49qsL*$oVM&XQAUzm8H=I9D34CAV ze9(C71Rih5QX6O8+K~%*%9+CvnrBK;SY}m!e?ypa(SX++r;2!66s$GxU_`w~g0Lv) zbvvvkyXs|DyLQadQA7?mD@{M3G+zGs=3=o7*eS>;&p=6}SnB~RGBVQTnF+GW)At;< z8^28at;d`iLA#sJ(w)N&wfu=%F|4q%R);VwV#xz~9PB=`PzK!oe3dG<*5V1MO)8A@ z0#&`d3h0?3zdsvWq_+1rJ}7Vu_G?#_^{P<);1*QI)YjH^xKl7yxvtb!yyZ$s^{uRg z^4J~2zHQfg@XI1V_Oznod5p+G$)?bD2B7!EzpS!MMpCPT>b3I5k&(ZF4>SaaDO<1g z_Udxk2Oa7F&QGq1h_JgG-rZ4sSuXIMDn%?efd`Uk5=*`!ipU#rzRFm_Y#(j_IoWMV^IUd>Ctx*mSA~OE7oykdCQv6;|6egpAFVo&G z_g4}-i3C6#`5bhz@KLL_Tmg!xadGl@F30YPw)pFH%IMx$L>ym9n|HA&BwA`KHmx?L z;N5Tb*?`r$Z-!{VGbe`vm(?uOWU3QH%cULpWgHJGzq)+n@;5FOu9);eMX$dVARb|x{P{_0!X5**^+pZb{)x_J7?>%s0TRB zt#Nc(<*KaEIdkl~`0J~jle2S{2)m6PQQR6pV zy{_B~VirTKP<&`PL5NpaQ@psAcv>^+6T4N*lgeaLdV`@T94PzY1l+-(egGIMM`qJ0 z_2ehGARFTk;XqMxZ}!H}3T;^?7RV63i*e?}ZH_K!j1|x*F$SoMo(N(e7wW7Y69LPh5Kx%Me>8YT$m5nPu6GTZCCS{ankd&BhSEBJ6ciF%{zru!i2vp_ zJ=(rW4Bs&73KSCi-r#p=L!L!1nG6i2a2Wo3&2)J1>iU8eUp%hM4q8^JHZIfMu{0t7 zm!$VSn$hd@xN4##yuohI9ojl*=4)Mq9=A3NllHpkmrPGjmv=5^TM}gW-S8LCLjhg~&wh78DCke;7tl@(bgv?D_3 z3?7T}VyQgbTvSS3lcv*FI}?-|CYaVYtlsGG?Lc;`uC6X$lfY%bc)tHTpje|`=RB!4 zcXQp3qrylpAzZp)rBepT=7k^JA!Q&!0sR4#8l^bU(NTz4QTpR(uacD9~{9yhy*?Bx&ykUpDv-e??Fc9qvK!i zYgAlq5M<;}QRI>8_ZmAt;Ckdprs|x1ghNE@=mInqpilttwEqi^VesJDuJk!3a08v% z&DmQ}y4PKXrUXOT(>v$vKx!iUsSl`F-z((53?tVf0C24C97mZF{U<$BQD+}VcY}o7c$Q3?ecL!i(vX0&Y&azYEX?B6JMh^?_Sip6B z86j9}vktoSc>y*)a7&)6`9H)ilfv{#T;uL9RimG541OL?;U3Af)(e3KI*E25_udH( z%M4I??nTe>RE>;)dgC<`tyWX!X4NodLB)=xzGz!i3>Jor89#j`KgH!Ho_~<}j8-(r z0%!LJh#%<`Z=a4stVTY;j`XKGDzOf)xlOmMdp0L|pztNK)m zx+8BbnJpFs&(QmhRMA+Z-P|AU90lh>94I7DpjRZqKd|@p%TSqgvH5h{py^ z&^~s;35>dmqt*=RjVAA`i3RHs_+-&;MA*?CZ|I>5zXP4de6ggZrC)u@q@0JMZ;2T4 zfReS&ZvUCb!ywcbuUM??1vq4X1W0Z>D8OA~a~o2tFS%i9g<``T@cBg0sIi{zE=jZG zRh$lS9%zFS<@@cwVF^rzKTYF?u+P`ypgtUEuZ#kjQ|NXQ_})G$;?$t?C$tV9 z0@^eThx|K_Of3EomHUhNJ(6-+8TT=CblwT~7*8Da0s~Uh8(!D`ADd;PX%O}D31~Oe z+O?Y}#Y(rOX1~As^42-9gLbLy;FZPQr6I<=;dP#Jce3f?j|}{ODp!62N;m+mB_;*Ma(ZCd z>P%k(7PkCd^5Zq*n}Tf&`gz3IyO<;&ef2L-xqD%y@FvrScsw{w@Q4z5bR5mu3Absm z@8_Q<9=^Na_Qg1$2e4CRKg%sIOzv9=q#NNJY_Bw=Tg+Eh?~dNeEH+Q?1$yV)SxL)NI%MY-slGcLb~37K zYyQKEf7^$SSeDbj;oE%0>$*6Tnw_i6W-7J4vDm|xW763b5{wCcJZWZqUg<716o$W_ zil%%gr^w#Chhk(zq45bEO8>+5_=s{Vv&rLx3ovv_NYsC|?;{Xk)IwDkq>h~Zn$AB3 zug&Wa?vP*(agr-DRot0*j}rmLsECsw?_NUDhj5FBdpsm6aQqO@^y+pUIcTJU@@c{} z>2V=%_PM!daQ;E)oxNX!^{%^5A%!|FTy?1ta~qIl@(Wuho$D2nEpuF$=@((1!~H+aD*TY0cWxZP z#6W{Sq%0l`SNh5u`J}$-ml+g;?F$S95fpYDh}HYgo2gti-sCWE%x-EH^|7=lpcmvxHCMK^$V8`g;C$qUIo=HS~w>C=PdYjS+kd>ma=o z1ilZ#(;jb0DC7}EFz;H~da2=(lKHV>L^%!vd1%8=ryOD!&Ue%1@#pljD2wwl+3xhT z6VZFmSiLpt)u~Z}p`Bhpw0oSiV)owTmI5igR19^Js5Nnv2p2m=^rMc5xZ zDe4;6ei=AtD3K%Of9=$Mk%;7fJtS~Y=aOK5qy2Xdt;a)hFh-wv{>{6I8QexB7Cw$f zS{mVNZC#qYI9nk?N~)ysnp6Vk;NI1)qCl!Y2b62xJ6Z?ri{JNGx-32mo`yWeLlZeN zSQ9a;uHp&Y%V&91FRV~+SQ(r7%iP5_ za_3BKVJ}P&!C|fGKi=g286nH2i*dgfK=ef4O{@Bh)DPHSI(#U(X1n@}_F2#^EfOF_ z+n}fJyf8Wc%`sZ-L-Z|?o zEG&OWcwbS0i%fi(WMXARf{Af)`dj~xdM;vJ*lDZOgQ#(mGah32B*`S$`qH7VuuMKy ztpk&{nXqonA@}QIgk$DI&(jv?q@>@x-V{>p7xi#L13^BvGBt5>7$NJ3k>`Lr{~W~l97gW zcHcD%Ke`{UM{K!;=%!mX+qn-n*^<8$?Y_L+XDw1XwBWrA+xKeyF>uC8n>!1Ze07zu zA)1?3r4kR%aJEGBJ1h(PGqWm-BsQAijn_7v?)c9WR0#L|X@xygq^pJ}4q&QdzZ3a& zvmK}76KY?j`yn%K9I4e0dd-n(LgA3mx~OdOUJ6{9ej>$C$zH&a24~u4lAe`0GvdC*RA#;@Pd#fzX3>%kQGVmqr^l+R zDTmX+-@oDqv-;!brylB4=8XghYcyQD8#sN{z4vJX{TGL8{(T2@!35_qCp=%YrQmIQ zB0n@S2!Hk~0nW?iFLZ1m_>Xa_KC^!XHo5$J@*Lnl%x^y7V*U6lTn`nxyORz1%m>!s zcm*O?b(5t3dMxS(Vj3x+%b!w*2QU8MZ~>5OoX3bhM%$t>Y605%<&3PdqS!TdH-^OfV&SObQhxJpk{or z8Va|KN!aD!p4(5DLrT;`G3@vWf$roaOezSYZNkQY6ZKHom-btK0z#$aiFC!)IS-2P z;hgo>QsJ|{zSV2RsxJO-2esSW2}Bi*lHB=5;;$qq;3Rf4r{~YP)fhG|a=jh&?q0Y^ zzrn}?IVLcxgFkEE%!I|`sy>68w)gx&E9v^~#c?Rx98K7+C!@hA7`QQZUeP75Fy4svWfy@wkL11Z=n8ELWgOE+2WP zbjzkGVspC^Zp!-!dH=!;j}==L%n=r=RS|DxyNB#q1t@W| z`3|ZCdd^ghw~r$qKJ`))M_=Q}>yNQY`iP16vLGbfW+&Z9d1_$Ri>mtQlQdQq;^RFc z*0h**VMvsiK9hZ%m?(4^6RMX@>)5w>e@|9q5V&&?-ceUoabNIb&=(Qmx+Gq^%A1X# z%fa!RC&GSy$E+RvnK$a#c*aqOi-j)|Ibo_Lz8Xfz;_0{#s(fqD+g0LJ)}2b-Q@UE0 zCrtvJpG(A_4kK=H*>QNAbIvHACOk#2aw_S%z00}ko||5kXtD8?FAD182no6+%#E|f zQ^ebSE#Mt%If~wCq87_nDc!h&r?;+046%1>7%djUIa}vDercayo5DhgfYLqB!+Bl*#-wk#l+%yRRQOQ~si&L|!O*2f;olfl1xg z05&YCYg_-XYxK_pM_-I(>gFZ$hO!MOcy9%wg7~|;LLSR)&X=nA-+j3s#;_{+?*wf;#7 zox~kC;#6RZ%K@Ts)1^#BKGU}!=_|R~`sVcb;|2+OAKyNljk6Q&dX-@0DxQ6&NZmce z=YSI^sB5d$N7B2}8<9=aQP{`I@DN=aRWZI7r5N~Vif^}LpKxD`^nw{7c^5}#J@_k+ zxZ}ArUpQsXm(nBbO3jSX2jESx{!~+gb`~!$*_OK9##R$97>WLvRP7}7D1H*ZT za&dIUMvfo2(RmNh4t)Z4Oqniry>h+wN^BO&=ZIg!=hD8$f8%F2@C#d;|&x9Nq?feez5E*IwQ zoy9nc&$RH*g-xaj2ZB3M2eX4o#MRJ)2Aaw}sS2wsD@Tba1H7e^1|uV!C0jWD#?WjY6`yn>R+;F+aP#ZxnCtg@GViH*jWBZ^k!0T^nQ|UU3uc=Hv=ur zCGLEQvazmH1D3m1;Xb(4tIA-Z@7rgPiS;c56UWf*9lYTyUE3H{0&D$p z7rM^+?xY94W#!e%Z$i!w*xc2}+9fd;p~uZ>&pWmeWbA_{gH@gQrGJnaUtM$K^e5P~ z7#2LZ@|f70u9m4jPnX(#cVcw9WlJBcZC3K9a|bWAdH+QEGfm8eW})lEg~wKT_u9<# zab0w%^pusgg1p-53H}@7MtAg(efb>a-Q3AEMuTg#j!QE-i?HkbuU{*O48kyD8Yv{i=q!w-(-?*R{NbPrIU7D@GnRKieN|&p9Yh7#^ zGdy!yZFqB+Z8QYUY?)6NYxKG^(an!S9>b{jlh2+X3VhnYy?h&#Vef}pnN%$9N8d+z|-!y6XEY&Mg&u}S3$ zZ-sAl#MFs?A;2wQ+g`)odEuQ8Tl+;Y)tuw0cfmd*Q+=Af8oGABA^fa7KeL4@Q`fE3 zdcz10#fuj29N**%jb-tq zYGpUbK^!1Oab-n-Rp9&yk(u9o^XV)$>$C$arhq(A9^%Pz(#$qBMGZTzL@TU3nVpL< zeZi`PilR}A&O7wi$0pJp`{C;=dHm8jcP0_nj2U}7w#iEz%+ot}C*1id|JF)LHmBKh zufA6K)xPw+V;Qj$qrX2EswWpf_StA$zrw6y=?yju5hhMS4+`f0+ok>HX^_@~k% z<*m;g@wR@`o;+5~wfMOW%0tVq* zsg~oHNO;zAe&h&y9=-$)o5o ze@zy`zES1;WNA^Zl$)a~X()=aYxb74Owu+-61Ys_wIS3dXEhQ(~?E4{?Go1F+- zvp=~$pdE&fqEna_qs!CGY&Uv^ucXI!)&D9oFJIfkZzO1|Dr|FDwQTV`W;kC&IaWc~`(1d4uJ zy^rF;iQZm>zcidb7r1$UXVM%oa@51N=2*9Cx|ZFbTWKsQFme_!J?JE;>!nmqvsEX( zMvB``j%;>e3pt++C8A*Co1$67ZtlI7s2Q(6W3bzxuX$j6ZoZGI|KhpPn>_Pp9orRP zBCNbI_z5fhvecySRmjNFnTB{|jum-NAnBF5{h-i$@2LP~R1|PH^&Jj=GOuJ&l}Bu4 zcQrSA;_yS;FD15)ooy}1KG&2&pM~%_j~=JZ&)$7k#nd^hwP4)A4LL!=ZK;wNW~9>a7mv=DA|_zdsqwYyPI<~@9B1zXQ&(syRC4XRZ~ceb<^4@=&z z30!ECF`eYM%ZBj3O+yqzpS6(L8|k?CKMweg0lY71a`M#in+s;NY9+lhp&wnJ&`DnW zvdKR)HXq75lu=j?Ik-R$E2-)x->QkZ5F}eY@Z0rBd`7)~+LoEHAGx`V%)EyuF7gbu z;u)6I-xT8{4wUDc^9c`{$gwo2zH(=MR@EQ*!D?{t6Rfug$g zf^?+D0*e!=(WW58rSiAuY8T8N*|?kpzIv0&$i-nbs?!B*nc>D)&RvVVCkq9*NGGOB zdKKopS;*rja?dyO_eWVaS*dSzVXBNQyt`7YKl@vmT^tGLCevd%v%lc$fuEkne9ZwC z6$fjd01UT%_vYc^uC~hSrr73?I1HG5YR=lN1DR|=c(L@D$2j+^)+j5sA`h0g5X9Rd z`tHTAgD2jOH##Qa*UHJYW%d*f>=`a4I`1hU-%K3aCQ!YQW3Mg{+J=qrU0iNn^T9=x-yA96d35i$2W=$KKU zqihj6@)A^McWp*+ydc4=4!XymaJ6i}l{&*>74gZK<`a8~!<-(9$4}?`Za7CXu*ClN zzR#lZ7UeW%BCM9P7EA$ys~Ls-?k{|gSfaq#s^>MDaIzs=sa6FAMod%_xEXV6GW`~R8`V8Fx(1au^91I#BiGOBqWTm3a@87e zraG`wleUf?Usof~=lRl$zO{{9UPVGZ+jCFvn$h5QXj?L~o%POt_iX!ZFAWMD*m$&i z@T1$YZXE1!Bbf3hEzcIlY`;tI@-obGDS2l%i9Eh~=ih!HWFVp1{3LW0yKx}Tm`DOo z1t%e7WV{VoZ6jiBN{7-Vt{Js?rK{Zkpw;|0oA8EKnLFa#CQ4_yOqX7l>Ddok6k2mb zZ68abn%R(FNcsVrZ+PN0x49Hu`)|4FZ%V0f!&L%aHJ-jViWDw`w8Q<36kb3&;rNhY zsPJ~ch>1VFJqfPAI;I3J`^K*Q8(;gR!vUAcE5evvpV}_hV20qtB77ElNaGQQy!So+ zwNAeJ50ftaU+!$huRLzmC;jxOG9Yj_E0-8=oKTNiM_y+|Z2My9`r{q+yS}c{vSFxN z5xZrd9SZcLh|?=I!bAZFx%HggI0?EnM zas)=w*7ggoTI`P=ON8RE^()qHCOW$x)Bfr@7S7BNX7_cAz=zU=9&sq@w&xuANs5Vs zz6eG4gxra@lTiSMs^GEdY-VRn)D3NwA=Y{PQ(NI}izAFT9a-V(M+~wN5Rc93+|p>h zRk^jpt@$!qx0xtrX*{Zk@WK4~Q|1s|FP7wb%tfdrzv7@-S3xG-U)iwC{G z@-t8L^HX9>bIFnw#Z4GuAXc8SVU(&zZx8;PMaTlzV1wJrhL-_gnv$pR|16aod;YP} z(>j|gJmFcr=rXEr2$w_e^^9~v34ih-+QskxMnMfgYODNfeCkX+sPcP+(~2q<<(Qwa z-`$R*k)CbjvU*5nf9okU5e6QrKl|nt@@xr`?jSt(O#7x>>75~=-Hi)DEJ{%!5;3uh zgEdrY5gdDs2pk9LMlg@Y184%>51L$ne*U}tV_mBLNuH0`3e?bwND;>;>h`-=Jtp8g zU0V+FY2UsR`zJ83`|R6NZ3!n&&C?l(SN1eOD_oe5R9}@LW^2VLCaV1%90TZgOvV+m zfBPklTS^oy{}%0q%<%%uerxJwm_Eo9%%m;nZuzhGn41?@B&7V(JPtaCTD7R_T&@`kB-(=)^C3M#KnC+q z5|J*v;9HY08Wy9L_UiQM*u_Q65N@MMZ1aKZ(Wg*V@Zg&n8fq4*;s=w`*N0-UCLL= zTqwe&;cRo0?=u!%XK}gd?H#f2r_gyZFC5<cxpW9_xd*-y+ zv-=sl?LOV_=2-K@zD|977bu;jKuP(|^%IvNo9;=tOEL1%Q8x~YfW%YP`{vD+&EGKYho24@x~@IAU$B%C z$Z^`!^J{ZKk_r7=ODt*ZG+zWKNd_b=x|Yb+@Z{jQ(4bB-fy^P@rr0Eqztp_UIzqFV&7bx7%SnxrrQhf`idL$6)h{SIc-QGyzS=eDT0udT>Iw;R zQfy}nT(coTNks9nB;#~=z2Mqp#mi< zLhQK51liLpei@e{PDhP@g3k#;TXgFO1}uz!Pr=QUXrV;pn;N*k~H3Vj&}Q zWQhyH!?G0$=}-2(r|=q(_$T;8GE01!$ll~8kfwNOQ$4%0eezRCoFqZ>X%{6Yi#EB= zOaR3nqr!cU>07kHQE-aqJodTryl?g@4Xf~Cy68E3*mn3BC zJrm9?D?52ZrCnh`K5SH4jV354`e@_JixNLuiJ#wqadVX(m7I%uFP@EEDQtc8KYIJB zsJMcz%iwOo-3ihJ3GPk^P6#yKIKkbW#yz+MPY4pAad&q@aCdk2=_KF$vt}M<*3857 z+r6v1`byQQefHjU>X2LV$^-H@FY7=4Kj&o-%)~hFC^zDK#G$|{r%PAlg-XxqNOzo!QPhtbtwr6Xp1_oVhvutjdD8c zrjD)%fyx_!E!Rdjl)xLO!NXEZKqqHI`hD|kL&H`zpM~;C)ZVfC2pBVPkbrR`bo zt>U!Ja^~{S*xYxa9ZxA*7FKptK|sEy_ckA?l(M-M7f{<6;qcw_{6FD#gTT*aC)yE0 z!SBRn=mvI*txP0vsztgjLC6OSblw{9v#pL*iguK;Ddk^(NfJ?WhJTHMS78hE|fq#^A-D^LvfI``KLT{UhSye z{$RH6z43zY(_Apdb=Dp9%KLJ5(|IMTh>+~)Y4~gSy5Gqjp5!{3o-Q~R7;?s)^Yy`Q{#4{p1Xowf>p5nO{=0u-rdRWNDe2Ep`-)l;teST`zdO?|~^U|9p zFR}fP9{0b`Q?95m>}9U>yHu3!38s$0MWnDefQu6}aP}DA<>mDZH3R&|lG+Xs<;!m0 zOw?CPFg$PdWi<*)`o{@dpgNg9pUDPIXGYmt-?O2bU^~1j5p%zhuk`k=j7#6 zjJO$o{~U~uQ7%?+2GyO-)JZn?yF?x9`*^?i3;|uu`uXX(cVO(z&+o{7o(~DdBQMuu z8(P3(Ex_Ob>XXZ39eW=xF)Gk$V*o1>4W)eJ5Mr6KsRa&DF63A^>S!|nX31t|DP8B| zhEqRTSbX$?lpp4P3$H##;XMjzLBNbS)J5?}`kQ#yjxhDcu5(d8t6hV3)A$0ndl&*Q%>)edQ-)WX+ z2VC<@LaYDt_k=4-5pH;ANK zHNPnbX3Tu%w*=jLZaDpbf8xLFQg7gyiW;zZveji#f{JK+dFb~dP%Fd+L*q}em$+?D zW^Uw;-|IH^K99ChWh9zYKq&Hbx%;XBD(QH$(;6~=x#7?BG5Yx`vSOT;zu zH|1_^y3BgiW6i2WLd8pxKcN}=iSPZhOC6*3KJ{%^f2S(v
    zG|5#I1#bHkQmvYR zvj#NaYhx`#;xqhvjkgUw%VF(fYJ}8yUW|>JTkD!b9grioxW@oxHbVNOk)yk?q|{D> zM6q7RP0cP(K8Fp|ik1f8+>hS%dt7C!5G8?4y?c~xHZDlS6i*Afn`(jxw`p-{kT>QxQha%-OEP_D#D?juBeW^ zNTxzjZN7Z=ztoLb@%n0q>S)myV!-JUrQmhvakv~^CU4LOZwFL8cCsO3{?xi;*n=x} z^o3Afu^MGr(4F|3dR~&SiK;%37!uoN8);aPo>hMOjU{+_@?zoiP!P+>d`L0tBQC#W zov~%1_HM(#D2!LGMsFols-;{;%I0Q9m?1@~@OCFvFBwOSjOimNumJ-4&bO0vD4Zo4 z-sYbh#_n%?^j4ojYthhIBFyPzU4Fz5E zQZ}33bN@r=wiW(w-H~z;9JD=wT)3yL(904AkF$N+i*OjJnrsSkqY|s z=D3lvC9<3ZC+i^^HNJ>g6CDSztXzr}-tlnL&ve;$+$QX>9%#naJaRZP=@D;5oeafv z6}p56m-Jz~SH3zYgdGKE@~#(PT=B)VEh6zOOkv)T{K#71OQkdhVXiWCrw>2ZLNQj)An4-rj&@V~@Ym@7Cb% zyM8#OUQcC?nb%Cc4_CxUD=ZX5r_#|x*(3QkMh-0NBz*(e8%-}B_=#86A!lz;bIkbl ztYtTSv|_PVRj01G7gy60t5`=pqQqulqN9KM99Gl5fc8HB_2k7ydkM4E>!k$;Yal62 zkHQ0F-^Xj5_S@`GaVds(AFQ&l3y))HMSf5JVmpfXGl=!3DE8Slgn`3s|@;`F~>Cx1yp9C#SQ&55C17#Q1hB>`! zsPJqJE(0``^pfe;>K(sRK{>B*N}tf&tYV*sC8{L^m4{iF$i|kuQwwRc=-TTSt;TJln3}e!lTs-CC~d@kaD0#^8Z33gl`lOv<7i z@6t{K!F1%}N{=Z2`p?AeGEgq9Qe@$TVeq# zoccSRd_y_Y?9TMxxZe|oOtZcXF9_Enm_ZfYD{Ud?NIdd zB?*J+66@iR)XxgluLIe2=-J3lRNqIs398H+$Gpq*UAd;YVF0NLsu<54?wgO+7Fu`2 z!xB~c%zcF^Q(+I5DRN_Hm&aI0?^Et+y6=dyoH`e6YjdWZo}*kvrpaqOxvQI451#=W zTi?^dzhzjm-&SKFdhodG$mJHhNN9b!kG)Yd#dca-0CxMrIlX`#kW)tAtL zPELv&OP>ay+z|~h<)bN3MJ?FXl$g*8dii0K;3;tPsh!6I&bNi#znz=vL#f4LWMDTV zIC@D1Z>~;9QG-hOBv(OD?Q?2uW>yA@69_9L^a|8hdLvH1Pq2Xm(345hQBVYudCqq z5`-p~E(E>#=Eprh?Ium4&z*J=(f?+4#YmY4f`0fb@tvf*J7}IP#%`J;zNf4gKQQUo z2`nH}*To7w#_)Y4y`XCPd}1@apatRwQEUWoB=*%fFq0~Z(>n4)u0Au4~M~e&dlE@EZ4Ow zp&S#)cKzxC*v|DEyIfUOWfUYjR%_HR@<}6`)KZ5^2d~}3N2(Y+KN~hJDz|XM>WJd| z^{2m$0lsCdCa6g(0RLW{5w?}BYgjjm5d7+^a8`D9Q0IQ~E5bsmSX$ILWNNUGN+na# z`)q63DW-&*H|t8%^(D0uX&EH;8%jWgw}p+k`*~RQrF3xN-nQaKW+>BdJVzZZIzCCm zO!s+whpZN>#nKuSR}|%9>by%R@IY}8z&m^)Ix&%H*Hs_YT&l|3`w`7;fmZQ3S4QA1 z2b@mqvA=DpJ0~(rmd(m%E0P$`#}v?(?Y7mD4#lpDJi+q6R# zQ&-CjPA5@79GBxlu+ht*D^uIR)ifsfEJenZIb;u498Q|Mx1ye20AY$}FQuR@srqE3 zlTPCqvjV9lnTunxVf}Z`Vq{_18kCtUK0|f=STG3h!PpWM?EGJTt*;5G?s32Aop_|M z6x@hUC)&l%wB`D03w~$#u6C5TF_+&sVk{49lz>ZPfqG1L&s+)KYLQhNmOI^k6u|Y= z$#K0hi&Zt?h5Y68GvABUqH8XNSvM`q3#B3M-* zjZ6glfA7B2>9Nh3+RnsuKGTZfd4EKZLNx0{p>0KSlMNUNK@F@ z)@IJmv3q0q#H+V1#CTPJ@~gJIkRfbHU*{P>MjvYXWckB(3Uue>uuevDfpIb&x53bq zEXOQ`8Ryp^L9di`LY5aq15yTuiO#p7o5%&1pVd@IXaRvQt49=bHs8g|HK~$O_TwoR z+T1{Q57sFST`#&^I9OZ)8RN`lWelwOtny(2O|&!$#I%^9i6Kq=sx=`fc3bU)Pmr`iB z_oyYFf|2-kPqO&23l*@%qXiQopSj|)0j4!HT*#48j0TK-zB-Wjen7ob-^PF3%u&Bs z{O%J%f~noeXNHOwm=;FRMmJM1_MhZvt4z&Ju5uZ zSh#$^``cp2US*xN<_84r=+d>4Xo}0sAk?WGkQcL{A@v8OJ+1l|ZzgQ~K40Am%+}48 zRa??hLg3Q{a{GNeQ(S!!Jd5vq$a(Z9$?Pi1H`*hJ1mC)8J;{_Cm18azRQk&VO*dZu zz|}BnnU9&bp(vRbcFw294XG3$TbA?*+6G_slO(Qu=*jxn@JoVwGhP- ziV^Qj^v9nK>C^8-&41O@+2-k0+vn! znHsAvmCmGvLH1&e`-cE!V4}yFIFEW>j-q+A3@sXV*5Fcby4K)o=MQTZp7QzN>GPyNuFpS@u_Bvuo6`O+67> z9sBbJtJ6VuK})phoDPEm$C-d@T&wshWnh2atMD#96DGBcj0Gr(xz0IBIZ>(*3Tfs3{8*b@4=srIJYW}CO7(pG2zIRuB#4x@)KH4hU-HSSiLV7 z4NYIVV{ZxWsB>P0V@vc);->YJ%<)=RM2|sTPA=iZJ)N(uBMzjFD${_i3$Lo`^HNYk z;O=uZX^lr{J{=nty!-~UGJR$&wN2E3Z?X`(i%0`%V-%dQtUKkEGAj2U3Wf;FcGWs^ zRbW%=4S6BsMh@R(#b`bnNpI;F#8!d4v|;t#Tksx~kv*)Xx&qWT$CTRFZ5S9G zS9)Sz5mX`%y1&d=iRcA%+C;0_^L|EI9#pTOTBQd}&$KfplY0>zsJ1fU$}W~9-Zk+k zaeTVf&-LWWBm#x4(qTB~+OSttqS|_#h)0F@?MIV%Klx&y3k}RX?XZxA)4Kq($Ad#= z%-8P}ga=E41%~(ST!>NMZOlHE1~_eF9*$mBorW54{z$PQ*b%+TkiAk2Rli;rF7EI( zoN6inx}I2$CjbLijxTksyHE}S?%cJTYW;Gy94N~BT=wP)a$ST~%9s76${RqO4*XY% zDx}vbzq__C0wh-=ytA-a4kdz#3VhK=B4~#$XZ_~8$L7MceMkuK(txWTLbx^D&9BuUciU8gFRD_rtj}>h&rmoux4dA@H8E7@0bs}mF?~D1E^!^O^ zSzg4PZB*S(?6p07J_=d~a3B3R0{s>G^@^>C}=Z%@|6gED?}=sF~cw?@^n&EZ*m`DPHL53N(a zHXv<;HRc~eYmkdtVBHoLdtD{)ZaSoQ&`2ZnqT<^;`~r}ihy01Cjnyas$X*^@_(i21 zmbnmu{UA)bI|F9>n7nV|t4d5Vd??a`A9l4dn;{n<8rtX4Okr-*B6*ORz?%aq%k~#i z4+0Rl50)k8Et(U7{=B2u55U$nq{S-x{;eg8<)pr`28<9L)Y8SVLDx??0p@Yfzaz}9 z-{zbjY0$++`8jetxFZjF0?B=6N1jWWFH% z3ysjP1pc-GNI$1xn~*b0MtFHRJ7~FKRJW0};?oWU$x0qVTe!@lcKrha5lM_>p@)B3 zrN#b>3;!H-s`^X)=PcR(`$_NEM&+Hgz0al<=SQ;9i7!G#w&!5kMXV!FWa_TizhRs< zqbp*b`{L{|M_h&%-Q#1tU!%@q<#AR-;RQM%$@?Ue!8*HlP^as7OfT!2YKe;~Te$6E z87X!jle(Mq@0H20Bc<21L^$f8^LVFX&@0o^hUU-tht#`UO!&)0CKSGw=+BS*_g|?P zKYO8*&w$MOEqj)X45lE-L3++K0hKZJxP4`Ka5WU5Smgf=jA4awp%*LtVdvjaqBXh4 zpVcr;B?vZmGC-|8H#idgwErHo=&QByqn0RPrvkAL4f~wW^_qQZOQno%V;}cy#gD!# zH0Pv66c+XvcBFF>mETa3O#2ie2D5-0lsg?D?uJ@S=)N&sdPwuproa>)+_6iFlF&2x z)|G4}xbwLS(W+9^BRBW-e2m^DD+nJ`^4FlRvVxQc%sS&o=K8Uzb*7JZT<_xB7T_OJ z;D&n|jB&@B#8@_Mn6t9m2)1NM@AU?jY=OmBz`^X7v;v_-gX#^P)`e_WV~kRiD(n}$ zg|OcsTPfWAv4wA6v&s@7P9M-{opprH-|B80%gipCQhnKm7j9YDPjD;JwPJ-C#YDaJ zL@XB^Ex`x2?+*yjj(nimbP)dwWBNija1(cuHzLC$D_r`h$p8Z(oxLQ7Y~=yD36!)T zjC(>2^*ljGl-gtSz9Z)Ls=9qhFuD1q?$cozc?dTOu#~qQCnJ))6Y}5&lCFlk4)9cK zRGiJyK_99IkjAm&TL>=y>8K z{4=OpgztQw7mytuj8lB~@iga5TYbi~^-K?iCcketD$RR*Sy&NuNGhIdjizj}y`W3E z$}D+q^Snj8F*s@XHOucPavSlcUe`u;8{#x-e0RY=Ejd%9>pHBI47Ys(puCuM8Zln* zBXo1pEBhXztgE+jrl=Y_RISy2p`;lp_{8=`&jWzPc4TSlC45z{?S|r!wmv90wH2Ry zn4UcRynN80TUIWDeO^5=)y)PR%+Ef6iU^uXaR#}I&z+O?Sucy*5nmg7r*1Knv8z8d z>Sv}O7T;&uHR&xgZQE!c%gt!&&-9NPzaD+p^X;Wy?_RGgp`p`>p=nUt`(kpf*r4;8 zUbAuD{Y#U=ec8iuSt$0o{nL@1-@`Ix!1I41n+%|7;+3(*>%6`T@IwtdeihB_iES>) zZt?((G0Xg73sFKs9H(k8Z+-ZL3WPG5?M{Uy7isGU#`(+#751JTpx^QAc#a=_O@DjG z{*+3Du&nLc_}kx9-gql`1K8Y(UB2_6lP_wGFXQm<*5i|kOuU2#a&+sZh7H)v(MU>; z!W6QRl4hJ>&S%|St!cGi=&a|?2DEVF;-Ud72SoV6-IqkIYXdNod!Br_>$wzN3GnOe zf`Y}P)t8i=eFcDYgoYXJ%FGg%exsXii>JUs`vlIMk9XU$0R@+IIg^2GLSB!}i$hn~ z67MPhrj=3eI|)5U=ca=%&!fjZc{)#mnAO&Bf$yRFCs+7Az~Tf{Rblkv;?K6(uo4s& z8V2wrAn;N&3UoKT+n2+2?*v)@_*H25;KEvatb>u%hH!T*0BSN3I||^$D|_FyUY(Yz z*G+OyamZ6EEEoLVZ>s|qtK910dt@-G*u%m_4?mxN>|9Spg-@+0T8BQbwKc7yWg?gQ zXkTpB=|`hF1q&|N@OO8ojrywN-(@>Inu(t@A7jJ|It}(j!|ii#?VLURZpPISz$ONU z$}y%dwe8oMpPSme>M10U&&2))1{@|K2r|+;FBKh?kZnV4LG5cO__TWl8&=Owu7j_{ zNU}1XI0s3Nc8PJL6E)E)TCL%n*BzEkD#b_^jd6ZPfuj)glER6I(8NH(?lU|$jfZ>Nm#1>7*sArBBmscISSkz#5D4d4^;(j``P-bD$eL+MK zyu)WLYu`Xz0_++eTUZ(fvA5l5ykoh=l^DgmqV2M>@+zm=h|UfiDvBDb1_h#V;E-@( zJi;naQ&V0Nfuq}wS-ST$;U9Gcc%Q2SOn&}#q`0-1Rb<2(25vrMQD zY3A*_R&HzjF5C0rN_qXRu^Zgq`eB)Zv8DRi1p>d;EC}JE2LGKM8%3U39(~L58XZN?7e@7ucH!&V+ z4Qms@K1`sV;GZJW1#!Bu)iOBe^1PWermwYip7#WT*PnY}8TqLvUEI7Ecy&48VNS0@1&t~jhzf=SEnXk@7y2A;pA&{e~Th{%Q zW)&R;rUlKJ+erdBb7Rr>KZV9Wf5fdVD9Ej7R27@2LkwJdpP0-2j7BZR%sVKe-E0zpjN8Ikm{ zh`6D_K$cuD9#L5-?l_<0XB4$rzkAoAq8H)qV{C^N?T91zR=pmRp#E%QxNxXK=o>|) zN0x_ur{i~2*8+)+CjUSrk42#$hNfFP#8DOPTV}-i!zF?7JNaurxd6TksM2OQoZY*> zgFLyk^%c94afMcTnO(^}0I9z~KDNznb_ucV<>nTbP~0fw`;UT|B`R6+cXPFxP^}{v z(%htafuaU9`O^jM*iTy~9E|R6@6>vA#e+qVhGzC1j+GFX=PHq(WL$!oRaNvtf1+(w zkh2ktHRu|IZwqp$L~r!n8i{`?+ho@dHxXB}Ww@@Qk`rk|M>3dfcc>-0J0v@Zsisl$ zBVsY~35v6)I~IxzDyeSo1N7s>ESbV?s~h#@p#V%SaB{n{urPDQo>)m%MmO$QB!fO7 z+Gs1Bq~xv_(H-*l#ALwuE@~&Dt$eL^dz1V)yiq#JVj;2w2lx$&yAAuwMp5j2`+9g+tVN}a<-FqM9lzQKk#5MR){=7$+$u<+C;fAeE}j0)d0kAtYzqmJ z@=>sD`#We5BS7<0OKIR=X2Ab;)*U7-L3>KQ^Sv^QwD-xBCff#>z zSW8nHk7X`btcHG@^xvwAq+aMOLm}-uh^Z0xb3g1G ziT;f>XvM_Gx|1>Lku?A3*nEmVL)OgVFxFmVue`DZn)_9t2ih= z$No2FL5A*MX3X?(p=jvk3g`X{Urh?*Rz8q=j`ux9Xg9-fK*!lN} z?{9N|Q6)BLG*f${$tzPcOo;Q2VNcy42h0BO32GG}}DE+)=+o~u7`}aZ? z+gMC}Fak3WH>+Mwhswje=+=F6J0JwTIzl$=GsWz(Ld*H_6C2$(FRa8^$s67{1cb!? z!SsCfC9hOPw*^Bs#j5lfv(-|O!amQ(j+#A~Z@d>&J~b4^9=bl5I0PALV?FFRIMDFB%KS#tb4IjY-Me z?x=5aAJi~VQ_h^Mc8r&xxcm6@>n2jrKZ5H$vPrJu4^g|F1vta#mwDz(!Tln-$M1Kq zV@z47H{@b#ZBxg1I*XS5$;;`*@l#Nbq^Or*4jw!K!U8~CVe|wqZq$junfe*8ONkf~w3PciBr#w%A52@B1s{Jkw+|+ebH$j#Pot zSv+0?Ec_76$tbRoNRDyO1rYZ3YZ<$q^hj;VgRMoGo9!5F*>S;WRN945wZKkOD%J5A z{)ReUfWT&|7R;lc7KnYiRBB!=X9AKyHt zoT*fCww!8_DxcX`;eWSM4aaw^>#ctr;KA)xTy6 z=TI3NXpflTS>>fP6Ca4hg`JzmRkRm^#aKO#Wl{B#48M}aTEll0E}o?;I4SL&22-Tg zed-cG7iOf*eqFAf0_q{dX!6xZq@S9Fu*265I#nzl_%vHdcP%i0)-anN%$R>4F7ES} zoQ&K8Y;30(EA6`PU1X-3K?mlN#vO!hPI0vxZl` zhpAWq!euSp{5bnnONY)}gII4YDNCsAdDxGAg@*s|xo>9WJ(KvsK6dD@BHuHo6N*DQ zj?@m{R2#{ws03M*zbW+bO5)V*hIz?1<)!RjhGXU_s_fE>8%O3C*{bEZ8Z4O;nD+@!ccenO$}kK_~*tlUdIe#USqEY7x^n8FfeElg za_eoq@~vCS6x^EKrQ))%v71i!{e)NZiOot&Dd4?7QN+GGOI>yqcLWLaE?PQn9#m>orosE_Ial83G*4+Gt}-iYU*QXroM? zoroJ4ZE2k-yh&(7yc70eV8RWaV%^2eF;@Ttg;_j4GG(n2ShSD}!bGU7_KuW$z`6~M zejrm}nYDssQ(Y`911SJQLPS7vSJCr9xza|S`gpPDmKq>Qtkm; z*2|Hg;andHcD(d$zcaDlVo5?s@)E?z&yzD*a~@m7E&sL-$?azd3B%{*-n~}#vZq}d zfcsG3#KqlW$QNrV*P7g}d}`>D#{X4&cXh}L9Op}p`ACQMpdra(O;?(n<@O?^ke)T- zn@r{N#r&Rnx7ic^UaEH=I#{3z`3I*z3OPpY|4_(J|0v|3KMFbhH}v6v?>^;uv&CZ5 z+rp*RJX92ljAO&nT`7;)0ey>vR|j4_LUul%0qL5iMh_=<928Jmu!2ZvC~(i!$;yD8 zrG7aOt88wRV@ui$d0lEM&) zTw#I>^rc-DMTEb^jOl>HnYoyYRyOr7=55~g6w{#L&4oHxXyH9ef0HB_3O$pERL1VE z$f>%vL{{7Gsd9@FAupVv+Tki$C`Y?-W}6;^Pj}m)GGC!`iaee*6jmLEO<-?6pMEWM zZlcP5<(l}K$YD<>lI<|5!dDPSkqzAU~4%RQ?GV;Ze=c{CbfV_-#rZd@qoRD7a}5gVp-1pe|6O~be*H<(LiSk0 zv+)F5&w;n?0FUO=R%_!_p5t$DY+j z5!a_ah1}r>3bvW+Wgpdpx2_|{m9Ljvxou2l`UkJ1%RSo*(E*sw(^0cb$Jw; zeNCMg9+_Td@k5&lFRSMVqb1qik59OoMW^@6!$V0k{N*#YI^PbYuVhl5F|u!9&Rnt% zi(lJuwoPw-ElX~T^z!n#5`USQ?K-b(dph#+gTMD9yZY-DYTtbSAu{wriXNS!1v_T@ zMrDCG_IJ0~PLFf`o-=JGN(RIwrfrRN*-YU~>#}1mu-8&>GmRxTa`khIiOSpmSQxyu z$zmWcy}qf674E)^tll(ZUWV3$`-UpVRB|Ej;#pC zSSJgjRw3_bC?<@`ahqcHM?6_<0BhwP92FKZ`Cmp^|PboOD^`lROM=TT}Qd(Pc0(e=|=yS#3sP>U>x_HfNk2b zXIP=Aa*&%-mD4#L5vBik@Oi2>5&AKJAg4UnUYqaX&*T_yx zlMB0SH1N$zQKe%Or}5HAm~t8~gB5_d$?t~G`Cs~RQ;RZT9w@n^zd@^9u4Dfy@98vfW{E{)4p8Cf|yC zg7Ir)+~8(ndK($~3BHL5hP=TTz|0^H%Ou(2M(=AQy3C+CRZQWdlotLRSbcO*gt9)4 zHJy$M4SYl+rl@{gnMzQm+Q z{a7jEal$Tyq|KHF6yXlL{u;TaNyl)BMv*O5ufonN@NLaf@2gS1dyXUeS(-e7I)8Me z_%FKHH4v{hsGb4+MvY3Fe2SNB*a3mS3EAw2J2t>LV9AUeFPp%4)aeh^|H`Ux=aklN z4MIGt?S)h5W=hqm8-cL*DX6@bW{N5>f4F(Z?YJxxvK45I zpLg^Ip(N0V>}BfXYy$Ro4XxHoz%DyuH~!%)EeAdVz00kQDwo2-xr#&ZOc2$<&kHqT zM`o`$mwHScty6|9L8Z{Z7MIz}HZ4#iMBiI<4_Co=ZX!Oyw<8gB2wdwi3)0gC1tH|g zmBwV-#KSTq+wxC_;JKFLf54#eT0tt9X}A@kO62z|xAODyZF{)BJTwA=-#yIv&lq|<6(kB8Z+pId{LKr zY5lW?S1*ksmEh7>GQ*AZ0N*6DcEQLoeHyPwi^`~piTYT2Wq>4cA#oY7Ty?;sA*ybmDC4*lSyIW+!8|z-k_B+0MONORfHNaQ$ z&>kejv=Yt_h#rfU%{o~ychRWLJAxZNso>k6p=YJJBVI!H!uQ)k82ce8Athpi&2-=g zp-}5Vp#p_{@u0NwYwAd|060*qvvlUmuqB zF|l(s>#K3U$$iK)P1Il}-ZX}4Wb2xN(8;VFvG%;4`^V4nt=G1R&wEr*#U6>+D8Eh* z*e@2-01@fJIFYqToeeU-OE_6&4#36CUbE~-{#c-m)NniC&MU%iC$WzHxt@?FxCgNy z3*tJ>*CT;(D*)?b;`oEWwms|Jj)QeH>QPd8Ugt@KzYlmBUnA50(YRgZ1DEcN&b9HH zUXh)(eWP!GZ1`l2VIi6C_*i4*R^9b@VSVp1*9p zsjvMND0nZ~bvhELg@VMV7ASJv1KMuT$v{<(hCK(=^^e+*Z*h;M7IqjkVi_v@Bi@8x z>EFZd9*c5yWD;Q|)w7|d-#Iev;u8Y)bbwtxKd-T`Jx{$>jB=uo3%&>orKP38h=#!Z zO&2L*IOO_06`@OBtW;clb7Ur9krKnxN@$f(B4L^IeqFT?|iE6I%i_h%)fCnUHYgmnZ!7&3Hy^>hc3(uGfZ3r#_rm5-FVrsl;8BH^xsi9{8*}@>T-axX%!%%`$z-O!rs5V(M zB%koKdlw-POk1!c%b#K1ja+m7aKxg0DrB&hlar*jV%Gt;wf%Ga3_fQou4s1eNNK5N zQF(`=i2gJEOs}fZ=nawTZm6AU#D^g0rnwtR6QdIbZ)k%`r;QyxZ~!KGjolbTT~*dn z**W0rf#JoI628Tt=D{y^JTwNlkv&OIq?_v%q`&h6xW9LAwRm`z%aQB?;|xJNXx1Jl zAh7XtiI$3UC8GVk_HPp5GOx)QmC?1(1_T|Y{KPN=BG`*#PNFH2A41!YQi?M$gtION z7h2AFL;jC*9)EcEn-Uz^W#%AyF8r$BzZ~jBr;GzMZfy%Vf1~yhA3*$cF!lS3I%XV5 zu+Jc$|hKYrk&!j0{;ayO{}UNH&c{j z?s6QtTg4-@A1~TL-+Yrr30IJSr>f6o17qvxwj^LJPRK25GTV)?Y5Amg?r0mN((Tyj zMoaj-ZpwYjrcDF`t((4AK5k;6iA1+0X>2Jhkm<3-Oh-8C5O}eNiub(@%xZ?8E-0kWF;j(hXlSuax;rt_<47+<0bdkp+XbWMA@|HW+t#}yI6{sD7ow2H6(1KeXP z`W=g7g|`h3Nm*<#bFo3{c=qX@>k;wcKw_6`Gtp3R+ssK2w-Bk961h1>UaO4b@Zy_? z7{f8cTLub2rB5_H8-fv=PS@)SSBP{SV7>CHjakUI!c3JG)#!JES{vN$R_bPLk%9FK z?066-JfFY?C}E4(*|s1Lb}PGW_eb!Ax%c}>pqeXab>$=N&1YG!u#bf zWC#x$w98|UX`mrFbTE-iXH}`zg6wy7YRDvJlK{n-=cv{l3QOpoQmWh5nU^-oP<@j7 z&Tm9WinImU!E$NucY_|PO(z0uLdeD?zQr>q850!P^s`_c&PEHyo!kAK9Xn6=YY)K| zp){#Ku5+g_q;IhsGZYjZYt*~4z=)Q$v|csl>@v6R6?CD0A70UMT5Ep)J3p>z~FhpF>V+kdh7RAoCdR=5++*E>=C> zJCqi|-i9c?I!z=WvXgcS#KO*g-mEWjUVHBT7JHD-eyliOx#*zA`_U$y599@AU7A`{ z4CW|Co_Xp;o4_H6cM+4JJj($OGG3IR(?7=z=@v(6)!S_ysG>l{2hybsl}KE5TS&OS z@&D4-3DrtU;9ytzXBbmgcjLAd#9sPTv7o+LsM_(~bq1x6wJ!&&aI86Bb`Z)I`zc>w z4{QvQ<6*ds#s6~#LA4dF8GbxVD0uV75*`g-Nw~1E8 zzjv*3R@Rv_Gh1ix=j_bHYilZDp_8K{ARu6=D9h_2ARwl^-0Ns4FD=@OozgEque^1Y zWD)9TDSy2@ympY$kU>CbOu=}xLVkIEU&0oZ-2wL2!zkgXU9^#XXzo*IP!@SNGQ1ayhoJUuwPKJ{%9?QP+D3PLT&y^F!+7t zKIYg#NWMLbkJjJt9Sei2Khv{kzp0cu@^>6=go(Pkx+=Q5jyDXpB+Z?-dFbhj=y~W< zI8(I@u+!%hd9}}jJ}K$!@2PiS8y`~qB~3J`h+svp`zi{pOR6(;LoDh`84H&>*ITa9 z{fR373;&?v=6j8n=qI=yIJQPUhPTwKmGh*{|A1}rP)AGwz^~lmXP4WrH|%;wdohG2Qc}_uD3(k z1^%NBoRHLU6+yB**hHypKI$>qD4R*hU#-oqtOhX@r77zBdj6o#T}K<9k1h68$f7NJ zwCKrJ`q@7R?xyE7GKpAsjx*8}7TaW=SAFo2>$7wGC7Y>Dc>j*%euxgrt8gCIyuMh{ z$EM&%Uxrhf=aCVA`BF9#0*AgDL6Ot=#f|_1)C%J3VsUjKiJM6}P7l#DyXyd&j#8GNbbw)A_af(q^+2)>Wxirrw&E|c%0sR?<447U z)lDj9d%ul@(M6I3>c1M)zqdB%pd7PHfgWS}${j~?SyTyl@irtbZipdgGbHVth3CzM z@9V_t5|(-Opr328D+sjZD{P!g#5MgkAdgoZ*ScHU-kv>DQ!e{n67i~DdW4-Qu4Bc3 zJ!7{E(D9SZ@lok&8` zI}gG)B{_O*qfCQ&9uMN{V6bFI*uz!?k3^G`eDh;$q}xr6R*m^BjIo8^n8&9Ix&fW&*H`xmS4Tm!S)p?bL|9?5eq zlX~F$_!*G5;;VDE_S6MzuZKgRt^K-v_t(d*(oGO|S5uaPXX;A1jj*f(SArSkkdrz* zk0ZVS))(TN^S;A2`bw?gFr{55`)h!6SboaH4wwH9gO%@C8ddiv7z1@!JLTB;?LoKq zTHyxUb4{!QH@iE_u2(P_ib5M6NH1*XWKQw&5Sz8>{UL!FNj4&;nhOf~kc!Y}j2Ntn zfoyV$RgiGZWmeQ2^<&xhS4xMb)+1nw-S>a})&g0aPxiS$z$$!CNn4qi`&sv7aZ*Bw zVdYfup^pmmgA7Bj3?>VbFQJJ6cC#rQ4D4lSG*vl2OEn;5pfRQd9}(UjGxsh?E2`>3 zzRw|om&4F*9%R-$t5K!X^InW(XDJ%Fy}nkjjCQDy0B$95_G7UJ2N&mOi058xri`kF zdr9c^#;1`6ExE8%@d9-JYBvDDs2qP7!Sq9W+Te&Hr{%4<43cHG)gx6Z3uYMKU2?ta z53ih?nT}R|T*Ji6R?y=>*d~mNgBN6S=fq8UPNuWirU$}s#2GRZrwEHRu8FP^+UM*zADsAPKWNz! zC*S=_cbetiSe*WCBy#Peor{eBwI6bEV?%O96Zj`Pl%24;#ho!Nfu(>3@>xC#qp0{x z1+h-Kb}^>EqgC1PSjI*acn)t#XPc??C4+h04dHn2C|&CuH^mHDC!*PvBE<*L#U%dr zmz7wJ2Y4{hZ+mdJ1LD-!%(HK#HHQL13h0TG-4@$Q+Ulh~@Kc4{-qs#yw%65ZOja4~ zYra28CuqSApD@cJ>fg^O!oJuNd8K$sqn7w5h(otoXrbt-{gvt?);P>?3BI} z{>Lld;nX9ITl4%;d4qKI2MNj8L~c#+8@1?z4mD~&n(w<}-VZDtm)P82r`#fsV1e(w zO@lBCT#e1^lFT^hJEdeDJ?DlkQhCDoISrb~>hmdS?7>0A+PbVk64>mnx)sKWd)9>;QchE_LW=2vBG38l{AayExS3Ts zO+U>eh|JSOZ_bqx?mdO)P`ARu2+Zd0>?K`T>b4JeB_|oH-Z(eUZ za)pJ+iLGwCfw3x}JdBBrbV#+Y7J{7WgIhc{TOmGp0bba##s+ntAE99xA&Og zXeC4a&po*L{!1=PxKrRsERxY|!-@Ka#9A!an zLpr%k32^#sRWNISx!6FLNI(h_l7y#CS_9Mjd{ar_t%0N@cm1+w`}5kgQhV6ACj(QR zmu=tF zT~lmA7u{eg#ki3K$|kMpuF(ishm)L+UZaGqu$w4(4TmzkIc3yi@Kn`oFf8xfQ7l-~ zW@wo(T)5XV@}gf1mu9g&S97uAsB+S}WWO;7Zft4SOh3qbY{dC`Y3@jM*<=`NZrveE z*A7NMI|NR1{z5Cup={70)rhwL!De=rd7SU?s-cgp-m*s$t_Bq9P0XvfB~^(U^VOXt zffy#sL3Ixb^8hjBu6^$hr#E7|?EUZ#?rINw9|751s}HW^&D?D4@ZRjW>K6OqimOMe z$S?1Mnw^d`^_{PvhAjOS1_}Nzwpr1*{KH4Q|9B7lI>nmN>>J+4NXW$ zcWDGGx3@T|^ehPM&W-rSp+Tct3+(Uv=7Fpms8ryYh-}+**1zeW9?<@m+pPJ*arM^i zlkZ8QAIxEp)jL}%)o`$m%l~98K&a&_%qzY|YbZjbNN3l!XDj<&q=WhEzK~)?t|PG6 zHP0QR9%61rxk4Zp_4{!=VF<<_oLI)^71*zFJ1eN*>VkM)u zd7GD_*1O||kDDw+9qD5#c#WUQ$yqOijNVzRQXM8X@XtGhWOl4?^ChwTAG^w!@iWXsf1g|1S-*ZIbO&PsQou@DON>6$B zIi>@CIkhC!nsB}5@+vcmJ*feA!Y7cE(pdRj2wpPo$EtC#QZ79a-w;#0MgmCU$Z0y+ z8SFXSJ0$qPVQ2lMsJ$}Q?K#u16WuJDJZyv<@9$$KiFGRxb`rB+t zFr0b@5{B)oRWv*JO;wb57}uPXXrxVmvu&X^boJt{r}txd+G)7*Z)2&i7&T76dLA~AL*5><;`Ju&aPy}CM5H6ug!0q%rEQ)SqL zbMieN(ervzGy>Tl32#^F=m4wL zr-QS9ub$g*ZLjBqbS>M^8;eO z95N7~USs6WN?tdb!9qm$15d48cTbW&&IV(iP_WjzU&T;Wi9bnw_l7p^)rEqed9)4l z*umHpQdk1-UE#=$=vsE4_O6(U(;gF027d#)-;ry7@POl*euBkXTkDH zvttc|g`x(ly62kBKQ$^S2klae!_2b^-<1u5wHO#Evx2GlbW``Rv&CJ{Z29g)Mn;~a zJ3UJ_a9NICDGx*EqEDb^Mp*)0&Oe4Y^t3F*-I`agmxMj|6&w+o@r1#6SlJL1HCMZO zoSYS_A<&rB0e>Vo!zLE$ctWHY3`!|UeDo^l?o(2vhh&Dn&1If!+;%jNPmK=eB#|E~za_ybhP)OVciU8EER2&2h;+&C@>p)O2_{q6k(Dp=7B@!$oMV%Mky$fy{UY^=>TaY%(+PM?rb9C{ItxcH@!q$ zL4AmkV%tAa$hr@q{Dg1)r{|ru=p(~-!JT>>niB z*_IskVQ0mdq6kQ0Cm|N*6ND!%RPU#rSLZSp&bLZTyFD_Xz7~1{OO4fhF4&0>Nk`3h zQ6E9>MQ9%9_M{t?hjtnL^z|%S9`H?F9FQR92^okNqx9N{`{jJg zq}7gf3o~0|#IBd8=%eL+NzV{zl2uD)|IxZB(5TB0=o3uo6b;lX7!IW7HGXX<(dcq* zM$gD?&NBOTKE(!Yz#+vfgqx1q+z|UB-*2arpLhJee}-SbGjue@4%gGvko-`@y{63U zz06-)4;ri7KofPED4>3GMCuzap)Raw-b2izDS7JbeeInt#BB>`Cm>-4`3KtC$0 z(xWSFI$V~W_*GvRVg-_>M3)UqnBs7?8!e(ReB4qMQ+R8v(9}8lCis2%xln?+FIbQf%rW3}p|*C<)XRrC7Utmq66-i+9KxFNwBS6CztxBisLcmEq(AwFJ*QLjgPt4S z8aE69^SVz$1b6|RaVwa$WxKitwSY)AZK>Iuy@43C@Nfb6_ygBLEPphtx52`l$g+>( zE+$}jB+lFHu2BijAJ%LE>RBT3>vSKdZ(icek|wzBn6LMAk*S?v{24B`@T)1}_LE|MAHl^-W_BT|?x;vN zyDa>%el5GVmSSQ(WIfSvl|T~q2D;O69hJ?HXcWCGyutgcmQRteKQ3rW`AH!|&1Ru9 zRB!;LZ-zs2u0Fo%r52X|W*q?I@2`(1toe=P8RmioV}9M|JCbs~_qgKrCj}iUQJ<2X z;6ieqoWiNK&vW2#PXuiTB?UHP>~ws-w~RKESkbQ7-|1+Q)+}ubtP+AlzNaVxPgv$4 znap!rNt4e$>@WE6QZj^UY3hi-$fiIl1681NYX~gePF26fzw;H;*QnwL6~Pwo>$vD@ zP@%|9B|WAV7n){rHlwhUT5IGUoTcCqNWNS;F4=nLwPh=^Yh7cX>ucBd!=&c2gbPqF zI$N(UvRwuZhbn!~D)gB?yu()S$U{xM;2c9kc0CxxWjRcE_Y;K_PPBSBkp*Y@_UtOU zJu5=)O!&NxW@}xxpX~8c{@Jmu*?|P95o(sG&?zo`nu|BWnB*ij{`pquj;+3ht==yH zF2bo>{k8DWLp)t~lg?5VHC&{TmkK;MX+Qsi0Y~Edd+a){ z#`#F3c=mn*OovShglPF}+Z*=)6QQ@SVWM1Zzq9f~wCjz`O)ba~vlS=%J8)ADd$o+* zoG~BvH|ELFl%h)Gip<6r|7)vxa)xT!rra60SoERJydxF~S z>WJX!p+@+HVeW#MzefYp7)0KA6k}G}$h`vVghuV$@HRz?t9BA7p<-mubk1s}?TCbd zAh!FHr`a1>u%V9@^qkx)8pCQpH_1)ZlZhu=KX%21!PYQPC*>}j3~eZvHEa`S>?{Ma z=y-;WQR#+nVbxy7s&2Rc+(qw>TxnUFr67?_5Ez0-e-Lp#_<##C8~L)&rHYi4fO`ws z|4^9yB}n-y?ci1^eP$!sOsG4hmAAr9VDMEv$5g3R`0WEKk*a^2j@FLtaqhO9S>Y>- zfIxkir)iv4;T>TSjUqw{AqPO;vQY<{mE^$Dc3I5i>Q9OM$wMc*O?19LZj$slK%Svo zUFV#Zyd>j}zM~K4hM(SC9LRA6v-^yuAZ8^$7FG_?L%(;CW#{OKnvC^r>pg=rQ8|4PYR2B;m=Vb zky@{xHI?U%0<^i{=44-DdTeb;Z!Gho`r}wX{_^SkITV;R3J}lQ4Y9kBJoq$o+uyi5 zK*CK1RfjWrz`RxeKUR`b@{B8Yt^_U`8`BAqb*^aqIy`&BA=wpL^EmKHWqOwCDvP#5p-XL70BYF z)>=@56QfqMj|Qe3`bpxGB3w-*QPcCQ4gNKZ_uScPJ_pcv~IH zC6fnhOmw7G3uh3+t@{KB#d-R}^2$V{gs?XfpLiF`f85@=y4%jT#EHa;@Mt_JQd{7{ zhecm-OJExkfnS(p1my+@%a8stT|9} z-fcTF*!?9}zkc)JdK?+@rQ;cLAVmEzOS6J|1S}m0>+V^zeL?4S6=^H?Omp`l=_`l1 zK&e=oyVbqgMhiGzxZB^v+$LPZM`aA@cSEqm^e^JpILV^xH0~uvG?qc+>j;YrGDe>V ze*~Gw%AlbswTK%fPo5m3qBcqj&F$a-gq&>GcGVF-^9 zV4Bp5@b+QCpjYpednsCR`VCTHx*4S2Lk!43O$L@r_M>VPZUfj)e z^;b-y8LGWtMX?~#Ea zxpMIG8XY}l6Gb##NUBx;XvB(XQL(~!cik3VjJKrZbGmszn z0UqMcnd@7=_1|hBa7(aqK=XLt8bd_RIGENCBQPN3%%MGbSQKkKG9-rHW|CQANdXi6 zoJwm;Dg-axEVHq|PV-&vqKN0gaspa{tH{9glQBpEuEf$+`<4+YK zz$uxC6uAg?4#U*d`2oAB-#k`XXk*ycgt4`a*%ucM&Pv276I9V(_=~lf(4;-4&p)^K z22oRmjuWoib!)D>#Zf04w%K1ii}8$5iRY6g4S`8{8V2#Kk(QCNW}8?o(^ZEM8~Y2r zUm4<5x_W;6@)B?58^Y#n*QURjRc0B{vM3ddGG|QwEV#FWy&)BEy}j*KXm&y=GWzlO zrk#$vdb$#MSA{#}$uGQ+!(y;gBosEb7dM6E<|%9u>feN1hMuV!5psjs+cy!p3ME*f zD911IV4${$=?>tVMH;0FW-hdcioCar+(HeZFTBNTAyfWHfoI6<*9kD)YZZ5U>IDX{ z)~Q0p0cN3~&jNhDQ(Y>3u<<_F@?*R*fd$5}!FQ3(UQe?Tn%C0i2lQ@ep7q*OJl7bf zIN}|WO)RQjc%;IV^J1H#2t47Q2}gd_)OYo>7ZdK3sI@1Nr>U-ti8$DeHjzfw1k6+4 zM@GVg;`izxa8NidnmdwjH$^tdyWv2$ODo$#_Q`mjUQXpCyij;tl7i8;)hcfhDB`Wr zZ3yf@&h^6Yw>6qzw^G4yB3OZe`s$EbCuc9gq9~~hxjycZkj5hLHp%;a?-zQHKH3x6 z2HV?P2Y%7nqzxwGB+o5B#-tEL=;&`LJ%U6u$ZbbR1Vo9Aflcd8!|Dg6WKU2D2!kSf zIqm=$?*ts{>d|VoodAqZbFU7zc9C(1!f1v_E|1Ay6! zzt0ZRVy=JLn9ZHuERfYRme+#}`g1rH+X7@3cqOMuDh#CNJ%zIfxa|FsYe>nl9wDQ0 zD+ARlF{me&xpT3;W+90IV{f9$L6nD2LwbL_{&HUvIqmml5jU2s*wK^S@&9s3#9oCr z)lX;x0|P_A^QV|EHHOz&Uo_J2oD*5|f;B`eu@+Z5lvXuGcZXZ;qNLd@gc65;JnJTp zBEM|nh`Y%ohi-Z{q&sK5NmYXABIZ+hBrVE(u9$HpYj-&ukiMQ;Vq2$zqO4g6 zbs|SxX5j@3^$aj1&HHS;4a(s!<3E>LceiMpj*Hr@1Cf^wRuB>##Zg5WO8pL7PGz0z zI_G+b;O8HsZIo||dQ1Zex^hycPwN(S`EgDMrf=fN(bGgsP26MJ5B$Usfm(AbC0=H4 zgzOzu-njNqCo>iATGHTZ!Ww1%0^1H9ynRkAULr;T{7rS1!*}J5>1kE#zm3dC9^T-Y zOaEKJBln8#24r=Ogapq_`TUCzT%Qxq-RWoe+?95R1<~p@ADaLG+ zBZ2AHrS}62McB~=Yx1m}OLZngho+bA2x9Mk=d(w->Z|!^LW^J(r^)B#qa)t)#TG0iOA>Pk$#uWr0lI6k zh&Z>)$qKI%9z!GL@ayb_F6AUo18~IZvhd;;(!Z6_1f}l23BxeOX?`gTSNbJ?BR8&& zSr4Z+jO(_-pghLf1pbH&kwYNgPJ37|H$beN`7UL!Y!`S;9>c6G{^N0_H78Z+NVr~H zh#9Qa!t7_I4wdpE8^LNbo{FyhoNkwN;K-|l;U>M{CH9;>FI9_w#Fm#*0#`<;N98CT?~GICz_RGUMCQ%DfE6yLv`x$(ZY{zeXmFer#$3*eWi` zZVMxA9Vx26A5G0OM;J1yfzErQPQi20J2I=l05qz$qGXXa`VMwL@rXV-Ff{*zQxeJU z{uoi7x7!wedK-cYQz()UTUIy0QmI|TTd<_>IQN^YseD%j{!D#)xvcddUr}Y+Mob3c zER*ddQ$DQx{+*pu3MtR^JTJbDLytEkZ#qa7mPRdxJCr@R*R``wKNMYhPQ0%jVg}jE zZ1x+Em0Jo-nTdfKIWA0u8*eZlH1PdqbjxDmPaGt5QwYx1mWR15E2QGzEZcc-bnb(_ znXq$~DwA9H(bi%Jm^$mq0c!6>3fh@%{Tyq3l01RUj^$xMXAQF zTesjS*6hrg9YPPv+>2M;k|IVQ(S&Sj1Dd(lIW+0wr=Q2E`|VQxF#0uO4(HlN-r{{E zO5EY*uOEgys`n4m$x*y+ZO!RYJ!}Ah%H8cwx(tAH%uUL!_DDIId(a5M{5ndHgt}k7 z%w*p--DAu)=8^_SnlL=Pgx72o6?TQANEOcD_1_M({)`HT#rvZo#T$()Y21g22CZDd zHj5@EB`4l($iDRmypkYF=E6CS^4@c1k@9z+h##0bU?;UN{_RCDSRoK0*(lwK1skOv zh}l~c5wO)20IKAoh&TyWD00zj5_!yy~q@$@Dx{e=|vic4a^}N$d+qMVK)~MMa zahpeSM|fj_xa7B5?CGIQ1cO3&qqz0W`Bd0u)3TdAGOpfXls~<#{wn1dPyWhHrA89_VuyL zdlz)|3bPf?2IUoe)hW=$MTiQI_@Sd1EP6;ZhHH43uZHe2vGp`{l#nKPA^qp=P=y+Q znL(97ULKF}6DfzuF<}mv zrq^ljoZLF_mA~dTysmF^8@E1w_jPVcJ0aay$j)hG$0_L&inmk&%s!q=D5)F+o z%TmXGa7!aM(iK?6o~ROHj*qc#T}wNmfC@+m5eRdy^~vYc{YDyWvrG?1Avm9IH3W4p zH-xy_GX;4c(TEaQdA04#{l!K5)nDnGl&;Q3{E4ahF60W$JB$)E%cQtOP#$>E`z7Bu@GO zn%;Sd(x(Y2GAHp(=uh10D1X9U6@igc(j+Ke&e3qQK-cjJ`xrj0kD`0wQzS^Iw$?`G zycXhEqjP-uGrK!_GYW+hw~{Gr@Oc%J_LAcWb^xJ zuoX2f@VbKvJEtk!tN~N(y_Rm{-b3Nc2g8+f-Pqj%O~b9fVN!zDH=q8NC3z@r1qn&t z$&II}r(fi8{uaW2_dxN@r?~;b-{iW4orkDgZ#^AqLr9WMlNiNskP;^z2obuhSZnf$ z)iPaqj9@u}rYeb6zM-YpgF6$H*`*G7u;;rNYLJn+m_Xp)O>P4-84C)&rWwOZ4M*G;X%MWukSmZI^= zy)3d*A^fE{A!$X&<+fATX6=W)B#Wg5+*D=5b{c$My1@6NH&xv=8(g>oI8%cj)LE&h z_S3v#N(^%O5rGyTi$$j2pj$E2TRK}oC-|h8V|?D)=X|z*lQyqX6M-d^v%fWrzulGa zz?`Evl^5@H-ww)2#k5>${jz^U6JyHzE^@v1hsUW8W^YYvV{do?k}#r*UdCY#dPc3L zMpDg3{Su98Rre7X=PUUrV8HV5PPyqfFd;OhtHFq0U(OHt(|m#u!A!e2p86ZXJ?o^- zK9Si>w-U$!vs)ye|6Ey3nTJs`wo}}X51m@=t?OxdWVSc88wLB=svdyjuY5DjLcdC! z0i1=O1*@`?Mt4Np?5BR;m%sn<%8%{5B(R7rjA*>)7n0Dsz=m0Xcyxhn6lDs@YYtV( zvlic#g8Sp;TZg?*7Sq>?zd>#+E-U@b(pb*9T`aeyRtW;sHbaSO*1!;EH)z#?4JcnT zub7dv&)L;BM&;ekjQyidxU8E!{+;_Yv+I}6`moDo_Q~+Im1bv;wVcGiJsvVvtP`yBx6jd$z@928f@$jj-NT%!|b8u zP7JzSEI>Q=81q2ft)if$?ZKkv0lYKGhiTFdr+f?PAre-%q4F0(Z_kCPgC*4${sMJ2 zZgU>Y$9{&YjxtX58x7Iae?Q?CEd=eY*Yi$*yO2LDM4LQ;UDVAo<88(oNKj6p-qzz3 z;q#8(YA3(%ENg#X+)1MkOXApX&}0|`37f#uKa%NlzaKQQg}ZMZzH29g=-bE>sOckg z3O9i6P-bZ9p5K#g!X0e#WvxS(OqX`LL?lF@VbsMFH?4O43#pH+oZiPDzZpzhO@YQV z(r+OE1u}wq7BAUJB?b)!mc*)#D?mc}jO)1hYrxjc%$xAJ`3>da9_2|H$O5Sus4coW zIyB_$I^Ek{1R^iaE?9ao11@gRLABAt@P53q{Z;w&cKCHtjK|aXk$l~!c|IPA2}!|v zHZ{ED32P#0DfJ$jEG2Lxf8g@_Ove1j1@*Uh+fOB|`P0qf8fm`Qkjufsrn&3jjw@mA zq9m1Xfodi?ZDAdfjTJK(Jd|V38|LFwP`BXYYDy@%|b&@^+puJX>7Fy<=HnY>T!m7rThDR1tU;b<|Lh%pC<3YmC=fVLE!aSe8Q z1(iL`+!?!k*{7gGAFx);jH-=X8%#ZfE1kcyHNI{`;$ZaPOA9viQ{aU2rR+LJEJq>9 z!f1)Hm1K5Xr&C+f%eDZ4Gact^-%lPcwC0Rc>WG)b)KIN1sq%^%nYYVc@sX~Dary6#oc~eyLcepT$Duf_5dh(;+G7s{vBN0La8Y%3m6@o zzlV%Il94^d%PQy)D(GYoD?}FuthvOL$R{#T^Wj(huQ#dh;CzSmJNbLU#;{re^Zxo? z2H-#a3CoZhBl(DvJ((1Rlkp8#1^maAjx{ZAey-`^ zkVW6eq1&kc(RE_`{EBbyXZcr95yK$w{D&$hiG~kdtGvVeJlp=J=!js{=aIPe1~3MEiNYJs+^0)%2T+_ zLI$e6hXhP^(4Y%av9?9@fb z;rEM0KX3Z}e#82&Hxm-5G{@`x$JmL`6rsd{A1#ZTCBNHuq}obSr1HXUhiKNz zE{8MW^}fUK+p)o)7@iQB z$A=d|D}$N)U`Zaz5?KsI`}aBgTHK2SvM+Q3+bs1#`EG4rYU;b3YfcP#`!Anw`Yax% zl3vT=o%{OSNQmM6dSs^-MqsCmrlU^2`yMC72!dj5?f7lD{aIh_%?f*j(&&YUOMg3( zyy7wG`}_RhbbSip$CC0t19m!i%@->)VGhC~F}OeCY1XE=g&*q`rP<-;c0`JuHVoNr z$zhAi!*yQ-&TtsYG&EOXDGK2)^jT0@=yT=#*?zt0t(7Mo-uov-vyzVbiFmI8vm_r! z>h?3I_u>zuWIH38JtA7Hg)ZMufrn)AJA{5)zJ|Y)4Bom^o^31ML<^n;X5fuAY=M>U ze93O6_+R!mAVyrr3im|Jia;@|0&snE2B{PLznz$Ql|jo}C^#fFqy2j?3)4{HuQ}e; z;*zke8#@#deN8!7lNvto2)m@n6ZW7k41d0B;)cI9|JTY@pDm&s<-+0R!r$V#zx~ne zw%wxy4deNof4f;2jKNU2U_$;m7yj&x=V9b`nCqZQ^Q+@(#nkDj&_BzL#5~}OdVa~= zuvEyY4Ndy(3x)iJ8%YZNx9$?SVBC-J&zKmBXiB%5cg`_xCX+QB|`@$}Edxj>kQ(3)VYUT_gY!Dug2Njh*K*9?ATaG^7J9Wz&^zbp=%}p7akCxlaeRDSEd98P z;}`!bG;az+z=hP!$8vrBH_~SK--jLkkCA`IF&Hxcu>&->Q$r>OS{}jXj4*FBd#68R zU?XSr!U5PL^u*LF6WI#%Rma+xuj*e_UY z1g{PJHJOA? zQUZ>;p3Un895upBjQz#{*OKDx%YWrE6~I*_)iLe%t4q=$9|)#}HF+ntu*o-TJqiSl zT=B1igK2i#Vov82GOlXa|NlIEX&y+S5Yu`{txcT3PfkHt1^ihdYghN5I$ks)7)c9O zqNJluD6?yEe@br&I$+Q@g1`Upe*g%jymrD=3j!x+C;C+0s`lw~>Ol$t78gsO2{X;4 z?(>gP;wCF})Bnuj#MCvooMG~SR%hymgT>XA;%LdHV>GBWmxJo)D)w&%Csg=iFm+ZI zkvXSr=Siev7p<&F!Li@?emKJ~Dxd{t`ac7*a!rhP+39m*f{k9ola-F_WvK%Hham86 zYv3lIoVgXu+cB|qS;8tQJ7#Qg<@-m$1pIoP{Qvbh(XP^eITVA(kW76RYMby_OBN_^q#Lj4W38j` z-}I_A_&V$Nn7FBI=&r1v+F~vB=l}E61-NDO{PqrMAQ`&x3$#IhLs#|RN_?4G(1=!+ zQC38ZmNJGG=l{v~fr*Whj+~(6qZs^u-VU%l4{Rw(awlBCQSUidIviC3K_px*{&Dx0 zt4@KrcIy(Yr$HmSMT^R{4o4?Md_F%AS|xvFfK03 ztoIb7hQ%fS9~8V|tf(Uh`%X&@6JJ&NKOp%AtiVE=zPQ5u|BxRk3uSu!B@zcU-(=;D z2>XY$el4B-GS+>2dT2fiPcF5TOA? zwpx*>jo&o2+Fai1!>UX^0r9@l4Fk`dhW3ZY&y#na5_ z<*KWvnOT;BXi^*oOD~!l44HH`MYn65MDta}k)5k@vIevZz5WzsCG(qh#!<3Qzgq{D zTjEIR$Yn(c+48);W5=Gu<%Z+W+!SScyO8IWa`iqS)q;)OD=ht~jPmyh0>!Fb^v{^4 z?3u;6ZVKyP-S7*AzQr-yZJe%89vJ(>j${t&1<>X6Cc7?b^*35AqZL^;YNaTIn?%s|zETA#rTU6zZSwnd^yl#Gu1IW)p#^32BMA zMbC8P51ulO!%;(F0KbI-q~OnVcsFp^CWDWSvL@^ukSJv?@^2u0F~w>$;1skv9+Nl* zp(EGRDbtit9k^UBy%k_`zEJ~+XBVevY-Rc#EBkz$Y_^`rLo5vZWqm)jSi_WPgOI#l zp55y|iI^wZX*M`HTIMFp zt~V!Xr_L^Y+$T8!BoeL<>KdlPW8s8$PAOMvjz>(FKj$GBzjnSgS56*{Aeb6DpPYyE#bon=@Y!M11<2#}y5xD6KE-QC@TLvWYDU4lCV_rRdReQ<&YcY?zV z?(XvD-gEBz-Cxf)Rn=WxyY^nI;-lx;abhfFWeE~fvWDhat4mI2r6PwGH2xqf`?+xb zt{z1J#kR&P(|?1L4-+o_Z8mJE(j^!e5W_4WWs}&z~~|=$oz~yLyIQJ z`gwW?a95^Utxh$dT?#I(uzgk*6zA>D$4+owdHBt)v`Pr%J<_&`nBep;x%*5K<%f$J z|KYmH4tM&_(b&>VHTQv6Q=MYp700ob?|A~WJ5_2VoY1y>JjqN4RlmJTVW4>;fU8q1h3=4dfpgVC zxrra}2kOf8en{YD-kMII?7r9$^~J)EJviTa&;y33dSoBp8FsdXOmzB2A_H0uQXq%9 zC5?MAV#xAU&_^rVd^FbwLQ?t?{o!hZ{kgHdRlyp1=40s7cu}(MZ0M>}=&Firlchm! zx_#x*^RIw|h4IbJ&ucD6ClrM558024BVa4m{;}BiL`%S;};6&Nd3L#?XEcGD0c+G@zg0L zAOCv+?O;GY0%&Lt*+56<5Kmx#)=G6*MT4$vYGdMoe1|T>j7NX z`Z~oguEeR=f*=FH@cII(&!&Fo*|p-D{{(blp1+0*{|0m(LhZJ9w z_>{`Z?m&3CmDld*>zurj#_7(cPlJLdEWz_~!2MfOu{+y-#iYS*#A<#i)@rD>9|x-%4M_B)z@YYF~kK`pi!| zuoG8WNO|p*`o-JEH~>XNYfG86hl!XMu=~j_TAqo9Hus&p&B%Aht^_S9}yS7^>c?Mxl@{s+@scbhf}via1P_~Y52mn zQnq;fTTe^GtDkUwds!g=l(y(HfN)2wcuwxcP(23_wVe1ZI6o%N*o=t-g@!tlS8*-K z$sT^t<6N@GkJgqQuU@czOX8&gch*0d=(9e2sM3X^*)3ESxGasya&koWZy0-Gy<9^^ z`>VSjCa&O>{o>i}KR)L@=v9LpN&}?kdL~OK6WqV| zUsy3{Fv{BE;8Dgonxh0n;>7Y(po#>MhUM-^f6yp%Fp8>QGQo_)_aEDlE@NsilBQ}P zzPnh}w=wdluB?bfyyJRZbZ6NA>1(Tj`wJMo{9a^?q;$~2iQgR2AA++on?py!{SBDX zTDA-hIeP6Ep`*tu)1#l7`%XmyTxE6}aHQkEsKZ_hIPq^>&$lg!a{%=gGcx0`qWtNJ z<*)x0nm-~@NfTjRx=1Qv=t`~eR_J~`#quf}z^_uSNQ6LF=#JO z^rA&Tbpx4^YT>VO&`Wi1HvE0BY{1xJDy2bnQ8gqJ(tsW#fg4!6BgW!xr7?GUHw#Ik zKbgXsZYu~v77N>zCSjy_Sl#sVOJMOaIWTIw=#NC8j!|57`@3X@a*F*9e9i9I;U2RV zRfWI0ci+BYtgUU#v)!gPSd?uLFqmyzN|~Uvzq)I<>X9zh-2*wW)h9R^rp*7q58+TOApug0b#|;tp z{XYseJdc~DFtxp8JVj>oT(SFe)95@u7fr%$JqVcHe?KCy&Ub3LsJ;_Bjg4PtyA9u2 z?m;v4@i=*ixrN`r$g38C83oHjNPsDBdLW1;jT#u}I}=Os;`0`S`yxYQ=s)$9zs?R> z>6Vvt;RfG)%z4QQTy3_E>4aH!3AcKkRQBrUS1H39JZ<%7A<$?niz}HuQ_;YRXMr#b zT6F4x6K}S;ysEdNPii#)Vh7|06upM)VH5Wo0sWK0BO(Sy;JLz1>8&WOe^2X}EiV`U zne$9x*O2w9FDFKu+DRRys?5N8ZVRj_^6zrS$aU@0;8fjoVFp5pT|h?c)GDDs{2|He z6y6-pelzdr^n#GEY{dkq=c&_KslSL1li^*0)u3QNm2|uSSnK7eEdLyRC~>(jlE0I< z$*L`Kxt%WmlnPyqU$KsCd!j~X2dY-=#%7K}i-5QFB_^BQbI`)kxtBPf(s0|VMD@2n zxA)RtMnVBzX3E9d%<`+Kdb(9I%SUnH{CDxg8ABEfCma|4RwPvi%1_0Co8S!x>SY}pPB^iWxn4vOp8lB36#Crp?}XO70t{zW-{ z5dRq7f-$C;dNAhw(x@b$?Sz}o!Ta;Fh2Ieqsmw;0zEB#oC_3J)BI zyoX?{d-MD6ks!@JA5^^%7B?FZp`|a*DpZ>Sf6B#3F%HswuRDdl;-N#`DOTHEt{ADY z@QDZQWE5-cma*uZJcJab8a~Fc3+IdA*9C*4iuzDnvCtI=eD0Yvc+p@o7@IirGn@Ea z*U+k3*WAbT?*1F>Y9gxGKC~N>(OlBq!)AqK)J4cK)(NUXOI#_7e@%ZAJ6}y4Vj-8? zFqdC&v`*C&@+2F>N5zvrQ9q%lnRs?lC-t66r z(ZxL?Fz9#5gbHuu)kZM;aX7J@4?ujz_Yga{E>2$k}M zbA5b#ij2d>wkwUh^I!{Ic@?JL`E@_C$1M-c&IBZS<%NV+I`t8aozFnCeAS8rEcr@_ zF{EMD#zSagi9d_E*oh5x>oM&zxW|fySmjdsn1u_{>w(Ilq`9 zFECL!z067;<$b}!y=B2f@!~V6$%j^jy+lH97Oox_67CP*EwEj1Ho{xg-G))*n;- zlV5t-btf=1RPfP6DID!tE%02x*lMcGqY8fw0q@4uW~8S%T}BaeiBM1A7|~ZS-CD-t z7~7iRP4LqwCyIkNLX!YC@=bz#aai%JVHJ5yh~Cf)?b38|LvDv;kNEC#9K`s_K zEFqee%?-cItM>8kDgJ^AH{=}tuv+|J-|0o(smMuVNvjVYs&}0-4~=GV-`F`7*3XV0 z4ft9Onjm|3w`4`S3>+dUuc=W9NTjskD7~G2|8y+IB5+uIi5RurR;(Tc2z>sO-98h$ z9clK3h3mn-I@zEJX!xkvVC7 zKT`5UmkeQ0uaSJP7kln37xXWH`ZZ88jjVT*{(A0vD@1zp5$JS$TXKW36H*6mdW0Vc zxJg0kPN>zGVx>>Pt}G=Crv~!A0N0Q108doICVjhZjCv+pko&qV|2hAhp<-QTzC4G; z;HP`aQ4%w5d(hDD3hPooBq1Fm<&{!b&CBoJ^wmeD2W$R~rZ0LUckXrH>FQPKW|m(m zZmyL|Z|vmfR``-tev#KD=0um&DF@z-L)!SGV^sDc`2Kt}*`Ime z4_)nH$Ep_EMk1UfDnj~ulm9#rF|aXW9)gPIvf{TtZh!&LOw^H0Kj0v&|2YghI%B(D zvaZggQK(O>Yr!FfZc#elR=gW)y>ukcOv{n_nK47Gvi z){mY&=p5i?8o>$L0e8x=?Eo0Y_k|jK7jmvW;g^=O=Sq>cc>F7sJ~F%T?uILUbh_*5 zl;KXyRP*>1hujcooRp`dQG8pe!qFbN-eD|oBG96AD75^*Q1jNX`g?mKN_UnTmV@%D z?>egsmRsqFvBRP#V2%Rk)q5L7ALSB!Eh8n=IJ_Syq`#@rQ;B(f_;^<&gl!?9``})? z(<<0nSj;|X!6sMEC}q?2`)_T}n0s=%71SN^wJAqH5;sosI|C4&t>dQ?n z@+zr_Hj}3SdMR(_#Yll}lVwMjECBkWO}mZm0dbNI{;tg;9V2ZB#fc!LRPixAvifSq zP@pB&g{2;L3fCd+>b8H}XHSZI@H0i1Y*iY{F$qOYqY>k8Y+lEVbk}x`L0_(jf#=Jh zq5*!#Ms_;lS+yRD@V+Xe^R)Yv+kfi28mJf+rrr!)_-^j9@0c0T=K{HX z$(@+_?O<^L)VZGt$LD@RrmR;xqAQly^4JW;Vp-_xRF>BZ~a@yYDZ5Gg|hV zwC#WoQXG#;e{p8UciG@*^%0Yf60dn1klr-a6sC&h-F8`!Tm0Z2`LMV{(B)e7`6t-lD;?7VI2B~(2DsTF7YMa74&{-{Y_*ZT;kt|vn{J+<;EgP)K zcD#oIWA}$g9fp>;JgoGlF&2M+7Q56yKq|t0khw&>Wb#wI(pmmlL?F0qY*!07j-GNx*=arE zc4Uhv8FDmzHXVWmT`qH5sTcUf^gy#D3VC2egl{t#tU6@=0g-T}6^s!J?bBk|ugqLE zdEK*r+z#$^+g(rI_jLM~)a7viChE1(vE}HT{59c+p&Zv@Zca zd$5bRRmN&f0wx@JnY84K9;BFt<_&5=$QESPi)$!$q#Yh&z$Q6Ek z^ipa{Hi{jm12P0M*w#RjG#Pg9R7}~qDoa)=Z>sDIlhBG?q88Gh-lIcH)q?R9to?NZ)WSUHM(9+ngsL;TEaP zTR7uF)j&e`0e}jew}`Qx{4=z#L33)qSPi^%)SwlJd?HsMhU5r3N{Qnp=_D);3G{D< z;|S9Bgwrhn`NO|a50@MaWp?gsB-~B;->u0UEmT1(9xyW}f+F3}#J=O$oYbf@vB$x?aoqY{XoUTP#>-OJn!Iilw0(0EhwPY<&%PaH5V4|(y%O<;U?F-ka( z39B9YHIQqPHc7I|fOYPT4Z)4O{EV=goTkoO`UNr#?NB?1&{uaPgJ_sh``}s3f+t)U zr^>VRKiaN17fy%aAjJqXquZQO;{G!zU#!s)v(q(qt29u_T~$V61U!M6RY>V(nbHj> zAa%03kuta;-oi4=OYDBkk`^AV?I+tPmE6@(-P1@+Wmk>-El$4JGBLrChj678Xi#!3 z0?>V0xApMxJI5ohnLNwRtYr7&Vr`_fb|4%5StzLE{lJ6w!{qC8Y^01}=Eh#sdnT=ys60we)t!J=*& zOSHz3a-nQeFH@IX*AK6M-BLx8M;O%!lQ1oCSts;JG&H8^Of^4G>Op^Fk?2Q5byHmZ zs~-*CI51Iwg*L7w(`IT}aDuXfN9HAF8I*)>|vE@%M{;D`z{be7qcRMMZK4vLgrLh)gG*32GI`aV z3#TAtzMs;ldU8)nAV!4}031bXj?MgRzeHBk@MUuW(&AxYs2I;nJs#Dw^|KWL{zT}I z)hIX}J8pvI2Cx@zSfiUKXXjn1N_-;D%^fXMj9xC{2gw>S?^Q21$DSEv^34+AHKbRl zKpM)EZu8jjuN;b5W!#Lit=?4YKH+R7LT6ppDMk)Z%t%KFmT@|G`DLgPl>~92;d$C} z@rp|?X2H8Fs#ztS#!?X!gNKKwpfJHt>Q6Wb^mGsJ!gi2}p|j$sAdlcACycugb94uP zXC2IlKA(Y5XvKuM9he9Uy+(Vq9Zq@R{tzx+a;Y>4@b?lBdc8z{>?3zr^}1?fT)*fV zWJoytwKKH4e;2V`Hn#XpEt<&xlsqu7_p6?tI**~Ntiay*fj0@U0vSY&UoP|kpRyi7 z>_s{vB7Snt8%x>>Os+`4J;dbdUD!83tK>q2tQHo-2X)2M#V=S|;`Z5J&bD@bV2@t* z6J!xB50X-#BC8q0Q)M)Oa~x%3PT(t<$H$38O2W^?4D)F%RMq#y|qSa&8NdlLOB?L8;Mnmh{0b7KMeGh?uJbFfKGWvGHdKZ%_x z^K_mDN26DnZ2O(G=3nR55i%u7-^s&Y1Ac!ReM#4?hKO7sNpEY7T=6x1UWO5et5rmi zyxQGsWpY(r*c_wtKBMzu&nblbKotM8hSDidkt^!D zv%u5wZ3{A|F?hbe)6y9$CB2ZOm_JcNL@ez&B?+3=F2XWu0z*I&ZkT12+Xyi}6CF1} zn8-0ab75XAbLL}}aaZU7l#GQ%jo+f*3|J)F_reHRto0%e_hL+rptDPhJ;^Z~CUJdP zK_kAo3A7VIQB^TCwBN1PnPqWW;k}`nh0xi~Z4^06W>Z|;-o|>8b~jXVEJ*M&J0bkz z-#?@XrIai}Bf2Q#ET)Osa?#JMwCm+|3`H=`L?ABw(ISiW=<-qkX*3UGW4ZjPnjvmStRG)_ug=>Swc#jJWL~;_B94j}yMJ#(23q z$9~*6j@QIDi(ZbBG)STz05zmV#E@;*GiX1ItoOxSxLywv=I=I@?svhyQp0u^`P={Cxq;jdiSwa$`#ry9+x)E5oZPuG*;k^`FIaBef` zdf!sKo9$lkC|1wfa>7iuu_pzI_xXAwwE3z?nR{77MTiPd4vBfc5afAM zffc9T-5Q4{f+Ex3?YEKX)>G|j(Rk_P`O;vM=asmdL1`p@=Cg8iV${gI3-Gi%PUyRp z+A0aBS6VXj`8J_itZeoc}mdbtQjt}@nonN;iH3V9BL-F35YXplV!u zTa~G~U!y=iZ}2o2m|Y_7Jl%`2Zm$uRq|vnD3J6!T(@2IR&R2*gMZ){WY~X zI^il(`)7roOm9M8u;M^!MiqeOJclY!{qyJ)TYMN^tUn4GfL_!pS}?~NMq!iG{J3P9 zmQ}%EBG6Ty_vktvN}N>gaZjlN>#kG%s7edDv=%ryXOzJANLK7JzKyV z!rc6)D6!4{yl28O{8$>swf)#p(%t@|D~2*3Kyhp5uoiu&aqOSTFC#Z-%ZQw;2A|d< zLHBBD1|FBp8n~I~X3p;*Kx=Czp~wAho9RLt+QbMd`1rjTtyS#aLZD%tBFbWQN$@Yl zz8&OzeJ^NujpC{IB4WBz-g?p*6RWBVz`*FE_LED;pbb*{gdW-#_$mU=)su z`0$c+FS_wN50$(9Q%>IRf3ciSHRg>9xV*rkQu_SCZON%7ZZTpD&vt_UB#zT;(5;KDVK3gJ{AYh0MV2qg64^&7{ADw;h0howLsVx8 zl_}yry9GCmF4N9}Gu9=QLwG-{ls|_u0xlYUSXWkPnzZll|80EC)i`*IKePbqKwNfr zVV@5wnTZmu(utDM_#E=Pr~-*9=OOP4wON~Sf!%2;mRvETKaoSG!bJf_U2U?O=D}HU zI)dtCdp}zjQNYu<&~)m*fS=#^*vp2LIor@VaO01~rxFId;65J-xE44ZZ4K-CAwV>kkCJl~;rH;-vaQv-AmiS@vISfdAD?fpF5!eYCP!cNK3*q5M@HZru zoeR~(`9zA2j;=8ZmgK_1N%5aVDfHFCeV8L@+8WG;CF)J02+9KZMK(pfJG#v3{MnF3 zUK!_c+kkqsZr+e|J-O`Ayw4)j;dz8Zu_EI60tO!-9HVW`vnk4L2+kUFwcFS1U0tp` z2p`p<3o+6<9cW<;Sqw;S$+S-1zZpy-8wO7l?9~If#OUVJX3aS3Syxq5gm1~1^e=f! zNzC8tZqA~#U~b+PC*oEEN(5sxU-wYxgsF8FDMHR~iCHsF8ovk}*LKEYQy(#Y*iHz1 zwQJiA*WY$`@FGJr#oR3^zi9vWc9l!|cans9G3=yaa-G|g>J#(!Mc#&vsEg7dBg3n+ zG0Q~s2kTmsXsCjWN};15Z%B|PH?U|%tAS*-x`;Q3oyh-7!a2^-USI$Zlh;$R+j7gR ztoG{(U3<}BYKw>%>C2ydn>~#{aV!5LX`dIo>;#==3JP=w-59xSG|yPCPuX4^Rk^aT z_aThYHcg02vVs+Pi451Q;ZCTT-zzm`buw%k3pYU-HBAQ&~o6c4@};^juyO z8HJNrRM4{QI8F9V}elT<8a_LL*&%jNWh`M2mQ| zu7h6dNg-_MyI0h-Q^V(k)n_3&^Q>WDS!W1PD|p!}j59k@#(r6ERPzyy)o%GKvmUb! zVl`1}_ue{^h51Fpo?q_7%Pq!1_vD-L@OY;hwyeXsJ1fl8eTDve zY$*>tYe6O<&iU!bsMZ1Yc!pwh7-c1_qBq>^d|#mbFNXTI_OS%#I6kG1ooP0YzqWyP zdaku3+93RUuRBZD#;n4TNVib**ybV^lFO$BBb`_Q?Z~OAQB~%2%6t|-kY+sl=R@v5 zuw&Nq>rntLuqu`Y!>ehw5o=;AhNKbincO1PeuaQ{;Rv!#5%C6%A@SI%fpC56;1578 ztZ2wy<}aPDY!$d{X7^jY{}`s*wnZc`qL1$UU@ofdU?9N+v+f_AkDtA10#e?WRs4NC zTD1g@8|0wu`Q1`Nv=0xK4z8qWdwK2GDH0*I4}U%yT)H-L6ca>DjLym!&5Uv>zp7oG zvwTS2Qw^<3~FYs&Hip8@N)S%;Qip^mY19GFK zjhOUTA{jD$l6)znR3g+q-rExk+B7N`3HLQB=V8dyBYi7nRp zWhqOBlV`V)wK-6UVwMX`U0AAise{yq;8WFLjc-=YdWOon{%o=%r9Z*u} z$mqoHgZDU>jb2ZV&|jDs({$Q3DA{52!S;ee6ynuBR;*McqmE~6t`-_$gA8v0gGEQ^ zI)49_&m3Vb)~(%~7o=_Z5*TW&;_UQoxzsH@8_PpNL`sc+0Pv^4JmmM68E-nsy z%t0(1xE-)(q^0}y#j|9mOc4i{BY;=&L7b+Tq2uI3l@}+!s|{v+Q=5HBI*IkLTAp=? zbACDpX83IYi|3g()c-rWThCvb)~#E&{XY0#_}^8@3M(VpeS!49ATHj0shIdzzGuAX zp&K~;DhzeJl`gr}E}4j0+~5h`v2^7e1mm(^-i-or5uwLn_{RIpp;i=vBK2Z%35yQg zGLNl(fnW^RiGNss_{C?so31uNDkE%5Iz%eg!nbo2uu3pVX0Ly$D~1l78cVAau4^)a z(BJu*D%_`PscL?2I2!w)h#Pq}m)v9wUa<{(WFM<@DY_3uo$R@rba5Vgoi)o5T>-n8 z+|s~b_-mgWB?|<$l>FBGt<7Jx>kpU-2Zu%0 zA3nz^^YX*Xkhax;tCTYbDCrHtrO5f!ViRTVqrPG$DGRz}gaA%Alz>b_eMUxM*%ipf ztaUn}LD&_;D@bI3iX75VO6h+Zep_1f7}J}Zwv>QT3&P*`nuD@}@exAQe@C21$Pb(l zJl25vho`6UN4E8+z0KJo*+y?8(0wdYFFgOt5UZJTCoe5OV>2^7d_Y&Gfa`DA^DO6j z@^gg?T*afYU@byM99P_No1SM_@x!_5BI@D*qvDs%b{T?$skSiZn0AS!-VgoHzde)+ zXmbnZdg!B)z39GaNVyDiq8rjT#S7wiGurpbzb5zdO8{k_T8NJH=^_gW(a)sQk);u*>1Fdl9 ziH*OL!{hZOcv*tRs3JF97_|RFUExB^=8+ejQGeEvlLXXH744PK_G>KLUtWdN$-7$R zY+2N*bedo+3ute55fCM=C0g$N()~~lv!zY={TQq<@rH^-~KI zZG24}{gN(o?=2qNcs0G{W?%)>;3|3T2Uo&8_MOLtleH#uS6h&GRirvfzNfrVM*jV9 zBmXvnWYXhAmI&BnUVwHusw{Uac07cHgoVYU+6(hnFL&#?>(AkfGh>+?WmQZp;dpVR z;4?tVxlcs2u2UTEWSooRIf@&g-eGuL8uO#zrRw13RZC^@*^7UW)YlO-?T2TA6x#Mf8~GZ2TV#@fXs?v= zd&&{3nd|tse__HegYb!Q>|%rhZF_LBbF|^usdVS;?6#>U^O2tGVXFmydtx*#eFe9{ zylj0Wg_2q5U*2mJHXHCM^Gh6w&kg%tiQ~qYh{AGT!3ixJJG3V|`o^Av>b^fk=t-gA^2M&Y6A=I6f5Vb;+{u0iPWgwSB`s|_O zTyVDL*I>3DtO{b5_bSc&;S$Gfg~W4q?XAuD!_MCt;b~@@36=nVsx|M)&c^S5;Cvp~ zSWGU!JJ*ihGabzq5l=s%=P8zwc2*f`s2O$KeFPAvzEYN ztmbplm?8fjuF1iO`}K+OYnWpj^!*_zGZ$vq4P^ou0TSVvog&wS+J3FZXD=-{d9wlT^&SaT+01e4b zrZso*yFk@o7m7d8Q0x99?8uKM(m}D(;U9CtTG3Br8jJvc+=PF)Ms{#THQ`4t+tv+| zYI*vrjU@esK|=)y+8DYs7wn`qtUn?%smrsQJ$lPUK7q3>E;3o~J||-(+u+8-_H}Vh zzkb1cH{6eJDU~=ll~`A3Z)thzUERS>FAB{ut;>L*_+Z8jI_nnGMzbS#STS!;{O*-U z=Xr#t8}|#M_dRE6Y1lJ9ii7Qee)b(k$VZgxI~qw|nGfIlvQN&*uudyd>~v2_pnY zr0zzvOg3}L18vcNuFoKwU!J7=%`&d(J(304hW&5}mJhq(WCs&MrWI9W?lrdl3%t!l zdX3e2jcul<=#Yk6U?%J&1rQQ^zTh3SrgT*QKLjlr+XzRCS-pu@QOqPLy3elMKxYyH zOr$S1xjYI5`PZxE1+7L)lLy{Z7*AK~HrVfnL5~|IOJIEe<1SCPjai-$O|ILQwScD+ z?jprd48KkI>xGsst!G}`>?^NExH6|Q&+O!?2i{{?Rg&9Q7~b*}N*^q5O!E|cE3@R* z_&=v7o^;e-6#WqGHyakOQ{OM0nc}BMtHC2D5EG0CnDh%&{317gR?&w_0xGa1I`o@i z0Qqcs_p`-Cw`!$fd)kE1oq=A57n?tf(Jv{@^RZn;N7!Jpp?5~5MM{z3_!A4ROQZ6B zIWkr$&2foFqXUEghbxD)m7tx5FJ<`L!wC3bbis2`*v~z~T2!#udFrl7i~ThgWvMP` zN^t?nt@pcx!@>gGBih{>+diw2t`hcK*ilXQdU%TT6k=-(QObklA;E%}p*v?ZA#iHXkQX!*m@H_hH zWEEi>iLc!j-j4^RE3h7dVM2_jMRLjghA@W6(0eBpLK>6p*d|Bli~ph2^dF3tK0p$= z4@R56hY|MFA|Bo3=t9@3{HI{3eOZ&(kk{+O-e_1{g&pbBzoBDw3qfi<4A=tNd>LjV zfQ{f*p6_YF>8T?T1>d^a#UM{tlJH&Yq?}>Tz$t-M4*3O^O+z#81m7OfW>H zwH$t;$NN?fVEnn5M9zYhGz4MW*^&}gG!OJt3=q>mq-e?U6wLEjwz-CqzWobFweHw> zy=_@Z#7zE+IkKI~Rqax{S{%HE{E>_~lbP>vujH2rGl1s3w1a`5^2bR1ZP(+vA$h`d zfC;Dk-y0gZ>dI9d!dsjNf%DE)EsmM*#s=%M5ifu0$KAPJ#DnW4tRgQxe#MH_&klMH zc{(sM^gAhLI#vC8{vWr)jFz?`6y6u!gEQA*uC!lT3P z*Bh30^Wzh40U2XiSa;TSGXpG=?J09;gGqNj;yuL8r@iweLWd-^zq+qp)F@k z2HZA4hFqq=UGOVnukY~M%P^|Z?Ccu`m#Li(HX%=(09U^RJOO+!uW>sgiI zwcDPe1YAcfn}x?FI^k}#W;qytq5FpqIzygz7BEizP*+7IAyjRbHOR$w!KuJN6;F+( zu2PqPlGz*8S-ABPX)#wNZY5|VRUlrjK7eNOriuiWEK5w18am9F+C(=F};baqE<72u!Z z%X?s&j7gYb^Id`9&rL9+VVhr#$=;A7_;6^ zdnZj`2p=C37w*YO#yM@$HWD_n$*-a)(Q4wjSVui;B7jfmiSxfAlkJF+1muM1lTflt zL0B=#flA+G5Z0DRl}J@j^RgE)|eaEzGso-(oSUmkB*~G)YhD0#r|3O^as8vD&%j}EFMvH zmEQn^5%~t2?%pa;Z1wTxXh6g$a2hp-gSVvmOf0XA=-1N4+H$aU==Z@Y92W1t3J}b- z@g*mJSOZd_KiDI5JVAdyKb-1-UB`jFpJ-(DLtnD_TwyR0=I{3?Vjc9WvAmA}1!+6c zevr2)Vix9)X><)ou}xb51-kZE=jnS`Aq+{0KoU)_L(3X94-|sDj0O~0-|&w#QF&qp}WC2d~AT}6RcMEm^6He1fTrRD;SH)+i4~ZnVHa8G0Tt@{A7*JyZNp) zeK(q+x>f-j=@9jhk2xTRSM{cFJuul} zVbH!|$gG>I+x>&|9GxRy*6<{=VozVopSM$XtCxo+u3{egS;x+jMGdo4?b+;ekCTc z?)l>t$0JG^t_G+10X3}8VIh*cq|f?eC|z}m+8^gPbO_MmKJe`>uzmtIS5s>!z`lU5 zI@)r>NTW#}jO2SIUf-<^YE{5i@RYWZeg5Xvf8PHSJ{9X_Ulj@Q_x!%`^!NxlkW%Dp z#d1+VfPA*ND8TR^9-I?}##r2U!Ds<+N)tQb>RAX9+<7R|A;Jhs9GCN5*B13F)SMPtPM8ScCX`#DZH5t~UcY{YQ&SxCbv_MRF!cnin??h#H)ipi- z?eY4KtyIEztg28qX@>75rB%+Mk)e#{-Thk}^Djp6^|SMrS%8kOIekX);c3|wk`|*M zXmCs3jP@6?|3~{Y0-Gkq$Sqmg_9=*Fv)smep911kIhl!0z5CbVk1wrGUZtngGoY4y z2TtB02}~Fz0;@Q9B`VHezW@GT1xL#C_qpkD;ogBUB=8OIIB#v8P&N)7V3so@*j%>0h%L8u#RMRls>C7(PX$|pdG>3chImD7ORO@hvr>7 zW&XMTLPlG-bw6~8k+@S3t-7+aTk$`}kEO?hJpbPW4vjO@v@(KDjWyQH6qZZKJ|KVE)Jdh7wst|Hv>eYyse=B$;QR;z^#&AC7Lb z48O31|HdSQobkL1(tx_ebcjriKZet3uywxxpsE7&U$+NSB#C>h3}7qT1zRGP#GA8F zjp9EJjFg1|MG2z*Nz%_h@x4Qx`+Wg%(fvqM|6e%wmA&U%>t@S?G(Dz6y%P zjQt#M+C}7TUZ>MOiCN9@AH7R)aV;obnswnr5kXl0FlCH1CGimgs1@Ts4TlY;a{>r6 zu}MvahWez@J=YqWtz2W_Kc*5UIY#2D@7Lsnvvv9DU&BD&hkDPK|7Y#P<=WB-?50GK zp#)?`;*D_pqn0)5Df$2Z8%Y{qwv~bJe?7hrO31HO)}F<#bB_HDtL80KjB+<0*!}e% zu}mX6zNTV>#XlE&@5>j#Vs(d=f!V*(bJ7B8*am?=jK63m;l7jUXI=te7mQ`Mg zTg`)C9{wLsUm4a$w07IlB1MY3mf-I0?(SOLwYU~{m*DPN+@&}K*WwV|i#y!(ob%oM z$dBa7%w*4g_Pl$&OBNvhmAZqp8SM4zRZOL-lJ@mq{%65L|LI=`Z^Yl@lOlVC5=yL6 z8=n|p(C>;_{mlCtsss^#ob$4DvdQJ4XOb<}f5%9s^223#X~iWS`^Gb&_(y1A*F@7WNG+1}q~S#hN!N4NDky8oZQ01Ban!Wf zG{Oa2$pBa}MCU(D{TBvY<=(}1H9>4_^^s+*IR&=i*b%B6>#`@g-P7iUwupP%Mml%B zzG@69<=#VT8O`5`JdeJ1s6k8sua&DMZtkxDF7Df3yr?`PQ&X2_h162b`2Aw{ALlGv znzdb|{IFN}Tlfts^5uR)K!_7>BPtB|#Zop=gKtR~zJCksOtd_0fSUS83MYPD1?K8fIa*^id?tAf+z7Nm~9}DCX%3>DG;CpocD14fFnKv(# zOEz=g6kqb+PioxV4l76bjM3CI=Tw_1A=$l66}jJ&Q09(YlX=HE0GYWQ2?19muVs$t z`pho8)sdmLrw`+?6f^i8$R(=nvH7v{2(+;Vr)3^Kb@3?S8h=J9YXUu#vwvb(TbWid zE11lt7qhqQe=JOGrqf^TjFJ8Qmc#A`%0LoojLIDAW{212DtVzP=HU*wxK6Q6sqoVn z-1!{Q+WAE68%*@Dta#Kd>!&bioFJo|5=mgVo3XlxKl3c0RGeeL@VDly6ct@3F>Orj)T(7ENLXuBS*6ttoZ|cy&tUcqB+h|tdk1eo-8kHj@b3X9EbA=%~;j= zx^bl7L_OMSbdE^h?VaR>hGfa6=cWfoH*?=h5s*?zP!`cJpM% zYqjuQh?9Z1q+==A<>2@yOodq+6TdeQvCAhl@*&1dzBN_g*Rh3*#U3;M^(hxc2d%H~ z*bxu>@@LFAMz$}HscOy&LMsW9KJ!>h)WZ1SVj`6-c@`o}(cF5!fgydSj$e5)vksYA z%Qu0MCFg&M-q_CCsZHFrEn;@^t7fx@#r>MIuat9Wlx5IF#JtiuAc1tAi4iOr-z~#a z*L_&||K8TBzN;##q=4v?bN_BfQu$%U6NIL;iu!_hp)&ZOVe`Mx;jv1-As65I0%MdY zpcq^0?Ng-7x(kiE`yG%hO{;v6ba{$Pan zZ-G`Ld5JnhzA1#o;E{3z1(Rz2zKWgV&hb8VQ_-=Ckz7^sQ9 z?f1_z`TF-rH%eNBbl(&+&Q!N-$PmA5!5#^|UkmQIOzPoSKE_QQe@A*fsCTe)+dlmH zv(t26()BaTZ?VChx^lV+skLE0%_fmJwMUW2^ufyx?Ri6)Nxy0(Bmn_z_>VugaiF;%p@5&8~a5 zY?S}44Lt2$#`oPo`B*;Vc~tx4D{4U#ire!p$}{dg3hPy&{>|3~qZ8F3@ISb4%4eT- zesNKv*7wZj=(g71cTVChf-)zb4dMn<&&;k-Yaowp=)eT1sD+MZHaC}UZng=q8$u4h#Ha9_{p2j2gb@I7vZDb6xjcVCILv=O&v);6Uazle zXiyzni5O~kMKjtGE80*|0w7l246z@~_Q)XEjsNJcYg<3`R^3D=4$`nF0ACI-+wj}jiM=0}I%#7@dRzSzS&bRjOTkQvWT!EP~$kUiX z{te&E3aS!k((#6iSmv`21y2TJX5q#pqXo5ce$_^#`zK0rw#J1R!dU$o3?k4{TpWfC zb=cna->FrHLDOJ z*j`4l&09#AkxbgSE~H0M_|F#CWhaJnC=mT*&2>rNWyABJ{JYgwmS8QQ^AnaCEGMS=A9`t= zywfbCPpslVgFNo8+5qf+X z8ildZlOe;&FTZEVCj!70kP;Q_R9piWBP%~5BT%>6V5(~>_(<%WocN3O=L_t0Fbnb2 zq{c4B?+AcD3tEVd!3Z}XZCku52;mWe8{s-MGK=g8h!j#(T8>&Dzss4UaDI#W4aIqM zqQ%E>6nA*9Sai4&VwX&ftm>dv^wHkfucbA{UQerNAt;EBNOk~NT_v6$Le`KPDyzI= zdTq*c{)3GHQYXKsW!~ITQR7W~1XL99TD|TZgc~xiwSkD_FYHeLcw(=d`FBg$UGFQm z7e0b|mwc@K;ei6Cq7&(N{ycX4SUs<24oBmxQ?@)J;kpceX>t%4JL4h7PsS!EkC3M^ zwefy}BvBpnt!={u$5k(q1RZ97&8A02j+^E6~8mK@uBm8jxW~h(YL_nOQem%!X~A?W7y9NyTB1*s%)}&5`us|D~_#?5rrLc_!s(! zXZuhB7JniJ%dLU_kkH!&^$nKTCm!NnyUC`14&Exzw{{)dgMY1Y3`1fTFIXtukb3R$ zOAFc2iB0p+uSQHQe`qmleDl7azFN{3wTXSfjLEu3j?{?3q5>kV{T>#Y3W_nJU(&q} zkKRVXVjm5&Os-3)s~(BA`7QDK)_90IHwkMbR;(gbER!ztI~;Dn=qr#r2RUGOsEazR zl1=Ta)vZu~y(dpzW~#d?Lw0_5mSq0|2Ye;A#-AB?I)}xE)t)GT|^^Fk`ynM?(~A#(yHqCQ~pDtOk>;KZhg2BCpoLHIgxLW z!7>&tSl)WDp=y0!=b;yAbQV^Xxy{88=r%usGQp_Ga)X4)2 zL?Bdk#FRf5hDRyD4}^zIBu;0V^(dVWw-h7R4r`J8Io*vRmn}+)mY}Vo|8^La{_CUf zB}E{!mCTR7mCPReimdyS*|M9j=k8X=^W_}ow)+#AlABM9Eta!I`xgzm^`;S>E_%!a z&H7<*+;9@^7lpx~TSi#PEX^y+_tAa+I%(AKuq;QzW5}v%;Hg4%&jL37(1P>b)5HrK zs9^Jay_5i3J*6~SY<0yLTP&Tsnrp7_MLO{?oN0M=VJPgo$s5Wu#T~yQ&_?X)^YFpR zTfiUAHQWF5?Hl-WhS$M~)qZtt@zEwvq?bVpYt!vQiE>b$$jRG9jrJIY=z4lE1?Tvlq5W92KZW>>EK|%HJ; zbPBPQzSie~>&;ZC{yfJdjI9-#8frrYmdHT}1_J%Xh}glyF`qyQmcbC(B~^ zz#mI5d@sDO+H?Ljp~V11D$b!{seeDH7Fq^dJ)3y6Hm*HcKddU0+;Lt=y!j`h6wlNjw200ODpgHTg^agzy?|YEx7-yFl45by3 z&t#CRUpUnl-!f%DIYpZSIi<9~ano<|JlZ zzizrhq17sTL6#fE=hKF`nDT>ki<~+E=uQ{iZY?lO|G`i{x`|+o$hR9Mi|tVLjD%ZD zoz%)Y%m9?z^Kv%}>5pFo4S>PVTG^H^q$-kxNQz;FgMi)<#+(A8mrZZ0tylkorrHPo zYVHTkMwi^&xq5xZ{Jm#=8QQofLZr?k9=w{Shbg1Z#4> zO`*zNGKFOrzxIQfgFO(b>8_#Pro?0|6{cQYPHRLP4_^58S{1`QZurNCDm(@nUHPuU z-LhBxIA_V{7Ez*@C`pq_=F!b~%QB9>qmD9&k#!h&^{Xz9HJDt2X9`JBaB|;Y4$3Pl zK|}H3Vx6#Pism~vP&S7Wq$M{bm8_~M1vI~u`|o*O4tjQy+ma4{yeTBe{~$J0E% zC?-P`a}hK)I^$l* zT>$Qj_#SG-*J_AcCSKmfhDM%6Yb){n;kP z+nE)S(28ovrx<&0IhXaJIy+#1PjQ5S}tf>Q$YcZuV1F+B~wAg%X zxDtQ~|KOn&MYARVYrDT>?pS5IiwfWzRhA4+D&&sLry$sN(`lhFNIrn&lXJRTwg90o zeqE~#&+YBE1ilQ_LzC`7>bka0IRfL^x+Mee8Sjm2qUr=acE2!G(&=1L`pCbLKHy)cyZb9=oc^06j|YD=bg^8$+%>&Z((plyfo}B1idX z{;5>P0k~Jf<&GL=0$+Wk#R=DZCcft8Wv`wW0_mydWUkgCIcqU znmU+q2p|D%yI{cQBGfo8oi+E2TyhsuG=^ZZ(5Muz0=bUx;SAi5<$NvQicjR3t>i5w#nwds<_RD@nnp1h|o+Up^q+4N~MavUCo+j9cp19rsKE1SymKG1bq+ z1_{bv4u6&V6i;0;@ulsG6`)5-`xkCMw7I&@*GXuCITMoP+IBJ7ZoMU^*H#S`RUJIZ zZ(k0}9s+Rhf5{zqhRqcj=18$#aEF-ddl>&UJ6vY7@r@O3-O$d1QBT*5j_{z(2%5 zdld#fPx)^{fuNMx!k!n<_+$bze%cO%OX1ig$z{--X=kwTOV%#a=5d#+t7+9`(d>PT zT)D(+Aq@#4n#k<>x$n?JZ^pYyEhIPrp52LBwGQ8G`bwpKRo=BGog|Su!!U#1NEkIe zxiN~dr~UKJYqxHV8DMSuAglMGk&cdNq72e=pe4D)Xm6W7C=B9-T4Qrn5jqYZwnJf zIXM9c97;-1R};&#n3kPw>wD|*W0l(dlmkOP=MOsT`L|4IAd&1`tv9=Cm${_ub%>>`x5Pl7bHiir|z)!IgTv%sKA)eAqC!dp3x^#*= zO{5B9>*|8&7+4{^cYDSaOZ!a@QX)Y2B8?+9O35`Hk?LtVLjW=iMkzwA9IZ1>92Oe;S&| z-MZc}IyWV>ThnlD$WnXcB9h<{NgnWPmZOnBYvX_fc$C;RuLs1gJMi-O!N%>IE-5!P zW|&X@iKY1Q46cKVet~xaktLRngX0+Gso{C3^w09o$Iw=m{iDC8v8Fd?w)4uL5)EDzXy z^d7>4^3cz2u5og7qdc+M%6Dyi$=jTbY|)dg>>ld7G{%bOXo=Q?SR5x_WB0dli*u}breH2DAv%n2Mq@t^O3Ij@ z!rT9GP_@@?PnJL~>;qdvflHTL`f(oehzyAekQ^DOO9c_RHi!eRU#<3KBfG(BP?Tb4 z0VO=tN<-MI1{)9Rmwx&Ws}4O~oeWG4sSmkV4eyeyetv0BTztY~kYxV!)_}zH#_aNbv9@>EaszeC5ax6OK&< zec$!Qb^Fz6X4r}R!WR5|t7VHa{vcwO!#tU-QU2K0C1%wzm6|`2tbLe`Hhat~-K&M? z-Q~NkMO6F?rD|cs2x6U;Sa!glR1q7_gFADIg7glZKY#a>L*lNZc|`aqf&qYAf&$e3 z=0mNPKn@hmJCt1EVL-e>t4iQ6De;+Fv1kfOd3Yw z1HH|QJ(mRTWxac6(W_?96XxqpsbF!#Bu^9%4-fc;$4pOm^|e#bf$Fojd*QhQu{5iLV2JtK1@o1fTd_)NE;-%C zL-K?jTkV-w1fNrdEl*TyLl;7J4RoBqt<@^a$1IP=p);sD61id)IwD@GzoIhk9*vs{ z*)HSF&>1NC0eUOeBi*vVPrf!vV##T4W`wn{vPT>a_Vqh7N}jXfc z(6WDB_k`gbb6d&4N7LH|CEqr#s4hy+9NNCW-k0V=Ziw^vmV;gn;z`+s<>V<}>`E)Z zhhwXFs~m7JqPqN`E&B52`Yda{TztFr<$`tPrh9YZqXcmhizy6@WwW0C6(0#&&DR9y zDru(5=#z9G4#jN3uK79snC4YCWFC)F`<231LpIu$#H%%m7%^^mS?!Dr?WxPSS^Ff` zMo?Cl<$e)&GN?%zZ*JZ%@|q10m)K)VO^qvgF`U}h^REBST9~K3Hc-Y08*Gi0ZgnCN z?a{QHTD-RtAR8FX>{fmq|a(3jfetX}*{?qsT zKJbjmN4U%IXVbrVve<;3CdggJOSg@yjhM+n9&%3J$p-SglRk+GD@}484IZ`#-qaVa zDmjBD6cZAhda4`u2~&pWjl!;l zirVX@EcL^{QrSzydqLmuWd2)Rmb{I?4Y$r+fa2WT#WNTG%{lTMzeRWM+tcK|lF<=M zCg@MA<_OiqZ&B7Vpa(zlz;FZfUW{RmaJJ%`O3ZB5&Rx1%ovptzB2iGW7B~!&=EhG z-1gP&Lq6UF(A z5tK?r3On}dCOB57r75$?reJ%wB-cu|Z=_U!^DhQ|2M%I~!Rxi-T$gFGx6=hZS*A(U zF?r~EulN2+Z#IG?{@cbhVINca;5#t!jPT*d*hVz7KM9Ax{8@JxzMW4X-q|P5t(D&N zWSH>0$_SP8f`XC5h25*Xol@|`u#?LuuO zt12X5H|><$RzL4tTNl^ zS`sKp>qSCfF1fVKE?Y&rJfa_FsZX!4lRg3qBdoDu>qfaMroJ3#aopiRv>y@+j=+tb`u{; z96NigRTp*R?$rA?KQmh;YKS_e@oBWQ%wqv5`F(FejqYoMhv|&vph-N#Y|iSPDuZhA zRij;5w$`S5?iJ#W8|=5bu|beSeXI6Mq;E7otedAqR(cyK>V zPb<+;G3!H`@-EyAV*^w`T9=Kj6qnJhiL0NzCDW7Hr?~5sv)b$LzYii}A2>t@cMzmi z8nu28hfgQ@znLuYvBzkh2h&kqG7(euap9OV@0ME^{dQs3=o1+-hk<2o>df98Y~(oW zGI@~-pdC8b_s1|ATbW8NM@zrwH+K}Ji5eF7fAObCsTU?8z3e+)xaXHDM(|e%@xCbi zeFcZvv0^n_lVr8>(Oao;Se9DQf%5q9IB_Xai0N1@yMQXQk2OU7CTZK|r~;hL7HsIB z_Q3;ligxuY+6>pNrw5#cEF=ju>I1FX5JmoH+(P7at%8IgNaVD2B4kBdRB2{8>*CcR zmP(GG7hr5ziUV+h)7S*r(^KD_uDeJJ)O*?1x1Mer??y|h%04GwoRw^(vr=u&P}gQU z?NvfTQn{(rBoCXnpN|&7CO3``Z1mK%`NDjE#4wMgT&Fq8aT`_LcnC8#Lt;nH2hZZW z(X2=zG$zzv-?Ep4SlX^LH&R7sFEakj@c+6SjhP=Pq|XdB*>*j>YZ#H&E)8M}Nmr8S zCm{l^J15Kk%L}85yyBZ9(XpN%*h-TQo{>Enc3{dg@v%48bpqG5Ier!hE_~*oIXdMn)!L+gq+kubH% z%Xt(3e|dXT^5;GEW3G2Dt7Xsew#QBY6 zq|JGCs26|pKXxIb{a*on$=UZ)Bl++dDPGbei@s<+svQZUY{)qOqbu5S6F`!O*z8u= z9+eRvaxoR?C?F92$@0b06#^@X6s%f4n;BJ}nio8M*W34q|I_9L-JS2s_Tj@~>=CJ4 z-`ys#ML7O1nGZv>{}&+4Yy=gmekM8M$ENT7sNz-|aEzkA=V_sK_uf0@AogEIrSaG` z2omn90MY0rK5#bW?C`by?L)AW@)YnmE-x*z6XAvatD3_V8{W^X&LJ4%8~g)5E~LPg z`T@tzmIGV{RSy#!!FxF)><7t?jfYvf%-nnlHMnnI8tj3KN4$V!x!&wC`fGzz-Y)i8feFrT&FfJ+BI+X?_b}YA?f3hiG|>&-vTdY|RA;8jB0G&HsziP7G2zzp*IHH03; zQ?nyU+~p)FzoIn-Va4g4;O9b=dg*tNJv_b&$8eqH(EkbF#BR2c{k0}(|Mq@D9)J}6 z|Ekl)7ALmF_aOmN=_|-}D=~1vW^K9o4LBfjuDc{vwRl__^MJzvVgr>weVYGR*}xK| zeZ+~NvpB(OB5PF{#(ai|(lFf}56QlnF4h_{f=Eb}x&NuFB72ylWil`_M$iG~t?@!V%ei;eB7sr@vvZ>ggA&0Xm&D= z{fbxPRW6lzY$K)T1Rc-msEI!V2i-0S@3&_Nf*!%rKQ?}VRSj{1Af1>l5!mHIaeFaUwtbnRRKeNIz@KCe>e1h@#B>Kx5WZm(T>@qt$#^iBW{Qw=)2AU^+1(IT z0%N-F4I;ZrtyIx_gcuS?(%i*xZctezr3d~k`Bc4R-o(_!ngMCtt}v5NVH z-zB`fgTn{ucB4rg{PezcwCNjC2(y(JD%&!KQMLJx&S{2neu8z1kG1=!2yR=byNQtJ zPQ}~beq^A68{Gy(?>De&y>M+@1^Hi1If@v1Yov1M~k`+DavVe zhsVeD0-}{U*i#F2X>eRU_HBDuPiGGPw1JHaPJqCPlG@y;r}DFzA0P-aEDXsbjz*%! zk4Xs^@atb$--Ik*WGlfuOaE+uPpSytf!YzML#rRK#?mH^gWOQXhf)ovgP*ir%6QTw6?>zs*f%@ zRp#y?mV_dcH8kFddA%)XFzpXLw(UPgY__9`hwQf$G~Q>uiJt51i{#F&0+Ah8@)2}Z z;_zXN|nF9**Q(+ER!Ln^QpIUl#gqH`7n=117J)olr9mWBeGt zt6nK61}GA1N5o$-8l6in%k^f?wFG0ObuV})`~Q@%ZICVC)*D0gxCuNK)aOEKE#iB0 zVJU@R4L-&pUaaq`$K1VVA5bXJJ-aYhsH2Nq7`?KXA7W(sDu_YA#a=$wq1C(zKu+K6;K&CVh9Zzh_|HW9|e9K@|ISe^=sKYaWB$x`7(+Zi@Iy|C5CT+~p7sx3AC0>2~CjedbaB z_d}}4+2iP90wmWSro#U|(Hl943}ABbC}e=6ve+Yq6_*Vsp6cFHCh;w!|EFi5aGvUK z<^21HX^jef(a&fozcBv470Q^_2;+F`X46p8|Ku2vELdJs{}+$Dvu$+jWN#H+T8+PX zQfB;rYL22K{{PF#wSl5fyBw#Fan*|9lHr5G{NG_^Si#;zzMI&Z{;5j;)xNkotuUdR z5BS&+P%pad{wF#a@+a}6p{-c|FVU82=i@fq5P|0aTl0T)6$NDFs^Rvr`1kx8q+R#_ z`%SrIZu9?i4iwRo^8YJ)&`XX!v0A}bDgNhd;#TS+i~!czg=kMJu0Fqt#K;TR&&n8s z|1JI?H_YP=8irr1T4U6r3+G8&rg)CW?!RMO5IuxMM*)i)@PA3jW*GKZD-px*QybnN zbX1a$HXYn^U9P*5!i+|^Bfdkap(txCW-$kFS1-G|PP9MW|5$3QLB(LoFC)YJ6bM(A z7cMi23zOz^&0X4mFW}&wJ$JD7<6;dra6Ie4{ldGV9rEgEZ+|+fIJWN`nz3ysQBj1- zl!p5jj3UyW={5r=3SKF10RIjIX9Xv&G=+zOf8i}REWnWoAXLys`**bXb0`s1?csIob!3_> zg*JqCbjq{{MO3=243?!5k0>IkvuwqB)B;Aa2MqYJt6+h>?Z5U(q3z2x81Ufqsm{Hq ziKdnAS3*0AR=X5HR13fSzZHvcp@~o8xKo* zOx>jjB2mU^(eo3%pPQX_)p;$$xOaqDMJ0QyQS6F+O4ns2_WIY7*RlvL^Z^3o+TmDl)`a=(55idGY#tX`#jjarJLi4oUT)YNKF#a|UHmy_oP-h~`l?r{@gX4a zDq4uXDx&hFDSAkUQ}PLRP(|sZ>NHEGdeCPtKg;r#qfjdzr2fX#QxTPTV?8F$>H64U zHg;Zj_zj%WneaP+rOyfVH%v0stCEmu~vfVM=+)(t4HvZuwcZX8SdP-8*P(Ma(!ayN2~) zdF3i=o-Zz&3qBJKjnG0rQ~*U_rsoEqS#B#gTt~;xD!$)B}!rNfxUnU=kj zBHCtC*x#3qvF=-7H>%Sl?MgtbaBYflzE_J|<6j2c%Skxji%}sw`)dC=0FAw6oK9<| z1Xv0|%P1cU>r1>cW2R=L8pub{h#=621gPtY-MwA9>}TTdrmD}&=&+yEDwM1MkeEf$ z3#75(BnQF_X(>7>sA>D3`3^y}k_%LV~w*BP5GtKT_8(Sy}nU53AqA-cW5Z-kSJroMMA15CSkkB$#=gLS!rO^y}S9!MrsghAf zqDLwXAK`I{aDL&dC$eEMH+{GFw{31!vIR-Zfcs!V+%C=en zAElrY=GpU&7vJBHTKO9Ql5P{_7G)MQNOjtR2P;+@<*>ZWDzvbwSqD^4fM1%FJukk2 z_LvvgX&7z;zibzP$Z1ICFiSAyTN;+EGABP(CjY4E_|VI)x}6p&3GFv9XJYBE#H}@^ z=PGxbJPt0GZaep=u2LJpAhB#5i(H`dgQa_|PTYTE(>18?QuepKb*j3yH3iDaVeKAQ zE{)OKQ0}F&t1ez?^(ryNgq?!C8q^UhDz9f9`7LflY~H-6&=!kp)e^gnrQHNg>sCY} z04Y~SMJF;Hbu%nSv9c|JSVI;)Z@yO@g8Dfje0+R+@j<(%=mM44)@w?3JC^CT;vma? zR!7lVjp~rATZbH~f<2AKwV~S#?RG8&f~e|)h(&fBaKT)OS>s~3JfCrvLlrO}Qd_;G zxCCl;shxcKk=SRmN7l|+q?TAe{@~j5_gBTn7Z)&U?MZ+x@)P@}S0;GIRdcxF5Ghjf z$}uSMkIIics9&3nDt|8{$hz*19{D+x6L>Gs9v7{8fB~3ssm~|s38Fx2ZKBoG!r7_?L+gt zy<*Vv30t&pW{_=(l}L7PQQV^N1aHSjb;pkq*?~kB^PoeP2??Hp5@29%nm8V%N<5~pjqX&iR!gGK+mjPo!|lTZ66kS!p-g15qZwAt8_*^ zvW4C63CF>Q3ktHf`tSz&kwzqgBfx?Z)p&*})^8ZF*r47T*j477)-(9>YQvO? zbiw!g2zQW;!Ogg>H9kcprAo$|#AriUuNvQR%mk<6L$jD`SAIpr+T}R*Naz_>={={l zPSs2*$%3`M^&Cn{#xvX!la0HYpbpI~k@N|!V(58~>RrbTaCTKURmW9D;3dExXz7&* zW*+{lAej-x9J`2~Ps%cj|4ee!pdl4G%q_+6QaJKuQyE$28{*gcO78WnFsR6%i@)Z# zOy9nOO0IACJg0OA1bO(s>r1ARyOn-g@>8?4^lUtb;V*Zh6ewRYRuSK2=S@fSUT@2eL+; z{6R!dZG;mQP1<88TIdL07n@~T z5dy6;jo?BqSW<=HIUBV>=ihbwWNYn*5tcgA%K$t27Rt5ce^IebCz+fDJ4~IUVYWpOh*$`b}Dz3 z(L4m{a|fb55TY9%y{US(7*O$vDL3a0t0VDsx)4=nT4 zK`Xi?BW-jED}wR3w`b6DWQ(hdKYl7txuT-iby-wYsi#w$c%@nuHb`nr$K#^Cj!f|F zTpZ$NQLAJ~-r>+9vGE!yewBPCVOGA8F?14Uy1tUQ_QRj-UNP0IkdqW78^Pzkm*(>p zvI+vXGR%3w^45RXQg~VKa+b9cgLw+Q4VDT)$gw5I9YG+#;{6(-K@t%u)W`%@DjuFT z1OAw+(I8M$=hFFxj0wQ4Nj_y45Z#MJ#Ns=;oTkyxM8yD+d8u4(p|xkyq3TaULM1|% zp`oy$vt4MH%}3ySDq%5PHv92yx^IBDFqZv!K6`@xv|T$UD!7Ee*&!#~w5(+E?c~z} z-1;3Y`BZtik&#_5+_a4{QfIYLN=nn^KSgxvx_koU2=jy+Obn~TnA#c_K-06dbTvA8i-k)QLN>6~@2^U=AFW$I&i1NN9m`|pJVwsP zoV5Gs1Iw2dD!k@)WvNevvBUZ4upqRd=yneNgA5yTiG1V08DD*v>R5w$lj>Nkq154J zX@fVISLu#i%fFRC)jhu ziKGfBxKK5+-UX;is81%zyKMe~fC0!CfYHfGGI*rqLJCws1p+TZTu)=9edvUdwk zeA*to3>TM5%zS-yU?iW+99zj0*M)b>c`F{WTGj2ZfS}Uaqa<3*r6MM!M9F9TUC?uK z5l>mAI`d9QS=OJc)}=TI#2B@cltJm?t*A|Vu9GIEPHQQJNWe(If}RYClh&U?iEVdr z-FdC|5zghaS{kfpNlWJ4@oRfX{gOTp@2lbfBU1hMMCVC1LkX2OdPkO#T$MC98nHd5T7=1Aldfu98DE-}HB)XN+y5J~o zGj5Ioe)6AT!j7CP5+uL95gpCc+ro-97%C#!RJ#g=S7;<}-BGt)-!F~jD!hj!FUB1{ zsxi^dqcv$YzyB3kex80Mqrzs3sb&Wf6L{U{_%lu;Zl_5q#?xB`WOd%XjJF^KIU`f@ zGCGSdz9hUEkI3jV_EP#hla<>%)|TtPSNH>Gc!orG)?>WlDz0sGM$UYDM*M!L@}pNC zihWWzuC>gH44%6m+wr@E)^1*RPOnkl16;hjN0d?yG&o&+rdzw#)?h3~1|^@Z$D+jC z4Y(J7{lfBY2Gg|u`szzOq6Zl2#ao4s zUYZw`T1&@kG->MiXxg(Upwh4KyXxLHgL6xKPxwQ_dmWsZd)}N_dk_4+U%b#Bd*l3Q z`)U6lO=lSvRrj@V1rek>1cvUC?(XiCkd%@}8l;N6*gd^zzMr3)l*CY7$!EgANOwFS{oMABGXWt+nNOKB9BoDTD!j{tR{Nu z9eDXlZbq<#f0U}ZK|_<%ox3m7eo^Ur;i7sL_xY$dSs+*YL^W)7%6;;U9GB^3WyHI8 zE2C?o1`ei{p(ihi?Wst}4M#>aF>o)>xPdm#KI`rq(;@y4*~RT%$7&Z$+tp{L>2ysU zdVpiQ3Z5@zRcKEi|6#rMjKnoIqPYgZZI#>1(oAJ8VE_tJ7sOPKE<%gIF#RpW!lr1+ zU2k1EgYlkhup_*sTCE696=_ABjL5(9GKLEu9}Ve?4-fDQUOU8x%Wvte*UZ~#TaV55zs$R_cx*=C zFEAl2fb6^-A<^NYAqi-h2e4q0Y}QBzbES>tl>&g^_5rv2{XxQ;gG6oO3`FT4xZjc8 z(GZ_6W_^Y)_V6Swk_;q$UCe3Q;RST}AP-HzUx>(!5HH`OLcQq>VpIc8O`C3ZEC$dRO7F@o>^7 zR$HTS4k}U!W`T*_r-T+LFEL|8AazW~U8{|v_x5*c>yB8ScIy_1Z=0zpJ&9$8+Szm^ zxm^szD(t_25M|p!h8j51N>YL>d*rW8yn(tTKyLHSpr*yzOrU7($9iutWF?)jK*0Lo2 zJIcPGLL9MNn%8}BX;ej(tmuRJ;HK|_b9U`j0)tbxCRVNSH6MWyJ98@|ISC8haS+6>G?e?0uTZ%}>eu-#aJjLOzT1~Elw}G_L_64SYIx47cXM`>kFxiI zY!rEU)by@z$VBtItkxiupvw?isl&v8cq?1~;`^aYT@8&s4qIcp3~|BrJf+P%n~pAr za1m++&z9bR0Mj#~`EE+#8ETzUFKci8iDr!^7pxeZFW;=|eBnb0=G@!y0eVkJ@U!BOcUvBYBL!DlT5T*X2K~ z*{>n=H{l>lyhsVcrwHMvW23pmjX^~mSol3?yZ1)mAm7<>Dgq0^RfQ}nzsWG(K$%|` z^(k9`!hlM)?XhOvF;^8I{9a!6|buKAQT6;r(=5i-gH zG_tSG4pQJtTGe{Xg|eXa3w2zoqf}-~ceP~A3GUT%&-szbW}AklD%rn-s`iU6EsJ|J z;!xVa_*n7aw=(J;1}0E931k=pD9e9Z{l!4i1i#1W@YHKZ*~S_wTN~77wx$x}SHCJN z+3_@N@72T5$EJI^Gg71^r)vYMWsW|Xv-?_={iVDFN0lFN*7>>~(YEzN?W3r2sJ#Kn z(1$tTaELW2AqU!VW&oe*L4a(_Q|j=MYRNLG3EwmlUH9{O2`DNQiyX^U zwomg{=yPrVxDoAdJH5uv?-k3=i>|fZ_A$wuOpqOts=K_|Z=4OKM`u^&Y)>2F`Nh|0 z9Z1WgBQxJt&||c-Sc0?Oo+BRcf{M{gfEB$TOs9w^E`+n0k52X*zjItN2v*e{90>yB zr#SBq=am0I@{^pS9mm10Y5*c^5`&56n%-p4=71psto&!9hL{QGw|npUF!CD83tfGg zW+4@`R8;N$lI`yv*Wp)Lt`F<`BL**=pMtWKgqlwhch;d=GVfZ-aGbT6VVUyW zRdx%#>e)&PFV96zY;MnX;=XEZccL;5#V5V5b^1w}Gsm!W&0NhBD?SS`!#ZRY4XAOG z%v4WOKS6J~%8FCSd6XF^;ZS_QzYR5CMC;b__O(5XGrJ_LI30ZsLT9mFU@UV#QH7*e z%C~fqzxdQ76c*;IWY0>LvNay!hClY1?X;rC6+PWF)Q;=2fC9(8B9HurBFzt$08H9w zYgFpO?P4KS2Z>9}%~GW{MfqPdnfdkOoOq~ui|O6r^S=cMTD6xjofuv)#k4OSlRf(E z@710@DswNL1`5YN3wy^f@?W@*cIjTI46}YF<(4dJlg}?SaZr$4-87fa*JqZ?(MPYs z9_TWU)aXghw|5tjD(W-O<)WK1)_ic~Q+;0GpD#1Uq6ZXlWTrte3dPMm%_gc7sa(4w z-IMJ*^ZJ=R%8X~e;I=~(bl^hBTTc0~3r_0_tDh;tV=sUDuT|T-A@1IPVJ4{Hr zHMzEOC4Kv>gmTUlQ&HqGF`ty`%u<)CrO!HFLB`Xk!BP6-{0g;`4B#{K5gmxr{_7A< zlOZIL0V^~5303n<;~G`HH?MEm3xsS!+sGopHEmb#`^)}bcO|Bki-Fo5}#9gyvQ5UvUn~;?i5rBXl1$gU?~a!JnxJz za!rjGS^Re7ckZ?fsY6N5&Dviqww5P!euj?=@Q0U$ZsfXwHRN5Rf~NH3V;4kseg=$X zH3~tz*shk?&FFb{Dt(9idAid;%U%0Pbuj-74!+RE^R?sLEf8S`3Mzd>MM4K-OdtG=w9cZT@h>b54 ziU&w;AgyXIq8AccD69*SlKS?>h3sNG$tF_m`Z#u&WI7P7A1vbbWS3cp|tqq7U-iAtny(vOFvPK*a_HP!R~X>M>vqf zz`B1KBORW3r=(Bq9730VZ(#j;KMTO9tN;B}?@8JjCF6~Jv563JnI7wmtAXcB@qUJE zV_XGPj$u-QE1J=?fKSgYg3G8}b5 zcl&~W+n(hmR{wE!eE85UlXg$|kz(`NwH^7WJsz3FFE$Hrik`^Pv{hBC-HJW|5z{6G z%FEd0RpJzA-md4jVw=O4cF|nBi*6dae)Vcw_UQY{WIM5yZEBa}C(-D4(`p86$|Ch@ z+exqOjuf)oKxf2`bEKpOe0(m;;!PRLnT0Q4*r|EsgyQ;!Y$S=|XJ-Arf z$wJ({$z&NAOR$GFtvpVdG|O#iaw4)lDb1sc+)6zW{yc=)R2f?6?0>FKe;N6yXuFR& z)Q%|4G6}JVUJ<+4kmWuzEUm6GR)-HO=q#2NzeM1gwAstC{J?kHxE|GKM%z{1va(4q z)WQ4Y%))={_MNqx|!=KszTh$<$zfX9TC#?)mxi{cp9+} zu2|R9fEnoKBN4o{sT*v{kL9LsZuci}?pN5+LmJD#X15`u;PCgvEF7<)uKsNy{^Dyr zbrHK{xbGC1!|66bbO(y45|n@}Iy?;lPq^RcmSF?6Xy@~JX;QtWInv6&+&evOs%suB zAbC4IF03HD#IU!{l(TGaez>%O{X-#^?b~5*fB;dTV{Ya3#8tGg)h26+vYNmc9Ac#_ zm767;V{T1d!SJ`zI7c2$G>SK0otRnHC2bITWQt7+xab7Wf7rHB#O8Ehcr0(ZB|gsS z=eQ;2KvUqFz4w-GhfZI4sG7=IpuYl4Yp<&x2}qa*x>f-Py3Tb1zPG(<#f*u<%f&d} zY*Y;sR=n<@!ivNX9eEMTM;KM(^wTUzMd01PTHDq$f$_5gWxHVmItE`-4J8k}H3W`EK&qiFIz4?-Wu&r{Pv+#BI75vIT zxFKyID*;hjQdU-j8l%ENuqsPhFj&Krroeu%9{EHqzL-09BHeE0!W;Mw)|Ku?Nxp@H zY-^A&)v!+P&~25XW0w;^N*GzBaWSVULwy5P+4?DFSk-f9YuqkW5USo3Q1OWg`RFF4 zB{(mOrq@4svd-IW;lyawR#d&ruAceG5GSgc0DR-j67T1|Pv_LFz4qmjaK9$x$I;ro zs_q*rxVgURhR`op7A0Yx;y}27W9Pz;Ifnh>MpgzU;=ehv_E8c@l;v@<0gUdRc^a{v zDskc9S!2&`O5fsP2l8sO4;BZjpHIr%kr7SV-kr}Q zo%5tNcH!Bm9i+#49vJGLuF$FiX^?Vta8Z?Ib2=?HYc#TAyS^|EKMbi6b@yW7jmg06 zBn0gjYMtY2X@-gMyst^PBG;=@Om}ywK%o@B^semtF?puu#0>%fgYdP-cdxi7>M<%fGvY>$9fNyo!E zijM&BC$AMW&v+IV6wzOr^qLznBKBp|QEj;8j?;h(3wYm$Xu@-jKMm_;O`NnpYMv66 z7HbQ=5{#WK?&f68z?gE_2ykYmLGBXi%eXUi)r|YKS zB|~uDQB55Jpz&pDl-`7zoPZd~ys1Ot=1=6ehad5)L@vJ_Q%Ee~74l;(k7JAH!^&zc z^tYd`BX_J_+e)Z9ixKA5%c8>XCWC6X6dm1t1sD-U}Ve2w1Cv2fX!J^j^; ze5EiLJI1o+8#n;)8W+ie6!TN_jKHFwos<2xS3988y{V{S?(ownBu|1~Pr60_ z=DO?Pfc54|>@zdG-V5ul3*j&Xeqg#Z-OS;%yS5~?r?gADs#Ai?&>6Js_Cn`$jAsb? zZe%00dR5`J(DrkgArkPakCjreVZIPY2iq#FB)Kbo$-Ge!+UUGG!NW9ZG>!8&pgP0t z<=$zGw=*_7%NMK&WW)zSgM)R)1TK+zAtUTN<#pq6RhbU862E^u?I-(zNc>)DoOW-O z;*GpdHF&r7@WRK?+bWqf>V_K%l!$`S1NFoprG5C)2z>)n4|)bzz{)twDn=a-+5uS3 z?OuJ8nw8U}nw>py+%@n(la&+R@WLO2KZLlfkx>P)?D%e>Uk(10&1xf3rr?8YUQ|F{ z_7yTMZ1i3y+VOr~k61esz#H?^mB`x5+S;R{6D(Bb0WU+p>Z2yxOofA$gS8W|vhVdA zCq2OQJkXcddX0Gd$1#10`?To~ahZCZLw}L6vW!^Ll2mu7k&wJ9MqA~(+i_9;n{J^U z`!JCm2k0L0QMc&!u`;d62==Y@ej2lvzxPH&+Av@paJC(@ zJ*#YW_^2jS=mEoCXhXjqfw&8HI(?nj40Nk4QX!-OSHS_BdcgX?y^?^5EkVx~ml57K z06OqGy6h`X?8ZD_%l*=6+-D_^?Bz>HmHf9ALEIBKNt@uFHk+3{DmI_jZ(O)e4yWSZ zgnl?kWDN3G4T=pQLxV}E)W(r2KE?3AxO+@)C?^#WKf8F`IA;}1^$+$%6Yk7Z2^nTx zF7FLM<7V|eUM{m~>^+D1H7HPr+?dnj>|fhy*X~XlB<1{vqE6dM zj%(Z06Q;K42+@iK>Rey5&Rwe(jcFP8p9Q4tGeWw}TR#vxRc2QNsrP*M>{{;Cl;1~m z*P68qkSSw&>|Wvyl&w_<3W%=+W~Injqgp&nLChuUune#9tDf1bdcQdB1^8LCg^0WJx zv}Sq~A8bsdrD&g^!E=*Dli$R_EZ9y+RjMREy~Gl{nS$*lR)UPZy_pRq3h$QntbG&K zeP}ox?s|O=K=wWfWV;zITPw4u=@F|+6KpbIqEb2JCG+`jN=E$)S{rg7XB}@j&twb&ZMSA~uF5Pry#V=ZbYKL25m=@-)rwev96nC1_P{X&ICfpuw;a8x~c zf=fk-psMS*(1#Bd5WU&s=b;4>tAau?3=fF1R>ieyFA7ZWluh;A>V?drNS&;OhvWX! z@$N1!YZ!xlF5XnjFRU&uE$+y*8J)=ZG9fh#f95ukIx2dTBVsWPd{5I_C&_Gq<7h7# zHW%R4oex`k4)yJ_ca^@&n2*y1-bpga)0&Ud;@sQ-T4$S{?^$re#oT4TxwipjJftYU zy!XWs{%S~7`D5Y^EKeJF46G%kN49Y-3=L<6sxP%69FdW4qpfBV$bSPysKq)Ox#&x8(4 z(ds5k#d0hCwIZiXxO9a2cu)$XA=rF}Bd160B}Fw6bwqfOxLQJ3@byzd7dcLBtz1=@ z4Ha!k^O5RlwlCwga;Ho#nvnA5t9OjV>$6nq({nN^FcJ?lX%Q*aTfz}K0 z^EgUX@#TbK+$_7thUMT=a0*YrLrQxbJPc+uP!t8l$_gO5c1F*Or&~tBR%$@obs@%f zD*e8wA}oB_YnNp^W@;>9$yk_A{Me=CIkaf_ThWV#-J^e6$X3DJKKFUysTsZe-1{FzE`k+yV*_1z%$UdgtA>N!ZRNoHB6f%Dcm)yyu&$9 zq3X6k!+>(aU9xXZy4K9m;AO|iYx^LSC20lsMt1z_heTf5t82Tvbph5qo|3yB&!3e* zZ9GvPazB+0$kbFV`8;ha3#P|)p1}RVu#_3=>Uda@8z+R^;C%}$!`L$I z-Y@_&rYde|TCbvQN{+~{_)3+yfC)%#XhZ+%s$3rp!9Gf%f`WBscc~SppfadOYn7IuH!+oUC5M(zfZC-i3`!{UdyIL zS_TPgB1ntYy2;1$6>OKbD52q5gMr%{M`9y2NG@n!FUbpvC?iQ zvd}2e_)1{a5Zn3C^w2JG`bo2`=eed_$Vcu($V03!KqaZ8KYj(!p1Dt@#(cj|Tx;i& zi5!DGNJg@(IK;_xr_Pz0@iAV`XmErfcr%$JGyf+h)t{~S{Q})!)nd0IP!)~_qYyx4 z09DqPur*Q8H|o6A(xYD`YTAHN)8j~Kcsq<3#$yPT97(hKcAiXqf*fRho*T{iJp7O0NV(e@8eKs}PGEGX=9AV9i0=HadH@_>1 zgV(L+I0+xN#Jd3Qrr_~4`9{B6_9LFsj#F#TTOqc~QN{7^Uh{aCQdQ65xRa@)I5F{a zS=slE1{PV33xmdZ5;Y&;PE)RtsP6BIUb2H0gXuWWR+XRt!pHbO7b`XLP>Q!*MlzK2^RvxKzBtV`DPaiJNj z=AjWJG3g{8AG*b3-tg57mxU_+3`S=PEAAmffY0qXM&A{%&9qWS&gH~BvUa;v8Ecq`lr2e^>~X4#I* z(1XrohSb@r|0M75Gbi|C;E*;0@`^+K-9Zm3(qBf1QL8*F7PM>nOkAhvOzv|D>~T22 zmkn)e1@}HO=5`T5 zhI4D+)$&qwjU2)HXZ3>mFWR#79oP>;librZ=XXYC7n|C$*L_v8?WNqQgF!N{H{?iK zL({dyRLjQNAHGkdzv8s&q+Bu1xEB9uJK;K478YlAA6?47C7F}|=ACC7R%rH-Bzi8r zJWKl2x<5lZ91w6+iKbuXY_x1&5i!7mT{T*iny$Ugd^F zbp;YO@9LI`bXQ$o7&m^=<6%N$pL;@?2t$&v>j*9~b~iP=&AE^54wnkujUk40QHQ60 zK?Jcp?*K*_q61qMihrp9p^7ftOlo>8Il^h*KYKN32$bF_lVA7H2gI&{W%9+QXLI4v z&@AgK6LmUl{2N(fLs*zu)fSYZ>^l}0?Z`w_yK$` zC97F>X!V%&_-80DzurMRoWYY-!=EP5XOm@B(-To#t>uxN?)BUU)969z1B+KArQZ|x z!Ts}6!P)SfjQ6fQ<-_VF<4ynB~lm|tJ2(xXLI=0lkI(Qm0~X>=eT z$(+)id~fatIsLDS0@iIB0@nIybJ|c2)-+r#q^_@S#;j~okNFxM_SA`S+N8wOUB)%n z`1^8%WgA(Y+TAbyieH7n3I+{HvppmBmwb1le>@MKcx_~9_JrKNfErwc4v?}HxlPi= zZrLwK(b~Hw1WG7u3h6Op_E#);6ILz7xK=geCptvK`veJ22ogHF$mvSJ<;CR(;UNVn z8k1sKWj}4%mICx0`gXtRa;wPH$HiP~{izLa^=*G_LL@dZfNS3+?oh#$=43i`*F+m) zmq4etZu>&iZCuZ$9ATXn0)9Km)~R)rc6}l_<4&w@fWk5xj>XI4hROqUW#he&F58*wfk3ni z!g0r+{_i)5(5R{WXBqemvJod)fzF}GSYD!R&y6~%gc&b<(0V@P}tV!b}pjAns!cc zB6r974{NwMg#KB5c@|>v*bWReU_+s9_uZ5%DBX~=oLs%v8oPMDBz<8{+jfv6dZZ2~ zmcf)g;xh!bnf+a*Hf^{O?INCW-)W~#*CGLCUnzM!K7xMogLUH7t<4bR3Z@mc`$Ncxr?79E!f{>Q6lC_4c<}K?>dsL(Q9(9`vs7o%v_Z>yqW^1#r z`~9!-!KM>O2ht===55w;a44%VHOAdiyimc+otANrN@O%Nh}F;Q;4FAZAI(mbQ3eIx zO982yLPe6(kMp^3#;f<+tdC0jEqLa+S@8L zTDDVkV*|H0`V2m*AJrc8e6VPS6ob!lpAqM(UregjH>##qZ;%$g+J;9d_F*Qxrz(va zTAYvxxiO;W7iv(}5;Cu8$Otkl7JC=yHT8~A@TZ*b^RasVppbBIv3LPUX(`ipwl@P& zL@+5j^{~|VgC)KT;RgS#rFuOXEZ-88-!T{KgE#~m1Erz@*b#=p!8C52E;`;gnOTSf z_?r{z=kq#j$#U#9(mc9`{uxc8xJg;43rhE%p(J-|F-UBjTvV##nV2QN7?dkO7u#tZ zN)&@t}(zNUb6>Cq7iWtSiXzk7gGyDMwo!AQ@ui|66UgE}hhql51Vb-#P z!=^M_pRlm2!s~@9zwDaqqXlTm3+oZgYLF0=ymS7mc(+Y&8`!&52Qoy-!fQEoC z+i|JZ@42-#7Mt1fnE^ed;_Iucp?0Xmw0tsSVo8ZCKiZjNU=Cb&t?!l;(-Pc4nS!o1 zgYA~PY?~p|DWAXFgzq61iKcL`X;w$@qkI6%prucgx9p)gq!KlxG1=cg@$aBem(j9K zCQ%kpRUZ@@A^c${+WI)dwLHnt_ z{&U@|*T4CdjaD{Aaz+@(U?D;HgjBS^*dbav@RtTznoT0=3uES0v(85y5kIDH zBX#$=*UAPk4UaA;kgOuNCfzyCzRJa-np*6O5}vP+H(sgT)ODHMlRkBWQbMI0qMs^y zB5RT!i=lB1dKIOr9C+xX%eK6+UsUMc|C$d%VgKb`tul@y(15BM(`Sm1&ofQP+D^J8 zzkV$;KOFBU;*fak)JH?Tb4>CY@O1Wd&zua6iRFH-Xee3uh56tVGAh>SQ(m4kQbHn0 zEL;+KfqWh&%H;1Y(Mz%U(|eIehH3oZtNKJ{v>|GnF{v8T@$Sr6X!!@j$W}^ErVn}3 za{DhgNP0cziDjR#fV8*G*Hl0KCf?p~@WlkW<16#g%C4~y=+_1!qaMqg%e)Ze{%U%VERnI7eN}Vdl?M@lNgX9L;&VrmpkM`-W?_YSYfE(|MZSUN}x{|NFnRf8+#sTvZgWvN2_gMdQAfvsycOj zeOF1g$24!#*L^>UB5e)r$Zs0~1vF6S8IDg*=*v+p1Jve4B(vP|d zbUVCTdP7s)r?)21f$r!Ea6rYSmY|}t36k6xTu1%hMyhpM9 zvO4KX!-A{|0-F#v$Ev$_q~6|pg7aVX zgfuCsdu@^RX?wwj3O16^9M&MJw!CTFbkPp6G%7?Z@v`j^c)ijq-NMPOy|&oHgLBve z$8XGgFp{Gue)>UeH|*^Isv*%u#d5U9UNogi!EWEH!gpTVID><97MStJpWp^>y) z6#a}`RL_Bz4dD9~F5%t%kq>Sb9cY;|&4VD$z~435qtdyaAyNi@v5p;*7Bq12y*UIJ z?R9?w=6@NX&?7?HDVS_>@G3z*V(jfQDS>}h>+ep`6@cvm#fGM}eR0u|35~?53@yf1 z!B}rMkVTho;9dTgC4@1%VGC1YpnZxQdmPuR+gbq#=3y6#LJb=>~u#0 z0`oCzs_+wb94ef7ndB{8@N$sRAy}53sU}U*`cMzzm4B}~*L*;FQ$I72{I2jmaJeVI zeS5`FMpRw-Kuyc=Sn&-Ks8}SQc`V=LChfd8!3WGOo}R0<=aN`yTEyN*XvU z<>4eVlz$F#X9Yd^so*NK*OOfI?73YH4U&I5>G>_RV!&QZ z^!aSdkX8mOCNPj+ro>Ifq%&b`3R0u(dDt7BBz@~jPza;pT-+z4VljX*% zQ{8de$u#TIJ)$^!BYW894`u#kvePFPsL>+-rjf-&=wJYR9+!Toy$*4w{4ZNxUpIHt zQAeQuuXLlSLgtVB{}m`|5N{qM=S1|r54UP9uNaVdQtWp}<1o4XeUb1UF zHd_I^>dGJ@ZHvRwf6yo$GrTU<=Dc`;N-h-(oHzp6Uz5&a+}gU|jTJUSiDs>8?{Wn8 zE>{VL9=r!gNb;{CMz4!cKR;h`0EgF@3Ivr0pHj+{7SwdInvl2oW8e>siIDU^lZ1Wp zu3kU4?bRbDWCE5r^y~rDp@*$|mFd`@CY0p*3#hOV`z0teEiZ;oj+%yMr?T}V4g>;8 zt#pdCPX3JTzmpic5HZR>0?z)wnvFpGBE^BX-gr6D)VGA5^el=d18zDlxFE z5-gW>+qP%!{OWP$-iX;^2k{=x1KWBmE37`Q-VTMJ5L&dew?N7H$N9f9u}_Lg)!v+x zI!MEk>ReP9TEdCrZ;}I&GVPI+o2tM3hJgxg8=82aT~xHA2U?0cRD9s!LU8VX>yd^R zzL)8i6`uZ85Tg4}qz_3^)O(Kad@B2;o-9M(y(zFw(!*8YJY3l}!7;&J0oKhs_AAN5 zpU{!m(6y&sZvI_5eeIje3Q=ZMeYY3eNYYNBn;Iaep7A<-=8&UT7FbKBiBW%AJjQ#K z+@Klt?(#kz70ScV@r>bT#(0E0gI39UqqG* zBkf;w*Us~)U+0SKMhw&$^4c6MUatRr!F*SEFT;7n6-PiRzaQE<+*>riyFjK$4jHVB z`M=ceiiYaUEugR=s=(PVDVr{+&XN@j1`bA7Y!MVcCXLH4=-X`BY&z*nBrPrdtp%@b z9ZoB}IVs|=gqm*DN$(DmNXJH3q!a3x@T>Q5nZQ8Z>qFHmn>e6j1I0cCR8$-`0pp(p zA9P$h%)jMG%IATs;NzM)s23{u``KAS&`Fk}j>Q&F(k^9oHzQe+C}McX)6)j^cmBNn z9pbcq80`nu*&g2=0V+Y}m$we)3n9fkSkcr(nLo^iw{ZPoE-KyH%L?G$uS-b7MFxbn z#zFx)bBNqZS5U3YLPyXubg^3xzuu4gH4c3^cbp5BgGt0bak^QwVToKiZsr$RKF*0e zfOdfw7Y&?83=hwsf2)_zh$+AnhcgBPOtvf={S>k;O7)i1LWy?=`;vcgPBe{_Bs4UX ziG&Q7OhaY&Epr?CaypV-q3=a}_Q1`Oy?y^jydm!<)g~geZ0}u?oC(#c#B? z`BKTZqiF9r6=k}9cnzKW?s)nR{)$b37a8Nu)0{F8Fr+g5(j9yS)&Aa>vZ1xJtBESB zLMO2@oezNBLu&jGlD=6X+9U2g-ut&xF^*&K=9i5XE_LBkAntsP2Yf>fe2w)ye8Rn3 z7MF{29kcof?cW{Xg+s@o$;kXu{rF=YnfaJWJOY+*}@fy-Ulr9dwO5 zeDqfJ0=vr!JY5Cu%P{)4oXlx&a9|ND%g|LUFISL?>;Gh4L8(tGnoHoY9Mr@zjcw_2}V?Udcx29zI;waw|^qq zA_+mbK*j6&tF7pC_8a~ytA*3!ansk11n(>pk9zX;=C>K_bq4t0Xr-Nb(71X}_tY^D z$)CmjAH@RCS5t%@{MyOXc0CRPtU(r*mIFx?nGjbOx4l*aZq2NTfUwp4mYA~UY!At|TlM~DiPA#o`MTO{h;urt`e&+q7QT!iPh$q8rh8|RKmmeIP!Xe)Gbvw+Bf(P-V8g)AR)oZwVS9M6q2uks z2O?MvDH$4J8F0G4h-j+cm~)otl%+=x9I7}wpFa}Z1;8WhVl}I%8R6$=gnm?G^xVG` z^F|l9sS={V8-dG;=1wG1hXaEy+})bo z@gYl^hR7c)7OrH81Bw-@i1c;?JQ+Q0;#E)uql@iI-e|b`W|(%sO@b>RvR@oOkOe^> z=1pu!5^}=jGV#{s7DH^nTc+oOWSEoy)`|}v|xKv&Iwafpmhfeujtn72&R?aRjgP?y1^AUZgT(mdpvk@FyNr4sV ze#nOtt;AF4>oraxlU*wNOnUm4y#)4uqEWcVw3}?${!DafFngG*8OH>K77Q?YLq4z7 zvVh;TIS^;R>p_~IpbtL-`W%_g%7u@M>~CzYHmj8uSb&BFYoV_ z1m7_N$j}(*KN`%rUdpqNI>uuEeWJ|!cj@eB|7}vu(6FwB4!0&vqW>$ZC0Z0w$^ao-#E`@4Q&J4Ypfa|thh{;tmZQF}doZ=w8K z**9;RTx2CgH9CoyyUv*Q1#jlNH!&|9HVnt(!HOIE|J`;6e|&M?y_-z#p!|!#+qs%j zPX2d37Z0dP6VKcoQGlCCE>rpkppaqPk8Mz`MQ*%+i;H2FraSZk^o*uur^p6Ffb$3| zHRVJ=i}$@#B+!MFluQZ)2!c)_hW$#e;qX2wZmxf06RTKj-2Gm+`im$Rr|{y|UN9YU zz$H}Hy)kJZkwJS1D(`C%fN65xg~XCTBXk~q(Q(^84(|Nmp(9$B$Bq+ukZdu3@pnW= zkm}!nnRnV^#hV(u$O%u(lMSf7jvJu*!M~kak80&jb)&3YhI2HXpj!^Of9))Udw?og z-{kV#$En`h7m904LSkM`$FUKCd(`0|H|uxi}dscvZ9BtKV6R73w#Q!JpOwl zf?k^WJZ9^%%#BYy#=ZV+`@K}##@!MWLF7Ssmqok311Nm$Pq#nB@ew&6Hwf;K>H6K| zF-83~KNLwB$%w{<9*-Df z3-PnWOjtnd2_)Wbfyp9<-%(F+~NQj_^>zc>f7#vavDFVWvI8t3}m zh2CTIPy|uFGe5C{v{~l=_-8F0C}FZd8prei?d3bFq=2pEri!JU{}oC7#MXot6DZv( zbH5@Zk4IgZ#g6*-MuV6SJt~O)U{S@kt^`U$O>z|FHW6FWS(~NPxMkv zO-7|M%kmOKWXVLRnQ!sma=+c|&k-bwmk5`zzE&~lBv;cTbsVqVO_6TSeERqNe6O=j zS}z{zB!sS-%CtWa3_6zB-^Vu=!~Y|nsa;^oYVc@ja`YL?Qhvnt`$D5z-7Ts{u-b50 z=K0?{+|({K@cK%TY-(g))edw$elY6ZTk5uT|5hUy4F7K*5$o%Ulkn}784p8dUQyIK zd2v4=SHLD6VvmC6%OiYs5N0Ga$b1|R-P)#n-k<225%Yk|2C#>{$|am=E$ho2XlHxdHkYH z*6HkOrSt#oSd_9=64k}z*VUvAD*1pJO$jAgY~?T#Tn>qIfpLBKexZLBsS8QXl`PS1 zvCfg|gpNY5DZU)OsDM&qqk!6{|H`>@K1g!9=2bJRCg>4`THFK^L`ePHHDNw>sjf_G z@RX+OaX61q1XKRoId9ea16ip_A&0Y5v;8`f`Fa6K{ft@ReF6DfBy|64Jr<-<>#bEq zj4qPd@_u8?q@4}C-vQPoTL(%z9RhAymE_LflPc#K@;baQ9 zpXU7AI)vXk{Tj5T?h0prWkc$&YqrWfKfQop;{L9h{KvEM9So+J7CW1-`;AihN@6wp zC5!)g5Def9-({`8CE)Z{Ej&*H)S*@#8b|)uhK@V63n{ zO4-jOpFacY;4Ln4Sz}C{F|;micK>7gt%&~=n+TQB=niB%DDx_flbEt#2Uq-ec-;n6 zTGewKX+ag+=~5rNKYSgIRqn`ve8H7_EJcLrngw={i=>f%+^u$YUcVtwBJI=idxPU+?1* zqXj1iNB$yr_KEs7(m4eZs~v=DNm?&_Yg+mEeH$b_#0@>vY?-a#J%R+5FqvDS+6r0s z^3cXT#X}=^GaN?rh%1)(q6=O!pxc;j?V9i7Akw3jD(=n-J!qtb6e)Wb6|k$ zz2W;xa#mRr*O|@fWf#*Cih<5c)?)b7s#XF50#LueE~~{~*9Ozkvhz4+^4~r*`%K~Q zP+v8ePtMk$AOUqEog+8$jE&CEr?l`NRR^}LJ7+&;5P6^dj%Hqh8uL*0;;tX`u%6hz z8FM?x^}=0QN9ez}Khc{Djx;xz4q2=~0aC!{U(Fab;>vD*Et&uu&ZCk4J6yqL=1W1GBWk^fwm{mhvD zx7%a==%FVBHW{h-2?wjGbx3DC4KSl#(ym}c7$)Iwbt)t>iw@8L(FzKN?f1aPASA*%UwYxs$gBLO&e%UVWJLD7Vj{3$2khbuD`Jz>KaP~ zdT&!C^+9EV&6fU;r>hKzs%@gu-Cawkw3Kvr2%<>0bm!92-6?{!bV;Xl2?$7cN=SEq zcZK)+OYGhI#LStQb7r6`MGn3G2yE&Y(D<4eeT{mF&G%Yiw!tCS3y8Yvz}pwng7pi) zz+Oji7s-;rsy*ce#m$MRy3wq0jL_7UM1y#t5m7110s!Z?_!qnod5;d<+MDCxwG=b@ zAuX4gl@R&6eSsm|R`clu4k{kw3B>a=ZNi9scfwvf3i{RdeL6c5k;Vd*Wvqw7XW1C0 z3Xmhe@l{@ep z^~#lE2KT^-PtJCn&*=4}T4yJu0NzS|ur~O+32a5GQW&##9rLM6L3{i1f>+DkiFr`q zFPHg;#BYKuGQ@PfgP&FJ5;0p={6Bqd@<3W0nXEf*Iitw{^L+ z4sRR0?TtmDdPTQ@&;N%pBV%IHQBHjRJ>yjxBjM=;9cUiTnDX*Bx5ZkMEr+m!yZek5 zt?y9)`Ah(%c~ln+vwJ9P7A=;+7np0%OuDQk|Od?DU&e==l(rCYv91 zt56xPSTjiVhnV9tX3V~K$9-l_Z@1(hfi~z|*^#U^DZEEGkR`_QL+-5i!B9y5}V0Nja0&(-93x#Vf*`36?hx%1&9rG4fMm_x^E zRn<)>bNLH(JVT{qIRI{I6Xe>#V?a)U{0HTN3>q6_U-XRMa6k2>cf&GpOch0q8dbd3 zaCqqc`I49y#5o*n6t6UfUy|LOc1MBF);~9zgU{~ZsxSPzY(763W(03)ge)o5qi>+o z^z>`9Nbs|>QC!Qc9I53K7X|!Un@!ZE06vY&lWQQDpdx;?n(Cry+_Vn!>Yo$L(+=xN zkQAH@vG{H@w`Lw~w1%}@6YS><&);_YWOc14Qtf}DhL64N`?+PhhP9zhz6zij>+q*9 zfkH>DM9?%PlZunX1iIHcO-plydhSdc5p1B&nChwxLr?KNSq51OvYnXF*lgZ>@G3fg zzBVbx%XU#8w;D}S@iWjo1EVvvm|p=(P!?3!<;eZf#?SFs%36{0nL0zxGQX9J_2+OI zdg9YV_q^C=z&ZY2<}Rm)!)4;Vth2V+AsF@B_t!o0$befnjXw;^5F1Xgqb`8&~^!?~A*em}$dTp6A*4~G61`)(@_ zH7E;~7$%TV`wagUmMvvb`q!sbByTJ3sX6Dsi!Jgv>pq1(K3Sal_o;#1NE^mt*zI}p z)l}GL;TnXP?OZfs;QvEFISLR*+t|x60(C%+5T^fkw0j-;zo-_LoI-Ml8WbIu1#sOf z!uz0*bcT!{(w{y!Z(eMkN((f!c5M#+ix=~sucrQl+@~g2My2+C^#dq2%S;y8n_6xA z+jG4G9R5iQ07hy+@6C2j8nMGr+*^XW@V=bDt+gZ}L(21nG{9cAb5Jk#JU$#g4l403 zCMwy0M6Nn8Ho9?Ceind;D{W?^$33EL53X+tcv~4yzC>b^2GZ5(CEg~~f>qySoDD=SW*n%z_`UY?^j{>cC zJAgi#BZFQhUS2xFfT=Tk3oKt9q3@@w9yqm90Nv^*BK7q!k-k0cQIMhreQ{tzy}Zh? z2j9*wvqJLFn?Pc&;_vrS;jNJUx_MhoRPim0!C{}<{S+l3_dDQH|Mc1bex3jcDra#4 zU&+$5r_HeWiFW)|jpB`TT}nrgfb8;-BjY7YvbgC7=-GoFa;HONmAsE@s{U_!Oe(xq zCOtp6^M1EoG0|Bd!`NRi;3!?dmyE&I>T^n*=NZuDR*I+1OXU9TY7^7|vlK=k;%;DgPGF^In zxEvY-NGbpiqRQ5A18ba&jI8!v`o_ryLr7r|2aggWtd9{(2J0>3O}G z!aFWCD;?p{hPpXn!RGs+eMlpb_P1|2>QC;9w;6GLlVj=H2laW8*yAjBmth3*qbt}u zWLix3T|*`Y9mtGl%&}RVG#R z0jFMNMo|6Zx34};!!Xl2PEqd;AjzKnoPcw~*3es^Xrb)`j0Z5~NGJ8VT8-L=0}3FA zN-bGyBETpUk|A;c=bZqhgn3qL4EUKgU{cB432HFDuAjF~jd@%d&Mg>73C{-!Vbo!O z59;9NWA0xR-nq>fB4~qll$DhSA(P+J>lrIqOHZp}ysh!${cU>Ms4-$$qjw;qbyKGq zzXGt+Q=q`s9OlI7c&(?-4s36I+K1amZmm2E75Yb~CJ`nP0Z}JVXp1Apg4EXGgu#x=}=g-Gl$< zKL9dpY6P-g5$`OOe~>zKV?`m85Wpxl%M%Y}A`-C9#alLG*$Ve=Bp z;I=a3U@a(F@NdYFQ%Xu`$Xyd)=Bz#5in=$q329g+b;%Lm3v9o?*Qh??37x> zLE;zsiLkF?97ejf>qnUR?K&cYw}=>iHXS@vzH!1@-vKMqKHuW1L*$pO11Zscx9M@E zx<@17`Pon2-Q#FptS=_V_c?MqgKQgSAbn6L^ zO!z*I0R7t8Ks#Oqs07(`J!GeY6=2OXuWg%+6$YI=zg#$mpL!^ymI+FP8v0i1&n(FZ z?W)ohVg{SeT?3Jx$!&Ob@cO+0yLJYL{ua}vwwg534*XhYYl-o^?9|MSiNkc*20A|l<##?Ucq+5v{I}>J9oela0Q}_AE;ZvM7|a8IhYE2 zkE)Z(|7nWGc|O~vTi2cABYK(92XqQD!9c%q2DdRs7K-h)G_(yUR-PX&B(E!l8qC|z z^4V+_ChHHWlXqZ~yDp5HbtCk?3Cd{MmX7Ppa}x9$|7{*paL#Tt{WEA5`XUsuCh^BU zZ0F)bXXRfQMu7wOVX1G%dncX>+ldIW`?~t|rcWJbxCJS-cvDy&UulkmXqiS(Zg`)#YUhuX z;t_=&V_(XsRGgSB%z{;uQ}=a}W%Hz$O~S&!Kq%`I{~E?$_d#NJ4b;+~8|)2Q)ac)& zJjXbtwwTlIrFUv5$(uRxK?{YQ1CEEu_M^spGq}pinz@3}`KDL&_ z_QOS{=Ya)tbCH)c3R)f3Vr)kLA=^(~OtY5)4ffeqwKy{(&b%W$%VR#)l$IY~lALD0 z1sSw|w1WC_$Pv6P%6kTxwl%>w(oeoowBEtr7t5L~!;dKu0`f5D`SvP(?$5Qgr$D+k za1AlP^~(sVznVuI+^Q@(iL~jGaC+h3u<%ivZGLJZ6Gp&azPaqVf3;V`f?R1cn%#)KyiW94VhbVY$|6%H70?FeIMikMW zjj@uyxY(c=RjtR@NIm{jIj!n_zi+f-HX$gTQ_xy3I4XVW5TNU%D6oI=PZjMYST8!i z1qV||XxP(leU?E4UxCj&>GN2#e*|i9{LWWoh`Xxb{s!NtmM2EhqQ8 z#LD6(cJaP zL`)%T?r5@Fv92Y2dye|0$y3@y^?cMpZN1rnZF@F6EgksC7 z!enTQ5U^ELLiP2jlQvk30(lj{H%ywI6NlYEYME99Uy$!ruSc=64kyAri z?W+De0-HHC~)FVxR0ea)#-2r*95}miJHY76uR7(V= zDpKOkeF+ZBMFwWj{tR@p5JVJ)p82a{*@=633FYD6PK~D~;t=UHsOOQ+H$3M{b$`2}s9`xq_s`B6Ccy+w9 z!({ZO-*H7pq$n0n{?0<9J}#+Z5JpK^Uo#)H!0#g-lW8BQd6N26fi#T5M?y)_FnFR8~eM^DtIJr({~n5i0%^;g0E~`TX~OL`(3~`gaWBih@mc zni8TpaGcA?&uIr(oM>fco?#0)k!T~Nu3tcj3JCZ8%ie`QL;aE5Ikrhy&R}}62R~bg6 zT$EF07Ux?-6MPM25u+}_HI?9xBrV7XBSFCP^zC@m;>^pU+387NO=Ij1S4GLSmQrz6 z9>-jrpg#Qp>*ttWlbo@%R+t65IzfJ?vKT{LBmAe|G0jODcTtdh=ZG=4`57Ve>Y3{3 zOun62$7&f1v;~KEURRYk!Om_$lp&y zh*C9tO%5^tt(ttgfi+J2)JZBqI8gamzJ02zHK7Q;UA%LO=b#6j*Kg9UDs#Ucs>nk!Q&?y^?+gcnO(myM>^WJfd!>s(gDjO3Rl?1am{m+W#&HD*j6U4O9Xg27V z^EQ_lx-U})JynG2cEs9Jdw(@vqM!kom)Ut0 zTTmn9@^NJl0stbVZfKa)tI!^G_N_&r;H4)CeL4K^NMnvGWtGe!^#e5+dtf(8=7=)u zMo{D+ryX;gWdk-BCyr-{lPV~CQ}uqGdm z{xp@7sA%Vw%n3Q{KUbfL%4@5}c4u&-qf!DT`21V!pXs$b!tBLknh~)-o4zXvLemqD zxeU8K(P*7tDl>be`2kfM7C|d8>^@7BLs{bW(HoqBp zMp!ISX`w&s1$Uh#1anH}8ofrJ7CdF#+{T%T6EDhQ&v@ztkpchTeM1a18sBajVWy|L z&zia`=QekHx`vmrsj})${$o0b{l9@j)55TTB>UmPboFUlBkYaFka}B6rrhP+>7NR@ zi}2k>Q@iFYF|(fJx`0v1+9Td*cTjq&(~d{ETTHv;)?z)V%ZiKgXn{VR{^@#p6W~Dx zXG)@T0k4!LKc{>DzY0be#k!}?%oAk1+iBKW^@eTcmTXY~w0QY^wRk_-S|av*Nymxx z=|24M&t=8J7s&?ZSHRjK%UFR?TV&}!m&J^X+FC=70B`}|a{lCF^yU5I^48Fc0hvj@ z4#cjv)9#o5)(3HimAEVl4MmL-slADeJe5(FAt*0X>A8HD&4^o8TSZA4@cwvPi}-j% zCMi1p_e&n7fA7!~S~}E}4~GrSi4%9l{cAkcE-3K%|BR&TUFe9h4#1xt#A&tyso-Us z5X_!lygm-8_ov#}%$F&Bsh(WVc4|=aCz0^+Z9QP9A)*wML@>d>EWj{SCg`k9mQjH-xgF{}?tZH0?y%+< z(Qr?OEAv7B3E^Hk{V-@DCCvP<205Pbp~P63Sz51Zl^3YVf7dwQXfFG&f{lSFc^}t+ zn{I!`v84Jfqy0FuPcY-j6!+Ju{7or6$NFfbI$SFpj2WvbSod70gfYU}vM-Ba`7gK2 z7q@*^J~`$c#qKS~x3sgpv`5&7?J-gGoD;^|uB*fEEp482(M1rW2ok?221OYvzv-hl z6OZ%g(8E=JT4I#xlkKJbZ7nk0)R<)HklSL^kG*%D{|vY6G!z-o#d>TlG{i)!lO}aA zrvPK9`%NP8Skw2XwbWSc&T-K;)1BF_b~T($?X%3?`}|aL&-45w8u%s<>W|xM+aIZm zSVbsS`!x=2zkeXW8AF+2OPj)`G`H#Eg_4@u*mhGnCF#1>O(p7o6bE!f=|B9dGuQ>$ zbhyV@)}JQ5>ddl$2YCwGo1?J3SrTHqwG;X$ixVgDeTSc_oL49V1je9qg@8Wk9vig;5 zDHQSISE#^nP#4ZC#+@Z_JzZ^2`%bK_zzt^(ylAyUEb_&PtNwFfS}iO#k2b~X6X4aA z(&KBwmvPo5=*poRx#}oWl_WLVHnfsBZQQvCY#RSsgQ|!S>ms_ z>+cr!WEu{jqr%Jcu@)zb(vjtyIJU6j;td8fn^@73CBw66d{`9xpLQH&s;N+XtZ`&F z>96UkDz2s^Vt+ij_Fk^O8dO@t<@1HJg<2=3#9ox(+%5;&MHX^#QHCYU2r>tR6%wX} zb_iP@Vh+s9hHihN>y6tq*jnO* zr?s0BcUA$g+7#_Ll*rvXW_sv}g%E2CLmu@>wtJ{!QRCy6$-!N^^KgR&W9}26J+OkB zvI*7aSXvbL@BaZ^zXOX)XKs%IN(w`F1G@KOJGql%71wkiz$#M_c#b1jJlUVi7i5S+ zh)z`1z~#QztaqW%dq-VJ{wlmDr&j#guyn%ae7-HHO_zR|r<6McI5RXI8p-GJhj29p z5)8$3&Sf##8Z~bI^Al4eCk9YY?p9Znxe39Pf-1wRQ}uqzW?u`GfwBt7$RH0M_Xf;v z6(VKW4uezv8#!&zn2QjZ$HgE>aa}it_UnJK4hd$MvS?=y&J<=mA&kZ9IZY*f+1PIA zw{j>gvg1L}^K-J2u*3oN;)P|Vq9l(btrl^Hm}ryRGln{VDT@SGZR2^CHWRZ-=9B-1 zVGIl^@GDKS7K?r=BJK$5Tyg=Vi2SijDJCih#=1<4ZQh|N4Ap1*t;CR1 zLd>eS_%>pKAmqO*K!pX3Ey|VSFqRh7SQX9wg5ZhL6X;Bi85XBu4L0vZlJRP58nfAl z&1-G?hRM_YkL?8D`p!;2MGYo3Hs0nk1s`T9Hcp_@i75SoU;>bS_x;~OMcB6FdQKY) zTldzN0UPmrh;jhyfGIVO1D;w7Wwj2KHH#X>*^;6`{Vx_i$T6sZ!I&uDEi|X%Bty{T zw6Xvqi^;L;C)@1?RW(!czMP(pijtI)%J3p7El;m16kHWb^dEvna5m5#7IImPt`&rq z^lNjVMk3RIrr2{G@TFNFZ4(r82D1 zPVc~oKN+vajIS-Cf=J8~Q+p=x3}Zb*!{dI-W5#BN^~;GQS9wral}OF9voxjzmH_nl zJkLMW+T{PfZc_{p_ZbrM2<> zmR^0jOc{|;1SXcnrA*aSn|aLlYO&!=150z>Z-m7 zOk)dv3jgL=WB4D8(mr@5mFl<37rd_^$iS=+rjx@B>z+(o!(xd^jUJMyKIo4BkM@-1 zb~_y&co{CDo5I(BmQ65w%CVhc>tzVP0rXx6E^!`8THCuk9?B|_Fcr*V$1^2957o)c z&N_sT6vXpVG|zN90_^ECdT*GR>vvpDnHImy!Os5Al)1c!Fk{a*(z|cBa(b{vyI{qB z-3b~t8~mT835^$u83y+u+n{2PQJRU^iizYH+}ZNRxQEgqtN>PJKJ!ofx5V- zdI5#p8(VL=hJa_Xn*d|7JT@-!loDBrQAgiLzr$N>FkmV{^rZh`q!=J`Aj=X6=))4G zR5{{5-{gt|MejKOf0=>2q2uri50Ix4hTd3iG6i$GEqIO}<3A3eY9T$(6hNs`%RI|3 zoydQa_aP!bZwg?SFc3eTrId#E@p*bYCG?*ZduWTKGJhNETUusb`rj(Dtepm8Mqkx& z>v(0_pKa(V{9DXGXM|?5TPaW47?Qov>9ZfTA*O$=UNHfz!3gXEfLph3X#E@x9<0wC zmL}|WOMA}E^$Nh7I@!!!YJIH>c6Tm6eYO^c=kDzb+WT?uCh(jLFDE^0JSNpmw*VqQ z)W2sf4tXT`Ph|JIe_&59rr*UMrpt-HG7pwa;nsO`M&W-c}s)RHO5a%|+f$w^mX+>HawSNfFc>>1t})ehwTaH0Rs8)&ef}mpepUVZ(0Ain`LczL-?QC)sP;DM% z8*q95y^}Ey)J_Dl3{He$5A+H~g!Qu*kfy-R_<$O(B_Y{#q^Xbnj5sm8qA{m%z+3p8 z{_35106Y$L6Z8n$>1_sOKsa>(?;WLvN2|g){n}v?^!fOmxYmpRf+rwEmi!sx;tYIq zm#}xD(sBk+S#Ruwy`RGc1ar~LaL@`YO##Ql*wQJ31GC;iYjm8(Pp_vtK{C+3j^#s7 zr6hPWds&*%8K^y4`y3b_{D`rNBJh{s>coi1VIVn8h2#J7L_4NjM3AI9Gtgt_52!q& z_579_)~m?3^?b`bw`qtoC-cGE)7Ja2DVjFbwF zcI`bq8wiT*BR!a(9}E2L$S>Wf;}~1iydV}$c82l22*uqXtf0QZAaiJLr zjz%}3Eud3&-@~du>V<}+e4M0ZD9tJtdFm4Y6aNK6R_GqMCz%%}eV%@PIc@6h{-Nc; zKTKNCf<b%G zZD^lI9pBRn(NSQI?IK3>QWr&gemwVB49t&t`0GI`Tf`f`B&OnVGq@Aqv-6ww-$Bxa zk)+mpM8iVrNd5io=iR_(++E|H)IPvN2}!B=Q^aOxX9H}U+qviT7pQo$SW_(>S9NSV zXhIFOFCSM)R(06z@PH9+x7hqI$w~ej)`;$6{-?XG0X0VWyYDYvG-gDlnjm9lz3QKG z859#EHrT!y87uF0H`2MraQK*|7Hy8+R16f z#MYhO?mS?*9-o**$MSwLPi}))>geX02Lk5-#yN}OH;Yg9XTpTnD{mzxv1oe)p^<4nM-CQ+6xt0$R36WVm;c0Y>DukCbcNdhA1c#PpE zb3>0AIYLT!ig?;3KEpZTqWktgYzfv4?fdvsoy#&yv+tYHN!b${EzgrZd%GVtS2OtQ z@1ZS+b&yzF*mI(p91Ux>0Oj6aBgKe8Eu4z6ch}=nw;F!MAi_t%;fR_Y{0B*vc!qMh zG9Fq7QhCgk&9pR&yx&}JxouZ^u&?5-u)}DwX&iLd3d890#VX>%x&0b83GUF1@h0US-6|CBGd5*uv5iG4-&K0_ z#lm~yo7}VctL09WSb}>p!-szF#(n^_I&yj6XB`& zzgNK^YuT!U9?mV!vnZ0~Xt&E@pr<&O5qv8}EE>u6avZfw!yUP&+8yX9)pdeKtn*SD;jtGxsbap-#8(iNd@*WdN;@AUz)9z7qyz&5!B|s~$nh}>ZFh7k@CJeb_ zX6=V<`#pN2gpH#mAb|g7YKiEV;!&f#Ige*LoYd)xNTrV;|y4;0?srbHxUGHR~O zfULo)>b&86Sh_6;@^(8P?Uk$v{JtZJ>xu9VuN>tnrkjYMi4YI1cnGxGsXOtG`>6}U zJ1CVg$&H5I?cXo5f>a6L`tFMU$}g)?#ZA|B=t(+>d08GS{w7g8yU?Fg)i5lz-vUu# z*m8J}y|j2TPlsth&+~vagv_Hbu(sHJHdW5a1*?<|pdh~fGL3ihTMptOW$V|rcOLaqfC^sV)d4ap>P2zZ3OHGQ6Hg7^kml#>1s>W=oG9 z>byaKH`$*%KbdaVW940RR>1!(3lNRezm=!~GixiRO^4^WFRIU>qA*IP#dr4hzL$oS zX*a*m1b9UQt0Ck}ds8+wA$I;qOZWu$u{av(YeYsgrFeiv(KU4XYQeFYo5kSUI;GNAFu=t^o4`UIS}C+ibF))>8sgLrsu{1W$=p9plXJgM(rSa?&z+hS z(2qNcK3}aT^GnpmrwD1X74EbT3s=lK)UP_?g>k1H$Y4 zYq4jk)MK2l0S_N+;_M~vbCo+`-9po=I`vLxt$YAo)Ag^KM1NhEM5{aang_qA> zsNdzeUczX9sj8Mz6sB4#<>Bc8>5AbvH7k+;*Cl~{M%Dq1 zZN2hO9t=FmCBTMR3v5)N6|Nui3oTy`!x2IUgHsQj(d?(uemV_x(0!z9!^lr+cS5avi=uyF%^w0)1Os~@EK{GKi!9-O8usV4GD(o^vZ6#BX zqnHs(Nq`XCYlA-86T4COrZ0eIb4X?B5&!jlSKk0hH24c@qQnj(z2l{~+hDy4zgPiX zAJ@b?!HbLjA1hhbq+}^5kM?0#Vw5&ewupT*$nIMG6S=>m)4%qn$u+z0;azH$_2MW zCO`|3ah8Z&omHWNe`e{Pui?5!p3HVPYPLaE;ZsI>TVpn`ekt_kVjfKJ`eZC7-Z;iR zr<8OzWvsSjbBm-rfjslZd#5N-JyKb&NIh990)HroK-YTBp|X7$*fkmS=VB_;*0|8CLSLy!$`xTs3*wQmw&?MN@lppkrsQ zUOsp+Rm;iGLKIH-=hK7R+x$B$1WJM)wM~&rp6xA1VJdN}58>*!-f3E|DO5G{a@Oop z;wZtLBl9Kh>e;V<(Fe5R;bplE0R&Z;B4w2lzKq1GV>!)2=#!iX*7$)Pty5*$lzM_> zGdS{%d#BYv^aa%944QJ6J05xD6zJC(i}98Th_;PTlI zX6%QOQ@}jR%jNbtEx7v^VC*7;1quy)m!JjbE;P<2!(8i`2GyzPn8EEC56$W^nb*UvaU#+RK;cnx`JZP9sST|0p zbz@^SjZfe0%_W_Fy*h4ia8|=-+fK1$j6)f1f5ZCN^>t$@-7aqXz;h#fh&5&TewEE} zSm|;=wvl4e0x#w&aJ5?!fC+f~pY5wY#5)!lm8Gj9BE^XO5;PxKAjNeKWkaN(w>RM9 z_=4Dt6h|Nk7FkP_r&Z_+`qPu(l(D%^t!tJ#?IRBTr07nGsbseh6ODiHVx91K46mZ3}lej7xT)#jR9vFxBb3-F*f1IX{P zyiU`X6CwRIsvS26rFH6=uX@;g4A+jS$**OHYO~VEO3dgeCOH@5h)G+^A=SmTar1=G zUz-b_hxZqjARM>P)ay98Cn+NOO!dpIC9TH{WMPHAT5nR&k~WTDE)oO|+qHdM&h<@) z&r)Swh(ZFxTzDoQ9iF=9A5j=Ads65Vjq`s&h0_-=-SFlUi6;<4E_dPg7u|1^0F8P zpdVg&NDd+Fh@HGGt7wjkF4F_s+l7LsX`_kccPj`{&VD!np(sb03SLoW;z6(cDkZfb z4MIo()laqg7!^ualPXe{z+*Uol6YHplj+*VwY}@AD z2*-m^Fb^)~uj71=s9At>7sLEUr1@rUa=GE+i_^$!Nc)F=pjQz~Yinzi71__poyrWi zCC#>n^NOKK4Sf~@J@@S4Jr8D-qlECj-)A0HV3^}jUjGvNK%=wYwYFA20SNNG$o=om z{`VAD>UKK1-VHY2MoHWDbNnH-B+H$vH?^h#0VgKF47`KN=9Y&ev!S?K5HPApEBJ<~ zx@*w%E0_TuWLzD5c(7i?bZO9KX zt1sasKf9$3R{Xs>+ZV~e}a}DYy6l9 z^td{1oekF+1y$u<^*;dFLRc3>fY5$F-#)MoXfdR92*^(lTTYd)w`D|_R6OSjw~O(DU-%);HY-PCt8tXI6Y3+8)bS^&GR5NWCf5ndK1Sg=2$?@o|# ze7L@bN-4$n#p!9V`*jT@vfxZDYm@el-s^*KwE=EU=a~5?c8zJ6D+gUs8}(j>dw8M16guy^7=#y9l%B@2w3wyvI+}vdtH>(*W$`xO!Ig$W401}* zjs?-zFR_Js2{|99(3wV(i~Ky!9&QKML609an;a2z%V~N- zfuexD3|w~jr5qKDmmLW`Q6SOU>bXQ}+vCHnjW8+(JSC_bPe)PWC#7(2G=*0mnOn_S z)d-}87Nj>)uSXob@(j@7Ygh}fDyjhoA~Udb12>QeLNp>Qf7v9-l7k}l{j&ZZ9@cYV z!dEo`0*ayUndi*fyiCwP`#2#&%P?tc`U|)|3 zU40U3&GCmYVvH_C%_8b`n2hG-p^$#*=9izYeU04*$*>t}cF4kq{2>D2xe6Y+7hRHOv+iea*& z)Xfcox~MHKlCz#_mx2`Id--Y)=L~C9dXw{BZpYDL0aI%)ar{W;IDh@P9+Z@!^XUZ! z-bMTGI!?>Aj^jb?NzI2%`gFX}17j*e@*c>a;kD||D6%m79B8DJ2#i_w1ApyTt|!@~ zz?@RRo-P(+YGMXJx?(JN?3KA9TmYT476UgQZV&C~k(X?0fn%7S8hF)wwH9HcgQ(0C zD(NS{hR7INdI+oskN08grPlWcK%p#!V*ybK+mOkU7-(0Lv0IbCf_laE90zD!v5ngz z{?y?ZogXwGCg&@p33#Ru3t@@ZEf=Zz0Hn&{dZUhi%b}yatghK~xbu z1vvEgfbxk*o2~8;q7=G23K8Lo+tJdgB3+}haZcCwy+5xbCoBmIhdKQxeVT5&0EQH6 zv|F+?&WMyI005Ob!fP?o3bq`j@cZI9{HcSIzqw>;ddObED?fWK^{gapqXdda&hIVO z+^vIVMym7^_%gDD(7)Eqf)r55no1S4D&JeTs|DBEM=|R#_=x>ULcZW~WdhMp>b`U< zaqpfH3hk?^VoW2g7(Aa|VlWg+49k>z{TQ8|kBe(M&=1{s5dQMjG2skl$Fzx&5L7sm z;(oO3qgRdK+6pD~8kY|jg8u{w-u~Q!XzuZS%l8`6+|k(>lgw5sGt>4zk4a3a=N@dJ;t>I272;c zBsA)d9R13|XApdYrL}bB(~&8uU*(8EL`XW$u0K^yo^U%IGq{VE;5b2csX(f3@@?@l z(Fad&Vzmaj(gzTHlWkT~qbFqVClA(6SB&44E9BS9qnQ=OR`Ka>5{c14Lu7Zq{Z()!UUWjGwnN(PO4K{ ze`Xr^0G`dR6Ez3jXlV6d=9gm#t9hi9q!pbco#;!tsW6)#C;RmD$srB5=M}y-ds3G? zy?XvYvpSiFyFVh@5!)*(S^LyeQRfDle)|r1Frs{c%okXDE_eYbPQm+u5!W;Dc{}4B zP3-9K-~a~>!ho6QxG9v;DD%Ju+TOkOhOv@_ob3t_B3)Wc06Ex=%%fPT7Hm{hd zLPhmK1@i-rzmzf{FG`4oYP_XLWWVnH&v#I>XX*7NM8wKH#)WWbjqnZ}TwFQge+L|Y zKp_kQav>@h36wlL`|RKOG`vgTucc&P@fnk8&#(b@x=y=8ZFt^%-qz&iA+HX7``z$Y zuHnzjx^0TCOEwsq)m}koC73KpFYA{Qmp;rr zL1bSgnezQUd|$C9+uq_pE-ww+v|>cFZSmsdik_5do^4s#RZY9*o@&;xBUZgd*0z0L zn&pejtZm4?Nl&@J(1quLsfzk^$^m5v=_wU>phS;;)cxXg^B28{l z#%b13`GR5o&BP_f=SsEj#^bIAUs9`W)Q|j7ew;yC6$*f(g>TFSt}t~**bNBj344i+ z?#MwVpWXy)cZb0SRCdD9&A>Zf8bz)FeK|G%wb5irgGlB|d$8vtHYv0gXT(>O)$<$< z8vkesA`S$g^Y=G}kL`wWB!&hgknBlD(A6yp!J!+5ZR+%_Xo*sa>Ms4L^hWF=qrV^u z$i@)(%MJ$mIapV)btbHs_jFfd4liGixNV34V#ndfaE%u6-rinCOk?jEyA8Mtn7!_c zA3*izq`#{?E-hjYTJ%0@`fSBT2vH&<+6rdZ5l6xjvG2U+JoNt3_pzQu0=GF@K!F1) z%zk6J-+=^sIYd=kD-3aCqEK&q^ML=9x*);V&Ju5 z=V4& z=Fonq>FCajcXZf}o*cvC&-&}>Amj9^eO95X(}@>DKVnQV$+s@%m734Kpm2oJkE&9N z&MdjFN6}#)+sE!R_ zBQl*#Q8zc&_DpobW!Jhc^5aciMS?(!pBiikI{A^m zo(z{7!i5JZMjPHI@2d*+VblE&enardo`e-$uh-fq^2o9~ zK(1|lnCI1rlWE|v=&|6sIlXtWTsC2Y0xX;i=$fDSoTtFS`$wv4x)2CBFydNu&AtC826WU)zbXjk+rGH z%+7s>`0htS>*d^p7LhkwvYHrN@YYv()}q94&OA5nTQc`7YXG)Z+mFeE2j(9oT$j!4 zW?d}4{{23!?6|Uykxb?`s~mizeg;cR)O!0KDW^D03i0i*Jr0X|H8B--9|FdozhxFb zf|`Ek8h&M{G0vSgkb##z(~;NB4;zdEjymi`ylqRF zdZDJA<&)(457VwbzEI;*{2$nK>MPLeg<~%PItAFouZd)Z|Aok|TMII}Pvm3Y%b7R6 z>q5PRuC?iU^~ZXKsHUAIvq!Gz&iXJ@r?FxEDum?~N~?uL#Rbz>*&3xv&1I7-1&dQI zMTs&Sb1H6b_1q^#T4ewTU1s22_9_YgD(Sl5kRR6D6M8l{Z$5gfFV&RZB5gviPMBF_=@s| z9V6JjfptO2__f>k)^v(WUp|V{#=0@M9z6xrDYg_u396gzaoCzdh(qiM)i}($CBBZR zO8J0pXbY~_-JiI&ac6`9 zHSA=xV{-J`V-8@wHO+;|cJG;F?B3f}?1dx?>c09P0C+%$zXHB2Z;>aNa6}mNiDr@- zbds57qIF?64@S3w96%uoRB+hWP*yD0ki^DKSZh_$b@QeL&(k~`ADfi*c&fK&P`u^4 zOVYnsLMci-yn~c_2W0iywK6m`D0}X)n;fwJzV^NAvWmrZYwnk)KlMl%8N$cgYbH)L zRU94z>oIc&QkhTT&c}h@+2-KlZ|-ulf&IwSJ`HAz)9!Y{2}l@P6w%ENAvxDF^Vzot zYySx$ggkh-y1CtTpze2#2e>9+8gXFmdO_N->t$wHiz6hXX%OV6#F~i^jhc69W@dhL zm3BR;U_*f$RKZuT)nvoQ4Kg`3Az>6Y1c?a zDjxgg#+z=I4eQrRxmb|F{$5$JY^ilszv>k)mtw(_jT^=!s@JVcd&UW12QBrxdFe5m z`&hX+v&EZBR5{$TbEPvI`SfR77sB)A=;Y6bIr7Wpx6z45xHyhrw(WP}bFGIELdYY7 zd|mGRo$7bg1cOApqPpdh6c((Icxqe*R_rbdmu)A@R_L@Y zQ=Oiag2r96a71?Bb!X}8Evxv%SUc!Xy+d-sMbmB+Cqf9zJ6ovf3O4Fs2xA`#Nc(c)IUGDA@ zIPn;&Sa;$vUwO>M1Kl=42qBLwQ1`oQf$NDPvw-Vs_6L93bq&L{(OMq$V%iwz=nR61 z>d|rl`2iPs2N!Y<8Kj_faC&OmzIrk~F)p<_zTQ%mYIR!YdQvKuRSbsGxAVU0Po%C1 z;K^*i;7OrWkW#s956J{UA$@gEp0@0F>udo*50-VJ!~A^Ed~G&5?$c&4pQTL%wh2KB zLqZ7YZXW3MXPZK^!m^_!OK_c3U815ZS(ah&)NnUMtvWee`oL2}c5Otp!r&sWtNw0qz$xeOp47{ASta z&}sR(Y&I+(GA#SD{75rcvo9@isb7VpAK+bqfs_g=3^6tmHaH}~(iKu17!sqx}@nk7CR*MbDZ9|J6xX5$aeA&|F=E>$JyUF;CvY8_bGsljNO*ZJX z$RnA}%`>ujFn_mh-0^#;jcolmVYn%QxQW@@9#+8h2me`NZ|EM&jLb|lI)6Hy6OYbx zz9p2UfcQCFx?9SYEDahDHHgPN?fcO_ZD7@#vMr_K3LiL|N*43;aW-!=bceHj zP903QTVv)UnujR+Ne1(G>xRdV%$Ih-ICI*5%@5jUZ_~K*2yR3FH9$tV*2dJ2)<<+< zLkl4^TQK#&HF0GBSwI%YF*9U#5G!vFgidL73fo*}U$(Urxi}4B4b-15kBrYOi-}(p zRC|a6nH_8PHx_lVa%80zzYSlu38|AVkp<0<&5Hc+fW4T_Ix*Kg(3pqglKyvy-#K(^ zVC&uTe`4WtnbwwZo$|6%*!;l$ZSD3D;WG8XupAwN9&-K}>)bYYWaL`Q^;(%Z?ZVRV z=4=<66( zJN=ezM*igY&1N8PTGyIRxjf5q3VsVm8lJtz$F#ZzI%|-n?^fkjXTJ157uKXxSV!{f z+RAC{N{5}tJZDWhhZ-(p=W99gscy>VqAl45vn|(>X8ZPS%5u1L9t@kEti0P_>!v)I z)?ls;YoDHlmPIx3xfg3$dq?u;`yt;jY{5*Y7;(H9VVmglzW%XA}FO2g!~TToXLG;@|`jS{@r>2!6CVTFYZj zEGp*Ur`40v2x|#VX{>Qu!ev;N6Ek)?#lrQ+q@%f6e9TlD*{%W26kQxo5*(NrX8#YI z2PKiMiCpeG?}Nd^l#dVA=FZ?@EeE-k*$zDd3gH%JZ0E%`y+06UTLq7l>ZO`&o;u$@?|;S zFjscnu`tV~XEGzFI#>>!?3m0P%oe{b<;|n9u-nGDEQd~R?)GnrndznLY!Of9Z`+m! zi4J@Dz-ddcbssmqwyj1uIv&9Bc}VjAkxpZW-QI7_mP02ux9HA{pN8a9&acfGFv0Q= z+or+xw%fMIZ2Ohwk>*yGUpZ?`JJFc;`{I?Jb${advG`uBViJS$LP`8cD&+-o+gD2( zo@lgK|3uuYAF*iOO=+E){~?%9%+|CwkIhftO|>tH@R_M)A^90?g*NRTN^#NPLPzFf zwk_2*jb-vHQQ9USQgmY;&ehF@<;%>>$vd;sSgd{d*_g*p&wHKiV8OPT^H|;N`!Jt{ z+n8&SeDe8t2yfl=_6-5^+?Xxc<}F4ybH1x{`{=MebOD`q*XS_gf$U$)O1F>)xcDOq z&5uXI?lg|_jKkgO_&>;7+`fv3AVW4U$t<=y>5J^L4Q$!Y4*Bv=W466}q-^8n<^KGb zYv0^FlaE?lBi)2ZHJ~peD_&yZPAst>xn z>rNwv-GR55{%q07lrDqSTDms%VB$6~rFE)xozCAh{mn-PjcLS4-89HeH))0=PHHY5 z=H<=8p*Wpo@irUFNN1Ryhdn}QY|6~cF=pG`8R6~A&t`LxCFs)5o1^K^-`QqJ+Z49F8qvz|gGhcGI@xA`O|-)W7e7{SWd=u?nPe`GGrM!# zLbEg;BIcDRn~X4%mbzs=hGphyj}RJ1#T}wXotzKL?7`mnEM0dg%_ckAmg2T}KGs}W z*6Wk~;XlPotQ2B zpTK-Jx1C0O{b~4fwn=6a#LgP%gq;u0g|EF#wH~uHtohfO*}^;F)|8=MHw>?RmSgtP zlWym1f6e`9wJrbal-fgQc^^o(AO)XUE_fxGoV2N?nQ+v2c8;fE&6dZ8X+@!yipQ$X z@+G!!1M4A%c+>>4MKYScndCML1u=)4YR|k`$lH=Sd&r_nTb zWLy8*W3}3B%r&nQ%`{yufP79ke?DwBX3lSxgXWr2OF?-^r9#57PbV7W zL-PjUy6tFS0a%GEOTcYmx{o#^o0*1owoY`4*J{nYY~tp2rag88E1a1%Xph^T_syL{ zc;52iDOucn`Iwh&nwhcM)0oAqe8S&>w(WF(Msuec%#z9`aOpolW^7M(6zl|;#TxUQ z(Oaw|Zd>QrW?NQ&Y#s1sCDctjvV6~LQNvBBHEw3IH1L;3Y5QxBr*4`^j%=QJv%mH@ zwnh5mj&y47FPlFLt#O-wZq7{G6rGlt%^nDwNJFy-FBOD%yyoiLG-_TrHeJ;FFg(Md z%cK>xeRw&J#Z$3ZNqXdx8+AGfMT$e>`$Z`vbzMNG<4Efr9E>c{#zy5g%=y!7ZOm3{ zR7)+D&Tk8+e#C2WH^rOVAl%XVZQb6aS{$gGw2(9W?o2bV%V zrM!R3NDrsWnLJtAcHq)=G_d@Sb0m) z`S{PG<&#L`WMwOhgm{)8`furI<W4MLJDDrHt>LX;MQ&w{5H4x!w9;58 zy7@Ua?Lr%eTFtKgFr92QM1br5TIV;(Vp^hb@sA%&J5y{S^|vmZqZ!|Azopag<^C`q z>1XROzq&4NN;9k(u9n*YbM(grrPjK?AU|#OTf;Pb4%45UwI`td8MsKDadXoWI-BL= zwHxwaCc3q{N%$^xq;4d!7fM*D$=|QMC5_+~GdGvtDkO97tk#vIGKmxMqqjwZe4D=g$~JBJpD;$A=}ew{2){9U5+~K(lY_s*xqz0fcZ^xf9W)6ov)@p4a>sv zq+zZIHRCkmna6FzT;`Z1EFbKw6O9#Tv`@FtvZW0=hjw6&ZE|U}S~IU*&Zi-B(RqGz zRk@YsXr`^!AxfHRHa|z}lrkfrGqyGq5?jEnJBQ03XESiiX1}>O&YQaW+c?kQ<}1uJ zH1Ez7k(uew%(6X4IaV;w)@_yr+RE~V-}L-Ur<6uw?J3TUrIJNQ-kP_OP6{r-=B7^O zY0fv04Dw+U)=b1iBMZ+`{X7lrZ&FOT$T9y~~n@y&sVQ|w}YUxHbr<<1k zI1n%0ko3kBQ_er1KbJ!5UxVC=-L`_v$<20UsA-LDo5fn=Ia=d1ZJxA6ZEoM@SbnON z{G65;>ebhx%ru=g9jv7q?IO{c29zZo|!+{@9SjOhCqd zUBaL)7hLqWW-{4vX&j%-h2GIbvQsBPw{$_oFG~`X@NeKttO=^CmYw_m+j|pu%dVEQASx{ih=PdSh=dlEN$m!Iihl(aaQHj41EA6fGCP2Q5Fle!C6%fq zHNRJHymNowxAr>c-23jU6!0pQD$jTCI&1B<*B;M4d#^LyTOh@ai%2y73gd%Q-kZa< zT0t<;i6BBgLSrAretIw(v1JyC7wtF?R4a8@@;~ruR;^9g`~T)v`#=BZHk#953PVnJvmz-6g>IOlijJZp zQwj==7Pm?je2{7uhTL@uXTSg$0+)gQ(SIDct<3{set-O>IqBD!ge5eq{7LAgO z`GiA`V9orK%i~bYK6MX(@k=@BGQ@b+_)SHUhQi#g0`}KXh6zy?$mb7-EEN$3&SNHY zIhCw@qow{?3Ab??MloIFlq2Lw8w9ZEB*((D`X^6Wq#`1m#V3WFd~y#uxIfeb{!wMJ zQ2J=!@Ds5sEYc^}7cGwqmLIet-7sbCNwmU7`3&2{JnH1S69SKeB&y#L@S$^JA1^6# zaAdJ*hZL=b2%91$Ed?>QR!C}vQ?$n=3-zfZmw*VQ^eiNsXEU{D=-WUZqpd2pl8U*k zPK3*Oj>DY$K&0^TF@D@ZL&vW`t{=7)An^b}mh4{d@s%E-qOOaMVA=*bS0OqA} z%V!wt*pjNYXYc*?%2&SAI+bpoHto-BKP7*!QvJ{Skq5m`@9b)|3!5Gyx;8brY)1|~ zV2`+Rz5Uj!ueSfVBJcoL-6^? zTf$9o;w14_Kc#*@UHWangRj?Y(1Q%}OTu101g~qLC<`e(suotUT@@Z5R^qJ2P_jZ` zNFSh59pHQvDOxenM}Y6|6yPs}B0c*c>xT@$D?&oYn7vWnL~bfip=2QD zV^q7P0NUk!pLkZ^)e-TdcKnI16oW4_L+*Um1%y$}J!}0gj>K-)su=T?TFq?(NmTs{ z>U=+_f-Vjr;t9xE&;@OgELUfeMDMSls3}4SdK*bFR5DM?*~#~sgYyedrhRTfyAh;i zZ_u-Dzh^ZB*gMrK=0A|~_F_~A<*Lefj*;)GPyz?{q4s-9TZ|i@Q*IDRf*%(tna^k| zq5c>XRm_^v8go#JC#6d%T*Mevj^Rj^Gt__Fy3J7ktOoY~gTO7Y9b=l8R)7@jF~p8Z zGYZv^rl{-a@j3)WrU8_|?1z#R$~#_GGF+{0OsKlVhzDfuY2x_c+KL%~DiCz)Z|JaY z^BR)_`Gg|@6VA^)#P@i-^f4#!@ixYTyjbY7eZoA!SSEu>@5OtB>f|XS0^>2#2T~YJ z)-)4%+>eZG8Mv6GTNRmM!l?b2^iek^T`haWDQEVl6r)I5jRzkyk(K&mG||{{Rw{?q z8Y0TC_dtC+c%Wi;-Z5kU&-ZwBlGb6>3TYk8WX-K&~cOl z399#+R@s2?hQ6(vtJ!y6H*HV2bi$r+*@Rtrj#+d09@tJkq8a zXox7s!Y!V{DkCpI#4>9b;3T4h`c+V`s?xAc1HZUSJ8>K+$O_TcL7Te0wpFGktO~LY zb_!_F>!EG@?Iai>4{sQtB9p8DqE)9rAxdxPM3d#T@e2e|-6Hg@ecu$W$z`o@h`&o3v3u*ttbL^qWKK5zogK598c&T!I zCKC`@pL}2E{p|-&>R-sg1Ia4BE{oCxqz&?AdsDuOWjUOv5=SkeWxug6=ztBZ4!MVP zJ*1QK1uH+^I4vU=W<;69e2`T2XO0T9-)M(2#Z!Mk@N%OboXkDmIpW#xh(kySPEd~g zHNLrj5*Rnp#6gNUM4&ln7tW@ta1g82x^+-ihxKf=Ky9l}G(b(H@_LA8d54^Gj&=;y zhA9Y-qwGEG_9Dm}!@f|(c+T?@<78GCul+#>)XnNKu0KhB3he!fl-7p(Sns3#oLe-% zzzz}Ze#_dumNiicPG9v}6Ewlcg)lCdC-;FWs3K4rD+NUR302fl5JN^ue!OtL7%~6~ zHaWb%sA3Yek>fNg56IF5ASsa27GhNKoaGn_dphn1jz!-eFi1AqCz*XAp+pbo(Ruu6 zUGlNxY!O(>HWS7Mwg!r4l2Jo)ig#X`ZgBtxoS zrb+W;o|PZ7*^!$?xWKM1D3e$S6NP@wqEwGQ_ElY^Cb2GwYaYO-+v7!~X&e=t(>SQG zmSK(S*U_droI#9nbq_BdaW3m&|AX3?CfZmaYuzQQ^_JjA@WK-Of|QdkQo&yPQy&%_ z?Eyzonunmsdx-t)JnVfFvd0P%sHfwKJ`Dpv`!C{&C{#!?SR4_Nr`N-!AvR`!Tw~v9Edwc|#FMUK&%7Ubai`Yd3}HD!r<3GBVxg!vFiAEC zHh<7;`{tTWtY2r7pvq+3W|x+&+E@ZDBQNB^vy!x<{YNI@bWW|e>2=e#wA8Yt#g_Gs zEZX6n_gQP9X>Ab8=4YZgVH1rB)h{L<=1DNTjCq_?tJkbntJ>Daq-_B)j!jxvSOCr2 zvDsrbH#>_(u8v8ajgQXqyqXgzXJV3>;>(ntzlSTfgcYI1RRQwWcGZ@U#S;2}d2q|C znKe4Bs7D?3s5KVstQ}1Z1}vwb%HpC`7Zz>*&fRuw*DkCss7C{tV6f=O@M<_`xqzQd zu}rUzz@QrqQ%d7<;x0H(I<*Pgo$Yi$NW?`;>aVO`#;$i^Kc=3;~+{~Fzs8$ zfakK?QgEKaL_zkE#Z2(^j`Z=vcDPb{<;NsAx@!&We~|PD_m?K@@cm16Z1;U;N1<1) zbR02uaJ(_0_J4tUX3m?FlNhf!8NryV(20SLe7T7}0Vyo=B+HIEgu!)O!Ks7BO<>Bc zbHc~AOA+s!$1~fcVOd`gHBfc~<9=efYm>_z+j;Ys?9k1(m`zXF#PmA!xi3Dk2svUr z^2;{xB-JS_2-&MJ){orVn-eE28fpu8J9Qifm)dh>k^#n^2)5Mn*l$i^o}n$;qI!V0 zCO}QzWhjqj_(X~sMm4W6t#EVw+Z=f>s8H}5SE3x#%aOgGU#c{GG9ItiIQ#atd= zuY{sqg13ih++G&0T8S|_wuS4+vX-Ml24ab0jEVr)cu)A+K!8h3v7uiPPce=+S7@6y zoVzrC)i4)T7cgAWD(q+;>soIy7CF~*uI^zCm#>V>rm!|oHZUd^aiX};g3jwVci*jc z?Ec$qc6OJ|%@cAa~r~Y~<*qZvXIwj&JaZt2_ z9fi-=fM3(VE~6jF0n2pkXFtYWc3!dX+=qO4_JA{yY6Bb&P;wv#Q<%fBzb5DePa*+` zx8QWk2Bh-|IG7dQx~Wk{W9c5lhMYtPt_B-kee2_lr_(aKg zz0x`prPh1Byq+1!Ht#pj&+ExgW>aOG{VIX3B1D{`-G-mIlEzye{j^_X1Wt)9*A?Lu z_BaYBVQAj(Iqab>8ko9_oMC@gJNtUZK}91zET8SsG-VwRk*F zT2Qw-+W@&LJ!+f9BY)+C+Ow{j=vk&}jSt(y7LrrXh&*0;5GN26Vt$DY#~Ru-iE2!u zUH$H|^+1Pi-)V=E@!QBgEC#GZnlV@pp z^@4Uj-hJGn{cJ03Xv><5C(>W8a^F!-=@7&I&iWbsR!3bLtP_rHK6cVW)z;$-ya}hW ziFvPP9npb(ciTbGVDBDla2`M%crw}RwDo5S70jWSAQClF>(Vxj8zMVi^=19CC;%GR z#+66y6Sh@gUlxo<<<$1*w;?luHVk+^UJs^mz4}Hnv}l(?WO)WD4FP+UL1G@_h*JHu z&)vq&$Au+8B&Xi%<8|XS zNk%=Qf7x#-4Uvfjo$QeoBTH)w^OAvVB21C=_{@|Uy8v4G*eNby*zHVcGEMd$p+u=id z?Z}~hR@r}>RUWv_2JK~0e|Z7R-y$-HkAZd5uUJ>%8hU;FSVpy2HFg8y*w4Ab$=lCL zk|3+mX&i`0Jdb;(C73Z8?GsTKyh!>YAI$YWyj-7;oiSm2vtvT~6i#wx$E|ceCUU*U z(cT?qw;`#D2&>xQo@KHZ2dyY4h%CusNe4uIy&EC-QI`6gAJq`Mfb+B0!_yYH?EVv+ zM&Q3aBF&B1E+zE!QaIh4T)DC z=XvJCytwz-JFp?o7ZWzhR%f=0; z2cLuLX+iCR+6NEWfjjQ9-tr=dXLyLGBgKqVkKh~_tPlr^D#p^t9N?p2-!LL^B9kLO zkT|MH4)Os=K&GJRWG9(*qLAu_1JDlwuczx6PZ{-8I@Z_q3P)VxJP74>+={yd4Z4ge@?!C|U z-trYJ5G|2XrgB8AgYr#np_%~q;lOxgNXHHRvC@VCj0tkZaeT0^Xq)Vl4duvBoI8Y3 zFq0j0ER(m-BJ6#I{RPf{SKu9s8p517CnkBt9L^)CUh6~Ox5e3mphI@}&fCon?nmCJ zndZD6(qnOB87hZ7+JrJV$4O=l5=qV~C_8d$WD(KQG2Uf`3o^gaKdyJRC@Y_VC?`dR zvFZ_=dIfy{E6jArgIr}$4n4}IJ;J`wu`ZrpgyXoPO_964pi5LNCq?R;Hi}c@~CvCJZ zX~45s=@_SgbHzIs#>%O+Tm&$EY^}bySz5ju^9kEL8P~MiVED%?9tZ0IVY8IOiZ< zjy=XaFA!95Vue*$cO^*Gg+o?bJY+M69supPqX+M|*1-qN=8joq`IyeFdfi!N${U1( z9-Pbp=MS84@j@2X9+IDM1ycJ_w)X?dXPqdKgSd8RokM$cYh6uuTki)NQKt=aNP2dJ z%Q|MUm5)se#k-u_B$+_i>y^Ti6Azn^Bdu&BT!FcAE?NAw)V4AwvqA9*72#F{(1 zTF1~M$Hb{Qn$Dy0L^oJ(^dqGpq*52}EJ1_vfD%Xiv1c$V#+uiR$c`J*lk+&i zt8;ur1Js3MeAnl0vi{f{f)B0 zeXL??U|*4Rr-N++hpb^tLR7^2ODw#qf(obdN$%9qjN{Td^UC@d_BG6QJc%Z+Os`MQ zBOl+vzSYUVGS zNEqSSCTA(1QH}~SBr$D<o;1b-xdupmIhqcdHlfv2(EKW9NXfcZVT>2n|BW^K@+BMEL(pmjKmTbR>uLJBXi zuPb7lOE?BuXN)^?5bsEGn3HpK>uFR(^Ti!<+IVkzdr=8=3CAYKEIISyIA$EnVJ=Rb zrhK1ydWJ*@`<`OZbt!$wV{He5wr@r!2q3^gGdwLQ(m_NhA2^Ste&a%nr9AOQ@Ab>sR5M5n_4*QT- z-)bN_kIdI^Su68c=c!hn&WOepp66 zp#$m80P-Gk9$A#PJOqu0h!4{KN3k0JoKGRsd2Hf%uAwh@C2sl9VY`3lT{d^yF6;Bn zJq{Tj{^}p3QwMq32vOuoJYLp={7n+3!7p( z$;m$DsjHTBjKFIX(^kVitf9RdHcgAV?Ro6ac{t4nt#|kk+I|P*16Xx2XEy0Lu`jhr z(8MVox9Pn_K1ZrkSvPXklSuW;9RWN%Z-PJ@)UEugXzd*mEuxtk~90neakUIRq8)NEXm{%PJC!ym00Ad z4?|WIHpwQBqt@phURj)9>R4j}j%1SyJ|j`DG!JkcByS*HP#rW0Ut*#*Y0GdHm-zxI zP9iXpteSYew_vsIylt%EBy#Ss%^teXW)FhEXTW*Ivf4VR7xLUIr0;-2`J5!yc+Hm@ zBYuqXWmZj7FlXlB_*SPF@BIKf;L=@{^b)`_H*Mjl3#H+2>q3mC76W`lRR!EuBZ$Vlm|; zOeeB6*8z2H|DHoObMHZ{wo@2zINRu=vV2j3_2gp33MxM~5*1C0pgW^<)_64_IgiZ- zoX4&l$ho;Wn?E+E1-sMc^P5cTgTguU9>Y_a8ayhC3nc488`se;`cZWQHJepAkk0w+ zR38UY&lcxqY-#SO-SdT;&1PmXKG8>V9#xD$=2t^FFd}2dYnP_bNP)Cf7?d(n8?tcD zsn2pM#vz|*H&w2qkeiUxsg-S(juF&_Jj~q=!GhigdWg7jop~b{q{$lfQ@d$Y1mfApD%8o-cv|Jk zyuc}YKT+rH4L!e-lP%N8KI>EG*f=FQ9C=Qh6SZj@;FzWV*I3uI<`igx$Gq88YssdT zm+dS6{7<&pL1nJl@pMcNiZ!sNNLGE9i#o2qGBAUfdc8vO=?f- z5;En%I*KPsw&Y@-fpnhF7@br(AJQc;k58M#U0n=IfLP=sc}kA75)1K3R*;;6bC>+s z;b<2a@QowO6oBm3F6SJCuOAB$E{vCyF6&p6Mwt&P$pOQsU!6>j7ac!*xT|?*l8;{{ zY9gIGkC+c2^A|Jts~8^&2&dJcpXk`G=giwoF5r`oxE1in%%CIf&Q;(yZbf9d! zj+IGl{}@?fK|dnb?5dx-k++NV?=pStWa#yvG`}$L38X*@`#{U$WM7n1T9BTPNW`<1 ze!9ZQH?J2Lcxk!;a}zD^zfD(#ILIA^#-}RxLP4 z7jY_KV>wI1coeDeNM&}Dci*ROpOG~L7uOmri zQI;~V8^fV@U9P7cgrsBG0mHEl}R3FNpwDF$Nd`P5u_{ZB)&`m zM@tX(V{+>+ckS5WS>>U8hRTBuX?>igd`Yy?cw~8D8?x6!Ws@skkN5hxU6hgK6YW)5 z`F?P{>mom?l@7A{fhUY{EIaWIwS$z`eiUQiK zu;N&cVw&7u^#+f2tIn`@XOuc8<)?JXM(xS_SaB)d^GWF-*L2$*QJr4%r zB3T{OYyxKq6PUx=d?^mi9(1u#;bejN@C{Ryp&H?n)+FC1VtFHc)EQvfkln_)^a>{~ zVtKC9K4eHd!a1j%*Dp`UI1gjXeJ%mtBx<2b0bjHty_2W+P!Um{Bjlphuthcicj#4fWTva@y(;E45PXIn z4!RDA@4#aCBV4r(j*%Y57N>$D(Uzx{U8`HCGGU$Cq;=|3)@`h_Zgbk!opqk=xcDmD zcG2aw2$_8zoa5t?t*~BqQ7q??Q`WTpd zd!3ebyI6ZsD18JD)7%f>yzW;n^W&311?fKXkqgXeT*oyxq>kdrnA!mHkq9AUKy9$)GCj9 z<&CT?_JT+gBNhdAquQ%BV*}#BrbQA7wNR>n&^cE)NH&~!VV{VOBcCOc^SHRIj*`=e zL8Uj1khd0wlqd6}EDp*XN0tq)x4HQyXsRq1Ysw3=$FO)~P%)k2U>_VhUqo0&9?oQN zZ$r_>Dc7Ymsta}jpZ~xhrNhbo;~5X1`{|&K%X9qc0)T^(>C%VJtrBO0iG&#G$n*L- zrFeWG4BIeFInz;eo$8wOY8xXJ$8;%AhLcQ+E20P#;$1G^Yt=vn{)utkxXOJ#{meF7o+Gn@};f; z9Y+v<1MSHEL(0d0EEj1|7hQ4ISS*nGH&GgwBFQ-LSLoc<>yf7&lF1eJzLH*ilxWNP zQKkx;C<9!-u7L3!$270_bDcXfbHw@>>vSCDJR%vdSwwzb5Aba4xL)%Njib$(j5-u- z^Yn?rmUhZ3Y$HC|FrJ^x20ZmkgojABo`#Eyk5{JQzQ*y5_SdVJb5J+_hTYj`?XV`C z$JrU281Tfk-L=7T%PN?Y>Jxn4P&xX#q>XDbBFp4a?r~z7K9@ZvQKVs?4TUL_g`DC+ z+Aoq*yD1ma$&^UCJf1BHd6+U4WwE44>B#eZ$fZm?A#4fSr?8uH3nCA@q)R1A&dFm| z$V%@T$`aGoImf2+te+IEjkpI>IPyrg!*Rax5Vk4oAP)-WM@0tcSQqc}qzEe1Esu9q z=zT+3fm~Mzhbm*(O!RmGhAvZ#TSyQGIB}BW*sWp6!%>8ej$;dUU991K44f{gk9m$4 zayT70c|0A*c6Gv9)hRfRlh$j%d4%KGn^u5^VmbNiekt{CrfDhK6x-lLT4W4<4vh);Du9<|0}Uv(oN43z^%=TQp-9XfO- zZPg)(b8%$Cv|z?9F-^v?c*;H}Ei%x@6&aQxClLd1es0k^OKs>Ir~q^z?&P6HBP|pe zsa!TLmFG?y1_9&HEj-hp1KDchEQBv6Nb7Y`eu;~ex9g%zZ$q+Ex}?u|(y4rgp$73S zTh@bDLFqhZ500ZA^GA-bgVAO_&dc=LiZjoQyu*{;Da!SDR%zIVA97KaXF)E;D~}|n zvRp3OhCbP5_K9cq$xeE*ape`l;JG7T;7QKv4Jx)l;UQb9J#Mtl!{t+#_M2>1ayidD4PO2 z$Sp{9a_;Kj&Z4Jer?_Oxu=I(Dh?kr;nJ(;;EY4sa??|$~+z-zAO`9Rvvq^e#eN$Wt zOG@04>m7N#?{|t32S{X3Pyi_$@eCK`;M_MZ3I)BSEUaMS#kf$V)-XTJGkrNXek{=e)-HR@H`}%gA7vZPxx$*;F0sLe^HI%nY_PQ1>PwSWTdG*6 zGlBdjkRQ_X=VFi#U(TaT%zAKNLqz`2fYd&yCMPGc^|oa5Gh@_NZ!hNn_LPSc!QT5~ zRL4Ttrr^=1MH{9|X_H-^m-8VfPx|pR6dz@d=(BJ!9y@eJdJ)P`b@Vts6aI}qb7NQ6 znxRO}BONmCR9;eWXR1Icb3KSpd6XwR#mgQ<$1!m^kLWo5Gs6td);n+@s}1ZZK3|47 zBpM;lGs01Rl*QlG<3GtL4y1opAYl}?mi=wvNblU!V$WxJF;4namg^wn6Z$NkX|g&* zo;=xs^GF9$&Lf-#_8)V=sn^j1`_VRd==`UdR3D^96+C|*oL&YZX|XcQE$z6YQ<$=s zKPr>COzz})iI|pQaps=lQaH-?CL|r=lxJo`nRXNlI?zfxPC^A;AzVxw>Bi>As6zVS z9#?2fs(Vnhdn{M_WT&=-ed4K4vostxisJ#~2a(1C9jX`?FySo}UUkxyCrpNXk+sj~ z9uFS&^?vEapI1jzrgf!}tj7L5>Wwy!Q|1pL21dO`-hZxE$)KP^Gvm8G%5SPsSCo3K6L+Zc`d($%ZV& zXYwe|WFiSE&O?!B((o$B1&U>|-TE=tpI7kb>k%51#d5sI+l~n_-jUied<4 zY(tOhSQ_sPOOFi?9}?e<;IZVlf9W{V(eo>g;UMBG3I~$KcziwhtRVc2=uR`f-W&J4dx( z#kttqoX^QhD1uJMb>gZ2LiRZ(DCNO;Qf5yb(--0r4W~`|H2)9VMSL+YFHdEr@F->V zLA#WGs7^VjU2Xf*ZoF}RZV5dJB|C?-FIdLYQZ2eYUqSS}#YxQN) zW1$I$lFtRUS{>cGURvPufV}buW9&&k;7}NC(+;D~^Yru~Gfoa0$n{Vpr>)&?yYm=& z<|gi)BAJ|FW|X*hxZ7qnXeYS{U&fQt+9J{|Yt)&<=c4rYLvR>5?B?c=S#MzhM-zWT z6Y(JBkF2ywnQ$@9bRMCPbJs;!6_Gt;sa!86UDA7nJzU^J&KsqoK2av8bY9l5E@bbk zmAWXWs4wy;H9Gc_^=>PiYy(h=r^mOkC%6 zpgfW;I2=cgcipz;EfYA76-$0%o(a}FcN z$!R$>hha8nHq2p;+rI1ld3?XW-)H~bd)&v@bziU3^S++X`0d|Sb3Q|xH@V882`L`W z+AC%m-E51PpoA?J0|3G$uDwX5@Qf8bW}L^WgcBAdpAXnJIVc?V1+Pp(%LFw(_^5p74o}*C4HW8J!spDrI!HcijH#<$ z25!DvJd(+{v3ABbfmG$4^;=p`*v>oHuID@N+<+(&1PglJj2rT@wq1CT3EjJSKP7uT zB;JJBkr;b=-(=lurjJResJ>%Bq%=u^v!WU0t}oxX)ugymHm+sZ5`O+uF_eSY=QZvL z_dWB3-j}W<7nCNv`Qw(~S<}lfxbiQZfXf4JA3N{si)M->W)MZmA4ogDRuVeTk1EFJ z^*9LhYoh{@9A|4d?x2(V3Kxy7<%-+v$NQ8jq$&_24+Ejk#}KSFx%VI#(!v%F^ZuKYzjl3HhEG zx*l1ykX_C9{%IZSZX^Aq-pVs;upP%iiA278O+5wE&-O8A?i+V;0+w6hT?Irt+@4U`e4nR( z?dQafd)p`a=GR)#O4;2GnxtKOSlp;QiC-%}3tp4SO$3+$Ud7@oyGV zSkKef%>$E?U6C5(%?A^1Fu30Jn0fTDqsK59iHz{=?=;La{@YQS?__>PF zs*<C6$?Twjj zphLdCM6OJFRHSLAI&r<-_q)$tD3NrIasJfu5@@qWRHN86A;|Wk!gz@;dN5N58&k_) z={>zr@qGC4{=JWVYURO21`77ijEF<_F~BaJf+7~jw%E$NwA7Nyim2S!;5C!M9v0Kv zaiw{OR6=PF5)`pj2-!D@*n9+XEcfodY-Cbswd81A^g)78+;(IhlznO67nMp-xbAaR zPb;0vrb}E$^_};$1lH6s%v5*)L-rQJEqG%&hk`PwZ->NgEF_bDZFyfgr@Wkub>t7o zdV5o2%-l{?%@wE)DqD~FzL0XL(L| zHcI+JxqLFS%i(MR^wBy&H!}*n#n#xOlT_RsnNmqtrTTOuUAL3KuIgr zC`YzzTv^p`sc^^24HLf;I%EH9EA>NWdt0Xs0jOewTdb4AK3%KIhD zyTV6)Z$}?Knb2z$tW+4;v;ZwH?H=34$yr1Q=EzB0xq{8Dc9^{d+L zr%h8nJe_=8aP0Y6>1p43LD*>Y*@NJgf4%|Xg7seu#Uf?`FADCm06p9>f%?|roLwkp z|7y0FC5~Gq&XYa_7VtS=-d54ReN4c0JWVBH?>h%#s9a)bFw#C+qfT+@ci^^kyv^#& z$+FovQH|%)^SZei0q`dnZ4os*+vt&wv)-K!7lDPZW?_;6&#Z(;T)F6-)^$!o^n9of z>bwLNhxL)K=wGyci5qAc8fe_URlDCL?RId~J9Ej#!4xNd&)1}7;S^A2^|AlghcHE8 zYE!ISs8QVt;b(sR$l~e;lSIv=um|Q}byH2e){IpQYv)*dNIHTj5bYIz%H3igZ>#u4 zAhB%U;s-=92S|DVmj|8qZB2BiSMbt7g%Krq-t z6mw5!k!=mEo?NKEGRrIxaBjZIB)8+2*1x;`R=kS7f7GYPJbnPQlve(M5}k)y0-bsw zp3auW+Y^|l8J!q26e#005oXS}7kX*=X_$P}zSS>KAw>v~d%3KcB1QR~0~Iz%Vj8&P`f;%I>~%Ab$E^Dr zmbY)PlnfpxUCn170*}5K3j070cVIq>k@&yoVh%;dMbG0Ow@w#9e1E)s<}bX@@cHF6 z2OhP^j`lPKb3%^ab`cT9u+JA?%%%c3K8M*p}z2G_!OzxVqx7iuHz zV>T|V)-?Pn$vMjqU$95_% zP|C01ofFP|iGNEn2Y{=b>9kNHOl{(gqTKk7LofcDz*v=hdNqS?I9!xO0a^?&z5DwR zVq$i+F=EBkZ+$wb;`FW?42H7trgT#03P7FZ^$RWqN3zgbRrsQU?Te^XzR(kS4Igmi z+CQtl%hjgD!gW^>h)8;jt^4p|W&U&J^FNwu^AbXTSiVQc zZPgV#>6&!_#{Xr4C&_vQ#`FuN4+~8Fu{_ERvi$0Q(ky*N{IC>EiG`-cK(<>2h@m8@wP0ZaT^WhMZJs`2k3`l(=UE1(n zdPI4lvq%wD#?R|g`||15PgWpSGF+`((xijgL?XExPlHRAQtB+I(#R{fDTEu$4X znf6NOEnE2PU&V~qJ#w$}NSkmMIK;WOzepFUqpL;M(eC*fS1=Gw#+KE8WOgszFSX}4;t@P2owzP z-86^Kn?H@Og6|ub!q-@@JBh38PC<52D}j|XCKYBD^MHK@qZQEm$~ePuI6e?{N69+v zc8TagntZ{CZ5c9Ha8b;bEcu35}=Bfb7c9@Erg!VxeN7CNxc@rG+m-ccE_#hI>deioBwIR zzJ&(i$835}i>NGRo&Eo;C(rOUjLXW4@Bg9pu)@H<>Fae8H-VfIZ*%?Kr6`@M0PPY-OIo;phKl` zQ+S^mSB?E&#uEJ#GaCR8{^DWaBlpIR+O>e{og1;Fm8_wWRK@zj0{f=|)o$bYrF27p zetoHsQ;IZo0w+n5w%Lo2igeuM)0rwhRj}1Rr>5PS|6V;sagxKgw(94 zXKa(ImZMXa3i7kvQq2L*&*nNy=uknuj^}KZn>8)$uz5*X@mA)j+FstVMYyMSE$7jq zte$CZM+;{XGYSs#ND@Kx4&IV_mQQ6ZD#5()TTDgi4Sc_>UVt^cEP3Nx1A12&WuiGvyd$75t42LTXwuo{c^l_K9@g7 z@aefo!6scM$;dc)y{4@yo90T%-MTW*ZCfkWNS%OOR$o_ReEl(NH_A8!I2p56FQ$TV2{LbemWo%AS`93d{At22)@-;z7gr%SbbwUv!oHzq&LpE#85A{Y6+#@98*!6tT3)H(+vPSZ%H**O~v#=%`Hg~m%QyG6X?>4wuejNUBhoSXB@zl0k3%hu7v;fo2F@jfm%kegJC4E1_Q;Ap;5kXwSa7c%QDdu z19!)tZr=xn#)=EvEB~Fa+;*QNq;1{M`FY~%z~0N}!O!ck1G8E64K&g~vC#9<@uR-` zstu638V*cbLgsd2CiD*UAk-yY#lMH&^iK6R=NhN};+&#|+%lFsGe9MQAh%x4(b~2^ zS1d2Nu>@1A;}()(D1>`K*2k#?8z~%apo0SphcqPLl_BZQf1Gn?4>Lv@M*uo5q{(#U z*sr-hSK=0kqJZnogj#uV6xc<4ik1aLBN9~nLqUT!eX zo5AfXSRbcxY38zmN?dR{H5I;`8j%HdurXsnj?u>AQJOJh1DXEgWp&e^Ut)QnPWuE@^KA6DH7ee34<~51?@t5x&ic#BjV0XVD1lp|8p2Lx;noT#f zSNt0JIF(ntMWR%Yck;3Q>9XqzRuj=x-==a@z0ACk&n$QEO*>=j@j^P-#Q9<6r$FUs zE!x?sFpc5eKg9gbH&Y1cFX{`x`eB<<#_H{`<)$JX~>V)Xm@od zn!M2W>7k1momo3>9B2Uq`Pe{3g?rN-lxtaQ2DxgA>YVJ4tH74}LWEY$_lM3+9KR&g z{lVx`zaO}RrW5%=v%qVme9G*hhIe*EmV!rpVjG-RRu@%FODX(h%uIO|{w95VvAI4{ zAGd(h(Mf8qMjc*XA09lO0Wc_lPWhH2Z&fB;wisvosv3uJ0Fk@w2?ZC)IFRRr?~ov^ zY#Mv_=K&q8DRI1kk2|>LxBv|gBRL$Ev~v3`MK^^PW#W2F7~JUncS|-;T)AOru=mC9BE#^DCk&!7B0M1FnBvq9XrPsE?H7 z$Bcm&BEO!We5G?KvoqOy4Jfgd$YJX%Cd`~mG4Ur>M~Y|GWo)5?T9$nr!YZGtA?ynw zApV+Y*1HZ*1|^_ewh+x`EoZMg2d`H){*1w&&G^LhrS4ZDXL6SO?r_cDlJRb|3%Os= zEVuLoj}&jNT#V|MtDe#;HCz%GR`I)|9(HC!c0Jk%U#^Upuw_)UlMa#l+J_Oos-)j6 zy;zd})c%TWz0bK7UrVe@O(|~Wr@0@x*U48>6tQ-R29GLJ+R_C-fSPa0^jaV_-bL*@lthVJ62TgXf7e{H0`y^ zD1U+nFiJ*M@Rx~lPj<_W4;J=Kc_>+7Fw{mPL_w{Ayj*0hBuf%es z>+m1#9+7V7Z|s#wXWlZf+q)>@j~N50usj{o=T_k$^zhwrPIaeD6agn!jc=lgG&T)Y zbmbJ3z_GJF8DDvd$19aG&_<1JYQXp@;nM@6-hFZ)mG9tvyP$X<(ECtd`?S2eLbgot zMvo1%M*Or>khDi#$RB@QMxs0-7PT#jn6{<98y)XOtnhC46_LE&Q(lYeDeT^7&WxM? z&W!WQ(cT<-_1xo~4+usM<%wz%aJhS&3qXanFF*Gev*qEVHvZA^Vc6bho|q~B5;a^M zfN}SFi&+4;Z0*PdK(PbV&dqLfaRkb8?MH+?hl=PpPE;7N*)m?@4mUk`rw%JUs?_9B zt!w+y&SO&=^s-zwI*v1Ao+{!YWL~OR=y<3^ ztt!V(9l10TZaI%fTxalQ=tEwlm-se9MGq#O+#aV@!F;ES!^BH|29^?mkZpn5N$__= zR6lkUvv<3+$7+P-N8BqO91q||^Jm&kSj^|0x#Wk_?}W9g3rlR{>2qvLq^qRQcKgrx@njy-kQ?V~h-&Z_&RPMJz~VC(}X zoxlODezapi1e#LIo1IrzynaCOaoaV()Tzm9;MYPrS^e&jbg$SdZ3OA(QuA_)mS0*( zCnAw!{@rR?7gwf~a_pDLu!qwHv!{&~nNITV+%k~oFft>=x_(t@yaR7`G1;tF3Cq6* z;)uJi$hLT4AWxR)8XL!#fxh3KavR9A86_j=#a_7^}A(X?9Q9P zVWo4{`iHfH0@<51qZRr7rlIeysYw zd*nmXCVs*>^{C6Xaf7_u14rYiW7N87d)zb;icMdyE%TU=o!FFablZ|&zvy=K&8AXg zd@pW&kAtEXL>*(M>B_%mZ#tD#{jKr-yzJ>DH9(LC6E#{g8TSc~SYx|*-MW@_+99!0 z_8C>WYz0fY+G;6as{3jaog0gyBw~Zw3p8mAii^Mz(YbGW&lroCKUBcoVcWVSUXT!S zvB8r+rh%lNr}|DrCAx|ATtNj}Zj~mQ;;_A*Gpk|P+0-8Gx?6&^_*}KN*#xg#+-h`o zcnBrvPT#%@sgniN`UZ2oy6McG*^XV7xmpSF=~eW@AEBt>vBnk7SzBP&haQQ4oYT#0 z7Lt33hLDd45cFjfZNXe15-A+_(i%bO5g&d#%qKsY@xEEsgh&Yg+epz4t4j@RO!HCp z&{#FQ6EGPkH=QLBd@JFTtc+aHryQ4VNdaTnP$J1IJ}6_3sa{fZK<@sNFdD6a*jn>% zvDyh_qbbh=<5K((R`3eY?WJy>rta=XR7Zuzoaz|Oam^~zyN>?5r zl|L;;g#lmKs0yuC51PYxeis?!#-9;}t^B?!cp7z$O^+Pfg#8q5%uD;J(DtSjgDEl& zG&oFY}Jc2%ykYo7V>A1sNp3eDF&tsva6-rods@Oi&ilBtEK;IHWFHOH9HUSWw>Jev>S?1iA6s*3I+ z!CRk4$NC<@=kucqd4$lTv?I)_&Im>Yl1`g5Zf+AbI`QLqM4r~mPfaX~5PeVx~Al3hm)rB|Ara=6=q^$K?_nYjkmO#W(Z9}$V3hd-$_u5znC~1Ks-N4O647pE@V0p=?pA=Kh0lYUj*#K~@#}zxql$xFjxfO_}O1l7L-P%_H!t z8?N@-?}?dZV?@K=;q-2#^vcZ}2*xe~EWvhp_Mt?s;nDH!nvMh2mQhxqc;>**X#_@# zN_~ij)a@d_n;~-*_C-f!G@=?jm!|k$<8}lX{nM~NLF7$Cwy&J8Y3LdnWsfsB@R#i# zFWbBrl|bTZnivCpA6{W2yc(7KhEsS};jBgp4jS$)uQ?y-?E1y*_%rf7j}|ghovW<2 zzxE#qNTQNScBSPv$&Xb_HXH+pr09z9TG6lBr*#64TGF^%ziDjhSb#4vgt}6k=Wg?O zQG@7_f?Xm5LBj@R6V{Ri2^+yjJk(VBO8?M*RYnOI;E-2ehW154^vh2Q%fB(U#m<5? z0mmG!iNfB(3B2Wx1MZZ*-O@!_USyn)s7j4-S@#qMBZ;;>F&U<_MuI@JUHsRDf#ca80&0Q|KzLrx>22IW;3R- zI8_b4Tj5dV4BkNU1DY(mpfSeNY5JA|B;}!s#iPM%INy_Tf?cnHANoZPODR8X(zc|W z*=_d9@Gq!X04&RG>UUlLs-2aU2f03ON8qw*12D!b_zR7OZhke2nBA|P%&1n`?6`1u z@0~@qGoX77G}H;YwMZfIqCC1?`Z9ig%kx`egBy9jKm(duh4;q6#@EoSEk`d)3?DhW zhytj){RlPEtH1u?OOu-oGd4x5#Eo!g>}4)0>XnXGymhhhDwX#yQ&6=h z+aEGlmVDTW7pz@LpqZ({ey%98X(f+al*sxfaV+?qGZLHs(XVd_v97MM!|#mgK{nS} zOcsB4I#EJ;Z}u+1j_dD=_U^J;6uq%Dr2R9)yo6mBePklcfOp3u}hf$ zb*fF9|90i91CJu`^^9;q9d&^~QjPgi+3Qj^%S)#2u z^!oU>RNLa4NQF%Va=rP`UHRmZJfw@#GeJQ-4tC=*-~92s(pXok{)&XQ@BP18s6=C> zaun4vdAHnuzgLs;fbCWfVmtDvM^vbbtz8R2B@-c2aXWQt@s}_5_sQc7+(V*i?G+wo zsJ(c}FlBl&c)Eaa%tYd#KNil;N5I4Skhop&CSUqL_Pl;E#yH8wnvMr09>}9ZQL5zK zLmvd;wi0#vg!ASn_`M8sCP$y)>@mp)S4X;)9x0WLT7F-iI0eD%xY_$)vuJLNR`^~- zFS%_?$?7uP{`~$j@?o0ixk+EpEw;^fymN6H;HWc9#w4?b-pc6akA}tm7m&nFj$@7! zT+M(9zb!U|0fCt{Y9^Wg8=eSKaS@5Lx@kZ8bKd@wbA!1G1{5vHsuM3P-$;jfx1FEp&?A^Fm|U8yPSvq!9NPwVTBjw zLzW%_Dp8z*Lk7BsyXzR>^3OLc)HLJZ+f`*ksCHL6{aG}{u5sZ-)^dUWmMaW;foeFOylg$Juj228UJwU+|t{IXyhbDy6-L_Qp&_2TysIMgunsG=OP+fnz=P>&jQvRz4 zP{y{(Q$pN3OeA!nkFhg!mq`YC}#^DxIqv?{R!0m;WlLemGhMjWXlojgu zK0Em_giSDYGWuHAA89BTbE%Gv-{2_*5~`wZrZEb$YSAMkvQD?r7lSOR`ItVOVNeQ` z^-H5;i3IM+ zxuD-A^s>>(T|h>~V$%YrtKVQ|3v$#&Ov%uA41Cmu!Npb8Ng6T>R^h(|EAs{N5(aN2 zpYPWQ1@LrU5A{a@cpobSU{)WNVJ&LR-~ zb#?1n$Q1olq;xbB0Tnl5?csG|g1dh~$T#rGpqsxHV{HPWnkvU$ZPW?UoC8lJwRy?d zbTRi-`+xZ3Pq*!o7*D~*<)N2V$GejCb~}zv)u{jSg5I#{{x77G|LKb7C5YKu`{z0z z%tdgh@|``W8Y>5mymF8evoO}r(Em>-z3E~r+XNu)1!|9_?Jw}iu>{1vHk$=Yw26M* z8e86l3aI)EOxesS#;x5`2{>Y+(!`M*>nUc+IYX?du1_!r=fASTALo?|sviOTy-^pH(q-pSlw z>;G%QqT`v(ecUoX!Y^)Z6juG<*O#nhg2<AA4S^nTf=>GsQ!~AUk literal 0 HcmV?d00001 diff --git a/windows/configuration/supported-csp-start-menu-layout-windows.md b/windows/configuration/supported-csp-start-menu-layout-windows.md new file mode 100644 index 0000000000..6a290c38c7 --- /dev/null +++ b/windows/configuration/supported-csp-start-menu-layout-windows.md @@ -0,0 +1,67 @@ +--- +title: Supported CSP policies to customize start menu layout on Windows 11 | Microsoft Docs +description: See a list of the Policy CSP - Start items that are supported on Windows 11 to customize the Start menu layout. +ms.assetid: +ms.reviewer: +manager: dougeby +ms.author: mandia +ms.prod: w11 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: mobile +author: MandiOhlinger +ms.date: 09/02/2021 +ms.localizationpriority: medium +--- + +# Supported configuration service provider (CSP) policies for Windows 11 Start menu layout + +**Applies to**: + +- Windows 11 + +The Windows OS exposes CSPs that are used by MDM providers, like Microsoft Endpoint Manager. In an MDM policy, these CSPs are settings that you configure in a policy. When the policy is ready, you deploy the policy to your devices. + +This article lists the CSPs that are available to customize the Start menu layout for Windows 11 and later devices. Windows 11 uses the [Policy CSP - Start](../client-management/mdm/policy-csp-start.md). + +For more general information, see [Configuration service provider reference](../client-management/mdm/configuration-service-provider-reference.md). + +## Existing Windows CSP policies that support Windows 11 + +- [Start/AllowPinnedFolderDocuments](../client-management/mdm/policy-csp-start.md#start-allowpinnedfolderdocuments) +- [Start/AllowPinnedFolderDownloads](../client-management/mdm/policy-csp-start.md#start-allowpinnedfolderfileexplorer) +- [Start/AllowPinnedFolderFileExplorer](../client-management/mdm/policy-csp-start.md#start-allowpinnedfolderhomegroup) +- [Start/AllowPinnedFolderHomeGroup](../client-management/mdm/policy-csp-start.md#start-allowpinnedfolderhomegroup) +- [Start/AllowPinnedFolderMusic](../client-management/mdm/policy-csp-start.md#start-allowpinnedfoldermusic) +- [Start/AllowPinnedFolderNetwork](../client-management/mdm/policy-csp-start.md#start-allowpinnedfoldernetwork) +- [Start/AllowPinnedFolderPersonalFolder](../client-management/mdm/policy-csp-start.md#start-allowpinnedfolderpersonalfolder) +- [Start/AllowPinnedFolderPictures](../client-management/mdm/policy-csp-start.md#start-allowpinnedfolderpictures) +- [Start/AllowPinnedFolderSettings](../client-management/mdm/policy-csp-start.md#start-allowpinnedfoldersettings) +- [Start/AllowPinnedFolderVideos](../client-management/mdm/policy-csp-start.md#start-allowpinnedfoldervideos) +- [Start/DisableContextMenus](../client-management/mdm/policy-csp-start.md#start-disablecontextmenus): Doesn't work for Pinned app lists or Recommended app lists. Works for all other apps list. +- [Start/HideChangeAccountSettings](../client-management/mdm/policy-csp-start.md#start-hidechangeaccountsettings) +- [Start/HideHibernate](../client-management/mdm/policy-csp-start.md#start-hidehibernate) +- [Start/HideLock](../client-management/mdm/policy-csp-start.md#start-hidelock) +- [Start/HidePowerButton](../client-management/mdm/policy-csp-start.md#start-hidepowerbutton) +- [Start/HideRestart](../client-management/mdm/policy-csp-start.md#start-hiderestart) +- [Start/HideShutDown](../client-management/mdm/policy-csp-start.md#start-hideshutdown) +- [Start/HideSignOut](../client-management/mdm/policy-csp-start.md#start-hidesignout) +- [Start/HideSleep](../client-management/mdm/policy-csp-start.md#start-hidesleep) +- [Start/HideSwitchAccount](../client-management/mdm/policy-csp-start.md#start-hideswitchaccount) +- [Start/HideUserTile](../client-management/mdm/policy-csp-start.md#start-hideusertile) +- [Start/HideRecentJumplists](../client-management/mdm/policy-csp-start.md#start-hiderecentjumplists): Also hides files from the Recommended section. + + Note: Recent JLs never appear in Pinned (because the feature isn’t supported yet) + +- [Start/NoPinningToTaskbar](../client-management/mdm/policy-csp-start.md#start-nopinningtotaskbar) +- Start/ShowOrHideMostUsedApps --> Need CSP link + +## Untested policies + +- [Start/HideFrequentlyUsedApps]((../client-management/mdm/policy-csp-start.md#start-hidefrequentlyusedapps)): What does this configure on Windows 10? How is it different than ShowOrHideMostUsedApps? + +## Existing CSP policies that don't support Windows 11 + +- [Start/StartLayout](../client-management/mdm/policy-csp-start.md#start-startlayout) +- [Start/HideRecentlyAddedApps](../client-management/mdm/policy-csp-start.md#start-hiderecentlyaddedapps) +- [Start/HideAppList](../client-management/mdm/policy-csp-start.md#start-hideapplist) diff --git a/windows/configuration/use-json-customize-start-menu-windows.md b/windows/configuration/use-json-customize-start-menu-windows.md new file mode 100644 index 0000000000..ff779e6965 --- /dev/null +++ b/windows/configuration/use-json-customize-start-menu-windows.md @@ -0,0 +1,178 @@ +--- +title: Use JSON to customize start menu layout on Windows 11 | Microsoft Docs +description: Export start layout to LayoutModification.json that includes pinned apps. Add or remove apps, and use the JSON syntax in an MDM policy to deploy a custom Start menu layout to Windows 11 devices. +ms.assetid: +ms.reviewer: +manager: dougeby +ms.author: mandia +ms.prod: w11 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: mobile +author: MandiOhlinger +ms.date: 09/02/2021 +ms.localizationpriority: medium +--- + +# Customize the Start menu layout on Windows 11 + +**Applies to**: + +- Windows 11 + +> **Looking for consumer information?** [See what's on the Start menu](https://support.microsoft.com/help/17195/windows-10-see-whats-on-the-menu) +> +> **Looking for OEM information?** See [Customize the Taskbar](/windows-hardware/customize/desktop/customize-the-windows-11-taskbar) and [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). + +Your organization can deploy a customized Start layout to your Windows 11 devices. Customizing the Start layout is common when you have similar devices used by many users, and on devices that are locked down. + +For example, you can create a pinned list that includes a common set of apps, or remove the default pinned apps. As an administrator, you can use this feature to pin Win32 apps, remove default pinned apps, order the app list, and more. + +This article shows you how to export an existing Start menu layout, and use the syntax in a Microsoft Intune MDM policy. + +## Before you begin + +- Starting with Windows 11, IT administrators use JSON to customize the Start layout. + + In previous Windows versions, IT administrators used an XML file to customize the Start layout. The XML file isn't available on Windows 11 and later. OEMs can use XML and JSON files. If you're an OEM, see [Customize the Start layout](/windows-hardware/customize/desktop/customize-the-windows-11-start-menu). + +- It's recommended to use a Mobile Device Management (MDM) provider. MDM providers help manage your devices, and help manage apps on your devices. For Microsoft, that includes using Microsoft Endpoint Manager. Endpoint Manager includes Microsoft Intune, which is a cloud service, and Configuration Manager, which is on-premises. + + In this article, we mention these services. If you're not managing your devices using an MDM provider, the following resources may help you get started: + + - [Microsoft Endpoint Manager overview](/mem/endpoint-manager-overview) + - [What is Microsoft Intune](/mem/intune/fundamentals/what-is-intune) and [Microsoft Intune planning guide](/mem/intune/fundamentals/intune-planning-guide) + - [What is Configuration Manager?](/mem/configmgr/core/understand/introduction) + +## Start menu features and sections + +Starting with Windows 11, the Start menu is updated. The apps are shown as a flat list, and users can scroll through multiple pages. There aren't any groups, folders, rows, or columns. It's a more simplified layout: + +:::image type="content" source="./images/use-json-customize-start-menu-windows/start-menu-layout.png" alt-text="Sample start menu layout on Windows 11 devices that shows pinned apps, access to all apps, and shows recommended files."::: + +The layout has the following areas: + +- **Pinned**: This area shows some of the apps that are installed on the devices. You can customize this section using the **ConfigureStartPins** policy, and create a pinned list of apps you want on the devices. You can also remove apps that are pinned by default. + + This article shows you how to use the **ConfigureStartPins** policy. + +- **All apps**: Users can select this option to see a list of all the apps on the device. This section can't be customized. +- **Recommended**: This area shows recent files that have been opened. You can't hide this section, but you can prevent files from showing. The [Start/HideRecentJumplists CSP](../windows/client-management/mdm/policy-csp-start.md#start-hiderecentjumplists) controls this setting, and can be set using an MDM provider, like Microsoft Intune. + + For more information on the Start menu settings you can configure in a Microsoft Intune policy, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#start). + +### What you need to know + +- When you customize the Start layout, you overwrite the entire full layout. Users can't pin, unpin, or uninstall apps from Start. Users can see and open all apps in the **All Apps** view, but they can't pin any apps to Start. A partial Start layout isn't available. +- On Windows 11 and newer devices, you must create a new JSON file. You can't use a file from a previous OS, such as Windows 10. + +## Create the JSON file + +On an existing Windows 11 device, use the [Windows PowerShell Export-StartLayout](/powershell/module/startlayout/export-startlayout) cmdlet to export the existing layout to a `LayoutModification.json` file. You can also pin and unpin apps to get the layout you want, and then export the layout. + +The JSON file controls the Start menu layout, and lists all the apps that are pinned. You can update the JSON file to: + +- Change the order of existing apps. The apps in the JSON file are shown on Start in the same order. +- Add more apps by entering the app ID. + +If you're familiar with creating JSON files, you can create your own `LayoutModification.json` file. But, it's easier and faster to export the layout from an existing device. + +### Export an existing Start layout + +1. Create a folder to save the `.json` file. For example, create the `C:\Layouts` folder. +2. On a Windows 11 device, open the Windows PowerShell app. +3. Run the following cmdlet: + + ```powershell + Export-StartLayout -Path "C:\Layouts\LayoutModification.json" + ``` + + Be sure to name the file `LayoutModification.json`. + +### Get the pinnedList JSON syntax + +1. Open the `LayoutModification.json` file in a JSON editor, such as Visual Studio Code. For more information, see [edit JSON with Visual Studio Code](https://code.visualstudio.com/docs/languages/json). +2. In the file, you see the `pinnedList` section. This section includes all the apps that are pinned. Copy the syntax. You'll use it in the next section. + + In the following example, you see that Microsoft Edge, Microsoft Word, the Microsoft Store app, and Notepad are pinned: + + ```json + { + "pinnedList": [ + { "desktopAppId": "MSEdge" }, + { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" }, + { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" } + ] + } + ``` + +3. Starting with Windows 11, the **ConfigureStartPins** policy is available. This policy is used by the LayoutModification.json file to add files to the Pinned section. In your JSON syntax, you can add more apps to this section using the following keys: + + --- + | Key | Description | + | --- | --- | + | packagedAppID | Use this option for Universal Windows Platform apps. To pin a UWP app, use the app's AUMID.| + | desktopAppID | Use this option for unpackaged Win32 apps. To pin a Win32 app, use the app's AUMID. If the app doesn't have an AUMID, then enter the `desktopAppLink` instead. | + | desktopAppLink | Use this option for unpackaged Win32 apps that don't have an associated AUMID. To pin this type of app, use the path to the `.lnk` shortcut that points to the app. | + +## Use MDM to create and deploy a pinned list policy + +Now that you have the JSON syntax, you're ready to deploy your customized start layout to devices in your organization. + +MDM providers can deploy policies to devices managed by the organization, including organization-owned devices, and personal or bring your own device (BYOD). Using an MDM provider, such as Microsoft Intune, you can deploy a policy that configures the pinned list. + +This section shows you how to create a pinned list policy in Microsoft Intune. There isn't a Group Policy to create a pinned list. + +### Create a pinned list using a Microsoft Intune policy + +To deploy this policy in Microsoft Intune, the devices must be enrolled in Microsoft Intune, and managed by your organization. For more information, see [What is device enrollment in Intune?](/mem/intune/enrollment/device-enrollment). + +1. Sign in to the [Microsoft Endpoint Manager admin center](https://go.microsoft.com/fwlink/?linkid=2109431). +2. Select **Devices** > **Configuration profiles** > **Create profile**. +3. Enter the following properties: + + - **Platform**: Select **Windows 10 and later**. + - **Profile**: Select **Templates** > **Custom**. + +4. Select **Create**. +5. In **Basics**, enter the following properties: + + - **Name**: Enter a descriptive name for the profile. Name your profiles so you can easily identify them later. For example, a good profile name is **Win11: Custom start layout**. + - **Description**: Enter a description for the profile. This setting is optional, and recommended. + +6. Select **Next**. +7. In **Configuration settings** > **OMA-URI**, select **Add**. Add the following properties: + + - **Name**: Enter something like **Configure start pins**. + - **Description**: Enter a description for the row. This setting is optional, and recommended. + - **OMA-URI**: Enter `./Vendor/MSFT/Policy/Config/Start/ConfigureStartPins`. + - **Data type**: Select **String**. + - **Value**: Paste the JSON syntax you created or updated in the previous section. For example, enter the following syntax: + + ```json + { + "pinnedList": [ + { "desktopAppId": "MSEdge" }, + { "desktopAppId": "Microsoft.Office.WINWORD.EXE.15" }, + { "packagedAppId": "Microsoft.WindowsStore_8wekyb3d8bbwe!App" }, + { "packagedAppId": "Microsoft.WindowsNotepad_8wekyb3d8bbwe!App" } + ] + } + ``` + + Your settings look similar to the following settings: + + :::image type="content" source="./images/use-json-customize-start-menu-windows/endpoint-manager-admin-center-custom-oma-uri-start-layout.png" alt-text="Custom OMA-URI settings to customize Start menu layout using pinnedList"::: + +8. Select **Save** > **Next** to save your changes. +9. Configure the rest of the policy settings. For more specific information, see [Create a profile with custom settings in Intune](/mem/intune/configuration/custom-settings-configure). + +The Windows OS has many CSPs that apply to the Start menu layout. Using an MDM provider, like Intune, you can use these CSPs to customize the layout even more. For a list, see [Supported CSP policies for Windows 11 Start menu layout](supported-csp-start-menu-layout-windows.md). + +### Deploy the policy using Microsoft Intune + +When the policy is created, you can deploy it now, or deploy it later. Since this policy is a customized Start layout, the policy can be deployed before users sign in the first time. If you use [Windows Autopilot](/mem/autopilot/windows-autopilot) (opens another Microsoft web site), add the pinned list policy to your Windows Autopilot policy. + +For more information on assigning policies using Microsoft Intune, see [Assign user and device profiles in Microsoft Intune](/mem/intune/configuration/device-profile-assign). + From 3bccda1ffece251c04a97f93ee4ebf5b17783037 Mon Sep 17 00:00:00 2001 From: MandiOhlinger Date: Thu, 2 Sep 2021 22:11:59 -0400 Subject: [PATCH 0174/1214] review updates --- ...min-center-custom-oma-uri-start-layout.png | Bin 54535 -> 41540 bytes .../start-menu-layout.png | Bin 112528 -> 102330 bytes ...supported-csp-start-menu-layout-windows.md | 2 +- .../use-json-customize-start-menu-windows.md | 10 +++++----- 4 files changed, 6 insertions(+), 6 deletions(-) diff --git a/windows/configuration/images/use-json-customize-start-menu-windows/endpoint-manager-admin-center-custom-oma-uri-start-layout.png b/windows/configuration/images/use-json-customize-start-menu-windows/endpoint-manager-admin-center-custom-oma-uri-start-layout.png index 56c6da08d16aba08aaa3f9f137e29089cf5453e2..cd508b3dea9f0ab49f3bb1a8e03c17d5fb4311a9 100644 GIT binary patch literal 41540 zcmce;WlUXBm@bSR+_kt%p-3rK++B;il;RYMySqz);!@n*U5dLGr&xjF4u!iqcfRDy zWPVI;a_>$EY_iWeTh@Bt$JPl~R+K_RCPIdSfywicgHbE&roX(V)$M*KZ$Q)~S?>fxR&L$=%T3eOUs$}Pc_ed*1 zKFOG|rzR9*U?RfpPi7x2swfC@v zRluLt*4CWv9N)g8J11U!15}&Afq_43b>`1c?gIk@{RaO|!*0)70>bZ?(=EKj#=#Nf zD<&$oWYg$2DKwnb@mQ(f_2v5KwSec1%gGGHiRB&jubp8W5_G8q7;ydf#P^IU&>u*w~nuY|pn`9?n}E!BQnABoGl3hr|85 zr{+u5#(hOm?_&q~Ja3LK_a|w$s(zJ;LoyQl{1&|gH~RYObZ<{eOG`O9IgO2t6V_hP z=jP@RRkpskE2~jq|2qLxMMcGT<`Zw;y!jfW`(C(xU9RoyR0mG zrsC;pOI>GYXJ$u-GKJgIfr^+|AdLhQ#reJCeh50@Oo8J*VV5EX68iH&AA`SeTw-E} z`Rxg`(ADWo!R1VWTtWi&OVq1w?Zbgx6&00`JnVR=z#c?&bb}TXiR|?bUQc&)a;~d` zY3i1i7Uum{uloSZ{?*Oia2uy*+LYo<|lnv1zFj)6#x6DV;w5eJm&_ zkj?w|%(4juz3%SLe-W@6to}6Ia%iDf%DTF|Txqh)PEJmyxjDLHR0)rWDlaZp*3@ij zXn=UGm1(kujg5~Fj}1{^*DEV4SKDvFRR0VPhK!F#6&DwO8uhvCbXBT-L=(+rqoHv- z$#}n5sSm-jGGlu(=+J4lH#XWl61sUN$KC!tTU7G;bu}0jtP&CuRGsdei@)9!bMKVou8&omA%$64f>?nRh!?(S;o?MGHcQ1S-wWkaVc-+P_`M&T#Krq-J`Sp>sfB&3 z+8@n>5%@c(L>4&zd9gAxxsmH@_h?yNd^}eAI6Ov9gPjVvYWLY6QCCh3gZaaW9j8Lg z``*4|OWExmr~b^zG}y2bLe;)PLr7Ztv~tOU?hnTg(dhM8^p!+g`$UqhWca15Z_)l9C2p}UM^RE`Q8#Nq5f$% zzAyCMyLXhS@$of{jp&gB5z*1KSFnxLy?whoJEosL_4rbS(D*q?Nl5fc(l;skZc2h` z@x(`&I84EaL$9dU>SSqbymkI-5Q$tuRaG@%TlcQEcxQJPn@r~RM8JZB$i{DUrc(^z zU{B1o^BRFRJUqOlq(qI;`S}S_XFf@3kUN>ii2?^d)^ zP0huhKRxCT=Y`Op&O5$l?{5!mfGf7Y8j7Ea!!$SF|NDqhZcryFBNM)q{w;3v^c15P zDpJNi?c)EhOiS1oJiaYoROPU49R=9v(5DmPbn#>z@og;QpV-m zXs;fg00%e-yvQUeZtwCya9Gf+r<+?qx3H2Br}|ZYIEBR1G!>#u)5#i=Av6@z>UXKh z$H4oFK&AD6qiGW8pZC^tX zO=M+Fd3}9uE_CI@!h~W58mL9S2-T_1&d!_f{H9@PYBnYa#3ABTR8%C2@R_&2XA9AZ zd4ulws(r~*MuTy>yw0(YS>u~?gs)ONB1)}}Zg-%xY%x(~gfq;))Ep%7ygFDohl-}V zRmd9Irj>I!UUdf5Axpq>VIG`n!#e@y=p_h?bne|iTYUVqr&5`)TX}i8(f7ti{7M)u zy`N18^o1=ggdEr`T!NHjBgdOlg^6WMHvIzwy_{y|=7AQ=OFtXkL_rCCLF+!r%>d|^;r>?FZsZ9^X2~#DDjX7D7mrLpKl9-wbJpqk{Buq!4 z8^rF-`*u)1_Qo9&oS&cH;d#Ts#l`h5m7isCbaZrj8mqh|Bm{m)-B}$E@q@E^ z!*Gd$xx2X?931#b=NA?R1c^&YOk32CjEt-_eI^z3dX<59CSf*_Hh*DasFA$4f2s*T zqM?&lR>W=GD?WsI@+Ppy?fL0_e;@*AL}!YhKZ|?(8c zwET28j~*R*p4_b$%QckaUTl{gg1OP5{Yy%Ix8I`(hc4ONjHh#(O=dNGe2j6Kn3yek zc`#qsaymXhmIzMZ_qfAc#lnnw@35g?ui$>kU8h$`VIgDM>CqZx3*4r?ALGvMUVvO~c|NG9s2({51#3-qLd*)x(spKM zg6<=8;A|Ke7|lL?va+;vc5p-(2!zcoub%EQ^p%jH)z&WU2<*#PcJ#Ub#GgIM%E&l3 zJA1TTrx}TILAmM6!NEa9MC8X+PZkMb%&V%x=nSchiBXn3I6j7v-8?y2FS0X)2&+sF z4Ha8AeU?jk<}w@mb}MNt7T-M|P)AHm_`+u7S5QEEegYR$R#K5WI_w_{IX^|y{0DG# z!~%ReOmY69?`IOjS0ADP;HEId_-}DI8ZI6{xZ+kh#s3ca0Q=uU_#gY7#i9BD{8t%v z(P=;@CMA)AkI&7ewApC>LQPHm@qBxL+0hjA4{E6x3rowt7o)7=@&FTou1>FzW_nvw zfc@*&FUtMYcjlsvm~U8EI(=WBuYS*#m6gSk@)eeq$x+4Mc|D(P^=(CgBHU!R@qE2# z7~T(+GO8dgjfjRuyXO^T3V>dJC4SBmEiJ8;m6fveQpkmcwRIm?#t}fECBc@0B3sXQ1l)Je?0Nn><|ocDz1RH+j#-whKmY4wJZSjxuV$T<!_4W1r{rgws zPfnaN)YN-r&LwGidARpMwr6&mO925eaj8FkNZJojyd{Cj!l{8r?eB9ILCp`6HtBh* zOdaNLjlhZ!08Va53RGS{vV-5hWni`~!z;?myGyZA3{un61F@>gahXfCR8?Um+pj;e zur2)f@gpQ8*1;nrgFt7@PexSU+J|t1T*~j zE)^^MDko_3N=sL_4;~5|vfET$4HbWRe(qmZTv;jTenGRdd3;QQi~BVx2@)FU2*0=l z!0{acdwE4gMQLdO+7Ny%RpnO(SilP}$g*+ps6-A_O+($bLG0nePR(B(!$L$j}|udk;-8^Yk>wpW3NhX)YsbPWfLx%^dTBJ$^BUSw{>^V`8dyz=ckeELL=*G59G`)XJM3>Dv~(rt{eb$4 z4JwNBo97VRT$nUQHx~nbd|+v*RhQ3Sv+*>@I($aF^qI=)+8V(dt*O;j5*!>=4Gs9< zT{fNq}_EFtmu;`^gDG==4 z7l&~CnlIDr?_=@nG3x*EqqU`_p*>ntMFkpRccDTTl=X^eHys@!i!tQ4py)d}J44+4 z+|G!*P5Zhi$iTob>em%7%gcjdx9m8kHeGLV+&7=h^7fhcz=T3ULE+H@c)P#f6jTHI z8Spt^YTsbIp+eGx#)c^3+4M<@iNV?kTlVB?H(256;jYFl=!Ai)Q@@9jmzSIS<#KO4 zDhlbh$vjN-b1UNAR@>ol~nK~4oq z7JwSUsGDy9Sp^ic+SbSjlZ*^qFp(xQHn*a}*3$BRvj?_$r@LD?Z_M6JOY0Sn>HPdW zFE4KpUobdjuOR{rpP&w-58>!-g@trWdQ@cmun-93U@~Cso*_ZtIb*TnIN4i^NWo5&f z1dR^D8$!d4^*5LOVqttRf<^r={N9MDY-#bR`1o|@iN03oD5|hqG*6d7O1lS6#~yqhu%{POhjS3tLtlHVy~PORzpRA zI61o1jIz?J2~+Ubf>rr2S3*V@I}nG~ZMR^DYWJ$%eUia@>~jlW=P;;%@iibUrP zc+!UR%B`(zAJs~~b%IDh?qkjj&OD}0CUA*BTYb_NRuhe(cgZl4(#(~~>o+WH`IN<&bLiIzO)kkC@((Cejlr^%7jEcv>~mo zJ|Bz%=4IOZFTHnfzf0-2INYcIkQ8m>aXQNh3=~UY(YNGCizsCb7f(2TjNH1sPfblV zTxNs7h!_~GYtn_tDQjrludu+~FH&J%e2*mKtY)O$Qo4Mv;;%UJ1MNtOL}+5yA?#Ig z7*N@&s;cM%J_M<&s-`E5d}1TIylfedO3OD@^bRy74|uxvORTZlm341@Dje61Ar<;^ zG54D?Fw`sYt*wOx0|Udsd|45gZjU#Aq+-bw3O>+2KAXHk{Q+=U4phRKxxWUgftt5> zCe4#J7_fj!AP~JqqTZnOqC8a@$)Ydul*wlmTFv`UEDk0pP-&F251d*{N?voY+3$OM zd$+m#DJ?E$kfEU^y1by~{yg65UDZ-wKD1cH$Re`Xk(kk%X38BP9XLntjt)CUIv*_p%&ZnxBWMs~7F9BNwtw0rU7-@SHMkdA_|MrXPisEtr=1gm} z*4Ni5DSK$xwPj?G9*iwZN@vXYgPGwiqs&I!mf5f|tAW=WSwh=YSB)njn>90&tD z&&e@l>R_~KO{6ffv4O!)1K`QQe23RP6*IHGL{#%PY>Lq8sj0Zl&9p-+pfQ*$WsB0q z;o^TCf$4tN9vMMXu6pdeyn=jG%;rDPk0rw|R zG!1@A!9;Wyw3JF1{cG<2Tq(O4-yiWhs&dM8E`R2ALiIP+p_qgOc8)rx6xNjFWa+$q zVY$ed2%T2b^X6i{MG=3iL z&rdDqzkIb@Oxyu8Ju*kJa%o&sB%8OdE}AmE77%D9<;yoQV_XiU@O^88&qOWIVZHeI zw1v*7u*#stVP^*LA$<(Ysme*csvx(*>UQ-^Ye3$2al*3*P zG*mQDfx8Wto9tMNQS@Uv-Dl0>ka=j{@IM_dzw_{Th>21B$;+$!N*a}Y>cQjJwn>$K z7d$(_!Z;)(s0G1_G+!4MZ)r2IWD%do3nB?b);II{Tx>#Bg$Zv?meDjsyZ6QX!@c5O zRD(pJ(+A_=*1HMLvIBqTrL-sMt$csOyfV19#(9@TTA9rG5e`x&Pq4W3%2th+MCoU#FUr)79R1 z`s4MHki$-Kfn18qALaSJxEeH*P|^CB>R- zR-3aQuTO=X4>^=chht))ne#qMX`UG|;EptuY38Ip@mOGH5IjeRM<>x>A7S#4ta&<} zPJiFOGW3O{z&J@OC;$?=21xZtwau~vkJZ#>PbRN(L`+OT;hb3C^&om#a$h42zR0sjPJ&oAQmbsj8L^f1 zQMV;vAT$Amg=YL@1Re*~YlRBLQ+P{Lv$KI|7}wevJKm*brI{p|h@rxuq=`IxuUVmK zc`4&AK`jai2*7#;XXm6w6FT0{6dWFwCND^RpMJPLZSq_^=?ldOl!H@<4Wsun1#GZL zDO0DxidLE^avKI-wqECD|DO4gj}u$A_?4E+{K+kThYhixpI((!NxR%vx19^M}!2W zPi$WX=J_=*+tkQUqFTJ&YxvgW!b)9w9^sAAz`}|pryv(J%o6|{K)f-IK9JIVPnb^ZCXWv3g^`i* zjbZ20()q75*NeH5nvcF#-jZi3=p_7z9Zdplu7Q=9=TP`)=9Bya0tC!Dt1qGC zVS$^5$h#=f`V_eA>9n=T1C?cE^KRb@;q2Fw*)c7S4s14nigslP3-ffk-a#KO@hn6+ z9Ji_{uBmQ{n)>U08s>b^k#Os1EHT<_aLp{LD1`L^X88(U_lKH4QF-| z5-tAz(9MWbjsf2yB9QG)JvW<$_hlTGG>vRb95z;nV}j9ByRr?%K2nP_4vj9VX$}q! zF3!&nh)eZ_hxIf24FLif8XWSaMUOFQ#H>a~*U?_#;_`yxczZjqq+l6%R28));VN2M z%0Tni(Lo;I!i*+0Dl91Q=3yYJ-9C4ZL*;d6UdQO(KL>6bGBPrSAaLFonXEs3qFugy zyQ#(S{)!bmjc%T~1+}ILw0og}dAA{`HVMzCP)WSC>_5&bVg@_BzBq=oj8JO*B7yL< z^t4!Z$Gg8TkdV%&$h^F~gpG0nu!aR;n{Q$i75Q9kVu2VM8{6i2%W}t(;Ei~p^wG?$ z(|M&aAt7NSnI%=w_VD7O%?X*V&%j@qc34c-rryqc;1kyxWirZ)r(My4B?6I`hH7 z0d!))_J#|}m!>%Wu^(^#oOBc){js}NK@{Y^_68Hy;s@)m!KQZosOWI_=T-B)^5snz z{^nCs9Gs)At=zoQ5mR;m*ifRC_4U_!dZ0Z%ux1G@&Mcfv<-*!*bop)!4GqoDzceB4ob_oIAM1N`u#oj0TNf_xpo>e^r5W zwJ{+?tdA+rb4_>IBS6sOn=!zO}x89xsMsTV3PGUpx89dl!_BV849l{tDI$%W8ck; zCuLw9x(!m6?DjSP0OW#aHX7vLeKi69X_R-n{tpcE|06<#BTKb`1>^5GZuartIbq01 zhS1T23#ZxQ{&&}~!jaB_qth(QAMoUU=Oq{|33S|Fo~;3S0bWvW8yx}`L)93M8h{xx z<&gG>_>=1MP5*Y1`TEMM2pn(*5mm#5i$|ux4wr|AxNk6n+XHll|7!T3$A(8JN70C)Jz66d2ugply4BGi7)0ABq?HdzI*R z)-APZ&jTnluyzA%-QDkBrbt#Kdx@E!s%N9bv3|2`a5*{(Dm0kaS=HM@;Y+D#N2 z8(SHg1e$5`U^+?cJ1G1}=iLih3=E}DpFZ&r93aQQNj&od>VuAM3kb~cpkPVobnCE8}LQ2y!GH^+7we57pc zAt~;sdT}^kM)=MrQ@~n7TpW&L6YXeGj5>|a{01nPl+9oILdM2WrGZ29@)(SgNUxB= z@um0vazA%mn7YOFwzBEA<7lxm`eiqz!FtgTKO!QMVgqq$m8`=9Bufg5ihxo8#v%!? z8wDTV%Fs|Xh0y6id>@#QU_gPJdw57hM^~uEsGguE88U8W`1DuQP3s#_-LKlMtgRTC zm=wu`G;~!_-cHH2**}xyL#rSmo^^fsoAyQ>|K~)Dqj_2y5hn*HU?H3w9Kr<@?2PO% zI{5ilovz&c{A1nS6!d)i$G=qx3G*7`zF`__=tySNmzQ&Ja^i70I5?cFb-+H%<%$jd zC@h?%SMrMz`8=7$?;iqxqHgB#P!QSm&s7OnZ*wh5U6$YRqnO!VF_;5Rk8n}Q_#PYt z0`4D+Zl}%lAtx5r)G~4?BQYjswa4`#5XK1!iN&@-kmHX3GL_SD!9Otc;r0}RwDK_R z5Xh^aMw8J9*@H$QNn66~7F@u8!ew{=^+O@CNdCR=iH(ZNbU-jlMn(pg?K;2pf{jH@ z4%1ZqlFh>OcPTiSo;_w=?$1A0my~@Uu3qzyTmaf$*HE|CVoktNB$vV>n%~@xcmc!* z3v@E}x!YYivog)so76zNj?HGP5tCZX9#mrEV3!Sx<>ug+nO)@O;&QRvAhY3!$8P1> zR1zkz9+|U@YqslprYkH2ea~*Ca;l`(Wg#{;fcY9@Uyi^p) z{PaBDGa3p?u*=Tn)3Tqx(9OYencQL}rcC1Bomm*T`;T7f#eOyTXZN7#(yx_N-~>*i zt}$6?P8}B4)#e+}~2u zMDY-m5N}+7&-PdRplaHJ!(t2cyaaJ}cD!9Y8~n$jY#(;8adKvIxXS`?a1OV+JTS1l z3~6-$4sKj_N^Bk|>LjF@b870ah6wfTJ(ZQEwRLsW>n|z{xG0V&XQ(>s`%UmvKp!S0 z`B|^#pd3>>^8rOpZri?iUfC1;o1y@)otP{ZanV_*B7`T(bF5QU4ILP~bhj~x0)`j$ zUCPomWwo5HZaR;qrKOC${pLf1^+JWV_sKCKemVplzg`*VBM#MD+?5~RPni_ynK90sqDKT4KV8S$jrw_+>S7X2kPW-yvdFQ2XM`0 za_}DD;lO2b+tTZ?k{F_Hb1%ZhlhfGpabPMtEq0CV+y`vUnnV49IE-ike z-Ut#^t*vQpaVUNw2(j;3Sh$!u3vxR<+uKn~>#gaV;^HXIj5g2azJ86Uy|5!1v7mE_ zN>EMMIs-E~D9B9|p}xWSgX+Jb*^LwM&SxpUwxLc=My3RhPgoh1fySvtUS3`_AkfOH zl!=LnimF%F6iFn1fI!k0a`y=I%fS6Fj|&wjU52mt-K1m51afwVrgzbgH(2SVLS=uS zo>t}OfBW|B6&4w~K=!u-3w2IT3=9l3v~e7IrKx^u^Srz~K@sszb zrKP2EhX6mnvy=1u{2XZc_lLWq2{SX4eIeSwIxj9RDSPbnA|oN0n^@LXQ3>b4ENyCx zndp05XEorToEQPOieO$o_iUkp__@kpesK|v{5`Us;{n@1zj%|Q3$zgY6$J|y{)CB* zO-6hcx;nuH0wHh`?Y~%Jkn#w42R^Q^LqAth_%bsyOB>nR!j7b1lE0kwz*-a~Cokxc z4FX}4m6hPZy#IjH*%^&7*yHjCr%;!sGPdfwcM1y3?;Pvy?(Pt7J1!kB0aD3b*`Ftr z@}=~Ri;a1HSe?5C1`7zWgt$mhs=lcx_qaU)n$+oK=s(;XX=-b` zpPuNS(dhkb1Ev^eIX?%U^smcf!mIdJ=RbSDcXy8-u^+xrVB5QaUi@@)azaLgoe-aD zY;FAr6g5Z3ODt+h%-GmmcfXIOwx0ythT?#9=k#Y`TzC~1XsxgY2t%{G2X?*1NOKrFLoBh__2aEC;sSCOU5L?Jqw+8x@s!uS9soL0rmaK(Qk1D zgwS~ZW-ji$Jb5q%6@ws=47OxkSJaD?ia-9yuKm#VX+5Z&ikUouUuI~;sHdUi;O@=u zi;KNhB0-ko*{oUb1PE9Y8G_DxbHk42N}kRqzaH9=;ro0}5b$KXV`@%IOLuX{vjqdpiXocXf~2JHi8$d`F^>PR zzM)aD6sG0*bZE{0BSw;y(~``*^BN^dS1c`E+z=Zc<8(z{nwuZMh?JCZ1jg*gM=xB zB|y|zm?}|vDoyZAw%Y%nh4o*<4R;uTm@sTQ(5@g}6m3OdA;Kk8zY@%z{B=&_Z|6U3 zv)9MH5TL+*tGsW(?_2r(yI9d|__teWIk`Y&Ap48JZ7l&ZWov88m_!5vhX4@%uBrLx z^lt!5X|R#72Y>t^diAPakabE;kEGEdQ>2Ln_x*br+<Zzje^3zQjf z=;i%h(bE?tUk04>0vvy1s|zGoNc7R}D1o_Rw$H=WaOO&r?5Hfr&SB!dYIc|(DIP*J zG~Ae)QWk>^1SOr{=jrY^b#~I*ivnIJxh@hVnvSRy_%=DH*@p z`L+a*IT%dY8E|$kvuy7f>=8B@0p_LI(&$QQXy82VaJ@YV-eBeTxjK0EJ`K9#!BA4F zwoJ%3gsE+HeB}CS-y0O})J%ds{No3FslVy15VT=8%0x%0=wfn;db0TN5U!-=0iV@} z->108j<@J6s8J7j5-8ul=Y9HAvW2yUfw#%|I3+bUDzrx%nIq$XuHm|d4% zT{(r71JLlWI5Q4Sgo4cY{iF6gXAV>O;bHBR{b$w0e=ZB6?odh&dy5{!^8d>b@tPF zYi+kAd_E=@JFkPF4_8|*Z%FxEk5^kh|Mei&T~RO7uv=*){c7|SgoKIoTlXRC?c2AF zE-q8|u+gdPpAIX*tI2s7s&b(44V`M0s9CGnZ0_uxzr5|l=2<&hgl1u3F_Kgy5h5cX zXma{(2ZAAdPIp5O*GEZ78$ZigVczE#6t%Rq1(JsLf~PO3uRkO37k5)FDJALX_iz0c zFZZcUN_$@rNCqd84288TkH%(bNEy zBIkQrm2ZOAP(t??SzbMYR%8btEx zNOR>NS+Zcb>Y8>@^3i{O>B(qYkD8guOQ}j59YN#u{4h`f5z)C!%0iADX!ZI%g8>T< z;;ri)j>HeALG);i#E0v#Lg)d1{QRH}erafE5E2uM4Y0gn0MH|7VhYp&fUE$jL!$nm zt&ODbb9Rk~i~H->b`CK*sWBTNNPyV$EUB^`O|3v)U`d?pk0?JG7<7Wnn--HYmW4J2 zs`7rW;U^mtDqKV$ok~aqkv)`YnzEPF=D~=gPb8$IBcP!vA_r3v5!D-pg*L*%z;?gh zG#tXbf<0!<2nY-MI(3l41`Cf0Ws8V}9&&>cHp&_m$kG^!;FL-Z}j(JVOLH}^e1`)m^RvVKt2*Ei6Br}fVe3HrR&j)V*+0PpMj z(&_!!OB+a=J3QQ@(CPFW_{?x&{>qYwnqNWaw@cqmt2rWq{VQe+L<&V~F`_ z8xjlwITNtAPg5De=NNV$ZrsKJ8yj;-77!mbZ>I4f}0%aD@lFD3UsQwqC* z#Uz3r*7f=sZDc>IEQ~11@=bYjx)!rYuQUW-0}b=HrKJ<^+FU;zT=zc$D?X*yV+DtR z@cuoo$av_4s+L7qnKgYiUnmAC43375hRgkogpiQXzRN^>eEh!_aJ4CKv(bq6wR?K{ z_eAE3kurtj&>@H(x_;j9FTc9Jx;I0z zYvltLG*I|*r9(sxa1rhv{f*-K|Gqz%47grxb5&9?HXeQF4Tbv2#RVVeoN)U|{XW7f zDwNF_Mv}C~Z>Nlvl;pTM*n&)|^lB0&3I0W6ZG8uCY*FFG5~TGMrzqo$hhBiY4vIJM z5kmw`fR`onMMhqpV>%@^Dyq1o0{RlUCoIg~6(hbmqBWe9*XtmShMvAczfLDc(QYGG zOxj}T+52(HhAZQ0;g2rBE={$y+xG8u8*SiIp>2WSR^3qJ?BEmx<2NJ5O(5%YH3V8; zRk!8P=s1YR8d_N~#=m>@X=t^~(Ofy8(RStYS}h@OgRWab%n1lE*?`WMGiC2~w1Kj!r=(PMOSat; z92yj4vsx{pDu<(prsHrAnEL%9 zD}jXwK~-cnrACSb-kQ%vOnK?q>&%$aAxk+Eq0xQug2KX9+cuX96u6bWJ$z=yyn+g} zEI1236}y~E$RbeI55Ga#6Cff$e$sO!omDGSJs)8q-c3o*%={Y@NJ+Iy8$RS+d^8`P z>-N3yQSuAA_a)rj@@dFKI!P_!K&Jff!)@RRtrKjU^C>(h$$>tvPZJP2*?E=$;((Y#jw$NBbamUZe?(tiT*d6W?EM9A3PjZ873LRutO z`~t!pNlY4V^lM+u6&t=hZ}vx#yuaAb_Px2f(yMVu3do~6r+5&Mm6LrkxUVqmf{qei ztX$*g7w8EN=;YtQC{mP{KAtIHq6u7q2@PZpX&f`Dt#8<9QjLT9JQNg;vy~r*$_~dT z>?D&qJ`QkIXvS8fb+NUds1_j0DMpr`kZziGrzN2ETts?mcSm!(<6_&|h_NteXlVl^ zsMgbf?`Czplnv~%_RoKa&JJ@Xui=WpTZI+QqvFtgF39<(f zy3k5ztKON}H|tG(B-Yinj}dwE2dvF07DuOGrf^d&l!qP&_^J#~_59s$5hauCY*Kg# zN@|M$+6JM_(_)1LxOq_D=ePFKV%YW~Bk}0B@NL zH(sk2`Qy+ppF>M_cr@EC=dAS<{Q9ZROS+K^Ez*g{rk+DS^(~yDIG`{@Qs&E-&x$cf zJgjtdob&TjnekZu{5Q&Ql+9H0Ag&KB%ie+Mpz9sHtK3J(cOgf-1qI zK8Uw*cTer?6ddwna3uuUr`h&)Jqr;IZS9ZL)Ku6%gHPq+bM0)gC_=HQrS2Xc0y>~F zk5-z;^Xx?H$*iYMC~d1<`~4 z_*yB29{xhPSdFcGyWS2OvVG}xbCZBTV=t+|{3ii>x=ptlDu^~%7rGLD)pQz~Tv=QD zlex9js&VuEPZK2=zYGAaMXtj$wnF?yYi%E0FuQ>Bs;;hqJ&f3W2UKuUUMI|qKoBD} z(IVP0%c)YLu^9L4B2Wt%iEwp*-6ZgTr=z2VDFULS#hQ5AiA02iSXBWO*iVfMF-F!S zBcq!Lv^KRsZj{4&V5q(oSiFp67`42vPjjI&!M~%$#6`SUQpGUSlu~r&s}z0Fk$@JY zXFMAfVU@>r69aX``WJd9r5Yb*IEd=$YU%VgnhvHTOaagO!TI3|By@}N^Tj2_h54U! z(3DAuh;u0Ye@t1NBEEh)WB&Wb-931BR5OF$-D+qmm%z76xIQs9FQ@Fg*+(>Dc>VTb zcBo(+E?zmk2TLlC{gFf3kC9_;y z+grv7oeR1<2M)|t3&En$PSVC=A_lqOp$*tsd^Rh#wg`J87(O=>8hD}!{MXQrV;Pwe zr>wa__AGJSGRMReZ@>LC{1H1jF_G{}FU%v5XILsMHWD_wq+nO{dC$xYM6yBP)kthh zn1QR9u7<#<=G&naxjQo}lU$(5<-OfsN;a2R(A@=GIjSWf5D#9Sdg+b>;U!TlAPOR~Pd>1SN zIt}k9C_RJCqs7g;7f_&PHhcof;h(QBZv%b4aNzQDwQ=`Z>3lRdmrE(?@}g|5jEHc!L->rcDzl;4xryZN z;okEav>Yod>z_OklIKv3jg3HhU5v)W(K?{^-NdbD}tU<>krV_zcXs74xXCS74b<`%JFwL)9TRrTp zByq&lhSG@aIn~tFaB*>g$HD&YT|Z$L>}qPl3^v2NE8_LXj_yB!tu-J%4?JoH{xFZQa)>LQpUJNpwR)(P(!$^|UR$>E8RnSe_*EiJhC?NLey0stIOq7(*0?X7EWgF(EE7u6HgZY~9ljl$R!7S&OonR4R1Xz`X zA@o%3up9BNNC^VpDQIu>0{Z%36rouAH>+F)VkwBb`$2g_rwDMDL7Fm$MA^=!|LSm_ z*oy5OwT4qMMll)<4LB&{i?_R=gt+`!od&B|dLwP1Kd;8+_OSry%PEW92d${r(84MxssiuMl?$<H` z4`>V`8e7I&b^Bw%eOr2J=i!LryEGFlKjUz}FB+LqAY` z7r3>(Et(HE9SnPWyv}L8hkE+BZja2sh%0}!ZZY7{rCAk%PK^Hwm&fje1k(n9jBQ-z z6x42K|94HM=XnPQ#kW4J2l!Pw9fkUBjR-fVfk!%QzR%uvc46c~#xPg8J$Vz^++Z_b zf4Wyj9jd;boO966a}4)Iq=J4z`E<1YeGtC7_h?at!L(Shn!rJ;*A>YqdCMMSA^hjOM?Y#u7Sw)5U#ib=;nP5c@&F4YjPq(St7NI|Zd|-h#3sCOJGb ze&V}du?eIzzw916bW{xuyN;U*Mw6?ctY3#e&?CN2o%1P2)4$GKbZ*W9YYNWYRiMF_ zJN(mW=~`-3`k#?={sh{>+?F{jY3m5@ddBGFxvo}P|Wm6t=|dz4(kq*(#X*??~glc)s)8#kUk+W#6_cc$0%2$-Ft(dk@) znl#IQmHdFnf9j>8hG_|1cyqQThPS)>&V2m2kekYvO!+G)1e$7JFC`qkkU;L1H7#J5 z6?3AC5OXM!fR*cA8UzL`H<_92db;4=Si<<1fpS$=dsh4=PnRm6kob6)@9X<|>id4g zo;~h|61y(57heP$&Mmy2-EN7$nMx~y15y&Z*-n>OaQ7J0tgJ7w49HMinkqpF85yg- zVk%J0nA@^nFo{m|n}?Yb;E0bu{BWNJ31QxeQ{~raY z{_`#V`$dvGxilA~J^RRMjNf27g|Q_ucVb1U5^*_y*IuZ}+@XQYm#g?#gOi}Hu%^5D zwJNZHp!D!#*ZTi(Ec^fe?F>K4$JV%#yEy`p=QpDMY&&iyq315A*E7}5l>gFOn0OG8 ze3)=~DiQ04Zl)gikpJdtehJYs!jLI-@5;g;UMy1JBB#pJWlyFAVZm7r0KVGV`fyPo zw?C03;Cr&#;ptjeTMHN9dkysxU_M!Q>Lv$X#O$ZGv$M0>;{6D|2?VHqHfC%ze1cH8 zp8%EvYCf=}C@Sv23T}1v`-e`Brs}Er+3}GvohFw*)6`N+Z<0-K+s@qDiMcDmssicW zZ1}H8G>m+Fy4cA;uj+CBO*j@IYbGJ#t>F@%-DQdp;6>{1U&U?rbFSY4uwq6g=1;X+ zBwUZ%r(I%;|BJP^4637zqBSEBEI{x8!QF$qyUW1|5Zv88cyM=jch`fvySux)Oy|3E zr|Qm3)l5yz|E@zf-Tn4{*M8R8646`mKple3VqV$M09?b)d(y>)HA@N&jC&~Hn;IAp z6W^eE=-Q@JQUcnz5g$K)c?0U2tnNU7c*5gyzL58VBxGb@;8Q2wl>JOGJvGHcBI6bM zG%~W0N2M_Sp6;@(yz$aoCr%NK1AT>d@#xOW3+|PS2O4@N7aIiEdvrj9?Gx&uYMre+(b)A`NGVoc}nR8FV6hble5XaF>XKAbLAdU}Y7Rc5SHU6=s$I}rMU z@MFR2Z3Qs1vAMZH0oETvS@NgO&rs>l4}eJJAK>@&{OsMVy1c+ASXNQ7-lP{;7B=er z`g~~r1bkY;akyd2mgeS^0mnIlU(Vg>svFQuMGrBtu#k=o<}1T1Y;*UUOE6wd=scRsNU z!$~8I4Q*O)=$|e-EwmY(r#4+%t~ZmQLMxa4Iy~I1^LP$-x!#W%+&L;PKAiS~-0z#| zxtYufq**@|3`t}0a7`%JR4G+$av6>Xa6iD0BM?vtXD_CysVS^f*WOM`$YtL1Hwp++ zsBNg>wSD;JY&201sJru}YBdJOb0?*xDivCF>2QDg^+|v57&1F5F1ys|-Jk5wu!=e2 z52$=#c05U}qDu#>)|nbe*fJ>6TnNX%-KB(t4A-A70}l3*(o%C1lOmvtK3BF3NZpNG z<$S+hld-V1!3f`fT5qg*JY%O|y}k;MYXZp*>XF)&CewSj*epMjMgici?3mK$rQ}15 z=SIiJ!c72m^lpzOR(?7ArrQVb-8x+m#`u6mcVk%yvXnQX|MMU~(b!ft1oB|@Ffk^< zhrw@1@on-U|Nb1C16ar>sQKMul@v2`$k?@B4nDM^i@^*6(K4Bn3gkNgZ8p$9e{TS! zzig@+{{e2~=a0TDFWZ^??%p3{06q|c-d|Yw@$nIGtxU?xmj$lN?V|n2m$B7q?eLs} zct`+j^NZg2+JRL;gTN&{-5-OE&T*|pI~W5fDXAnu^714v=72*7sN3$J%qCFXZja!Z z|Fz@vMCZ4*2oFB=_Vj$k{(R6M-y;L zKyvZ|elIHp)Qx3@{oP#(O7cHM=RiBue9=laooj4()PL_@i#N1a7YK3M@9=&_LfVW& z+s!!4@9br3X#@g7Isqn*WpQaqfVeO!xtSyC15(=Y>x(f`c|N9{UwEDc-aeqh=E<%D1^?OT&=BA!iSKFWPp6gT!Zd?diUDc%KU|6|WUnoQYS&z9=wTWS<^IYJ$0(!%NmNCS=D%bFR z4TXgV00Ax-fZ&^tcER!cF*pv;D1Ai=@#$m%-W9^{{)0ty=kGtyz+D$2E2!^ToBK0T z+xl*QdVmEaOJO2S<`~He+ay$0RT1#gMMP!;wo?(5&&|O@5<`xTjzInf$y>AiVX&11 zlF3IU3@l{%T}7qYk&kK$Mi2IX|4DUcG;~*#nlV zuSZ*Zdvom`0ON=OC7wNxfNxV&Xg=F8Jl- zCW276;PD`uP1PyJ|ZC*k$&v?Ak@|04~1Z5X*tLG^S2!v zpy`*FmkWJ5xa9VHIT+mTw_XE~OW)rD;0mwzH!_*@Mw@L{V`IQJr~)jQe|w;>_Pxgd zLpoH0<>Du$Gaw&oa+3aZsm_-YKJ2I|0#Wf$HZ1J%TXO0zaQiC)9>>GU;q?Bv$JtsF z(Kq)gkSMSyF=3qoKLG5*R)Hu3b4gur)OgsNPq>DlhoHQ?jfhL{C0gpu%^#Q=G(wg3g!tE0v-q3;E zA0Su?5N|glxW)M*y%-6|VwNK6vP#~}=0E^R!M?Z%(2)rVD#pv@Y5yEb3J{9nKF4C?f4dZ*TqD&{ueS+V>A|0AHhjsOU(9a3TDSqC@Z6 zMGE)uGd%x4=zjo_E`%#%$WlZT07~GL;m1fBjG31^A)=$IQC_|0~G< zH%WQ_U;ZjTkj@t^4e?mfZMn1KA8(WF@~?jLLJg)~Z1fGUPWK^x`SP#UCfpIqmc~O# z&MpOjdoij7YV?HRIEZ$LAgSU}%jz>zLdgP&?4JLu0{7^xxQ>-2#DDMyT7D*tRA8Xt z-|5CLJBv0`N+YBDo-0P4Lx0r9UljPZLxu14b&$tc&L`r5_`fS0=$8k~Ur!%k{RtOe z>HkkbfU?1`DWftHQs%EyBKY5c=o)~D7VEMa7$4WJwf-1080!a4dn!Ho>yQHRBOEx* zcZk%b?4DSATD-t=AlqUCu2CR~t|44D7=U@Wyf)nd%>vNvrY9xCUG}VrOY|0^V?7)F+H?Tt9Q3i8g!bvY63Bg zS2A#NX);c>_Q8Mu8Y6|Clu`r88wv^vAvv0auYfz545D^hI}7{m*4$>n0~k98FDas0RQp?qU&>G*&Ha zN#Ts>2b@P^HzpvjG#+jShU&Tqg#A?;EAHN%VEs-rR~VE`vM}k13NX^0DRw(1ajG#U6e7lqPslU$TRe zrEt4NnH={;9xoY1AREs>UkrdJD}jP2Ejm^AeB%R0r;eR+nL4-5R!<0qmlX{%KAD4q zgWpI8xQ?0mn;;icO=Tres}%$l9c~H+@>%`8`H&<*_v2do`Pk(lcoRwQ4dX!{Uza@qi`;2;9JqgOCXD z%=5630P-!+yUSz}41@=PR9Kmr;|it$;~#MmFTaS$7k>eh{Szs|s2?~ucD8nFoI>Mm zp#9etX{Z~gRCY~%Srz0Ed@rh%kpnqR5XuekRHCCd9IAI&>G;n>3W%Q%^(dU{_Yhl< z)I?d#dxb>^T(HZ31ZZfWjt6+H96}|Vm&U|a^;1v)V5gGaL;a8KIXpzVI_BSB8?H3Br*TxvjsHv`3 z{?>v-jEU?_1EgvI)p}{6^FG>N;9iA>UfhR(0mapMy@d=_7EVvkLK6hCdwHk=-q3{w zRcmFwjK4R4fyG-!B})OE#TkJAF3yA|mG8ubr)=LXRCj9qe5-iH86)foul)_pn&%g% zLv>x<_07c}i{DqV6tm2;D&@cKE-p?MYsenxfgRsQPvoFJ8d{vgF)I@b(^{kF>hy38 zpomsV3M)B`CfC_FzZ`{0FUGxC=qHk|6>n(J4-tXp_>r1{AgKE@f;vDq%n)YHOR@~!we6wv9k{jww-qZ z?GPqbRzP4O`!#r-c;E+GCmImNFG{pr<|t=)GGN3g=of9*hWPXmS_BU7mP3_#uE6ml zu)-1Y_vSCx2I<8aFOUNwfbS{P|6N2z_#2Q4!Nd3j$N!BqMh(dSiHahC@m-!Y6@Eg8 z_%!(&9RSgKN*>vO19GK=ck*&nKCvm_F!YfJueCp(i7L}ZM^VUnHtkCcEVHX2?NmVA zYzq=U^LzvXDBPnX&9FTbh6HJ?c#&Ql>zbXAY}tR%$_|wX+olZV5LWZCe~%NN#xO73 zX;1U>84tYnaF>AbmplvWzR-@*dov3 zyC~{kwwAx!p2JnUA}ZJR6T<*Rlt*H9Qi~hK19d|LWp!8vhSb!^jj5&l)E?+{47wc9 z^@8rZpGFdTj4JFIpPq?`v5bR-jcZ276wFWYs4Zw96gpqCQ|N^Y2w)gWEZI$K(tn;5__%hS7?dGGFM%7 z`{aPCW4d3`p?X>1C=gC9l*n!4ak#@`#pU{H3o9k|p6wGu#(UQfpFYZd zc(-*HDBk)T^cnt;(!*18rx-4~>!!(_G)IQXgU#n<7WjY<%y(_WHoB(m$$X!+dKf>R z8@Xz+2fwTufo2q@GR0$_5i#rD8u*2??vH!Usl?bv+ww*NTjz#XUX1 z&E28!A$_lG`YT%|+*WB`o!{nocpQt?eH<7?5wU*S_N5ki?6fnzt16FB;p}Vie*Mnm zc^Pj*i-n%nQeVSTcYiVqE+`?qZF4NE-sr%j^B@t2=6{m_3W6Q8tO@-zO>+ueyNYas ztWL^7jK}X*^48}%x%f+E=DKCQ#YT2Q5gq!gu4)t^SjpM#MLZ2rojdV{eI(B3uO>Hz zK+*}_(lHGv9i)<$p-D2|Im8zm5*pfE&T}fs7|w~1IEh;6b@t>Nb=aFK%S|m93C8*N zK&tx*U%RTwtCeWN`VOn+;+xQR#8=Cb-~0T>n}0n#h(q!dEF17UvStR zj|SRJn(d1t={8!`OvRW?uO&IMOqX2dqhh9AlUJA9UvjO&6$6=w2JoPO%$#=gkAW!9 zl)2gEL6dSg+s8D=TZZDVQ=sAqoy9SFF8u5y;*!Erp#-AAiMT?Ey}S5QBmPN;u+gx( z-KdWQ(lmk|kX)1IRbMCZuETOah6cB)(~h?50T{;gGzzQ>1B0T3po|vaTSqy6CD48e z?s_3j^}u}8`1i_I_)Fv@8#4p>ySi)Hc@ee_o+&H)5oN8qXFRTkfqP{o=wlhYUdx*` zFb3wBn7vtc%GN}5w8;&>k2k5LEX@4lv)V~?%z%Sft!Q6P-BL+|VxtBTIci)7ef&d| zxhn1xIXlBhiKge;w9o3oLK-qE48gOw^wMA}O&ri*q~AASjVdq!EVFMbOf(J!qSDMO z?nU6RA52)tfIJyQB78#+?UzXbBQzn}HeQO||u7Nb}Tvz*=VlD(@K^!?J( zTaG-KAPS$c+PJksuEUG-JDzYATFG;RUw3* zpCX6g}-jyztGUVVz|DIf7a7BgIWJlmf0 z&9e3RunxK-q(cCu$JY+JI`9o_R?9>Zi5&lzb*&8}Jli1`b+@TU48gzl?~wmhiyqJp z`71ala}P36bj)x#?xSzo=1l zF6;j8P)S8N{{HqCfDkUmWlx=>)u0H!J3jvwL1R7IOmEC~9c*_JM{I^{nbKbONLPmM zOvPAEIB!#Ze%nuCsGzl4d5~jzW)Kq+cI;Vf!&afzuGhUSKd2UIY>S$2pwVs*eORu( zx9)Y@&P;NF!k`JG+ZFTC{@B32e>u7z<^V}{#mwY(mmpC?`ZZbO8>UZ%3m$oCWwGMs8N3YMUPUVpyzm15oT6cfJTm`LIfTq%8(V{M5DJdD-#o4XfU|o;aC(FSa zJEL@{;Q1hm@TMx;X`6PN{wQB4w&lcV;gES)2?Zi@bj|*E2AeH96j6ArLQ2UW_x+o8 zW(*3|?4<#Pu_JRT1s0a$2;BCaycliiykGx2`CrO;S#c#fXX`96Twrplpv(Rr@R&(2 zxsBmzB966k!AK5|?~u?2I47eS>Fpp2tp`=VNKE^^U|lHLX7Ub%Hm`oYt>VKRD94*4 z9>=Zk7@w8onSx3!^cVYz!hAv48rX2`#pGudfAX{E8)_^ZWY}e5?*jiv0BI2ZyMsc; z4*S=iF%WO$r2#8`Ux9p!7G=C5kVSKN^;|UbIa7XF6_${lsVyzus>997Y=XCZSnFOZ zvI3X~x0+aaCT18aBDK+FUx!b@zp2glizeyaV;)ie_*$bYBYE56>}Zfu>NmBl$%Y&q z56hkAIBaa@GT-tO_iu^FC`hG4uIhDIqcjyWR$x6hrhxFPFCGULSrrfS62^ak zt#4i3y)(;d%DCb@Tux=HMkzP%D^fYVHnY4!!!6tdnK>G0Uk#istjM{N5}uy+*4hGr zzl^S;xGoo4b~LptuF{+JET*SaoVNd+%7TPn@2xt6RB8GBAotmE4MDHqta3P4Q$+wIb52ZMb!uUy?!)1m zlPSDg)3R~HitWdi%iB|w7Q~G9_Y+|onv$O+C8vLo`Y3aw{V<>$@fzK)9aYuE!^fZc zG569qv96EdtkM?UPDbLMWwm#h3OU#k$%n9=?VXh5rZ87V!=BE}0ao3+%3)7aGYs5~ z%No(ISF<=fn++AGEd`g;>`+$En&~4MbedR&!e~67gkJ zmIUHbRd7T1PMzSY1sSdSGT3*p)S-oyIxRmyd7sO?@9cA6{p-@}R{HJWE}`h3lvl#qkxnte$%!$wZ?>Fu>Q{0F*_7onWvkJ* zEfKgYMzc3pHzl9s%|RaKBGZvYA@{f(3|5(kWAGSM>fE1ob9olsNp)wY(gG3A(ivxp zx$4BKbI|mKee(hl5G#?yd-o$}@mR9V8nwU6o*?A*KBv@;yz zI*u72QTV`hx2;FjABOWhy--y`>(@IaS-+#vA;N0a`9yn}r13|na^WDaNLjw@$cLU%(*e9s|Gw%U zwKO|VkF)Ym(}MDvd0<=GSHQpC_vzDSVo_0*W>%kG3lXaX3>#&0LyM*S&SOL)GICi4 zSTF*tA=C|F>+aLrhf4NL4@|#-IID+IWN>*_UHa1LE&KG5gGfaa@;bm*_Uu?xXKLQT zfeCFz(LSxw$#0RH+#w!#iot8@Ah(-SgR+uxfYIJw$paf&xZ1>pM(%p`FBf`wDXC#r zH!n`qOVfRth9)X2*Ev|66H$}bk{2GXNf9-+&ptRzPOUB}Xeke zpkwW%ldCz0zyQI!KnhFy%2;acMRS)C3?E@(mP~=omF$<{cXGiJrMrVauQR?FAXqb6 zG^L>muV$#=u{UoeGP!RGvzLSuSD8V2@{j$8{RRKKQVe@(qoBXaDW#Xb2W| zs6MUrhly=uaXx1y<_K%oug$VxdOBd2U z(&nY+Y~JfJkmswgnz++iJdUM=Fx0$^w(W@$qjoG+5J+2YDYJs+eUqZmJm80PjX|GS zax0g%+%QVpp9B?<1tu$B9>oB(zks8~WLx9Z!1Zu{aD3tqFOF7Xjt5BkGr-dzdpA1s z0kxP~jT|)yJ}x^`j7(S9PA}R(-C-UwR6RYt-Y}%im^ow@k6%X3%NgovG0;XlB0Lr= z6rw2l#M#$#IXz?!FZs8U^OJZnxfEfM$#F_@N>@gEJws|ruhpD_WmB&}HdE`~7iot& zbh2pYQWDgQ$Dyk|*RAF9vSTjm$DOsg40`w0y(1A!B@gLKD%_pr|Eh#PLZDl$m(K-1 zWtqqiQ6_fc&?prMZF`RspdW>Ubd)OjvoNtrl;}}cnjOyP1aJ0dC*{K>@~KQ*!V=w_ z*C{tcYLd{hwb(}+kEpRFKK>#pYPkzeTtmkFuKmabBY zBsN3~v+^+J54>@t6(qSA@XII-IB!cF2OfPFN(DmXNlx_g&(lOB?J5_-+*ddRaTvGe zBJ#Re&#M@>=X~)Xh8325f=B^e5kJr*# zgvQ0jZORG@ORIjfrIIWGqa8OpNyw-n6%=u8Z7#MXNl+EQE61adKCJ$gETc3wE*695 za5=g}ghO{tDr|L;KQFS%$MZUM=Ch-d7D(I7}icA0XA4k7JtMmAnrf4VNR zp9aaI4nlSy0`=9Dl+Y{5XJ}nhOSP?UeGIoID`CjdRx}B_W`gFZ(Z4U-7`j?Y{F8$5 zT0$m`X_+e_?d8B&?L%5fH7YeeFhC_g&CDvH5!i0gm+hHdrF}64ph&E6s#8rXF)^Er{_;*XdCu^}EhLeRSCXS=0y5JS z6({V>jf$pvROn~qS!_;9Wi}^fN2J4QN0*%Kf2tVSu}gfB(euKz%qMkCkW2hVz0Koc zj@|TyrO4x)UaxssPW(q!Yg0%~8sVw5FPXf(lysd5>=(*9#BKu?YHUK|LY1G6uP!TM zpOpsu624t5Y$nW}&L(}0RKyJ z*Dt**XO1EOG2e!kmX6NyysG<`8~!#oDJaSM;9{0icWu0%nMK_Uk(`~JR}@tgUo8Aw zUN5pl468Q3;xaPMyLe0yqdzc|{N;#J0+mwuhK$V0SU)$Uy?^ga zs3%pGO58P|hVe@8+9y&W!{KgIRnZ^O_^qYI$!~Hpm}S94jP$+_y|5c-_*Tredr(U& zlA#=VZ$d52-fouBn|n&MT->?>E^`?;>Wt60X?}Ct7>a(g`8ljr+@$bVU{dv-p0a;;@)$*;QM0J5g14I)(a*nKa*dlwbkzF=JDA! zygS_LS*c?7`=1Jae!=l2#XwjAq3nYsY;yN2B(f{<|F9;4xPM(NZAd(?e=g;B+W)mb z@~{2#sO&fLR6G^^q`W=@mr@*@!sfHLltU7@}(j5zUV6O1AT|{9b9;TZ+=h2V_-k zp$WN0lkq(d&T;xRjFt)?r5n@Za5y|#jX?wYrfe9+1s>6azBpU0H0^J(uS(h@1n1n(09D$RFb`~Dan zImbj}(j;&%b63``gKzeI85`>WJF%Xgo)R+is`#-^;g+vVqTbC?_Wt zaamgQZSe#@X9t^}7-vCxH0MX}TnFB#fuHaricXA;y2uI94;hfHu`15i(`jcy8XY$H z`4oOhN&OP>d=9s?=NIf4t?3_2^*~Jo2KxM*SMpXM2Df6ZmG(f1^_9eI*PluiwHXq{?Q+fvIB9&)}`z-+JYXPEPXA;z;W8bkT7uiZE zj!iGlti;+%7OJ>VT3*0JE)uWC5_$4@68Vy$cKFI9 zC@gn(v-t`Y@!8;}2&p~Gk1@A!LHT-AWrA|4`Gnz8fY!dbs){9wSyMhqWU#yt14`&3 z1axeknzlnil3hgZWitAE#|`qoEmpE;i~saW_UCTin!oHx5;?I-D2SOKWI!J z`px)sQD>bZrr+G4%xCEDp&Ru*p1yOpuE+8pW$S$05dxRo`zpX*+nr@_Cz(&K_bQU? z`Zw6kXSF@uoz05g%on_8(u$a$i%p_b<}V$YA!_ZQqUZZ_v)@xc?yrRtfFxp7{#Wc%%x;$aBbwUAn3DLlp%TbuiEojQmw z@*M$)ecL|9kKv`o1Nw_sVUZ@Mo{81E26#W-{qXU8BEXU7f8S3CH77#FGcb2vc<`iY z86elAVXoGF2lZ{6)_)Sn-S|tnzxd<73%ARE$Fy41EP`BiG74ShdeZm&BXdBL{xZ8FHvaZe*( ze6LTyT}DE(xqhe#9cpZGlYxrkuY9=8O6Mj6Q(AD#SA<6Px3=qzEohI;4-GKI89?;z zdm2`wo8U{`u6Ys`4lMAAcVIAJ9lJ!ED6DnuGm(JX8w@9Bs&WD&QaJ9HhW$k1cb2=G zeFnlf>85T&2T=LNSGI3OwTq8UtzF=w2sY8I@*^KP8poYv*sST!M(MkLoEw1Ram?Kr zHKelE(~ClA=VpbnrDv zzPijza}B2G@RT^tcO~h>QGc6m&JG=hVwJ&Rb?=#&q`FU)qAQPCIno6Kvk$S^O=k|G zh{(pZuBhwf+$9qml;Lri>>m>4i2~o54jaOr1wmIytxji3nmRo*^1Pu~+@_%q=K?~) zE-RC)(s_ zzvBhnfXBEMy5cuy(P$SPnz9JI_WT@d%6J}s=kuyH?(w-kdb#Uh|GOid1~qK%A0xW; zgUISJtdods*GA2vPL%V5lyGsdqGo4CyxCswh@3{SiJ#}&m&y_0#BhG<{xTZJJ-P}t z>#yHwZ+Oe8eC#c9Aal2K3rzw$y}v2d^wD>RmvPvK5VZRpjrRWV;(ke6ht8&)AQn;#_M;qjJTaL_7y-yVuSnprZeVuMzN(P1wxr=`@# z%?Tp-7DkF@yD)l^eXy#Mvo7_Mw0oZc(>%S|+n2u%{dUvx*t)~cLxIbL*>FA}Zbo~}nK zbo&{zWH4FxEdgHP^QA`n$db)f8o2wnvwlmGG=Yx|;?sK1n>oOYK3_1B1+zoi6MT(X zXCKrskHb@R1Ei>{&$Tdoc^jHt+mE4J_nW9iQIZ zTACf;T^_u{>7r4Ado@`wHMF*1L%=%poZYIY!CpK-YMoT)ZxF5K?$6~Y&hIE;Yb#<& zA3~--7au>%tc0O}9f?jo2~BgLW>mNi#wxjrwhM9LvXr-^kNNpmz|+Ge z>LB%S(P5O(iNC{=azMtH0ab;i*0GCe**?#ZY&STJsipWqxGgQg+gz&Y;8>QYhMqWZ zae4R-2PBa1fX$u$;`&Y{0JFv?&vLN^Un3Zu=nsc6~T$_WTK=8Wu1D_GB=m5emwmaa&lnorg_S=jZP%V-She z1Ulh+x~aJc(-7v>lWN|bnlrg;;biPpyPhhz;fQ~onE91cm{pKNB~ejSBtkM6S;)lr z*#cI0tZPX%>-HB5YO{A7b58vw)qMOL@4u=>sP=WUfYuP}&Z8jwEK|BCvUcg~Y0)zW zM@Z#|li(e=in=fMHN;C&4tK{yDgr%yN$)#7$P6$M@;*FbM5lI{Q<%EpW$;rNyOX$1H0um{=#<9>*pSVqzezjiJ0@TJ9_O z%lpL|+s#Q%`CmMAtOU)mv#BZHG4W#JzGEmU&qku6U}i-35^-z@I3`;8z5b~Zp|m8+Q4^$x4^O<1lp6B>CfZw_^;IoGtw5^l)~rmhx@431W6vqh2bF=e1!}v=1{* z%Og%P2^)>poYkmr#{@269CI~os0{4-kiA)1cZ@!o#A4RD=_`4ikw&3A;0*s*6jt3l zzo9J>ddQ*Qv%rGh?CX{Mb1U#HI_L-FOLKrB6!x_foY3TqiV-VwlEWcmWldd^#`>UM z!2N@PlnO=+OPi=H=9F+arT7>X+=3m0=iA<>osm=$huK>M?jA{0!t_8|Lq#I5%hHSR zG-pN&3jQ6QP~_oI`kiY<_cQ@1CquE2nHo0rxhW^NwrW7+J*ONMh5?IQ4xjXDUcWK7E8Js^A(0w z5>G4dAYRLuQCe-W-JID>3&AjF!ep42x!yMOIW#%8U3YVceKx=IgF)G}dh1(pt@daPJ` zv}BXm$cP8RTv1W19foo*QAk6z+mF@LWwZ6u#E_~j+ES0Zw3KT~P!xtVN1128mX?)h z6=1NE1$4=&!a7ljY3Dt+gX$Zg>M}gx?-ug><#p-U*NEr^xkP5a2<|AxV=-r8j`*hNd@Xs)lCpf%5RGB$cIe`?LE56{be zD1X<)|of_Qg_V3`sAmtC~@ch6&}P&XL~Wn?Rg&h;nC_JE0GaU%-}9iadXT%osK)K zc&MBIrcB zA3jx}=eelXR#C@|tv4j}pO;<8gtyqaO_Q)v%%z_&+Kj+h_+678IA`ce|cr zuC_466|@ysrLvbCb219OH~eFP#FSVev1>R25`LiOtd#>=H5J zfhjTcG?Rq=VEQ`;Vq_3FLG9PL?~f*Y_fL}j<&TfT%_4pI=!W@*B7J)t)f@LrjEy}V zACikoLasE=&6pb6iwQ%-&KFwjqVHFQ4Cpj+#vS%(nnUk?KcpklMy+sJ&vURDthoKi z)88P_`lu$jF497NB*N$7B@2R{QvBL~JHy$oqvC4vIS|hJ2oA-`lJlI!IG3<2u8nZe zA+>p}d2E?X`sGX%`emaF4L>Km>TA~9ye^e3JN{sE zFveywy@X!Zd`)M}E-T6doyym1U6#{5pk7cUZ@EctJakRME=TD?;{+#zo?%e}L^_ zc{d$~iGIRMVrZP1DZxW+Nq!J1h%ovldS|)NYOowH%{d13Rl9an?fh7Ik;1FV@e!u4Aou7U6WGE7 zqa~iyf+2qyGDc(*(^a1k_WOt`M4~Jze2kc#q0T84z_?^w2*;Nf@{!?Ic8Gr;rS^^_9`k+p zAktxOoJ~$S-4oFT!R3hJE1o@tcBp@$3WT5aL|EgePme$#iil+o2)tEWtyx{Lk5Xrq zWDafZt?h^V<&G(|?;!uOAkO@$$)i(av_!C!`9)wR2yFsLW`Jy2&enp7)BTD28 zNK0I8Vg>(kDM~0lCZ=FGXl?XEc1qt46$M2kgdCR$u#Y5WZ}j*yThRUnqkZtplKZy{neZ20iXh;z9kCM5r#}7S^m4cq_bxah zp){LjX}bU6cqJJOm->VYjFx@>!cG*yjIHd{Fds!gakE}kkT40Bl+T6yC#(#te@YU_ zk?$Sf6+^|M=X>IX{=dpC|2zEm$Vz~<^optydb_-J??OMQ#oH6x2Zu6IhtXlG=W!kL4JYZV{l~L z%R{=AnB{O!)H*~1&vBe~?2g;B^2&1Ejj}ELUrCXJoair}$}_Jkrjs{)15Tg*qt`}~ zOWQ;(hcu4rvAzvS-nPXmcMc-Fag&1Y-t!X1ibmEjkT9+H1wJ1~IMb~p>z_kaG-W6f zTXtPjJvy}R{0TYS)lT%meWd&M{a*jl(xf`Q(mgG4{q7-T>}eYsvpjw}3K4`Bo%bCW zu;}~mn9x?|vl!)pTW!apj4*+DOqKq|q)7cl#Do{u6XB~il$3%OF2|>-(al8%!h8Se zhpVA>wV3|*o9mrdr<}ws9-fx=oxw*MM$)&J>j#ScPYfEQjo&JdEl(dUE;|dP-T6Ix z+8jdif#IW$clp5E*3o%uO|clNt(c4Rp!Iq ztH=AG>KsPZY=@rjy;azETsA3+n11(FYz2V(%^U|bo`qu2o zj~f_}eugQD#*~=LEldwhO5n z);9(9mM&N=T9l|{WIBf67aI5D`*Z6=5l?;`_J{{ZwIXLv?Q9r!aA!q|6F2WIJi@Jp z9rn=f{14>vv(KI>__-6y(Q${48K-Qljbj0;#O#pG0oRCzTIwTWcj0!dR=B>5Aajbo zh)zH1O!cuYO7UpI>&&pCwgyOaT}V=`lp=M)t>A3FPP_Sn44$1WOrc_u$o|j=5M@7u zN`|`3SwhfIH92(Vps9#(Xf&t2^+Xbbz*A#Eu)mWz$XQi(cJ_u%Q>JWjm6+n&fC(WE z=6G+DBd|yO( z>Fg#W=D%t8FP<1HF~YX5j!gU5(o2->xf?Z{+oF*uYYb?7b+8jpvmmw8h+t*aWvbBDncm!qo zA5(B#M~&Bp#6&Kgh{j1}2i&a(1(QV1_9 zayCJwueKWVanJa#fyJjhgMBlNID1&+LkFKIAu~j}r@IeWvstfc;#3jKSM8E(El#T; zx1sKpRgk%%38}E>;*AoR+V0t;4W72pdR17oV1_o~{F^H1`pMraEnkN)QM_zfQ7YI3 z@&}k_NKlc^$^77jn|8N)o#JMgF@wq9^Osj zx2)c-`6V>lL_juNJhrrDtb&U2WyQ65zzg?ZTZDx?m=aI3{FwVF+e*9jnUdjRac>t} zkpqEVIeK1R1;)*uo1E$C=@x~3OO|zqX$iqeMeB7rpx=`~=ObcUcXbfPZE(QpoK*^j zoo;X4f~hdP?^CH!yC*@#nRXL~#%DK*YFOSIhxS&_L+Ol6{0wX|EnfJCF&{ze`}=W5a&;%wajn%7chnd`~0z)rw* zyeXlpA;9MUZ1g^9=ZzFKPHWD6pu(9G5k_u?Ot!VRC^;^Wt7~z)jZYNl zyNu{=E2CuOWM`yr+p(h&Eipd6j%qo!pKZvCB(FgO)K#^*^>SmEq{gOZH&V2_^>o!% zl-09t-_}qV9~0lCY%^?dS6Mlgc5O9_^963*JTw*FjA0{@HMNv#3)pt1+@}%b)iXOK z1imgMnNOKD%T5=3BVNMmCvAWEO|>jEGPBlW@vn&Gb-}MEr#a>q1Y>I9GY>@EXlO zKeVdw`N-8tM^7)-mAr)^U|wE3L22yCp=~rI5y*cOT%-#@{s9y;td{&bx<0S`8ycUK z5fmrKghVCg=NH5V-QRS?uj`1P)Nrsa^6vme1wp(@w!wMNe|W^d(8cd-$-(sDlTqYH21glr3^{TTZBR=O6zY5pln3p2?XL`#I3#O z0`eqLpM~34x?{=aoKG*1@=d_KkymR4SPjgM?+7nkkTxaY(f_~rU zms2eXv>+714Husr>d8lPV3fozn0By~2ndBlTBu$`L}S#sEe8WXczscPdg;cpM(O+n z{}d=H2qGf%>Y+zz6*0HA9}5uKfg-=XUS30ProXd{qkz+JV%eCXBTv_g=Ec&sHq-g^ z_m5J67kO!Yf{NFoSwE@B^71kg8(ES$h5>ec{<2>tzbb37ON=A4`)+=gBMHf{uB{$< zEj(XE*VtH7Jh{u45b(L>MWt+M2mqg1;eC3?vc>b4%%3-T;vDbTB8aOM(46 z{o_+RR<2yOY{|mS$8VK2eX}hV^4X=8HDA2qrs|4D_S-v8&`_RueEX)=%a$&hJ%8Kz zM@=6r(=6aL7v)#N1%tdsJvp~*`ESdYEm^hxa8j9Q$ua?>s;sis)>w)JsQm0sO?SX$UA(wO%z9WHKo zYn0`bv|KG|FGBMO3nZ+HNX=0S4@(eDISIk~)QD_lM>8F}uA}=n>WJh1HiRkOTLK$w zR&U+A=fJ^Jr}zKZ)&RT$zg;^*^F`B(NsGGBvv-n}S8Uw5bLVEO!fW>e(*I6ltfXZ( zdCBT+yY}qazeO(cYDnoPSGQ!>C!D*NF@M#TojZ4pb!HsB5&GXAa*NZnAm0(6nWlw8 zl~va@(o$AX*EP{sr8VRRCsFK8OPZevX5Hb%U-ckjuo#Eb$3U2`oZ zSunc|`LW)2z5Rk>dCGc5S}G)xOif;__q}_5!I8xc6cbZ@s(|(C&XEVtlFFLus|wgD zNiY0gM;4b?7gaUb+E|HnjZCF8lJEM~_3rB|PZs1oJ{%(JPD+e$_+fx9U8W-X?u}%f zaihCd#J@^qs~fA)>r!3@WeF)YvA6C%N-buanH$SdMSfO8Nvij)n*lKyGnHagKZ{7prK#!bs>volzaPifv(%CYBN=<^N-R&`N>7O-YzVw`lV@zF z#IN>$bo=3p!0d90wXJU2)AQ8^KlX7olciE=G#Zscj(u|Iwohz+eSKkOwP{;h1sP6y zr0=~4k3wV9xHL@z9aZr8L?z7N)MmW8n^4!@##pAY_}Tqi&t8UA%P5%{Xj49L3TqSZ z1eUfL@`DqdCeO|b%Ahz|QPKjlg;qwQnGTBLUOvqwI~uEj%MkPIZi&3LfeNK6EBw|? z@38o6d3{SAWm#@>#j~iqfn7RL$)wcRH(un(l1pC4HfUSv5WXEV_}+E4mQ`)SYreG` zDZ~H9gXfu*JTr46ISPqHrqE=m6beO_rjQ%$C*QW071R?Uzbqs2&Ye3UDMd=kase-M z`%mbpP@nD>Ry}A?4|zG7fLZ91BpBM&o}C~3Do3ZIQI+@Y`(dfY8U`lniZl?)z}vy? zdUuHQx%=c*coR+2L|3gU`T4_mzOAJe^kAyuZaj(MTU+VD-N*?1J)3W0pe9?K9D4iC z-LRx$Wj#}^_h!fWMx-)L3wkODBEqmuM=MPQJ$ujgCU53LR5ThoxT9}S64A&S@?suV zx%KO$M;JFoRaQV`j*L)7z^pjBZjMj7jI+C!A-$xwkzbV=a`D8`3d7!0e(XSHmK|R* z`&x8;M^{%ZPTH2`3!)1f8}cJ(u02CCap`EQU67s67Yd3(F3ntZl&xv!>SUFAfA5-o zci94prG0x{y1b=RM;B+awr$%QXezaB@8)bLns-YK*{V|yr858WTCNPQ*2g=)%ZS0f zw2EWX%VmV@?hc7p zwjA}(|FCnf*JGA`)AJW$Nr^#sE`*SKc{)&J*ca~yh+lLGB782MIrX9n3dyX$_c(>3 zCQ}=Gb;YL3D%LJ`noYYG&J8K%Nb(eN^McOry%^WQ!AODEc=EC@L%f4m7;^S*v@8vD zl$-8<=59K_efzeB{wG(S2oNvoFK8$&&dy8?xN|&*=I&{z0#Rj2kJfDcUDmu~2V=P5(<-k%PUmwaPWs?peui+=KQ zbL~5Lf{iY86`3UK-hJ)06y<3J;ZH-=e%!QdhKGm8(5Y*d{%CUdMO;I5VXdr1_ipYU zeTV(@qbHeNbLmphh*i5M4({pEt?%kR`?d2Pq}6lG99{I}6wKPRcXGCD)7C{-Q`y0# zqm#Ww%NOq?-L`Iq4OwM1?CKJKzGEi`gD(B8Q=?NkOh#BHtFMRcyUklb)pMLbZlJ42 zpDA<4#>6EHg^X9b_A3rtI&EmrPF)8qSTlpr)B2?A50XuGt)17y!?o|IxhsFMK6}hx zzhh^)#1|C|VNG$GQty#Q{Lm&AuP7~E=-$^*t~@=9?BeOssdLYHTYu66IX3IFW!GYb zw7b78U3B7UJVzj-XV<|*QQowTYx@ok;yj|HpNuk6>^t=qs!>wg=0=lDbMdvKwO zr9)>ceMLGgJLEyL%YUUPj8SKrW9rvAvuSN(q5GOU+Z_n}kf^;Zh;lXMr#;~($5 zT`+syYFk}JlXmW==}+QHc<{@{`uJ(}o?@g5cd@=kb-?l|L)|^QEn2aN>US==3~V>Q zATreF$oIcvqOodk+y*5jdTy+r&kO(jW_dY^ zqzjmBGb`jY-E37PS;*;F=_}_{5idtR3rWefYH>j%4K4lamuwTa#Z%((h#Y&a99!GE_4|YvPfYytE0_MHsMbIR&+lL|aL^*7U}r`0s1#1wb$;VetD z`ejDfYn$h8I&?WMw_2pYB(jc0yKxIPA6Pvx`}&ScuQNqiy@64Y!?toa(Ue$Rb$u(@ z^0Z>nnlDs6O*3MNubP6?m-5WjfuzXfyy~W@5JdYVnwB>Sq|?_2@Fl(GHM?s3x*H07b}3KYda(2*P&?|81k7V zA`eWq&7cvp<}cd5eUGysbiZ$|Omk&Ut&F3kB&C9ihMedZ5ElC#43qKPw_*9L`Aavg z9Dn`L*+Q|8q^IqoAYKoROp`NHRgTLStwW=#rD3Hl{uyM*x<;n_s@!^kk%yapQg&&1 zZjzg)TURsv$n@I$q-f=yJ#{%{sTq04*31!K)VQ;L8CBIE4io&lK~X`FPeY=2`*}Fy z+3x|D_Awm>>xy27ya$P{LaL~!6F)C$fh_Z8wP88Bd|v6>(Wu;}8Y2x2vVzXURl9d@ zUZP*|eCv^$907&e)KuC0HjgG|qo(qQ=lTf7E}b)y6XTpkyluvqvV&k;xT}k~hqvA+q98335tWtkU9^(aKClHCa_pfu`o_VV|6lm6exj zudnW8YaAI@k}RNiwvdPH90$xjaB$y`_LMEF7Dtpz4kVE&YUZBvX7x>tm8=s(K&7kj z%8FVR`scD4JVh-v@ftNC%|y{CvdZ0l{_WU_6YzKZ#K|Lv=9;`WVf&jX&`O7!aD_MTS-)0k{B|D zVryfan^z_p!XXeevLw9$zJM=&J;BdRh}JfUdd9SGM#{Hp*r*vbMeq(LX!`A6cWs^iC z>Drr8vU4h|o$TKdQ`ATduR!baoSeosNoPk()v4nTRAVY8)4nq6I{jDqbrCA#Sg`Dv{qnB9o(tIr zO0QjS6^Pp()nB=I-I!^NMHnqT!i_t(QIU{pIn#|+l~;U4D3MCqADk*KVlDEsczGh- z1UHX+<)`ZfT>}G({$8}B4?ptY(-`xnFi+$jZD@l*X#|3yi!Zb3@R8on zJgg{GQ#V9@`s$_e4om|?*I! z0Y^1+ch@d1I@u~x*6YH_GE|j**}8c)UMQ@qZflUep-l{@7>ym;+)vsBu7 zuky@AiGILTL+r&tk)Y&sr2soJEq8MBtK61&8{lzXWBU zw-Ab@jkZxLV2dE0Px)o%Y9! zwVS*xbsSyHD~|3C5921JWOP|C;eGCe$I<*^IDI84Ym<*kC>D_^DYT}-Xf8Wq{Vvoz zaQ%|$*#2KEp^<$+Qi$!L^cW61G&$o?i)`d&A~?ME-1zh$i}ua2VXI@4tBKwlIR02N zfYWhsa3os!PQlt@5}7d`AvJpjnrmY<*7lE13DCQl7|G>DL}ixL^bIOM3qcS(NoO7} z=^OjjgrqFtGaP}e<>P8pUWH7btUi&2CyWjBnOK&&na7LzTWpoOAs9$IFcyoALoD`KYVcg`O3uq4RMhsTins(jJ?smHr<p0q^uhg9002Of zY-fM{W7-bxBG*wEQ8WdP8~^~QAtZ{9HcdI;4?YwG6#xJL8UsNE004l-Ku`gr2t|k7 z-}@fpkN}J-2!as*Gn@jCS6-Ag@>C(r{sN;&YmMm2o?B04a`pcJfDc8aA}+x;cK*x} zaRq`30001ufzw|A001-wf(ift0F8m50ssI&V<4yi007V!2r2*o05k@I3IG5Aje(#7 l002N^AgBNU0MHN|?jP*ZsyL4dI;sEw002ovPDHLkV1mePzE}VN literal 54535 zcmeFZbyQU0+xIIWNJ|LPT~g8_B}fh3-6=y!H;5o1Js=$_-Q6*S(jhS*E!_-_FbtfH zzjrHf1$W*%1b}09HZI=en7XAQjvP}s3sog*5WbnGuC?r1NTRdNSPo0 zpnx=)jvqam&H~9uY5SNSEMW!^Z_;8MV}^V;*WmoDsqrS6`HN1twj6ma`@k}r{}2%y z9i9L1a-Mqn=f@$JJd}pyHlzmFBq87FzG#GN*W4pIe6=6~PE(Hy#LOgXT7*-FH;LS? z7Dc&Dl2K&-eZscS%@`g&-|cA7hzK7(iG3gb^MCogbpH+z+T$wx=Lp6Bqf_j;={|*r zfA^}$VAE(%YsI5Eh=tzY8A)dN@E5AZn-(tOQ@_rqrT^EOdWN5-`tWgDy~H_}d8lJ@(Jzz^{weDpIxBg)qOHsmJoW+zF|!eu-rJcNudN36_F}hQ{wY zJK>|Hjxr@0tVQBT|Er^2cE!jJ|6u9(qowypiy|h{|2kukT^4onVt=+Kctt|o=J4;y z)0vOICyHFmMsoOtZ-m@uI6d~J$wl1SE4N=J8aB_>*{zOci?)VEK71fbpV9Npf{{8G z>AYvBr;}G7B=2vDF+)QyNYbCNsXr}HN{#FM!iAuJ?X?%yuo4uVA?UE%qKtZV(4Ee2 zcTV!32B%sRC=k#}$f*CJfd$L8UvFjpt(l)?#mufP|<=v&Fj zSitP?2C|PhSng0#lM=+?FmA4Hg>PMk=7vJ5T6geBp;&aR;qla zT>*X;LnDa2J(i=Q{RiTJ0}5t0kXw4)kXI!+UFk%5VR!{!nRS;Cxfc(JggVWvS2V3m zUL7PA#%XE^+nibp*e~jLu%7uR*|W#*&nxcFB4o|tLC(aiF?z%G+w%<$@0QE$&)eP1 zh7J;sjjNog%Qhe8$wVFfH~L-I2*$*6l-14gH z)B$&pZzOMjkWX4#dfLHrZ<-Kl()@KOH`y%q*t^TpJX+5z@YyHq^p8bcbGn+*vn5vY z^-fb1D*@}#b#}qA%iO1Wg$2gT-uHJ%?K%ac#*oYD-Kl2E;Q`;%79)Id?yD-}8cEI7 zf@rb|Zc^iNAFROmhcTJ+I4(S&l`u}G79&4TKCW0}ZzSJ0J1Hrt_5Sv3+(@u43C)vy zguc-bOQ~D#)iI60z)?thI;YFl2>Fxat665(BnMuVbTO=zAVdXs4gANrq*c!ktmYu( z1i~+inK1-F+EH`guMRMf`@R0CA2r9FW=zswit51-=(caoM8h z$)0Dg`N^xh-2@tuh^zH@$-7@#mnO~cQP%t7x(^qcJhA?)t$hSK+G=#(rN(AoXvD1g zspsB|PCS=ME7KSqGgETl`hIjQrSKjRaeTZ4U(bNYExeygAG(U^LqHQ_+~Q`jvfRPD zrQ%$qmaDnY8?aDgCE6EDS(edj5T~zK=x89|G>^MGRW!>SuaJ->W^d_nm@$wFH@T4D zY|@#s9gX>u0UEaeUkbVQpx<81nzf=2WHCpdTz6CzeWelgKPu1hlliz1MJ%~rBENx@ zk(1kFCtmQi`GZCN;p4xjBwq6=pOqYVN{^Yyzo_1{rx^%U@dJZb7zYpU=eT6QShG+P z-5IjgQ#Vusn8B#SvG31z?Q&PMy_dT=s@lH~h2v4iRmsIk&y*WnWYr{jB9GeS1?9>4 zth;{kL|E)iSLrA~LcPdyZj;m~EKeW>;2*KcEP)?ey>_Vr_h*}UW-1McslBYJGX-7Z zu!vda@t!rgEcL9(MwfrIPGV7sy)gT}9I@HBw{nleso&i7q8tO0wkt=x?IIZz1!2}v z=M(i^lZl~#md#emnkAK(cYmB9Yy7g6BS~AQ>k9K|BprcgiM8 zL$UVYRH<1Em%Z1e#&vu-Sln^2*drzM?Ld12cs7o3ixcDoL62jVlEb*&Ey_K@2q5ArzMol>srsCW-!$I#F#K&{Qqb0fINR!_f4y@fMH6jx>JmaY(@{g20aB3BD zV(*SGnM&s8a)F;mldxL`5V-BLKeY1uG`#^T1RZ~P?CLUOHhoSAnCVBMq>S|j*mchj zl?S9ejiuzQ2TvJHKj)=qqvsE&^6awHH4)C_=V}=9*^a#9wZ)mQT3g7UR=r1Un1YiAC zEMr#ocAU4r~0C%l{L+iHJ<@jm>tM;xIL$8 zbKqMB(`O~Qt`4um(pH`o;ucd#0tzEl$?CtSThGymLZ0KHpy>7nqOrq?z+w)kvQ`@S z4DY(XTA_tOery3@5x=u5Pd{Y3T>($o*t&z}j_m#-1CnX{w9&V2OV^^``5Uw+JmMf_%WZ3) z&*0JsGOioh z>`Hu2)+R=`@=F$X`HNzolE(2Dsg?0z$!yJwF9az~5`ZcbnS)33b2Y)>nSXI`yjsBO zzyat}KGS0+dp^&dKT_g0r6*ysPkw!WHXSQ^ABGy(BcnZ~pu zDB2{y#R4S9>QyIiCnO5lq{?<0vXCs~KIM(klG=0*yP(0iXFP=p|p$_^23X z>-k#y)mgCgn1G?r_$f8!X}MI4t5f zB=BDPOR3Ib91$D+s9Up33(aI@wkRwRON=Oz6Qq*t`}h5B1WCZ353Ssg1UKKTe>cE| zg(q(tFUrLHnhsP~LM>X+t5Bj@F#QKLuG)LzcW(qi2?aHOOPpG4M*PQ+-|fD{h5{}a zP&ibN`rbx=&qS_zZ!Qm$l-u|#YKDzdv^cX;iuP#Vi1n|KasP{+NWxy%gWtT1?Y>&n zzs56#$*4u^^^m?f)1NFqIhJAM3RIUa%{6)R2q6&i5wFST+kDSRb&+3EuK#}ZEYtma z)aIhILhoxv6jP{{8IFG_THIwnQ|xM`Q)d?+BgC3FmY&Kr`}VchL2)ZjDF1I~%DKDi z({%7I)5ziP8u8cW8S-t656iIKFpwY+Q^k#p(1TJECyA&N^5H|S(Kx|F-To7n@!&A3 zlRE_5h=4xu)Y=0|T34!5W`O6-m2bZ?kZATTg)m2=QukS)UvS)?KWJ1|5{Bi4hHeEg6fjF0H0MqV^U;VFWbm?~w=FE6)&)-d#8Oe842~`;N_S>;DFw(*}VdVxmCaoR~ zU=}+ixorMf5>TWdv=a9ZUEo(o1EFhv;q@eQ?Vcw^4^#g9AaOqTM;If&uXAao)N7xY z`Y`-7W+2Q=2iw{amwFw|lLxwL&*50ewf){F5Vo zlLL|lHbhYHS3aAeJ@%yD2>jJOov8-*k&QorJE>-ttKVfyNq+_$^I-nv8(K)KS%2wp z>F61vBMl$Qn_BJ8U^sJKn}T{ zP%}ERAzk;3L#Ky;QrKd?e)ssi-0_*Q&BB+n;;4ZPi=b`ac~A@vB-#Z^2R!^OKd(X!E@|t%&x|oGHDzU4L-28h6;!42so5EvO zi8}O4oL5~H9v z-+hvLf#NeAM$%bCjr@%Fa0=Ip_s@7tjZ-t~otIwAI>d(o`%9P2;lE#%2#jDz7!4Mi z<{9AvN+UX^o}S(_R7VhAl-P=p7?%6{$THHO#=T5u?e}+x7sa61$t1cEHSh@0UUw)a zxMKy75dN3Up{DupO_W#|zGqu7X5PW|PuS0TfXG<;YYmg2WQ|~KQla-`mBL3g$NX^6 zz&;cR^GXW`O`rNxG5uO7LbxX@3t%Rl|?ZNyHdGLCOx2^PdQh^Tp^ z>iPu8_sUoTG`Rzz`Nl(GV%#e5kt(M-lJV1q{F3|*I)^q1huKP4PPd1}(4hM5mTct_e>@dk+BdE}7)wZ#B{!-?GELwc zAQPNYvBM_|qF zz*@0|uhvx}dFN_C_(D|?sQAQyY&h|1!;`bAqCDR59@re@tK!4zRkL6J+~H@Dny0e< zG%{PP!FZASFs9iWd^u4-_~C~a6N#a=B0h~&=29O&Ouv4{sjsfGV1=)pB1kwnqMBnT zqW%#bv&5hVmw#}geOT;s_H_8bAKWs%DpfayL_=zWLJ>9tA+2bq%pbaDKTk^BGI2Y0KH{;e%uf7c(FrnFtenR&h?~xc6m*y= zhJu)-Kp8!t;+F)&Tn#Tzmp8->!^IaI)Wo^tgsMn1iJ9U3#-e?9@(-PzoB>1xB9r-} zRJQrS>W<%j)Nb{gjwW!Cm#CtCX^{ldfSctf?s)P6Yh@vcbmo=fQL$k!ca?0&M<9ye z&zuo>sV`qlXx!&BL2fIs&mt`S8mxD zH95z6AERQ?YFaU&yamTIIi?}Xelwm8x*vREJ9{nSr@~|q&N*!Q6>??0FwQQtwK`Hj z$}Zv{Ka#gLSj$WzQDQOTG$>TlB(Zf&L3wRlumVvyvJH8-8<|0RP+)>#1Gpf=Fz|Xa zl^3j*PY@eZYde=HDWqv-Svi{cftb>rSZrAJzR^Wl;a(_b;`h8gd$(*iK;1_UzBH&_&6`pdY z_=a8Mdsv3NK8A$vqS(uiVrHmWzUSf#`y|ZCoNA4UVccgo12=<>$xh~jmq<_-wZJ>| z_HXGALwpCMKxXsnDheV4^g4-Bb3GNyzvytsJ~5wyi9u;gLSgbY?%$dAKR(D{v8X&L zNYAkeW@Jxd37%Bel&ko+Zun8uL{T%RwXkR7Dq55PVvwWZzp!$q=6MJW;R{O%6nVgf$g z8qIt+)!LA8Wlu^@7*dA$5e7IwpLc<)L+`gn-z^r?&y<_S5_~583B;YeUW>0hc778A zJH9SvH~Zn$N^t)j5;5&CQ)xm;8+^-a>bJ`raB1LQZd!){I4zAi{7yHAJ&$oIFKs?g zCoi@6lhxUcO22vYfg2=o+A^@sn5%VjzU#?OsIkcOJa$nNE6Lk;7m}}(Lcuggk8w1Y zS2T%_B~t@?4r&oom63U)txY22e2bDN7b_Erk!y|&r+xV@L3nSbA_5GPklP+JdFeZ( zO~PfUEXlYjBeU3NChYuYRM>qNVmEwo{GRHykNV@84btmzNx8p^@t6b$xg^XCepw@{ zJM-D<_1xDD+$ybrAS1HAeq@RroyyqO~Tik83lc zPg>P;y#v$hgh#+I`=_S_NCZ_QT0ceWWB$|BCxOEdjp<#^YfvuDqGScsvX8Kf_!HZ~8uSfDzYykawXSyWMFVNtq-Phgq z_OI)7rH+<(zj6xWzQscR;%#fn8O>`C1@Zgo5-t5!>nOv@O?R88Q6lcPd4{kTU}~H9 zs0&xrnf!KR=6^n*fYZ0OX>joy{q846s#jU@rq{P-zl`sm?`rYpw0XnT_IT@l&jjuz zvjaIN=zZA?rz?2P^1Ugw^@I4cxAj;%u(f3!QiKydzGa;a<&KA@t z?Zlr~LGM1t_SJ4;Y6P9PW8!H``kY$5<4(2lIGP3_zb+^q#IYH5qq6b(JbE#bQ>dhD zZ3w7^KnA{q^uKz4`U8uE!;oaI4qB?T?ltZ+_Se;l*YfXs5)NG|Ga$nsOe*?wxY%;C z`HLP%8-ik1cB096*2=0nrN^>Fc%5(2&v)j~q(VZ{UIw)rnr@AxPqeAIobN8^jq(KB zji*0&d8PJ7wa`S{kU+#`H>FGaH`Cya0gV^NxPl*ND;AnAvZBsbf;IG8J)%x>mirnH zMPK@zKNkaRm=~Pq@L4i{FSuN;M4>0=_G-v#Z@9&SJcE!jB3f+q-v69xI`o;>svmG$ zb_a4LCGVR3V0%dD=@7@?N&OtoHreQufi&K{(oM?apJYCFpSEF$gB=kx8{KB+8`lFJtI+K6JvFm5sxSIw%mST z=k|L>iW>t1--S|3kht;1wQK$5yWtetnm~k?a;5~exc>#;B`s~wdR}}?==>^pqXkx` zOAbXy?zgA_Zl&BADc7%ZU-x8g6N=FcL3!5o556mRfv6o{8b zlE*lSYCBn-`CnXK3ZbgvAI#M)fP>$;EZK;ruxUs)Pz@%r#v6J8eoG>=66uAHqiT*= z$>n$wi<(@4Vh*@N627$X#69q2RCwjjbV-t*D#F?%|I5%5Mk=Gqrtdxn^o zZ3{jGf(|fgz_^-j9c;`lMx!PyaBdsp(rNlD76(i~W;!epcV@mRY{#^p|aI_D*gYNB}{~~MKLCfC-Ssmh2#YV^04Z^7q&&i$;bWSodGI1NX z*(VWAE-SiZHD6d(QiREAOjNN=I|D%D)LNS_bks{d>^nyez5NF^We zMC~WSxXSLb95T5eK~(7NDUPNklO%&;kcouxXKdev9~2N8J7C42NMQ2O<_&6(PGt-E z8BMl&Sz&aOm_~(6Y`p5-NoG$1OPKpNPS(Fws`7fnP$J5(nhZ0z5Uypi01ZV&4m=U) z>$YER_jSFQwuepc+OKUSW9@1dhfAUAIyR6^maAt3EVO;$+^yXH3{u69qZY*k|tkjU63*QiaGtK6_f`Z3^WXIlQDbAe&^>KgCosMngsIT)M> zPPiuv@ECX4a)rk~4_S#hUMROG2B-zi3pK{?(>#p{=gqx|3YQ%{(L9}iANl&v;#{46 zle0-oT@)5FQ58RG2}sE_ZZ{k|i|lNuBxycow|Vs$MQ>P-oV7cR7#70Ge#PL96RJMo(|meo6BnA~A#_i|=&_ z%gUv5Wo4zGGlI#HgxgpjFQFQI0d7B*w&gUee>sEGh(k^fh}^TKhNQVR!xMRSYJzD} zHI_dU=6r$_Ax?}712ZtmJHRos@ZlgwJQ*C+YI%8l`xr-iWrMcKQ3JUI1mxzFkQ|v; zMC@+!oWXafay$0nI%T?j&vlMm?-W@3ACk5;y>=g0?FwBLyvJM>C~M&PWDzA&Snj+2 zxI^9yE2U;g;l$*@P=_|VNd}(;o1r!yEpke2hOt=j-2woF0J;;8i6w(dD|53+&ATzy z@g$rg#rJMu^^pnP#Ep(iMDP!CmjfTrQ;>Dik&g18fbAZ{6;zPcW^AQ}7;RGX=`%8#LOi*kL8Q8Pks* z^;SjfYclvz=!fTrWJZf$zGu>8q62BQVc<~|6WZzqoZ*>z1ZhY@ZY3vOL3`3GxcRj%mcu zk+Eo-xk1>Pq4?+U6|>m)!v2?3KzKU~rpryH!$gE)_~y-S=aw0A7(~e8kd+duQ3^St z1088?-7#U+*K;u{4EvjEE_oI6{Cvji5*C5np_>^&a#>Ue^NuH?= z#G`2<9CH$O20SH%#!W|}4dR=g8-g1dN?R5yQ9HW~^!5Q2dGX>@Q63s6f~4`G#yZB8 zAg0+GpKF^b)p3ZnH;-xk6Zh>gsfEVFX>uug*dYMn^#W@g%ma|$r#;!MCFp0rCeVtu zsFxehDg?>cr?0Q%WTQvZsGZeGbU2LW2CbtKY6`)S+ZStXBt7xoLk_))j z=s`T#NoOLXPIWkTygrc^d>7(zWYz(GR;pd``5K3`6ws6y{4T2r0NzX1iWc}mvFtbI ze{>+WkpGMR^LY!9C5~2nz7_!!d=g`>X;5N}@WCn}sd%3)_FLrQ$y?w{3dn2Kk^(ai z)~ULsC?X>VhGr(ZU!A;VV}K*elzn0~9DM$!S9fN)}J zABgFGx42{S*$(_sSFj`&1>_1AL3vz2v`bDIkWjgFs*QI?e?U`ZlWaZz9iAEJ9Gxg! z|L>Sp|LE7`kIpNdv9dVZdB`FsUh8AJ+YK+ zsg(MZP<$z8?gNwLM()+#r$k0*&r0xpg;J9I|0ejb9kzO$F!*`EKdVwp^q#EKw+a+; z83k#d4c?A_48FU@T=~o0KanRt(JreLaO>)MOZM#3J?pz@!iameWgL3p24xRQcJout#+8vW#_tIl0 z)#vVd+ta@1)@v0t91lSRMP6od^Cmjg`i)XNNJjZ;xu(FBEeQOCP1XnCz18m9_%gDx zyOSG?4X4msHwEy-i3YT_RUkVM_nvnX7o&>6r&0cbk^soZ@7)oPzKC)32A{EHNd~K?O0?ZY z-O3BrF*1BFlD}ES2$bx`KUj(9(5w6k+#fI4qSks4)!W-U>vbS@e;m!*>(k9d_C!I! z5*T1R#Q{X>SKCp;0RU*>21F%4Bne5R8x8F)dp`&|Mz`Mb7@Ji3I(~?ei3y!d`mIL2 zzN_^}n#TC!XBmJ_5bL%nc08%Xv#a?BpcK2@atripeF!^E+At*V;K9v*7hHTqy`38* z2`7W?4|X(~{VqxkFa3Z`jmxal`@}Gg3QXgl&$7Rh*sK34SR#eT=repaFyaAI#$OkC zppLf^pAwTaV*>m6PwbV=-_^?mfIK4Khf989TWRcbBrtJpK;o(R!UPq zI)RYOe59!NQSl+`Fa!#3Ka0!I!;t&k8A$n=j3)$;ql)<~f=qU|t#kAm7rs9}i}mC% zcU*v_iMwMsFSipS=TFlI8VzcFzWJ@#spj@kimbf6bf_xsAKehy??jTi+m7qzCT7tE zAY*5BpbN+Qv#Tc)^7hV>YBKiGd5C5b>U{dLnzJ&aCK}Z&v5@Fg8qa|**N2 ziP3A|j85PFti87<{9a2eBcAEqUxh?>|!UYD6k z2`G-=GI+_@*9y0ifMk7HGk$>)TEU?g5Sq?kxL%NICb!LP0&`znQj(2t^}4?c9LW{! ze?qNvvh067QQ@!Vu{*Ewi8Z$%y2cMS^c?L-;cKS21B}@2^j71Xlpof1<-kul-z8H-=o46iCD5?{2S8`e9{zuCDN9@facL zk;v6vjdFe02F{iav%f$b@9{J)vN`q>4p}kF2g$>wXn-EwlRrrM#UHfzY9oM=wJ$dJ zgGFz6$pwYL`wxD!>9N#iaEXow#vhittF-RA8w&d_t5n8ckYa7pA5ZDfPzj)m8g_J0 zs@Lc^G1;Yu_KR*MOJr-wL5*;)m$K`rZ_D<9& zU`bDZz`4fR=>KKWtMSc}nS@Ih7v?biqk7d07~uDREkbikR};I|F1s;b>{tg2wq>X} zrwD2^Uf!J(dpWLz+m0GNhax-FC!ffjW`zUG^LpMXIH#*i{6Pz$ahYnQ{+!D8Z7a#% zceyfKR2#~w1R(RW6^0EOMb6?4V%Ho^b%1IbO%|+$_$d7edp+CxwB$k7VufB`8VmJ& z%OXkIisJJLZSP#%2r8Mhfh;PkfrEkXjQaQ(haMn+N|l`u@J^kD?slgQmQ_}0P4IG~ zQ#1t$&;`MD0FxnT>Eba#yAcfJz>5H!jc6{V(m7==Md!JOdL z$K}Q?(p-7(CM?<1zka0%QJ7yG4gf^9&z|ZS_G{IEKv?GaD+DHMTYOY8u?k@jxl))*mB*T@B z*~wZo&mQDQ;`a8K74?|)!o9ttp8e6g>x@&8cC-9Q!g=oX<)yY}YQm7*_=v9u5wvSu zne(s76X8gP_{%048GEVEm`o)zshM+~9sV%#Zh}}^!{Kb5%Y!+c4jxWC0|y7H!t+crb#;a9Q=YrZHzK%Xo-b_2)zBs(6E}m5 z2F~5bnVps*BQ-Ng2owsb7r2_Aiz>PzZ#-eCMRFJM6_vT#wKA@pW{t|(H4xf^A)V5% z+PjlG%N3Nb>s{gj`P(o%B>4lAQ{5RfRkDwuk&7%O z_}xwh7y#sh19Nk8rE-0XnDRG=znAk};?GYKJH>(Rske5s^L^mdvrr6tnX(kF2NA4; zgt%o(GXOyA1J9qx#QAUs9-Ix$$@tR)^rb{)3_3Lx~Eg-foeZshnfO(gC8&^?TWxKFn~Kv$(~v_&j8h4rTAYbtNJck zR0c*w>9GWX-Jvg%(98n12Lta+1IBGBb;<~%XlHIbt=<_6D>-P;YnqvyWHpuFZd$#z zmS5#bQ4Dz^Aj*N|UE27GC(%z7_0zy>-N&*r_M`iKfG>hnn=YWYeu=8&d)k@TGai4B zQw@&evfilgT53y#FL~>@iz{hny1=idHMd3#wDD$uk}cOYI|KrIu4`kdKdJyWFWG2xx2P?-gFncRD%5*uwbGn;df;W@+$@nZ}a{ zQ3^K08BaUUfYBQ$b>R@}@P`(w*k#L)7;y#fH4FZSR9xYQ+^Z-r=CoyN&b97pW-;a0qXx{`7^pC`@0wm+AD>+*jUQo zNE&*cmVwqee385TDyTVtkFaf;4wcrG3!Ft)IR)4@Zy{7wHP5dZPas?e*yWFp?nj^V-YN;IO%;xQ zM_>+u@&Phc=WKY#1F*$3XK8EYGuZShHGu*tvc8zzsXuidQ523+&XfIe;dEqtZdr$7 zn4tv4_T+1br1043i&)J`L|uivqzyK4WC6*4S~IE$LGEf^1TzMiB-Ezlm_Q z>XQkUbC@mfn{OzyqE3&G+_C?%f%9{S4%>}T91Hujx7~LNAP9M>akj?$F=+!n0JhN& zz(y?1Me#I4jWZ5rJ5WrcXxP4zyi*@HY4@qw<6)AV2Q-`Rd(_*+yO#646Y(~0O36Nl z=?13Hl%g0wW~33e5n;?d%{rXiDdBd~)!;B&njPig^W{R+b5A=adQQHL7fX@QyHc#;zmMZa?-|Pbo!W;7>ThXM7Q|RPuYo#?)J|{mp!D;$f zZncgEs@>9$HNL(<5v)3Ah42^E*^X(33f+=j&<3@=M**t&`uJ#R1+D+e(+1{y?QC6C z2Xv;R3zM^Ss4lgZ8lV$uxGC;^vOJ@N8f@Vt8$wXL@>|Xmdm~`*+|5sxo5E&>1OqPL zvlJknPui#oF-q;H8Y@~0bJB0+6rB)2$r=o$9T&>QI-GCNC{9#vJ?92F`qgbd6;;X@ zp)=K5YcpITMQBaa@~2dQbph&9l_8HBAvRNZSX3%m-Xd8%U5`$=3fgLDA1JGC!n5we zXi)%mz?A6Dw2BU!fy=~SjQcIYD?tZBmt2z>-`qA!0ggIamiIjrrINF9o6PB+V5y7Dz-udd!*axTExZD8 zhb<3fgx_b18jAnuFTWmZHYf5hi`y`ee*F(jrGONx`4|I$ z22nZR0W|4zpO=KTjbGD|}|)D;7bte5&f$yXf4e*+H| zTSDm{)KA>GqQOp;OV_wRpDY2hYUqEH&p@MzVRX>G&TWK#B{XA!(1mG^et;rY3zr|1$*3CV=v7Pjihtyg~QS@HxL1RaSPL#0>m$YRh>;#Z!qJAWHzLDN2V! z&k$)ocjse6%vs&?40P=LW z5FGBgQt=iD-+Ap%t#O~fdODif^aemav?Hshhkh50=J3z%%>YD^_4v{EyNqEL<*fXf zDX%*S^U?*R92u|{c0zL}Ge;mf&8!ZvQv+w=c(idJKVg&iW4r&F^~wIbT*Ww9q!vFe z;Sdj#W2;*%WS5oR`1Tfa)u5%;&xyWY-0U14kt5#9xTcD3SnpVZstA_|RB!X5wn9k8 zoRH^-b&2~Y0NUg_9aQv%cJYU`pV4Jb3=49NiN1kJJ(r@KxfXyb^V06pvHfb<|G7OC z=HT{Xqm$@^nsYbR4}{puKMxG*o<4p0wJ>Q4c<(_dkjY!@PBORt==^<$9E9fLQ_oxd zt+w!y&|>k}UseeWs-@n%;y9HWiZBv6S^{3r@ItpVU!rWN?~22$Ga&w=4JnXlF5srb zth~Hgp!7i8fl6;TV*b?IPbEyjo`pu>YTQ2`qL3VN(5;e--Wsh2N)6lS*-AuFl!#=k zBa8q|=s+li-R!m>)LFhoi>z7i`vy5FSZ?*iY4tq(2gC*?5X`xkvXJ9 z;X&7%xI?K`kD3T1xR5O9=n0k;^JD_IQ6P6zQ~6V0x~=U*sV zcrc0ss|v(?PrrKXPU<#&myM=ZN+E-pxf?_gF;5#fE?k?$212<+x{@w9^u~I@$c^h- zDqqv3){6&b48WUA0wp(MuBT+;95()LbzGgUFL|%%*tm)D|Mq{%ZPFU{DVo#@VCdxZ z55J-+4yRODB5@&^0R%nw*n0go|0;A;f*My=0qCpDi4Go^aAmGtc3E?i<$r!q0+uoj zy0*D!SFl3nhaYyM^{bMwhTSea!NQXIaoDW(VgYf*x>_6z?Hst3wtXhUqLyANA$)x+ zfjr>HrPzoC3a?9n7nDq!BkdjgXWiR#)>gh0Ws6Xmv=M)vVTR5WfKu~6Fq!2ingxEk zy*{%7inNPqUtdSi313IlxK7z#tiL)K<~h9k#cIQ9?f_SlTottP1&VmI&3qOzGLvnu z^LQkmoZgXf8|Qlw-DL{zw@`V%JNI$C1fxri$Gi6R>wOtCOHVm{YsFH`2iPmBLH%6g z)2+?TT}vG#A43V~#KerpFCqn+=82o-sk5M$^A4>7hlxmCAVXb4_I&b;8f=4iM4a}a z%w6rz{G4YR40x~C8Q^PT>2`Hwa(gpe#isc~1t{15X*#Ot_?d+LBTz@S7DM=Tv+K^D zUdkN6c=sL|^|S|!7l?dIj;9tj?Wh8t@@@+)j{%weUdkjVw0H8w*5b8$sqQb+cdAZ~ z_sGE;9@BOOWE;7lpTII-oM(QYA5j2)N-wToz&_{D|Kot?)Vii zAyVnm8TCK`Z&nZE3m5Toh&q#C*E?g$prkftjFpx^`|6WZsYNxv0P&VrqaAqjLyJc` z-yTzD)^39*pb1b(22thYWsBsvDh!?NK$)FdjCx=Gj2| zwpr_)Ew?`NH+y>Bq&`jG%ELfEXyC!Kn4mp4UD16t<1va7G)YK9z0YscA{iiP5Y zjVITgITC@`XqdQ>M-H|}mJCpXl#!KT05e+!iaozKH3Y<+n(zf*aW%zXi>E=yFFO~u zJQHlQPmLIxc;&j13=Ps}Pn-Ie&px#vA~xH%;0r+MTeZg^(ZwCnq&QPSf%Pk*hw2xv zoub^2>Un;6ZL0&yoj#g*9_KrR#;raYsToYb^aFLGr*fNU+p%WX*?#h8_tx1z&lkNM zy1BnPmTWH%enrIae+S$ag>+;PweYBXzdBrS&~c!HW?~XxFkUUVFb1Pc!LzawQ*C+v zL%Rm*Xl=RC(3Hk^o!Sh4C*b@)$a~AEx|(m@GdM|*01=!JEChE579_X?ch}(V8~5N4 zEJ$$o;O_1&L4sRww_BU{ob&H{?&V{^9vQjdWZexdN-U{JT^5O%wmoC zs(i|7X9AE&E;MP)q^!jMr5YSqQ-mlQ@frbC0SXeaRm!J%yQ3N|(EGp3-7sRQK3pRHhkPj+oK$gAwKx|ZZkn!n zdQF|3CzUAf*V)9I=403H27ho0`=#D%xusRL+jcobdzlWUa2ITpE%0nyyoJE%-BiEC z#}A?Ha@_Db;$-N$#LtmP_J%SX8t*&5iQ?@`HCbYgEe_qWR+%rQsRn2HlY3AC)<+cV znC)(@Pu2D4gtNJ<=<9vXvsXWi_^i-pk z$3k`nQcF&+BC)z=HJv|8c2h7MOhz75Gh0S`z8#MHu|OwNo@p|vCvEodnp`TeFtL3O zYu-`$`gPw)xgn&N-T1(_Sfg%vq}4}}PjqUsiucF*wWvob5YY%)qF+^OHuJ$LP<>US zvfbUFS>;^(P?!3B-8D|;X6?$RKX!kVLEmhbwmXUOPM3PVH+JI1a5B?8@`8ED!LR%oF1?j${eCxvNPEW6{&HJ=#jhJESo~LhhY9Rv$e2I8JOvh;w zngz!CO!kzwAO7aWQc>vZb4RJlyj^0$G0V{H6zgK}hzg(y951#NpQPalC&3RAY@P>J z1?&ea&9dvU&MuJoMrNnWTOl(iGoX08_WV5o#K6ep{+wGvK;Nz37DghA-o2oDQ zBUxP35uSP^cFvWt4ox*sx(ZH1L3!t0^)31jw z>y}kaSihfq)TV_Ri4c=kpOE88M6|X-fqbP&(c5rQqHu6VE~vPTHJL2dv#&b)uB84Y z_Y3i4w${18Sdz%lm;P44(ex?K>9~*=6eR|tXi3tk96pF$UIqIq>Krc$6zZ#vZahZv zMdicrOA4ZW&e`X9g-vENiF_XnAGVk_ZA$6JZM4tkOgZEeXl7Y4rKSq+rr0A0^Gqlb z*)084DhyRw+%0x`zvro`77d>-Y>d!TrxJZ;Ilj)S%nPrh)HySpBn{tSiUN}CMSdrek997!RwBR9LQ|2rWb<<% zGp$Hmnmm(SW2u@oUu9=Z>n=Q2qhyh;S|YweJv_V=@%xb(bstjR5aV#XBQ-EPPdfzU zxNVUlv+P?xJO0A^hUm~G%RX0Q{vGj2aqMy>YK~%lXE5g7!*b@G(KKx`gYohwmP_B^ z^7S2wh<#ps;aA4vVrOho+WIN6rSgK(SQuG`N0TvYgVEFMA`VIvwfdS@cX2mkz4HsC zLhehJcu3e|N*z_P8P*y8J1Cn#2s6>Zui0HSTg`0kPPr?dpDhaOy|C7F8eZl|Pj#n5 zEjsv#c6IspqU#IGrUY@nUwCZyV`PD6@agzZIG`iF092uAu<2KCRbV%PD7wgmR+r?U z$mMKDxzVsFpYp2f0 zx@y@Gqm!AeLMC*BcTD=EbtD1dxlLoSH`Z6w)Hf3eqBQX+M>J`R7(vb@jFxUo2fh)W zc2{Et0S`3D!cFb6^KS(P=rqd(QJI>jk+BvReJ08@+}5~z4qAZoXtcrzeX?2PdSd3} zT+NbVYni*)K5qCR-I{vSxab?cR$p_n(%vm+oPFPSsyA(+&KAn27m>q5Rf$$jbN3lTSsQvI9Z2-KQuzS*J^_52M|}b8Dcw zD2|F_BCYEPdrU${u#=gP8WL!f2bf+v0qXLNo+luo6DSG@ zh}lMzu)95q_(ltCa2|aNaqE+guPx_r;WMtWlSt!r@1C?S|{lDVJ%%VNbe!gx22KD0mG0ab6U{uhs=b358I%E?4fUF$e?tmo&2!Qpr+?HarIqVxBv}$_X<*MUdcZ<78IRe^L3?u;2G3?E*j1WT^@IR zZ(sCql}8R51@4IsNPTi>8bguZppmPKQ8WQ~xG$-t1 zkRzw4Y-gR;owYq;+w~$h>kT(+ay!VcupdJ=NiMT^TEqx+Q*#`ua_{aC1Vwrn?4OV| z&wu{*O3r|P$fUpZhnx^a0WMm<8ow#$n&-RzZz}R0Ph6WXF8->f@;NwnBE->Zg;lD= zC3SwU=qzc%eTY~KJ0E68&!8_xrt-}(cg!yH+&LiMrJP?+1T{D>F@$~YgDU1e zPPmYfEt>Lk8@bVq8HpSmHX}ri9F#^Zc~yt%(QKz+;9U(u*)y7U4qa?rWeMuGxz?-X zJ4;Ss?5db#g6g~Xtw=<!$NI4%tkA#;T zkF`)ZPuBXN1G55)UQ1-8yl(M$3OM6l{UjB6I!oDyo+zL7!xH!y->Fq8g?RXuN^R-whjQ<#*Hl%!&$nXd%llB;aHF6;bz$^(V?ggcYQNG43;$J}Hcmt-iXPR#6wVUsr`zJqvtQ zr)zp_S9enN!r^~}^A=k)45h|1KoYHAC@~MUP~I$rc3sb~PDVl!YfF@-;Lm5R;vhrU#9BD8%tF&VaT!%ZfvqGJIlj5=C+(G1nd}ghk-4p<`T*y zO{@>!jx5u9Za(ARSHGBcR8HLObsX00$H}XVQPrImCgUe9kWU3Bv>dL<8h4 zCN42S0YxQL%~HINTskH5di9s_EaOmVbbPYstxxQz7O;q6uZE;A=+_8apY~v!vGE*- z3%G}53WS1Nc>_`_>QE57cY>*rls%c!XGB;wILddfIMhygvLW z>39^5Po(JZNA03K$yP5*5@}42aqO4|pU~*iX?NeoaYvlR%qwYyej!m3`$jHqqaj<{;LX)!(;2*V zrcr6~U11R7wq~36)r_itSG?E$mx=rXdtFezbMr`pirlL(tUmmxzdSWZGhi>1ZRbBh zZv}XkQ1o2B(>J0PfJmypih6h4&;DaNflQy`t&w#YK1ZQH6Z7eQ08Pt^`YVNl(5FHR4Asi*=RVob3F!b~A zn}n@3(KwrR4J7P@6eZ1mZ?*Erxp~DAsQ?%>1sEmxWF)bJiQK~Wq;aFafr~?&rD$jR z;dz7B8iaeA#D@6z^S3x)!`5JMzh$pPV}!Q_-tAoC%2n4?o6;B1dDFuqb#2}Iv4@71 z@!3)wD8OU+%4U%GAolu6t?%6e{qRVcUXJobf+&X4pcp@yz1lp9Kx+S&Ih!OM&1`&Z zF$xcy+5w4Jns$kP>p)-oe)CsasUL}v+HIaR0X>JCA-oHR2myl|dmSFqm<`4d;F;#@ zVV#`F{b?kR$#{7E=LSuDYkR7Q6L@hgd?U3cZV1oU>D909f~^bLVL`$;l&3h_nbTn_ z7jY%Z^huFQqnO{@+A!I;VvUu9W)*WLj=+PNG7=t%mJ2Z+IF9outgY4V(Dq*?&0Wpt z5B6J2scy8G>`g4Ny1+~^xr}*iDbltIWO7z3ZI(UTiE@KfB_t;U$!yY+uIR^#sj2V{ zgxoG|u7?rq;d;?Ng(WDP+=hGXzWymnyOaWR{af~!#pXA$qPERCU7NCF?5rskZba)9 z_q$zM*o=0@<&bGY-1)hvkiz(p(N}|{q@gADr)2>oWFK&RwVDYlwOem<$wTozzoJuQ z&W~~J&3!%i`WH8pxwa2!cJUc6HCQ)NG}cp6KeX-L~+)lbi!Cx1|TA+6m4^PATHqlnPT1v=XDQ1X~e?d{)!dsmT^FqavL^X zB*)o@Okd{<($g=`0R2D)_`vH(_apAot?3KT`^!Dt69J^yLk1+~19v9MGA6A9Ya6td znq+`rd@}3nQr$t5+(Rs#dd;D{N5J@TbMuUEK!9+i*(jF@Fj&?3`ho(p-7#g&Pr=VmPK{u(-ex&!b1a)>b*ph(mAM^5$+dTT<=U z*Ll{@H)CIpqYQ_@BvZKa%9gmhPI#bI(*-P&ba=f_=|-W>BNR9^l88oIb48qBXf6ie zVR1CIOq3VIYYUpj9|VPT51JaGReyU)(e2cC8TYa~BtDQH1pBO#NR-^j(Oyy15ON<0 z^@dBl1|)Q$$^6Mvz-NHcHCnMFwp2)9woevQ3uK%*f%k`8GO_C;vVbZnNeGQ<%?psR zE4X1)_D1oc^O5asJ$wGzNBPUnJ4p~r&iMkkS%JqwHV2bdb*D`|B8kC2u3iEw}hOun*}ii9px=E%?xK@$xu3&6ARyZPt| zXAU7>m&7)~Gf^{L;HeqS+z4C&4`&SX-vtQT(0OJ&Rv7m9*SNFQ9CLO_&~XEw|4krH zW=_YypeLgh`amO=tCE2TVw6m%6G~PJqyT|>OD5fkp+GGw_|-_-osn{-4H+oo=51zX z28RT;Ov1GSV2X^19niQJs#M_a&sFh(viazZA3*y20Zw3-VgSfkwuI8H->;L^B5vO=mujJr zG5xE64%iAN^=N?+`al9V9@N(_6o%`k(;kpvKJV~oqki)$Yop%rg4S?2(a+QK3Cn&U z*kyDont8=y-lu`P+xiMp=cD?0pCUn0PFCz6H%sOC2aP&rz%#_wsJCwi_fxhKK=h@` zOa+CA2Za{_VY`;#0;mLheSP2laX6le&z!K4YfBqlEt@UCxaH#Q!XeU9Aonm(?L!Yu z_}K@%WWS&lyNF*_qq-=^goWq8MKC20p2E!l_7x~Q&!nlxgw5(8}+(yt9)p4yH)q)zua8hYue{iF@(G^l{1yW1`Z1nDrss zWcG+h9lcmJPTT3U2=~v>yFsm7rdrB;lBW?+M)G^-eUQ*6RsoJZZ6Uw_WBH(@Z*YHR zkiaghcM%Aa73$B+4f=Ac{@Oq(B|Aqm9aRfpSTe4=Crh11-*In}$gVQm_q~JyKm52< z0_G}B{(ur9yVdfOkKj0|skP|SkfY|{y_~>gbolwf-9%%Z{345*XZG3aPeHA4Uv$oy zftz?-mNp!^HQ_KB3OdB?A)}(QxWnl!t%x>H_N9D3JQ?mjnheC)xlnSKUUx1ZHw9Ro z>*Pfs@&Kw2_G^ZdgW?6Y=qvsEe=Ej}{A`L-)$D&gXnlF8Q+e`>^e&_6s*BBqN2Lkn ze);0=f*}^FM-ouQ0wN%}JE1pJiqw3AYt-$L)a?t5#AKPqpD@Q>Ys{slaym*$_9t}p z%8}#27!iT3Hv5`(^5j@{e=6?kGWU~gc_t_Dp%2SAqL zR@!@KDXgtjt-0fVr7|8ddi9xw25@@v_y7b*rdpHx*4#G&m_ZAcxLqOArc;G^*M(wB zlZv3Wv$TXk($r>J(wMzT@2=)?EsBto)pf7EnmyP9*cR@je>z>?=SK)g-1TB8aZP6GJ-{v?rqU_=+) zs?26jV?=>wo!+ArR=z|=;7ns@q4xO>o3ZEbddECm?62v>#N@8$drqsNNhXA~32`U7 zvDC_?RxmE-I|jZ#&=s6;=(T@7V-pS`Fg4RvE8a^g04`F%tK(m8pz^L>?Z!suZ8VtzOs7WJh}IF@62PYs@;kzyHd{ zZzsE5$)_r8*MDdgcIOn2p$?+%vaFje`cXZSZ$Q;>*!H}R)WK-@K3FMq>3}X|$>XG{ zWqw|byUOUo;!MeG_Bf-=V>VPKqdRxW#98BNKlaSt+IrL$_%c^@(L`<9sGI&_7aVz# z4&tsEo`ZFyV5lC7DJ9FU2nPw_4q$BAW0k4+-uwv$YKjJifE5ZODJAtLHgf7>J2QrQCZzaUa(&mFXdcVDk*5 zE!kJVB0O*5FjeG!RgKS~DGUxeh3;A!8cTwjdfXPm3yRI{$DFh*s=%R;o_mC6E-DoZ zB0)JIhz7=F5onu=uZWGHM&FGY24wP?z*A|mxpmx^QDHYWZ47Yq@obi~F6Vn`bKc=N z+^W2|ytCV)G-2wNdO(w9{JZWIE}KcNx2SF}V%%IZ(9ui;5JNQ>Ag%fn*iIBVwPz`t zBbjnQ4}iH9ahhphHpyGmyVP2_1Ul-G2Iq>cd#R0ifPBOtbl31}t6?{=SG)_Q7FCY2 z0rG{7+RYTGZm7(u7gHjU3kOsY{HibB1|aP?-xO6x(rSFO>_|;AY|{KE(pPhq&V?9>wT~CpZYS(L?@;W{$N}A zOhON-&?Q4eJr-K+l9YEn#4lMN84jKY$#8|GWT?Yvq4os01C1)NV#yt)q;SsEgGh(~ z$=X1EKh_u83Z)Y}iLWO?)OleFG>yP8fp1B&T$49qsL*$oVM&XQAUzm8H=I9D34CAV ze9(C71Rih5QX6O8+K~%*%9+CvnrBK;SY}m!e?ypa(SX++r;2!66s$GxU_`w~g0Lv) zbvvvkyXs|DyLQadQA7?mD@{M3G+zGs=3=o7*eS>;&p=6}SnB~RGBVQTnF+GW)At;< z8^28at;d`iLA#sJ(w)N&wfu=%F|4q%R);VwV#xz~9PB=`PzK!oe3dG<*5V1MO)8A@ z0#&`d3h0?3zdsvWq_+1rJ}7Vu_G?#_^{P<);1*QI)YjH^xKl7yxvtb!yyZ$s^{uRg z^4J~2zHQfg@XI1V_Oznod5p+G$)?bD2B7!EzpS!MMpCPT>b3I5k&(ZF4>SaaDO<1g z_Udxk2Oa7F&QGq1h_JgG-rZ4sSuXIMDn%?efd`Uk5=*`!ipU#rzRFm_Y#(j_IoWMV^IUd>Ctx*mSA~OE7oykdCQv6;|6egpAFVo&G z_g4}-i3C6#`5bhz@KLL_Tmg!xadGl@F30YPw)pFH%IMx$L>ym9n|HA&BwA`KHmx?L z;N5Tb*?`r$Z-!{VGbe`vm(?uOWU3QH%cULpWgHJGzq)+n@;5FOu9);eMX$dVARb|x{P{_0!X5**^+pZb{)x_J7?>%s0TRB zt#Nc(<*KaEIdkl~`0J~jle2S{2)m6PQQR6pV zy{_B~VirTKP<&`PL5NpaQ@psAcv>^+6T4N*lgeaLdV`@T94PzY1l+-(egGIMM`qJ0 z_2ehGARFTk;XqMxZ}!H}3T;^?7RV63i*e?}ZH_K!j1|x*F$SoMo(N(e7wW7Y69LPh5Kx%Me>8YT$m5nPu6GTZCCS{ankd&BhSEBJ6ciF%{zru!i2vp_ zJ=(rW4Bs&73KSCi-r#p=L!L!1nG6i2a2Wo3&2)J1>iU8eUp%hM4q8^JHZIfMu{0t7 zm!$VSn$hd@xN4##yuohI9ojl*=4)Mq9=A3NllHpkmrPGjmv=5^TM}gW-S8LCLjhg~&wh78DCke;7tl@(bgv?D_3 z3?7T}VyQgbTvSS3lcv*FI}?-|CYaVYtlsGG?Lc;`uC6X$lfY%bc)tHTpje|`=RB!4 zcXQp3qrylpAzZp)rBepT=7k^JA!Q&!0sR4#8l^bU(NTz4QTpR(uacD9~{9yhy*?Bx&ykUpDv-e??Fc9qvK!i zYgAlq5M<;}QRI>8_ZmAt;Ckdprs|x1ghNE@=mInqpilttwEqi^VesJDuJk!3a08v% z&DmQ}y4PKXrUXOT(>v$vKx!iUsSl`F-z((53?tVf0C24C97mZF{U<$BQD+}VcY}o7c$Q3?ecL!i(vX0&Y&azYEX?B6JMh^?_Sip6B z86j9}vktoSc>y*)a7&)6`9H)ilfv{#T;uL9RimG541OL?;U3Af)(e3KI*E25_udH( z%M4I??nTe>RE>;)dgC<`tyWX!X4NodLB)=xzGz!i3>Jor89#j`KgH!Ho_~<}j8-(r z0%!LJh#%<`Z=a4stVTY;j`XKGDzOf)xlOmMdp0L|pztNK)m zx+8BbnJpFs&(QmhRMA+Z-P|AU90lh>94I7DpjRZqKd|@p%TSqgvH5h{py^ z&^~s;35>dmqt*=RjVAA`i3RHs_+-&;MA*?CZ|I>5zXP4de6ggZrC)u@q@0JMZ;2T4 zfReS&ZvUCb!ywcbuUM??1vq4X1W0Z>D8OA~a~o2tFS%i9g<``T@cBg0sIi{zE=jZG zRh$lS9%zFS<@@cwVF^rzKTYF?u+P`ypgtUEuZ#kjQ|NXQ_})G$;?$t?C$tV9 z0@^eThx|K_Of3EomHUhNJ(6-+8TT=CblwT~7*8Da0s~Uh8(!D`ADd;PX%O}D31~Oe z+O?Y}#Y(rOX1~As^42-9gLbLy;FZPQr6I<=;dP#Jce3f?j|}{ODp!62N;m+mB_;*Ma(ZCd z>P%k(7PkCd^5Zq*n}Tf&`gz3IyO<;&ef2L-xqD%y@FvrScsw{w@Q4z5bR5mu3Absm z@8_Q<9=^Na_Qg1$2e4CRKg%sIOzv9=q#NNJY_Bw=Tg+Eh?~dNeEH+Q?1$yV)SxL)NI%MY-slGcLb~37K zYyQKEf7^$SSeDbj;oE%0>$*6Tnw_i6W-7J4vDm|xW763b5{wCcJZWZqUg<716o$W_ zil%%gr^w#Chhk(zq45bEO8>+5_=s{Vv&rLx3ovv_NYsC|?;{Xk)IwDkq>h~Zn$AB3 zug&Wa?vP*(agr-DRot0*j}rmLsECsw?_NUDhj5FBdpsm6aQqO@^y+pUIcTJU@@c{} z>2V=%_PM!daQ;E)oxNX!^{%^5A%!|FTy?1ta~qIl@(Wuho$D2nEpuF$=@((1!~H+aD*TY0cWxZP z#6W{Sq%0l`SNh5u`J}$-ml+g;?F$S95fpYDh}HYgo2gti-sCWE%x-EH^|7=lpcmvxHCMK^$V8`g;C$qUIo=HS~w>C=PdYjS+kd>ma=o z1ilZ#(;jb0DC7}EFz;H~da2=(lKHV>L^%!vd1%8=ryOD!&Ue%1@#pljD2wwl+3xhT z6VZFmSiLpt)u~Z}p`Bhpw0oSiV)owTmI5igR19^Js5Nnv2p2m=^rMc5xZ zDe4;6ei=AtD3K%Of9=$Mk%;7fJtS~Y=aOK5qy2Xdt;a)hFh-wv{>{6I8QexB7Cw$f zS{mVNZC#qYI9nk?N~)ysnp6Vk;NI1)qCl!Y2b62xJ6Z?ri{JNGx-32mo`yWeLlZeN zSQ9a;uHp&Y%V&91FRV~+SQ(r7%iP5_ za_3BKVJ}P&!C|fGKi=g286nH2i*dgfK=ef4O{@Bh)DPHSI(#U(X1n@}_F2#^EfOF_ z+n}fJyf8Wc%`sZ-L-Z|?o zEG&OWcwbS0i%fi(WMXARf{Af)`dj~xdM;vJ*lDZOgQ#(mGah32B*`S$`qH7VuuMKy ztpk&{nXqonA@}QIgk$DI&(jv?q@>@x-V{>p7xi#L13^BvGBt5>7$NJ3k>`Lr{~W~l97gW zcHcD%Ke`{UM{K!;=%!mX+qn-n*^<8$?Y_L+XDw1XwBWrA+xKeyF>uC8n>!1Ze07zu zA)1?3r4kR%aJEGBJ1h(PGqWm-BsQAijn_7v?)c9WR0#L|X@xygq^pJ}4q&QdzZ3a& zvmK}76KY?j`yn%K9I4e0dd-n(LgA3mx~OdOUJ6{9ej>$C$zH&a24~u4lAe`0GvdC*RA#;@Pd#fzX3>%kQGVmqr^l+R zDTmX+-@oDqv-;!brylB4=8XghYcyQD8#sN{z4vJX{TGL8{(T2@!35_qCp=%YrQmIQ zB0n@S2!Hk~0nW?iFLZ1m_>Xa_KC^!XHo5$J@*Lnl%x^y7V*U6lTn`nxyORz1%m>!s zcm*O?b(5t3dMxS(Vj3x+%b!w*2QU8MZ~>5OoX3bhM%$t>Y605%<&3PdqS!TdH-^OfV&SObQhxJpk{or z8Va|KN!aD!p4(5DLrT;`G3@vWf$roaOezSYZNkQY6ZKHom-btK0z#$aiFC!)IS-2P z;hgo>QsJ|{zSV2RsxJO-2esSW2}Bi*lHB=5;;$qq;3Rf4r{~YP)fhG|a=jh&?q0Y^ zzrn}?IVLcxgFkEE%!I|`sy>68w)gx&E9v^~#c?Rx98K7+C!@hA7`QQZUeP75Fy4svWfy@wkL11Z=n8ELWgOE+2WP zbjzkGVspC^Zp!-!dH=!;j}==L%n=r=RS|DxyNB#q1t@W| z`3|ZCdd^ghw~r$qKJ`))M_=Q}>yNQY`iP16vLGbfW+&Z9d1_$Ri>mtQlQdQq;^RFc z*0h**VMvsiK9hZ%m?(4^6RMX@>)5w>e@|9q5V&&?-ceUoabNIb&=(Qmx+Gq^%A1X# z%fa!RC&GSy$E+RvnK$a#c*aqOi-j)|Ibo_Lz8Xfz;_0{#s(fqD+g0LJ)}2b-Q@UE0 zCrtvJpG(A_4kK=H*>QNAbIvHACOk#2aw_S%z00}ko||5kXtD8?FAD182no6+%#E|f zQ^ebSE#Mt%If~wCq87_nDc!h&r?;+046%1>7%djUIa}vDercayo5DhgfYLqB!+Bl*#-wk#l+%yRRQOQ~si&L|!O*2f;olfl1xg z05&YCYg_-XYxK_pM_-I(>gFZ$hO!MOcy9%wg7~|;LLSR)&X=nA-+j3s#;_{+?*wf;#7 zox~kC;#6RZ%K@Ts)1^#BKGU}!=_|R~`sVcb;|2+OAKyNljk6Q&dX-@0DxQ6&NZmce z=YSI^sB5d$N7B2}8<9=aQP{`I@DN=aRWZI7r5N~Vif^}LpKxD`^nw{7c^5}#J@_k+ zxZ}ArUpQsXm(nBbO3jSX2jESx{!~+gb`~!$*_OK9##R$97>WLvRP7}7D1H*ZT za&dIUMvfo2(RmNh4t)Z4Oqniry>h+wN^BO&=ZIg!=hD8$f8%F2@C#d;|&x9Nq?feez5E*IwQ zoy9nc&$RH*g-xaj2ZB3M2eX4o#MRJ)2Aaw}sS2wsD@Tba1H7e^1|uV!C0jWD#?WjY6`yn>R+;F+aP#ZxnCtg@GViH*jWBZ^k!0T^nQ|UU3uc=Hv=ur zCGLEQvazmH1D3m1;Xb(4tIA-Z@7rgPiS;c56UWf*9lYTyUE3H{0&D$p z7rM^+?xY94W#!e%Z$i!w*xc2}+9fd;p~uZ>&pWmeWbA_{gH@gQrGJnaUtM$K^e5P~ z7#2LZ@|f70u9m4jPnX(#cVcw9WlJBcZC3K9a|bWAdH+QEGfm8eW})lEg~wKT_u9<# zab0w%^pusgg1p-53H}@7MtAg(efb>a-Q3AEMuTg#j!QE-i?HkbuU{*O48kyD8Yv{i=q!w-(-?*R{NbPrIU7D@GnRKieN|&p9Yh7#^ zGdy!yZFqB+Z8QYUY?)6NYxKG^(an!S9>b{jlh2+X3VhnYy?h&#Vef}pnN%$9N8d+z|-!y6XEY&Mg&u}S3$ zZ-sAl#MFs?A;2wQ+g`)odEuQ8Tl+;Y)tuw0cfmd*Q+=Af8oGABA^fa7KeL4@Q`fE3 zdcz10#fuj29N**%jb-tq zYGpUbK^!1Oab-n-Rp9&yk(u9o^XV)$>$C$arhq(A9^%Pz(#$qBMGZTzL@TU3nVpL< zeZi`PilR}A&O7wi$0pJp`{C;=dHm8jcP0_nj2U}7w#iEz%+ot}C*1id|JF)LHmBKh zufA6K)xPw+V;Qj$qrX2EswWpf_StA$zrw6y=?yju5hhMS4+`f0+ok>HX^_@~k% z<*m;g@wR@`o;+5~wfMOW%0tVq* zsg~oHNO;zAe&h&y9=-$)o5o ze@zy`zES1;WNA^Zl$)a~X()=aYxb74Owu+-61Ys_wIS3dXEhQ(~?E4{?Go1F+- zvp=~$pdE&fqEna_qs!CGY&Uv^ucXI!)&D9oFJIfkZzO1|Dr|FDwQTV`W;kC&IaWc~`(1d4uJ zy^rF;iQZm>zcidb7r1$UXVM%oa@51N=2*9Cx|ZFbTWKsQFme_!J?JE;>!nmqvsEX( zMvB``j%;>e3pt++C8A*Co1$67ZtlI7s2Q(6W3bzxuX$j6ZoZGI|KhpPn>_Pp9orRP zBCNbI_z5fhvecySRmjNFnTB{|jum-NAnBF5{h-i$@2LP~R1|PH^&Jj=GOuJ&l}Bu4 zcQrSA;_yS;FD15)ooy}1KG&2&pM~%_j~=JZ&)$7k#nd^hwP4)A4LL!=ZK;wNW~9>a7mv=DA|_zdsqwYyPI<~@9B1zXQ&(syRC4XRZ~ceb<^4@=&z z30!ECF`eYM%ZBj3O+yqzpS6(L8|k?CKMweg0lY71a`M#in+s;NY9+lhp&wnJ&`DnW zvdKR)HXq75lu=j?Ik-R$E2-)x->QkZ5F}eY@Z0rBd`7)~+LoEHAGx`V%)EyuF7gbu z;u)6I-xT8{4wUDc^9c`{$gwo2zH(=MR@EQ*!D?{t6Rfug$g zf^?+D0*e!=(WW58rSiAuY8T8N*|?kpzIv0&$i-nbs?!B*nc>D)&RvVVCkq9*NGGOB zdKKopS;*rja?dyO_eWVaS*dSzVXBNQyt`7YKl@vmT^tGLCevd%v%lc$fuEkne9ZwC z6$fjd01UT%_vYc^uC~hSrr73?I1HG5YR=lN1DR|=c(L@D$2j+^)+j5sA`h0g5X9Rd z`tHTAgD2jOH##Qa*UHJYW%d*f>=`a4I`1hU-%K3aCQ!YQW3Mg{+J=qrU0iNn^T9=x-yA96d35i$2W=$KKU zqihj6@)A^McWp*+ydc4=4!XymaJ6i}l{&*>74gZK<`a8~!<-(9$4}?`Za7CXu*ClN zzR#lZ7UeW%BCM9P7EA$ys~Ls-?k{|gSfaq#s^>MDaIzs=sa6FAMod%_xEXV6GW`~R8`V8Fx(1au^91I#BiGOBqWTm3a@87e zraG`wleUf?Usof~=lRl$zO{{9UPVGZ+jCFvn$h5QXj?L~o%POt_iX!ZFAWMD*m$&i z@T1$YZXE1!Bbf3hEzcIlY`;tI@-obGDS2l%i9Eh~=ih!HWFVp1{3LW0yKx}Tm`DOo z1t%e7WV{VoZ6jiBN{7-Vt{Js?rK{Zkpw;|0oA8EKnLFa#CQ4_yOqX7l>Ddok6k2mb zZ68abn%R(FNcsVrZ+PN0x49Hu`)|4FZ%V0f!&L%aHJ-jViWDw`w8Q<36kb3&;rNhY zsPJ~ch>1VFJqfPAI;I3J`^K*Q8(;gR!vUAcE5evvpV}_hV20qtB77ElNaGQQy!So+ zwNAeJ50ftaU+!$huRLzmC;jxOG9Yj_E0-8=oKTNiM_y+|Z2My9`r{q+yS}c{vSFxN z5xZrd9SZcLh|?=I!bAZFx%HggI0?EnM zas)=w*7ggoTI`P=ON8RE^()qHCOW$x)Bfr@7S7BNX7_cAz=zU=9&sq@w&xuANs5Vs zz6eG4gxra@lTiSMs^GEdY-VRn)D3NwA=Y{PQ(NI}izAFT9a-V(M+~wN5Rc93+|p>h zRk^jpt@$!qx0xtrX*{Zk@WK4~Q|1s|FP7wb%tfdrzv7@-S3xG-U)iwC{G z@-t8L^HX9>bIFnw#Z4GuAXc8SVU(&zZx8;PMaTlzV1wJrhL-_gnv$pR|16aod;YP} z(>j|gJmFcr=rXEr2$w_e^^9~v34ih-+QskxMnMfgYODNfeCkX+sPcP+(~2q<<(Qwa z-`$R*k)CbjvU*5nf9okU5e6QrKl|nt@@xr`?jSt(O#7x>>75~=-Hi)DEJ{%!5;3uh zgEdrY5gdDs2pk9LMlg@Y184%>51L$ne*U}tV_mBLNuH0`3e?bwND;>;>h`-=Jtp8g zU0V+FY2UsR`zJ83`|R6NZ3!n&&C?l(SN1eOD_oe5R9}@LW^2VLCaV1%90TZgOvV+m zfBPklTS^oy{}%0q%<%%uerxJwm_Eo9%%m;nZuzhGn41?@B&7V(JPtaCTD7R_T&@`kB-(=)^C3M#KnC+q z5|J*v;9HY08Wy9L_UiQM*u_Q65N@MMZ1aKZ(Wg*V@Zg&n8fq4*;s=w`*N0-UCLL= zTqwe&;cRo0?=u!%XK}gd?H#f2r_gyZFC5<cxpW9_xd*-y+ zv-=sl?LOV_=2-K@zD|977bu;jKuP(|^%IvNo9;=tOEL1%Q8x~YfW%YP`{vD+&EGKYho24@x~@IAU$B%C z$Z^`!^J{ZKk_r7=ODt*ZG+zWKNd_b=x|Yb+@Z{jQ(4bB-fy^P@rr0Eqztp_UIzqFV&7bx7%SnxrrQhf`idL$6)h{SIc-QGyzS=eDT0udT>Iw;R zQfy}nT(coTNks9nB;#~=z2Mqp#mi< zLhQK51liLpei@e{PDhP@g3k#;TXgFO1}uz!Pr=QUXrV;pn;N*k~H3Vj&}Q zWQhyH!?G0$=}-2(r|=q(_$T;8GE01!$ll~8kfwNOQ$4%0eezRCoFqZ>X%{6Yi#EB= zOaR3nqr!cU>07kHQE-aqJodTryl?g@4Xf~Cy68E3*mn3BC zJrm9?D?52ZrCnh`K5SH4jV354`e@_JixNLuiJ#wqadVX(m7I%uFP@EEDQtc8KYIJB zsJMcz%iwOo-3ihJ3GPk^P6#yKIKkbW#yz+MPY4pAad&q@aCdk2=_KF$vt}M<*3857 z+r6v1`byQQefHjU>X2LV$^-H@FY7=4Kj&o-%)~hFC^zDK#G$|{r%PAlg-XxqNOzo!QPhtbtwr6Xp1_oVhvutjdD8c zrjD)%fyx_!E!Rdjl)xLO!NXEZKqqHI`hD|kL&H`zpM~;C)ZVfC2pBVPkbrR`bo zt>U!Ja^~{S*xYxa9ZxA*7FKptK|sEy_ckA?l(M-M7f{<6;qcw_{6FD#gTT*aC)yE0 z!SBRn=mvI*txP0vsztgjLC6OSblw{9v#pL*iguK;Ddk^(NfJ?WhJTHMS78hE|fq#^A-D^LvfI``KLT{UhSye z{$RH6z43zY(_Apdb=Dp9%KLJ5(|IMTh>+~)Y4~gSy5Gqjp5!{3o-Q~R7;?s)^Yy`Q{#4{p1Xowf>p5nO{=0u-rdRWNDe2Ep`-)l;teST`zdO?|~^U|9p zFR}fP9{0b`Q?95m>}9U>yHu3!38s$0MWnDefQu6}aP}DA<>mDZH3R&|lG+Xs<;!m0 zOw?CPFg$PdWi<*)`o{@dpgNg9pUDPIXGYmt-?O2bU^~1j5p%zhuk`k=j7#6 zjJO$o{~U~uQ7%?+2GyO-)JZn?yF?x9`*^?i3;|uu`uXX(cVO(z&+o{7o(~DdBQMuu z8(P3(Ex_Ob>XXZ39eW=xF)Gk$V*o1>4W)eJ5Mr6KsRa&DF63A^>S!|nX31t|DP8B| zhEqRTSbX$?lpp4P3$H##;XMjzLBNbS)J5?}`kQ#yjxhDcu5(d8t6hV3)A$0ndl&*Q%>)edQ-)WX+ z2VC<@LaYDt_k=4-5pH;ANK zHNPnbX3Tu%w*=jLZaDpbf8xLFQg7gyiW;zZveji#f{JK+dFb~dP%Fd+L*q}em$+?D zW^Uw;-|IH^K99ChWh9zYKq&Hbx%;XBD(QH$(;6~=x#7?BG5Yx`vSOT;zu zH|1_^y3BgiW6i2WLd8pxKcN}=iSPZhOC6*3KJ{%^f2S(vzG|5#I1#bHkQmvYR zvj#NaYhx`#;xqhvjkgUw%VF(fYJ}8yUW|>JTkD!b9grioxW@oxHbVNOk)yk?q|{D> zM6q7RP0cP(K8Fp|ik1f8+>hS%dt7C!5G8?4y?c~xHZDlS6i*Afn`(jxw`p-{kT>QxQha%-OEP_D#D?juBeW^ zNTxzjZN7Z=ztoLb@%n0q>S)myV!-JUrQmhvakv~^CU4LOZwFL8cCsO3{?xi;*n=x} z^o3Afu^MGr(4F|3dR~&SiK;%37!uoN8);aPo>hMOjU{+_@?zoiP!P+>d`L0tBQC#W zov~%1_HM(#D2!LGMsFols-;{;%I0Q9m?1@~@OCFvFBwOSjOimNumJ-4&bO0vD4Zo4 z-sYbh#_n%?^j4ojYthhIBFyPzU4Fz5E zQZ}33bN@r=wiW(w-H~z;9JD=wT)3yL(904AkF$N+i*OjJnrsSkqY|s z=D3lvC9<3ZC+i^^HNJ>g6CDSztXzr}-tlnL&ve;$+$QX>9%#naJaRZP=@D;5oeafv z6}p56m-Jz~SH3zYgdGKE@~#(PT=B)VEh6zOOkv)T{K#71OQkdhVXiWCrw>2ZLNQj)An4-rj&@V~@Ym@7Cb% zyM8#OUQcC?nb%Cc4_CxUD=ZX5r_#|x*(3QkMh-0NBz*(e8%-}B_=#86A!lz;bIkbl ztYtTSv|_PVRj01G7gy60t5`=pqQqulqN9KM99Gl5fc8HB_2k7ydkM4E>!k$;Yal62 zkHQ0F-^Xj5_S@`GaVds(AFQ&l3y))HMSf5JVmpfXGl=!3DE8Slgn`3s|@;`F~>Cx1yp9C#SQ&55C17#Q1hB>`! zsPJqJE(0``^pfe;>K(sRK{>B*N}tf&tYV*sC8{L^m4{iF$i|kuQwwRc=-TTSt;TJln3}e!lTs-CC~d@kaD0#^8Z33gl`lOv<7i z@6t{K!F1%}N{=Z2`p?AeGEgq9Qe@$TVeq# zoccSRd_y_Y?9TMxxZe|oOtZcXF9_Enm_ZfYD{Ud?NIdd zB?*J+66@iR)XxgluLIe2=-J3lRNqIs398H+$Gpq*UAd;YVF0NLsu<54?wgO+7Fu`2 z!xB~c%zcF^Q(+I5DRN_Hm&aI0?^Et+y6=dyoH`e6YjdWZo}*kvrpaqOxvQI451#=W zTi?^dzhzjm-&SKFdhodG$mJHhNN9b!kG)Yd#dca-0CxMrIlX`#kW)tAtL zPELv&OP>ay+z|~h<)bN3MJ?FXl$g*8dii0K;3;tPsh!6I&bNi#znz=vL#f4LWMDTV zIC@D1Z>~;9QG-hOBv(OD?Q?2uW>yA@69_9L^a|8hdLvH1Pq2Xm(345hQBVYudCqq z5`-p~E(E>#=Eprh?Ium4&z*J=(f?+4#YmY4f`0fb@tvf*J7}IP#%`J;zNf4gKQQUo z2`nH}*To7w#_)Y4y`XCPd}1@apatRwQEUWoB=*%fFq0~Z(>n4)u0Au4~M~e&dlE@EZ4Ow zp&S#)cKzxC*v|DEyIfUOWfUYjR%_HR@<}6`)KZ5^2d~}3N2(Y+KN~hJDz|XM>WJd| z^{2m$0lsCdCa6g(0RLW{5w?}BYgjjm5d7+^a8`D9Q0IQ~E5bsmSX$ILWNNUGN+na# z`)q63DW-&*H|t8%^(D0uX&EH;8%jWgw}p+k`*~RQrF3xN-nQaKW+>BdJVzZZIzCCm zO!s+whpZN>#nKuSR}|%9>by%R@IY}8z&m^)Ix&%H*Hs_YT&l|3`w`7;fmZQ3S4QA1 z2b@mqvA=DpJ0~(rmd(m%E0P$`#}v?(?Y7mD4#lpDJi+q6R# zQ&-CjPA5@79GBxlu+ht*D^uIR)ifsfEJenZIb;u498Q|Mx1ye20AY$}FQuR@srqE3 zlTPCqvjV9lnTunxVf}Z`Vq{_18kCtUK0|f=STG3h!PpWM?EGJTt*;5G?s32Aop_|M z6x@hUC)&l%wB`D03w~$#u6C5TF_+&sVk{49lz>ZPfqG1L&s+)KYLQhNmOI^k6u|Y= z$#K0hi&Zt?h5Y68GvABUqH8XNSvM`q3#B3M-* zjZ6glfA7B2>9Nh3+RnsuKGTZfd4EKZLNx0{p>0KSlMNUNK@F@ z)@IJmv3q0q#H+V1#CTPJ@~gJIkRfbHU*{P>MjvYXWckB(3Uue>uuevDfpIb&x53bq zEXOQ`8Ryp^L9di`LY5aq15yTuiO#p7o5%&1pVd@IXaRvQt49=bHs8g|HK~$O_TwoR z+T1{Q57sFST`#&^I9OZ)8RN`lWelwOtny(2O|&!$#I%^9i6Kq=sx=`fc3bU)Pmr`iB z_oyYFf|2-kPqO&23l*@%qXiQopSj|)0j4!HT*#48j0TK-zB-Wjen7ob-^PF3%u&Bs z{O%J%f~noeXNHOwm=;FRMmJM1_MhZvt4z&Ju5uZ zSh#$^``cp2US*xN<_84r=+d>4Xo}0sAk?WGkQcL{A@v8OJ+1l|ZzgQ~K40Am%+}48 zRa??hLg3Q{a{GNeQ(S!!Jd5vq$a(Z9$?Pi1H`*hJ1mC)8J;{_Cm18azRQk&VO*dZu zz|}BnnU9&bp(vRbcFw294XG3$TbA?*+6G_slO(Qu=*jxn@JoVwGhP- ziV^Qj^v9nK>C^8-&41O@+2-k0+vn! znHsAvmCmGvLH1&e`-cE!V4}yFIFEW>j-q+A3@sXV*5Fcby4K)o=MQTZp7QzN>GPyNuFpS@u_Bvuo6`O+67> z9sBbJtJ6VuK})phoDPEm$C-d@T&wshWnh2atMD#96DGBcj0Gr(xz0IBIZ>(*3Tfs3{8*b@4=srIJYW}CO7(pG2zIRuB#4x@)KH4hU-HSSiLV7 z4NYIVV{ZxWsB>P0V@vc);->YJ%<)=RM2|sTPA=iZJ)N(uBMzjFD${_i3$Lo`^HNYk z;O=uZX^lr{J{=nty!-~UGJR$&wN2E3Z?X`(i%0`%V-%dQtUKkEGAj2U3Wf;FcGWs^ zRbW%=4S6BsMh@R(#b`bnNpI;F#8!d4v|;t#Tksx~kv*)Xx&qWT$CTRFZ5S9G zS9)Sz5mX`%y1&d=iRcA%+C;0_^L|EI9#pTOTBQd}&$KfplY0>zsJ1fU$}W~9-Zk+k zaeTVf&-LWWBm#x4(qTB~+OSttqS|_#h)0F@?MIV%Klx&y3k}RX?XZxA)4Kq($Ad#= z%-8P}ga=E41%~(ST!>NMZOlHE1~_eF9*$mBorW54{z$PQ*b%+TkiAk2Rli;rF7EI( zoN6inx}I2$CjbLijxTksyHE}S?%cJTYW;Gy94N~BT=wP)a$ST~%9s76${RqO4*XY% zDx}vbzq__C0wh-=ytA-a4kdz#3VhK=B4~#$XZ_~8$L7MceMkuK(txWTLbx^D&9BuUciU8gFRD_rtj}>h&rmoux4dA@H8E7@0bs}mF?~D1E^!^O^ zSzg4PZB*S(?6p07J_=d~a3B3R0{s>G^@^>C}=Z%@|6gED?}=sF~cw?@^n&EZ*m`DPHL53N(a zHXv<;HRc~eYmkdtVBHoLdtD{)ZaSoQ&`2ZnqT<^;`~r}ihy01Cjnyas$X*^@_(i21 zmbnmu{UA)bI|F9>n7nV|t4d5Vd??a`A9l4dn;{n<8rtX4Okr-*B6*ORz?%aq%k~#i z4+0Rl50)k8Et(U7{=B2u55U$nq{S-x{;eg8<)pr`28<9L)Y8SVLDx??0p@Yfzaz}9 z-{zbjY0$++`8jetxFZjF0?B=6N1jWWFH% z3ysjP1pc-GNI$1xn~*b0MtFHRJ7~FKRJW0};?oWU$x0qVTe!@lcKrha5lM_>p@)B3 zrN#b>3;!H-s`^X)=PcR(`$_NEM&+Hgz0al<=SQ;9i7!G#w&!5kMXV!FWa_TizhRs< zqbp*b`{L{|M_h&%-Q#1tU!%@q<#AR-;RQM%$@?Ue!8*HlP^as7OfT!2YKe;~Te$6E z87X!jle(Mq@0H20Bc<21L^$f8^LVFX&@0o^hUU-tht#`UO!&)0CKSGw=+BS*_g|?P zKYO8*&w$MOEqj)X45lE-L3++K0hKZJxP4`Ka5WU5Smgf=jA4awp%*LtVdvjaqBXh4 zpVcr;B?vZmGC-|8H#idgwErHo=&QByqn0RPrvkAL4f~wW^_qQZOQno%V;}cy#gD!# zH0Pv66c+XvcBFF>mETa3O#2ie2D5-0lsg?D?uJ@S=)N&sdPwuproa>)+_6iFlF&2x z)|G4}xbwLS(W+9^BRBW-e2m^DD+nJ`^4FlRvVxQc%sS&o=K8Uzb*7JZT<_xB7T_OJ z;D&n|jB&@B#8@_Mn6t9m2)1NM@AU?jY=OmBz`^X7v;v_-gX#^P)`e_WV~kRiD(n}$ zg|OcsTPfWAv4wA6v&s@7P9M-{opprH-|B80%gipCQhnKm7j9YDPjD;JwPJ-C#YDaJ zL@XB^Ex`x2?+*yjj(nimbP)dwWBNija1(cuHzLC$D_r`h$p8Z(oxLQ7Y~=yD36!)T zjC(>2^*ljGl-gtSz9Z)Ls=9qhFuD1q?$cozc?dTOu#~qQCnJ))6Y}5&lCFlk4)9cK zRGiJyK_99IkjAm&TL>=y>8K z{4=OpgztQw7mytuj8lB~@iga5TYbi~^-K?iCcketD$RR*Sy&NuNGhIdjizj}y`W3E z$}D+q^Snj8F*s@XHOucPavSlcUe`u;8{#x-e0RY=Ejd%9>pHBI47Ys(puCuM8Zln* zBXo1pEBhXztgE+jrl=Y_RISy2p`;lp_{8=`&jWzPc4TSlC45z{?S|r!wmv90wH2Ry zn4UcRynN80TUIWDeO^5=)y)PR%+Ef6iU^uXaR#}I&z+O?Sucy*5nmg7r*1Knv8z8d z>Sv}O7T;&uHR&xgZQE!c%gt!&&-9NPzaD+p^X;Wy?_RGgp`p`>p=nUt`(kpf*r4;8 zUbAuD{Y#U=ec8iuSt$0o{nL@1-@`Ix!1I41n+%|7;+3(*>%6`T@IwtdeihB_iES>) zZt?((G0Xg73sFKs9H(k8Z+-ZL3WPG5?M{Uy7isGU#`(+#751JTpx^QAc#a=_O@DjG z{*+3Du&nLc_}kx9-gql`1K8Y(UB2_6lP_wGFXQm<*5i|kOuU2#a&+sZh7H)v(MU>; z!W6QRl4hJ>&S%|St!cGi=&a|?2DEVF;-Ud72SoV6-IqkIYXdNod!Br_>$wzN3GnOe zf`Y}P)t8i=eFcDYgoYXJ%FGg%exsXii>JUs`vlIMk9XU$0R@+IIg^2GLSB!}i$hn~ z67MPhrj=3eI|)5U=ca=%&!fjZc{)#mnAO&Bf$yRFCs+7Az~Tf{Rblkv;?K6(uo4s& z8V2wrAn;N&3UoKT+n2+2?*v)@_*H25;KEvatb>u%hH!T*0BSN3I||^$D|_FyUY(Yz z*G+OyamZ6EEEoLVZ>s|qtK910dt@-G*u%m_4?mxN>|9Spg-@+0T8BQbwKc7yWg?gQ zXkTpB=|`hF1q&|N@OO8ojrywN-(@>Inu(t@A7jJ|It}(j!|ii#?VLURZpPISz$ONU z$}y%dwe8oMpPSme>M10U&&2))1{@|K2r|+;FBKh?kZnV4LG5cO__TWl8&=Owu7j_{ zNU}1XI0s3Nc8PJL6E)E)TCL%n*BzEkD#b_^jd6ZPfuj)glER6I(8NH(?lU|$jfZ>Nm#1>7*sArBBmscISSkz#5D4d4^;(j``P-bD$eL+MK zyu)WLYu`Xz0_++eTUZ(fvA5l5ykoh=l^DgmqV2M>@+zm=h|UfiDvBDb1_h#V;E-@( zJi;naQ&V0Nfuq}wS-ST$;U9Gcc%Q2SOn&}#q`0-1Rb<2(25vrMQD zY3A*_R&HzjF5C0rN_qXRu^Zgq`eB)Zv8DRi1p>d;EC}JE2LGKM8%3U39(~L58XZN?7e@7ucH!&V+ z4Qms@K1`sV;GZJW1#!Bu)iOBe^1PWermwYip7#WT*PnY}8TqLvUEI7Ecy&48VNS0@1&t~jhzf=SEnXk@7y2A;pA&{e~Th{%Q zW)&R;rUlKJ+erdBb7Rr>KZV9Wf5fdVD9Ej7R27@2LkwJdpP0-2j7BZR%sVKe-E0zpjN8Ikm{ zh`6D_K$cuD9#L5-?l_<0XB4$rzkAoAq8H)qV{C^N?T91zR=pmRp#E%QxNxXK=o>|) zN0x_ur{i~2*8+)+CjUSrk42#$hNfFP#8DOPTV}-i!zF?7JNaurxd6TksM2OQoZY*> zgFLyk^%c94afMcTnO(^}0I9z~KDNznb_ucV<>nTbP~0fw`;UT|B`R6+cXPFxP^}{v z(%htafuaU9`O^jM*iTy~9E|R6@6>vA#e+qVhGzC1j+GFX=PHq(WL$!oRaNvtf1+(w zkh2ktHRu|IZwqp$L~r!n8i{`?+ho@dHxXB}Ww@@Qk`rk|M>3dfcc>-0J0v@Zsisl$ zBVsY~35v6)I~IxzDyeSo1N7s>ESbV?s~h#@p#V%SaB{n{urPDQo>)m%MmO$QB!fO7 z+Gs1Bq~xv_(H-*l#ALwuE@~&Dt$eL^dz1V)yiq#JVj;2w2lx$&yAAuwMp5j2`+9g+tVN}a<-FqM9lzQKk#5MR){=7$+$u<+C;fAeE}j0)d0kAtYzqmJ z@=>sD`#We5BS7<0OKIR=X2Ab;)*U7-L3>KQ^Sv^QwD-xBCff#>z zSW8nHk7X`btcHG@^xvwAq+aMOLm}-uh^Z0xb3g1G ziT;f>XvM_Gx|1>Lku?A3*nEmVL)OgVFxFmVue`DZn)_9t2ih= z$No2FL5A*MX3X?(p=jvk3g`X{Urh?*Rz8q=j`ux9Xg9-fK*!lN} z?{9N|Q6)BLG*f${$tzPcOo;Q2VNcy42h0BO32GG}}DE+)=+o~u7`}aZ? z+gMC}Fak3WH>+Mwhswje=+=F6J0JwTIzl$=GsWz(Ld*H_6C2$(FRa8^$s67{1cb!? z!SsCfC9hOPw*^Bs#j5lfv(-|O!amQ(j+#A~Z@d>&J~b4^9=bl5I0PALV?FFRIMDFB%KS#tb4IjY-Me z?x=5aAJi~VQ_h^Mc8r&xxcm6@>n2jrKZ5H$vPrJu4^g|F1vta#mwDz(!Tln-$M1Kq zV@z47H{@b#ZBxg1I*XS5$;;`*@l#Nbq^Or*4jw!K!U8~CVe|wqZq$junfe*8ONkf~w3PciBr#w%A52@B1s{Jkw+|+ebH$j#Pot zSv+0?Ec_76$tbRoNRDyO1rYZ3YZ<$q^hj;VgRMoGo9!5F*>S;WRN945wZKkOD%J5A z{)ReUfWT&|7R;lc7KnYiRBB!=X9AKyHt zoT*fCww!8_DxcX`;eWSM4aaw^>#ctr;KA)xTy6 z=TI3NXpflTS>>fP6Ca4hg`JzmRkRm^#aKO#Wl{B#48M}aTEll0E}o?;I4SL&22-Tg zed-cG7iOf*eqFAf0_q{dX!6xZq@S9Fu*265I#nzl_%vHdcP%i0)-anN%$R>4F7ES} zoQ&K8Y;30(EA6`PU1X-3K?mlN#vO!hPI0vxZl` zhpAWq!euSp{5bnnONY)}gII4YDNCsAdDxGAg@*s|xo>9WJ(KvsK6dD@BHuHo6N*DQ zj?@m{R2#{ws03M*zbW+bO5)V*hIz?1<)!RjhGXU_s_fE>8%O3C*{bEZ8Z4O;nD+@!ccenO$}kK_~*tlUdIe#USqEY7x^n8FfeElg za_eoq@~vCS6x^EKrQ))%v71i!{e)NZiOot&Dd4?7QN+GGOI>yqcLWLaE?PQn9#m>orosE_Ial83G*4+Gt}-iYU*QXroM? zoroJ4ZE2k-yh&(7yc70eV8RWaV%^2eF;@Ttg;_j4GG(n2ShSD}!bGU7_KuW$z`6~M zejrm}nYDssQ(Y`911SJQLPS7vSJCr9xza|S`gpPDmKq>Qtkm; z*2|Hg;andHcD(d$zcaDlVo5?s@)E?z&yzD*a~@m7E&sL-$?azd3B%{*-n~}#vZq}d zfcsG3#KqlW$QNrV*P7g}d}`>D#{X4&cXh}L9Op}p`ACQMpdra(O;?(n<@O?^ke)T- zn@r{N#r&Rnx7ic^UaEH=I#{3z`3I*z3OPpY|4_(J|0v|3KMFbhH}v6v?>^;uv&CZ5 z+rp*RJX92ljAO&nT`7;)0ey>vR|j4_LUul%0qL5iMh_=<928Jmu!2ZvC~(i!$;yD8 zrG7aOt88wRV@ui$d0lEM&) zTw#I>^rc-DMTEb^jOl>HnYoyYRyOr7=55~g6w{#L&4oHxXyH9ef0HB_3O$pERL1VE z$f>%vL{{7Gsd9@FAupVv+Tki$C`Y?-W}6;^Pj}m)GGC!`iaee*6jmLEO<-?6pMEWM zZlcP5<(l}K$YD<>lI<|5!dDPSkqzAU~4%RQ?GV;Ze=c{CbfV_-#rZd@qoRD7a}5gVp-1pe|6O~be*H<(LiSk0 zv+)F5&w;n?0FUO=R%_!_p5t$DY+j z5!a_ah1}r>3bvW+Wgpdpx2_|{m9Ljvxou2l`UkJ1%RSo*(E*sw(^0cb$Jw; zeNCMg9+_Td@k5&lFRSMVqb1qik59OoMW^@6!$V0k{N*#YI^PbYuVhl5F|u!9&Rnt% zi(lJuwoPw-ElX~T^z!n#5`USQ?K-b(dph#+gTMD9yZY-DYTtbSAu{wriXNS!1v_T@ zMrDCG_IJ0~PLFf`o-=JGN(RIwrfrRN*-YU~>#}1mu-8&>GmRxTa`khIiOSpmSQxyu z$zmWcy}qf674E)^tll(ZUWV3$`-UpVRB|Ej;#pC zSSJgjRw3_bC?<@`ahqcHM?6_<0BhwP92FKZ`Cmp^|PboOD^`lROM=TT}Qd(Pc0(e=|=yS#3sP>U>x_HfNk2b zXIP=Aa*&%-mD4#L5vBik@Oi2>5&AKJAg4UnUYqaX&*T_yx zlMB0SH1N$zQKe%Or}5HAm~t8~gB5_d$?t~G`Cs~RQ;RZT9w@n^zd@^9u4Dfy@98vfW{E{)4p8Cf|yC zg7Ir)+~8(ndK($~3BHL5hP=TTz|0^H%Ou(2M(=AQy3C+CRZQWdlotLRSbcO*gt9)4 zHJy$M4SYl+rl@{gnMzQm+Q z{a7jEal$Tyq|KHF6yXlL{u;TaNyl)BMv*O5ufonN@NLaf@2gS1dyXUeS(-e7I)8Me z_%FKHH4v{hsGb4+MvY3Fe2SNB*a3mS3EAw2J2t>LV9AUeFPp%4)aeh^|H`Ux=aklN z4MIGt?S)h5W=hqm8-cL*DX6@bW{N5>f4F(Z?YJxxvK45I zpLg^Ip(N0V>}BfXYy$Ro4XxHoz%DyuH~!%)EeAdVz00kQDwo2-xr#&ZOc2$<&kHqT zM`o`$mwHScty6|9L8Z{Z7MIz}HZ4#iMBiI<4_Co=ZX!Oyw<8gB2wdwi3)0gC1tH|g zmBwV-#KSTq+wxC_;JKFLf54#eT0tt9X}A@kO62z|xAODyZF{)BJTwA=-#yIv&lq|<6(kB8Z+pId{LKr zY5lW?S1*ksmEh7>GQ*AZ0N*6DcEQLoeHyPwi^`~piTYT2Wq>4cA#oY7Ty?;sA*ybmDC4*lSyIW+!8|z-k_B+0MONORfHNaQ$ z&>kejv=Yt_h#rfU%{o~ychRWLJAxZNso>k6p=YJJBVI!H!uQ)k82ce8Athpi&2-=g zp-}5Vp#p_{@u0NwYwAd|060*qvvlUmuqB zF|l(s>#K3U$$iK)P1Il}-ZX}4Wb2xN(8;VFvG%;4`^V4nt=G1R&wEr*#U6>+D8Eh* z*e@2-01@fJIFYqToeeU-OE_6&4#36CUbE~-{#c-m)NniC&MU%iC$WzHxt@?FxCgNy z3*tJ>*CT;(D*)?b;`oEWwms|Jj)QeH>QPd8Ugt@KzYlmBUnA50(YRgZ1DEcN&b9HH zUXh)(eWP!GZ1`l2VIi6C_*i4*R^9b@VSVp1*9p zsjvMND0nZ~bvhELg@VMV7ASJv1KMuT$v{<(hCK(=^^e+*Z*h;M7IqjkVi_v@Bi@8x z>EFZd9*c5yWD;Q|)w7|d-#Iev;u8Y)bbwtxKd-T`Jx{$>jB=uo3%&>orKP38h=#!Z zO&2L*IOO_06`@OBtW;clb7Ur9krKnxN@$f(B4L^IeqFT?|iE6I%i_h%)fCnUHYgmnZ!7&3Hy^>hc3(uGfZ3r#_rm5-FVrsl;8BH^xsi9{8*}@>T-axX%!%%`$z-O!rs5V(M zB%koKdlw-POk1!c%b#K1ja+m7aKxg0DrB&hlar*jV%Gt;wf%Ga3_fQou4s1eNNK5N zQF(`=i2gJEOs}fZ=nawTZm6AU#D^g0rnwtR6QdIbZ)k%`r;QyxZ~!KGjolbTT~*dn z**W0rf#JoI628Tt=D{y^JTwNlkv&OIq?_v%q`&h6xW9LAwRm`z%aQB?;|xJNXx1Jl zAh7XtiI$3UC8GVk_HPp5GOx)QmC?1(1_T|Y{KPN=BG`*#PNFH2A41!YQi?M$gtION z7h2AFL;jC*9)EcEn-Uz^W#%AyF8r$BzZ~jBr;GzMZfy%Vf1~yhA3*$cF!lS3I%XV5 zu+Jc$|hKYrk&!j0{;ayO{}UNH&c{j z?s6QtTg4-@A1~TL-+Yrr30IJSr>f6o17qvxwj^LJPRK25GTV)?Y5Amg?r0mN((Tyj zMoaj-ZpwYjrcDF`t((4AK5k;6iA1+0X>2Jhkm<3-Oh-8C5O}eNiub(@%xZ?8E-0kWF;j(hXlSuax;rt_<47+<0bdkp+XbWMA@|HW+t#}yI6{sD7ow2H6(1KeXP z`W=g7g|`h3Nm*<#bFo3{c=qX@>k;wcKw_6`Gtp3R+ssK2w-Bk961h1>UaO4b@Zy_? z7{f8cTLub2rB5_H8-fv=PS@)SSBP{SV7>CHjakUI!c3JG)#!JES{vN$R_bPLk%9FK z?066-JfFY?C}E4(*|s1Lb}PGW_eb!Ax%c}>pqeXab>$=N&1YG!u#bf zWC#x$w98|UX`mrFbTE-iXH}`zg6wy7YRDvJlK{n-=cv{l3QOpoQmWh5nU^-oP<@j7 z&Tm9WinImU!E$NucY_|PO(z0uLdeD?zQr>q850!P^s`_c&PEHyo!kAK9Xn6=YY)K| zp){#Ku5+g_q;IhsGZYjZYt*~4z=)Q$v|csl>@v6R6?CD0A70UMT5Ep)J3p>z~FhpF>V+kdh7RAoCdR=5++*E>=C> zJCqi|-i9c?I!z=WvXgcS#KO*g-mEWjUVHBT7JHD-eyliOx#*zA`_U$y599@AU7A`{ z4CW|Co_Xp;o4_H6cM+4JJj($OGG3IR(?7=z=@v(6)!S_ysG>l{2hybsl}KE5TS&OS z@&D4-3DrtU;9ytzXBbmgcjLAd#9sPTv7o+LsM_(~bq1x6wJ!&&aI86Bb`Z)I`zc>w z4{QvQ<6*ds#s6~#LA4dF8GbxVD0uV75*`g-Nw~1EAbK@rgXGoW+vhw-4G-pUkZB(*-9oChL?7|X8S zpR_y8ld&Lj&~n+MIW4qM;CqzrxV8}NNCf7LwC9Y#&xJuz;Ldw0 zw@0B4r&A7Vo8{kG?z@g#a8%05{$jhI-E#AYNNaTC6 zfMCf6ozuGaQlA~FjPS>a%KcT^0`*80HaSU};^~2}N@ioE_X*vd`eajz<{?=aaNoJ| zVgV}Dnp7l=%1yJ4l+;csm;i#bv=X+|$1as(tN9ub-IX?CXo6EHxo~BkU}D`$JKMyE zhDQD>k%QL37toS!;=p0Algmb2M&xuo(sYZ_jF*LY+zTg1ZqrP?Qxvuu`!Ib35Y%kx zgLT~46xz~fzKV!t14vfaD-bQr1f`N-%y%jgs}_vDjH5`thEE=_5_^XsD37b8&q{r(6owB@l~BN#Q&p;*ru#yp{P7$^(VwxKx)nl~q%>2k#F zGSLwZR`9EZ$`wa#`xV)g|lxm zJ0INm3J_+{wsfzbvJRD*v^s8sAqBFix?dkscL-HRutjADC0%cpGPqS}OR@Y4WJ(w% zAFiCUL+<7goq&W0q2|^k6{FJT8Up*yp0i~aZ75}4K^L`@xpt1 zdz)7MzBvw^9+_Mi_8NE*$^vAXo0*C(v*{P4E_Z%K4~*IN?@B9|2{-M-sbDKe=BH|^ zK+wGOc|4?qp>M6K1zMc+2viBN4OnB?XGZzEEp2!O1W45gv>j~E*gquQ0`ZDB2RI|n z^_!g6XIF@@ZRFbU&?#_6)#0lc3;kP^6m8|ircrW$56*b)KsKNJS!92ElJ$?OFkn|MZ1%eX8E#%a-gazOPd+T zvzrWU4BEX6`8`J_o4N0F$~kzOvDe6DEplX%igw~dLBxpxR(p!!>Jrmt$Cb@e3i3x| zWoc}j;b{g4iv5b|>ak_G0l!MiV(8+mQSMQ>0YI1+Ak5LOM`@5MevL*m6gpf66dFvZ zn%K#HoB0TkIdNj&G6z{1s2AaC$WGZWn2`}5HxCrZ{G8?8WE5O;`vvb(eKDo4KAS;B#g=l!pBbWD^O$$9W-K~lGI^M#R z=z&Xze(_j~adDG(rD`lCi36-pprwkvXj=Kh?G8v1cYuOkHJ`CZT$nzZ$fo7ByH~4N zev=u?tWVYjeIVszB`g>7h}J^t=Ye;-QrAiDv&M!|XHsJ&7`nIb=l{%|RTMGI<6Nta zM;)5ixV?>ATm~Pio~ND*?;9$}^!F5Jlrj3*!>1grmU=`NF;pF&q#9@=sL{N4lL^cq znTD@m0U%VVb--nG45-(jHt{-M?OajfW3*xEd!8O@9-Rwz3!FL-ts8-!EreL`rN5CO z>cs-Xi%u&=vVc|=_>tylI*C%)@aK$DlQ01$1C29BgQ^JPDV_YOQDA&TA-4e9KEDwE z_*`O`d6-F-&f!7Lh0H(S@bZtDjVrY_;W7#Fh~;41RV z%09v6r+`N-ShO6AgO;Aq=Ll69TI_ zVn)ZPIDz_I#}0`6gRe+d?!K+ueqBz#d$iRFvHOf+a;gVd2*uD z2t!wwC8KZZ_^Sd!HJH^OPqwpi%Ys@qx}1;WFB`xTNIJ*dpP3L76`nMh5+#C9Hn5mp zy2GyunK#?jl+)RTK`bqGREX2IPldymRHMpQ$wOjtX)M5i?tGI7$7MpNSC|PdDrjLf zH>*{mjoilyznho8P-G+(aF12tQ`djM%1SRw8=)U9Ko&2FokUah@)$(WCLQ3BO|;Kt zWFM4r#Vv8_XuIgdUM@*-* z0N4%W%9E-R>ohmDQL8lf8So?>BdR{e-$jJx)edK?iGDCA*T*7kjov$-U$xn&~50K+u+5xNU24;x;ewILEiDM)HbLk;qf zS5`!})Y{_!x4?wMQZIG#_hw$ODyFQ5X#JWA7P4}bQ+l3PzV)XGoYyf{%HF;;UoRlT z0CH}@iiix`S~tY-oz!TcD=1&hs}#1t&Aum)sFPW$?2f4DUrmqBJeFDVvXh;sYgEC- zrOa2$uniDa9BpFfgby`HMmy&=PeaCKu(IG*n5f71Er|9-&eLOwFpdA(Lj|GGRSV$Cet+f6!*;#Nf%`GR*pSwF{(uzxdaA zrO|mAF+Rb^WrFP=p~)4cYM>wJ8?_%X8#RWSkzEFChCfb{2uLL$7SIYT|IWJLEDp=_!%0vl`qv9%qa?1X~p5 zsvvJv3C6+YC4tE4Ft7Bt&tJw69yUm+r8V+(tW}<6KBP589YL2>m<8jF1ASQ!v<4BY zkp?P2_CQ$3GKC6zW;67TEd2#alcM~0 z2*Jkn#(s!44=CMtweB`Rh#Tx*n^)HPb>F^bnU3B{jXC@Z`#kfJ#G1p08+9ztx@hL6 zRG5G@?Yl-1kNRCzY7z~(C!8_7F)B;p5tk6HB(n7P4tiwlU0G?m26N^`1x~eFqWr!{j0D*IE zHoCv%_?c4yZDJ3%lJz|^>v^ut~e+nz6 zy3AZP-rZW8bnHXy~1SF_Gr}VthZ(L z7kgQ^iSm1(@gkIE%YE|?f;)CSy9jvUno1`FGg_kN))8gmg9wGAWWgNblP+}J7hDqa zmSX#L{%0&ta9ZT#M8nFc0Pkd$n0HH60xrYKojXE}=AuuC3$xLJ_eV%w_pH9#xR)4k zvt@GNwCu(d1Kfq>5Wf^Rv9$?3l<(Uc^F$BL3nqn3p3VuV+{C_kg?DUWh0Mf6eT zy^*+@vgT$T2$O+ql>?k!((A}HtR;rT#UHM>9g|4uZFyUHLHYA5oV{#DgHxUL%H6vP zcot3Y?~6m`NT^~$&9DW06V|@{73V%X5T(SJYV=-1wOqJmF&VRw%KBcrnXYNy{$#Pa_dprE-$?2K5r zaD{*QrijVF2l|+Tc!j6th^+N*LA2BI1*x@BC2gGKSnHmXae40?Gk!vmQ)}J#GQY3n zzpu-TbmT)uM01TtootU^x6X0k-p$tRnl>zlln(lbp^=~_RbtfiBMqvwk@ zPgoSxf$32Jv%IQU3^wvA_Ias3xa5=imGgZAbW58(2m5=8Tafkk?viE!F%G;si@9GV zf0rA@od|XDzqhK>T^eR`wPbU)oyf7@`2hH*ST=qI*mc1;h~)SvNN!`)hFyCcZUjt4V$ z6yICmVVdMRhmku%rz%R8r@Az%i$Pr;hh%>l$_iuN++q(L%q%qWj@;AO_Pn607;tCn zOQ-MXEa$Q;pUhek9F8|H>`JkWdbdvH?4Xm94_!~=k-r385BBcwhg^FN3^r}xWC46c zbLDj~!kj5IlvFT-O)|Z3R+;VPisefo+3x^XoZU>ab{kR2MY1|F9pA(QXho40`m2)YPc0SdEo{IrYM*!pPNS zM=(UU`*kOhE0j`IpdR?Ar`Q(KC>ZJ)5+W%QB0XW<%6y>9vgDW&yoqM1QIN>A@>3`a zot>tZ1w>Y#`l?38VT)8+mlV^{R-4&K643NvZn5^&u=6RCWLyZvq)!-~mp(MARE$yt zR9+>~Czk9ejtOQNvE>UrY8=9Gla|rp54qLLNTKFa4s<>uyQSz88hDRO@y8F8lF|TUg5fw4;=@94mFpu>!AD8o@I$o4)q zq~J?g7N{rLVl^W`6@=3nPK@t=th8Ngm*qV-_gw;G3l~dA(%KP1I{XJV#wb7f2sCbd;32-#M3 zs?I+z0uPAljX>KfJ6U=**oF(c>6ga4see~<2-vi+wJ7zB6-`Y(hGHC7O(HA%vE4A6tr&I#@wsW#5H><=GY0yE|S^?v7lEdSghKP z(8x2>SL|@sq)Mgt)k_WHlqr?CS=i@<4nXNovnxs0xK*Xx$vu^lb(!S!>usA^Q`eu~G>eN^L&l^d2(qDj_8kc$r?koaPfr)`m)bW)t)B+=4ULz90LluGG%pZbhZ4cb+;E=z)osSwb#brwZ5LA`!OPCwwwJf13xzNwMB z1Ky1VBCr*I+*ZL;m^q_>%+JaSn{|T95znyZmKV(m&lu+M7Okt+PuiJf*Nq?-P~;%o zcI=qV?b5=|fCo#96)Moi0TRuUlC=9PxWDMM_#95^LQdV{?T) zB$jHv7G;**7z$A32Mc07xT{{5nE^I;;I7HTog{@z*plHpw=zceY28bT%{)>G{IFvp z1jd=50|-Xj8}Ir1XO2tHJ$v|k#vkl+XC@P>2!%wNe`;8PVQTQQ%=f=@0;WJkjwytW zzfY69nEz;xE}nL5+z}z3iO3xOIC3xNBMj`pc!o`1k``^KDmbESdVK`;6GDMkD<^8Q&oY)8Jo_nrgUU5o|D65{(`zA;G&o!4s=K=?OAX%As}^MWlsZ)8%Vq zxd+$of~Mj;IA)L-tvNK;WW+g$qm%EY9Ij}vS<2XUDDMOX+9YCy8id&J9en-J)x_Mf z4uGT~Ou^~Pm4#{PJj~Jo7ssnKn-={$*SDFnK6ju3-_#xX)kG9XL{N~e71e^BEF z(o?VLXi#}8QftZJg%~Nr^Kgz8xT|TDPt%m+FLb4pGN9@c_~xVc-cI(!<{P}UHTC4P4SIcf1hi@jb0A{FXRO?&Se8GY~pp*0oAYrTAYlfsz6~YONKJTc}(Z=R>2F1enp?W1v zB9&AU$wf-3GlCSl7?Gs4#Dt61Wcj-7or6&At9tRiG)kb?J|M_dE=+PKG?|C?KDSBW z36jm~vxYLuqIiwT91wsB?T`=ERV3&KZ(4HI0=5wU)VuPb=q->oUFZcF4Op$N+eK^py6%EPIVfn^kv$i%G8_5#Lh%RQz_GrUDMpEZVpCyBDSPx_uG`3LY+S+%Zz z7pll-=gcpZf;^Z-v)k=d=G_w9Lj{9txwGmXH>n+ANDr|sxTO2-;vx0y_c@*`KoKuI zbDi|_Di`(4;}d?rE=Yk3(Z1KCAloS;M{WwHT%*~i6yI2DD28BOu0%ygK7;5h;@?e8 z1;|U?DrAzGRC`xRGZAo)>IGT1OC-s6AHh`PN`Od!@ck-Kq0CmO&99SL$Z}U1-L^bv z$ow=B&pEEnXT#w>(eN?xQbdxgbou<`&i^UEz$~)E$H5O4#)0+vqEY1{)rHMXc9tSF zU>sxsory+K(sGck*M^i29Z=0Y-&efkMsdAZnX@Fcx_bCKZDfW>+$MnHo;5CEgDG={ zk9U@zPvumjX>myhL0i7OeLK721-^l_OpT8KRqzKEIlo7T?i_TCk-HW^P_1whVDPcH zaF(0^%BSwavbQh0tM{pRwp5CBkspuFEg1<}(Q z*DBIHXm5!~D=Ur_1HrgoNDdQ;RJota=q>48hE$*IaGRKC0g0DldXDdBlL78_YcJ&- zN@m5NtbI!9gsSiE)6m?nX`^qrWzV$UWID+wb1NR=ay|+LTeId*H*VY**q_G%KZ%Y% z=zxdK=@$}_C(b9VkV`eXv<{89!PQZ`w~Vp7zom{CzSuuOV-yuD*^d4!Z~*0xkLqTQ zeka%$6piDR_CUjvT1M$e&>2%o^5RZ>;~_7Bt{T*I4S^xgY>T!--;dc?8Eg48Eig0r z#pyI!hxk6q&{o(x3m!t1xI3-jHE$K!CC^zZPe8A}@KsG%{CZS(0Sgn5DwxWV8~}#S z$rM88AYdFU;Eg~^m!r4JPDy95zJClsi;L7KPo7fEDK%ySv6Mu-UmK>>Z&w+#TH|`( zc@edhXT{OSJ2)T(BMe*i2|P^AVxk^2V$~X1FE7n`{+3I@2y>U();P)1<8g9F&0xY* zDbr+ahJgXEcrymsJ%##%emdy9Y)s`INAN9+PvU^xd(HnkRS)Ep{+8_}i*4-bnZ3soZ z)@;5mV^Wu8kPPxgFHN(zqIt*&Q=)5779Jmizbg#GNznrG!KAYdFC7TQd3;x}xl6&F z{Q;y=8%wz|+s8*k1*J}+ENaowz@(Je@!Jl|=p7j79nDKifiKKs6_o?8(t!h|k>3S% ze+(W^7bW&Be1E@le`qwk+VTpRO0*0BglTT)3Bezkwds_Vj?u9w0gf|$iJ5`fpg`Fb zI(p##L$Z=u7)zgROxIK{5QBP}162~4W?IC3^K~ZJ`Ks$PTwf)mXI`n0T@Ay6I=XM{imenT#O^3>c@mSqvc+!Cm&(1UTA8^ee_F7= znDF0;Nqr-#e$$2;PE|=W3(139IhwpWk@Lh`r!rbEo{rs-6QOJ@I7!4%=Wru7w`n{) zf)@>K03V`+xW-ukrCEdLuYJ%&*t}WPpuU*9%V{&d^x-91V;Uu6s3f36KMIwULOizA zazI@P4m_{YCi77lPjF-nyjo#H6qnkv4B%*>!kMWT(=VOoEet5@!%ZkwTplZHwu$|+ z_pQ%Q&nF7kpN|v6lZ|v!RpI}}Q^X@q#Gqk(;iv123`kL z;_+!hSxGRq@wFbmrKdVO(kkIp)e;$6`H*5bb6xY(AqR|vP$2R@0?kO$37m66jCNO| zR-yN@5!>v;;sWf|S`rjx$1hAMCLW}<`w_L3AA{(AYz7~C;koq2k(;D17q(JXE3jw| z-7zY%#J!?V=Irl^<5x(t7+J9>i%gLGJrLl9=OE*p6+peYhDF zrxe+F_%QtX-J%u5Z^VrJT8uSLo&T<=tbWwlPE3kL&f5!W3M5bi}Ls4-+r~WES=#`4B4R>0*R(aWX0i8VZONcU&?aV?TZ6H%FKuchfzKr}$`} zQMYQrfZ!BZzu@W-Qzh0JgR8*+FI13RfCfsw=*8h!2w7T(pH@;2mG=-@skA}a_ChJ_ z??xRR=@ju28KLk$}9_YWs#=!}w%@&2HDkvip}z z=cn5znYt@^aQ0~8Lr7j|Zrd6jg0#jphhM~|A9b`Osu`1guDIk5nKc)++$w_Jd zW|ZYFyFEh$%RVwE##^F|NobVpGlD})lg9`4DbKH+e3@O=srg$I|Nl6YeLwi}^#aRw*Z2 z(ju6v`DQ*?AM2z@=}1e1p4`(}0hJ6SiH%g9b`Xx9Q1?CL23#qKALHesC{Lc+N{J`? z_E-Y2)3C>5oKUPOe!~o%h(Oe)!59FbGY;EVxkp?6hCaqrH!LmB;FGQ1rvuX9ScUFu zCf|(HU15#U%$oAOI5YQ4W|)@Sn3kvh$lF&yF~se_o0dA_WctE_C8e=phBoUNLgJ|4 zP_>P!gc%05uq*)KV`tLr{fee|T^Z?B{7|bY{D_om<%n}Ur#?P}Dc4LuAIbRsr(F3d zI(lp5?L1gJKY1;u3zn-5q$#Reo`Qpzo=hMcyi};AVV;5On-1BFY`$$lfo)OH-J$BHjL@!yF)m$nYtm2~TBMg(QX(ePVjna^A4*n&Uk+=<5}T%~RLHZ=i32iYhL3Yd z;-?|}E(}26sCOb;AOlrCX8NOQ6{PoK=*#ZWO@ z7yyv2rlO}v4h`Xuo@*88=4bRwgT(TCH-qqucv%;+UM>H?3LnhFqD9NB7xwH%j5b9o zCx#7%tLama27exP!>3D)Q!=J!xf|?!)s*677fvWapo>idW_{oP$cj=-+r&wv5I0|z zEJcD_?TL0wgQmkkJm0sLKQN1`qYEcM^wNokP_Bpq09=PuAxO^hiPB(v(PzUKT^HNE zdSNQ7mCZJ`IWR=UDJ?t7R3Xh2vu#1BT3V4vRvj{PHybJ1TynM zSLu`CW=>K`h_XOmuE#Y-Vf)X-XG0cb)Nm>{t>Do)v>q=psvB=B=kLM?nossmN+p?V zv?PM7QFKFjVTYh@1B@nJkql`z&DW<`G?>&2vSk~5n`!h*sQo`$Hv8q6S`JF`E5mp2 zG>s(JjoGI&Kqq))d{m@Egn9$U60wwg1IVTNhMbLr;NYMsP>WOw-F;UjJ@sC3bN z6fzuxGb+{674$`BV|5GZZk{y8&Y)s;YpmsBp+D z*ZmvnHdA;7Xu*sb!s5|rU|n)XLQ+PvtfvD42;o$3ZT;% zqpeD1>93$=wZnSS9CyOgspe&QoapSV{O*okt)%i(q+eum`12X;0(@!J%9vWLvK2sY zwni*!#cFt^6oVR>0{E|HWz#plkTvo0ot5^va zyFhe6#2Jn$C5v0ng--2!L3anGHCzp+XwQ-*bsFvYG9f)&1Y%)`&FBx+1s_L!x`ZL3 z8Y{c&w%VRuQT%C0r6}3S5{;i<3{qCw1*DQ~I|97FBd=VluLX0TJYE^s>|<$+ZI|HO zDqmu#L{}d}BYrkiQ2ToAMT{Rx*Y?Ilm!hDar>|ov4be)``Pwg=lr^Vm({na}OJcj- z{+(A2xpGgVB7@pxf868?0syV7B!!wsQIuM{lp~Z)!2J{npX0HHfvzKT+kG@q8s9RB zj8R`?ey1Q$*Y6dUN?V$iC5exhU+8FO+SFQsfAur}9FcPof^x1)qh{JSl}9iDT`W(T zs#`eDA~F~&2rHU-MJYfA>AkX({aZUeg35}74r_e^6r_6 z?cJxHR92$RGQu{sALXeSOvPJu#P%N_+2#%u>%7KknaC6Fd9N>|?o&h6rbEI3*x&dC zI4{-*3_ehQ{VvG?PmYBzo0Lb7eUfo2GEsaqaFWK&6=<9-CI{=8r|Ia#iMGB|M64$6 zG|yMkT%#ZW)!b;F9|u;5{Di6f#L2jj1RbpmdqUr+$%7_jPl@Sv;vT{~+b~aL4Y(*F zsrr_YZV_W>+V@@)0peQ~`P3F1x~_ zvVLmpd$@71xt58wS&=eH2q%-nXL+jFo3i5elVxm0KmLio>Pceggr3Z>Gua=Y%UkJb zwqj@}V%W8WS!fBGo}uj%<`BHh?-4EBK3{Ct&n8JqvN)-_yjWh1^;mL>=u#mkjB4BU z5E9L5kv9I^g!GCR$zSu^)rB}jf2K|Ok?8&HdPg(Wrw@pwS3|oH7~}EzM-p`CUDEB< z`2szTb_G5aer*%YH@k>l;%G3^iSDQ4?#@$bEfVdp_8;BzE?4(W6y3kqMOm|h$UVMV zr+xxbl8~IC$gZ3fR!3vZ-}x!@CZV7Sos%SXaWLNK*e~yWZeYp%BD#&t4I z9Dm1ZHW_w zu{YdlwZQnG3Qjc3Z)6AuD}VNg~0>M*xT9J^(c?7D)@e6PjMx-K^x#lf0}Zmz1^!Mi>A+(k^VOHRC-)R!s*q~~LLNZT&*PuTlxV^7} zaZ&%oaFisyHm*L8Ii{Q`SozqEYx`@fXc2n<9yXeZw@ z2O8D0hw$qDSLU^XLeA$LSA!N`XM?(}qs#oEsF<;6CmTP){4$R^%Kh?5jnv^MN%t{F zrTN+SsHEUk6EkoQ+7o|_Ym4TBJhl(<{g*(F>~=j=DP~syW(7K0 z?C6e9QV)Q2;lsbnYi;#9$6ZUaD=S6vFY5zL4fVtJlsX@sv%)sJqnw=wk4*1~(40;F z1HlPvwzoY*d25^Iunp_*L)P4&_4q#>{RbW@Ea@Ab?eQjG(G8xR|Dj8Y!0@x?aAW`x ztIfs{{hvqx!j6FIRvIlAVl95)5erIN$&4?z64ui>yZtW(Qbf@iiiC7f*3$Rdf05)e zNapsk>QX!INI{J*`oHJQ!C>7`DU=QUY0wCe1 z+Y3xmL^|b1Q#{(ecd#!UZ%^U>L3Jj03Sqhq6i0%=uc!W8aMV@ryw1|21G;a3IJtX} zjexB?Q&1^e(S!Bc646;}R=fO)&vc|MEeE?mPrbcj$@*f2pUC8^9FWY32vFdY$v6O2 z%OIebV%xOvRC|EMF%w~D3ZXys`tnonmv>6ZCBW+NRdzKsH8E6?^m*@`O4xU3lvNvy zin=`{o127JQ`@yI|3ibohh9@%-3pj5s799P=Qo4ZiR|hw;Uhi>V#_ozVR1kHOZf>CET2{~7~&ksA%Z_h{KH6j0ySq>e#w!G89@xz*8Uh4Mu!i}!!REieYpi4-G9-(6?EP-LgBp#%o<5|sOwYdxM*9S&fx!_2;$(8k0%k{5rP(^MD5S49o_>3fu~Edww1a-weem7#rv^)GtYoP9-p6x(Rx zb{szIHbkVreVCYA^p=T|?KN8b+5GADMAyh29)}i{+XMQaxx55DnY<00G#(-Uw4o~S zv$WN5DCqCSpZA_|=rux>=Hfgz1iv^oGN)G*1__tzR0Zs($lJ^mpdWbuF#hwUArO6m z4dZv@hXCjt%6B-kK3X?>f0vV5p|Zi^7d0g~kX*vzrm>8F%K1_^_h@4Me4-u<^Nr<# z1WMUJ5thq+SBAMyB^q;J6GTnPh8X|$av3Zid_ebaVbR^cx=?kzm6cID8mp>K-pim{Fz6GnaBz{AaPDt?%L}VO41n&H#u6?u1BSZJbkoP?^UsO#) zFG(qC4Q!Tx>n7#v6(W8ULP)H-&_Oz8@WY_^+vCi)+p-VL7s7iXuow?hu0gP{$X0Lf zbA#!kYbTP>cc$=E1?wdz6{};Io*7h-zqa+wJg* z7ZAR!#R-*Tn~AQG&#JW^T3G5klafsQFTQx(Jhv{Wh4&|v(WECNB>cOq$>HzZue*x> z>e$oj<1AM%3>rXY)bh9jOlI>OjnXE;8B)G;JlCl?cAjL|XWbbQBP#Uu7?Ly|?H20X zwu5!*;=1u<*?J0n)gHM+G;Sv$Atl}PSp4+qQxds|4*W8#nfhS#2~9XoV?}>M#-BEM zs2be{@a0)OJR~4Buj8+G$`UKFa9d29Jx@>6H|z3$r32^j?mj+0iWfmI?ZNA7u=QgTeHh4+pVu#8)oIzC?7xJ37>(Ya zKDDDPa=0a!@!?k*%zm&DraE@w$ege`?q-tHiyIHjsr$zjIFM~O78DeeDQAL}=*z0v zx4YcDBc+NFRt#LiyKP|EoLE^hV&F65RjQ9Q1?~IqB9lm*6VPRn4#Qhr~aX6Dm~- z1z@#${*khOoY`=-^^8x05z%cecUXxegSVO70Vf*kYEB{d!aveDJG&ymhsRgcX>jK9J!0{o(lUPPxUV5Ci{$($a4ITTyDNw!n|a5t7qX@?%3uX@C zb&?ygxUuRYhyM|egcd}Fw96Ex%|7L5?u-AY?lFiTIj7=3LSG55w}QRK9aRL1sc zKyv>7U*I)Uyt!~N?@HO}>mOxMHXL^NpF8_J%g}*btwY@jPhs<0-f-!^ED%^`?eGd* z+FYa!ia+G9fsTT+ZGPc3w*5lsUSB19t@llR>~D84N%+6L)cxiFvaNmly7bbYG*$0X zHun$GpD#JNU55`Vf+u4F?-KcV+VSV}ohER+E^`9Rv(BkNSP!1;B$wzOoyURE-~BI& z!~RXHjU=G)rw*EDJhb|8)osFSBuGAcQKo<{OQ+s(=jlrwbk>g@E=rX8hhmifJRwL4 zw69x{Q%**>0u3hsR8d5V77Hq9vg&jF?cbWZY4%@%)Zr&16V zcWMhY^YLPN*ZzNl<|nc`Tv2M>L5t1&|9mTmw{JGJ^e2;VY`3RMo#7&%kU>MIqqd+f(SvKc zvINGdVz0V@%<=J$5gn##vDbBoa)F>yBKs8U@8H<5)g3(oG6aSMsgw8T^6M}~VYFOh z^Hhb_z9&!UkCEPr3kMN*(|9Q!pWVM4`Nbug)=qdKct_6urrk9!9TIGIn&4vp(aJqA zKCDwvuna==G4l~dS3{DzY;oQZ6f*p-(>VefX8<-If7-U?P=@ehIWK_=jff9*Ae;7g7Y=3BK0=16I6Y!}5 zgpu%TL7WK=(YV4gD<8ipgjzYCw~w}!C-#4;eLQ3OiYopA@`I9pdxled#KQ;KRja@_kCMHZ{ zxXoxiQToaJK@5AVr~1zI=bU@OazBp_0S}nedZU>U5$6r2j+j*M*#H}vNbYOYv9Fu& zAb!c~$C}Gz#jgdc`&s(H^SHR05*6um=XAsYym)tOCPgC`EEFlHu2LX-w zqJQ8}pWZK#gMm%93{SVDhxp zY5OOCbSmZDWR}*hMz51*##a&7)n@Bl*WO3TzZX@lu4`r(=T;0LTWekqGHc++j8Gi=()<(W_MA9@@Jo&_6WIlaizLaK1MD@mlr zm#?l(+AZOtG_Pwv-}oKXO!+%$`S_@FJ#QMv2i+fY6PFsGII+2KYpL(H!j=a;zATV> zynH*+@xQ8bDqnQJ5Z5uf?Hj+J{`G|aw)Q)kFy4di`C)A0m8wTB<+sf89=ie>$y&_* z&xx34L7d3@jt1xUhQh1IEVw7J6)Jg$EgK%Bxz)l?i1$l7ukX z=X%|?k27qD63!9n-&Q_(fBRy&%dwbQkf)vN;D<^X4gj!-*BVqSMElBk3Yx9?)uwEoI{jMK;=M{u${zj2#kujI~p3 z^|EcROE7{X;s414ka_FhcznmImz4Snp%HOmv++uJ#$w>DhdCkpL<2FZV7 zRnyyhxcH`nVE%S?^ zP5YPU$G~qdkDUD56fdu;*@x~?ssh!qWhal^C626#lUV^Bl^gKw>$+;*Y!ze(Z(aL2 zAj87nr@I>Kr{V!7->LKRlvio#K28OBuPt}?{3>#-rG=ge!m%Gx?!Kz~nIp}SsjqRh z6`Z8EVVJW>G$1$Zq1NWU)>>O+xNhf+MC3{xh`Hvbl2$0sOHS*dx^`X~WIb==cRT(( zGP5a;BT4rFA-;Wo(N&+}Iqnynmg)zCMzbAQ%r{!36%qvoVzcZ0F%hShrIjYjV*O^T zG0zXZDB`MENTg{R($a&7NuRem+|zBoTF@ca_@-(0>0r(FFdIr&60v)oC1@-X1>HvZ z4tfmnVg!?t7xnh#;Bg~S=0o*5vUGX;>=omA+S>eEfMTbrJNWrFWBR4{ZR6xyFuYa* zDq`P)-n?008i#vnZ#PliWAF{;!!qRUbCvO79haB)r!Q8!_o;gq!Ri9z;3NS)5G)LNWePB6Y(NbtH$7sE6)>uUZM+Yk_C`))SDM2Eu z*j^TlkIaM8_d{o2kQ!uv>L~S@>RhlHG8!96ntNw>?yPsL=5T0XdIxs6;03j{@o!c9 zESH25czY~B4D#Naa{D9p&@MpuAzEX4rfO?>>Ce0)s+Q!Ju-T%>4{)5kPV$ONc<1eP zv4wWby2@>QwWnvgYi$5y==;`IZ0e9uGd=03kaR2nErpFK<7Bq=%o(iuV9&HwoKQP1 zLi^FZak7wmmw+nRNLg=Q=V4luHRvXNEh@~k^KMEJPkmwyR^!0kU*&l>C0CW)kdf~T zv?-Agt;6$faHMI>M5O!9_zT9*)3(lg?1q)3P0@x05_yrOk3oyZ@?Hgkbc4bu)I>oI zOn+P+Q^HBg+kDthv)-UiDk#s{j{EPv;9<{X|fTdXjLJ? zmb*C@Z}%sc1B+sk+Qp#D=s=&L^T6B_VtZ6qKQ#3DhGA}wlwiOtr?N%H3VCIjU#Q~o zl~x9C1Uqh@zTjL^3xzNqhE*7Y&=g&-%WJjpH9&n0ad}_)|M7Ir;c-RV!wwp?vCYP| z8mm!bPRu5m7>%vQc4M0p+qT`#Vij_Zaitsl1ht2o(+h zPoCukt@{NZ;T1i$)@EivmGWiJPd1RHmB4EeQNqC)%LJLny(K6mEQx_=>tj?AYzw2! z_!o4cFI79`oI$b|dbO+3Sp?$qO%9XMvzD>nPh_ARS=TP!o9#NoKi>2B_3~>iVG7gj zBX|hzR>(0ytqix`FReb@dY4Pqoga&IwHZn%A|}bk>@1PEE+7g6!RbP(P2)bFUZg(y z#gC)k;gy~{!TiTTiL6AkE~hz-|j|e=$VYwyv{j&GzN>!mh>EVdl{JU$Po>ZRW?bLK}Zn{ zqfy(dKY)3y;=AIwA;#Z!ihmaXej($uSG`ZH4-ihXfadEDL0_NaP%Bvs0KLWgt*pbC zlEx|ss8>D)B&BJ@oNm`&7yH#J>FG+`<&3>Q6}tzL6~X)-G3fu{I=)TMd?)1PD+{xe z#3$>8*a@i6F)7m^XCWLTtt?r1`EdxJ4muqxJ`F$Lgz4N-RYTEP7nm$x+wLi1YQBg( z_qR!w&0T%1?+8cDA>^1^t%?4P>zxLB=XOMrwR-j1dhs;blXIsPIh3+c zS{cRE8!es?E#96w+=?XG!Fs}B9?^!eY-7+=u*5j{gVsSN2Z_W%iwE3^SBPaQSJ&+@ zxbj3>xM;cJTzF(8eHxW+=nC4tO_wMxH?#!KDb(?p$JFbzlhH^orZ&PO<2#`^A;SC0 zQTSEH!KUkZ=bW47dZsF$drNB(=aw4IxJT&MQl;W+an(8Gqt_sGv&q3tu(eBre4cMB z<*#8GLVr77X}BPo&(AMo!)NM|RU1#as2&Wm)R#aAem0!@mFO()tQ!H zSK+LdO6`sba?nsD{b3mz54b2N)Gh|r*X&^#!~42q-CVBtd~w4eRVQn+d67uul+TWwj=+$& zc5TT)960S{mE8fg67%;$_40L?V67O#o#8t!8X~zYPjzmWa(y~pD$Rh`Rbb7nz!#zQ z5t$-DsoW8o_gr|u#V@_r3Oz(`9=V=;!#E}fW| z04E4KYKnbuP&*FX^dHwsVivh29jMzZ7R(KZf?(guIsLD%rMH$Kv*!VKI~&NW2xmr8 zSN*LdfcH(D(LEgZ(2FxcO8SMi!f`` z4uAhOeen(CJekW}@^}|~*P{Al)p}Q&7 zY}p)`_^lJt?7rwRg~yQo!1hFUWZBMhAPbHd8LtS&gzcS*;6*Hs0er36Iu;wUSLW( z4Ap$?&8y zLBo_BTyM6Dg0EyU8R?qgJ0`z}G-au*M& znnkgOUBNDA+l}FWE7kslzrV!ATA}N;Z!h54EL4B%bs7Fe>e@4mz-?=WKMu@GwL128 zcbfy$NBEm2Fiu+oypj%0DauH5g~dCJ??1O_5xBrwAG4@^8EtsAcFFK~l@2*;kp|~^ zOH_M)cH;^!YS1nqr3A%(8C@04u{*x{xbO|1bVe4)=U5AtcNVc`&Sg97jSV!}VE3vk z8r0@1;`Pp3tFty%(K1o8R$t;Sn|EV9P2=3?Ef0HDO8CPLGL_Iw6PRZ5C=+c}&{n6B zY$=7M`y`Jd)GmRPL^*>bOHMQ3O~!DSw)cYv4b!M|56D#p$i=mSMAx183i&l-F zynZM9xGY!%1kuILw7-PQ{$11NcFj!g*>5w={zQUfqK<%}_qV8b=$N*4Wv98){%y$E zo6oxU0EO;DrFI9yXF^mrhK%n`HHp8!4bsGLLOTB0w-faJCfBKNs@dLhwjlI|7q8$B za6eybuC6fr=6U1SF}X4SwAJ%Bcj9s$%PYEV=A|TE!*e@&)KJ@`Zu#M?lYd5*L2LTn zr}Ify1ILRXPu=$&x-Ks1uB}q7lFRz!jrg;k=W78e7h`RyE?3ENDQrGi%<&nX+p6|` zlgfEq&vP=o?4Uw>y#=sfFO#Gdtai3!I!HHfzG|qz?=sxrp}X2RE;#s`$?CmitTR;;Dlu))vE6+IVJ-K0o~k_S;Bt9`J62HuCwh(sXCtD+`xh){Y)fS|pG*BSyBi zD6b0G8Y|DiGv%Ee$sR1Obx8$_0`1lDB!mc|HCvSCwCj`qhtJc3xy@jsm zGDs4;7Z^dS?LV)=sP%`cj=xZI%C8&qb0<62@(xySKlU>yU4+6)VTPNPnCt^%LlB4n zlHw$P?G3_Pbv3-5;&h<1dzw!2*Mk%D)eQ$|&QxWS7-00gy|$0%k9!BUEN*juV^G^P z%&S+IGPhJ6ufjdwIaJkf=C&Y-K8099zoy}Y znB~g49`G?+Hft1kTB$W11y`92XaWMd`{?>nv(F6_0`d)G1ByOs>UY-85m3|>of#o| z{h#G60cCC|T=7KiHng^3a)(Cm5sV@LX2Va@PPFMn_&*4Pa@R2WMV7fFPMf_q!dNzu zGx#kk3qIyU6G~Y_WJ)DNAg5SO{AIf0)Rkcj>?mqDs!UxTX=Kt?=8+5KEp2qLG@D8) zD=CvtT%YFWqlGX)706=_i+^F5*PJ(0m#kqGYwG{ zZi>$^CY~7qqG98Q55;gt_&`d~r23NaQ#G=2sk0W&+1gLU0`K1;umz$(!Y3S^< z>9qd@EYMb)giw?gF7)Mx#|H5F6~R#Gfqt%LYIJz^0Tcb~PuFVn6ioU|IoeI1CFkU6 zyT_qUgLs#t#YiyFhh$8Pu>v!1zWi!s?p)!p-Dr!7iZZG>d=cbHw=9K%H|i3O*1UWk zNu+1i)BV6;&68cC3ldM1!?S`M!^UU2y}Q6HFR)d1vuU0{1@G8FFdek$fZ32Bx#&#( zIE=nnMt)W zN_W{wg}iVdJ=Ko=VfV>;Wq@TZ5{VoH{?#5{uP7KB+Tr{Q04H>DRh!OvpEJrY$8u1NB1lc7=Q(IZt$*<8j#{hYKPKN+04OKR;pC!*^a^V|`Y(y&o{z%eU zC8)7@;_6>B9x+fVQ|{wUsRgI7XL?aHja#S%*0{ED=oMOg5)aZPO%fs>A3c&3Iy|qa z&vk=)n)J42yLNc7**)~*bZ~f9%wE9% z^{<|4m!m(>#EW+UG8}W>?#7<-gq4?7W8_rK63myN_y+i4>E3dXKVz)}w)M!|($rmF zQ$x=EnN_&BxEwmV6+=plSQIdnj0a*soWHSv^69(3%N%ZqtJ&i!f>KEOjj1EuD02bH#rhlh+d*tp z0Q554Z)xzf)3x?;S$Ar*8=r?X-44=azK6vjl;T6_26JHvGw6DaCOLh3FuEU4Q@C>KX+t40x?qpDCd-8nAsa){jSkTWq;_fcg0qTqJhR2~^TZoDrP@fn>RQSc*UZQrR4Qk}N1CtjVmE>N zj;hBi5W3_VSQ?nST(d9g7T}^Y^}nL@`MHf97lc)7Ma5ZB*}83*R(NE@$Y}P8yla~7 z-6o)WW+N0lm4>uTcWd>HcgL|${P$x7v3ug`R2(+z+#km;C-1dV6Fm;dqj;O0Z@w*i zaOUrAQm_dy=)J(#gWf>~!P2Wrf$LjHZ}+HpDl{XjG(bs!`bECKjlVR83biwC5^H>E z6WNw5F=9!=GAnJbYaHAEO|b~jHz88gJ}f!i=K)$^H2HUisefMY(C0%Ofv%mLP;0SW z#Jn}o@$}2N_kN8JY`={rJP2!0Ns$Tr%evQknaAr!E}nnAsI0h~ejwFbdC0fVABI&c z?s34A90*82Qo|EZxt!7MXH<~Mp-j)f?My;m$bjF(#E(Qr(mBIYY|-<;hZkH%@ujf^ zPD2F^QSJFYu{D=d&8~>%SNYj{xzVQ^pQPeBgv>Lo>HP<-T$H?iw!`1zXjqYwr%%_^(@pp7uC*bUVpG!)0F`E#V}rS@<_sIB3JUEto=*-DVV%qtLRB0)_I0Mh zQrj=jiK_Bd2@8Ecc=%$h#myAa3pTWj1Gsw)Y{HRX8!6Zc@Bxu^NlCrD^4R|55u%-K zXFR{`Z7ojB(3&`q0xBA_bQ*ag8g1;$6Dp>e-KYug7`lD-cFPL4N+EdE?$Ip{zvBtd z?N%C7Rel4GgauGD3&FqFt9_u<9jk4=&Z%wkY@6%zzZdBXAfF%Te>5Gn4Q{*bp6 z#vYX_w)rGlbN9ymVI#`=bKFdPgN>nEl?d0H6uiy%quWoQ?hqWWIn+2l#bqy1^wb(- z0FuKBIx0KPLBu4%E{Ey%fqTY+!qI_BQI*Qefae#5hFh}w4&b54dl-mm(Ei7Ym8W|+ zUx6he$;_o!{3Ib4!Emr(eiF9Y+ZI(45>hFwd7Tb8CW)7t^ivt7efFE|Hp<$@K^pB2 zV%D5*b#=}f>3Tey`Iu74V12U*K)V`U$Q{Ewx<}Z*Sbl2OPjUS%qq~=VLLMBfuOxwm zAM?fXxafV2xpVFIt)u4S#99fr_KvX`uWUV`qCkbV6z6tNaW?wT(ybizjdD7tfbHZ7 z)R%ZhU6#JKD7$OiljRNvn!`JX)$wnwD_JXtg6jkWT!px!H;z+sHVy9pRLWJPSvc|H z&&~Ks(xsW;wx%fo<;(%X5s@@CGN-K9$c@>~P3M8=Rv|~c*C>S#)MqvQPP6%b?s~72 z#k1sBSerXA`P&n>YnB?$Ju_Sy%z&aapH2C_@zC{=wW^&TemIV6Cq>Y*P@4$)H{r5; z+c1O%-F?T^^QdfcJK7+O91rX~BT|{DZ3#5C3+rvU+`v_B<(VdSx<)C^@F~QrWl3u^ ziDTb;t8Hh0;q3HUqU%m1cQt6$*{s*kQCm5)&>Q_`2aVNwyUk}%x^*lS7UNZ4;Z?&_ zmc{$^G2njnWH#$DluvHn|3a}Y{=z0!nB;qRmNqVNK=t@16oF(sctt^r9${}B*gMFZ zt7_YgDmIpmy1i|{zJq43e|7VXvDrWjf`OWO@sW!~r_h-+k=F$&oS(=yTRPPq8=1@In3Xy^`y)CGqy)XPAozdZp%hkkm-Pg5{ zkLoqn?gc8dSz}u*wiCFUsMpzC7AE5rr?xTHPCbs3)|=?(*|?>i>&=l*PsUaHJU4JR z$eoT7)Avx%U(<9LWWV~SwP+O+f6q<)E=2m7vQRZK7s`xhjFI|@f^~@8O&goC$Sg58 z%`n`dro=+p-Yuiip9Ts5=v(+{Ob(pl8W)VKXr>pQFj?ba!udi}bBF;ufWL%aW>D?i z?4|ZgF_cZ6DqJncoCh?n6L0%JyHE?%zrdJJ@H|%A^8?CE_ z$z=P$0wtZypL|I;IO7+eSq9NbP`C==c%4&9B`^c=78?xKE-g)-cc1%r*k-Bs141+P z>dQ|HF$S0{%Ck6g`Wr-g$wPbbFw&Evtk;}$!j&+Gl*h!?9aYu?p&}H&j(< zKXPn_zy5Jjrd9h=Y>e7GW2+6#;|~F0ixUvS5 zK6P;uK>B&NLY6aJ8u9$w{B&ws8h-T0P>9G+!L&FtFkY9HX=K7`UKZHPlW>s5t$6GP+& zSe&%xW4JL^#}h}U3e$p}Pqpe-+^^pY1zmW*;j>8X>}#eQa^YLmS9SQ{A6JU zwh?rQlodJ&PKtf0CP(kX+}0(I;ap})kTZ;VuRHSa^#IRb)0_*QSQ4kZ+xnm!qm!j- zvC$KnL>zE15xA${l|5k_lDQ=b}C(T`jYUiwR(Wds!@BI9nz}rVkN(xTX?SYY6 z$KxK-=W%7b^J4(6>ZRx9*B^c&8O?d2)^qOBBt|hKlaP;`UgRM&xNi^IXIljG^^jwr zf`nlt(-Zt|a~JD;Jy{|MVoU~2>cc1P(}9q^{X72-0bppz9u-R+;v0;oyOcSrS$798X0X{jIg9%prM^SZ$D1 zCrmMm*t1r>eVxY}WF8C>CArn9RmndMFmhBtS@Jfk&yu;gg52l#A7) zu&;9OmT9_CiJ#y3C-K~PGzWB!16ga{nNQT13WxcA5KdYxERYMG{hWkuE$+72FX(zN@AD8Pg87m`oFW4Xei4q7kYB|ek zR?(6|yo0Arb21VtN{Ef0oxVajU|#zvm!4-imO&V(KPBLiX3h0WG@StPjNfD3DCsN! z1;v&_UY6v_k6{(|-Qu;Esrdy8{?~2~7>gtlc!Lo=qBT`WK*qlv@KzMV3uT{qN1Yyj z34E1SxhSdhu7d?9DkZrDJev(~=IWTcg5Osth1zaMtU7%9KlCmmFJ3Q;I$ckPi_j9G zXwAn`$YhHtS=7p;MW5rU<;(7@LJQu-QPh;G*vf$y4qY+D}#T5ULg%ak|(-->=XYhBLW#R?~n z;@^ej@yJ0*m&ek*4!+JTrHwD}a&#z5;ta4$ab4S&VySDTAnjv!9@(!iIrkldo5aU5 z>UL6|58Owbqf&p3VJQfpjit2fTFtVzi%c}sMK!!$4f>a)pK*2UB^rryVT~7Yn6K8r z!0m^KVYPc|=V7g=ccJ`2>Ot)1oGH;4ow@nduDP+3; zVx}5b$HF7Xwk}6y?B?7v(WKd7$9uVV{_OamLvf?dEayJMBJ_SKd$`K?^Jhz!Q(SjJ zErs7ZY5_(wJysx3ZZmb*-{9u~owvu~Sr7~3Vr>S?_4&&*cKw=)m&838ZP{sws_x^} zq|f~FG6EzKL`+Y0w}>F$45dE7?<_yOVg0+GE7t^LlXD%fDOl?7bBQcf20GFjR!ffV z_ctD#c{in?0wKvIJ~ab-I=ttztud5yO#)SFUb9Q{({Y>fO)dju^(eaSVQ z#bd6B8~nlE5Xa-eG#e(B#oakE;^Ye3Si#~nbn5$htmN5sXDx5FfCY=WToaTO6F{#L zCz9Pv4;7yD@b>{7VDEGvp;mB~eb3az;fXHNYTAWuK&nF&p(^njP0zPG?&1V|C|1k{2EwzD8>jBLFcRMt!*g3=p8b3xd<#(# zU;M=`2SHq+(XNPR7xZSy8zd~j9uf>U{$d&aj{Q%9KLe#maZT}`4VQG z=HjZUvqeO}3n;|OF+h+SnQ*ozF{y^5JG6#zwT5t!gNPn#kq5L#22AJjde6r-x--&5 z{yFsbciOYAL7-{xLlDW7Ip#}kkURC^$MP#(Magpnbm_j0FzHR2pBBtw6xse)Qknhq zsOxhI4&`h*BLn{*Bn%;&sv2LSza)xIm0Zd(%uYp5VKH3)4n3;7;dszKq=_~3_wUtw zG&~KtEC_!ag0J!ZeN+Lim`>eY%T6-uJz8SkCIn2Q{;;_2)|$M zwHRpf`RqkXlxAx~GOoDZQ7sy^vD$o*<0GVBO=0FtKASS{Mq159$@GoX;jxRwlK~B|)E#jXK(r*1i_dMjo_A;x_cW@go_$=ZUuH8?0`OS7E-(E-V%vVs40o+$py)A&_gyY^S+`q_SV7U45 zdsrUtxeKp>D|j}4`MqyEwAxs%uJ%Nh8zR!}A{vM2E^)_2ZCktByIIhJd^RGyjJhL8 zR!TG|Sj7(MuE=m50;!h^ z<>vSts}?FwhWrxIWPmGSm>eNzuwpt(lWH~$@*KRw_ z6s_rM-}RI!$lGY8ItIxK!S`?_^J#}2AB(@Guo%7`2s-<}wp%XaZC$jzEfi%sy(04i zH)m!L8|T&QCco`9QK0aP7sjUWI_|@m|KT#9P_NBMgRJ3PkIs{5UxP9SxyX5pX&|y8 zDoS}i;QJ?@Y26|v+O`{hwOuKC91uGbdinK>wlC2^KG4*5KK;j_a{0^elAP|nc+%R+ zo013XyTs_TT!#gwDKK1HDdMb+Q9aD(UNDE~00F7hEqSOeKYw;ljPRHxom1GYkD}8O?3LiRJ?@9?bX=WOLcI-8&ci(9CZv=z>TxE?ObTD53x9`yeC=)7uc z+x~V{lnJBI`H|huweD01?zoKjYAFBb<}T&z2p2hTB%kD&onf(Fy91c=8U@+FfdNWA z()ElTY22t5S44%g@oSWF|-QjAhWy7VyO9eWCIFQ52R0KjH}zLj%!8b^14{UjKXUbpVxs+?16E} zwCtHlB+__)zd-qR@2R2hMoRLqx_~-EI{MaFye;cngtF!+r8$p56{S&12ggmhw36GY zisZEF`<2}CRqR`PW&cOqMx4L9q!5F9_sZX@WJ!=QAWFV5P5gU%;r^04hw)bgtC5A| zDKVsaoOAeaH|?6c6z1V&aWKOU{8MHP=IJ!~<gAW_Z-LMO2i+sXsPXxK&ty0! z+g|nEzvp&*w*I^t#Terw9vw`fjGja%_G1md0m?fqLNkeYpK3@Q+v$Z^sXEyrgx$i$ z70WA>xKM_aWF&sf0_nI@|I#?YDfo?qh1CqU%Zvk z$N(Bsf++FMNL@1PI4$8!6lUR^jTTv#Qg;mq04!xS-gy@hVM9e13Ee@b)X2J%929o- z;k5Xp{3{vRwm0Ij`b^0^s3%fmtF@!PCCx$>rIlpx{1{q#pRBqag3j>lqRjb-v3)hq za|-sL6ve~>5V7&mQ|wp?;!GI=IlBy73ab9tB^V;a>kUa0S}XXUqm4#wIPJ94|Ftx- zYB83#$d@(K{fBEv0!@u(BN1@~m+&V7!Dct6D3g|vux8KI-gp8`8 z#NvMg=|YC?W$rKNsGib2wtD#T$Ge7_=0WRCbsVK+BwCDqoTittag7aJ>B7>qZ92>i zzkYg+_IWkN@=oVDF3uzNx>dp|*3Iy`U#8A0XYf4Zma!j6rqYRoF`Jxr=&uyc8tswYXmWy_w*@h~(bDb-C`5E-XgM?NQs( zhGk?!B`lS@ijDT%ecXxG@S}rM_w%@D=WaCb2&N8d1nzxdZnIm|UA&;a`nU`cB6J*M z4HAW9OX^qFLYQ(}!A{A`(VAr;{L>{zsX*+~Uyak`l1+Br{-B3dOlA-|tcG7|%2)vg z10a+u%fqzOtQTOSrpf%dI&DpBthAaeYYtC10&P>!KH`|yL4_y`S0MzC$*$alUC9;! zkU#4d^?h_l*v%)t?Ioz>w`E@b4QK8lVK+m3H62Y_2Q!1^#1U}Bt`O|V5X#^`{a_UT zx$E7$Mj6D8$L7mMVS44&O_|4e^FdAsaVgY1qFl*84l(Ixtw`r(5HmQ3(6<73S~8Aa zH%qtvcl0?G1x_w589ZmEAQ{h7W0IHW#m=bUuCOQY7eQu>y>?E2<7An-pFVD~KKdB0 zTo&=7!64?%q)-)915|lq^<@iqicK5-fuwXs@HTB%1DTn`v>NIX<6~SWp_E@T&o%GT z^fjeB(Nqu8Dp`VTZ&0f7Z_}S{V_~1odSQK*pLgRG-us!obD+MZdtS$9C9tIc@Rx;K zU2GSFneL115gqt1u z5V8qN`tZQ$XRaNo7QB%?1I_00jK>=!PIxM&GkHMq=f|UOQSpNa8hWH0*I}jjO&egg zbss!~T~4H&ag{T$LHf-u3E!=t$LXw~=lvHFv}VjIP9YS8-s)A68Ql~Yb*nTz=ywS7 zVQ~_Xk%qZZ?dC6Iad0{8VuUve{9%I>wSxU3juK@k5R`Bg|Dm{~!YJ~l?g$CN4x|SC z5ug~cS_fQYM(miHOM9Ed`KY=$1W95R#wfw(!^%n~yo5XG{Gvcv0uHHesXYiqa%?rf zjzG;%_7b&?h!qFZ(Hk3j^=2w67$&M;ARslke^T{f<>XASDI%AC{sfut7u`XSI@Lxvt-_g&IDA5hNkqI4!$iDl4 zIYl6tlXSq^oSwFSyIV9Kk;E4lLCDi`A)=jCq9<*|B$XZb3>`11?0qDw-vgwX^}H+7 zU-$WV%jwHyQ`2+XOJp}2^F=>EC}``NhR7HL6Pm71du3@kd~36OJ3GX=8tE4UWL zGzAsj-=22k!H8zvnoLO_HUM}9MkBY}m8gG86`1;x3Ag_g?DIc(2Xn?U0(7Wa21wb| zLuLXy5$wS(zJ{_tS}PGNh05C#RWh7rq>rY)GvM@$_UisNzJ}4Z<%0JP5Tbb91Dq$UZ9BD7RG)C)d48)&LUMRJMUWa~%Aye5j@EIe% z!y%PXr-#%IUWyXca)z;2aze}y#`v(DJ~vZ@*BzYwrJJlvioUFj)R=QTg|H>%pAHG* z%YhR0ff?4n*6gL40pvwn9M}cm|E_Uu_XO_&;jYAmNRbFmEJwsC7&(6KMG-=DBO+@} zIF(Ke35Z69gWRKtWYEuqHf4_h-=5W&aEpHY3H$W0>C-tE4NK@WC8F89GiJIsL?3r} zbkrS(UD(yIs8^=S2`P6agAXMau9@%i7b8n?`_r#=XB>RA@es*AV7kqW(Y?5oC?JnL zyTybE`3wS#j?Gr`Luty=%L-??=(P9LN4wfT7J#F9 zG86_yI%E<;;>`n#AH{Dm^R=XesxOD^Fd0U8=9YdDvG{kz(=gkV(=~w(0lwx+fJ)7Z zfAn-&Jr=G@oP-Lk1rm5AzT1PdD#rbcjWQebhOBZKni6Xy8I1ba|jv#r1r4SVT za1k^sjY>iOl zFEHNClao^pl~`PMnw8&cN9DMm*U*nl#5W}ly@hOSfS?Y*(HyJJM~OhAxj+)D6Ivz6Q;L>EM~UIVbQO&|1qwj0bM`&!?Nf)Q1D5 z;7J|&-oXU;PT-sGatNJhr+-9WBD)0T!W`s+@^z@;lKKy_NgZS)ox-*mOe=hzCP|Y| z$)wo#=h@ml5O@pNgsMEgU?(LVfze0;?d7cDV^TjdpMcg7O<&qRjX}3RjB;@Xy`6-^ ztc{|8W6w0QPIi3}!*XcGzi)oLk;JWoI$Ag%u1q)OeegB6+Kc_CjRzx9UTLDrocIb8AX|nWnBu=<_E!>U?OwQ2W6Y zzygHRlpUrBHUu=IA5C?cc7SyiGU*0OemCLzuTc09ZzRw~wMk4(TTl_%GOHR;T!(AT zjw0Xa#@PQ^DZ-6nzi{4{>A!sjTeh}aFad7vc`j+hE>ZsPVkFO~>Pm`6X5iV*^nSK@ z^6biX-|vy+PhteXvTI~=rR}e7zH=q?P6UECBq|2m@?la9b(q9jvuv7MLSB(Sp4Y?5 zPg7zj!%?4Zq-&+I{2to(j5qrhjzOI7tC3j+RiUGUlc6;fy<@jbMg2$a{omi49$?{G zwm_>ktsVM8v;P9%6i5nU`Tzo(CXt{`e(=*Dr<|bD4EqaJT_cRX7j?#bw!<@D7$;r% zN$Fsl+s$t2C3w~(NMy1q{vpa!u2m4d_%S_L;7AK>ZIJQ83b3~F&WLzuSsn_ea-+&f z{Ir6zd5MxX4{;7Qc8mzLr_SGF`~5?)4+lq?I}w8i$Civ`tCF(`eEt z3vFFpcFZ3)ocqLyX1tqH&$LQ5hID+Eid}mC4`MFGp^(;$RQX|ak~*B$w8Hiz&qV)* zhw_xhnYwUo&;H-|9}O07wvAxoo^y5nb`wgMT?EA~TJ}FIudxZ4wdGUDk#-yx(8}l# ztnoQ7lzm&kPEMP7Nf{?kYH4+3L<7NUKr(Z#Xan3nQSyi(J$IM`0UZ3aC9tvt1w@i7VSX3|toc+{}^q+IB z@yjkwlU{*R;8*tLDmdQlx5E3+vmbbvG^LeI7S@2Vg)Q@RIoo`QF~tto|0$See61^r z`B;hX4KYb2aCBS>fhjgfUv6()5Ez zcmdNFE|94tEYNCp%+;7J6`_z<()51|RK&M}agJZ>aoY7`RRI zfB=a){Cld@e=qS@!?cc2S+rQE9L-atR|mp=SOG1nK(ze`prcpeFzC!-ZeB&FgzbME zJgHnAVYmY>c7Q{TD#Ir~6i}hH9lssoY(w4M50DdohU$} z!45LfS=3iI%*C*b=av=(H(NQ>Pr6`hLnS4-jYjH!){G>sktW=V4B^NAjj#qkDG2#F zw-{5(-~@irEHx>>N6R+iz^z9AkiMMb)uxv|{VA=*;opo$TJ}JEmKjdL1yrl}(5GZz z%)#ffgywaHcF*?YZf^Hne=Rgv4`kM^*#zjACh!H};A!T)MY!SgMjhSbW97RQCYrhRG88;lCY3VMNuoCG>dpZ#x6#S{=1&u*` z>7Ee)^+&2kM3k9JijA|Y@w`i<-n#s`7%+o5YfjP zn($(VPw+1hlR-NJWhOlih>gQzQ8kVHvuQ8V(B0Z_uFwC%iMuKvuStOiCue8cGhttl z(4`+rhU?$otG1m2nmQKTP-~5J&*vxL_W*Oaz-un=k6j;djr*9)KC20Azm2|R0>g>* ziChK+liF~s_d0y8C2I;T!dE8soZoi3>FHiw>|(eNLW~tkSSbK?cL1{O*#r$rLkyT5 zlxWr-2;#yy@xENlw1S~)hHb52D}*K%E|z%q)!viIJ7O@CY_+y;u1u-Oi7H!%W87`T zcNe0qCrDrGSB)mG&*kV?w$Y{oUi!FhAY`xzh(++Dm&B$0%AG-6oWvR9=MH=zqfwIs zVb*0ywKH%f09`Yx^#kRUNT|ZU;S0l}dZi9RrZ?C~blwI|ikvs)6%|SKcjH=G3xMrD z$Y3EBxIteO)^d_g`^&vggwLCR;R#JxMD=YAUh2&O2gT#{C^J|Eu#f7S+!D~qc=gfR z@)|E-`2pvEjiupZbhj5C$%W@kZa^G-#^zzWhpZ))J~d4 z3}Op14U4K>-(GbF6+40{$5wEIe70R5dP=ogXuxQE^+y$vI~DJsH8QfIU~^=Y zg6B7WaWR>(^(M7IU1(%(S2Y9p;2MI?-S?NxJFXKell4A(Wo1@|mq3x@N?k7Zm{ITx zKD&0Bj-i4iUp$Q0+ulmD^=?V6r3 zO$V-gip_)g4SpH*!uSt3fg5uvL$a>YsL;~w)*Zp)PsnoM>@E9eBq^Td`$emeicxy? zw)glfrjES@noBI{I<-HK#aLji3BSGa&Hbtk|GnQDeqrXo#XW7w{v|l)<^|4wfH4-5 zcW_eiIyM?H%?jLq%PB6O`AsVb4{TWK0IRmZsxv*iZ@6CjW2tnxR8xSk_gByD9EpO? z_H$-y<}@WJh|ga8Re#4v$qVnN6Ewj#ls)Jb72ef{XqIW)mC1HOn;-$Y3u zD`QvTlrVkD&t{57zoIkqywzrkyXQ!Do)6w@#iJ}shkSyu9S<>zQw%tJ9F)<3cLT6gj6F z;tj2PqIa>YS7Jokhnx{eIXMF+JT7`m%i{94&GGRE&N^P!CVk$gUd}f^_S1_9J->VZ z6<2J$jBMg*E0eyxzxTH?6c{zA(fs%5AH}<$0ydq+hm08bI`5CCKXjvbUxIg#P4Vd&&BG>|a0WTsI=q-`m$*TBB*+eutK)XwpPbWUlUAirC#z@V<^0dKy*`d}y8= z)}$#AO!QL)tFx|Y)FRcokIPyw)cih~>C?K~I6wJuzioD?ww(uUSnYQ+uXAjEjQU^x zR=XN$T>A5DctG-;i|@Mf#E42@#94Ri!|iR*UKhN`?Y_I) zS5NWoFIe3u?SnH#t03}xBs*1X0i7h_m1Rz7`mm)^syM3E6*j=WP5UBa=jNM6XNK1V zZzKSiGsBuYgRd(OmH%?#^8tWC@6r)`Ijvh=32vsi9AlsSw@oPs+$DTw@0$H5jq``O zNKI|%X3hKklauU}4W1whRuSs3djT$LQrfL25MgI9I=Qxwlov^~3sohg#7t-1vC6hY z0GGvSQsZOYIs%j;V$%7^KEst>?z+t@l;aQZ2)XsfE@@hb5^pzU?%7vuWD0v0&p zdd`1wugbug00foBEUVO~2Bo``DEqCzFy!xz$v~8D{VYma*5+cXtIW5A5S&Fq$j>qF z8?hgL7!@hOef09)4Z)?&(0~^TbAPMm)YMvRee~Ote{i1A!Q;C7?TNXX8Oopc%$6 z4&Zg}^#nx#Pp&U3?-gka_QNj=sAmsdEO(eBZE+*hw9KBg{A^YrE|E0@nMHz#c);8uyieTfaPo9#ytkv1sth z6k0k@7I4DDS1i1>=>3U1Z>voI2zgjOvHof}^O3!}{s>irjyOthB@q)S5kAW$s;fee z6ky=?IxMH^UR_~v9lqk9`E6X<{lS91=b(!G>Y&N+?5)pxEut{@CA9vP=KL;iemy8; z1Cc~?BgK9#DPkGtAhcrVr{@9-+udaSB0)+4G=>bDOc`;LU5g8-Vi@lh*Xg?|QCg)_ z45eWi11BUvd)|Q{!=lx#QCDpZbt>=w@$}VUQAJzdC`zYDmq>S)NQrcJcXxxdG?LN{ z(%mrR&?QJW0}Ne5NH=`Pd++-J^WQMfJo}up*Iw&aXdjL?^p5ii3bugzsU1bl26$O!0k(F+Nhxfw1c~v76$H)$_Ba|O7iCJO0?Z!i2x8~EsKMk4j=i7d7p|<91 z2TBO0)~M3CDgcZ(0mKEc9(n*v3jM>K(~Dm@=BB3LL#n+U2A%^BAI5PsM47|!iR~vIC@*t{ z5khQbWkM)Z9v_v0NuVf>c%rJoZplJz1?=UGMs@>w^!!DB}(O#1U6mx|FYJp4HNsngZu* z9d1tO6`|(Ygoes)bH`#!N{~eI{T!D$Ana^x0PMq>;CUUjV`E-^*#tA$+47Mk{8B8# z+^{~d!3=nSK$jtiFKf$<)-(S1Gr6(Eyb7V=Mu4X#Fri;cV-JSL>I23z1#v>P=B|4h_d9i%O_;$6+U5g?Gh+&H7K3BP{SZzG3!L-*E`NnMc~q3%+hS*=f?WUd;>GRr8b#-AV%N)4)Bf1?oH0Ol zY)swUSv`YCg`H?mn}nEDs)N2VE$Mu(TCG>-;SdDRa26G(WTkSOR@TN48QCt|Z7fvY zJ((zRcllI-dS>S8&}3S9uzUal3GcC;_l=G?8Y+{y$YNjXa-ZMLYDwXnJKyJa=+j9w zA*b3RTU%S3$Qtj8lUUho0L&j4tbYOwXv6Er4PWjxsnz+3T*g6(PVVvauO)AtdKm`H zu)lk<6Hmr~{Ad^;ZOzR$mckE9mcRkzA1e9zn6~BR`C)G?lXeC!0c30H3)V8IrV4Aa zwte1mt;*JkX})*M6wF%_^!4s*_9VU;mK=QX4Io%y=skXEIqk5jOR&M;f0Zqf6TFs_;r@(R;u!}~{-HM!pM{6`+}q{E2Cs2}56$64oE#YtRhO}+i7zrWXkPnYhU z#c9?ZV=nS?E_bGKi`lhBcFz3$d8GE;UI{mDgTh)9 z2TinM!QoByevij2&KO^OgpoRqF>$Y^9clWZAd9i(pU8Mscr2DWZjxv_h)Y&80O7X_ zS61+MJm14)WSss2P$Yne9ZaKNZ|(t=v&MIaaW6OE`3AV6NwxY5f`Cb`$D%PJpj|Ud0Ow zP>_A=REy)livm^%XeaawWE_A&J+aVgfTOvybyI>35r3Z^0X-uY=S93nv6`r(dMq#i z%&{mh&UQ+m(jBTxM$R4#?R_|Qea?RI$ntP(gJ~D5TcN$ILj0x_$#Y*U{H=YSg#~e5 z+PqElcm^{l7C+(PS$#svA7&*s@57ZX<`MM#o3&Q<^@ecy^q5Rg$6>z zDMupX6YtU6GkIS3SEf{s`_;zWfJ3$uYOCv630}f0yb!i*W=-Aj2P8 z?o@N{XaAYsvY{CZ834|zfbFRPR;hd#&{h2d6VJCi=~Gzr%L@;OHe83k7s_KNkk9Oe zu$3@O$Mlj8dEZ8@1FpfqWc^vw#g$r7HV+JbnwDiPVnQnBjc?Nv8eo*v-P~?PX&-)XJK*rS3Q^WiOM=B3I-VTntGW(>1xn8ytl+ z&NgSv5NENc%MCh{rtNW`^&8L?;)s%jr#Z8o{d)Zy6vmuPH2+g|rkv-e68EF`H7>EW zS}*80ilxm8a6RT|G5ekHa+muO_&b77)23VS-+}tyE4a1D0vJ080N%E?mCc2VJ`H%g z)@cjdGb!(#xu=@obmPwG-VY^|hkv9#`uBd;u1AiYoy$I z^aq7h#q{5je=;yL)1lRK)vB2&1LmP1L&4_D+OBRCMSdU3H)!2L6y1{?i&h!6po-^M zTjBS{iS$)^GVA?I{qugu?%94C^cjnGNyO3JjhjLco-E&Sb{(*}0ZhiUaz>ZTHYwCx zg6AE9kRammLg--9e$!H`SNNaHn{G7EwN)`{S_xh;Q=kYC%jh4e(3 z67p<`oE~u)_vBCCsZRroP!j$V%LjR%OUf;>dy$zY#Nm=Z+msepsiy+FHd0(+hrL6>QMMxix)n>qWfJr8R!yApK|ZxzZo$4ct3%)U<)>u6{@d)gcEp=RC; zp!Y@U(GL5V(wfDtv1HlQFjQ)h-GVM#^8Zn0xLTduSy=xkLtvu|JG;+!oQJ|j>^tT0HMuEjWL*uP}Nvt#H6VI+E1zLH+# zwqQm^w9B?c6;M<=wgG7@e!SxV{61ctf*Kn|SdwM%^_+UZH*1+HF4U0&o2>q4QKx>V zK1L32lzU$xlKk{Y8{>uQp)>`8dC4gOLx1}i_C8h7_xAHfJIu@T2=z;qo7*U8CMUoQ zEVw+rg$K>nC~~2^@XczL6<|`s%$NW9TtG6;|AG7a-T0tW}s|*fPHqM67iz#g$5_eLE`-fJMZM) zU*IFQ#XNQUV0iNT$?$(bYrYjUm&blNi{EuHnvgP>-eN3+dIn%vJ8oS%mR=S#6MXKh zf2_dwVY%~M*n3{~IDgV7ZzuMjSPEeDKNSvz7;>&1{X||(kCBJ2nojG7$8~M^jlT+x zS{^AYGmOwi)$98v|CROJ(diZcj2%}cQ333Y+`QQp!``xjP$J+WyJ9vohPh@vZ=9K_ z3XW~*@Sg71u9_)MCzRC^HJg-u67tI&!8gvv;pIkbvMRrtMoPN13= zdYk&0;d;4(L|H4cfa4|FwX~CPoETvw%_4&a%V%LRTZ$HucD;Ma&XVy-A`W1RNp|x1 z4O4{6rGI%y{AVC<^a;~eT{FME{UJY!CBYCM3J{pOFR_$*tJ|y38aU@7T2(VM>S?ff znC!5pDA#>wymOs_OZ7XN6|nIxZDg!&*(?!$IslkU{}={=d8&Q)X{NFN3~S6cGnSB{ zs}L1w`dv>Z=y4pQLW|Gb&GV}JR+QikGm}tT<6c?v-}V!)hGWf%Cd0pR1L12^Kyw$G zE96*7;{%x9HACK{x4-l8xipm|hPRSjWP2tkD>-B%SFEdC_Krg}@~-BpK)+9FhP4>M z=-!7NAJs3V_3?5x=U`2w&9Yft+BDOyF&u;7Fa}#u7-w-AXFAOoQnM>6Tk`|;NzJnDqx&KLu96?JKKn=ZtKp;J1fGzqQU{u}= z_`m~J`B#@SimBEvt;=5QF1h#ihlrhXL_7MHCVu|y^C>UsoYzt93N1(9>lR+Resl?u zJl~R^3h%lK@REJ%v;P|zwG0V3-;R8GQR{dV9(01Pkz39?CRUX_(A&P!DoUsd%xHJd z&Y!NenDj&qu@^Alflf~I*`ClK9`jsvYY&{Q^?r_^t46hoN9)9MSQ<^zp^;$ReN$sM zZ^Z+O=7iZ0en}z1mJ^Is^AwvVaDhng;JesyuXe1Gn-!* zmlpFad%-QBoby`F-oVk`baeEYTg^yrxSuc}bwI#$FdFc(C%V2&?Ysn-hThTxRq#2$ zP0Lu*@$PdYuo{8+0IADLsWY+y_o!|_>-YR)5@G45W&dd1-!oi_PJaQelUA+KtLOs& zi+2Q$+-*B4y8gg;FdK*waCdj-kRP)PhWBFhlzL)e=&rS#jr03k%HAcMf1=xNCfu6r zb9;G2mYAhK*mJWcO!>0Z8l!n4d@!{|`*bP_lwZu(UB~5nGB;g$9GdHW=sw0gDuFTZ zQC}~=o?lTT+U{o%f5nwT&ipM9X%D%ochAG+ci&aeohNU!HV(S6$tH%xzXA)F2(sa3God@O3G&L{j-UFz*zYZp)#BjWE{@50p0&yto!%0~A@g&VvY`J^p>ly)HQuh%m#?t*II( zR7q)MP(sCt9j0o3&aG^NvZL#f7n(tJhl zoc|Kr^rp0J(4&`E*ekBCeJsO$S_l&GkT&Sde>QB|;}@57>eupZ!VqvUsC}q@fV{Yz zjtE1+m$B`5E6PiA>EfdAM*>yLC@Xd{S0?*LQURM8!mrYL;!;Mo(6N|m9mjZ&%NRH7Bd`UNR86sZs- zY3oCaawNTD{fvHbpApcN14sh7V!LtqrkTTFin&+HSsT-+-5!vw8oIHtdLf` zJ|${z%M9o^Gr}!(HwvS!mibn!-yaa=n<<;k=Z+;b&Xq4JXp-L1Avt<|v($vT&hw@D z)j&9jf^@WKPt!;00~soi`^XHIiDQi8sT%iWhiF|tFC2o123mU_ZXp(Lbl#eBJKsTJ z;=lM09Hr2OS8RAU0Ctwwm7{ICXj(y^f|M=icLqS3)t&oGw*L21uB_mL*sjjUu=>nb zm*~G#p2s~qFMynk%gf8hv$%kedYYx>iab~q;D-QQ?Jx(JqJLv zm(^4MX1gUKUIHp5OkIc89d>}idVf$d>R3L@=8dvLs?ZVL8T;DVD&G!3d;0qB$_dPM@f27tAj;VNhZ{ukLgn57F9>RWLWq|RjBv?PBQ@@ zuYq7mr-ZABcuU(4NI|%a8vR}EGk$-`X`DTjN{wJSi%{zee-K_QKDT1@kRs>JV|PfO zkO6d&>WUi;dh@S?0k};Y#hDH|O*YBX7;ol(u=W27B~i%!bY;J^ITuAK9B?dK!-{jx zNzV>eo%-nt=&M~*?JY?=_IPG!rW~9I!qUV7P3q{Fj}Xayv1~JbC(`=l+<2tS&4r5( z%;nlX+@WqV<9YR&Jp75yjk}xGDk<(XEMD>+liCkYSAPdui8CR?D?ZRF#u?b*V@a>G zHg0UK-e~zn18KCnV2I?)HM3)=2`a~N6f`nh^7b$n$EMP?+RpE{K;dY?Y_ zTgN08b8|Ht^(H4bu)`G;1IA1Ms(821_57B&4h$x({OqvO0u*!aT%dlN#tCwy{~1&z z?tbJ=3D|3E&rQ3zuXZgy1&#fI_sndVtL&NJ)Xdjoxw*cUIUnC~!J&~8i79I#3Oz+k zy;*tA%t4HTb@-1C?UuzzW=-98F8i3vHeBh%pa0DGO0}^`zMqkM3EDqq!9I8VoQQ2b ziL>56F1MeR?b<8$fxa+h(R+9yd|RA%yp@MTfAj)g)KS0P;tj~)a^Yo2dY+Q!y{_!{ z2B10Bobbu>U9CZ#5L(#6mqov0chwm>t&dr>$UVAb29iAMmzbp5Gsk%p8+a(nQttKBnOYwh8)61ZHtUEFE@VPe929IUb~G%PgwFA6sq=L-nB z6^2gxT_l})oDHk2!^PF#&6`~gr+bu~}h z4)Ho=0EWw%hf+k;%f8P^{4^u0gd@ut#QW<$foQgV^AAC1S;yX-rK;--kn3uOcdk9w zzi%+#55kp7lnS&otM4o_S$_jwD}e#R@54ydGa5jxz)VQVH_y>uZl$hM-ad!uF|r7n=lsb8&0C?OG!h%=&WMuv$_6dYGw+Ab_>8 z(@Q=5L%>aA`6c`@>5@Iyy!IUZV7eSV60g;eY-qAS0ucBb@TWUMOx)dRt*MRgQgy_P zukRNBK5PIuH@5&I{Bn`2tz(VZ4#@p?gp*YhznY8Bp|NompsH^&kHII$I&c1JHV7NxwrNoalLuTf*7~dr6V|!D1_LtqYfa5 zi~wUyGVc!|z{J=9r6~l+L6ekr3>|q^<>xMvVl21#&iDoY^#|EkM1)OvK-L_*R4X8B zdb);S+GfN!(uR5VQhy2e$0zjwovJ^nT4;5d;syX2W5Yk*xiVUnH8kMJIPvH_*&03& zg~$-vV+xO9Fychy%Rm46hQcJiPUTHWk<=U)}Y5FH>K`vfenw%LZ?<*yo!h!v)AXx?=H$uKuxm|LH!8{IReY{oE)n zoB!pA$CrmcjJo~cC z+Xbw}91?#egDo<_@<~0z`ivRZid#}X&){-KZEPR&z)AaQZ0wtjV~a|Y;hF-Gh?SBW^V=|LV-B1_Ghg(T9ziOc(S${my^WG9Dm` zw2x;CXuh3~2DCbWdt^48E$2&ilyZb(%|<4>R8h{O zHu$5^yGvQa`)SI!&#x(^tr-E%?5{$b6Xny+{Q1|Hec@!@`+zo)a@e4(9B-P4tdabg z1p)>Zw|xkx{vMN}h-KY_a26Jfat>;YZPm!VgEHhZ)RiQyIB&^0QJIF_wX4Vhu^WN1 z3$g0`KAxtbU(>d~oJvxu#@{XSmv1xjyy8t+?(^CUdam+qUjJlMDjKBkq&AlTt%WLe zf-yT6a1#!fYMJ$;J*OzT$Lg%-t8ilPVxWm4CCB7w^k#ghcnkZiMkDu|S~lgEzu9bU z=`(;b0UB?l{ zE$0HVnqeT3W2+aH_3L$+YRMN@;FA2#QHJm4ic|;y^jTtqL8Piw)tUyYfN+kk;^beZ z9-vP_9|Hy>sIG|I$UATG^}e?vXdCewp}+C}f}2;$050gVTdD{2TR02qUf|@IXJAqU zXb-M9&Xj=hD7EX}I2cfkime|M!(AgBy&dNROf@TMr36j|SN^2BVRUL51L3OQ)f1+0m!OO{i zQmIgYLeF5dd($rYgT8*O;-#f3VS)Hkq2*s~mQXkP>e-tKB5;|=@a)||lzat#^*@Go z9(z&+@)MLp73F_iY4kU$NPQ=qBv3b$V(dht{$j!lKNwqu%KzoX@*&-^rTdCUncw!t zAUu8#=c)fMcVB{HU)SQCawGmgCi#EofzqJ=#2o@8aUe%7Y`nI)WKQARj=+3I>;L`* z7XjL=k?_BFN5FqQ%772(%P8}L(}mBd{oi|tXZ>tPKZ*vps{Mx_Z3_P-p`N(a2~VKD zN_2+7;D4lPwO)+uXDFc9{?8AAJ)C+U`5*|y^ndZR(H}2y8dexF(P^>nPyVMVpbPS+ z(fjX*Hi|iV|1Y!51I>Tr&j$4Azn?U@_&q`n{|zav@V4<%p!`imdV~0Dh5z#2^Vp}6 z&=E28NQUZg7vq6wtOC#fY9zQM@C%W%m#4q~|IpjFt-qO)73O|+5fkSf!kJCpju8UdiU2)oO=H~vk~JZl!*EN zK;5^r^@IH{)Gk6Nag<)MEZLUAG6Id?hM@~LRt~dME<|(wjTz?o zGJ_OK*l&TAE^2kxi92Xvri@D&Op1!yWFcORlL@%>kh%X=;q^A6!Jx&oOvFi3HsM4Y z>*nq22Cn%#nf~4H)=MeJ-I5U~-C3`H4M`yqu;0HghhIf64zd0Oif2bheARy;%5C#z zg>sT2VW{9M({_lMAcBgSR+y=)XV3OWxgjowMgdb~lIl*EYPED^yc=ef3pIY9VTANY?GNoY_DRU}ii(h}V z(LY@2-vGfZWOjZvv^NukgtD=qG!PKKZ9&38zYG1TXGk|J?riw}syEa*m-XZ5l}qdR z37K&8XI51&&E{o_1HzvZfqkANm0C=kKEnkO#dFnI7>ej@nojoO?mGki#nCiS=+Q`Q`JyB_b>w+L01mO zX%8fI(-lk$G)8Ytff*f-l1k%g%`G0LBqW5vEArb+=Y4|5IlC+%k+WEHT<5~7-4CZs zY=j&ic(j)gZS9foawPZUgN9Yak&_52ij-q7-#B;H{xl)rjterM4``m=!@BTT^s$Xa z9~1&*a(JwJ;}K7ruJAG$)YV0KXqJ=q5KIWZ6(4u|9x43qGd-T9Chfq=-x0r)$Ph?!efmb#uiz)?c)6chBnhRv{z}-AV414V$gw#Yky($u zf~a#`pkwb7q)XR`41fJzYA7_GdUOX{eKqaLhX|FPp*7eNmEZEGko&eWvr2>`;@_1o zL25z0WA&u>9*bDs7jf?Cm8Nn!rJu(!E*Et33FW)_%Ww)C;MM!S6#Lkup!=U39l)*b z9_cNyufOM|q<<(ymR06P{`j%@hGfB|qZ>`eVjqcEwx156EVPzFV&|$$@bVg0$aBNI z>tQsQ;n85-RFc$XfOovCX0*)7{a5}B+-LsD#X37I4@t`#a>p)kMYGW-mM0#nloogq z({RqeR=wYhp&WX;-va3X3-*Oo{_3KgZ5*MsmC0Iz)4YE=I>pt*XEyb|+OSgs^vide zyXyfiucKSO)99$lg2Wr#kHy^Wh`zFg)@mj5CO(7fPj2FBSl$@)+!);x#1gmdOfutU z`A&@y0EW#H;3-W^W zZ~QH1!`peiuS{q#-70aQ|4#_VFNEY7Q}#OSb_u*{yCh%b`psdyGfmdpAj5sm1AybtQ{Yg==9|d^L+YCxNE+V%FTc3sh`y3{u}E-|oNd>nR+{V=5?NZMUj( zUOj!8XEP5^7G0_tmCx2OG^C}m=>3tt-js8Dr=`cmay+lpLZscbxH+LkHmE3CgB7F%%>C_<&GpSVoZ_w zzV_yX2nG(s(xn)DrZ=TzFDCCRY*Kj3kYNQ6pGf8FF4Q97C3xHSC1M~u;_w{3rW4Qq zw7x5KKtZB);x8%)o6llB3`DG5jpaZh;1jdZothaz#*tR+cR7(55kN4Y@_D`@BZFp zW%x1tQ?$xEzA}`0N^WF$oQCOI;TJ-fQh9&*8$9?6JuffXnc^xrxw^Nbz8mVN zCl8-ux;gzES3<_KJ?+e62k-{}ajs2HSvX7zPb z(SRQv4liGFT+1I;Q^P30{dXPS?iCdk<-jitQqt}SWsCj-ZE`XSEhDDpo77wIpcoaW zweFXuj6C==?3`fp4T?0B%-=N*~iXu`Rw^_@UoE=Y7WOp@)W4r7NwrGvP?i}{6^AHq&sP#Ihw7` zs4f4rr0`lvjW`lEAoK0^bmAZbx+Fa7vuycHY2OX<#|R%QT%L!J28PX4+4z6R>TFL= zqPLr$;7}0G%st26&x-ES?O#x?g%Za0BNLO<IUS`f1`8f)n>f-<~iYZ;s@RKuz1Lr2#c^g^P2Ib9~@J2KoA8uY?H9I|lCND;lyo(xTOcCV}?dy5?7;!N%{p1{wj$!K* zRGUzTOG%qgDP34An^WoFh;)U4o&`mBMjl>t`S0o^qeQ00mHt_%z;gDE|JeBfJ2-ue z^hU_+3l1mK92b3&pr_tcz1@P*xJrY!$w`MNjX~V@RG$#ek!q;O+V?JKUJG_c_I8ND$ZzC@lq~sh!_`Y8TXn7aupVE zD{lhJF{QAgmHPTVNU>d0elisw4Vuq=Dzs$t2!H1oE-v`;yjuiAB%{LzG7^RM+8(lV zB&ujDn>?F9o(Qal4q#tc3)|(s*!X76+KkIySl9wy$K=7&nu92K^-CU4q?=`+J*h=7 z!Z=HdMo$y5vQFHsH9NNMv2SqDaQ+yWZ-o+nQi59%_sJBML>tZ6YZ~uIVMSU2QHYq8xT0LL5 z*EWP&X=4@}r-j9&1fkwUHlH?ai5^!~6{+ZoWbf$wupC%AKr$1u*E%tsOV)%w#GyK3 zdbdq?2VW4CEl7dxS61{f7yFpM{owWcv~{4gb|uZy8}sv!1hV!8wcX`3nTG3W<3LS9 z&0i%_M9#3XxsU4U_ry3_UoCdnP1l9+eIL>TnLt;($PY?y7<^l}?{qO$9+s-ymWi5= zNtbL_lhyA{or32(#V1J>;`)QB^u5U6ja7Rmk2WOEj}h7wQc@)cb$=VpJ<8o(9(~w^ z@~IqN)?WB@Svl(zqqe7p<~w%^IaZ^agaa1jk3kRjr@p3pTTn9%MM;TqH<#48QtmM% zJ8gLW#5_&C6?aLORqj<-yX{Wv2BN}JlR>~D2-J1ExuzaGC)&LDH*3<`J|jej8~Cu<99YhbRd~5bOJBnxQB6lRM9BlCg|zO72bZ?6n*K>CT&jgzh4MA z*7Gpxt&xJirX5DaZ zJ~m|*ADtyKe72`EfO#n)xl+rdsnL!Nggjg76_sp>vAZf=FoXHrM9u zC8z&g~??S3&CNk~TH@;(~i&QqQ=d)ND!Z=8Gp@7fAy00|2{n|8_ z3sy`?X`vIeE%Etoi0zk$(b|% z=kDwIn$zeJAFv!5(cWrbd*Jme=IAA3)lsQ3n*B&L-?oHYeW$Miz5+;yoAXAdKAVm0 z3X(nkkP_%mrpD9u^*|`O&u?nS`#wX3mdBdY+ZkNPr!95I&dcQmLzmUeXP2il%~jt& z=AIo#L8FFG7e1ZNs@rpz{9DXXp4!U>$E*_W_{3gxwKB0g&Ru_0cxdO=%kqUZd9tC?IQ?R{mK$Xb77i!=|&^?3z__)Ml8-^&|fDiyC;&g2&9=` zGP!?j>DAisN^5S?nyxW1>GuRX%#v^t-TMQDG?}ioNe;_zO2++nG&Jn*VChJjnJnKf z-YJ6IMk2@aD7%kOt1&ORK3BN+JkDo(GA5x6Af6B%u1*TJI6JlT&r`Jbp9(NNUhCSP z3b%OQ&L?{r7frAFKqA+0GY_*BT!uf^2mg|9_IT(>_hsZHv3dJckjtjXbOD1D*>-u! z-F+`2PVt6q=3FU*iP{E|*1W77g#*^%+tuL(dX4fr=mqf%df$98w3nU0IK2z-X+;Df zeEvQuJuSLVw}$=xb@4)R$3+VVW!~=;)?qVNVzJ4F*aU(cg?9S?G$ zhwG?LuawMd+^QZ>qk+Oe%gopu2)!wc^*`= zw(KFxhkm}5XJY)F_AuRE%Q1{L-o_XYg(uFA=nGf3`Om%~FE#`c40hJYQDf7Gi;3lj zfUd^AW<}l0rwQigt_ha=HOtiJ^@~ye$D$qK=goTZ0ORn6t~Q95A$05U#jnTl#q&nC zt8r#0clpe44}ol)$dnhu{&1XL*gJ>Y#q?9V`|$(&+x=s@v<^YW{MO7mSyzk41u50ILz zxb9wku`M$GjI8US;(rt$gP%1wGhc5sp1*%Z+xmnKyTRwys3ffqejDDg$bTuGf8nuD z6`z^q>3&B}OblZXb6gYrbQZcp z{=?rgzo?QU+{wuP`-7(`#S`+Qs&+6s;+|7%GEs6Zg{tR8L@rP-&ucToC-noC) zmwV4VFJJuhVOeGoj<>}c-2UtRc&(145M??1FnUBR^5}Ma+E+qw5~2;2w~rR5{R3rP zI~tYy%QGjPPvyF8M?6D6)^0B-BS$~gcn#DXx4e>EXfh_83Pc6Y=4GWz40Qn0z}>6BfN+tAQ|JAZuQ`1FE!aBR?$X3GGXSH*8H z*`RFf+KR8JmKu>~ijR2Ig7wElDdR?vHD#O=#>Gt)W78m}|0NC-#5PoYaKh5qEO2=> zlw@F&+E3P}!9A!PveEBI>`7ENBV`Bu0Z;Pfaru72_g>W)ygPaIukdxe6M6}y{SsR> z+(G(wGx*1_G*QD0sMv=Txfr)%yQQjn0R?)dLxNvD7tbq5NoL$U;IXb_pPE%!B;``| zUNMSl?z3y=v?WsM2_H9EZ11qgv>RO&zc@q@b~TPs*&xVUb&c0iXf@Qd1EIQ-Na&9@ z<@Q~m|F)yQ3m9BC&B$wF-leG4C$x+r_l2p;Y;}g=v=`mKF;vUZHp2{_F)e?);BO^w zGDlCg`FN6@MQot`II{NKgSu*N4@*9 znLdzQFL(m+3%sX31Bln3ALLPmAA8#cG}QxqB=-b&a5Yy|p=!+T3rFL>u+*PgPKw#> z1IdtbOYu0b?Zh!bX@Fr+m8xu=#^Vol#5&`oB zOa*=Exk1SxZE?jPyO0r;wbTu8cPdpb6Tg}t=UGhJxjt7iEydPku9%vdN)cH)c%Ojw zvreBc_(!C4@K>FbujS6KIb~}?F4SZfyzi5qJ(W2)q5$>dLiIzeYHg+d-he{U z^2VYP>}L*Nq`}u1u)lWmonJg`7!_pkcaG|xT zXOEOo_~iD6*CY1<2}`TpgdbyB+HfUPqYijSeiEF7#fYKy%8!Em?^iz*%==kU`}gO#T%580A|6k!R0OgWDT}&2l;i~wjIX`^twq>tA1BPqPE<&;>sv}E#E!Bawr#NL^BM>NV14$*1mo_C+dx)kO_u8@bXU*k0PBD^ zw`&aU&rebTmjg&|Q0s{duwT)7Po1O5b6WdfjZ>(+t_Xsik=h`e=yHOY6OC{=g1 z56Q&+qA#ZZTm=Gc1RFM0jJ~f|67BAQ1 zgulIbD(ZPnE!6RyQr85YHhI{)9}RijuPb`ocOQ&GZwY01ZQnu$eIu>8k$kn_`GV0O zyBqWb0{OfGiIW~pw4&A#3AFgqdK>p~kNB7o#nIknEcLal<1<4BBDR008x)$1O+B9V;X2=DqqW1G%X-_Ahd|VL)6IVWVYri2VBD6{X99Nc+P2S)}4(>2>Zf8NbH1_Q9d30LrgAqSP=H zsG{J;giQ4mt(~*<^C#qQd;quZs910Hu`W4xYU+J^3Qoz?Abx7{+uJa5J{a1{9Zh|aC$ih( zNA7y0a?gSq_`u4&WAdl?RB*nYqigVc@2B+!oK!B#5ECdjZL?PNa{b*(GqC7p6~m#= z=aQGZaTcH3>6v(iQKB^8?TWZ8U{f?r1FiV(5PS09f$rf6Tox1uQPUb$t?V!7# zY8z@~#dch6uSZ<1xAn$TqMqVpUy{`Q&7y+1bMw3P=ME8aFQiifu};>K>9LgJ2-%aa;j2q6&I0 zBc{7z9%`fB4)suI3bcNIu6IKxlX|abLdns!NMl@1_62 z0BoD;IA=3{g<0&NXMd@Fla1;Xtkb@9YB6s2Yd#ImWQei{w0c+_{xoE$QB#TWt66JU z(8_COOX(xqW&~YbIRV?%rAukk=>Q+0%zkWT-#o)R^LA0T)?(JXMGDEelF@bRb#Hi5 zB^bwS+ZTN6M~OOfI<%bqI`U}Q>ny%>i1w8Zu@dYT+jbLeln%->oQ1Aj)0vS@jGYRs z)FEE2U3#6$xFAfFie`W*usFtfH|Ce?23hV?9}Br)iC-#wf`t2+IW(^P=_)1;0%{l? z3TQoQdcnS~;*}0X9!Z}{GYdK+0k@r3OtCF4yW0VT9jnuFZMg#1Ka@!?z!)3m&Eo5HAPhcP_6b;KOnr^=g^k7VXu3btS#8g_z;ntLb4` zG2SvqlE&(z^p_1(&F4Ibcj@NxrK)b>eBVq-DO<)kMkG#)!?beC^~Q5vkEn*L_b7_+ zm(c9VM)Kj0X@i0ihSe!>4E8oM_@+*v&3;iOM!awx9fZiD7(Ug8kL@cwiyGw~Z<=~d zF|`DaFP(ntT4?TlN=^`dPrVvrk2=qjeXRrrS2b}eL?NR~@gY(d$7ge)yiJ7~atnlE zDeFHdJyauRgwiCGt_8fH``zfZpNuq|KFvc8yuW1#UCzW&Ofx6#fw%dPye319y4p5B-0B<3WCBPNu@0XDFUAJt2aD#8?J9Wy^dFz?_ zcoHtm&*%a1e;Ug4zZgYjc^ap5U3r2kG zvFL5#yo((dIYq;Ul_<_+v|PC)y_>5@g7W=XxAkqKqXb)>J;yXs|GSL$B_6g?P;I-w zUNrYrSHH6#l2M^1FXKL3LYMKu2De`<7f7G%@o}#grveT-*J#%oPRXL$DwJ<))M3wV zql1S^n=Mt6N1eVk)Z!|(pU`*F$DD4JOJ)bme)9a9cTLEt#|OjGRt;ATR@oz%G;I9~ zXkH``cZSAb!mGk`MNrnD?o!do~mX1^mNsf6j+K84cp^!zZp7CP4wJlj@l>jNo?txs{o zc)nD89*F@Sy`;9cyRQ{|NR(mSlubG8h|7uaO&AY6(YQxezaBPn{f^=rgj;tfgl*hv zM5B-I+3K;qCSE#QLH?n-HjdCMIBB%9!Saz2A2Vl-`0Q6E{n<{NKM={!>orN-x9e)W zu8?VSCKncNsy(xBGqwyamKXjXO;;HZRnvt*rBg(@q>*kUL_r!UmF|XR>F$sgkdSVX zUYe!5ySuwly5YME@8?hVa_`KUGbd-BhwP$us^Q#&oR7wFZm6c_x_s`|&eCqMjv3gd zLOhtm)4>L=#D}?l=Hky?LZ-8dx;*r%7xT~5^(Lg+Rv1^xd+GyBhuK-D6li13o26w{ zGJn%YWcjMP)$f$>RgSotV7L!0By!(G~c1<@BsFi#6UeiOL*N6;+@vr*B+!DFt~ce@QAyPma=^A`EC zDhZuVrzD$0KN_I9k>r%4--#P0Mk)LuFc@CuLKh|R=AyNjvw3N6FWWEE4fr54b{IZi5#7lZny43J?rn!8F_)@lVI!?-wtUmbff0 zB`P_#2lh^#REHh54_BTwDas@1k$t=z$*b>3z+hlZ85sWVtr#_}z5Dtv)8X~`30b4; zqJCh}k8L7NqAukhHGZCfGB3Ky%sr%TgZt`kpzo-?9psb(g#)R>xi$FH7MvAO#*jEo z6Vn?@Qve`YQ0c5vZVamEpV&s%hDG|Sn)?q5s0Tb3&Ect^mptd1t(sKG=T%dLiyOD@ z{W_}e{W#s4E`Cq{WoBXh06~*_Zch3~nM+lQ7{hb^Wsa*s72lc}-ad69uj?d_YwFK$ z?|!bkUL;N)obSw^Sd%1x9&XoskRIM8WvO?1aF*p9VZFi2bKLP{&f^Xj95t$S`^@^g zJ^r_V6wBRy&8s#V9wA%Y6ZT%t%Y7m)j2s_1>$eW^Q*0Hb780oo78*lur%UkW61V2` z{0Ac?74>oUP2Ce(rdx3P*7O3fkjr-0o!<;J&u?cd@8^)o89-buu$VMvk3%jFV;l<^ z-Z57$b|wab>*Dl=cOXx9BPxwx9Jj zEb-l+50QIr#YHr(p-BkYY^aql=64DYPL5^H z#rxX(;_MZ^&h_OLzA)m&UMShknSaFHZtLrT>cX^;cd@1 z=;E$v*;tiO;$R^HvAg@h=XCC;-DPv?vV9*lk284$_DOc3yoLJ(XM7($v;|d3_Ji^J zu^tY-{h`82Xlk2}Re~@dRvrAr?hBW%u{ezyUk9QoNB(A7L&T#mRT2VI0|_FQI)<^nqY9OJ92f>1=lp? zjH|z8F*jorPX!p-?(X{>twVgAF3jny#UO3sDYYJnj_sUAGAzM#XXaefel;LRjfnwW z*+?AT?bls=ENp=#>T@U$)o7T)x!j$)$)ETVWUTK&EA0ed@F}k_Y3fD-N73ob(ES-+ z)R}iV$iDadju>dV&GZdK&pr46p(Z3DDj0U5AS9s15bxz;o|8*jt0)Jpu?Y}|BBX*$ z3f0k+T#h#m^ZRR&1#EWxp(+=ZUPMJ+LE`(R`gNJv`R$$Q0MFT2tL-}3pnn02B z=PjwaU(c4#B{L41kKagzgT*{;RR;JCjIO@x%zLIyjF78~mM%$N9&nCtt#6Mo9a^)b zI=+ZTN?gsBVYU5M{YK*mh^nC&T9lzDj=ldMsCnu97Ve~koDNM9ts5A>{$v6oaqw3e(TeY{uksXD`iL1$ z6#|ckJjdUlnNGaLw$ue>?vGO^+sEigrEAgjAppD$xu*S!7`~R|gUS7Ve|Y#g?40gO zC~N)pYADO~3YI6_t7ILPPvKY!{NVu+iE8Z%f}gN_1YVnIuZ#Udi!{OyuO@qA?vPk( zCRq@wC4_${l8`EsI+n&|M&inph)XNQ9X_08kz?yUd4gny7F;1;{#!PmHbsgyl=jo& zgT_U7#RCS*$Hb5S`qShe+TaDkc1|m~XRP%c&eTM|@v2{~pg=}3a)cHamKGK# zN*_!d>A4Cs%zrD9(nDWZJ7T~4n4G1pU(@&t@n=PMxIvdAPBOfV)kack&HgE|t1$h$ zTGrV9s$JGam?1l z9@}O6Mp~-V(uNN&>run>i8|haG3n7p)`#LGr?y1y>P~a6Lh%J@%^%oP7tBlL^}ZXg zzbq9Y%DK>Mddw0+ymZn!nJ30u)^Qsw;~?+vrBBT{+QNcty!;q*Dh%nG3_KqixQ@b& zWU^cl?+~ZDefocg(B({LR$;x<{@3wv?^Tl6#^&B7u!t!T!WuAEMLP8UCKx22B zRuWZX_TAnVa05AMYNb+tv^3MSJ6O&&7-^32bLPYS>ee&Yk!3sQY1vIH>tFb!%b)y^ z75c`;t0W;AgXI&@Y*r-$IUj;50n55Q$7(gWMvOGDY3Ls!Q6HoiYzxl~gRHS7n{nU& zCQvg|ZwZ|qxz^wCAg^Ed9MbnWrSqMExXfQ zX;7H)JX||Zo<^zE-e3Q8)0oNhrB=h{R73S)K39XqTELfwMzgf?8?1+cWr2H5mpL7C zt0uwQs->JpR9F#bRn(_-BLDb8SC(OFDxS zNvfkhYYgFK(eS-(ZAWdZ(DOIzQf9^4v`E7vE&ek+IueDx__gLR%gOn)&sLo zgQM>lOgQn*Pg?S`Uy3^|A-`%tBD!DCL+A&ZRUTOHCtHD&e12tPNp{#TTgAIAKyTq5 zhBBn(QEY^4M1v~$DhP-7Buh~6DSHnrZOBh&mGFEKtVmb5IIzV0TH8f^*qVlqrZgp=`jkn0@ z?;){keWMLUVYSrqEW#9X7F4AR&aSY`!GrV3otmOb);DkT;!Ey~|U zJ)$s?RGqXh9C_0+4Ogp}reszl`D!k%K74f-gy!{NXuBryJ4yKG{hjEa0^!xWqpbB+ z-mWHRu>Cdric`3$`+?Dj{QX$X_NqrT9|IR6KV&gi=|U;j!6ohBsuR@;O#8~Y5#@7p zwQqyJ(p{FnJo%@HF5Lhj+E==-#m8_2-(UhurJ>O1q(^Y&ecnjAk{DzI$w71 z<^k=i7R_gguldZjxua^eA`afzj7PsO%$o_i*on|rIc}u>E6UCMl|gm;IoK=pZjLW98M^ng3= zkY+}E*DY@=yD{_!ZhD~MIsyfsFy;=UPPd2(yJ-Nsu6#T;dqXzqxUBeB%Yk&P+NLJHB4!k-G``9c za_Zo4s<|ux0sCv!uAQ^imsV%>{kGd797?UTGy#tANS9R2=PyRJ=AZ~#9mB0=7zD_V zmBgtA9!9?i!+wP$j6jCF8^$I*s!nz4OW~kN^6t56Ndr%TqE0TQ{{H0($GIOj<95U>E&SwYrix5bjxoSKQXDktAH5QQptL>#&Isxkvx-8z35^|=i2>4+)Zkm9%tSK zWNUwgHjFx*HRZ&9O-;GL$RS^SNID>p`Ex}ke^8WK95;LbPIkL8xp<|+eIV-sShwW^ zjg8-V^>kC7@Zq%G$|S3mn&Y(lG=C(izaw?R!0Y+VwxV}@8q)_=!zv_nxY;KjjWGky z`nxbYq9~3QIIoNFPyK~SKSisXC=Do({OQag{a7C;;&!INPf8Muk|prtU^u8^{kOb! zB1ai1zj>E*U7n?;u&avy7s>kF58Nz}9}5)<3#z#m>z~#~as(+2F+PlqxyJBhcIy6l zufSkm)%uOniT)V1?%?Y**u?89%Cux6w_HwoGYAXWJPDqGQd9z-d^~!~Lk)J(JR2Y>ivC<@U7w3JV5Wtd6Y!)EuOd zZ7#$}NCw?BB5CXE+;V#U?v|`5>mu@)N~d9>81Gg(W2HTVnAvqK+23k+H7mi#tgH;# zXsh??-3gOHTqyDO$BNHf#0~z&V-D780}V1qs(Aj~InB32LgH%l410o*^ie@Zdx&+) zhJ6z>+SBG0Pu)WL6sqmZuc%if$@+C#HW6-4F6KTfcO87^(!$eQaZZS~;o zp+qw{^w|uKmoJOB8gO2&_{c(rY-R^}-{Dz4i zZ`1C^(#>j@I^8ABy%`$$>&q=0X3^wM#PL}vri&AuTMlKtrZKQZ*GiYM(stEaHT%mI zrua@Aoy-ggVG@DNVx?)Hwd?RehW<)QWsrqms*6W>yljhkN|g%ESf3u#oKwnqg^}Wo z@5TYCMuGZ}vU5)FNXr`%YMiz}G#Lz%!bWO_iVAA^ao)v=x}&00C`3b}%JOK-?cO~t z%7)Cj`_onR2L`&dRugi8yG#)xuzHXsk)?na2bF;Tt1oG5rmLwNrUpOCWyZRlM1~gJ ze9i(zQBTKaVu>~49WOhR*wx>q8K&x&r6m0||Yj-A4p^vTwg3*p;9#v*`*PDoB#cKi!c>}gpC znzq9wyxW1uRKE#Xg#-qND>Ay*+!@;9l2!eggz)vzYDZ`!V)!_J_DyBhB+9)$>S%Mc zN|-)+%QV#B`Z{iJ_VAicx#E*B?x{m6P|WYO}lo-;y!L`23 zGxQx#JMPJ3LK`Cs$we`q&E+M^$aa-9eS|`8zJg=aJRJ|4k&P+2u)w}#> zb*n;o#`-V_eovOvU+FP=ekJLmvR&nCwU*w|jF3CK6zXyp?k&}`6$VUkp6|ERa->4@ z;*t`hL*))A*u%8*aGy3ql;IUJUqG;^PWERTHYA>kSN30(u@4M6^glQ>c@s7&Gb*OjBMli6$ZhoiPWs`UiAn(!_1@DM;^tO%GgRC z=xGf6EM}q+A1*l-Mis3_g!G#>@%CfUjttotQeD5Wz4LFcaqV=I~4{?S<4{Wuf7#*g!)XW;;?9*_PvC)MEaBLc{fE(xX zbn_8w{YlE-n89}k6=ML7gs@ZzO|oq-1NPf;wg3ro5BmUfg3f@QM09k5a!bKuPti`{ zhpQo+cXml>RCl^~Q18vnAp5K(yBZvYVc^e7 zDYU0I9}P9ermT}Bqqfc$wxfpt`=R(sDV{2vFHJ}d?x^Xt5NN3>&3uwVN)!9>t{jboG&OuYF3b`a6%=$D<$h)WI)F3 zCWFbmzzDZVzMsfoD(I`C8}h~UZF4b6vu0e?@aOF&Tv zY?r#TFts%O6&oV8J8a(NcR)bO3)G#=N#`z~A4J3iS}r<0N8E=m>A*-Fw{Rh?$T5a4ffNSXx{G07 zp6v$T!$>cn3yvC0luSOQZZ(AVDTQK9dN1JLv$&Vj5Yxv4H!9KhdtlzzqU91eElUsn|~|Dc{rpMXDfY$eTr}{P0tBmonF+cGPJMl1#ei?la%Bi}=GnSZlhcByaH>B+c zfxaRGUAXBz@#4P#7~w<|xCW++OXb<{hNZ+823D z{%}N2>!>gOx{}6&kzu=bd-E9d3-m$;y{dwuU$TNb&c;ph0O;jZS_h%5J zTTKq!zvsY*VXR0#0N^37BuGb>+p)V4!-bLy56b#jlv;m?4}P%eotc<8189od+ik0K zUw87i+VbCK;x{0VA=O$Q%vN$Vj?iHi@fY7yj6*lo` zIesan-tFF=8~BdaOy7n}02kzwzW4ewzLAzqg+QT;`B#C|P>_-=!W!B8zX0uUVx6RM z{H;RkY(Y`2w9=-o#rlHpb5ueYHiXTMaxV=1t39SmjU%duJ&22b9k3DU_Obr#0R!;K z^71S1Fb3shO{v!ojo`OPMgx(pdbDZ=a1lBWG}O2`F@@L*10m)pg2JgNUKe#s805B$ zq0a_OY)d3;*p~Tl{R71OgJ1gss2fd03^0o0TYy}posb1{o~o20i$Q*ui%sjF_E z)k)|G!@5(8iM>u3>Fa^zpECel!u?It1F=MOJJ-;{Z%pzXBzC-|b7*yR}F%W+8qpuC}C=KG|!DGjoUN2nrzyHMJe9P zaNlnEt3R(H3wOcOBf%j+wPn*KS)YouCh^?lOnV3DbtD|an`u4`f}6ABd;atpvsfIavwaxr%QhT~10J0e0UuRbMG) z_Tj$(Benv+-h5v<-{((Djh7v)huhm9q+ba{6LPoRZc7OF7Ng5^@#wPu1(bK~{D7W~ zVMSKbnAuR`4XekFjL~bJ?>ORMn`4&)kWT0(%(IR1U&f2@HpPvs*B?v%Ah1u@6|C91Uqf#Bak5|U zt4z-zugznuA=Y3Ad}NrUUe}x)R6e$R2Vms@KppVOiRtnsm%;Mx&n8C!hDM(Rk?T)< zfS0v)1>tcFi}8*AWb~>w5P!bXQsOcI(gv6=L9#J`%dIHvZ8`lu_%WK@I58>W-F8;A zoQR43OO7VjGxKOYT2Aw?6xlUbe9Z3w<&I@iqYQ@UhesNOVY5ie{-%YZoU&n70sC#& zh}Dg-cCdZWI?;rHOS;GyCMGE=L{u)QRhRGce*l;*KR|69i5_f&z8S3q02J~BrhZxm z>~BnW4-!TV05Sja=VVJ0z_$sL7V0=52p)$DaUgJ&@&*Q6b41ni-6qs^wDFfArymz? zWPnhL47dB7@a-(uXCX8W0Jo0-Z}aTI(kc4jodJi}yoO@T4qQKJe+Fo>kiDvR> zO5CWm6=RN8=$cRFCTjdYtF*R_|Kfr@#Ny%M0kC1*^lcm~Yk>Vb#^eM(uf7%|j2p*s z36P^37(Bg+>$n6amTs9A+liW=DUc25UiF>}_Zyi zE;OtUr{2LzF*(wf-?rjfu4b!eVNv7IdjLaNK4L?s{qN!7qMz3RF(R*iW3%vaL)Okk ze(B}FzEfNzx*4`Oo|HGicN#<#g+%HPC|;?rSuehcQx&uIEgI2cMm`3hLzvi#@OoD} z!pOU7CMgc1QgjDBO>^fkY@3S(r@$kR76knDCO7!wB`va>u^Slfjag1gK>V1zFeyqA z!C&5zUo+p`Z9+Y$CRV>fUW+NFl2T;)GI;_4z}0bFllzK4{-*H0NBc{O?m88$sL;1g=P`yZ2?RtQt60~on%UF(DYqdZKa1^~swvzQ{*2+Z|Cfbo z!_mOgl^oGYLZS=CH4!cU{t7VsA8w=X5uqIAdNS($AkW4h_-6+&i4Wn~juCw@^|~HQ zb98iU<$Dk8(EAIo2NlmC3jmn!YIdqI;Kk2Hpuc2SI3skPa{-`LNxSs!Pij~R0c;gj z>wq*8Fm@^gu`P>y+GeZ|GgJ&9Nu$MvtvRf=ulZeBT;7^;_2C$3oud zg$wf9&IcTP`%*_nr)XXmZX%XH_V_YpNvbYPEmqrx+O-L#y2$KEBR8s4jxWHFag9)I zqPpdxxa8LOFn)76hA6YqF)$O|-AuZCc$|_{r<}fLAye?12|e=}ngX^QkDelP4cPtz z@}H71E~#C;#7{o2s|3Jv{c4T!rFL#}UNal2DIa>S{um=?`G?=j=(N|Qimr=UJ`RN{ zKAAUyCADfv*RU(Yz=4Ue(rTjAdMjK^V4~3XapQz=Xb}YYPMcLqYaO6DsY2Ie)a#%a zzbE-n_ebHqLIpYUBIzH#MM#yvG#OWnP^{*R&1>YiNURT)c@7aW*C8bnRS~e$%^UId z@r(YrRZCunlQ;cZwGtU%JzN1r3x7o%iP-!~K+c)6_?zISrm03PFW_{^>&)-t{2{CK zU!P2dnP_6HL3K5OxHeT;D?zpcw_HGS_iyqlC|F|@{;u)q?@@v$qNxASGx(Rvo0GOw z1gNV7fI+X#9+OP<^g%@?ZGx`#C~Du|P6>H(PjYLPbYNnU)pzY=3NBx&!utw+TtHNm zH&fKpm*_q9a+KE?MYs5z8Dptpyd~dC9)HfK=pz#6mf^W=*F=dJD0YRLc>0F^wu+Dl zqnRqhE%M-|SQ+G7&g0|i*mPNwW~7whoUF<9QS0Qt8g&^U5tu+SWoZpHL^Jj*G`e{F zMd^9-D#3HMW9pBq%|Oi!b!d|&qMk6+76nq^GwJHbzd*83o%p#G4>6y#I7+!?Hb&01 zc$~`Ds3`ThO;3wAY%D6r2i;~ zzW+CzZfF2IY3~)tosj8?TJB(th2g17@j!%{)b_vJ_Iz8?nhR1bX2X zA#{HEx_m3u%@fG(0S?T2U1iv~dn^34(aCbm^jm1wsReI|HLviC7lwZ||A3*YiuL0+ zU5YVjdtPne6hF=q@480T)rHWEM_|$-w^B_wv~X7u9UZ+{r_sHJ$rFfJr=6BOHaLy} zut&y7WLQ*azfiw(d<dt(d%ti)96=*n)IIgw}7 z(W52i8@<1x(D9l+wKf4nPt-V}0QBKJ%uB+RZK)u*y1CKdq<;v;?PNyMh%rz939A9% z1W2e|;*P^k6E=Ov)Narpg}+$G?M zZ!gy(sI0uagrk@>p!;@dH=0H5x@Wr+!a&Y^F>Qclaq35Yy9^+Mx)|1+&w@(d6pAgp z2lDX7-EYNFeP?Nx?R3ZWP74lGqkm-n$Yw=e!q76CZZ}wAM17QGbH8GAGi^&c0KU;R z0ELui*7oM0N=6^1bn0zQ>my9l`=e?g4bgw;l@IrSA24@n0hGTtZb9G88-a?I@MgRL zET=6LAu7BB@av|5W0?(qJ+LBKT}MJol$9C}z*Yi4eERY^c?jCVhA+xCFAlla?NLxy z9^5*4j{=16fQV0h7yJ~ty$LGiw}X}d`6P4hH&Miy1w203EBl<%bAiaSzaln zsO$jY2__viup}mLr%~Thgx&3%2!oVhhG&eBYRJBhzfv+s&(a`r-1W4tuRal_-;lx? zfN;cSlF6OA+DeNcKqheSX48>b{P+o1@pS|Hg|&w>QQ?K46U3Lq0;NZMa8Q-%KeOREo8k zLzjWH#}5OHmr7HjrMuhGY{|3NN%1Yp?O%FTmC7^Sd0PNgkFJo2gd~RR(E}$e{=nW5 zlr>*q8r42Gye$04LJO;-{oUXH-r@m3Qvx@+y}a{W0ccd90Ai+!P)B$lD15t8Ku{g~V>AJ{h|_M@>53c9)q^Ih8qb(j=dgER zY7JAg_10rRrLO^SK2-Q^{_36VB<%a?uJ?$Hw_U>brGlmbI6MZI?}Zf71vvsfr%MkT zll#G7f^8eP!f3zgJ;akNqrj(_>~y5u#p|jl9?(Tf$0k@ z+of44qJMfCbA!pBRY+SCvS0rBGuKvJd!~aP}YUhVdjFq*HDCifH!}po)%5Rz02$e)ijR6 z;|Dm{DF64$wC4h~;>@GTX7Dfe6Aca1jW%wR zUmJ;QflWv(fn!_AStPD?qd>E>BYfNb-UtMXCV?M-Q=9=fZTYlmVfzG)|Bs=(Nunu5 zqc?Uqg8Q3V{yYwitC?WvxPuwb!tJ~I)}{m5)4-J8px~MG2$`e)!CRtj=b5taq;|7n z zINtK8SnSxBuSb z_gDRWUL|S82S|#3pvK{`#ujElrIpyfF|IH{)P9cp)_4RXoGYNBeKRbImEcdeHg7j1 zwDyCuzm@YjaYyz*t1K;ft&1*aJ-}wf`34X>NIab5i_O+_i)JwwuW5pcd793CypBbh zifP(bd#uS6m=6HY51$W+=A!OHN01=eEHs8{GRNc@0kssj9T^>Syi~lVn}xr!rU9IM ze3ui&o)b*;A;-5Z32T>jx2yFcdxEjMR|t;bM$vL}&;ctcse^Q?nLS1{8%FacX8 z-{bH&cCf=g_DZ{StTMKqA)RixaNPU@gqgSO;5cWgGTJcd{pC^?=*tM5Tx18`AAo5G zFx&1uGTM}(Si-l~mFjl@n5pe%f(fk93Y7NTuwN7?Ljanra%{V`FkWb7C9_uTR~$69 z-ZkL-Y*mv7z=S=Rz_|rnp@wA51BJ8R4Gvjy0p5UO+g%nU#) z6(#|^KFrZwG+s0SSilbezUVZ7#2nd-3sxfsIDmk(SSQAht-s}LZwjaxPXZ9D1B52Y zKBx40@P5x8_L}bZ07{=o&0HliJnZs5mb!FTWLV8GMZk%rl^%OSoOHMopnxO$*0Ai0 z2J?Qu-&Cq&?9i|_;{gn4*RZ;#9`y~tH|#L3C;^_YJ_58sY)nA}@ZIL&ww(*u&*TM< zUMNw{&%3#_jd0TAHH5wR?fRVNVd&u&%T=n({m?E=v`ZV9!t|G1PW@rj9c>GJ7_9v5 zAdZ66WiAi2ZY^9uAC7{x_L&;YBkXwnfVcO@4VB~yE5}hi0|bRpkhRGdde_O@=p(ix zPThRi+_MCjdzn*eIcu7-npgb%{LridJuduEF)nzmuw7F3e=P^w zFI}-el9}hvdJ9+bdWXl>yaubY#~ahI)hlt;bJWVeo=7l_p#RX8X6X$HPtUCxG`04=QpVQ-2 zdhC~Wv31Budmm(K7>ed%nft>Tr)~7bQ3*-setioRwwB%l1^0nn~lOYd4J^uy#K3X!p z?vWU)Yvidg&-ZJ|(rNuhG}~d4n1^4*?g$!PhaY-}fMHJ8Zo8&F(qP#q2` zr=&M%;_O?EYl&`F7v27f!EG$J9|0{x303o;=IO};z%mSwa2k>3m7huk_8H7Eu-iVr*^A z6brpS5q|h$yMaXEJ(=mg|7pDe@cNx$pH_ZjMjJ!j*DZRARAO@4>;KGE4e4m_s_w^b zby&KsLjPE6hZ_9R!wtwB{&&}%1~JF@4IlU_+%bqz&eNuP^Wa4va@hFFaZeE2&d6z&zP?H!s&j`jiGzmjUiZ$2W^sk`s#?TwvMv6HBLZ2g`r@8jMt(ygIdJSkvF)F}YkZu4d z={!|vC_iz|tJZr3^fWWCLKgSX*`P&F^m`}n_j}5<@4oXQ$p?ynS zLGXQa-KL-+p_hUpU2MqO;=^+38=%(&(mo-&9N;Dq;3+X1$Kd|7VH5HLE??+;5-t(z zIX>N(aYE$Da|<$0rd$vo8)z0v;Ih-BuOvykH$Z*`|2^|(#itjUACDdQSQ_&4i9 zz5tOS<;X=rKK#MRH9JiMz(^KX3OC2=Guu=MtL-@z*aS zuzFwWz3icG_?Pn69qDx^rdV21ZcgiTo8ie10b8i`6k~5}v@>b&65h>5J7Z@fIlrY) zWxma-^9DyhDAIgnf2(J1fUV<$&w3fpi?uvC$N1%<+TFL2l(-z`WbkvAb67Ox>6=)Zm??A?^*=H4b1s!Vj_Hdgtx31O~BToKB{hj$M808 zZuE)hFvg~GK$N_Vag04(ss6ERh)Z*%(V9z}o(y9WQr@s=EEwS|>Cr97Sjp`H`T&S+ zFOTHi=rf5FLgO0tjY{;5{{Aq^G?)LHU<|dkpdfQ2WT$`FEhx@TmiM>mLc~P1AmS0) z^?t$kq9h2z2J^Yx&M+P_R5PO|k|=yu!T@ICleVNJ2B)I1_kP%zV^a zs`Eog*fxcK&`%1YA*7y?$L-FV8Nc-$#`nmM1`CvKfKHh3h#~LGE;2WZ8qLlbt}=ss z!2Cq_hoJW}!T1be-AZcjm&0>&AZ5ele*s1=*5?XXKV-h^QNOtZa=Zs1lO!3VUj@p> zPOMtBxS?x_u6#>f)V@qk^EQFW?7HE6fYZoQ><*3J%%_~04n~|4`>a5&W^stuKd4Xh zV`2DH`U*hWa|>9`=hWIju1B4k%d7iNZw%llPG{O&cR=Jw2wzZ(NA=>}yiw2Hf>9Wk z9*Nk|iKcZP#tg9KqvWorqB);vVQ9^i=(PcMHjK@c_(0^uXkv^wgdTn;5>46>pahDa zj+Fg+Fz_`yftiqan(He$QreD`#Ix4u+O<1=Vxw#s;72KK)2N#hl_37hRR-S^_Mxj#mgWYCk)BfuE zDyz=)lq$iLZe3W5SIf**8dCZg+?qp-)n-%{J54t2eqCceqe`x(<+X`qp()(3P(%RW zs$e5b*kE{u_sR)mx*28#yzxeEXjN}{-w$G9>^}0a`n?yOVP9i%de^&$(d0={ zA@s7p5pVQX#Y%~3i@xkL;cYspDGt0HJ26tkttkR=FbvVKVE}YFdkk^r1n>a6C5qt? z(+~-d<$SKvT{4GVS3qXJCXr&pVvzY+g}Pn-H{tv`<#m3=^@^%0R`rUYsDDmX>657! z?lm~?{oMgm-2k-Jfk=<9Tu=-~MgWuyb{VygLK5iRlDx!aT>|>IOEc&><6OTM`|Cj> z$ITrpcl|LUCip9`?iT~@&+e*poXRJrwm!Z8v9E7-)CtO2cpg@M{8-}T_!3V-sD9q~ zT57+ul(8``z&ZuY-q2C__3eOGMR#5Ya*pMja0Z|P24r~DV?nz%=3p6#Ta;b2nWpvNc3>9NoUZ3*d+Ep;JllRxO}ZYI5EY~V0PaevNg8m9V8j2?Jh^hGB~&$2aL@j)`L$?-rpbiztYwoC)(op~18YcTuR;eTAY$=m zyVmWn6iov|%OR$R7yL8u=y5ivE=6f5OIx{iJcSKjW3MjMY$AT0PEY>)rM%znI6Jq> zB^8>wQG3|xk9Hs;lRxy>sq6jvuX$nW)WW&B^coBrmJ8gk(96Nzn0|j9*WlNnh(ovX z!L;ja&Z@ql);#w(Vk*J?X?A!U$1SnM{2xteM3p&^Q=p^Ma^M^u(_iia*3r`uJ8I<} zp^(*+qa4o1gunNwm%EEt^0y_UkBe3h7-W)5MhEW!Dp=0WAa-OvEZZF9PJm58Ea6jB z)>K&lQ$dSzW&4cs?!P%jb24;Lmjh*=UGHENjf`Q#Q#Dm8@jQFyCwKzFrJq8ZC*BM{ z!R8=(Jy}Vea;)PITilo}hF~xaHh6T0%inn}bB1~%J(3R!#`kbdQY$StJ%-6Ugd>4E z_OlX3i}3*7$*gTMUwFpkv86RK&&=#K3+Ll_aHjKl_y^>^&q=LPhfwBnXU!Uo`qmUb zrry2lBFD)xmF>$*K5}jKmei-!YPwwr5=*b17Sn%v%o_710UX9%qsyy=-=k|Ng9&@5 zA}v09UJ{9*A}H69AV3kfr9M_;3irPXg{b^@6U?7!vuqWF(~~voNY})gj{|-E@1m+b zQr9Fih2Ko|2NRZznMm1ZDN<ITwEy?M4TcTqy#E-Boc>yx&7}D-S|%iuB=%y zJPX%bVt&$WvQPZRyX=o8aVkpxr8v=JSXTnRjOU^d4tpMdhy z{BqbL`cdXFQvQuvDFQ)22Y@QHvC{txCx}UB;Hi6#Bbm`rZyY)3VW6>t09I`I<^_il% zlKegPtN%`6iUp~M$`R)USVV)FdGp1xzU4pddkQVGMmQFw&rkJnk$alutPbJ&)_vYpAagUadE? z30ljVRAr_-IA%4LMto8?Qbp6-lV8>x#hi0Qj2-w<;=2EDr)_3eBJ=E2nDX3*eT}w( zOf^4_YggAlc5dP`v~q)>67!2|3ZeV|TZV+4S$G4+Gqfj(U{E^XMuGJhgQKG{8`R96 z37=zQMUjXy)_GiHsZO957Q}U>uW|ClSZ|CMa<;|sG-+&qyvV^jph+m9_n(=`TUTk) z(>QS|?tpd@Ree0SzlU1?U#J$f1eUVqc2Xq1U<*)ToHxb0|Ky<5c!<%GZ88wR8esAl z1&KD}Q4C-FYtRP)`RwjX^JUGVHGKa_&}jIiO13L~%fl8&oGp&}9_&xeLHz0XSn~7k ztV9dYRCuXUKL`bG@X1rI>kII-@DC`3m4Iv7ns(oO&m&f+o_kV1j?OHe!3~x0GBEfn ze|e4&wlUlp4yYeqjUgN;HJkc+rpTF929MzY-!#8bU6^-~Z0Vm2JS^!>6<^OLEI z`rF6uT&CzLAWaheTncA~8}&(4JJfP;{;{BCcjkE; zt*MhsVoe2WXUlDVWkY}MDC+-w!MaGS!#OwTg|2E}=5sf7rEbQ4?4<3w{>PWU^+xSO zuvVRTiPWFDp-dx|n2j<%w*p#wS|$F>;o;SI*5JA##!%a(S{D4a|60$eJ}jcC@U1vM z32wWTqn!WwnTRC;%)`k6b`} zOmb6-Fl9YTU3#Tb^Q5Zo?IpDS#{FN6LpL4tzp0a#WhQC?)#+CL=>Oc$r$*z0+M*z? z{yhpzrK)8FFHN zge^A%lH;|VACDdNQd22me1d}BOI5y(-M)Yb4S_%)J4mWeFny>aGdtk6>kNFo)^it&iJm6>s(>dC_6er)Ym zVirzG;G>?-T7rnN9#h7TpLT%evM&<G6_B4q#C>N-L3AY2t^3{T+*s;+RTPzoQyxfHZVKI+AuQq``D_Ar^M zXAD0^wA7Pb`rg02pEN0=y6%+K&VHv%`+~R?<75`)S^QL##N!h^?Gf9c$z$sT(qHM5 z9Y3vf+n{n|xIWVn88cuo__Xl9hPB-4i%27FlUQ7w-R119l|Jl9}u~`2fPgfaM z)%SFf?(UTC?gr^jk?!tpknZm8?!176ba$6@mq;i`_#S@xe?MQi&prFho>_Zlt+loE zqxN_bFMaZ)W{lB|;KK<#LhN{zom2U<~ae0ZcaNgng< znv|#IqgH?)~;HLa;2$&dU_JUSKX<(iW-Wa*p}P$yv6W~6^3_-{ znfw3oSDe2QgmL<=E^Exm22n7U+%ekLgc<2YpLp~1|0}$d4?QH zXZz4l;T2d4Ja+%04TYj$S@?g95s6IG16uY6X9%7CYofN@@ulw^B`d*d?N$GP83#EV~`gYtdz~hi6hw=@{4fB%K{ksdG;TgGW59wDP_ac6UAl%#%|BECjZmZ~h zRoj88IJD}aDtpXqD~f;13FWB)DTUK(LXtJr)(A0gPdi3^N~?JD;3yh*;|QKrXxV7oI^@I9htysyJ;6$gMHs{9Nrg+ORkel0PDhXmH&O>CO8E9sphjDy^oQUc1u?rvFJ zC!zlk8(Sj@H#jT^X{wHAOytDA>ZzNP-iKed7z{zD#}lbLP5N(GCtGJos!-HJq<=~a zwbxY2k*}2^OZ>Y4R8EB9Mw-=2&{amCOXs-NNzRn$QllQB)9p4ANl0@UWQqTMMa5B{ z7AJjenLX#-xf5w+OBuufsCC0}SN$)vtHQ;-t6B=e!a}erT)K(UsNK~3gs*Lc6Zbvv zgO3&LwhaEA+lA^%7Rh<=Ul6~>@LNP_c2&Hv0vp*Dce8=*%75}~%Mixl6uWhpj=OaG zi(+(cwm;jR+}ht?3eL>)<4d7}$Gxql&bL_;B)g`8K#sWD5}^;ZMmppnuM0PlR>~AD z&*tPu`HM9wDUiIi+9CJ8=-v(|HP&hs!^sxDm4)$?1PTrH=6*U~%_W(n_Bxv_fpv!Y z|M375*q(Y|j=e%#c1C&@9BZ`Abs(B*{^j$t2%BJ|Vo~8QP>Dw*vn2*i?g#@8Qg~Q@ z2fIl>f_v`;R@{=`S9)RY^C;TJKO)s_{tbjAxNj`(1F+N0Cti*KdeOL$82DBDKPF+L zpXS2dJ>&12v|QuFfq|J2Iktj-gWw>XGQ|NWu{LEVcq4rAv~B4iNw&RA$A4V34@r^< zVNmTXZq*5=tH>BI#&#R^2H{IL)x=CsGKIx|YMM;{k`CurcOM*dI9*1xUxE7XUAcC? zB3kH2PnN5QJ`?qC<}1tdnsfDAIsg2N>%ux?Z+U|WiZBLKdf%?xKW3u&fZ;jD{rtK% zn$YGKNxa?GrM-yqN%g<{H~3STT5VG#Nn%}2c^GmMdm7}EUxL2$LGj`}L~{SJpj4?}tfX z$s?T(I@ppUVr`j`rh@*)hjbDJ!^9E)l8Euiz4_e}@!Gwkl0W2s`*>aRX-pwb4k%R!in;=eed z*dGznr3LN!Bz}rfg-g)h=&c_6R5$eZjot*xDByHuJ0^K2QN$h25%eb(t^NCC%cx+Ulj3<10xj6BIh_vbIIYg`Fm zjF{d&&IBJ!!p<#2*zqOcZ>|mIE8(+JFW8dUR;>1>{O=*kz${%dz7)-(nvpLdWz0eS zhQ<+mKaK4UAPc?pH!k`c;}O-I+jV!o0d>WXr_(+;SI^#V=q&8xAx^@&yKdWF(*LSd zAPa)xe1P$UpsltpfF9`hH7H&EyqRUY6L|>#ZK^_;@uqs+W^00+WySjLR!b-+!dXgZ z`l{3a_3u`lzA4~eOEk-rKWed;w{l)wT(sy2o^ZHsIwNRWu>Fm&NRjel8s}9hTt#9u z58DmDITKoYm2 zbn9Pa{GE2}b=$dK17>aK&!_gUp!FjT;132n`OStQ44|T4m000Z*(=9QT)J15ideni zTfF@lrkQG>qRz*8+X$el?&io2Ai$jTxN*wM^;~|jmy&|X1TgJ?NK%C=lP{TzPD8V` zIEw@c`bPo@3h$j+9R-~3Gc_Yo+$S1MnSuWYXo{V?0Z_T-iO5M&cE7YVP#7*2oldSe zGglaG^*en9|HkWBD1fmvY|Ce??uN#Oz4s#}?;E`jS|#7Y-e<9t5wVLbrivI3j87s$7VNZ)i z7b&+F#wDb-GQqZWKa{oDk&_-yJz~Hd*^Ov~7DlnM;%VWif@auZ z*Jw=b|HC2&H}b$ivrY~r07el!-#?6AzPlxBnGC_03GeT@3thZwm;9p4R4&`1e^;!R zbZJTXpM)0w{d^CRj|OC7+4+tY{)RvJxwZzuI~2W|gwB<}+YVzCGz{bW1vgL7p6dMX z*U3L@wGe3K34EjiaX3D&&J>?$H80vx{Jv-Wx7kCmohzY_inul8;9)^Rmj9ir)S$$* z6NXlQ?&gd}-)MH=*8S^@eW)94JWOo%6Yq=lFJRzq`U~7lrSqV$t(;?$!=QXeYi-^q z{nsiTS2yD5lu0C-L4Fy9-&<9x>2=4bHe9iIRx<}(j<-T?D4yhU|}t~MIe$Ies8@69^Zyua29C(a;|(CEoqc*`pYo*?SU8^n>w8jhbAJd`+; z?kU=dc0;qJi(!zZ7yAP;q}t6pvh7yjoKrypK0PEnaoH4`^NWf*==|n5!|u3+k9p@< zgxn2|<4KxExRiG`W_NU%F-D2gW^Z{m6M3@C3a=?N8FgRN2h~w}hOMvcGdf4IQQ5#{ zf#jFE^G7HG>)a^+;w4mDgdn1!1L;~jRhx|;j3d!9wfht@?EE=}MUYIv!^14*u|SO9 zY#N$xu-;y_C$apv@>p{Z6TA-P!3*$Q$;Rc)x9 z;GxpwcHUUN`|*PMl^XP^+O6=P9PH@ZKp@-Jr6e;QMmHjhs~lcN#?Zi5(NlU2n-m%` zOTLocYouNp3p7Cg4E)`d(zy|5LZ~f?n zK#st7i{S6p%9XdpqzF<_?o;P@WV0VEHUpyR@RW?*T4*ZhsDUL>`}RPX@5f|Ow~fQ= zWc~48a2?FX#xqQ1D=a8^Ik&_JhyTyLmAA6*Q4o>2KW+++&c-^I-C4(BnhuHg30j=A zT&ZfehJ!fiYP*#Q;fS65Y6Nf<@+`OGw`?w8hzdjEJo@h2H@`ZYP9|Ee5CY2hr_{Sh z$#`JRn+^|LD&==gmOR{*KsC#oA`9}M+PNb;MNVr4gMC>7NBhQG5MKRqL&@nE?zRPM zj-m$zj}jzEe&WlYBFJI10pi_omUt}t)`YaOIJ7d z`=38SAP}L;>_t^c4fya#A zFT|fHUX>1j;ZIi$Z37V*@^P-eLNWUDm1*?o!nf62Y>b*O0-h_mBax=gDi~nethQj9r0X zEwp}VXU{qvjG~o_)JP8Ky>^@X5VQaNEe}$)*b7aKE}ff)$DgaD?U~aHM;N*T|OP-9mQ=tR{sV=txUB30 zx^QwMBNrSy_3F(RrX=gU?9=fFTjg_(+GTw1O-BDG1JW+iwUrm;((Hx-(znp)jFm{SO{Oqj4p#PrqJlQEla zwoVLU#ORV-n*rPJ1ELc`-s=2$YE|31zuGtWah873^NV=H-s1tm!11{dhVk6;a=T@B7v}0|$?GcvR`k9ysrXsK>F_!6eJg|!yzxm^6%*W6cLX_mMXI%I zgf(=@($Di$z$uMGjQtY^ON@BA;LHFA88#O-ARZgv1}KUEH>zkh0w*CaI&;ntG#Eph zOcgrByJqIdJ~oZK@r5`{`CPIX4N_v|p5R{6!QuPMukDTPZ9S$3Wt&d4pTdo=NH9dp zYuYt!d`o6_PJMKISMGX5%-`Ir&4?IX*0t9shTN2DUYF{pYgepOWz7s5*gUqL0U{(w z)uut6zb;ti0}i!mF<{9nUbiDBGTIyyg+o!c29v!8uW^`B0bIQfB~NQIE}C^@%8Nlc z?FVFDYKbzmOeIJa8+r1c?*lXU4~bI5Ywb=Z78cZt_|ZuWQDmltLFR0kb_$}%xW}_D zW_Ol&dNfLE{DFaj`vf+2XIFY({UH#IPpqJBelD=+ z%Sn^qx4WcJ)U8ZSTFn*SwziV%T85f%|K@W{1YNzW+^UU-Z@YNTp}{b6`)u6`?c=vl zrcm}&q9#>^rcPK4-=ihT*OM0vHjE*u>f)_MdD_UOG*-MA@X#es`%e0&c|xNy&CVUh zSOQovb|f0Jmr9fP^10g}IqM!8?Rz}3z?7Je;MfB!;O4yc7rhTsGs$aRv)uYp2uc&Ulpb#u^0(bd)o_R7e(0`p`$TJeH54N@Un5w{q1)4OI^^X`cSb{Z8ysZ zKx8&&(-VIa#j>zZW0VP9MlzJ>ZE*(s&Lo$Nr9?cKHKRfLF>4W_I_SL!Q{>o^qA#gZ zFgm38jbDg@+4l^I(!mlcW@|a7qTr(}!19dU%u_J? z)__Y>L6IQ>!=yu*K0>mCTSW5)K=<;4J^yhMAlJSEk{xe=%%3EJKJfK!UaoLC|IhRB zZKS277)JGQjwAGx9?^MNOXSCh(~^B zPtIaIgGFAmiBCQM^ylg(^_&yxO5TREz8a>2dP{SCk+ zp_&Y$9`Aiajh&XNKGHzJOM*;39E)gqpckoL-#P_1e;9lp!`f#5jjzVq$|`X%A|y{# z9E~Q}cNzAMfmQ@H)oV=L_yuQAg#PJ>hG~85OkrZ4wRANFxhE!SLrg&Jf z{=^?u)pdM;z~Oi*J6r-Y&ZI!Ka?@#q=*^HonFl$5JYE1jQ5An4ViA(|a1!EOBpQW2 z9f~rzuc>&plX%;MY6>CKaM3m~6p?*gN@)SwvbJniLyZOu-9Sj%-a9BO5BqLXAD@_K|zAc7*u& zfJB0T*yj$dWil~*OU*{b=V{{S`hLJ6f6sA(3Cgw~NwxmDB`uQy=w$Wf*Pqcusjo(V zim|6?u?v=az8VccYwopLBU!N5o#P;seyr9IyD@Tr)GiOsD4JnhkQ`)0|3u57Is-v?s=ojDi}U)=i~1?<^Sx*33rEe6o9{GTqV z;V6*yKGo@Zty`6M?_t%i+O>V#dKl);1IWrepG0bkVpbFqRw2u?PC=XU35{M2yPW7z|6ax*fG{Z6!$s^QB#*F%&o7DPVkR;*- zs)~(FJeWC!CRH>xBj5d^+E>6kK=wIi7UVb(_|{ab-fT=SA%v&mTp+F8b}qS5MssLkQ`N;lCg38+Y0m^xHkh z_CgsC)5t+LbjQpn~aH9xOyljNoO z89^Sm3W#Y+O-=jW>o*!hAzIqv9~ZU(T>wQcCpvGyjf9l^4AD=*_+b@(u(P!lORFJ* zJwVUn+daVb=Y$_I3h<=xdHyj{xUkAc2aOdT|DgeEbz3@qJ^_~&E!Y##_Y4+S(Y#CK z`6EH#WJ$``3&>j-OsBpPglS` zZBUKGFU&6^DmC^i*p4hN(Z*YEKm9SHQLp_txV}VS-RiAbFKOgC2x1O!yTU10zMZc* zC)BXZfxkXQo@hN)xXXTo!R71k^16)^etlq{=7AuGGhBMJ+$oM1@_uyAAz1~KQ{MrC z_8}lzK#cyg{pZ&o(OSR($r;eR`vG!wUO>7AS~Jhif4wW8{W?9ZSn(ZD9y~VzOh%&b zo+GtwTT#yM!@v9g>a6cL!l%U^z=!v~U;1S7&<_gZM4|l#sHEOB75?Ws+d&1!5hjFh z4jAGG8(Tj?Z>lQXy&+??<9E2f-qhtn&$}q(M}^_Ud_PxBRQh+rNsu9k#*Sw44Jy_B zpZ7_~iNj&mn*f^rhoiY}9xRbV6uy&!HxU$Id9bbgI)r2Jyf)*H?e#{>X3_y6wiaCh zEhMifL-PU1AT1~t9CNM=j0SkajRTJ+)2Y>M=m%y7TxYAx7|-2hE1AV0}qbFpYZsZpYpJH;rPw_fqwn(lkfJ7vRmOTQIz%gFqk%9SwAPxnBVeVTI?*wFB*c z-sJsBjo%Dj0lnn!rTT(H=Z|2tiD02QKtB4l4ahIt08!kYvgk7uj_x%eN4a=F5bmFA3gB@VN* zbH#@nttul}Zw4EsxfDY`e@}y*Zr@si(dl%hJL2-K7XiL#ITh(8Tcci&mxl+ol^C}| z1N!{e_LCu|q*&>AYP>LE`)g1g@2_u8)YYxgTgHuXe%r;(ya-}25W}OK9`B({5mma( z#`JcT{BM$h%Sxy~&Vb&f8!-5?wXqrK?WZLTLCx|Qr!9X580}9A+}}bND##@de70_h zR~Oz24nXIRKNAZ!xC6|70D5yT-2^(6+xfWaxlB0~%kdL1Mx+wjVTZjnQmBUhl$lOMk6 zO)=vxxVJp_0o@A(yLY;tyC{a?OR;Io51>e(PI_eQyBtpsEq9bPo5<5fvB`{fv1-(! zp#l>ZxCMdyO3ou4X-;zqCKKp^q9i#^sRoym%S@If&2lUKTr7~Ag%rQ=1y&&~4}sWI z8k5e}@>ZhubXi{Dz2FOhH$94AkC0RJ#znh}jfDkcm76>0s%2prhS=M1Bq{XQ)>kft ze&Y^PuTWXR&DC%G>a|5QC*+cnHgfdPa4CGd-0@M;Y9p+Vumc5wDEs$-<|pu-A0Q3> zu#3!h^1cKu^#$-|y8}#%4r&3d?3+Y4z3YH7LH>juQ)N7{S$ehU-rMix_dUy0;bBC$ zN}O>cT!{m5t29dL3lQuvNq}()aD+|poXX+^fRnJ%R9jmckdz5aNm(_FbX-NQrzH^; z5tKis#NcAmM1zBnNq($CHo25xLcK{uonYqfJJnU*40qIct12&VQMQ2I=f~Un_C5Fv$|OIk;AO)t(?qU( z%pLk&$#N@=L$IMqOFllCT5|7N7_BcvfVDf(T~qhZb)RfIkj;6;MNn~=^jj{G`5864T3WlwX)sk7!XQnt`{BIA zERr3nXSS99Bt})?uo*k`}fWi{A5=2((*enY!|QZ^quTe4~n~ zC>v%RWD=TAdKWA?|ACew+W}ZFS&5$KQnmj5Tde>NHlnG@_)P^G4L43VPAhsIKtrS- z)u7Qhw1RWei9&>w2HtD8xP`C=XoYyGvV@NcMAF&-us5UC5UW?CugcdxaSWb4zJk*h zOI{SP9Lr8&NjAzo8e6mE;`bkCAWbxviqDwxZ3Ka|zd&C0>WjPVFGf8Ayxnx$`=oT@ zhNV5q4F-KShib2hV^_?}hej-v531=522HL{c5Ulk>5Hucq5PMh?+CV^r$2u_Y^>+s zF$=eA{)Vit?5f)&#VWvppT=kqruGhxo};XxsB%L5(Q+ZJb&6|4dJ?c0gN^|e$MM1E zqNrdZ^Ixza4u&G&_yal8puzCn0mhd&BbfJrrK)h*xcK_$ffY3b+EFWi%eSl*#Bg&rr!Mi&2N!i1-b66{Y4bW?bD(t_XPs8krESfbRBZE~s&5g7(lE=( z)8vlHHFAb|h@zQH|IU zDQVM%2Y(XoKD0@B;_xp2*3UE^Hk^<`*$4LE=s@vzcw%gM6s3sFG7yzv%f^%M7>=w= zYbnxjN#j#IWvC8pRHS<}d?Q6UmGP#n^+TzQWWvCbNRbk<8t@q9A?eptxKJcdMjdpv@d+8<> zGwd3$n-|`y6(Hn31=K9od45OpLVp~8qjtO}S>WuZ8D#9)5zf8fw4g;);s3e02ZNHo zMup~1e&DF)(S}gG>T-I>ETaqCi9s(M(#BdWwR2|n2kme9|mN5=Ni)7FgFTq4Wjc3_=2QE#%6o8Td_O?3X zW6cLbpQ7}o;2UTT%=$UL-Y@I40Rk>gn`J;|_H_-A(gW)5bl@0IrIW%UoAz6-u?e8e zq?C&bxfxQ4;@-}`rN>Fuk@wet%A-rQQl!D?*3}i5qfIcrp|~Ev!;KJ-d7xedeBC1R zvS9l2{qwXaP65H{h`gc@HXDIrO6a5%m$(H_oXz(y6VohZMEr1odF||83GM@tot@7` z_pc-(_Y8iAwQS*=eEuuY`A-BL_YJe`ZiA-p%NvZRmW{yuAqFoM1S^HJ%Djl!CkfvN zOha}=8H)8hHn4=YnOXe83XMu4MU{)*mB?MyJC@3KS!U}pN_h{8r0z}>QAmP~u@JhP zN_amsX{f43cEKCHGfD|&>`%v)NpOHQ>WBzo(ddI&g^WtY9SenoodBWgw^}cK0uDuh zijV{lmv(n|lRWgo0L|tbK5`^k5vCMG13Cuj%&B*8=h1h`aK4itU=8!MnoQxq0TImw zfO-NR4*&-;0E-3#_66Z@Vv>9Bmp4xU05#+}cf>F>8-fB^l1Hdo;R?8IN3J}ds3y1S zf-4CZyvW`9jSJ7W>ZdR0cP;h0iGi!vf&oD<&7jSBZMtar@k}=N=dH~}km?8>Hek;9 zV;zQ`p19`I@3Yj`cCHllaAMt#vL?@buL%#$HFnH_6NLh?MT1uDTJ7q~F2Dlb>qk#q z?w7j|ycdQ83G(ppIBW^riB+n9kY$kd zUNd&#*=~8S!;SE^^@30PLz=uIkDAIlJ(IwGu$Z&p^x2AtDeeX>YQy25!4jF0=p7%UZE=k zPts!MpE+VS__fjLt+;-Gx#(-@&n3v|A_~zkV<RY$re9r()$1@0@>Jq1HaM`Xe&dv4QD)L{n9$(2}GlvjubvwNzG7EQA7h_5w zRS5mUbC6E3x5NKvGWKZ>gr~KMm}D-e8W&2JI!6d?@`>}Q7_|?&ArHd8@}YfwNnqVdHj+bN*%@R(;)mr->bLxTIYC=BKC*Or<$ung_F^<%g zysU4{5p&^p`*o+DDPu~JakY3na*r^~oa?q1v|HL#xXp73w{(@boEL2V272PZe%jJK z==<1sofd`ie{X-`2V76Ko1eU4_E=&tZnd=opAx~*$G-9S!;I4b9dBhy4E$gUV(t~q z8|Pu5Rgxo6#+$$lpAu(sqY$kP(ercI+gJo5N*Jg~}Uu%+<_ckU2Mjt<7%@EGxFJB#XbgjToO9VEli;b{ zwNv?QE^sQcTPTrn$hbpGIV@EA?TeYTai2KrBN@0ea`Y`h2elxAk_nbXrs6fE6^jZv z@KPp+q@Qa7@1pTjdEv#H3xykM=Nvmg^q~8ijMz#}xEJlV{j8N0(kAWdzJAHxMm>_x zsCLxYtv`>M6s&_~CV~pJf#%7)*#wA=biUP(ro|@wzRHf0sm4jDdcTiNK-bboDY`se z&-pN8^~dV-dSeWovZ4ua2#9O?1p}94&Y~0~ebbcu^nGkq-kRN?O+5)%3GKYI zXD+|7nnT3NI^@N*Y1b^X4fpp`(o)vTuD`y((VB=aA{w@%ElOL1k)gWg7&p#tZC!ck z!*Xy&PQNW=aXS zYo_z0aH5|*p6+CFC$*XSZztdq0xU%Cbns0yQ=N&X0UR&Vfxu%N-+I`Utz9PFv$j_L zyhCqfM4Ozo0%7AG*hwOCzk%7L5Xof`)tGaxnY8jv1|8Mj5UWYWnH`CniUk^m7+FqA zTN(Cz6iZ=&PU+7=I*MM)Xfk=y8PpMZTeBjhoM=;Q;}VQUBQqf`0sS4?2stXw9Id*t ztIi;Smm@WyrOPA7^B*#7VxJ>+B}D^nUoLMD1i?wZT!=PQH!kVLh9!k8u6qdNUs;jk zd}}()rWmEM$Ac(3w8@kk5vJ74YD@gl#MC&2($oesDz#I?+1B^O#`}ecD}< zcyh^FV3;Q#IN%JmKxaGKNq$B~5#?G<(1Vw3UL>#9%TYD%^2MVxS3!Yj=~^W^8|psC{tA!$@-se@$-#W{ zu#5UdizyqvY_r?&Xaj?)JT_zW!gwqS30MO5Jc$q#TDk!oNe=}RsFgMfg2BKmW(|=U zR%^;%KcDs`OX}w|w^|%9t(m8eb^}@B zw(?}{(#bQ+cS|nkd7F!;j);Su22FLw2>cPZ*Uf@wiBaIq>GtZx=s+C1=h*Zd-3SXq zX|>ox+_!fQnnD<`$|h;V?Q{H5JUa4>*Yn4OP3L-8G(U3WxSBEYck@fN{nLX?=ccQ%r<2N? z8qn|4k4BI)ull31CF6p>o;;&F4dwgc&Y{P0WU0!xsf?{Rg#0{z`}E$u$6>+i=B-ob zW(68gkZ!@s$r=Rl#W4ceU=peUb~b14z)KTH%;FeVQu7~#F;(D^gY@!f5*7oC3Y_QB~jz0s&%9Bi#9kfigF*TEO7o8oI8^(Uw zc=Xr`Sy?61RQ9{38RK#Z3Z#RTLS41SF0`A zW*@c&v$GE}a#CdcR|$z7%^&wB!M53?wDMT9ZKgx$C0Tq??S{<=vPKo)%f8B6Ot>a8 zH~CPt?xLG+*)g$s=qPT{V|3IE?#eZ;L0eK%?+H;;oVMHF+U$m?Bz6#lu5G!XaDK;Y zH)^7BO$+ovwm-J2XX4F^nqesC zui3E1o?<#jd1iUQ;b9^)k+FEF(VhXrcB+K)Q&$%HT*QIOS{H_7z@Ul7AsS)9W>?El zOhxHf_E4;5_|T82GM;2bNpR*Q8^zdbar-+BNhUch4ASb+bRiQI67pduP$8O%!hsEU zav9v3CkLwM?roOOd z<~I_&mY`rb+O9MQ%Z3IGkA1VL0%tS_wK};{G-|J?O~{;d&qfp+*Jbfp1NU512o#NF zBq+PsjF86LY3G*XNU=UAwpq)u;PK)#xdf1RgqbgMD2#o|8o$ZdPklJ%ILTp<-_PJH zv3gd%d&rn)&$=RnUE!5-AKNM zrRHEnMhTmmRo7b6#okFsU_MqPGo$aKKu~Y>)%qP()GW{VxK3q(pGP`ZjAySf zePVB^IJ?PPmKHIlM?Bydty20BsMhh#^nj17M&AB5B@XveO+7xbtfy*M=@VMhu07GvtVIlIxA zJQ!DGto>zIw8GQ$ktlB8$Li#L&LD+y&9#X&?Ypx|U!?C%woV*Vxk8&yTE4g1A(krc zg%_Z%Q73q+ri&CxF|tuJ8wFl<3;R!8!#53U)gs_joEn^uN@o=n=29xU5Y4QtY+T1Q zhwX?Cp~9mi=ANaIhFR%S^*+uNQhCfMwzQkL)+t(4?Wkw6bWzb06DgEeW@5{D=q7v3 z(xPb;#yrKn6AD)E;_1Q9okx^8&CK$|ZnB9+#Z+HuKAE34?yHbbv9T8CAcpN`P)#<{ zG&TWv-rO{f$`tCkOHWHZkCHwYGI8M=ztUFY5Y9?*xKufYwx7jXB`wlP+MeqX42fzs)V6s}-= z6Mk#Xs^vCBu=RpDdCp)X?+Xe-Ui)DwJC_qEhbOrlJAAM+U>!5D!o_d3$kM{!GaEA61uJ=>dC$8T0Nodp zsIjOtcxiF9mXk|PYM6>&RuKd!t^nC>yLz6=X-Ab35D$`)?s9b&3- zKis;V|LG`fUG^jcX{=irE+m`7xuIwsmQgHxIxtmoiY(LAPf4Z95PJlB!r<0NN2=#0 zRYMn&m(CKf9($l-3;vXqD+=Yv?Wox_haXjLF8khNzz!>G0FqgaY1}djor02gx|i5b zSs~BV*(m(aZq}`;KFGG-3W0E}dYDv>g=vi|3}FU4Ydn{Szm~l=-L*J}bYpO|HD!Wg zl!bseywNJV!1fO1M&0Z5ddST2W4lx~**oUUxZ?s}mM#}cx_mSmaGRSfr)W!~5{x1C z(?L>p6h`)~u(88976P!NQ8Y1rr{!YUwm>T}3t1yd>Q` z6>!x$L)ipui`eP?(;f1rRs|-xKC{E+V%cL_lcZ=dU7Ex%m z3G*OMHxi^Dauga^zKZk6VJ{{YaxbaG*)yOewk5Y&ulagq}u)I&^eRfIP zy^M9#;@(|gNVHj>w_Hg9<6WIuDIy`-XlBHjc0&02^0WO#~T!EL;$uu}#nB!IALQ4_GyrcQ( zR<9$ylpJDcmKY%Lli+BK_##*>tAf?tJzl|hn%~C;IK`^UNP`IpwSbpXd`uTQTs)FTOD+F}GEiQ79mTpqBB6#wW2W|-74H-`#cp58IaZdPPp${C z)2Q7PALV+AOo(PMmnuf>ZV({`v)3&dK29vn#`bE89O{UF=s=2r>=r4uQ-U4wG1$e< zePL}pG178kAUhLmAys-MCzCDfTS(}tIvYJANeUqzjVZDc`(OoTBxRG40_Dw@GScMG zCQM%PG|%4I{205N>=iXUau*d*ILNF(m>QC2$8FmbNc_jct=%$`vU&TQSLD!=8N+x-#@@F-M>ap?7k* z2(1||=O=u%(6#R=WMu}+ippqp(Ss^|cRpIWsEkQU+57WNP4f9g9~P;6sThXVwuZge zTX^b1r@k&EYWCRp*yB@Uzl>rNQkG+C1$vDkhG&yUu)+-o?wJuiE`ID1F)iH1eK)ZP zruYp~%B8rZE@HIv9e>6bN*(fRJ_=FpGG{M}Xj9bjt58HK^rk^QJ5WaXsL#eT%I5>e z+_37zCE27*{Ua9RhLM;S5pGKoL&12k!O^&alAKg8ZCr8BaY0*#jV|$I;+FT4xz&>npfGa5x6vdWP${>%AM?=5UZUrh`3|F6-p1xo?&z6#`!IO(s^7?DLP^5U)-bPx*|7g!DkmDz?L2%ttA9@^rQ^lggIepZ&!j z2QKmDKvKi~^zxL>@{zo{UFzOsC0r+)N2~&fLpR7K%9D;&HIq)ab7zeN5~}M7&%R9* zg~Iki3jI9b36WAH(kG(_A)3)9?`%wkB8e)XQYf91BB0+3#>+!3tnLrCkkW-Z&$87Y zK{3n+MdHtO6Q*INV9eI@p_C`oP;oGsb1vkVn|iO&%*Qc?(Z@}3;|w}NULve3B*pW` ziS?h%OESpKWE`mW;OOW#8FjzxKy*9syn4=T6ed!|Y6mYARnJwACRMf~wU&Joy+td@ zg4~Gg;%V40E@z}gX|ES3G26C7c(VVrYL$q!NbHi6bdK5ap70h`aK3{g)^5G;!nQ3< z+_BEVOXwr=rHmseegTGItnMH;upzq$v(f{<%!ynA%8{>EsY;Cl>pMFk#pp2$Rw~xu zVG#|c^h9BNSqU;_@j;#0LMZeNngYMDd=ZWPYH5%fou(0D`mhtaNs*X@vJ#!RY$=#S zvDQGWQvSnC5ijQ_T@9yR-+2-95%R1euhcc=G{lVe?n*KC?9(DcSyZfA)?0+7x5o{J_ld1>-7aM$Iwk^Gx?kr!P8DJwa`mM&Bxalas6ZfSPW zY0}Q74(G=pAW;}gg>G{eo1ON=g;iwFB6ej=l2G93;u(7dnk(^R-_fP{+DBVPuEBq2 z)mK`3gp92sPc=qOa5gPDNDS>wPc$^S*lAf9O1S%gU!2z`)fR6~*GHc?Zo+223g9r+Z`M=2>LOQ{rl4toa=Q%j(&dZd3_}x^1ZLDume+&KYaWXGa zb4%2`Biyw@-~b+N+#ep;CdlPlkD8#TCxu^n*V)2aqO`E%M(R##%%3dxZ;R}Ry0HFfLxRO<=e9_s4o4hnguzXitu=-5R!o+np-e%5Y?fSU= zb#@aSpFX@vtw-$53(26@T$7T`kWS$0v>QT!W9!@~T_ zDvNZoYD}3DTe;uDayd_3*q^&-Z%#7yb-`gMWPV0|6(I2|s(-*eV6*&OsL>UJJ07gA zc=j7>q+U5DnQE!Otaa&CYDH5JtA@I=ktjxnE{HwDHYNGFKvTSuXUf!!`YZOTBjypj zGX;ML5pf`t*3`!m%%D@12XqLMjUy8@YBVv&p8bb9wF-$L?T71254)}x#p+UZOWI`A zxo5E+(^3?=d=y6aCU9kZxn zV&TT!JBttus)3jKJ2ND97FWJX+_~1;Y(_yBov!BRV3HR zDct@($~8JOB)e9D-7FB1t4JGEcI3$!Atyiz+SDz{O9T@dLJIe4zt+Bk<<7;qm1c^X zClyNpdHU zsO+{oUiU2Wd$2mjo|w{hU1T8nffRYSrflhF%buw?r}bv@Ki8}hjT-Z^$vVr#zYi95 zSq}G1yP^cPa!jY1rFoO0$gKzzqAy}~>BBk72ZWz!0@E^W2dHQwZ&LQ;a(G7yp~gth zOKo>j)H*M)7YeQ8FMsEqQ^Tp_27}Sg5pXP;ZS6$vrB)kJiq*1`^SaXn<)+nqFvfC3 zR%zLt?R3S9l`q6}hc;IkkqA&?^sEXcr*+lKD3{3zaXSxuB56KrFp{um!CR;k&9#bV zOEm)S9@$S}2uQ*KFW=#NXDtKcQLKVOaNif$ch-wqhAuCStI8qhgl0*d8}CFhf=aV! zat<#J^+kS6iv1p~J9Wy%k`T(jTUD#eu`oBxJ&2VPb2v2+i+(2w_NV)(337SkBJZ9h z*c?j|Q}KL7Tj_RlT?sC{G)3*9S0EAfF$A1oU*IGhVg8|6d=4w0mxI|U?>md#tKzL4 zEb~+`5Kl_55-e|0(P921+MRsNg2ff98fJRjNA#nRJ6fTkISoWY(hW{}dCst8*$83F z25H6}xm?r9`S_$H*k+|;sh%05>JuItz*MpkhNMuAh$mx?mgj4dXc*i7)pU;0l{LZM zPcoTU6Wg|JpV+o-PcpG>+jb_lZB1<3e9v?5eS4h``@>#m?XK0`)m7E~`{Q|);zxs; z6k4|-=q^cwTOj0~??>fcNUMa?KM;o~Ir7?~M5=&h*p&qwDBCJ1YaLNO-AE*lG@;D7 z5;KeOO*}`&s0KyjE$x-H+WcEoXp4Q0olKd=ji=yA z@gplhDjB7bEb5$5Rfw{?-+d(y9vr0Vc+w;#z!Zw#^@W9W@UtJ!X}Vu%RSRJ?8Yv7O ziL^des@rIE5$is-#v+*RQzGCvqOK#zIK*bpG@_`gKB20nd7q-9n3PehK_nw2YFzOH z=5Q^nPH&{Xl1%&}Q&OA?DFx{Yktp&xm9hNj6Ba0+fP_mnIWa7%fiT8nV*T+{Sp~}^ zz#A5RX=$Lu6PiSta8c{76X^!7N}?XxGVY)(9d|^=C-1w;{3=zEPu||4HUez6$-46b>dKkwCk&}g>uDHML-6E zPijSk$aj!L=1WEtC&FnB4a63d5hv)(OYZ$D4i6jwz4K6Pi6paPg~&}*`a8=lDyU;h zqY3{0a9gqD;<@;w`>(Wg(&AXuvJXKCcKWUwmBKKMSm#A03~RS&nbMyeOG%z$NE1}X z-~lD(a9yy;?Ql3B{!>jdlQdbven1gX!L0@)Pk!*HKV;t%ShrND;qJO3W`AD`{$Lvp zbHV!@ZO*#KtaKySyb3?!m{Pn zI>*l+KsLXW&Oo|Zl_w_=`eb&QoeV6Nw>ZW_nZ@iN`VKd20F$5t0RSUvfQu z84!mus;#R14P23D*>Zl=P>@f6)P?SP^g#!DINK$v1u=PWk-hRv;WNL5DhZ2L>ojYp z1?IvRSuh9k5LziFZG!Ls1tY2CI9CXPZd4ksS8( z&zTUd`)FW}V4SV;s*}QYahH-VRTLqUumQg~!BT=Ggu<}fn%4;JaIZ@yrYSU(gYJ$R zoRs19gm&=OKpY!Ydc~J>626G$anYdLBZ#C?!G@@r-e8oXCQ;>$9r&~Jy7^;0zMb4-)nhs6krB4qBtsScU)R~a{Ys4VuGqX)X za5l$>x1!}A>~vNd4Q+h}P?iOIbk9cs2DpzzJ?Fct<;7Gn7y`vCQg50tiYg)J^82$Y z8T>niDH_7cr;ECFMswJ9!E2YeWK0$iKP@mxXlC%6MALMV5^$?`>CCK8S+vPO0W#2} zSrmTz@QN$DD2H+K=Tlk;lH$D&w&zRMC#*2$ zA`S@IQhj#yV56*UsEMfLYV8`)$~Q^V{hE!ZRpA}MvEJP0&psMbX_^)R_!l+(wjLI2 zZj_nfF88rlfrPNv4p?1Bxl8K|9tQ*Qpcg}m;B=SgK!wap*}~O;#Q3Zk3smx4*s+NH z-5?MMywZI5IW1<&C>pd4BmWxDcRQ(N*HwoQtJqCveb&`Pgr{}Az4tUK1@m_GKoHr& zPWNANIb;OiF6BV{ypK(=alM!xhgrNgwu2I?CI$E+I01pyC`(SC+VTWcnL`L z5b~=<|`oH*{k- zYp2!I3zj2gY_l(_$!ZR12N$BS5W2`zYoTgb*0I^gGz;Y!5svK)l@MCa3tBfu%W^MD z{}F8|c{=P4P`8jvaL(4zI5wYvc#lJE_Keia^i$B*Qb`cXui{-Yc^jirh}afU|S0XO04=MWPE9@E9+ zM)z1)gkBVUp-i;vx}7yLPV=?{F+CtIHbIy*@1}DhiiUe?L!6@TmD>d$2)_kH-kCQX zN8aU9;5<$B+;XZn#!hjh#zEdmCbDZM3Gn~1SgSJcJ2H*kW~BToKT!c&zHUX0KefUV5KLYS>KGDqf`Su-kMzXCzZ>%KD|8ylOKfm#n@0 zkOdzrZ~`$+v%BzhwC-GJ;BHWQKWeDByPVHzLL3?xn?V6zs)L#`EG?j*_^K5%rVdC7 zYMbCP3M#DFlRsn0;(L~r>DHG4Yy2UbZkFDW8_KW}ZtOX->ro2z)aFlX_6 zMF5B#H-c)Ije0m&AzciEg3{ekbj=6p2RKVDS(KUDqa=b$bFO>m>UT7gx4fGF)|(BX zD9Ud-fnkjJ+9Vdn6tCAYpcO(RNL@qHpZe?wSL`NWihg!|GS(I{7Vy}*ZX(Y3`0csbJ&NJL8!X! zs#kGTF9&Z$MHeO;R^o;<>t8p+>oG+5eP(qB4FTzV5Wdvl~D+^ z3f&(g`UsdgK$1|qMsI$$QTF-?frr!Q{*o(B0^#y+5ZdHJla8?{ffBUM0p1sngWH$H zAQ>xW?(xC}+^tE3LaAnHH}c!0g`$nbh!;sW{1e_MpPt1jp8cP-?rt2yi`cN*#&f+_ z9(mtmkFnxEI}81;RG?1!sfHs{5I&3VK{FTr4)>P!9eNn(FiazXpg zI|(Ah{AdaCx(WB*Y;XYbs?M3lrs5cGYcVlIv&A+K8dQ9`qU@zg^Iy8*v}TG_WXuUy zaTUV=Kmj=CO9RVdx=0i=71Gkx$wPnHdFO*-ZRHH0ZXR5_w6&GO+&FfuOX^dOsiP_3 zy2^7sU#ck(pl4sQpau+LYC5l{gQ_Got<4C3v!v0)Pa=zq!$h+JMO+)clb}_dk7EH?q6*?b3 znMn9VY|+ke^O-{zchl)t^YjfAgY4)sGiO5hV85Kzueyo)slgcGUBPTyq+A^iWP=tt z<7KBo(g;}|yigXrC<+-|hQt(r_f4wyLEf(}<*~=f0C{{<8-fT{vw-PnP7{~~r(hh} zl(bTtYLbzf!bY!JG)SaNnY~ZU{4-*VwQ4ooklWsUZOCPN5l~z_EaD?`h%Np^fh)Bu zLrSQ`Q_V6O4kM`OfY<}$dcRYAZ0Wko%W4M2I+&~Zk(sQaNQK% zD47J!fyvw^S(pF|^+F-sMH^-*?Br=mWAT>4hN+9YUsNGFD~mdN3(IZsX|0uf>O?~l zI!QgPi%F=TNaO;^Hs(hOhok;QUM;bMiN*8N`H~Kdvn;Zm4GJV>sgUI)v3~bsm<;sX zIdyFM-Mhw`sho!8NXf8kni5!~bON@o0L&sf256>75id*DR%;Al+a1H8R(@=b3QOk= z=#e%W&m(m2*(iRrTG?c~vr`-jXkRmHFNzV~T86dOmT8#;e6}^QQ{$4bgArUaO|-Uv zYQ^<7m7|;}MSrS)phg!e+#xHg>B3^;rTmIQg6|a68)hj8L+&x2rRQib#4HX?ldh6R zOdCE}Wzss)%v2^)C1jV|qy@u25>rNF`9dFxpb?z%G*>Pr`Qey`V z!?okSt1O|#K~XPiLTo-BWjHUv@47#xfVvEO(J!0f9t6R48ZWD7%5lPM;x4m?TO=b3 z;{v}1bx1-EH=VeFl+V}E`7r6pv6#Wutg)Dco6`n#-H#W$xTq%X=#T~bh>7EI zY`GZ%hC<#riYVBzSw@YJj4)3lCA@#E&|61V+YbwO{AILEpYlv+SiI7tn3!dgQggq7 zG=w&yTJ2zmSZ*|f1I_~wM{Za>R~9oacRVF)i`7{yt{g+9%#N+ffIUkMO%7Pk6>CFd z+paq{TI`2bMRJj?APdvwZCr#l%^;1(Q{);WUnPV6!H*K9xwuMER50v@lxjn2ioq=9 zi@n69esDu9YL$TN&}sZ5@aiYu4xWOm0-TZpo80Fr-o{$2&YdZ7tU%Oo&;Z9aM#BhJ z+0Mg7)Vz=t)3mJ^bAk7%WlQEdC_+%0V%zO8UvX4jB4+#Ag4W0oJAf4gB=OTERwc|xMN%O=l`-*EOd^%J{J3GI_>_ej zMK|dP)Xi0{!L~pMlm(OMFlwsw#-ec4vOvlN{RN^yePyzY!+6rij3P`7>J2H;qByeZ zBqMe}L4@5|$O)^PMS*hhVxBMp2;&H z?}{t~_#?9TnN-cvk2d*4jNkY*AS6m`M`u~pmXNA{JCznHgM_%~RRotD%guS|V#R|q zw*OJnK^@gx=z47gEHUtY1T{uZsBvK6FK7M3a7|v20(3(TE|~;w4+X%!1PbvphD$@> zF0}>?IZj%8*R(looGBEPdv~FW;JyYYJW#`Cxp>&y_lpXdfRB+V$P>Gw$U7#gw3_Ce z85fApv(U5*L<>c?>7r7}_BdrA4N_!wH{`jMgH@?|T>XAQXS%?yV=E=)U!hBcCPZGl zH6)@1pe+<4IM5Fe)Ox&p{(N@bi&3>U>Di*HGqgN zJ8woaNUR-$!?X~a;2&(kBa==Wpve*$k8BD@usjyJCb$BQz_#@W(Ar(yA*?0xG#7L- zSxTQ}qAWOYTU?gwm%wXSHj{ck5khZfNu_KH)Eex231j6?kcu4SR(94c=U%uc<(6iQ zAl)q#KNUU_H(tiu_bZDctwt$&kxX#R6XrY5AO-DQAp7FvH<5-J#5at|qqLbq*#v0a z_S#+i%(n56Bk?`m zuN2$9!pDt*Bz;VXW(X>R8SRjZo(YmXz>N`bo*s|8nj(GaeB zhGe*honkP0Kc!d5{tq$aBKvgR2FZ2^t%kCrI4c)xPH5%{3*^=@Tu{X&A_m5LB*Rv@ z^?bWMs`5R;>4Nel(IpAgLTnyB)p!A1xHt0zW-*pIu(c<~e}M9~8aFJ@VaoEILSF7Z zF6YrGui~^dCrC7ui(w1aWGZ_n8r9jLxLg1yjYmz}j#3>0B4hVE^n0p>;N}fz|AP+BRJi}@+D#^A+^*B7=cEyN?R($4i?IAeNQ?pxzPJEkz@4D;P zwFPDigr<@AA?vXobDWZjBvJY#N}J)>VsiECc;ep8jig4kXK+K}=$&rp47i!HZiAy) z5H`5CGgkEKkN#yq5-X0kIJN@M{kUQwRxuKle_V~(@6pv=vx?aZZ!{R_OdC9hFR@<$ z<|bR02!?26RtW4Sg z0Rbu*GD+dtI6?B%>^CR#b4v zNS(dJEGysa0ERQ&mN17Z-NFv43|~Se02j(`E6x+C;p~uMWG#!{q5v^_0Ty0S06&}0 zu6kZyQC_8!$Q&%2pwpyaU@-TGglBwl9qlCF#ZP7Gudz^Z;IVPM5*9AjEzQssmk(ek zIy%~LdY@+g1&+N|(~-5exiGlwCsU&asxdu1$?0oQFU`P86%_6d8+7wc9^4l*6_Ph zb^v;L8)-&cWIP|Ef^?~Hy6L1-I=!_F?MGP2uy-X6`M&5uVT+SOIvlShQeD!3W6*+N z8Me!WYBO?U+bT+b2pMvPnL>`+{H!B#7Il$TRYG5@)RHOWxjk*Gwh$k6Y^biKsgUK@ zuf|lozb9#lztyuf_|FEn4kcU|baXPhW)aQEICrtb&(VEq1uMjFEy%C2{S7=?c6-AM zN1rEnjULI#-h(0TFQ!Ui-NOBgY8L6mb2Kkpc_dR}NYe*fnc2mm@urQKjt=_|LBj2 z4AzflVi_)3gFA0F^XZ({_cMI!T|(@d!)}+RXBrhp!vqw3%!Q`~0dGK}uW8XW2oY&M z9zdI+KpU%Nkf!4WVmCWv2V;5QWS!d7Za|GJNonEXM30PQa|+L$L?;DAd2Z2Wq>D0F zv`5vRkdsa1oz6owSK2g|+eC>4C=Q|!uvw{~G0BHnS+Wdt;yqH;zWv#ya= zNX1$RV?|a}zy{q+1s4Sj`7!ff$%b&VYPRrn-DuP(9I`@6NjuSsnzh3PxpCw6#x(7J zwU&Nd+@8t+1YdmqS;OOZE{`!f2}a7`B?Eymdoqs^=&13IgZ_gLcAh7rSq^^jfT`DM zbG^)oUo@pw<0~zw^-=Wb#}5zmIXwoi1&1TF8jc$UOEa0i2e;0#-gfhidDs}%#F~0&xq) z;B88Cjp(h)KaHBT@DDtkMMX5c7Kcv$mn*$a zO=neDM#%evD#mKC-v{6d@1o(clnL@1n8iY<^_9-r@n3R`E!HzplM#M1CcbBNk~=3B zE12A_UQ*~|8C30tNz(-;imq2lV2W`SsiBi#b*@mWupe!pzKU=aCDwZ}F;Okzm2&xE zB@STun%Fc$Eln6INCYwwTEn%ZNWG3JU-{raedv`N87Rrka>0K`KmC4SkT&8_ z=GJ2SNX%H)1--DkrH9;&N7FT-(e-n4Ye32;Ut=~U9v*>X-3wFt)G%(1ifVjbd)g3K zAi1d(gyAyWVk4DO!FuZkHT8U}qHfVI?71gO!v$i+GxAi){VMLcWto)8L?zf|S``_j zLPv#0(R9N0ih^{Lz?O>3NnWSF(-vx3OeS7mrR|ckp{%cD{v*iGt*zzfq{p<>;lsq1 z8x=K{5JqZliQl71LmDvQnnf3kdd3T22@u-nl~IqOT?(AR@fCm(sI|Xq4Is}(j1{vi z9z2C-l*wd&llp!vL1#6ARLIRc;To^$T9F>sH&rU8;i(-#-lw=SX!0H3utlx_W#cl8 z+gEUxx~x=9hhXfNvql-n{$PosG#3e;hWptjvpcOecw$DI#_h7s9$CkY<>NU7m;(~# z7-EoZVn`GwAOMZmpTiT?azD4SN#K-SyErxmbfSF%rn;;Q!1^ESU zQ{ETE0jt7SEPzX$<~t>Rn_JZ!l7YfbNcwFP>3CX(#7RoAvi=NDf-D=lM(PjThSSwi z%1;B+_c;IR)H2FZfPQ=vBS#0trwLXDvFfZygK*!&`F=w`>XfmA#XokAz4Z)!3j})> zNySNeB`HHQCQEA*UrA(d()4yUGv2$h__fz6Uq({^mtkZk;4JLO&TH6>vcwYv_Bcfi zz|60yBJTu9jmG9uV9sd^gidE+7oVb2q9QzGOr87XVh^jq85%|=tpg(r{tj5f9)a^+ zIxRdcG!W{xOS$eD0FRdi^Xj)Cy3{Qb?j;#sq|9lM&#Tn_hiK_Z&n0(vWMU@H6r_Zm zsQVR#Dl&ipm0xXD|@Gg^-pri}QFZf4g<5RjWg$MPl9VCP!F_ zD}{;KipR&QnePqv$s}d;Q^F%FV^lC-Mv4_%vZKx2-HULnj^AL*zl9T9rW0=^5M#Uk zpga>5la3qIu_}MaC>!D|t6^7`vPxg%dmOi-GIn{#3a;&Ji^pYn5>jOKwa86md%wE)`?M+ZNp+ z|CCLsC&goF6tSy7`2rx#=Zrxx_xB|1ReFV1)6;u9fo)Sd_5p*gmX;Hj?lGb(W_w8c z>eo0Gj~zf*v72FL%XE-M56w*xEm-_MFNgdfF;+C$^v=MW`-J`e+C?NiTM@!B56>8m z`to7!g4XXUh zo`LRKb>@?mcRW@Eki^ z8@KvmSWdbQrEV=p1Vcdi5~1uyQ0`tilI|e)jVeRQC@yYl1}{wyOKE;S}J9 z08}U8PLI#S!Mhb_LKR!2fzo3Co&doUh7P(dYv$C}mL7^HgnwY23Uzu|@Q_S>cM3mi z#-HDH&E?Bhp4F_fiFv1J1N+Jc;2UKvsFq9 z9Rf7)BP@(zTE6spzVC@@lR42C;OB$BQFsr1-3t0O-c~5yjz9l#eske(SMQC&s-=y8 ztK{CO?f;ZW`JRF8kaa|H+_B+f=JkG-_kFw1{j`}_rb{d6==dF@QNNd@EYJ7(z>;%S zx-sYU+11J)PbyE2CF%7q;k;Un1`13z8`Q4-wB$ePk``(~B5JVsvz1Dg+qxye=ZS=2 zI#xoqfIaWiP#IFXM@Zg#*&dUxCt+76R>;}3fbIPiW^8Cbw-?4+er^a|588{P5)_S{ z%2UB2o?O@Ny&1tDz3qmz9D#{@7(j8H+JV6S__yyk`noM)3ST%oo_9I6cfD4P9s3;L zT*ro|vi&}MSK`Q2{~nd$+Im4W)#_VUEP9Z;(13}4avRv|l5(K>hk-qP8GVl9uta+uSkV;ev`Ewhq=`eVh z1O&Az)D<%z82a8!CVF{NQ6A<=mg)W3bA~g8K!NSp{7JaNztvB}?irGh$UQ0=uWx(d zD*}nNWjIyE1fHxfK53MI##p`TQ?`8YAxaqG5qMpW3uuXsfw>(1QuCPmy}JMmb@WN8 zqvw+Q#|GtMbjd$Q7SK&mZyKjeivdi3mygWNgL{oIX4A!6mKXX-wKAB$tHKnxD|+H>3ia$pN@f+sHMKUNj3t+1rmy>DXv7N_3k`GP+~~Yx4K%#aO;CoTJu% zmCqi{O2t|=DzWsb%SqDaXmUCSRic3&K#@FOy5q?#s!M%OS;$gerQx~n%HxZ~sMzjQ z4At1~*=}Gipy&UaCt~~kWBZoW^3b@UHXO#>cmHBux?4M2bm?K&Ck@gIDpn8)ImFJ3|Bl>sCpjmaDa&IdWego-Y6G+zfMczY=RE;Jf&_GksGp z8WDpF7J4>PeWnoc@Q0ByKj}x;cD?a3}cxK>OU0cTD!>GcrO7QUQXqGt@hqy z{e3gC)j6OKUnM4WJ#;S6UDBoh=H*M-^(pR^R);7<>%E91+KOY^wGwy~Jt!RHv7-LF z)9M7hYVKX8%k^4_^r3y(Ty#&oa#~f6@wU&rwm+w5`?a;^(?@*`&Ttq_fSV6R>C9}{ z@qSBrmC<3$x?kV;^eWc7_b+s}Zr^u`3AmhF4m322;V9QV>VHhLfYUmG5r_bQl5>uy z7xu9-LQ82)1b^=POsr|)>$?XdUg_*TC;pS}hV}Ji`DM7;ezksn)%C1?==A!A!{6+5 z7*D>t14`Ct4@McGqh8DcUAA)W_3drex)T6P=-eXi-&UZS?Rk_wo3e2S+k71k|NV}* zbJLjnIXU=DfcUkoxj%&(seyv=Fs)hl;b}g_V^fY1%L9Ogclwxx_NilAsac<9E$T<= z=X9I=OL`7>yY^UYAMI!Bh&LOt-^#_0{8PsywOzTYx^LMr;LvIBwdR^fw|`csjt;72 zn!edAxqm^5M*e=}nH04P$#I4kJr(9_ zvnLP%+(;A|cahm?{XYMB(?@=%F1xo^kA$ED`P+i$lbJMrMSlzZ#EIr!e4_7N{9+2XfNPbs^d+q( z?J3uB7JS>ovVO$7Ufox$d=M{E%hQU!_8dJWJjU7T8odRT73VETId&YmBDKh0y2}&) zy2m4{o9@T0nhXK<&fgXT!$-YgC`q0}){QSd@!p^fX#mtcD=f!n3UCGZI=D-d5D9Zc+Fa)_m zC>V<7@^b9PHz9Dfl)N)SD1P8ddaN%=^HT;)tsaO)G_@FfdyEzMxEUDcR^A!k*^6Z8 zJ}HQ#@4OMNI|6F3_qbiIzq5R(frv#vL$lkilR7tm*1A8f&svH|hZSH7{R)RDk62_; zMU&*~{Zu@~cE-lZdh;r6o3rFUQu*6DB`fEgiNbHGwq)X1m6LBCY1u3jhCe%?_PjJt z5qg%nQnTsy{iaoY@<56&Abcv65NOAtD9cs>uB z<+O?_AsSiQ=;SP}d#4t#cNO$wtzo(s+GljI2w+|(G zowP%A>Nvf69Q41;BUH~zq5WlBlrN5ZYRVF;8IR=g3l>F7IYpK6%NT4aLw}N5>)XDk z+|xnv!Ct+j3^0ZM5*ou%Eidd?HWLc^>n3kVM1_>X2UDc{HxT}(n~QA;>?%`&WPmuB z+^l>GYElF!M=p!re(bx}{g?%dn6ByXU}3}8yTddr_vdT&l60`(3$$ziH&tc-v^fA< zRTn0cs3|Bb|2c>o^SW!73NHs+=tprKp_2XR?;XDsK+beoyX{y3ZX5!!00?iBr-MnS znB9|fy*5bS8_{)xsGI^!;zFvM?@QExzVq9C&O&pYuS8**sL4p{bY(;IUie66sSV;mCj$Tghhy78@G4>TSENn(8<7m2g+ui^kg>5DZxWY zbvCw4bWj|L$zyB%eMMH3Qj@|%aB!uE(E!Z7sN4m7r)TMVsU5 zYt|}zd3%rf*G0AGVcRWpL(g|K^{&fHg3b>-b^Y6EL@vcZe(2OiC>2Igbo2#3Q|m}e zP}I2UQh0NTPQ=MP#s3B~qZ9xVQaY7B*c(WfW?P4zuK#VYfFhq~3yXg73Aw!x>f*p~ z0UNo#B!Ndrp{b&7I{aVPiJn#BBF@}=Ug)%IJ-GT)CiGigZIA8VB2)Qqj~RqkZ&Q6M z$kO)Az)kG$o1m2?8nw5_7c`W;ss{xK3#^uSt4c+Xa^aXquzQi+E@x)={^$WA0EJGO zmbn;JS!fc|l4oi^>?ftq?KU0~n&MEg$6hX48FpvdVRFvfsJ^=(vCHX}<5Mc0!l$*j z%W$nt8PXk~!3yWV9Y6pg{W-_XmjCM&hMI0>%+Y#0+dpxuT22_c`Ai`S!jY{!6#%Jv2{u z&FTH#kz%O``Ew$bA=LXIUV^n9l3b?2*w|S6uia2pyTu-2gE`1#byhzMxtaxPd7G{d z94j}K>VI=0i?5tJR4qRa<{6)DXbK9YTx)q&ff0(9Jp;+~L_=?4j|Wth0$O7Mm4jr_ zicO*UNsK2r-+@3sl+*`!cqRkO@bXlrw)@{WS^> zl9`WpAiAro>5`pO2S1jQ>bpd$+uh{!~ebVc%2yWoWfiTrS zJk3f@E~SWb8L75^?Z@QBoA@U!xCF_G06YTmnU8dMp|%(NXtjvx9B^mPflw*0Lb;)i zr@4Z8ayOfB=D~>+vM-0KiZk$Uq=naax%`;!ZGX$djZx_VTO-okWU3b-j2q2`)D*C( zN1w^sSHy2bhai9G>O*}A0@=6MgZMx8VzM`NHUd??f$(sv<>|SGCrEESp^eZg6WQe! zTR=dT11b)n$Z>*>L-ODF`*gDOs{FNFD9N<%#%j)WdpnJ!5D@I%HW+ylAMWjr5ST=Yf$@T^?R_+bOl;Eu!+6G#asqJY=~Z5D4x)fCsgOrWc41Hzan(`t-iz{CjjqW;|JH+rqq%~6@iex~R_DrkC0?)Z z7IDv4_vjd%Sm@uxxc4rr|EGTF-|jk}@>|kqM^iS`9VTQK%;NuvCNu#ZKFD6IiMw2g)t^ea*LP&|a<9 z?*ru&u<_Zg%W<`c%7DA{KXq$1)0rIKm-fD)MYu?eFjAo)E|PJmBjPS>ZfBzf5n6Y` zD(P5Fy;=D@0|J0QLfHlajnJrOTDwwy1op7s8IcKLoDBNGp(14Caf{?g-(K$rm~Z-6`GE>NliTB#`frxs_ZGgs z-$3O4xRB@M@98Wq4U=5gWzE;`5nLRc_pRsd-}e~y5PTlp?w8Fg*-qnB87_pJ&l}Fg zks2Ei)H+NawAs$Sr5{US65fB_s5x|U;A0k)BYdh>fP&_Vx@N(D<9$1 z5deg^_0DGN72#YgFZ|zZ9Gz-_p1+o_(Vw+{NHsU3bWycgY0SYCyIOydTW9l~3)pcU zEvq)V_Z3)t#isYv9<^+*=zmXb?i>}3`uLN%I?ko6z?!k{xtR(RpXDUHzF8Lf_^g{n2NyUs?`a%6tEBgAZJ<$YOb6 zP!1Id~WrO8Aiqt zzc+>8QW715LqTTFdpRt^H`^0zO4?0TcEeUu>-Q=zrrt~Q7knTU0tnf~-cCz@%t&(e zSXlXe!Z9aD=k8ux7eHTr?}e}0Dh+ibe|>aMY~t&3q=)C-QyOQ;X{WvWxTv$7p;t}C z(3byeY==loL#v9ApZsZFqS&U$sv=w(Cq-7YO7_6qQKCFQmKUlRkgneW)G}bVS@pyA zzn|v0PSLjK(@=qTKm|7;${*N(5=&ex6GX<`6h%N*2u7di*b2~552lk&fIt4&EIjr- zu7~Z8ym<-U*7lvVg~Fll_PKA%-EPc&kG_!Ow8F)^9*HE8LSPxu@RlNm7_^-c1rej};X=Kq4ps_I;zQXWsU;D>F)o- z6EEX^^0-~BwmFwd8LZUkK5tZiXVN@|;=2y#Y_Rm!AOIbOe@9Bsw6HuAAq=f;VfRm{ z(~C7Iz)F8>0|*iAROHLReh3c7ue!SBA=3$-S;(q(=`Hgwhb>KsyOpJrU-VE~_bI}P z^hHc?n{O6KE#u+p_RH2ntVr<7Fe0TnE~}w>?ne=1urPLej-^AZt{Gx|&1{};RLjfE zahLzr6$FR%$~!b@y@u$6R4k{a=0OuPrzXAG2}G=5{^4Mo&05cni(lPy`|RuA z%!Ua58i9SN3`%0IV5jE28`RTfa>x*&hx}%E_CQv8eQ4|Q9=W-6!Y6?H*4J)Ev-@wV zb53^1-?j|Z3wuaUNB%QmKh>(x81|Uf;z__^jf}x(B)8kcjZ-dSIG53hJ3cMAA{X2D z>-68(C&&5Rp*Lt(?RPS?i$;UQJnr!YMz+U(=*#vR9c@VnFyvq_F*q;e|67f9=YP|s z#Ab4z!DetyRfhfM-}nfWXz>C{hkTkVvN?Rc9&ZB`a>(cVyaj9AvHgL#?y>*5S2`$KAp}oGDt_u9K~kj@U;Eqb+J|L$R{Ih$p;8+*RFm&bP*zZ z9mLUZ8UDAmz(M0Q9}v0|6izeY$lSQ`M$Vj)gRcF9@FLddw5H?FCz1>9nSljmYt-d| zjqKe4+MWU-XjO&4%d$X&iY=4u|CK2IXw~c6*cvkVw017wwRK;={=p{lh>5ibqL~EG zqSoK=a7e@`ylHcQjTAw9qGExCjWnlw!Sl)(w!|jW;lY5ZxxS^)&WMOsYBsfu6d?d+ z5NK(0nk8SYAt-hQJPwK5H5_;+Jv-5+-htqzC1hGtZQOZa1a4?}dl8J|fuFKqM|ggr zhC8%&E}c}=*1|psEci(NPa;&qjCAHDGg+Z<DRbr_JA;YD&@o? zJ_vD;-x3>p3L)8KbnCq~s&8rhDk8 zzjv*3R@Rv_Gh1ix=j_bHYilZDp_8K{ARu6=D9h_2ARwl^-0Ns4FD=@OozgEque^1Y zWD)9TDSy2@ympY$kU>CbOu=}xLVkIEU&0oZ-2wL2!zkgXU9^#XXzo*IP!@SNGQ1ayhoJUuwPKJ{%9?QP+D3PLT&y^F!+7t zKIYg#NWMLbkJjJt9Sei2Khv{kzp0cu@^>6=go(Pkx+=Q5jyDXpB+Z?-dFbhj=y~W< zI8(I@u+!%hd9}}jJ}K$!@2PiS8y`~qB~3J`h+svp`zi{pOR6(;LoDh`84H&>*ITa9 z{fR373;&?v=6j8n=qI=yIJQPUhPTwKmGh*{|A1}rP)AGwz^~lmXP4WrH|%;wdohG2Qc}_uD3(k z1^%NBoRHLU6+yB**hHypKI$>qD4R*hU#-oqtOhX@r77zBdj6o#T}K<9k1h68$f7NJ zwCKrJ`q@7R?xyE7GKpAsjx*8}7TaW=SAFo2>$7wGC7Y>Dc>j*%euxgrt8gCIyuMh{ z$EM&%Uxrhf=aCVA`BF9#0*AgDL6Ot=#f|_1)C%J3VsUjKiJM6}P7l#DyXyd&j#8GNbbw)A_af(q^+2)>Wxirrw&E|c%0sR?<447U z)lDj9d%ul@(M6I3>c1M)zqdB%pd7PHfgWS}${j~?SyTyl@irtbZipdgGbHVth3CzM z@9V_t5|(-Opr328D+sjZD{P!g#5MgkAdgoZ*ScHU-kv>DQ!e{n67i~DdW4-Qu4Bc3 zJ!7{E(D9SZ@lok&8` zI}gG)B{_O*qfCQ&9uMN{V6bFI*uz!?k3^G`eDh;$q}xr6R*m^BjIo8^n8&9Ix&fW&*H`xmS4Tm!S)p?bL|9?5eq zlX~F$_!*G5;;VDE_S6MzuZKgRt^K-v_t(d*(oGO|S5uaPXX;A1jj*f(SArSkkdrz* zk0ZVS))(TN^S;A2`bw?gFr{55`)h!6SboaH4wwH9gO%@C8ddiv7z1@!JLTB;?LoKq zTHyxUb4{!QH@iE_u2(P_ib5M6NH1*XWKQw&5Sz8>{UL!FNj4&;nhOf~kc!Y}j2Ntn zfoyV$RgiGZWmeQ2^<&xhS4xMb)+1nw-S>a})&g0aPxiS$z$$!CNn4qi`&sv7aZ*Bw zVdYfup^pmmgA7Bj3?>VbFQJJ6cC#rQ4D4lSG*vl2OEn;5pfRQd9}(UjGxsh?E2`>3 zzRw|om&4F*9%R-$t5K!X^InW(XDJ%Fy}nkjjCQDy0B$95_G7UJ2N&mOi058xri`kF zdr9c^#;1`6ExE8%@d9-JYBvDDs2qP7!Sq9W+Te&Hr{%4<43cHG)gx6Z3uYMKU2?ta z53ih?nT}R|T*Ji6R?y=>*d~mNgBN6S=fq8UPNuWirU$}s#2GRZrwEHRu8FP^+UM*zADsAPKWNz! zC*S=_cbetiSe*WCBy#Peor{eBwI6bEV?%O96Zj`Pl%24;#ho!Nfu(>3@>xC#qp0{x z1+h-Kb}^>EqgC1PSjI*acn)t#XPc??C4+h04dHn2C|&CuH^mHDC!*PvBE<*L#U%dr zmz7wJ2Y4{hZ+mdJ1LD-!%(HK#HHQL13h0TG-4@$Q+Ulh~@Kc4{-qs#yw%65ZOja4~ zYra28CuqSApD@cJ>fg^O!oJuNd8K$sqn7w5h(otoXrbt-{gvt?);P>?3BI} z{>Lld;nX9ITl4%;d4qKI2MNj8L~c#+8@1?z4mD~&n(w<}-VZDtm)P82r`#fsV1e(w zO@lBCT#e1^lFT^hJEdeDJ?DlkQhCDoISrb~>hmdS?7>0A+PbVk64>mnx)sKWd)9>;QchE_LW=2vBG38l{AayExS3Ts zO+U>eh|JSOZ_bqx?mdO)P`ARu2+Zd0>?K`T>b4JeB_|oH-Z(eUZ za)pJ+iLGwCfw3x}JdBBrbV#+Y7J{7WgIhc{TOmGp0bba##s+ntAE99xA&Og zXeC4a&po*L{!1=PxKrRsERxY|!-@Ka#9A!an zLpr%k32^#sRWNISx!6FLNI(h_l7y#CS_9Mjd{ar_t%0N@cm1+w`}5kgQhV6ACj(QR zmu=tF zT~lmA7u{eg#ki3K$|kMpuF(ishm)L+UZaGqu$w4(4TmzkIc3yi@Kn`oFf8xfQ7l-~ zW@wo(T)5XV@}gf1mu9g&S97uAsB+S}WWO;7Zft4SOh3qbY{dC`Y3@jM*<=`NZrveE z*A7NMI|NR1{z5Cup={70)rhwL!De=rd7SU?s-cgp-m*s$t_Bq9P0XvfB~^(U^VOXt zffy#sL3Ixb^8hjBu6^$hr#E7|?EUZ#?rINw9|751s}HW^&D?D4@ZRjW>K6OqimOMe z$S?1Mnw^d`^_{PvhAjOS1_}Nzwpr1*{KH4Q|9B7lI>nmN>>J+4NXW$ zcWDGGx3@T|^ehPM&W-rSp+Tct3+(Uv=7Fpms8ryYh-}+**1zeW9?<@m+pPJ*arM^i zlkZ8QAIxEp)jL}%)o`$m%l~98K&a&_%qzY|YbZjbNN3l!XDj<&q=WhEzK~)?t|PG6 zHP0QR9%61rxk4Zp_4{!=VF<<_oLI)^71*zFJ1eN*>VkM)u zd7GD_*1O||kDDw+9qD5#c#WUQ$yqOijNVzRQXM8X@XtGhWOl4?^ChwTAG^w!@iWXsf1g|1S-*ZIbO&PsQou@DON>6$B zIi>@CIkhC!nsB}5@+vcmJ*feA!Y7cE(pdRj2wpPo$EtC#QZ79a-w;#0MgmCU$Z0y+ z8SFXSJ0$qPVQ2lMsJ$}Q?K#u16WuJDJZyv<@9$$KiFGRxb`rB+t zFr0b@5{B)oRWv*JO;wb57}uPXXrxVmvu&X^boJt{r}txd+G)7*Z)2&i7&T76dLA~AL*5><;`Ju&aPy}CM5H6ug!0q%rEQ)SqL zbMieN(ervzGy>Tl32#^F=m4wL zr-QS9ub$g*ZLjBqbS>M^8;eO z95N7~USs6WN?tdb!9qm$15d48cTbW&&IV(iP_WjzU&T;Wi9bnw_l7p^)rEqed9)4l z*umHpQdk1-UE#=$=vsE4_O6(U(;gF027d#)-;ry7@POl*euBkXTkDH zvttc|g`x(ly62kBKQ$^S2klae!_2b^-<1u5wHO#Evx2GlbW``Rv&CJ{Z29g)Mn;~a zJ3UJ_a9NICDGx*EqEDb^Mp*)0&Oe4Y^t3F*-I`agmxMj|6&w+o@r1#6SlJL1HCMZO zoSYS_A<&rB0e>Vo!zLE$ctWHY3`!|UeDo^l?o(2vhh&Dn&1If!+;%jNPmK=eB#|E~za_ybhP)OVciU8EER2&2h;+&C@>p)O2_{q6k(Dp=7B@!$oMV%Mky$fy{UY^=>TaY%(+PM?rb9C{ItxcH@!q$ zL4AmkV%tAa$hr@q{Dg1)r{|ru=p(~-!JT>>niB z*_IskVQ0mdq6kQ0Cm|N*6ND!%RPU#rSLZSp&bLZTyFD_Xz7~1{OO4fhF4&0>Nk`3h zQ6E9>MQ9%9_M{t?hjtnL^z|%S9`H?F9FQR92^okNqx9N{`{jJg zq}7gf3o~0|#IBd8=%eL+NzV{zl2uD)|IxZB(5TB0=o3uo6b;lX7!IW7HGXX<(dcq* zM$gD?&NBOTKE(!Yz#+vfgqx1q+z|UB-*2arpLhJee}-SbGjue@4%gGvko-`@y{63U zz06-)4;ri7KofPED4>3GMCuzap)Raw-b2izDS7JbeeInt#BB>`Cm>-4`3KtC$0 z(xWSFI$V~W_*GvRVg-_>M3)UqnBs7?8!e(ReB4qMQ+R8v(9}8lCis2%xln?+FIbQf%rW3}p|*C<)XRrC7Utmq66-i+9KxFNwBS6CztxBisLcmEq(AwFJ*QLjgPt4S z8aE69^SVz$1b6|RaVwa$WxKitwSY)AZK>Iuy@43C@Nfb6_ygBLEPphtx52`l$g+>( zE+$}jB+lFHu2BijAJ%LE>RBT3>vSKdZ(icek|wzBn6LMAk*S?v{24B`@T)1}_LE|MAHl^-W_BT|?x;vN zyDa>%el5GVmSSQ(WIfSvl|T~q2D;O69hJ?HXcWCGyutgcmQRteKQ3rW`AH!|&1Ru9 zRB!;LZ-zs2u0Fo%r52X|W*q?I@2`(1toe=P8RmioV}9M|JCbs~_qgKrCj}iUQJ<2X z;6ieqoWiNK&vW2#PXuiTB?UHP>~ws-w~RKESkbQ7-|1+Q)+}ubtP+AlzNaVxPgv$4 znap!rNt4e$>@WE6QZj^UY3hi-$fiIl1681NYX~gePF26fzw;H;*QnwL6~Pwo>$vD@ zP@%|9B|WAV7n){rHlwhUT5IGUoTcCqNWNS;F4=nLwPh=^Yh7cX>ucBd!=&c2gbPqF zI$N(UvRwuZhbn!~D)gB?yu()S$U{xM;2c9kc0CxxWjRcE_Y;K_PPBSBkp*Y@_UtOU zJu5=)O!&NxW@}xxpX~8c{@Jmu*?|P95o(sG&?zo`nu|BWnB*ij{`pquj;+3ht==yH zF2bo>{k8DWLp)t~lg?5VHC&{TmkK;MX+Qsi0Y~Edd+a){ z#`#F3c=mn*OovShglPF}+Z*=)6QQ@SVWM1Zzq9f~wCjz`O)ba~vlS=%J8)ADd$o+* zoG~BvH|ELFl%h)Gip<6r|7)vxa)xT!rra60SoERJydxF~S z>WJX!p+@+HVeW#MzefYp7)0KA6k}G}$h`vVghuV$@HRz?t9BA7p<-mubk1s}?TCbd zAh!FHr`a1>u%V9@^qkx)8pCQpH_1)ZlZhu=KX%21!PYQPC*>}j3~eZvHEa`S>?{Ma z=y-;WQR#+nVbxy7s&2Rc+(qw>TxnUFr67?_5Ez0-e-Lp#_<##C8~L)&rHYi4fO`ws z|4^9yB}n-y?ci1^eP$!sOsG4hmAAr9VDMEv$5g3R`0WEKk*a^2j@FLtaqhO9S>Y>- zfIxkir)iv4;T>TSjUqw{AqPO;vQY<{mE^$Dc3I5i>Q9OM$wMc*O?19LZj$slK%Svo zUFV#Zyd>j}zM~K4hM(SC9LRA6v-^yuAZ8^$7FG_?L%(;CW#{OKnvC^r>pg=rQ8|4PYR2B;m=Vb zky@{xHI?U%0<^i{=44-DdTeb;Z!Gho`r}wX{_^SkITV;R3J}lQ4Y9kBJoq$o+uyi5 zK*CK1RfjWrz`RxeKUR`b@{B8Yt^_U`8`BAqb*^aqIy`&BA=wpL^EmKHWqOwCDvP#5p-XL70BYF z)>=@56QfqMj|Qe3`bpxGB3w-*QPcCQ4gNKZ_uScPJ_pcv~IH zC6fnhOmw7G3uh3+t@{KB#d-R}^2$V{gs?XfpLiF`f85@=y4%jT#EHa;@Mt_JQd{7{ zhecm-OJExkfnS(p1my+@%a8stT|9} z-fcTF*!?9}zkc)JdK?+@rQ;cLAVmEzOS6J|1S}m0>+V^zeL?4S6=^H?Omp`l=_`l1 zK&e=oyVbqgMhiGzxZB^v+$LPZM`aA@cSEqm^e^JpILV^xH0~uvG?qc+>j;YrGDe>V ze*~Gw%AlbswTK%fPo5m3qBcqj&F$a-gq&>GcGVF-^9 zV4Bp5@b+QCpjYpednsCR`VCTHx*4S2Lk!43O$L@r_M>VPZUfj)e z^;b-y8LGWtMX?~#Ea zxpMIG8XY}l6Gb##NUBx;XvB(XQL(~!cik3VjJKrZbGmszn z0UqMcnd@7=_1|hBa7(aqK=XLt8bd_RIGENCBQPN3%%MGbSQKkKG9-rHW|CQANdXi6 zoJwm;Dg-axEVHq|PV-&vqKN0gaspa{tH{9glQBpEuEf$+`<4+YK zz$uxC6uAg?4#U*d`2oAB-#k`XXk*ycgt4`a*%ucM&Pv276I9V(_=~lf(4;-4&p)^K z22oRmjuWoib!)D>#Zf04w%K1ii}8$5iRY6g4S`8{8V2#Kk(QCNW}8?o(^ZEM8~Y2r zUm4<5x_W;6@)B?58^Y#n*QURjRc0B{vM3ddGG|QwEV#FWy&)BEy}j*KXm&y=GWzlO zrk#$vdb$#MSA{#}$uGQ+!(y;gBosEb7dM6E<|%9u>feN1hMuV!5psjs+cy!p3ME*f zD911IV4${$=?>tVMH;0FW-hdcioCar+(HeZFTBNTAyfWHfoI6<*9kD)YZZ5U>IDX{ z)~Q0p0cN3~&jNhDQ(Y>3u<<_F@?*R*fd$5}!FQ3(UQe?Tn%C0i2lQ@ep7q*OJl7bf zIN}|WO)RQjc%;IV^J1H#2t47Q2}gd_)OYo>7ZdK3sI@1Nr>U-ti8$DeHjzfw1k6+4 zM@GVg;`izxa8NidnmdwjH$^tdyWv2$ODo$#_Q`mjUQXpCyij;tl7i8;)hcfhDB`Wr zZ3yf@&h^6Yw>6qzw^G4yB3OZe`s$EbCuc9gq9~~hxjycZkj5hLHp%;a?-zQHKH3x6 z2HV?P2Y%7nqzxwGB+o5B#-tEL=;&`LJ%U6u$ZbbR1Vo9Aflcd8!|Dg6WKU2D2!kSf zIqm=$?*ts{>d|VoodAqZbFU7zc9C(1!f1v_E|1Ay6! zzt0ZRVy=JLn9ZHuERfYRme+#}`g1rH+X7@3cqOMuDh#CNJ%zIfxa|FsYe>nl9wDQ0 zD+ARlF{me&xpT3;W+90IV{f9$L6nD2LwbL_{&HUvIqmml5jU2s*wK^S@&9s3#9oCr z)lX;x0|P_A^QV|EHHOz&Uo_J2oD*5|f;B`eu@+Z5lvXuGcZXZ;qNLd@gc65;JnJTp zBEM|nh`Y%ohi-Z{q&sK5NmYXABIZ+hBrVE(u9$HpYj-&ukiMQ;Vq2$zqO4g6 zbs|SxX5j@3^$aj1&HHS;4a(s!<3E>LceiMpj*Hr@1Cf^wRuB>##Zg5WO8pL7PGz0z zI_G+b;O8HsZIo||dQ1Zex^hycPwN(S`EgDMrf=fN(bGgsP26MJ5B$Usfm(AbC0=H4 zgzOzu-njNqCo>iATGHTZ!Ww1%0^1H9ynRkAULr;T{7rS1!*}J5>1kE#zm3dC9^T-Y zOaEKJBln8#24r=Ogapq_`TUCzT%Qxq-RWoe+?95R1<~p@ADaLG+ zBZ2AHrS}62McB~=Yx1m}OLZngho+bA2x9Mk=d(w->Z|!^LW^J(r^)B#qa)t)#TG0iOA>Pk$#uWr0lI6k zh&Z>)$qKI%9z!GL@ayb_F6AUo18~IZvhd;;(!Z6_1f}l23BxeOX?`gTSNbJ?BR8&& zSr4Z+jO(_-pghLf1pbH&kwYNgPJ37|H$beN`7UL!Y!`S;9>c6G{^N0_H78Z+NVr~H zh#9Qa!t7_I4wdpE8^LNbo{FyhoNkwN;K-|l;U>M{CH9;>FI9_w#Fm#*0#`<;N98CT?~GICz_RGUMCQ%DfE6yLv`x$(ZY{zeXmFer#$3*eWi` zZVMxA9Vx26A5G0OM;J1yfzErQPQi20J2I=l05qz$qGXXa`VMwL@rXV-Ff{*zQxeJU z{uoi7x7!wedK-cYQz()UTUIy0QmI|TTd<_>IQN^YseD%j{!D#)xvcddUr}Y+Mob3c zER*ddQ$DQx{+*pu3MtR^JTJbDLytEkZ#qa7mPRdxJCr@R*R``wKNMYhPQ0%jVg}jE zZ1x+Em0Jo-nTdfKIWA0u8*eZlH1PdqbjxDmPaGt5QwYx1mWR15E2QGzEZcc-bnb(_ znXq$~DwA9H(bi%Jm^$mq0c!6>3fh@%{Tyq3l01RUj^$xMXAQF zTesjS*6hrg9YPPv+>2M;k|IVQ(S&Sj1Dd(lIW+0wr=Q2E`|VQxF#0uO4(HlN-r{{E zO5EY*uOEgys`n4m$x*y+ZO!RYJ!}Ah%H8cwx(tAH%uUL!_DDIId(a5M{5ndHgt}k7 z%w*p--DAu)=8^_SnlL=Pgx72o6?TQANEOcD_1_M({)`HT#rvZo#T$()Y21g22CZDd zHj5@EB`4l($iDRmypkYF=E6CS^4@c1k@9z+h##0bU?;UN{_RCDSRoK0*(lwK1skOv zh}l~c5wO)20IKAoh&TyWD00zj5_!yy~q@$@Dx{e=|vic4a^}N$d+qMVK)~MMa zahpeSM|fj_xa7B5?CGIQ1cO3&qqz0W`Bd0u)3TdAGOpfXls~<#{wn1dPyWhHrA89_VuyL zdlz)|3bPf?2IUoe)hW=$MTiQI_@Sd1EP6;ZhHH43uZHe2vGp`{l#nKPA^qp=P=y+Q znL(97ULKF}6DfzuF<}mv zrq^ljoZLF_mA~dTysmF^8@E1w_jPVcJ0aay$j)hG$0_L&inmk&%s!q=D5)F+o z%TmXGa7!aM(iK?6o~ROHj*qc#T}wNmfC@+m5eRdy^~vYc{YDyWvrG?1Avm9IH3W4p zH-xy_GX;4c(TEaQdA04#{l!K5)nDnGl&;Q3{E4ahF60W$JB$)E%cQtOP#$>E`z7Bu@GO zn%;Sd(x(Y2GAHp(=uh10D1X9U6@igc(j+Ke&e3qQK-cjJ`xrj0kD`0wQzS^Iw$?`G zycXhEqjP-uGrK!_GYW+hw~{Gr@Oc%J_LAcWb^xJ zuoX2f@VbKvJEtk!tN~N(y_Rm{-b3Nc2g8+f-Pqj%O~b9fVN!zDH=q8NC3z@r1qn&t z$&II}r(fi8{uaW2_dxN@r?~;b-{iW4orkDgZ#^AqLr9WMlNiNskP;^z2obuhSZnf$ z)iPaqj9@u}rYeb6zM-YpgF6$H*`*G7u;;rNYLJn+m_Xp)O>P4-84C)&rWwOZ4M*G;X%MWukSmZI^= zy)3d*A^fE{A!$X&<+fATX6=W)B#Wg5+*D=5b{c$My1@6NH&xv=8(g>oI8%cj)LE&h z_S3v#N(^%O5rGyTi$$j2pj$E2TRK}oC-|h8V|?D)=X|z*lQyqX6M-d^v%fWrzulGa zz?`Evl^5@H-ww)2#k5>${jz^U6JyHzE^@v1hsUW8W^YYvV{do?k}#r*UdCY#dPc3L zMpDg3{Su98Rre7X=PUUrV8HV5PPyqfFd;OhtHFq0U(OHt(|m#u!A!e2p86ZXJ?o^- zK9Si>w-U$!vs)ye|6Ey3nTJs`wo}}X51m@=t?OxdWVSc88wLB=svdyjuY5DjLcdC! z0i1=O1*@`?Mt4Np?5BR;m%sn<%8%{5B(R7rjA*>)7n0Dsz=m0Xcyxhn6lDs@YYtV( zvlic#g8Sp;TZg?*7Sq>?zd>#+E-U@b(pb*9T`aeyRtW;sHbaSO*1!;EH)z#?4JcnT zub7dv&)L;BM&;ekjQyidxU8E!{+;_Yv+I}6`moDo_Q~+Im1bv;wVcGiJsvVvtP`yBx6jd$z@928f@$jj-NT%!|b8u zP7JzSEI>Q=81q2ft)if$?ZKkv0lYKGhiTFdr+f?PAre-%q4F0(Z_kCPgC*4${sMJ2 zZgU>Y$9{&YjxtX58x7Iae?Q?CEd=eY*Yi$*yO2LDM4LQ;UDVAo<88(oNKj6p-qzz3 z;q#8(YA3(%ENg#X+)1MkOXApX&}0|`37f#uKa%NlzaKQQg}ZMZzH29g=-bE>sOckg z3O9i6P-bZ9p5K#g!X0e#WvxS(OqX`LL?lF@VbsMFH?4O43#pH+oZiPDzZpzhO@YQV z(r+OE1u}wq7BAUJB?b)!mc*)#D?mc}jO)1hYrxjc%$xAJ`3>da9_2|H$O5Sus4coW zIyB_$I^Ek{1R^iaE?9ao11@gRLABAt@P53q{Z;w&cKCHtjK|aXk$l~!c|IPA2}!|v zHZ{ED32P#0DfJ$jEG2Lxf8g@_Ove1j1@*Uh+fOB|`P0qf8fm`Qkjufsrn&3jjw@mA zq9m1Xfodi?ZDAdfjTJK(Jd|V38|LFwP`BXYYDy@%|b&@^+puJX>7Fy<=HnY>T!m7rThDR1tU;b<|Lh%pC<3YmC=fVLE!aSe8Q z1(iL`+!?!k*{7gGAFx);jH-=X8%#ZfE1kcyHNI{`;$ZaPOA9viQ{aU2rR+LJEJq>9 z!f1)Hm1K5Xr&C+f%eDZ4Gact^-%lPcwC0Rc>WG)b)KIN1sq%^%nYYVc@sX~Dary6#oc~eyLcepT$Duf_5dh(;+G7s{vBN0La8Y%3m6@o zzlV%Il94^d%PQy)D(GYoD?}FuthvOL$R{#T^Wj(huQ#dh;CzSmJNbLU#;{re^Zxo? z2H-#a3CoZhBl(DvJ((1Rlkp8#1^maAjx{ZAey-`^ zkVW6eq1&kc(RE_`{EBbyXZcr95yK$w{D&$hiG~kdtGvVeJlp=J=!js{=aIPe1~3MEiNYJs+^0)%2T+_ zLI$e6hXhP^(4Y%av9?9@fb z;rEM0KX3Z}e#82&Hxm-5G{@`x$JmL`6rsd{A1#ZTCBNHuq}obSr1HXUhiKNz zE{8MW^}fUK+p)o)7@iQB z$A=d|D}$N)U`Zaz5?KsI`}aBgTHK2SvM+Q3+bs1#`EG4rYU;b3YfcP#`!Anw`Yax% zl3vT=o%{OSNQmM6dSs^-MqsCmrlU^2`yMC72!dj5?f7lD{aIh_%?f*j(&&YUOMg3( zyy7wG`}_RhbbSip$CC0t19m!i%@->)VGhC~F}OeCY1XE=g&*q`rP<-;c0`JuHVoNr z$zhAi!*yQ-&TtsYG&EOXDGK2)^jT0@=yT=#*?zt0t(7Mo-uov-vyzVbiFmI8vm_r! z>h?3I_u>zuWIH38JtA7Hg)ZMufrn)AJA{5)zJ|Y)4Bom^o^31ML<^n;X5fuAY=M>U ze93O6_+R!mAVyrr3im|Jia;@|0&snE2B{PLznz$Ql|jo}C^#fFqy2j?3)4{HuQ}e; z;*zke8#@#deN8!7lNvto2)m@n6ZW7k41d0B;)cI9|JTY@pDm&s<-+0R!r$V#zx~ne zw%wxy4deNof4f;2jKNU2U_$;m7yj&x=V9b`nCqZQ^Q+@(#nkDj&_BzL#5~}OdVa~= zuvEyY4Ndy(3x)iJ8%YZNx9$?SVBC-J&zKmBXiB%5cg`_xCX+QB|`@$}Edxj>kQ(3)VYUT_gY!Dug2Njh*K*9?ATaG^7J9Wz&^zbp=%}p7akCxlaeRDSEd98P z;}`!bG;az+z=hP!$8vrBH_~SK--jLkkCA`IF&Hxcu>&->Q$r>OS{}jXj4*FBd#68R zU?XSr!U5PL^u*LF6WI#%Rma+xuj*e_UY z1g{PJHJOA? zQUZ>;p3Un895upBjQz#{*OKDx%YWrE6~I*_)iLe%t4q=$9|)#}HF+ntu*o-TJqiSl zT=B1igK2i#Vov82GOlXa|NlIEX&y+S5Yu`{txcT3PfkHt1^ihdYghN5I$ks)7)c9O zqNJluD6?yEe@br&I$+Q@g1`Upe*g%jymrD=3j!x+C;C+0s`lw~>Ol$t78gsO2{X;4 z?(>gP;wCF})Bnuj#MCvooMG~SR%hymgT>XA;%LdHV>GBWmxJo)D)w&%Csg=iFm+ZI zkvXSr=Siev7p<&F!Li@?emKJ~Dxd{t`ac7*a!rhP+39m*f{k9ola-F_WvK%Hham86 zYv3lIoVgXu+cB|qS;8tQJ7#Qg<@-m$1pIoP{Qvbh(XP^eITVA(kW76RYMby_OBN_^q#Lj4W38j` z-}I_A_&V$Nn7FBI=&r1v+F~vB=l}E61-NDO{PqrMAQ`&x3$#IhLs#|RN_?4G(1=!+ zQC38ZmNJGG=l{v~fr*Whj+~(6qZs^u-VU%l4{Rw(awlBCQSUidIviC3K_px*{&Dx0 zt4@KrcIy(Yr$HmSMT^R{4o4?Md_F%AS|xvFfK03 ztoIb7hQ%fS9~8V|tf(Uh`%X&@6JJ&NKOp%AtiVE=zPQ5u|BxRk3uSu!B@zcU-(=;D z2>XY$el4B-GS+>2dT2fiPcF5TOA? zwpx*>jo&o2+Fai1!>UX^0r9@l4Fk`dhW3ZY&y#na5_ z<*KWvnOT;BXi^*oOD~!l44HH`MYn65MDta}k)5k@vIevZz5WzsCG(qh#!<3Qzgq{D zTjEIR$Yn(c+48);W5=Gu<%Z+W+!SScyO8IWa`iqS)q;)OD=ht~jPmyh0>!Fb^v{^4 z?3u;6ZVKyP-S7*AzQr-yZJe%89vJ(>j${t&1<>X6Cc7?b^*35AqZL^;YNaTIn?%s|zETA#rTU6zZSwnd^yl#Gu1IW)p#^32BMA zMbC8P51ulO!%;(F0KbI-q~OnVcsFp^CWDWSvL@^ukSJv?@^2u0F~w>$;1skv9+Nl* zp(EGRDbtit9k^UBy%k_`zEJ~+XBVevY-Rc#EBkz$Y_^`rLo5vZWqm)jSi_WPgOI#l zp55y|iI^wZX*M`HTIMFp zt~V!Xr_L^Y+$T8!BoeL<>KdlPW8s8$PAOMvjz>(FKj$GBzjnSgS56*{Aeb6DpPYyE#bon=@Y!M11<2#}y5xD6KE-QC@TLvWYDU4lCV_rRdReQ<&YcY?zV z?(XvD-gEBz-Cxf)Rn=WxyY^nI;-lx;abhfFWeE~fvWDhat4mI2r6PwGH2xqf`?+xb zt{z1J#kR&P(|?1L4-+o_Z8mJE(j^!e5W_4WWs}&z~~|=$oz~yLyIQJ z`gwW?a95^Utxh$dT?#I(uzgk*6zA>D$4+owdHBt)v`Pr%J<_&`nBep;x%*5K<%f$J z|KYmH4tM&_(b&>VHTQv6Q=MYp700ob?|A~WJ5_2VoY1y>JjqN4RlmJTVW4>;fU8q1h3=4dfpgVC zxrra}2kOf8en{YD-kMII?7r9$^~J)EJviTa&;y33dSoBp8FsdXOmzB2A_H0uQXq%9 zC5?MAV#xAU&_^rVd^FbwLQ?t?{o!hZ{kgHdRlyp1=40s7cu}(MZ0M>}=&Firlchm! zx_#x*^RIw|h4IbJ&ucD6ClrM558024BVa4m{;}BiL`%S;};6&Nd3L#?XEcGD0c+G@zg0L zAOCv+?O;GY0%&Lt*+56<5Kmx#)=G6*MT4$vYGdMoe1|T>j7NX z`Z~oguEeR=f*=FH@cII(&!&Fo*|p-D{{(blp1+0*{|0m(LhZJ9w z_>{`Z?m&3CmDld*>zurj#_7(cPlJLdEWz_~!2MfOu{+y-#iYS*#A<#i)@rD>9|x-%4M_B)z@YYF~kK`pi!| zuoG8WNO|p*`o-JEH~>XNYfG86hl!XMu=~j_TAqo9Hus&p&B%Aht^_S9}yS7^>c?Mxl@{s+@scbhf}via1P_~Y52mn zQnq;fTTe^GtDkUwds!g=l(y(HfN)2wcuwxcP(23_wVe1ZI6o%N*o=t-g@!tlS8*-K z$sT^t<6N@GkJgqQuU@czOX8&gch*0d=(9e2sM3X^*)3ESxGasya&koWZy0-Gy<9^^ z`>VSjCa&O>{o>i}KR)L@=v9LpN&}?kdL~OK6WqV| zUsy3{Fv{BE;8Dgonxh0n;>7Y(po#>MhUM-^f6yp%Fp8>QGQo_)_aEDlE@NsilBQ}P zzPnh}w=wdluB?bfyyJRZbZ6NA>1(Tj`wJMo{9a^?q;$~2iQgR2AA++on?py!{SBDX zTDA-hIeP6Ep`*tu)1#l7`%XmyTxE6}aHQkEsKZ_hIPq^>&$lg!a{%=gGcx0`qWtNJ z<*)x0nm-~@NfTjRx=1Qv=t`~eR_J~`#quf}z^_uSNQ6LF=#JO z^rA&Tbpx4^YT>VO&`Wi1HvE0BY{1xJDy2bnQ8gqJ(tsW#fg4!6BgW!xr7?GUHw#Ik zKbgXsZYu~v77N>zCSjy_Sl#sVOJMOaIWTIw=#NC8j!|57`@3X@a*F*9e9i9I;U2RV zRfWI0ci+BYtgUU#v)!gPSd?uLFqmyzN|~Uvzq)I<>X9zh-2*wW)h9R^rp*7q58+TOApug0b#|;tp z{XYseJdc~DFtxp8JVj>oT(SFe)95@u7fr%$JqVcHe?KCy&Ub3LsJ;_Bjg4PtyA9u2 z?m;v4@i=*ixrN`r$g38C83oHjNPsDBdLW1;jT#u}I}=Os;`0`S`yxYQ=s)$9zs?R> z>6Vvt;RfG)%z4QQTy3_E>4aH!3AcKkRQBrUS1H39JZ<%7A<$?niz}HuQ_;YRXMr#b zT6F4x6K}S;ysEdNPii#)Vh7|06upM)VH5Wo0sWK0BO(Sy;JLz1>8&WOe^2X}EiV`U zne$9x*O2w9FDFKu+DRRys?5N8ZVRj_^6zrS$aU@0;8fjoVFp5pT|h?c)GDDs{2|He z6y6-pelzdr^n#GEY{dkq=c&_KslSL1li^*0)u3QNm2|uSSnK7eEdLyRC~>(jlE0I< z$*L`Kxt%WmlnPyqU$KsCd!j~X2dY-=#%7K}i-5QFB_^BQbI`)kxtBPf(s0|VMD@2n zxA)RtMnVBzX3E9d%<`+Kdb(9I%SUnH{CDxg8ABEfCma|4RwPvi%1_0Co8S!x>SY}pPB^iWxn4vOp8lB36#Crp?}XO70t{zW-{ z5dRq7f-$C;dNAhw(x@b$?Sz}o!Ta;Fh2Ieqsmw;0zEB#oC_3J)BI zyoX?{d-MD6ks!@JA5^^%7B?FZp`|a*DpZ>Sf6B#3F%HswuRDdl;-N#`DOTHEt{ADY z@QDZQWE5-cma*uZJcJab8a~Fc3+IdA*9C*4iuzDnvCtI=eD0Yvc+p@o7@IirGn@Ea z*U+k3*WAbT?*1F>Y9gxGKC~N>(OlBq!)AqK)J4cK)(NUXOI#_7e@%ZAJ6}y4Vj-8? zFqdC&v`*C&@+2F>N5zvrQ9q%lnRs?lC-t66r z(ZxL?Fz9#5gbHuu)kZM;aX7J@4?ujz_Yga{E>2$k}M zbA5b#ij2d>wkwUh^I!{Ic@?JL`E@_C$1M-c&IBZS<%NV+I`t8aozFnCeAS8rEcr@_ zF{EMD#zSagi9d_E*oh5x>oM&zxW|fySmjdsn1u_{>w(Ilq`9 zFECL!z067;<$b}!y=B2f@!~V6$%j^jy+lH97Oox_67CP*EwEj1Ho{xg-G))*n;- zlV5t-btf=1RPfP6DID!tE%02x*lMcGqY8fw0q@4uW~8S%T}BaeiBM1A7|~ZS-CD-t z7~7iRP4LqwCyIkNLX!YC@=bz#aai%JVHJ5yh~Cf)?b38|LvDv;kNEC#9K`s_K zEFqee%?-cItM>8kDgJ^AH{=}tuv+|J-|0o(smMuVNvjVYs&}0-4~=GV-`F`7*3XV0 z4ft9Onjm|3w`4`S3>+dUuc=W9NTjskD7~G2|8y+IB5+uIi5RurR;(Tc2z>sO-98h$ z9clK3h3mn-I@zEJX!xkvVC7 zKT`5UmkeQ0uaSJP7kln37xXWH`ZZ88jjVT*{(A0vD@1zp5$JS$TXKW36H*6mdW0Vc zxJg0kPN>zGVx>>Pt}G=Crv~!A0N0Q108doICVjhZjCv+pko&qV|2hAhp<-QTzC4G; z;HP`aQ4%w5d(hDD3hPooBq1Fm<&{!b&CBoJ^wmeD2W$R~rZ0LUckXrH>FQPKW|m(m zZmyL|Z|vmfR``-tev#KD=0um&DF@z-L)!SGV^sDc`2Kt}*`Ime z4_)nH$Ep_EMk1UfDnj~ulm9#rF|aXW9)gPIvf{TtZh!&LOw^H0Kj0v&|2YghI%B(D zvaZggQK(O>Yr!FfZc#elR=gW)y>ukcOv{n_nK47Gvi z){mY&=p5i?8o>$L0e8x=?Eo0Y_k|jK7jmvW;g^=O=Sq>cc>F7sJ~F%T?uILUbh_*5 zl;KXyRP*>1hujcooRp`dQG8pe!qFbN-eD|oBG96AD75^*Q1jNX`g?mKN_UnTmV@%D z?>egsmRsqFvBRP#V2%Rk)q5L7ALSB!Eh8n=IJ_Syq`#@rQ;B(f_;^<&gl!?9``})? z(<<0nSj;|X!6sMEC}q?2`)_T}n0s=%71SN^wJAqH5;sosI|C4&t>dQ?n z@+zr_Hj}3SdMR(_#Yll}lVwMjECBkWO}mZm0dbNI{;tg;9V2ZB#fc!LRPixAvifSq zP@pB&g{2;L3fCd+>b8H}XHSZI@H0i1Y*iY{F$qOYqY>k8Y+lEVbk}x`L0_(jf#=Jh zq5*!#Ms_;lS+yRD@V+Xe^R)Yv+kfi28mJf+rrr!)_-^j9@0c0T=K{HX z$(@+_?O<^L)VZGt$LD@RrmR;xqAQly^4JW;Vp-_xRF>BZ~a@yYDZ5Gg|hV zwC#WoQXG#;e{p8UciG@*^%0Yf60dn1klr-a6sC&h-F8`!Tm0Z2`LMV{(B)e7`6t-lD;?7VI2B~(2DsTF7YMa74&{-{Y_*ZT;kt|vn{J+<;EgP)K zcD#oIWA}$g9fp>;JgoGlF&2M+7Q56yKq|t0khw&>Wb#wI(pmmlL?F0qY*!07j-GNx*=arE zc4Uhv8FDmzHXVWmT`qH5sTcUf^gy#D3VC2egl{t#tU6@=0g-T}6^s!J?bBk|ugqLE zdEK*r+z#$^+g(rI_jLM~)a7viChE1(vE}HT{59c+p&Zv@Zca zd$5bRRmN&f0wx@JnY84K9;BFt<_&5=$QESPi)$!$q#Yh&z$Q6Ek z^ipa{Hi{jm12P0M*w#RjG#Pg9R7}~qDoa)=Z>sDIlhBG?q88Gh-lIcH)q?R9to?NZ)WSUHM(9+ngsL;TEaP zTR7uF)j&e`0e}jew}`Qx{4=z#L33)qSPi^%)SwlJd?HsMhU5r3N{Qnp=_D);3G{D< z;|S9Bgwrhn`NO|a50@MaWp?gsB-~B;->u0UEmT1(9xyW}f+F3}#J=O$oYbf@vB$x?aoqY{XoUTP#>-OJn!Iilw0(0EhwPY<&%PaH5V4|(y%O<;U?F-ka( z39B9YHIQqPHc7I|fOYPT4Z)4O{EV=goTkoO`UNr#?NB?1&{uaPgJ_sh``}s3f+t)U zr^>VRKiaN17fy%aAjJqXquZQO;{G!zU#!s)v(q(qt29u_T~$V61U!M6RY>V(nbHj> zAa%03kuta;-oi4=OYDBkk`^AV?I+tPmE6@(-P1@+Wmk>-El$4JGBLrChj678Xi#!3 z0?>V0xApMxJI5ohnLNwRtYr7&Vr`_fb|4%5StzLE{lJ6w!{qC8Y^01}=Eh#sdnT=ys60we)t!J=*& zOSHz3a-nQeFH@IX*AK6M-BLx8M;O%!lQ1oCSts;JG&H8^Of^4G>Op^Fk?2Q5byHmZ zs~-*CI51Iwg*L7w(`IT}aDuXfN9HAF8I*)>|vE@%M{;D`z{be7qcRMMZK4vLgrLh)gG*32GI`aV z3#TAtzMs;ldU8)nAV!4}031bXj?MgRzeHBk@MUuW(&AxYs2I;nJs#Dw^|KWL{zT}I z)hIX}J8pvI2Cx@zSfiUKXXjn1N_-;D%^fXMj9xC{2gw>S?^Q21$DSEv^34+AHKbRl zKpM)EZu8jjuN;b5W!#Lit=?4YKH+R7LT6ppDMk)Z%t%KFmT@|G`DLgPl>~92;d$C} z@rp|?X2H8Fs#ztS#!?X!gNKKwpfJHt>Q6Wb^mGsJ!gi2}p|j$sAdlcACycugb94uP zXC2IlKA(Y5XvKuM9he9Uy+(Vq9Zq@R{tzx+a;Y>4@b?lBdc8z{>?3zr^}1?fT)*fV zWJoytwKKH4e;2V`Hn#XpEt<&xlsqu7_p6?tI**~Ntiay*fj0@U0vSY&UoP|kpRyi7 z>_s{vB7Snt8%x>>Os+`4J;dbdUD!83tK>q2tQHo-2X)2M#V=S|;`Z5J&bD@bV2@t* z6J!xB50X-#BC8q0Q)M)Oa~x%3PT(t<$H$38O2W^?4D)F%RMq#y|qSa&8NdlLOB?L8;Mnmh{0b7KMeGh?uJbFfKGWvGHdKZ%_x z^K_mDN26DnZ2O(G=3nR55i%u7-^s&Y1Ac!ReM#4?hKO7sNpEY7T=6x1UWO5et5rmi zyxQGsWpY(r*c_wtKBMzu&nblbKotM8hSDidkt^!D zv%u5wZ3{A|F?hbe)6y9$CB2ZOm_JcNL@ez&B?+3=F2XWu0z*I&ZkT12+Xyi}6CF1} zn8-0ab75XAbLL}}aaZU7l#GQ%jo+f*3|J)F_reHRto0%e_hL+rptDPhJ;^Z~CUJdP zK_kAo3A7VIQB^TCwBN1PnPqWW;k}`nh0xi~Z4^06W>Z|;-o|>8b~jXVEJ*M&J0bkz z-#?@XrIai}Bf2Q#ET)Osa?#JMwCm+|3`H=`L?ABw(ISiW=<-qkX*3UGW4ZjPnjvmStRG)_ug=>Swc#jJWL~;_B94j}yMJ#(23q z$9~*6j@QIDi(ZbBG)STz05zmV#E@;*GiX1ItoOxSxLywv=I=I@?svhyQp0u^`P={Cxq;jdiSwa$`#ry9+x)E5oZPuG*;k^`FIaBef` zdf!sKo9$lkC|1wfa>7iuu_pzI_xXAwwE3z?nR{77MTiPd4vBfc5afAM zffc9T-5Q4{f+Ex3?YEKX)>G|j(Rk_P`O;vM=asmdL1`p@=Cg8iV${gI3-Gi%PUyRp z+A0aBS6VXj`8J_itZeoc}mdbtQjt}@nonN;iH3V9BL-F35YXplV!u zTa~G~U!y=iZ}2o2m|Y_7Jl%`2Zm$uRq|vnD3J6!T(@2IR&R2*gMZ){WY~X zI^il(`)7roOm9M8u;M^!MiqeOJclY!{qyJ)TYMN^tUn4GfL_!pS}?~NMq!iG{J3P9 zmQ}%EBG6Ty_vktvN}N>gaZjlN>#kG%s7edDv=%ryXOzJANLK7JzKyV z!rc6)D6!4{yl28O{8$>swf)#p(%t@|D~2*3Kyhp5uoiu&aqOSTFC#Z-%ZQw;2A|d< zLHBBD1|FBp8n~I~X3p;*Kx=Czp~wAho9RLt+QbMd`1rjTtyS#aLZD%tBFbWQN$@Yl zz8&OzeJ^NujpC{IB4WBz-g?p*6RWBVz`*FE_LED;pbb*{gdW-#_$mU=)su z`0$c+FS_wN50$(9Q%>IRf3ciSHRg>9xV*rkQu_SCZON%7ZZTpD&vt_UB#zT;(5;KDVK3gJ{AYh0MV2qg64^&7{ADw;h0howLsVx8 zl_}yry9GCmF4N9}Gu9=QLwG-{ls|_u0xlYUSXWkPnzZll|80EC)i`*IKePbqKwNfr zVV@5wnTZmu(utDM_#E=Pr~-*9=OOP4wON~Sf!%2;mRvETKaoSG!bJf_U2U?O=D}HU zI)dtCdp}zjQNYu<&~)m*fS=#^*vp2LIor@VaO01~rxFId;65J-xE44ZZ4K-CAwV>kkCJl~;rH;-vaQv-AmiS@vISfdAD?fpF5!eYCP!cNK3*q5M@HZru zoeR~(`9zA2j;=8ZmgK_1N%5aVDfHFCeV8L@+8WG;CF)J02+9KZMK(pfJG#v3{MnF3 zUK!_c+kkqsZr+e|J-O`Ayw4)j;dz8Zu_EI60tO!-9HVW`vnk4L2+kUFwcFS1U0tp` z2p`p<3o+6<9cW<;Sqw;S$+S-1zZpy-8wO7l?9~If#OUVJX3aS3Syxq5gm1~1^e=f! zNzC8tZqA~#U~b+PC*oEEN(5sxU-wYxgsF8FDMHR~iCHsF8ovk}*LKEYQy(#Y*iHz1 zwQJiA*WY$`@FGJr#oR3^zi9vWc9l!|cans9G3=yaa-G|g>J#(!Mc#&vsEg7dBg3n+ zG0Q~s2kTmsXsCjWN};15Z%B|PH?U|%tAS*-x`;Q3oyh-7!a2^-USI$Zlh;$R+j7gR ztoG{(U3<}BYKw>%>C2ydn>~#{aV!5LX`dIo>;#==3JP=w-59xSG|yPCPuX4^Rk^aT z_aThYHcg02vVs+Pi451Q;ZCTT-zzm`buw%k3pYU-HBAQ&~o6c4@};^juyO z8HJNrRM4{QI8F9V}elT<8a_LL*&%jNWh`M2mQ| zu7h6dNg-_MyI0h-Q^V(k)n_3&^Q>WDS!W1PD|p!}j59k@#(r6ERPzyy)o%GKvmUb! zVl`1}_ue{^h51Fpo?q_7%Pq!1_vD-L@OY;hwyeXsJ1fl8eTDve zY$*>tYe6O<&iU!bsMZ1Yc!pwh7-c1_qBq>^d|#mbFNXTI_OS%#I6kG1ooP0YzqWyP zdaku3+93RUuRBZD#;n4TNVib**ybV^lFO$BBb`_Q?Z~OAQB~%2%6t|-kY+sl=R@v5 zuw&Nq>rntLuqu`Y!>ehw5o=;AhNKbincO1PeuaQ{;Rv!#5%C6%A@SI%fpC56;1578 ztZ2wy<}aPDY!$d{X7^jY{}`s*wnZc`qL1$UU@ofdU?9N+v+f_AkDtA10#e?WRs4NC zTD1g@8|0wu`Q1`Nv=0xK4z8qWdwK2GDH0*I4}U%yT)H-L6ca>DjLym!&5Uv>zp7oG zvwTS2Qw^<3~FYs&Hip8@N)S%;Qip^mY19GFK zjhOUTA{jD$l6)znR3g+q-rExk+B7N`3HLQB=V8dyBYi7nRp zWhqOBlV`V)wK-6UVwMX`U0AAise{yq;8WFLjc-=YdWOon{%o=%r9Z*u} z$mqoHgZDU>jb2ZV&|jDs({$Q3DA{52!S;ee6ynuBR;*McqmE~6t`-_$gA8v0gGEQ^ zI)49_&m3Vb)~(%~7o=_Z5*TW&;_UQoxzsH@8_PpNL`sc+0Pv^4JmmM68E-nsy z%t0(1xE-)(q^0}y#j|9mOc4i{BY;=&L7b+Tq2uI3l@}+!s|{v+Q=5HBI*IkLTAp=? zbACDpX83IYi|3g()c-rWThCvb)~#E&{XY0#_}^8@3M(VpeS!49ATHj0shIdzzGuAX zp&K~;DhzeJl`gr}E}4j0+~5h`v2^7e1mm(^-i-or5uwLn_{RIpp;i=vBK2Z%35yQg zGLNl(fnW^RiGNss_{C?so31uNDkE%5Iz%eg!nbo2uu3pVX0Ly$D~1l78cVAau4^)a z(BJu*D%_`PscL?2I2!w)h#Pq}m)v9wUa<{(WFM<@DY_3uo$R@rba5Vgoi)o5T>-n8 z+|s~b_-mgWB?|<$l>FBGt<7Jx>kpU-2Zu%0 zA3nz^^YX*Xkhax;tCTYbDCrHtrO5f!ViRTVqrPG$DGRz}gaA%Alz>b_eMUxM*%ipf ztaUn}LD&_;D@bI3iX75VO6h+Zep_1f7}J}Zwv>QT3&P*`nuD@}@exAQe@C21$Pb(l zJl25vho`6UN4E8+z0KJo*+y?8(0wdYFFgOt5UZJTCoe5OV>2^7d_Y&Gfa`DA^DO6j z@^gg?T*afYU@byM99P_No1SM_@x!_5BI@D*qvDs%b{T?$skSiZn0AS!-VgoHzde)+ zXmbnZdg!B)z39GaNVyDiq8rjT#S7wiGurpbzb5zdO8{k_T8NJH=^_gW(a)sQk);u*>1Fdl9 ziH*OL!{hZOcv*tRs3JF97_|RFUExB^=8+ejQGeEvlLXXH744PK_G>KLUtWdN$-7$R zY+2N*bedo+3ute55fCM=C0g$N()~~lv!zY={TQq<@rH^-~KI zZG24}{gN(o?=2qNcs0G{W?%)>;3|3T2Uo&8_MOLtleH#uS6h&GRirvfzNfrVM*jV9 zBmXvnWYXhAmI&BnUVwHusw{Uac07cHgoVYU+6(hnFL&#?>(AkfGh>+?WmQZp;dpVR z;4?tVxlcs2u2UTEWSooRIf@&g-eGuL8uO#zrRw13RZC^@*^7UW)YlO-?T2TA6x#Mf8~GZ2TV#@fXs?v= zd&&{3nd|tse__HegYb!Q>|%rhZF_LBbF|^usdVS;?6#>U^O2tGVXFmydtx*#eFe9{ zylj0Wg_2q5U*2mJHXHCM^Gh6w&kg%tiQ~qYh{AGT!3ixJJG3V|`o^Av>b^fk=t-gA^2M&Y6A=I6f5Vb;+{u0iPWgwSB`s|_O zTyVDL*I>3DtO{b5_bSc&;S$Gfg~W4q?XAuD!_MCt;b~@@36=nVsx|M)&c^S5;Cvp~ zSWGU!JJ*ihGabzq5l=s%=P8zwc2*f`s2O$KeFPAvzEYN ztmbplm?8fjuF1iO`}K+OYnWpj^!*_zGZ$vq4P^ou0TSVvog&wS+J3FZXD=-{d9wlT^&SaT+01e4b zrZso*yFk@o7m7d8Q0x99?8uKM(m}D(;U9CtTG3Br8jJvc+=PF)Ms{#THQ`4t+tv+| zYI*vrjU@esK|=)y+8DYs7wn`qtUn?%smrsQJ$lPUK7q3>E;3o~J||-(+u+8-_H}Vh zzkb1cH{6eJDU~=ll~`A3Z)thzUERS>FAB{ut;>L*_+Z8jI_nnGMzbS#STS!;{O*-U z=Xr#t8}|#M_dRE6Y1lJ9ii7Qee)b(k$VZgxI~qw|nGfIlvQN&*uudyd>~v2_pnY zr0zzvOg3}L18vcNuFoKwU!J7=%`&d(J(304hW&5}mJhq(WCs&MrWI9W?lrdl3%t!l zdX3e2jcul<=#Yk6U?%J&1rQQ^zTh3SrgT*QKLjlr+XzRCS-pu@QOqPLy3elMKxYyH zOr$S1xjYI5`PZxE1+7L)lLy{Z7*AK~HrVfnL5~|IOJIEe<1SCPjai-$O|ILQwScD+ z?jprd48KkI>xGsst!G}`>?^NExH6|Q&+O!?2i{{?Rg&9Q7~b*}N*^q5O!E|cE3@R* z_&=v7o^;e-6#WqGHyakOQ{OM0nc}BMtHC2D5EG0CnDh%&{317gR?&w_0xGa1I`o@i z0Qqcs_p`-Cw`!$fd)kE1oq=A57n?tf(Jv{@^RZn;N7!Jpp?5~5MM{z3_!A4ROQZ6B zIWkr$&2foFqXUEghbxD)m7tx5FJ<`L!wC3bbis2`*v~z~T2!#udFrl7i~ThgWvMP` zN^t?nt@pcx!@>gGBih{>+diw2t`hcK*ilXQdU%TT6k=-(QObklA;E%}p*v?ZA#iHXkQX!*m@H_hH zWEEi>iLc!j-j4^RE3h7dVM2_jMRLjghA@W6(0eBpLK>6p*d|Bli~ph2^dF3tK0p$= z4@R56hY|MFA|Bo3=t9@3{HI{3eOZ&(kk{+O-e_1{g&pbBzoBDw3qfi<4A=tNd>LjV zfQ{f*p6_YF>8T?T1>d^a#UM{tlJH&Yq?}>Tz$t-M4*3O^O+z#81m7OfW>H zwH$t;$NN?fVEnn5M9zYhGz4MW*^&}gG!OJt3=q>mq-e?U6wLEjwz-CqzWobFweHw> zy=_@Z#7zE+IkKI~Rqax{S{%HE{E>_~lbP>vujH2rGl1s3w1a`5^2bR1ZP(+vA$h`d zfC;Dk-y0gZ>dI9d!dsjNf%DE)EsmM*#s=%M5ifu0$KAPJ#DnW4tRgQxe#MH_&klMH zc{(sM^gAhLI#vC8{vWr)jFz?`6y6u!gEQA*uC!lT3P z*Bh30^Wzh40U2XiSa;TSGXpG=?J09;gGqNj;yuL8r@iweLWd-^zq+qp)F@k z2HZA4hFqq=UGOVnukY~M%P^|Z?Ccu`m#Li(HX%=(09U^RJOO+!uW>sgiI zwcDPe1YAcfn}x?FI^k}#W;qytq5FpqIzygz7BEizP*+7IAyjRbHOR$w!KuJN6;F+( zu2PqPlGz*8S-ABPX)#wNZY5|VRUlrjK7eNOriuiWEK5w18am9F+C(=F};baqE<72u!Z z%X?s&j7gYb^Id`9&rL9+VVhr#$=;A7_;6^ zdnZj`2p=C37w*YO#yM@$HWD_n$*-a)(Q4wjSVui;B7jfmiSxfAlkJF+1muM1lTflt zL0B=#flA+G5Z0DRl}J@j^RgE)|eaEzGso-(oSUmkB*~G)YhD0#r|3O^as8vD&%j}EFMvH zmEQn^5%~t2?%pa;Z1wTxXh6g$a2hp-gSVvmOf0XA=-1N4+H$aU==Z@Y92W1t3J}b- z@g*mJSOZd_KiDI5JVAdyKb-1-UB`jFpJ-(DLtnD_TwyR0=I{3?Vjc9WvAmA}1!+6c zevr2)Vix9)X><)ou}xb51-kZE=jnS`Aq+{0KoU)_L(3X94-|sDj0O~0-|&w#QF&qp}WC2d~AT}6RcMEm^6He1fTrRD;SH)+i4~ZnVHa8G0Tt@{A7*JyZNp) zeK(q+x>f-j=@9jhk2xTRSM{cFJuul} zVbH!|$gG>I+x>&|9GxRy*6<{=VozVopSM$XtCxo+u3{egS;x+jMGdo4?b+;ekCTc z?)l>t$0JG^t_G+10X3}8VIh*cq|f?eC|z}m+8^gPbO_MmKJe`>uzmtIS5s>!z`lU5 zI@)r>NTW#}jO2SIUf-<^YE{5i@RYWZeg5Xvf8PHSJ{9X_Ulj@Q_x!%`^!NxlkW%Dp z#d1+VfPA*ND8TR^9-I?}##r2U!Ds<+N)tQb>RAX9+<7R|A;Jhs9GCN5*B13F)SMPtPM8ScCX`#DZH5t~UcY{YQ&SxCbv_MRF!cnin??h#H)ipi- z?eY4KtyIEztg28qX@>75rB%+Mk)e#{-Thk}^Djp6^|SMrS%8kOIekX);c3|wk`|*M zXmCs3jP@6?|3~{Y0-Gkq$Sqmg_9=*Fv)smep911kIhl!0z5CbVk1wrGUZtngGoY4y z2TtB02}~Fz0;@Q9B`VHezW@GT1xL#C_qpkD;ogBUB=8OIIB#v8P&N)7V3so@*j%>0h%L8u#RMRls>C7(PX$|pdG>3chImD7ORO@hvr>7 zW&XMTLPlG-bw6~8k+@S3t-7+aTk$`}kEO?hJpbPW4vjO@v@(KDjWyQH6qZZKJ|KVE)Jdh7wst|Hv>eYyse=B$;QR;z^#&AC7Lb z48O31|HdSQobkL1(tx_ebcjriKZet3uywxxpsE7&U$+NSB#C>h3}7qT1zRGP#GA8F zjp9EJjFg1|MG2z*Nz%_h@x4Qx`+Wg%(fvqM|6e%wmA&U%>t@S?G(Dz6y%P zjQt#M+C}7TUZ>MOiCN9@AH7R)aV;obnswnr5kXl0FlCH1CGimgs1@Ts4TlY;a{>r6 zu}MvahWez@J=YqWtz2W_Kc*5UIY#2D@7Lsnvvv9DU&BD&hkDPK|7Y#P<=WB-?50GK zp#)?`;*D_pqn0)5Df$2Z8%Y{qwv~bJe?7hrO31HO)}F<#bB_HDtL80KjB+<0*!}e% zu}mX6zNTV>#XlE&@5>j#Vs(d=f!V*(bJ7B8*am?=jK63m;l7jUXI=te7mQ`Mg zTg`)C9{wLsUm4a$w07IlB1MY3mf-I0?(SOLwYU~{m*DPN+@&}K*WwV|i#y!(ob%oM z$dBa7%w*4g_Pl$&OBNvhmAZqp8SM4zRZOL-lJ@mq{%65L|LI=`Z^Yl@lOlVC5=yL6 z8=n|p(C>;_{mlCtsss^#ob$4DvdQJ4XOb<}f5%9s^223#X~iWS`^Gb&_(y1A*F@7WNG+1}q~S#hN!N4NDky8oZQ01Ban!Wf zG{Oa2$pBa}MCU(D{TBvY<=(}1H9>4_^^s+*IR&=i*b%B6>#`@g-P7iUwupP%Mml%B zzG@69<=#VT8O`5`JdeJ1s6k8sua&DMZtkxDF7Df3yr?`PQ&X2_h162b`2Aw{ALlGv znzdb|{IFN}Tlfts^5uR)K!_7>BPtB|#Zop=gKtR~zJCksOtd_0fSUS83MYPD1?K8fIa*^id?tAf+z7Nm~9}DCX%3>DG;CpocD14fFnKv(# zOEz=g6kqb+PioxV4l76bjM3CI=Tw_1A=$l66}jJ&Q09(YlX=HE0GYWQ2?19muVs$t z`pho8)sdmLrw`+?6f^i8$R(=nvH7v{2(+;Vr)3^Kb@3?S8h=J9YXUu#vwvb(TbWid zE11lt7qhqQe=JOGrqf^TjFJ8Qmc#A`%0LoojLIDAW{212DtVzP=HU*wxK6Q6sqoVn z-1!{Q+WAE68%*@Dta#Kd>!&bioFJo|5=mgVo3XlxKl3c0RGeeL@VDly6ct@3F>Orj)T(7ENLXuBS*6ttoZ|cy&tUcqB+h|tdk1eo-8kHj@b3X9EbA=%~;j= zx^bl7L_OMSbdE^h?VaR>hGfa6=cWfoH*?=h5s*?zP!`cJpM% zYqjuQh?9Z1q+==A<>2@yOodq+6TdeQvCAhl@*&1dzBN_g*Rh3*#U3;M^(hxc2d%H~ z*bxu>@@LFAMz$}HscOy&LMsW9KJ!>h)WZ1SVj`6-c@`o}(cF5!fgydSj$e5)vksYA z%Qu0MCFg&M-q_CCsZHFrEn;@^t7fx@#r>MIuat9Wlx5IF#JtiuAc1tAi4iOr-z~#a z*L_&||K8TBzN;##q=4v?bN_BfQu$%U6NIL;iu!_hp)&ZOVe`Mx;jv1-As65I0%MdY zpcq^0?Ng-7x(kiE`yG%hO{;v6ba{$Pan zZ-G`Ld5JnhzA1#o;E{3z1(Rz2zKWgV&hb8VQ_-=Ckz7^sQ9 z?f1_z`TF-rH%eNBbl(&+&Q!N-$PmA5!5#^|UkmQIOzPoSKE_QQe@A*fsCTe)+dlmH zv(t26()BaTZ?VChx^lV+skLE0%_fmJwMUW2^ufyx?Ri6)Nxy0(Bmn_z_>VugaiF;%p@5&8~a5 zY?S}44Lt2$#`oPo`B*;Vc~tx4D{4U#ire!p$}{dg3hPy&{>|3~qZ8F3@ISb4%4eT- zesNKv*7wZj=(g71cTVChf-)zb4dMn<&&;k-Yaowp=)eT1sD+MZHaC}UZng=q8$u4h#Ha9_{p2j2gb@I7vZDb6xjcVCILv=O&v);6Uazle zXiyzni5O~kMKjtGE80*|0w7l246z@~_Q)XEjsNJcYg<3`R^3D=4$`nF0ACI-+wj}jiM=0}I%#7@dRzSzS&bRjOTkQvWT!EP~$kUiX z{te&E3aS!k((#6iSmv`21y2TJX5q#pqXo5ce$_^#`zK0rw#J1R!dU$o3?k4{TpWfC zb=cna->FrHLDOJ z*j`4l&09#AkxbgSE~H0M_|F#CWhaJnC=mT*&2>rNWyABJ{JYgwmS8QQ^AnaCEGMS=A9`t= zywfbCPpslVgFNo8+5qf+X z8ildZlOe;&FTZEVCj!70kP;Q_R9piWBP%~5BT%>6V5(~>_(<%WocN3O=L_t0Fbnb2 zq{c4B?+AcD3tEVd!3Z}XZCku52;mWe8{s-MGK=g8h!j#(T8>&Dzss4UaDI#W4aIqM zqQ%E>6nA*9Sai4&VwX&ftm>dv^wHkfucbA{UQerNAt;EBNOk~NT_v6$Le`KPDyzI= zdTq*c{)3GHQYXKsW!~ITQR7W~1XL99TD|TZgc~xiwSkD_FYHeLcw(=d`FBg$UGFQm z7e0b|mwc@K;ei6Cq7&(N{ycX4SUs<24oBmxQ?@)J;kpceX>t%4JL4h7PsS!EkC3M^ zwefy}BvBpnt!={u$5k(q1RZ97&8A02j+^E6~8mK@uBm8jxW~h(YL_nOQem%!X~A?W7y9NyTB1*s%)}&5`us|D~_#?5rrLc_!s(! zXZuhB7JniJ%dLU_kkH!&^$nKTCm!NnyUC`14&Exzw{{)dgMY1Y3`1fTFIXtukb3R$ zOAFc2iB0p+uSQHQe`qmleDl7azFN{3wTXSfjLEu3j?{?3q5>kV{T>#Y3W_nJU(&q} zkKRVXVjm5&Os-3)s~(BA`7QDK)_90IHwkMbR;(gbER!ztI~;Dn=qr#r2RUGOsEazR zl1=Ta)vZu~y(dpzW~#d?Lw0_5mSq0|2Ye;A#-AB?I)}xE)t)GT|^^Fk`ynM?(~A#(yHqCQ~pDtOk>;KZhg2BCpoLHIgxLW z!7>&tSl)WDp=y0!=b;yAbQV^Xxy{88=r%usGQp_Ga)X4)2 zL?Bdk#FRf5hDRyD4}^zIBu;0V^(dVWw-h7R4r`J8Io*vRmn}+)mY}Vo|8^La{_CUf zB}E{!mCTR7mCPReimdyS*|M9j=k8X=^W_}ow)+#AlABM9Eta!I`xgzm^`;S>E_%!a z&H7<*+;9@^7lpx~TSi#PEX^y+_tAa+I%(AKuq;QzW5}v%;Hg4%&jL37(1P>b)5HrK zs9^Jay_5i3J*6~SY<0yLTP&Tsnrp7_MLO{?oN0M=VJPgo$s5Wu#T~yQ&_?X)^YFpR zTfiUAHQWF5?Hl-WhS$M~)qZtt@zEwvq?bVpYt!vQiE>b$$jRG9jrJIY=z4lE1?Tvlq5W92KZW>>EK|%HJ; zbPBPQzSie~>&;ZC{yfJdjI9-#8frrYmdHT}1_J%Xh}glyF`qyQmcbC(B~^ zz#mI5d@sDO+H?Ljp~V11D$b!{seeDH7Fq^dJ)3y6Hm*HcKddU0+;Lt=y!j`h6wlNjw200ODpgHTg^agzy?|YEx7-yFl45by3 z&t#CRUpUnl-!f%DIYpZSIi<9~ano<|JlZ zzizrhq17sTL6#fE=hKF`nDT>ki<~+E=uQ{iZY?lO|G`i{x`|+o$hR9Mi|tVLjD%ZD zoz%)Y%m9?z^Kv%}>5pFo4S>PVTG^H^q$-kxNQz;FgMi)<#+(A8mrZZ0tylkorrHPo zYVHTkMwi^&xq5xZ{Jm#=8QQofLZr?k9=w{Shbg1Z#4> zO`*zNGKFOrzxIQfgFO(b>8_#Pro?0|6{cQYPHRLP4_^58S{1`QZurNCDm(@nUHPuU z-LhBxIA_V{7Ez*@C`pq_=F!b~%QB9>qmD9&k#!h&^{Xz9HJDt2X9`JBaB|;Y4$3Pl zK|}H3Vx6#Pism~vP&S7Wq$M{bm8_~M1vI~u`|o*O4tjQy+ma4{yeTBe{~$J0E% zC?-P`a}hK)I^$l* zT>$Qj_#SG-*J_AcCSKmfhDM%6Yb){n;kP z+nE)S(28ovrx<&0IhXaJIy+#1PjQ5S}tf>Q$YcZuV1F+B~wAg%X zxDtQ~|KOn&MYARVYrDT>?pS5IiwfWzRhA4+D&&sLry$sN(`lhFNIrn&lXJRTwg90o zeqE~#&+YBE1ilQ_LzC`7>bka0IRfL^x+Mee8Sjm2qUr=acE2!G(&=1L`pCbLKHy)cyZb9=oc^06j|YD=bg^8$+%>&Z((plyfo}B1idX z{;5>P0k~Jf<&GL=0$+Wk#R=DZCcft8Wv`wW0_mydWUkgCIcqU znmU+q2p|D%yI{cQBGfo8oi+E2TyhsuG=^ZZ(5Muz0=bUx;SAi5<$NvQicjR3t>i5w#nwds<_RD@nnp1h|o+Up^q+4N~MavUCo+j9cp19rsKE1SymKG1bq+ z1_{bv4u6&V6i;0;@ulsG6`)5-`xkCMw7I&@*GXuCITMoP+IBJ7ZoMU^*H#S`RUJIZ zZ(k0}9s+Rhf5{zqhRqcj=18$#aEF-ddl>&UJ6vY7@r@O3-O$d1QBT*5j_{z(2%5 zdld#fPx)^{fuNMx!k!n<_+$bze%cO%OX1ig$z{--X=kwTOV%#a=5d#+t7+9`(d>PT zT)D(+Aq@#4n#k<>x$n?JZ^pYyEhIPrp52LBwGQ8G`bwpKRo=BGog|Su!!U#1NEkIe zxiN~dr~UKJYqxHV8DMSuAglMGk&cdNq72e=pe4D)Xm6W7C=B9-T4Qrn5jqYZwnJf zIXM9c97;-1R};&#n3kPw>wD|*W0l(dlmkOP=MOsT`L|4IAd&1`tv9=Cm${_ub%>>`x5Pl7bHiir|z)!IgTv%sKA)eAqC!dp3x^#*= zO{5B9>*|8&7+4{^cYDSaOZ!a@QX)Y2B8?+9O35`Hk?LtVLjW=iMkzwA9IZ1>92Oe;S&| z-MZc}IyWV>ThnlD$WnXcB9h<{NgnWPmZOnBYvX_fc$C;RuLs1gJMi-O!N%>IE-5!P zW|&X@iKY1Q46cKVet~xaktLRngX0+Gso{C3^w09o$Iw=m{iDC8v8Fd?w)4uL5)EDzXy z^d7>4^3cz2u5og7qdc+M%6Dyi$=jTbY|)dg>>ld7G{%bOXo=Q?SR5x_WB0dli*u}breH2DAv%n2Mq@t^O3Ij@ z!rT9GP_@@?PnJL~>;qdvflHTL`f(oehzyAekQ^DOO9c_RHi!eRU#<3KBfG(BP?Tb4 z0VO=tN<-MI1{)9Rmwx&Ws}4O~oeWG4sSmkV4eyeyetv0BTztY~kYxV!)_}zH#_aNbv9@>EaszeC5ax6OK&< zec$!Qb^Fz6X4r}R!WR5|t7VHa{vcwO!#tU-QU2K0C1%wzm6|`2tbLe`Hhat~-K&M? z-Q~NkMO6F?rD|cs2x6U;Sa!glR1q7_gFADIg7glZKY#a>L*lNZc|`aqf&qYAf&$e3 z=0mNPKn@hmJCt1EVL-e>t4iQ6De;+Fv1kfOd3Yw z1HH|QJ(mRTWxac6(W_?96XxqpsbF!#Bu^9%4-fc;$4pOm^|e#bf$Fojd*QhQu{5iLV2JtK1@o1fTd_)NE;-%C zL-K?jTkV-w1fNrdEl*TyLl;7J4RoBqt<@^a$1IP=p);sD61id)IwD@GzoIhk9*vs{ z*)HSF&>1NC0eUOeBi*vVPrf!vV##T4W`wn{vPT>a_Vqh7N}jXfc z(6WDB_k`gbb6d&4N7LH|CEqr#s4hy+9NNCW-k0V=Ziw^vmV;gn;z`+s<>V<}>`E)Z zhhwXFs~m7JqPqN`E&B52`Yda{TztFr<$`tPrh9YZqXcmhizy6@WwW0C6(0#&&DR9y zDru(5=#z9G4#jN3uK79snC4YCWFC)F`<231LpIu$#H%%m7%^^mS?!Dr?WxPSS^Ff` zMo?Cl<$e)&GN?%zZ*JZ%@|q10m)K)VO^qvgF`U}h^REBST9~K3Hc-Y08*Gi0ZgnCN z?a{QHTD-RtAR8FX>{fmq|a(3jfetX}*{?qsT zKJbjmN4U%IXVbrVve<;3CdggJOSg@yjhM+n9&%3J$p-SglRk+GD@}484IZ`#-qaVa zDmjBD6cZAhda4`u2~&pWjl!;l zirVX@EcL^{QrSzydqLmuWd2)Rmb{I?4Y$r+fa2WT#WNTG%{lTMzeRWM+tcK|lF<=M zCg@MA<_OiqZ&B7Vpa(zlz;FZfUW{RmaJJ%`O3ZB5&Rx1%ovptzB2iGW7B~!&=EhG z-1gP&Lq6UF(A z5tK?r3On}dCOB57r75$?reJ%wB-cu|Z=_U!^DhQ|2M%I~!Rxi-T$gFGx6=hZS*A(U zF?r~EulN2+Z#IG?{@cbhVINca;5#t!jPT*d*hVz7KM9Ax{8@JxzMW4X-q|P5t(D&N zWSH>0$_SP8f`XC5h25*Xol@|`u#?LuuO zt12X5H|><$RzL4tTNl^ zS`sKp>qSCfF1fVKE?Y&rJfa_FsZX!4lRg3qBdoDu>qfaMroJ3#aopiRv>y@+j=+tb`u{; z96NigRTp*R?$rA?KQmh;YKS_e@oBWQ%wqv5`F(FejqYoMhv|&vph-N#Y|iSPDuZhA zRij;5w$`S5?iJ#W8|=5bu|beSeXI6Mq;E7otedAqR(cyK>V zPb<+;G3!H`@-EyAV*^w`T9=Kj6qnJhiL0NzCDW7Hr?~5sv)b$LzYii}A2>t@cMzmi z8nu28hfgQ@znLuYvBzkh2h&kqG7(euap9OV@0ME^{dQs3=o1+-hk<2o>df98Y~(oW zGI@~-pdC8b_s1|ATbW8NM@zrwH+K}Ji5eF7fAObCsTU?8z3e+)xaXHDM(|e%@xCbi zeFcZvv0^n_lVr8>(Oao;Se9DQf%5q9IB_Xai0N1@yMQXQk2OU7CTZK|r~;hL7HsIB z_Q3;ligxuY+6>pNrw5#cEF=ju>I1FX5JmoH+(P7at%8IgNaVD2B4kBdRB2{8>*CcR zmP(GG7hr5ziUV+h)7S*r(^KD_uDeJJ)O*?1x1Mer??y|h%04GwoRw^(vr=u&P}gQU z?NvfTQn{(rBoCXnpN|&7CO3``Z1mK%`NDjE#4wMgT&Fq8aT`_LcnC8#Lt;nH2hZZW z(X2=zG$zzv-?Ep4SlX^LH&R7sFEakj@c+6SjhP=Pq|XdB*>*j>YZ#H&E)8M}Nmr8S zCm{l^J15Kk%L}85yyBZ9(XpN%*h-TQo{>Enc3{dg@v%48bpqG5Ier!hE_~*oIXdMn)!L+gq+kubH% z%Xt(3e|dXT^5;GEW3G2Dt7Xsew#QBY6 zq|JGCs26|pKXxIb{a*on$=UZ)Bl++dDPGbei@s<+svQZUY{)qOqbu5S6F`!O*z8u= z9+eRvaxoR?C?F92$@0b06#^@X6s%f4n;BJ}nio8M*W34q|I_9L-JS2s_Tj@~>=CJ4 z-`ys#ML7O1nGZv>{}&+4Yy=gmekM8M$ENT7sNz-|aEzkA=V_sK_uf0@AogEIrSaG` z2omn90MY0rK5#bW?C`by?L)AW@)YnmE-x*z6XAvatD3_V8{W^X&LJ4%8~g)5E~LPg z`T@tzmIGV{RSy#!!FxF)><7t?jfYvf%-nnlHMnnI8tj3KN4$V!x!&wC`fGzz-Y)i8feFrT&FfJ+BI+X?_b}YA?f3hiG|>&-vTdY|RA;8jB0G&HsziP7G2zzp*IHH03; zQ?nyU+~p)FzoIn-Va4g4;O9b=dg*tNJv_b&$8eqH(EkbF#BR2c{k0}(|Mq@D9)J}6 z|Ekl)7ALmF_aOmN=_|-}D=~1vW^K9o4LBfjuDc{vwRl__^MJzvVgr>weVYGR*}xK| zeZ+~NvpB(OB5PF{#(ai|(lFf}56QlnF4h_{f=Eb}x&NuFB72ylWil`_M$iG~t?@!V%ei;eB7sr@vvZ>ggA&0Xm&D= z{fbxPRW6lzY$K)T1Rc-msEI!V2i-0S@3&_Nf*!%rKQ?}VRSj{1Af1>l5!mHIaeFaUwtbnRRKeNIz@KCe>e1h@#B>Kx5WZm(T>@qt$#^iBW{Qw=)2AU^+1(IT z0%N-F4I;ZrtyIx_gcuS?(%i*xZctezr3d~k`Bc4R-o(_!ngMCtt}v5NVH z-zB`fgTn{ucB4rg{PezcwCNjC2(y(JD%&!KQMLJx&S{2neu8z1kG1=!2yR=byNQtJ zPQ}~beq^A68{Gy(?>De&y>M+@1^Hi1If@v1Yov1M~k`+DavVe zhsVeD0-}{U*i#F2X>eRU_HBDuPiGGPw1JHaPJqCPlG@y;r}DFzA0P-aEDXsbjz*%! zk4Xs^@atb$--Ik*WGlfuOaE+uPpSytf!YzML#rRK#?mH^gWOQXhf)ovgP*ir%6QTw6?>zs*f%@ zRp#y?mV_dcH8kFddA%)XFzpXLw(UPgY__9`hwQf$G~Q>uiJt51i{#F&0+Ah8@)2}Z z;_zXN|nF9**Q(+ER!Ln^QpIUl#gqH`7n=117J)olr9mWBeGt zt6nK61}GA1N5o$-8l6in%k^f?wFG0ObuV})`~Q@%ZICVC)*D0gxCuNK)aOEKE#iB0 zVJU@R4L-&pUaaq`$K1VVA5bXJJ-aYhsH2Nq7`?KXA7W(sDu_YA#a=$wq1C(zKu+K6;K&CVh9Zzh_|HW9|e9K@|ISe^=sKYaWB$x`7(+Zi@Iy|C5CT+~p7sx3AC0>2~CjedbaB z_d}}4+2iP90wmWSro#U|(Hl943}ABbC}e=6ve+Yq6_*Vsp6cFHCh;w!|EFi5aGvUK z<^21HX^jef(a&fozcBv470Q^_2;+F`X46p8|Ku2vELdJs{}+$Dvu$+jWN#H+T8+PX zQfB;rYL22K{{PF#wSl5fyBw#Fan*|9lHr5G{NG_^Si#;zzMI&Z{;5j;)xNkotuUdR z5BS&+P%pad{wF#a@+a}6p{-c|FVU82=i@fq5P|0aTl0T)6$NDFs^Rvr`1kx8q+R#_ z`%SrIZu9?i4iwRo^8YJ)&`XX!v0A}bDgNhd;#TS+i~!czg=kMJu0Fqt#K;TR&&n8s z|1JI?H_YP=8irr1T4U6r3+G8&rg)CW?!RMO5IuxMM*)i)@PA3jW*GKZD-px*QybnN zbX1a$HXYn^U9P*5!i+|^Bfdkap(txCW-$kFS1-G|PP9MW|5$3QLB(LoFC)YJ6bM(A z7cMi23zOz^&0X4mFW}&wJ$JD7<6;dra6Ie4{ldGV9rEgEZ+|+fIJWN`nz3ysQBj1- zl!p5jj3UyW={5r=3SKF10RIjIX9Xv&G=+zOf8i}REWnWoAXLys`**bXb0`s1?csIob!3_> zg*JqCbjq{{MO3=243?!5k0>IkvuwqB)B;Aa2MqYJt6+h>?Z5U(q3z2x81Ufqsm{Hq ziKdnAS3*0AR=X5HR13fSzZHvcp@~o8xKo* zOx>jjB2mU^(eo3%pPQX_)p;$$xOaqDMJ0QyQS6F+O4ns2_WIY7*RlvL^Z^3o+TmDl)`a=(55idGY#tX`#jjarJLi4oUT)YNKF#a|UHmy_oP-h~`l?r{@gX4a zDq4uXDx&hFDSAkUQ}PLRP(|sZ>NHEGdeCPtKg;r#qfjdzr2fX#QxTPTV?8F$>H64U zHg;Zj_zj%WneaP+rOyfVH%v0stCEmu~vfVM=+)(t4HvZuwcZX8SdP-8*P(Ma(!ayN2~) zdF3i=o-Zz&3qBJKjnG0rQ~*U_rsoEqS#B#gTt~;xD!$)B}!rNfxUnU=kj zBHCtC*x#3qvF=-7H>%Sl?MgtbaBYflzE_J|<6j2c%Skxji%}sw`)dC=0FAw6oK9<| z1Xv0|%P1cU>r1>cW2R=L8pub{h#=621gPtY-MwA9>}TTdrmD}&=&+yEDwM1MkeEf$ z3#75(BnQF_X(>7>sA>D3`3^y}k_%LV~w*BP5GtKT_8(Sy}nU53AqA-cW5Z-kSJroMMA15CSkkB$#=gLS!rO^y}S9!MrsghAf zqDLwXAK`I{aDL&dC$eEMH+{GFw{31!vIR-Zfcs!V+%C=en zAElrY=GpU&7vJBHTKO9Ql5P{_7G)MQNOjtR2P;+@<*>ZWDzvbwSqD^4fM1%FJukk2 z_LvvgX&7z;zibzP$Z1ICFiSAyTN;+EGABP(CjY4E_|VI)x}6p&3GFv9XJYBE#H}@^ z=PGxbJPt0GZaep=u2LJpAhB#5i(H`dgQa_|PTYTE(>18?QuepKb*j3yH3iDaVeKAQ zE{)OKQ0}F&t1ez?^(ryNgq?!C8q^UhDz9f9`7LflY~H-6&=!kp)e^gnrQHNg>sCY} z04Y~SMJF;Hbu%nSv9c|JSVI;)Z@yO@g8Dfje0+R+@j<(%=mM44)@w?3JC^CT;vma? zR!7lVjp~rATZbH~f<2AKwV~S#?RG8&f~e|)h(&fBaKT)OS>s~3JfCrvLlrO}Qd_;G zxCCl;shxcKk=SRmN7l|+q?TAe{@~j5_gBTn7Z)&U?MZ+x@)P@}S0;GIRdcxF5Ghjf z$}uSMkIIics9&3nDt|8{$hz*19{D+x6L>Gs9v7{8fB~3ssm~|s38Fx2ZKBoG!r7_?L+gt zy<*Vv30t&pW{_=(l}L7PQQV^N1aHSjb;pkq*?~kB^PoeP2??Hp5@29%nm8V%N<5~pjqX&iR!gGK+mjPo!|lTZ66kS!p-g15qZwAt8_*^ zvW4C63CF>Q3ktHf`tSz&kwzqgBfx?Z)p&*})^8ZF*r47T*j477)-(9>YQvO? zbiw!g2zQW;!Ogg>H9kcprAo$|#AriUuNvQR%mk<6L$jD`SAIpr+T}R*Naz_>={={l zPSs2*$%3`M^&Cn{#xvX!la0HYpbpI~k@N|!V(58~>RrbTaCTKURmW9D;3dExXz7&* zW*+{lAej-x9J`2~Ps%cj|4ee!pdl4G%q_+6QaJKuQyE$28{*gcO78WnFsR6%i@)Z# zOy9nOO0IACJg0OA1bO(s>r1ARyOn-g@>8?4^lUtb;V*Zh6ewRYRuSK2=S@fSUT@2eL+; z{6R!dZG;mQP1<88TIdL07n@~T z5dy6;jo?BqSW<=HIUBV>=ihbwWNYn*5tcgA%K$t27Rt5ce^IebCz+fDJ4~IUVYWpOh*$`b}Dz3 z(L4m{a|fb55TY9%y{US(7*O$vDL3a0t0VDsx)4=nT4 zK`Xi?BW-jED}wR3w`b6DWQ(hdKYl7txuT-iby-wYsi#w$c%@nuHb`nr$K#^Cj!f|F zTpZ$NQLAJ~-r>+9vGE!yewBPCVOGA8F?14Uy1tUQ_QRj-UNP0IkdqW78^Pzkm*(>p zvI+vXGR%3w^45RXQg~VKa+b9cgLw+Q4VDT)$gw5I9YG+#;{6(-K@t%u)W`%@DjuFT z1OAw+(I8M$=hFFxj0wQ4Nj_y45Z#MJ#Ns=;oTkyxM8yD+d8u4(p|xkyq3TaULM1|% zp`oy$vt4MH%}3ySDq%5PHv92yx^IBDFqZv!K6`@xv|T$UD!7Ee*&!#~w5(+E?c~z} z-1;3Y`BZtik&#_5+_a4{QfIYLN=nn^KSgxvx_koU2=jy+Obn~TnA#c_K-06dbTvA8i-k)QLN>6~@2^U=AFW$I&i1NN9m`|pJVwsP zoV5Gs1Iw2dD!k@)WvNevvBUZ4upqRd=yneNgA5yTiG1V08DD*v>R5w$lj>Nkq154J zX@fVISLu#i%fFRC)jhu ziKGfBxKK5+-UX;is81%zyKMe~fC0!CfYHfGGI*rqLJCws1p+TZTu)=9edvUdwk zeA*to3>TM5%zS-yU?iW+99zj0*M)b>c`F{WTGj2ZfS}Uaqa<3*r6MM!M9F9TUC?uK z5l>mAI`d9QS=OJc)}=TI#2B@cltJm?t*A|Vu9GIEPHQQJNWe(If}RYClh&U?iEVdr z-FdC|5zghaS{kfpNlWJ4@oRfX{gOTp@2lbfBU1hMMCVC1LkX2OdPkO#T$MC98nHd5T7=1Aldfu98DE-}HB)XN+y5J~o zGj5Ioe)6AT!j7CP5+uL95gpCc+ro-97%C#!RJ#g=S7;<}-BGt)-!F~jD!hj!FUB1{ zsxi^dqcv$YzyB3kex80Mqrzs3sb&Wf6L{U{_%lu;Zl_5q#?xB`WOd%XjJF^KIU`f@ zGCGSdz9hUEkI3jV_EP#hla<>%)|TtPSNH>Gc!orG)?>WlDz0sGM$UYDM*M!L@}pNC zihWWzuC>gH44%6m+wr@E)^1*RPOnkl16;hjN0d?yG&o&+rdzw#)?h3~1|^@Z$D+jC z4Y(J7{lfBY2Gg|u`szzOq6Zl2#ao4s zUYZw`T1&@kG->MiXxg(Upwh4KyXxLHgL6xKPxwQ_dmWsZd)}N_dk_4+U%b#Bd*l3Q z`)U6lO=lSvRrj@V1rek>1cvUC?(XiCkd%@}8l;N6*gd^zzMr3)l*CY7$!EgANOwFS{oMABGXWt+nNOKB9BoDTD!j{tR{Nu z9eDXlZbq<#f0U}ZK|_<%ox3m7eo^Ur;i7sL_xY$dSs+*YL^W)7%6;;U9GB^3WyHI8 zE2C?o1`ei{p(ihi?Wst}4M#>aF>o)>xPdm#KI`rq(;@y4*~RT%$7&Z$+tp{L>2ysU zdVpiQ3Z5@zRcKEi|6#rMjKnoIqPYgZZI#>1(oAJ8VE_tJ7sOPKE<%gIF#RpW!lr1+ zU2k1EgYlkhup_*sTCE696=_ABjL5(9GKLEu9}Ve?4-fDQUOU8x%Wvte*UZ~#TaV55zs$R_cx*=C zFEAl2fb6^-A<^NYAqi-h2e4q0Y}QBzbES>tl>&g^_5rv2{XxQ;gG6oO3`FT4xZjc8 z(GZ_6W_^Y)_V6Swk_;q$UCe3Q;RST}AP-HzUx>(!5HH`OLcQq>VpIc8O`C3ZEC$dRO7F@o>^7 zR$HTS4k}U!W`T*_r-T+LFEL|8AazW~U8{|v_x5*c>yB8ScIy_1Z=0zpJ&9$8+Szm^ zxm^szD(t_25M|p!h8j51N>YL>d*rW8yn(tTKyLHSpr*yzOrU7($9iutWF?)jK*0Lo2 zJIcPGLL9MNn%8}BX;ej(tmuRJ;HK|_b9U`j0)tbxCRVNSH6MWyJ98@|ISC8haS+6>G?e?0uTZ%}>eu-#aJjLOzT1~Elw}G_L_64SYIx47cXM`>kFxiI zY!rEU)by@z$VBtItkxiupvw?isl&v8cq?1~;`^aYT@8&s4qIcp3~|BrJf+P%n~pAr za1m++&z9bR0Mj#~`EE+#8ETzUFKci8iDr!^7pxeZFW;=|eBnb0=G@!y0eVkJ@U!BOcUvBYBL!DlT5T*X2K~ z*{>n=H{l>lyhsVcrwHMvW23pmjX^~mSol3?yZ1)mAm7<>Dgq0^RfQ}nzsWG(K$%|` z^(k9`!hlM)?XhOvF;^8I{9a!6|buKAQT6;r(=5i-gH zG_tSG4pQJtTGe{Xg|eXa3w2zoqf}-~ceP~A3GUT%&-szbW}AklD%rn-s`iU6EsJ|J z;!xVa_*n7aw=(J;1}0E931k=pD9e9Z{l!4i1i#1W@YHKZ*~S_wTN~77wx$x}SHCJN z+3_@N@72T5$EJI^Gg71^r)vYMWsW|Xv-?_={iVDFN0lFN*7>>~(YEzN?W3r2sJ#Kn z(1$tTaELW2AqU!VW&oe*L4a(_Q|j=MYRNLG3EwmlUH9{O2`DNQiyX^U zwomg{=yPrVxDoAdJH5uv?-k3=i>|fZ_A$wuOpqOts=K_|Z=4OKM`u^&Y)>2F`Nh|0 z9Z1WgBQxJt&||c-Sc0?Oo+BRcf{M{gfEB$TOs9w^E`+n0k52X*zjItN2v*e{90>yB zr#SBq=am0I@{^pS9mm10Y5*c^5`&56n%-p4=71psto&!9hL{QGw|npUF!CD83tfGg zW+4@`R8;N$lI`yv*Wp)Lt`F<`BL**=pMtWKgqlwhch;d=GVfZ-aGbT6VVUyW zRdx%#>e)&PFV96zY;MnX;=XEZccL;5#V5V5b^1w}Gsm!W&0NhBD?SS`!#ZRY4XAOG z%v4WOKS6J~%8FCSd6XF^;ZS_QzYR5CMC;b__O(5XGrJ_LI30ZsLT9mFU@UV#QH7*e z%C~fqzxdQ76c*;IWY0>LvNay!hClY1?X;rC6+PWF)Q;=2fC9(8B9HurBFzt$08H9w zYgFpO?P4KS2Z>9}%~GW{MfqPdnfdkOoOq~ui|O6r^S=cMTD6xjofuv)#k4OSlRf(E z@710@DswNL1`5YN3wy^f@?W@*cIjTI46}YF<(4dJlg}?SaZr$4-87fa*JqZ?(MPYs z9_TWU)aXghw|5tjD(W-O<)WK1)_ic~Q+;0GpD#1Uq6ZXlWTrte3dPMm%_gc7sa(4w z-IMJ*^ZJ=R%8X~e;I=~(bl^hBTTc0~3r_0_tDh;tV=sUDuT|T-A@1IPVJ4{Hr zHMzEOC4Kv>gmTUlQ&HqGF`ty`%u<)CrO!HFLB`Xk!BP6-{0g;`4B#{K5gmxr{_7A< zlOZIL0V^~5303n<;~G`HH?MEm3xsS!+sGopHEmb#`^)}bcO|Bki-Fo5}#9gyvQ5UvUn~;?i5rBXl1$gU?~a!JnxJz za!rjGS^Re7ckZ?fsY6N5&Dviqww5P!euj?=@Q0U$ZsfXwHRN5Rf~NH3V;4kseg=$X zH3~tz*shk?&FFb{Dt(9idAid;%U%0Pbuj-74!+RE^R?sLEf8S`3Mzd>MM4K-OdtG=w9cZT@h>b54 ziU&w;AgyXIq8AccD69*SlKS?>h3sNG$tF_m`Z#u&WI7P7A1vbbWS3cp|tqq7U-iAtny(vOFvPK*a_HP!R~X>M>vqf zz`B1KBORW3r=(Bq9730VZ(#j;KMTO9tN;B}?@8JjCF6~Jv563JnI7wmtAXcB@qUJE zV_XGPj$u-QE1J=?fKSgYg3G8}b5 zcl&~W+n(hmR{wE!eE85UlXg$|kz(`NwH^7WJsz3FFE$Hrik`^Pv{hBC-HJW|5z{6G z%FEd0RpJzA-md4jVw=O4cF|nBi*6dae)Vcw_UQY{WIM5yZEBa}C(-D4(`p86$|Ch@ z+exqOjuf)oKxf2`bEKpOe0(m;;!PRLnT0Q4*r|EsgyQ;!Y$S=|XJ-Arf z$wJ({$z&NAOR$GFtvpVdG|O#iaw4)lDb1sc+)6zW{yc=)R2f?6?0>FKe;N6yXuFR& z)Q%|4G6}JVUJ<+4kmWuzEUm6GR)-HO=q#2NzeM1gwAstC{J?kHxE|GKM%z{1va(4q z)WQ4Y%))={_MNqx|!=KszTh$<$zfX9TC#?)mxi{cp9+} zu2|R9fEnoKBN4o{sT*v{kL9LsZuci}?pN5+LmJD#X15`u;PCgvEF7<)uKsNy{^Dyr zbrHK{xbGC1!|66bbO(y45|n@}Iy?;lPq^RcmSF?6Xy@~JX;QtWInv6&+&evOs%suB zAbC4IF03HD#IU!{l(TGaez>%O{X-#^?b~5*fB;dTV{Ya3#8tGg)h26+vYNmc9Ac#_ zm767;V{T1d!SJ`zI7c2$G>SK0otRnHC2bITWQt7+xab7Wf7rHB#O8Ehcr0(ZB|gsS z=eQ;2KvUqFz4w-GhfZI4sG7=IpuYl4Yp<&x2}qa*x>f-Py3Tb1zPG(<#f*u<%f&d} zY*Y;sR=n<@!ivNX9eEMTM;KM(^wTUzMd01PTHDq$f$_5gWxHVmItE`-4J8k}H3W`EK&qiFIz4?-Wu&r{Pv+#BI75vIT zxFKyID*;hjQdU-j8l%ENuqsPhFj&Krroeu%9{EHqzL-09BHeE0!W;Mw)|Ku?Nxp@H zY-^A&)v!+P&~25XW0w;^N*GzBaWSVULwy5P+4?DFSk-f9YuqkW5USo3Q1OWg`RFF4 zB{(mOrq@4svd-IW;lyawR#d&ruAceG5GSgc0DR-j67T1|Pv_LFz4qmjaK9$x$I;ro zs_q*rxVgURhR`op7A0Yx;y}27W9Pz;Ifnh>MpgzU;=ehv_E8c@l;v@<0gUdRc^a{v zDskc9S!2&`O5fsP2l8sO4;BZjpHIr%kr7SV-kr}Q zo%5tNcH!Bm9i+#49vJGLuF$FiX^?Vta8Z?Ib2=?HYc#TAyS^|EKMbi6b@yW7jmg06 zBn0gjYMtY2X@-gMyst^PBG;=@Om}ywK%o@B^semtF?puu#0>%fgYdP-cdxi7>M<%fGvY>$9fNyo!E zijM&BC$AMW&v+IV6wzOr^qLznBKBp|QEj;8j?;h(3wYm$Xu@-jKMm_;O`NnpYMv66 z7HbQ=5{#WK?&f68z?gE_2ykYmLGBXi%eXUi)r|YKS zB|~uDQB55Jpz&pDl-`7zoPZd~ys1Ot=1=6ehad5)L@vJ_Q%Ee~74l;(k7JAH!^&zc z^tYd`BX_J_+e)Z9ixKA5%c8>XCWC6X6dm1t1sD-U}Ve2w1Cv2fX!J^j^; ze5EiLJI1o+8#n;)8W+ie6!TN_jKHFwos<2xS3988y{V{S?(ownBu|1~Pr60_ z=DO?Pfc54|>@zdG-V5ul3*j&Xeqg#Z-OS;%yS5~?r?gADs#Ai?&>6Js_Cn`$jAsb? zZe%00dR5`J(DrkgArkPakCjreVZIPY2iq#FB)Kbo$-Ge!+UUGG!NW9ZG>!8&pgP0t z<=$zGw=*_7%NMK&WW)zSgM)R)1TK+zAtUTN<#pq6RhbU862E^u?I-(zNc>)DoOW-O z;*GpdHF&r7@WRK?+bWqf>V_K%l!$`S1NFoprG5C)2z>)n4|)bzz{)twDn=a-+5uS3 z?OuJ8nw8U}nw>py+%@n(la&+R@WLO2KZLlfkx>P)?D%e>Uk(10&1xf3rr?8YUQ|F{ z_7yTMZ1i3y+VOr~k61esz#H?^mB`x5+S;R{6D(Bb0WU+p>Z2yxOofA$gS8W|vhVdA zCq2OQJkXcddX0Gd$1#10`?To~ahZCZLw}L6vW!^Ll2mu7k&wJ9MqA~(+i_9;n{J^U z`!JCm2k0L0QMc&!u`;d62==Y@ej2lvzxPH&+Av@paJC(@ zJ*#YW_^2jS=mEoCXhXjqfw&8HI(?nj40Nk4QX!-OSHS_BdcgX?y^?^5EkVx~ml57K z06OqGy6h`X?8ZD_%l*=6+-D_^?Bz>HmHf9ALEIBKNt@uFHk+3{DmI_jZ(O)e4yWSZ zgnl?kWDN3G4T=pQLxV}E)W(r2KE?3AxO+@)C?^#WKf8F`IA;}1^$+$%6Yk7Z2^nTx zF7FLM<7V|eUM{m~>^+D1H7HPr+?dnj>|fhy*X~XlB<1{vqE6dM zj%(Z06Q;K42+@iK>Rey5&Rwe(jcFP8p9Q4tGeWw}TR#vxRc2QNsrP*M>{{;Cl;1~m z*P68qkSSw&>|Wvyl&w_<3W%=+W~Injqgp&nLChuUune#9tDf1bdcQdB1^8LCg^0WJx zv}Sq~A8bsdrD&g^!E=*Dli$R_EZ9y+RjMREy~Gl{nS$*lR)UPZy_pRq3h$QntbG&K zeP}ox?s|O=K=wWfWV;zITPw4u=@F|+6KpbIqEb2JCG+`jN=E$)S{rg7XB}@j&twb&ZMSA~uF5Pry#V=ZbYKL25m=@-)rwev96nC1_P{X&ICfpuw;a8x~c zf=fk-psMS*(1#Bd5WU&s=b;4>tAau?3=fF1R>ieyFA7ZWluh;A>V?drNS&;OhvWX! z@$N1!YZ!xlF5XnjFRU&uE$+y*8J)=ZG9fh#f95ukIx2dTBVsWPd{5I_C&_Gq<7h7# zHW%R4oex`k4)yJ_ca^@&n2*y1-bpga)0&Ud;@sQ-T4$S{?^$re#oT4TxwipjJftYU zy!XWs{%S~7`D5Y^EKeJF46G%kN49Y-3=L<6sxP%69FdW4qpfBV$bSPysKq)Ox#&x8(4 z(ds5k#d0hCwIZiXxO9a2cu)$XA=rF}Bd160B}Fw6bwqfOxLQJ3@byzd7dcLBtz1=@ z4Ha!k^O5RlwlCwga;Ho#nvnA5t9OjV>$6nq({nN^FcJ?lX%Q*aTfz}K0 z^EgUX@#TbK+$_7thUMT=a0*YrLrQxbJPc+uP!t8l$_gO5c1F*Or&~tBR%$@obs@%f zD*e8wA}oB_YnNp^W@;>9$yk_A{Me=CIkaf_ThWV#-J^e6$X3DJKKFUysTsZe-1{FzE`k+yV*_1z%$UdgtA>N!ZRNoHB6f%Dcm)yyu&$9 zq3X6k!+>(aU9xXZy4K9m;AO|iYx^LSC20lsMt1z_heTf5t82Tvbph5qo|3yB&!3e* zZ9GvPazB+0$kbFV`8;ha3#P|)p1}RVu#_3=>Uda@8z+R^;C%}$!`L$I z-Y@_&rYde|TCbvQN{+~{_)3+yfC)%#XhZ+%s$3rp!9Gf%f`WBscc~SppfadOYn7IuH!+oUC5M(zfZC-i3`!{UdyIL zS_TPgB1ntYy2;1$6>OKbD52q5gMr%{M`9y2NG@n!FUbpvC?iQ zvd}2e_)1{a5Zn3C^w2JG`bo2`=eed_$Vcu($V03!KqaZ8KYj(!p1Dt@#(cj|Tx;i& zi5!DGNJg@(IK;_xr_Pz0@iAV`XmErfcr%$JGyf+h)t{~S{Q})!)nd0IP!)~_qYyx4 z09DqPur*Q8H|o6A(xYD`YTAHN)8j~Kcsq<3#$yPT97(hKcAiXqf*fRho*T{iJp7O0NV(e@8eKs}PGEGX=9AV9i0=HadH@_>1 zgV(L+I0+xN#Jd3Qrr_~4`9{B6_9LFsj#F#TTOqc~QN{7^Uh{aCQdQ65xRa@)I5F{a zS=slE1{PV33xmdZ5;Y&;PE)RtsP6BIUb2H0gXuWWR+XRt!pHbO7b`XLP>Q!*MlzK2^RvxKzBtV`DPaiJNj z=AjWJG3g{8AG*b3-tg57mxU_+3`S=PEAAmffY0qXM&A{%&9qWS&gH~BvUa;v8Ecq`lr2e^>~X4#I* z(1XrohSb@r|0M75Gbi|C;E*;0@`^+K-9Zm3(qBf1QL8*F7PM>nOkAhvOzv|D>~T22 zmkn)e1@}HO=5`T5 zhI4D+)$&qwjU2)HXZ3>mFWR#79oP>;librZ=XXYC7n|C$*L_v8?WNqQgF!N{H{?iK zL({dyRLjQNAHGkdzv8s&q+Bu1xEB9uJK;K478YlAA6?47C7F}|=ACC7R%rH-Bzi8r zJWKl2x<5lZ91w6+iKbuXY_x1&5i!7mT{T*iny$Ugd^F zbp;YO@9LI`bXQ$o7&m^=<6%N$pL;@?2t$&v>j*9~b~iP=&AE^54wnkujUk40QHQ60 zK?Jcp?*K*_q61qMihrp9p^7ftOlo>8Il^h*KYKN32$bF_lVA7H2gI&{W%9+QXLI4v z&@AgK6LmUl{2N(fLs*zu)fSYZ>^l}0?Z`w_yK$` zC97F>X!V%&_-80DzurMRoWYY-!=EP5XOm@B(-To#t>uxN?)BUU)969z1B+KArQZ|x z!Ts}6!P)SfjQ6fQ<-_VF<4ynB~lm|tJ2(xXLI=0lkI(Qm0~X>=eT z$(+)id~fatIsLDS0@iIB0@nIybJ|c2)-+r#q^_@S#;j~okNFxM_SA`S+N8wOUB)%n z`1^8%WgA(Y+TAbyieH7n3I+{HvppmBmwb1le>@MKcx_~9_JrKNfErwc4v?}HxlPi= zZrLwK(b~Hw1WG7u3h6Op_E#);6ILz7xK=geCptvK`veJ22ogHF$mvSJ<;CR(;UNVn z8k1sKWj}4%mICx0`gXtRa;wPH$HiP~{izLa^=*G_LL@dZfNS3+?oh#$=43i`*F+m) zmq4etZu>&iZCuZ$9ATXn0)9Km)~R)rc6}l_<4&w@fWk5xj>XI4hROqUW#he&F58*wfk3ni z!g0r+{_i)5(5R{WXBqemvJod)fzF}GSYD!R&y6~%gc&b<(0V@P}tV!b}pjAns!cc zB6r974{NwMg#KB5c@|>v*bWReU_+s9_uZ5%DBX~=oLs%v8oPMDBz<8{+jfv6dZZ2~ zmcf)g;xh!bnf+a*Hf^{O?INCW-)W~#*CGLCUnzM!K7xMogLUH7t<4bR3Z@mc`$Ncxr?79E!f{>Q6lC_4c<}K?>dsL(Q9(9`vs7o%v_Z>yqW^1#r z`~9!-!KM>O2ht===55w;a44%VHOAdiyimc+otANrN@O%Nh}F;Q;4FAZAI(mbQ3eIx zO982yLPe6(kMp^3#;f<+tdC0jEqLa+S@8L zTDDVkV*|H0`V2m*AJrc8e6VPS6ob!lpAqM(UregjH>##qZ;%$g+J;9d_F*Qxrz(va zTAYvxxiO;W7iv(}5;Cu8$Otkl7JC=yHT8~A@TZ*b^RasVppbBIv3LPUX(`ipwl@P& zL@+5j^{~|VgC)KT;RgS#rFuOXEZ-88-!T{KgE#~m1Erz@*b#=p!8C52E;`;gnOTSf z_?r{z=kq#j$#U#9(mc9`{uxc8xJg;43rhE%p(J-|F-UBjTvV##nV2QN7?dkO7u#tZ zN)&@t}(zNUb6>Cq7iWtSiXzk7gGyDMwo!AQ@ui|66UgE}hhql51Vb-#P z!=^M_pRlm2!s~@9zwDaqqXlTm3+oZgYLF0=ymS7mc(+Y&8`!&52Qoy-!fQEoC z+i|JZ@42-#7Mt1fnE^ed;_Iucp?0Xmw0tsSVo8ZCKiZjNU=Cb&t?!l;(-Pc4nS!o1 zgYA~PY?~p|DWAXFgzq61iKcL`X;w$@qkI6%prucgx9p)gq!KlxG1=cg@$aBem(j9K zCQ%kpRUZ@@A^c${+WI)dwLHnt_ z{&U@|*T4CdjaD{Aaz+@(U?D;HgjBS^*dbav@RtTznoT0=3uES0v(85y5kIDH zBX#$=*UAPk4UaA;kgOuNCfzyCzRJa-np*6O5}vP+H(sgT)ODHMlRkBWQbMI0qMs^y zB5RT!i=lB1dKIOr9C+xX%eK6+UsUMc|C$d%VgKb`tul@y(15BM(`Sm1&ofQP+D^J8 zzkV$;KOFBU;*fak)JH?Tb4>CY@O1Wd&zua6iRFH-Xee3uh56tVGAh>SQ(m4kQbHn0 zEL;+KfqWh&%H;1Y(Mz%U(|eIehH3oZtNKJ{v>|GnF{v8T@$Sr6X!!@j$W}^ErVn}3 za{DhgNP0cziDjR#fV8*G*Hl0KCf?p~@WlkW<16#g%C4~y=+_1!qaMqg%e)Ze{%U%VERnI7eN}Vdl?M@lNgX9L;&VrmpkM`-W?_YSYfE(|MZSUN}x{|NFnRf8+#sTvZgWvN2_gMdQAfvsycOj zeOF1g$24!#*L^>UB5e)r$Zs0~1vF6S8IDg*=*v+p1Jve4B(vP|d zbUVCTdP7s)r?)21f$r!Ea6rYSmY|}t36k6xTu1%hMyhpM9 zvO4KX!-A{|0-F#v$Ev$_q~6|pg7aVX zgfuCsdu@^RX?wwj3O16^9M&MJw!CTFbkPp6G%7?Z@v`j^c)ijq-NMPOy|&oHgLBve z$8XGgFp{Gue)>UeH|*^Isv*%u#d5U9UNogi!EWEH!gpTVID><97MStJpWp^>y) z6#a}`RL_Bz4dD9~F5%t%kq>Sb9cY;|&4VD$z~435qtdyaAyNi@v5p;*7Bq12y*UIJ z?R9?w=6@NX&?7?HDVS_>@G3z*V(jfQDS>}h>+ep`6@cvm#fGM}eR0u|35~?53@yf1 z!B}rMkVTho;9dTgC4@1%VGC1YpnZxQdmPuR+gbq#=3y6#LJb=>~u#0 z0`oCzs_+wb94ef7ndB{8@N$sRAy}53sU}U*`cMzzm4B}~*L*;FQ$I72{I2jmaJeVI zeS5`FMpRw-Kuyc=Sn&-Ks8}SQc`V=LChfd8!3WGOo}R0<=aN`yTEyN*XvU z<>4eVlz$F#X9Yd^so*NK*OOfI?73YH4U&I5>G>_RV!&QZ z^!aSdkX8mOCNPj+ro>Ifq%&b`3R0u(dDt7BBz@~jPza;pT-+z4VljX*% zQ{8de$u#TIJ)$^!BYW894`u#kvePFPsL>+-rjf-&=wJYR9+!Toy$*4w{4ZNxUpIHt zQAeQuuXLlSLgtVB{}m`|5N{qM=S1|r54UP9uNaVdQtWp}<1o4XeUb1UF zHd_I^>dGJ@ZHvRwf6yo$GrTU<=Dc`;N-h-(oHzp6Uz5&a+}gU|jTJUSiDs>8?{Wn8 zE>{VL9=r!gNb;{CMz4!cKR;h`0EgF@3Ivr0pHj+{7SwdInvl2oW8e>siIDU^lZ1Wp zu3kU4?bRbDWCE5r^y~rDp@*$|mFd`@CY0p*3#hOV`z0teEiZ;oj+%yMr?T}V4g>;8 zt#pdCPX3JTzmpic5HZR>0?z)wnvFpGBE^BX-gr6D)VGA5^el=d18zDlxFE z5-gW>+qP%!{OWP$-iX;^2k{=x1KWBmE37`Q-VTMJ5L&dew?N7H$N9f9u}_Lg)!v+x zI!MEk>ReP9TEdCrZ;}I&GVPI+o2tM3hJgxg8=82aT~xHA2U?0cRD9s!LU8VX>yd^R zzL)8i6`uZ85Tg4}qz_3^)O(Kad@B2;o-9M(y(zFw(!*8YJY3l}!7;&J0oKhs_AAN5 zpU{!m(6y&sZvI_5eeIje3Q=ZMeYY3eNYYNBn;Iaep7A<-=8&UT7FbKBiBW%AJjQ#K z+@Klt?(#kz70ScV@r>bT#(0E0gI39UqqG* zBkf;w*Us~)U+0SKMhw&$^4c6MUatRr!F*SEFT;7n6-PiRzaQE<+*>riyFjK$4jHVB z`M=ceiiYaUEugR=s=(PVDVr{+&XN@j1`bA7Y!MVcCXLH4=-X`BY&z*nBrPrdtp%@b z9ZoB}IVs|=gqm*DN$(DmNXJH3q!a3x@T>Q5nZQ8Z>qFHmn>e6j1I0cCR8$-`0pp(p zA9P$h%)jMG%IATs;NzM)s23{u``KAS&`Fk}j>Q&F(k^9oHzQe+C}McX)6)j^cmBNn z9pbcq80`nu*&g2=0V+Y}m$we)3n9fkSkcr(nLo^iw{ZPoE-KyH%L?G$uS-b7MFxbn z#zFx)bBNqZS5U3YLPyXubg^3xzuu4gH4c3^cbp5BgGt0bak^QwVToKiZsr$RKF*0e zfOdfw7Y&?83=hwsf2)_zh$+AnhcgBPOtvf={S>k;O7)i1LWy?=`;vcgPBe{_Bs4UX ziG&Q7OhaY&Epr?CaypV-q3=a}_Q1`Oy?y^jydm!<)g~geZ0}u?oC(#c#B? z`BKTZqiF9r6=k}9cnzKW?s)nR{)$b37a8Nu)0{F8Fr+g5(j9yS)&Aa>vZ1xJtBESB zLMO2@oezNBLu&jGlD=6X+9U2g-ut&xF^*&K=9i5XE_LBkAntsP2Yf>fe2w)ye8Rn3 z7MF{29kcof?cW{Xg+s@o$;kXu{rF=YnfaJWJOY+*}@fy-Ulr9dwO5 zeDqfJ0=vr!JY5Cu%P{)4oXlx&a9|ND%g|LUFISL?>;Gh4L8(tGnoHoY9Mr@zjcw_2}V?Udcx29zI;waw|^qq zA_+mbK*j6&tF7pC_8a~ytA*3!ansk11n(>pk9zX;=C>K_bq4t0Xr-Nb(71X}_tY^D z$)CmjAH@RCS5t%@{MyOXc0CRPtU(r*mIFx?nGjbOx4l*aZq2NTfUwp4mYA~UY!At|TlM~DiPA#o`MTO{h;urt`e&+q7QT!iPh$q8rh8|RKmmeIP!Xe)Gbvw+Bf(P-V8g)AR)oZwVS9M6q2uks z2O?MvDH$4J8F0G4h-j+cm~)otl%+=x9I7}wpFa}Z1;8WhVl}I%8R6$=gnm?G^xVG` z^F|l9sS={V8-dG;=1wG1hXaEy+})bo z@gYl^hR7c)7OrH81Bw-@i1c;?JQ+Q0;#E)uql@iI-e|b`W|(%sO@b>RvR@oOkOe^> z=1pu!5^}=jGV#{s7DH^nTc+oOWSEoy)`|}v|xKv&Iwafpmhfeujtn72&R?aRjgP?y1^AUZgT(mdpvk@FyNr4sV ze#nOtt;AF4>oraxlU*wNOnUm4y#)4uqEWcVw3}?${!DafFngG*8OH>K77Q?YLq4z7 zvVh;TIS^;R>p_~IpbtL-`W%_g%7u@M>~CzYHmj8uSb&BFYoV_ z1m7_N$j}(*KN`%rUdpqNI>uuEeWJ|!cj@eB|7}vu(6FwB4!0&vqW>$ZC0Z0w$^ao-#E`@4Q&J4Ypfa|thh{;tmZQF}doZ=w8K z**9;RTx2CgH9CoyyUv*Q1#jlNH!&|9HVnt(!HOIE|J`;6e|&M?y_-z#p!|!#+qs%j zPX2d37Z0dP6VKcoQGlCCE>rpkppaqPk8Mz`MQ*%+i;H2FraSZk^o*uur^p6Ffb$3| zHRVJ=i}$@#B+!MFluQZ)2!c)_hW$#e;qX2wZmxf06RTKj-2Gm+`im$Rr|{y|UN9YU zz$H}Hy)kJZkwJS1D(`C%fN65xg~XCTBXk~q(Q(^84(|Nmp(9$B$Bq+ukZdu3@pnW= zkm}!nnRnV^#hV(u$O%u(lMSf7jvJu*!M~kak80&jb)&3YhI2HXpj!^Of9))Udw?og z-{kV#$En`h7m904LSkM`$FUKCd(`0|H|uxi}dscvZ9BtKV6R73w#Q!JpOwl zf?k^WJZ9^%%#BYy#=ZV+`@K}##@!MWLF7Ssmqok311Nm$Pq#nB@ew&6Hwf;K>H6K| zF-83~KNLwB$%w{<9*-Df z3-PnWOjtnd2_)Wbfyp9<-%(F+~NQj_^>zc>f7#vavDFVWvI8t3}m zh2CTIPy|uFGe5C{v{~l=_-8F0C}FZd8prei?d3bFq=2pEri!JU{}oC7#MXot6DZv( zbH5@Zk4IgZ#g6*-MuV6SJt~O)U{S@kt^`U$O>z|FHW6FWS(~NPxMkv zO-7|M%kmOKWXVLRnQ!sma=+c|&k-bwmk5`zzE&~lBv;cTbsVqVO_6TSeERqNe6O=j zS}z{zB!sS-%CtWa3_6zB-^Vu=!~Y|nsa;^oYVc@ja`YL?Qhvnt`$D5z-7Ts{u-b50 z=K0?{+|({K@cK%TY-(g))edw$elY6ZTk5uT|5hUy4F7K*5$o%Ulkn}784p8dUQyIK zd2v4=SHLD6VvmC6%OiYs5N0Ga$b1|R-P)#n-k<225%Yk|2C#>{$|am=E$ho2XlHxdHkYH z*6HkOrSt#oSd_9=64k}z*VUvAD*1pJO$jAgY~?T#Tn>qIfpLBKexZLBsS8QXl`PS1 zvCfg|gpNY5DZU)OsDM&qqk!6{|H`>@K1g!9=2bJRCg>4`THFK^L`ePHHDNw>sjf_G z@RX+OaX61q1XKRoId9ea16ip_A&0Y5v;8`f`Fa6K{ft@ReF6DfBy|64Jr<-<>#bEq zj4qPd@_u8?q@4}C-vQPoTL(%z9RhAymE_LflPc#K@;baQ9 zpXU7AI)vXk{Tj5T?h0prWkc$&YqrWfKfQop;{L9h{KvEM9So+J7CW1-`;AihN@6wp zC5!)g5Def9-({`8CE)Z{Ej&*H)S*@#8b|)uhK@V63n{ zO4-jOpFacY;4Ln4Sz}C{F|;micK>7gt%&~=n+TQB=niB%DDx_flbEt#2Uq-ec-;n6 zTGewKX+ag+=~5rNKYSgIRqn`ve8H7_EJcLrngw={i=>f%+^u$YUcVtwBJI=idxPU+?1* zqXj1iNB$yr_KEs7(m4eZs~v=DNm?&_Yg+mEeH$b_#0@>vY?-a#J%R+5FqvDS+6r0s z^3cXT#X}=^GaN?rh%1)(q6=O!pxc;j?V9i7Akw3jD(=n-J!qtb6e)Wb6|k$ zz2W;xa#mRr*O|@fWf#*Cih<5c)?)b7s#XF50#LueE~~{~*9Ozkvhz4+^4~r*`%K~Q zP+v8ePtMk$AOUqEog+8$jE&CEr?l`NRR^}LJ7+&;5P6^dj%Hqh8uL*0;;tX`u%6hz z8FM?x^}=0QN9ez}Khc{Djx;xz4q2=~0aC!{U(Fab;>vD*Et&uu&ZCk4J6yqL=1W1GBWk^fwm{mhvD zx7%a==%FVBHW{h-2?wjGbx3DC4KSl#(ym}c7$)Iwbt)t>iw@8L(FzKN?f1aPASA*%UwYxs$gBLO&e%UVWJLD7Vj{3$2khbuD`Jz>KaP~ zdT&!C^+9EV&6fU;r>hKzs%@gu-Cawkw3Kvr2%<>0bm!92-6?{!bV;Xl2?$7cN=SEq zcZK)+OYGhI#LStQb7r6`MGn3G2yE&Y(D<4eeT{mF&G%Yiw!tCS3y8Yvz}pwng7pi) zz+Oji7s-;rsy*ce#m$MRy3wq0jL_7UM1y#t5m7110s!Z?_!qnod5;d<+MDCxwG=b@ zAuX4gl@R&6eSsm|R`clu4k{kw3B>a=ZNi9scfwvf3i{RdeL6c5k;Vd*Wvqw7XW1C0 z3Xmhe@l{@ep z^~#lE2KT^-PtJCn&*=4}T4yJu0NzS|ur~O+32a5GQW&##9rLM6L3{i1f>+DkiFr`q zFPHg;#BYKuGQ@PfgP&FJ5;0p={6Bqd@<3W0nXEf*Iitw{^L+ z4sRR0?TtmDdPTQ@&;N%pBV%IHQBHjRJ>yjxBjM=;9cUiTnDX*Bx5ZkMEr+m!yZek5 zt?y9)`Ah(%c~ln+vwJ9P7A=;+7np0%OuDQk|Od?DU&e==l(rCYv91 zt56xPSTjiVhnV9tX3V~K$9-l_Z@1(hfi~z|*^#U^DZEEGkR`_QL+-5i!B9y5}V0Nja0&(-93x#Vf*`36?hx%1&9rG4fMm_x^E zRn<)>bNLH(JVT{qIRI{I6Xe>#V?a)U{0HTN3>q6_U-XRMa6k2>cf&GpOch0q8dbd3 zaCqqc`I49y#5o*n6t6UfUy|LOc1MBF);~9zgU{~ZsxSPzY(763W(03)ge)o5qi>+o z^z>`9Nbs|>QC!Qc9I53K7X|!Un@!ZE06vY&lWQQDpdx;?n(Cry+_Vn!>Yo$L(+=xN zkQAH@vG{H@w`Lw~w1%}@6YS><&);_YWOc14Qtf}DhL64N`?+PhhP9zhz6zij>+q*9 zfkH>DM9?%PlZunX1iIHcO-plydhSdc5p1B&nChwxLr?KNSq51OvYnXF*lgZ>@G3fg zzBVbx%XU#8w;D}S@iWjo1EVvvm|p=(P!?3!<;eZf#?SFs%36{0nL0zxGQX9J_2+OI zdg9YV_q^C=z&ZY2<}Rm)!)4;Vth2V+AsF@B_t!o0$befnjXw;^5F1Xgqb`8&~^!?~A*em}$dTp6A*4~G61`)(@_ zH7E;~7$%TV`wagUmMvvb`q!sbByTJ3sX6Dsi!Jgv>pq1(K3Sal_o;#1NE^mt*zI}p z)l}GL;TnXP?OZfs;QvEFISLR*+t|x60(C%+5T^fkw0j-;zo-_LoI-Ml8WbIu1#sOf z!uz0*bcT!{(w{y!Z(eMkN((f!c5M#+ix=~sucrQl+@~g2My2+C^#dq2%S;y8n_6xA z+jG4G9R5iQ07hy+@6C2j8nMGr+*^XW@V=bDt+gZ}L(21nG{9cAb5Jk#JU$#g4l403 zCMwy0M6Nn8Ho9?Ceind;D{W?^$33EL53X+tcv~4yzC>b^2GZ5(CEg~~f>qySoDD=SW*n%z_`UY?^j{>cC zJAgi#BZFQhUS2xFfT=Tk3oKt9q3@@w9yqm90Nv^*BK7q!k-k0cQIMhreQ{tzy}Zh? z2j9*wvqJLFn?Pc&;_vrS;jNJUx_MhoRPim0!C{}<{S+l3_dDQH|Mc1bex3jcDra#4 zU&+$5r_HeWiFW)|jpB`TT}nrgfb8;-BjY7YvbgC7=-GoFa;HONmAsE@s{U_!Oe(xq zCOtp6^M1EoG0|Bd!`NRi;3!?dmyE&I>T^n*=NZuDR*I+1OXU9TY7^7|vlK=k;%;DgPGF^In zxEvY-NGbpiqRQ5A18ba&jI8!v`o_ryLr7r|2aggWtd9{(2J0>3O}G z!aFWCD;?p{hPpXn!RGs+eMlpb_P1|2>QC;9w;6GLlVj=H2laW8*yAjBmth3*qbt}u zWLix3T|*`Y9mtGl%&}RVG#R z0jFMNMo|6Zx34};!!Xl2PEqd;AjzKnoPcw~*3es^Xrb)`j0Z5~NGJ8VT8-L=0}3FA zN-bGyBETpUk|A;c=bZqhgn3qL4EUKgU{cB432HFDuAjF~jd@%d&Mg>73C{-!Vbo!O z59;9NWA0xR-nq>fB4~qll$DhSA(P+J>lrIqOHZp}ysh!${cU>Ms4-$$qjw;qbyKGq zzXGt+Q=q`s9OlI7c&(?-4s36I+K1amZmm2E75Yb~CJ`nP0Z}JVXp1Apg4EXGgu#x=}=g-Gl$< zKL9dpY6P-g5$`OOe~>zKV?`m85Wpxl%M%Y}A`-C9#alLG*$Ve=Bp z;I=a3U@a(F@NdYFQ%Xu`$Xyd)=Bz#5in=$q329g+b;%Lm3v9o?*Qh??37x> zLE;zsiLkF?97ejf>qnUR?K&cYw}=>iHXS@vzH!1@-vKMqKHuW1L*$pO11Zscx9M@E zx<@17`Pon2-Q#FptS=_V_c?MqgKQgSAbn6L^ zO!z*I0R7t8Ks#Oqs07(`J!GeY6=2OXuWg%+6$YI=zg#$mpL!^ymI+FP8v0i1&n(FZ z?W)ohVg{SeT?3Jx$!&Ob@cO+0yLJYL{ua}vwwg534*XhYYl-o^?9|MSiNkc*20A|l<##?Ucq+5v{I}>J9oela0Q}_AE;ZvM7|a8IhYE2 zkE)Z(|7nWGc|O~vTi2cABYK(92XqQD!9c%q2DdRs7K-h)G_(yUR-PX&B(E!l8qC|z z^4V+_ChHHWlXqZ~yDp5HbtCk?3Cd{MmX7Ppa}x9$|7{*paL#Tt{WEA5`XUsuCh^BU zZ0F)bXXRfQMu7wOVX1G%dncX>+ldIW`?~t|rcWJbxCJS-cvDy&UulkmXqiS(Zg`)#YUhuX z;t_=&V_(XsRGgSB%z{;uQ}=a}W%Hz$O~S&!Kq%`I{~E?$_d#NJ4b;+~8|)2Q)ac)& zJjXbtwwTlIrFUv5$(uRxK?{YQ1CEEu_M^spGq}pinz@3}`KDL&_ z_QOS{=Ya)tbCH)c3R)f3Vr)kLA=^(~OtY5)4ffeqwKy{(&b%W$%VR#)l$IY~lALD0 z1sSw|w1WC_$Pv6P%6kTxwl%>w(oeoowBEtr7t5L~!;dKu0`f5D`SvP(?$5Qgr$D+k za1AlP^~(sVznVuI+^Q@(iL~jGaC+h3u<%ivZGLJZ6Gp&azPaqVf3;V`f?R1cn%#)KyiW94VhbVY$|6%H70?FeIMikMW zjj@uyxY(c=RjtR@NIm{jIj!n_zi+f-HX$gTQ_xy3I4XVW5TNU%D6oI=PZjMYST8!i z1qV||XxP(leU?E4UxCj&>GN2#e*|i9{LWWoh`Xxb{s!NtmM2EhqQ8 z#LD6(cJaP zL`)%T?r5@Fv92Y2dye|0$y3@y^?cMpZN1rnZF@F6EgksC7 z!enTQ5U^ELLiP2jlQvk30(lj{H%ywI6NlYEYME99Uy$!ruSc=64kyAri z?W+De0-HHC~)FVxR0ea)#-2r*95}miJHY76uR7(V= zDpKOkeF+ZBMFwWj{tR@p5JVJ)p82a{*@=633FYD6PK~D~;t=UHsOOQ+H$3M{b$`2}s9`xq_s`B6Ccy+w9 z!({ZO-*H7pq$n0n{?0<9J}#+Z5JpK^Uo#)H!0#g-lW8BQd6N26fi#T5M?y)_FnFR8~eM^DtIJr({~n5i0%^;g0E~`TX~OL`(3~`gaWBih@mc zni8TpaGcA?&uIr(oM>fco?#0)k!T~Nu3tcj3JCZ8%ie`QL;aE5Ikrhy&R}}62R~bg6 zT$EF07Ux?-6MPM25u+}_HI?9xBrV7XBSFCP^zC@m;>^pU+387NO=Ij1S4GLSmQrz6 z9>-jrpg#Qp>*ttWlbo@%R+t65IzfJ?vKT{LBmAe|G0jODcTtdh=ZG=4`57Ve>Y3{3 zOun62$7&f1v;~KEURRYk!Om_$lp&y zh*C9tO%5^tt(ttgfi+J2)JZBqI8gamzJ02zHK7Q;UA%LO=b#6j*Kg9UDs#Ucs>nk!Q&?y^?+gcnO(myM>^WJfd!>s(gDjO3Rl?1am{m+W#&HD*j6U4O9Xg27V z^EQ_lx-U})JynG2cEs9Jdw(@vqM!kom)Ut0 zTTmn9@^NJl0stbVZfKa)tI!^G_N_&r;H4)CeL4K^NMnvGWtGe!^#e5+dtf(8=7=)u zMo{D+ryX;gWdk-BCyr-{lPV~CQ}uqGdm z{xp@7sA%Vw%n3Q{KUbfL%4@5}c4u&-qf!DT`21V!pXs$b!tBLknh~)-o4zXvLemqD zxeU8K(P*7tDl>be`2kfM7C|d8>^@7BLs{bW(HoqBp zMp!ISX`w&s1$Uh#1anH}8ofrJ7CdF#+{T%T6EDhQ&v@ztkpchTeM1a18sBajVWy|L z&zia`=QekHx`vmrsj})${$o0b{l9@j)55TTB>UmPboFUlBkYaFka}B6rrhP+>7NR@ zi}2k>Q@iFYF|(fJx`0v1+9Td*cTjq&(~d{ETTHv;)?z)V%ZiKgXn{VR{^@#p6W~Dx zXG)@T0k4!LKc{>DzY0be#k!}?%oAk1+iBKW^@eTcmTXY~w0QY^wRk_-S|av*Nymxx z=|24M&t=8J7s&?ZSHRjK%UFR?TV&}!m&J^X+FC=70B`}|a{lCF^yU5I^48Fc0hvj@ z4#cjv)9#o5)(3HimAEVl4MmL-slADeJe5(FAt*0X>A8HD&4^o8TSZA4@cwvPi}-j% zCMi1p_e&n7fA7!~S~}E}4~GrSi4%9l{cAkcE-3K%|BR&TUFe9h4#1xt#A&tyso-Us z5X_!lygm-8_ov#}%$F&Bsh(WVc4|=aCz0^+Z9QP9A)*wML@>d>EWj{SCg`k9mQjH-xgF{}?tZH0?y%+< z(Qr?OEAv7B3E^Hk{V-@DCCvP<205Pbp~P63Sz51Zl^3YVf7dwQXfFG&f{lSFc^}t+ zn{I!`v84Jfqy0FuPcY-j6!+Ju{7or6$NFfbI$SFpj2WvbSod70gfYU}vM-Ba`7gK2 z7q@*^J~`$c#qKS~x3sgpv`5&7?J-gGoD;^|uB*fEEp482(M1rW2ok?221OYvzv-hl z6OZ%g(8E=JT4I#xlkKJbZ7nk0)R<)HklSL^kG*%D{|vY6G!z-o#d>TlG{i)!lO}aA zrvPK9`%NP8Skw2XwbWSc&T-K;)1BF_b~T($?X%3?`}|aL&-45w8u%s<>W|xM+aIZm zSVbsS`!x=2zkeXW8AF+2OPj)`G`H#Eg_4@u*mhGnCF#1>O(p7o6bE!f=|B9dGuQ>$ zbhyV@)}JQ5>ddl$2YCwGo1?J3SrTHqwG;X$ixVgDeTSc_oL49V1je9qg@8Wk9vig;5 zDHQSISE#^nP#4ZC#+@Z_JzZ^2`%bK_zzt^(ylAyUEb_&PtNwFfS}iO#k2b~X6X4aA z(&KBwmvPo5=*poRx#}oWl_WLVHnfsBZQQvCY#RSsgQ|!S>ms_ z>+cr!WEu{jqr%Jcu@)zb(vjtyIJU6j;td8fn^@73CBw66d{`9xpLQH&s;N+XtZ`&F z>96UkDz2s^Vt+ij_Fk^O8dO@t<@1HJg<2=3#9ox(+%5;&MHX^#QHCYU2r>tR6%wX} zb_iP@Vh+s9hHihN>y6tq*jnO* zr?s0BcUA$g+7#_Ll*rvXW_sv}g%E2CLmu@>wtJ{!QRCy6$-!N^^KgR&W9}26J+OkB zvI*7aSXvbL@BaZ^zXOX)XKs%IN(w`F1G@KOJGql%71wkiz$#M_c#b1jJlUVi7i5S+ zh)z`1z~#QztaqW%dq-VJ{wlmDr&j#guyn%ae7-HHO_zR|r<6McI5RXI8p-GJhj29p z5)8$3&Sf##8Z~bI^Al4eCk9YY?p9Znxe39Pf-1wRQ}uqzW?u`GfwBt7$RH0M_Xf;v z6(VKW4uezv8#!&zn2QjZ$HgE>aa}it_UnJK4hd$MvS?=y&J<=mA&kZ9IZY*f+1PIA zw{j>gvg1L}^K-J2u*3oN;)P|Vq9l(btrl^Hm}ryRGln{VDT@SGZR2^CHWRZ-=9B-1 zVGIl^@GDKS7K?r=BJK$5Tyg=Vi2SijDJCih#=1<4ZQh|N4Ap1*t;CR1 zLd>eS_%>pKAmqO*K!pX3Ey|VSFqRh7SQX9wg5ZhL6X;Bi85XBu4L0vZlJRP58nfAl z&1-G?hRM_YkL?8D`p!;2MGYo3Hs0nk1s`T9Hcp_@i75SoU;>bS_x;~OMcB6FdQKY) zTldzN0UPmrh;jhyfGIVO1D;w7Wwj2KHH#X>*^;6`{Vx_i$T6sZ!I&uDEi|X%Bty{T zw6Xvqi^;L;C)@1?RW(!czMP(pijtI)%J3p7El;m16kHWb^dEvna5m5#7IImPt`&rq z^lNjVMk3RIrr2{G@TFNFZ4(r82D1 zPVc~oKN+vajIS-Cf=J8~Q+p=x3}Zb*!{dI-W5#BN^~;GQS9wral}OF9voxjzmH_nl zJkLMW+T{PfZc_{p_ZbrM2<> zmR^0jOc{|;1SXcnrA*aSn|aLlYO&!=150z>Z-m7 zOk)dv3jgL=WB4D8(mr@5mFl<37rd_^$iS=+rjx@B>z+(o!(xd^jUJMyKIo4BkM@-1 zb~_y&co{CDo5I(BmQ65w%CVhc>tzVP0rXx6E^!`8THCuk9?B|_Fcr*V$1^2957o)c z&N_sT6vXpVG|zN90_^ECdT*GR>vvpDnHImy!Os5Al)1c!Fk{a*(z|cBa(b{vyI{qB z-3b~t8~mT835^$u83y+u+n{2PQJRU^iizYH+}ZNRxQEgqtN>PJKJ!ofx5V- zdI5#p8(VL=hJa_Xn*d|7JT@-!loDBrQAgiLzr$N>FkmV{^rZh`q!=J`Aj=X6=))4G zR5{{5-{gt|MejKOf0=>2q2uri50Ix4hTd3iG6i$GEqIO}<3A3eY9T$(6hNs`%RI|3 zoydQa_aP!bZwg?SFc3eTrId#E@p*bYCG?*ZduWTKGJhNETUusb`rj(Dtepm8Mqkx& z>v(0_pKa(V{9DXGXM|?5TPaW47?Qov>9ZfTA*O$=UNHfz!3gXEfLph3X#E@x9<0wC zmL}|WOMA}E^$Nh7I@!!!YJIH>c6Tm6eYO^c=kDzb+WT?uCh(jLFDE^0JSNpmw*VqQ z)W2sf4tXT`Ph|JIe_&59rr*UMrpt-HG7pwa;nsO`M&W-c}s)RHO5a%|+f$w^mX+>HawSNfFc>>1t})ehwTaH0Rs8)&ef}mpepUVZ(0Ain`LczL-?QC)sP;DM% z8*q95y^}Ey)J_Dl3{He$5A+H~g!Qu*kfy-R_<$O(B_Y{#q^Xbnj5sm8qA{m%z+3p8 z{_35106Y$L6Z8n$>1_sOKsa>(?;WLvN2|g){n}v?^!fOmxYmpRf+rwEmi!sx;tYIq zm#}xD(sBk+S#Ruwy`RGc1ar~LaL@`YO##Ql*wQJ31GC;iYjm8(Pp_vtK{C+3j^#s7 zr6hPWds&*%8K^y4`y3b_{D`rNBJh{s>coi1VIVn8h2#J7L_4NjM3AI9Gtgt_52!q& z_579_)~m?3^?b`bw`qtoC-cGE)7Ja2DVjFbwF zcI`bq8wiT*BR!a(9}E2L$S>Wf;}~1iydV}$c82l22*uqXtf0QZAaiJLr zjz%}3Eud3&-@~du>V<}+e4M0ZD9tJtdFm4Y6aNK6R_GqMCz%%}eV%@PIc@6h{-Nc; zKTKNCf<b%G zZD^lI9pBRn(NSQI?IK3>QWr&gemwVB49t&t`0GI`Tf`f`B&OnVGq@Aqv-6ww-$Bxa zk)+mpM8iVrNd5io=iR_(++E|H)IPvN2}!B=Q^aOxX9H}U+qviT7pQo$SW_(>S9NSV zXhIFOFCSM)R(06z@PH9+x7hqI$w~ej)`;$6{-?XG0X0VWyYDYvG-gDlnjm9lz3QKG z859#EHrT!y87uF0H`2MraQK*|7Hy8+R16f z#MYhO?mS?*9-o**$MSwLPi}))>geX02Lk5-#yN}OH;Yg9XTpTnD{mzxv1oe)p^<4nM-CQ+6xt0$R36WVm;c0Y>DukCbcNdhA1c#PpE zb3>0AIYLT!ig?;3KEpZTqWktgYzfv4?fdvsoy#&yv+tYHN!b${EzgrZd%GVtS2OtQ z@1ZS+b&yzF*mI(p91Ux>0Oj6aBgKe8Eu4z6ch}=nw;F!MAi_t%;fR_Y{0B*vc!qMh zG9Fq7QhCgk&9pR&yx&}JxouZ^u&?5-u)}DwX&iLd3d890#VX>%x&0b83GUF1@h0US-6|CBGd5*uv5iG4-&K0_ z#lm~yo7}VctL09WSb}>p!-szF#(n^_I&yj6XB`& zzgNK^YuT!U9?mV!vnZ0~Xt&E@pr<&O5qv8}EE>u6avZfw!yUP&+8yX9)pdeKtn*SD;jtGxsbap-#8(iNd@*WdN;@AUz)9z7qyz&5!B|s~$nh}>ZFh7k@CJeb_ zX6=V<`#pN2gpH#mAb|g7YKiEV;!&f#Ige*LoYd)xNTrV;|y4;0?srbHxUGHR~O zfULo)>b&86Sh_6;@^(8P?Uk$v{JtZJ>xu9VuN>tnrkjYMi4YI1cnGxGsXOtG`>6}U zJ1CVg$&H5I?cXo5f>a6L`tFMU$}g)?#ZA|B=t(+>d08GS{w7g8yU?Fg)i5lz-vUu# z*m8J}y|j2TPlsth&+~vagv_Hbu(sHJHdW5a1*?<|pdh~fGL3ihTMptOW$V|rcOLaqfC^sV)d4ap>P2zZ3OHGQ6Hg7^kml#>1s>W=oG9 z>byaKH`$*%KbdaVW940RR>1!(3lNRezm=!~GixiRO^4^WFRIU>qA*IP#dr4hzL$oS zX*a*m1b9UQt0Ck}ds8+wA$I;qOZWu$u{av(YeYsgrFeiv(KU4XYQeFYo5kSUI;GNAFu=t^o4`UIS}C+ibF))>8sgLrsu{1W$=p9plXJgM(rSa?&z+hS z(2qNcK3}aT^GnpmrwD1X74EbT3s=lK)UP_?g>k1H$Y4 zYq4jk)MK2l0S_N+;_M~vbCo+`-9po=I`vLxt$YAo)Ag^KM1NhEM5{aang_qA> zsNdzeUczX9sj8Mz6sB4#<>Bc8>5AbvH7k+;*Cl~{M%Dq1 zZN2hO9t=FmCBTMR3v5)N6|Nui3oTy`!x2IUgHsQj(d?(uemV_x(0!z9!^lr+cS5avi=uyF%^w0)1Os~@EK{GKi!9-O8usV4GD(o^vZ6#BX zqnHs(Nq`XCYlA-86T4COrZ0eIb4X?B5&!jlSKk0hH24c@qQnj(z2l{~+hDy4zgPiX zAJ@b?!HbLjA1hhbq+}^5kM?0#Vw5&ewupT*$nIMG6S=>m)4%qn$u+z0;azH$_2MW zCO`|3ah8Z&omHWNe`e{Pui?5!p3HVPYPLaE;ZsI>TVpn`ekt_kVjfKJ`eZC7-Z;iR zr<8OzWvsSjbBm-rfjslZd#5N-JyKb&NIh990)HroK-YTBp|X7$*fkmS=VB_;*0|8CLSLy!$`xTs3*wQmw&?MN@lppkrsQ zUOsp+Rm;iGLKIH-=hK7R+x$B$1WJM)wM~&rp6xA1VJdN}58>*!-f3E|DO5G{a@Oop z;wZtLBl9Kh>e;V<(Fe5R;bplE0R&Z;B4w2lzKq1GV>!)2=#!iX*7$)Pty5*$lzM_> zGdS{%d#BYv^aa%944QJ6J05xD6zJC(i}98Th_;PTlI zX6%QOQ@}jR%jNbtEx7v^VC*7;1quy)m!JjbE;P<2!(8i`2GyzPn8EEC56$W^nb*UvaU#+RK;cnx`JZP9sST|0p zbz@^SjZfe0%_W_Fy*h4ia8|=-+fK1$j6)f1f5ZCN^>t$@-7aqXz;h#fh&5&TewEE} zSm|;=wvl4e0x#w&aJ5?!fC+f~pY5wY#5)!lm8Gj9BE^XO5;PxKAjNeKWkaN(w>RM9 z_=4Dt6h|Nk7FkP_r&Z_+`qPu(l(D%^t!tJ#?IRBTr07nGsbseh6ODiHVx91K46mZ3}lej7xT)#jR9vFxBb3-F*f1IX{P zyiU`X6CwRIsvS26rFH6=uX@;g4A+jS$**OHYO~VEO3dgeCOH@5h)G+^A=SmTar1=G zUz-b_hxZqjARM>P)ay98Cn+NOO!dpIC9TH{WMPHAT5nR&k~WTDE)oO|+qHdM&h<@) z&r)Swh(ZFxTzDoQ9iF=9A5j=Ads65Vjq`s&h0_-=-SFlUi6;<4E_dPg7u|1^0F8P zpdVg&NDd+Fh@HGGt7wjkF4F_s+l7LsX`_kccPj`{&VD!np(sb03SLoW;z6(cDkZfb z4MIo()laqg7!^ualPXe{z+*Uol6YHplj+*VwY}@AD z2*-m^Fb^)~uj71=s9At>7sLEUr1@rUa=GE+i_^$!Nc)F=pjQz~Yinzi71__poyrWi zCC#>n^NOKK4Sf~@J@@S4Jr8D-qlECj-)A0HV3^}jUjGvNK%=wYwYFA20SNNG$o=om z{`VAD>UKK1-VHY2MoHWDbNnH-B+H$vH?^h#0VgKF47`KN=9Y&ev!S?K5HPApEBJ<~ zx@*w%E0_TuWLzD5c(7i?bZO9KX zt1sasKf9$3R{Xs>+ZV~e}a}DYy6l9 z^td{1oekF+1y$u<^*;dFLRc3>fY5$F-#)MoXfdR92*^(lTTYd)w`D|_R6OSjw~O(DU-%);HY-PCt8tXI6Y3+8)bS^&GR5NWCf5ndK1Sg=2$?@o|# ze7L@bN-4$n#p!9V`*jT@vfxZDYm@el-s^*KwE=EU=a~5?c8zJ6D+gUs8}(j>dw8M16guy^7=#y9l%B@2w3wyvI+}vdtH>(*W$`xO!Ig$W401}* zjs?-zFR_Js2{|99(3wV(i~Ky!9&QKML609an;a2z%V~N- zfuexD3|w~jr5qKDmmLW`Q6SOU>bXQ}+vCHnjW8+(JSC_bPe)PWC#7(2G=*0mnOn_S z)d-}87Nj>)uSXob@(j@7Ygh}fDyjhoA~Udb12>QeLNp>Qf7v9-l7k}l{j&ZZ9@cYV z!dEo`0*ayUndi*fyiCwP`#2#&%P?tc`U|)|3 zU40U3&GCmYVvH_C%_8b`n2hG-p^$#*=9izYeU04*$*>t}cF4kq{2>D2xe6Y+7hRHOv+iea*& z)Xfcox~MHKlCz#_mx2`Id--Y)=L~C9dXw{BZpYDL0aI%)ar{W;IDh@P9+Z@!^XUZ! z-bMTGI!?>Aj^jb?NzI2%`gFX}17j*e@*c>a;kD||D6%m79B8DJ2#i_w1ApyTt|!@~ zz?@RRo-P(+YGMXJx?(JN?3KA9TmYT476UgQZV&C~k(X?0fn%7S8hF)wwH9HcgQ(0C zD(NS{hR7INdI+oskN08grPlWcK%p#!V*ybK+mOkU7-(0Lv0IbCf_laE90zD!v5ngz z{?y?ZogXwGCg&@p33#Ru3t@@ZEf=Zz0Hn&{dZUhi%b}yatghK~xbu z1vvEgfbxk*o2~8;q7=G23K8Lo+tJdgB3+}haZcCwy+5xbCoBmIhdKQxeVT5&0EQH6 zv|F+?&WMyI005Ob!fP?o3bq`j@cZI9{HcSIzqw>;ddObED?fWK^{gapqXdda&hIVO z+^vIVMym7^_%gDD(7)Eqf)r55no1S4D&JeTs|DBEM=|R#_=x>ULcZW~WdhMp>b`U< zaqpfH3hk?^VoW2g7(Aa|VlWg+49k>z{TQ8|kBe(M&=1{s5dQMjG2skl$Fzx&5L7sm z;(oO3qgRdK+6pD~8kY|jg8u{w-u~Q!XzuZS%l8`6+|k(>lgw5sGt>4zk4a3a=N@dJ;t>I272;c zBsA)d9R13|XApdYrL}bB(~&8uU*(8EL`XW$u0K^yo^U%IGq{VE;5b2csX(f3@@?@l z(Fad&Vzmaj(gzTHlWkT~qbFqVClA(6SB&44E9BS9qnQ=OR`Ka>5{c14Lu7Zq{Z()!UUWjGwnN(PO4K{ ze`Xr^0G`dR6Ez3jXlV6d=9gm#t9hi9q!pbco#;!tsW6)#C;RmD$srB5=M}y-ds3G? zy?XvYvpSiFyFVh@5!)*(S^LyeQRfDle)|r1Frs{c%okXDE_eYbPQm+u5!W;Dc{}4B zP3-9K-~a~>!ho6QxG9v;DD%Ju+TOkOhOv@_ob3t_B3)Wc06Ex=%%fPT7Hm{hd zLPhmK1@i-rzmzf{FG`4oYP_XLWWVnH&v#I>XX*7NM8wKH#)WWbjqnZ}TwFQge+L|Y zKp_kQav>@h36wlL`|RKOG`vgTucc&P@fnk8&#(b@x=y=8ZFt^%-qz&iA+HX7``z$Y zuHnzjx^0TCOEwsq)m}koC73KpFYA{Qmp;rr zL1bSgnezQUd|$C9+uq_pE-ww+v|>cFZSmsdik_5do^4s#RZY9*o@&;xBUZgd*0z0L zn&pejtZm4?Nl&@J(1quLsfzk^$^m5v=_wU>phS;;)cxXg^B28{l z#%b13`GR5o&BP_f=SsEj#^bIAUs9`W)Q|j7ew;yC6$*f(g>TFSt}t~**bNBj344i+ z?#MwVpWXy)cZb0SRCdD9&A>Zf8bz)FeK|G%wb5irgGlB|d$8vtHYv0gXT(>O)$<$< z8vkesA`S$g^Y=G}kL`wWB!&hgknBlD(A6yp!J!+5ZR+%_Xo*sa>Ms4L^hWF=qrV^u z$i@)(%MJ$mIapV)btbHs_jFfd4liGixNV34V#ndfaE%u6-rinCOk?jEyA8Mtn7!_c zA3*izq`#{?E-hjYTJ%0@`fSBT2vH&<+6rdZ5l6xjvG2U+JoNt3_pzQu0=GF@K!F1) z%zk6J-+=^sIYd=kD-3aCqEK&q^ML=9x*);V&Ju5 z=V4& z=Fonq>FCajcXZf}o*cvC&-&}>Amj9^eO95X(}@>DKVnQV$+s@%m734Kpm2oJkE&9N z&MdjFN6}#)+sE!R_ zBQl*#Q8zc&_DpobW!Jhc^5aciMS?(!pBiikI{A^m zo(z{7!i5JZMjPHI@2d*+VblE&enardo`e-$uh-fq^2o9~ zK(1|lnCI1rlWE|v=&|6sIlXtWTsC2Y0xX;i=$fDSoTtFS`$wv4x)2CBFydNu&AtC826WU)zbXjk+rGH z%+7s>`0htS>*d^p7LhkwvYHrN@YYv()}q94&OA5nTQc`7YXG)Z+mFeE2j(9oT$j!4 zW?d}4{{23!?6|Uykxb?`s~mizeg;cR)O!0KDW^D03i0i*Jr0X|H8B--9|FdozhxFb zf|`Ek8h&M{G0vSgkb##z(~;NB4;zdEjymi`ylqRF zdZDJA<&)(457VwbzEI;*{2$nK>MPLeg<~%PItAFouZd)Z|Aok|TMII}Pvm3Y%b7R6 z>q5PRuC?iU^~ZXKsHUAIvq!Gz&iXJ@r?FxEDum?~N~?uL#Rbz>*&3xv&1I7-1&dQI zMTs&Sb1H6b_1q^#T4ewTU1s22_9_YgD(Sl5kRR6D6M8l{Z$5gfFV&RZB5gviPMBF_=@s| z9V6JjfptO2__f>k)^v(WUp|V{#=0@M9z6xrDYg_u396gzaoCzdh(qiM)i}($CBBZR zO8J0pXbY~_-JiI&ac6`9 zHSA=xV{-J`V-8@wHO+;|cJG;F?B3f}?1dx?>c09P0C+%$zXHB2Z;>aNa6}mNiDr@- zbds57qIF?64@S3w96%uoRB+hWP*yD0ki^DKSZh_$b@QeL&(k~`ADfi*c&fK&P`u^4 zOVYnsLMci-yn~c_2W0iywK6m`D0}X)n;fwJzV^NAvWmrZYwnk)KlMl%8N$cgYbH)L zRU94z>oIc&QkhTT&c}h@+2-KlZ|-ulf&IwSJ`HAz)9!Y{2}l@P6w%ENAvxDF^Vzot zYySx$ggkh-y1CtTpze2#2e>9+8gXFmdO_N->t$wHiz6hXX%OV6#F~i^jhc69W@dhL zm3BR;U_*f$RKZuT)nvoQ4Kg`3Az>6Y1c?a zDjxgg#+z=I4eQrRxmb|F{$5$JY^ilszv>k)mtw(_jT^=!s@JVcd&UW12QBrxdFe5m z`&hX+v&EZBR5{$TbEPvI`SfR77sB)A=;Y6bIr7Wpx6z45xHyhrw(WP}bFGIELdYY7 zd|mGRo$7bg1cOApqPpdh6c((Icxqe*R_rbdmu)A@R_L@Y zQ=Oiag2r96a71?Bb!X}8Evxv%SUc!Xy+d-sMbmB+Cqf9zJ6ovf3O4Fs2xA`#Nc(c)IUGDA@ zIPn;&Sa;$vUwO>M1Kl=42qBLwQ1`oQf$NDPvw-Vs_6L93bq&L{(OMq$V%iwz=nR61 z>d|rl`2iPs2N!Y<8Kj_faC&OmzIrk~F)p<_zTQ%mYIR!YdQvKuRSbsGxAVU0Po%C1 z;K^*i;7OrWkW#s956J{UA$@gEp0@0F>udo*50-VJ!~A^Ed~G&5?$c&4pQTL%wh2KB zLqZ7YZXW3MXPZK^!m^_!OK_c3U815ZS(ah&)NnUMtvWee`oL2}c5Otp!r&sWtNw0qz$xeOp47{ASta z&}sR(Y&I+(GA#SD{75rcvo9@isb7VpAK+bqfs_g=3^6tmHaH}~(iKu17!sqx}@nk7CR*MbDZ9|J6xX5$aeA&|F=E>$JyUF;CvY8_bGsljNO*ZJX z$RnA}%`>ujFn_mh-0^#;jcolmVYn%QxQW@@9#+8h2me`NZ|EM&jLb|lI)6Hy6OYbx zz9p2UfcQCFx?9SYEDahDHHgPN?fcO_ZD7@#vMr_K3LiL|N*43;aW-!=bceHj zP903QTVv)UnujR+Ne1(G>xRdV%$Ih-ICI*5%@5jUZ_~K*2yR3FH9$tV*2dJ2)<<+< zLkl4^TQK#&HF0GBSwI%YF*9U#5G!vFgidL73fo*}U$(Urxi}4B4b-15kBrYOi-}(p zRC|a6nH_8PHx_lVa%80zzYSlu38|AVkp<0<&5Hc+fW4T_Ix*Kg(3pqglKyvy-#K(^ zVC&uTe`4WtnbwwZo$|6%*!;l$ZSD3D;WG8XupAwN9&-K}>)bYYWaL`Q^;(%Z?ZVRV z=4=<66( zJN=ezM*igY&1N8PTGyIRxjf5q3VsVm8lJtz$F#ZzI%|-n?^fkjXTJ157uKXxSV!{f z+RAC{N{5}tJZDWhhZ-(p=W99gscy>VqAl45vn|(>X8ZPS%5u1L9t@kEti0P_>!v)I z)?ls;YoDHlmPIx3xfg3$dq?u;`yt;jY{5*Y7;(H9VVmglzW%XA}FO2g!~TToXLG;@|`jS{@r>2!6CVTFYZj zEGp*Ur`40v2x|#VX{>Qu!ev;N6Ek)?#lrQ+q@%f6e9TlD*{%W26kQxo5*(NrX8#YI z2PKiMiCpeG?}Nd^l#dVA=FZ?@EeE-k*$zDd3gH%JZ0E%`y+06UTLq7l>ZO`&o;u$@?|;S zFjscnu`tV~XEGzFI#>>!?3m0P%oe{b<;|n9u-nGDEQd~R?)GnrndznLY!Of9Z`+m! zi4J@Dz-ddcbssmqwyj1uIv&9Bc}VjAkxpZW-QI7_mP02ux9HA{pN8a9&acfGFv0Q= z+or+xw%fMIZ2Ohwk>*yGUpZ?`JJFc;`{I?Jb${advG`uBViJS$LP`8cD&+-o+gD2( zo@lgK|3uuYAF*iOO=+E){~?%9%+|CwkIhftO|>tH@R_M)A^90?g*NRTN^#NPLPzFf zwk_2*jb-vHQQ9USQgmY;&ehF@<;%>>$vd;sSgd{d*_g*p&wHKiV8OPT^H|;N`!Jt{ z+n8&SeDe8t2yfl=_6-5^+?Xxc<}F4ybH1x{`{=MebOD`q*XS_gf$U$)O1F>)xcDOq z&5uXI?lg|_jKkgO_&>;7+`fv3AVW4U$t<=y>5J^L4Q$!Y4*Bv=W466}q-^8n<^KGb zYv0^FlaE?lBi)2ZHJ~peD_&yZPAst>xn z>rNwv-GR55{%q07lrDqSTDms%VB$6~rFE)xozCAh{mn-PjcLS4-89HeH))0=PHHY5 z=H<=8p*Wpo@irUFNN1Ryhdn}QY|6~cF=pG`8R6~A&t`LxCFs)5o1^K^-`QqJ+Z49F8qvz|gGhcGI@xA`O|-)W7e7{SWd=u?nPe`GGrM!# zLbEg;BIcDRn~X4%mbzs=hGphyj}RJ1#T}wXotzKL?7`mnEM0dg%_ckAmg2T}KGs}W z*6Wk~;XlPotQ2B zpTK-Jx1C0O{b~4fwn=6a#LgP%gq;u0g|EF#wH~uHtohfO*}^;F)|8=MHw>?RmSgtP zlWym1f6e`9wJrbal-fgQc^^o(AO)XUE_fxGoV2N?nQ+v2c8;fE&6dZ8X+@!yipQ$X z@+G!!1M4A%c+>>4MKYScndCML1u=)4YR|k`$lH=Sd&r_nTb zWLy8*W3}3B%r&nQ%`{yufP79ke?DwBX3lSxgXWr2OF?-^r9#57PbV7W zL-PjUy6tFS0a%GEOTcYmx{o#^o0*1owoY`4*J{nYY~tp2rag88E1a1%Xph^T_syL{ zc;52iDOucn`Iwh&nwhcM)0oAqe8S&>w(WF(Msuec%#z9`aOpolW^7M(6zl|;#TxUQ z(Oaw|Zd>QrW?NQ&Y#s1sCDctjvV6~LQNvBBHEw3IH1L;3Y5QxBr*4`^j%=QJv%mH@ zwnh5mj&y47FPlFLt#O-wZq7{G6rGlt%^nDwNJFy-FBOD%yyoiLG-_TrHeJ;FFg(Md z%cK>xeRw&J#Z$3ZNqXdx8+AGfMT$e>`$Z`vbzMNG<4Efr9E>c{#zy5g%=y!7ZOm3{ zR7)+D&Tk8+e#C2WH^rOVAl%XVZQb6aS{$gGw2(9W?o2bV%V zrM!R3NDrsWnLJtAcHq)=G_d@Sb0m) z`S{PG<&#L`WMwOhgm{)8`furI<W4MLJDDrHt>LX;MQ&w{5H4x!w9;58 zy7@Ua?Lr%eTFtKgFr92QM1br5TIV;(Vp^hb@sA%&J5y{S^|vmZqZ!|Azopag<^C`q z>1XROzq&4NN;9k(u9n*YbM(grrPjK?AU|#OTf;Pb4%45UwI`td8MsKDadXoWI-BL= zwHxwaCc3q{N%$^xq;4d!7fM*D$=|QMC5_+~GdGvtDkO97tk#vIGKmxMqqjwZe4D=g$~JBJpD;$A=}ew{2){9U5+~K(lY_s*xqz0fcZ^xf9W)6ov)@p4a>sv zq+zZIHRCkmna6FzT;`Z1EFbKw6O9#Tv`@FtvZW0=hjw6&ZE|U}S~IU*&Zi-B(RqGz zRk@YsXr`^!AxfHRHa|z}lrkfrGqyGq5?jEnJBQ03XESiiX1}>O&YQaW+c?kQ<}1uJ zH1Ez7k(uew%(6X4IaV;w)@_yr+RE~V-}L-Ur<6uw?J3TUrIJNQ-kP_OP6{r-=B7^O zY0fv04Dw+U)=b1iBMZ+`{X7lrZ&FOT$T9y~~n@y&sVQ|w}YUxHbr<<1k zI1n%0ko3kBQ_er1KbJ!5UxVC=-L`_v$<20UsA-LDo5fn=Ia=d1ZJxA6ZEoM@SbnON z{G65;>ebhx%ru=g9jv7q?IO{c29zZo|!+{@9SjOhCqd zUBaL)7hLqWW-{4vX&j%-h2GIbvQsBPw{$_oFG~`X@NeKttO=^CmYw_m+j|pu%dVEQASx{ih=PdSh=dlEN$m!Iihl(aaQHj41EA6fGCP2Q5Fle!C6%fq zHNRJHymNowxAr>c-23jU6!0pQD$jTCI&1B<*B;M4d#^LyTOh@ai%2y73gd%Q-kZa< zT0t<;i6BBgLSrAretIw(v1JyC7wtF?R4a8@@;~ruR;^9g`~T)v`#=BZHk#953PVnJvmz-6g>IOlijJZp zQwj==7Pm?je2{7uhTL@uXTSg$0+)gQ(SIDct<3{set-O>IqBD!ge5eq{7LAgO z`GiA`V9orK%i~bYK6MX(@k=@BGQ@b+_)SHUhQi#g0`}KXh6zy?$mb7-EEN$3&SNHY zIhCw@qow{?3Ab??MloIFlq2Lw8w9ZEB*((D`X^6Wq#`1m#V3WFd~y#uxIfeb{!wMJ zQ2J=!@Ds5sEYc^}7cGwqmLIet-7sbCNwmU7`3&2{JnH1S69SKeB&y#L@S$^JA1^6# zaAdJ*hZL=b2%91$Ed?>QR!C}vQ?$n=3-zfZmw*VQ^eiNsXEU{D=-WUZqpd2pl8U*k zPK3*Oj>DY$K&0^TF@D@ZL&vW`t{=7)An^b}mh4{d@s%E-qOOaMVA=*bS0OqA} z%V!wt*pjNYXYc*?%2&SAI+bpoHto-BKP7*!QvJ{Skq5m`@9b)|3!5Gyx;8brY)1|~ zV2`+Rz5Uj!ueSfVBJcoL-6^? zTf$9o;w14_Kc#*@UHWangRj?Y(1Q%}OTu101g~qLC<`e(suotUT@@Z5R^qJ2P_jZ` zNFSh59pHQvDOxenM}Y6|6yPs}B0c*c>xT@$D?&oYn7vWnL~bfip=2QD zV^q7P0NUk!pLkZ^)e-TdcKnI16oW4_L+*Um1%y$}J!}0gj>K-)su=T?TFq?(NmTs{ z>U=+_f-Vjr;t9xE&;@OgELUfeMDMSls3}4SdK*bFR5DM?*~#~sgYyedrhRTfyAh;i zZ_u-Dzh^ZB*gMrK=0A|~_F_~A<*Lefj*;)GPyz?{q4s-9TZ|i@Q*IDRf*%(tna^k| zq5c>XRm_^v8go#JC#6d%T*Mevj^Rj^Gt__Fy3J7ktOoY~gTO7Y9b=l8R)7@jF~p8Z zGYZv^rl{-a@j3)WrU8_|?1z#R$~#_GGF+{0OsKlVhzDfuY2x_c+KL%~DiCz)Z|JaY z^BR)_`Gg|@6VA^)#P@i-^f4#!@ixYTyjbY7eZoA!SSEu>@5OtB>f|XS0^>2#2T~YJ z)-)4%+>eZG8Mv6GTNRmM!l?b2^iek^T`haWDQEVl6r)I5jRzkyk(K&mG||{{Rw{?q z8Y0TC_dtC+c%Wi;-Z5kU&-ZwBlGb6>3TYk8WX-K&~cOl z399#+R@s2?hQ6(vtJ!y6H*HV2bi$r+*@Rtrj#+d09@tJkq8a zXox7s!Y!V{DkCpI#4>9b;3T4h`c+V`s?xAc1HZUSJ8>K+$O_TcL7Te0wpFGktO~LY zb_!_F>!EG@?Iai>4{sQtB9p8DqE)9rAxdxPM3d#T@e2e|-6Hg@ecu$W$z`o@h`&o3v3u*ttbL^qWKK5zogK598c&T!I zCKC`@pL}2E{p|-&>R-sg1Ia4BE{oCxqz&?AdsDuOWjUOv5=SkeWxug6=ztBZ4!MVP zJ*1QK1uH+^I4vU=W<;69e2`T2XO0T9-)M(2#Z!Mk@N%OboXkDmIpW#xh(kySPEd~g zHNLrj5*Rnp#6gNUM4&ln7tW@ta1g82x^+-ihxKf=Ky9l}G(b(H@_LA8d54^Gj&=;y zhA9Y-qwGEG_9Dm}!@f|(c+T?@<78GCul+#>)XnNKu0KhB3he!fl-7p(Sns3#oLe-% zzzz}Ze#_dumNiicPG9v}6Ewlcg)lCdC-;FWs3K4rD+NUR302fl5JN^ue!OtL7%~6~ zHaWb%sA3Yek>fNg56IF5ASsa27GhNKoaGn_dphn1jz!-eFi1AqCz*XAp+pbo(Ruu6 zUGlNxY!O(>HWS7Mwg!r4l2Jo)ig#X`ZgBtxoS zrb+W;o|PZ7*^!$?xWKM1D3e$S6NP@wqEwGQ_ElY^Cb2GwYaYO-+v7!~X&e=t(>SQG zmSK(S*U_droI#9nbq_BdaW3m&|AX3?CfZmaYuzQQ^_JjA@WK-Of|QdkQo&yPQy&%_ z?Eyzonunmsdx-t)JnVfFvd0P%sHfwKJ`Dpv`!C{&C{#!?SR4_Nr`N-!AvR`!Tw~v9Edwc|#FMUK&%7Ubai`Yd3}HD!r<3GBVxg!vFiAEC zHh<7;`{tTWtY2r7pvq+3W|x+&+E@ZDBQNB^vy!x<{YNI@bWW|e>2=e#wA8Yt#g_Gs zEZX6n_gQP9X>Ab8=4YZgVH1rB)h{L<=1DNTjCq_?tJkbntJ>Daq-_B)j!jxvSOCr2 zvDsrbH#>_(u8v8ajgQXqyqXgzXJV3>;>(ntzlSTfgcYI1RRQwWcGZ@U#S;2}d2q|C znKe4Bs7D?3s5KVstQ}1Z1}vwb%HpC`7Zz>*&fRuw*DkCss7C{tV6f=O@M<_`xqzQd zu}rUzz@QrqQ%d7<;x0H(I<*Pgo$Yi$NW?`;>aVO`#;$i^Kc=3;~+{~Fzs8$ zfakK?QgEKaL_zkE#Z2(^j`Z=vcDPb{<;NsAx@!&We~|PD_m?K@@cm16Z1;U;N1<1) zbR02uaJ(_0_J4tUX3m?FlNhf!8NryV(20SLe7T7}0Vyo=B+HIEgu!)O!Ks7BO<>Bc zbHc~AOA+s!$1~fcVOd`gHBfc~<9=efYm>_z+j;Ys?9k1(m`zXF#PmA!xi3Dk2svUr z^2;{xB-JS_2-&MJ){orVn-eE28fpu8J9Qifm)dh>k^#n^2)5Mn*l$i^o}n$;qI!V0 zCO}QzWhjqj_(X~sMm4W6t#EVw+Z=f>s8H}5SE3x#%aOgGU#c{GG9ItiIQ#atd= zuY{sqg13ih++G&0T8S|_wuS4+vX-Ml24ab0jEVr)cu)A+K!8h3v7uiPPce=+S7@6y zoVzrC)i4)T7cgAWD(q+;>soIy7CF~*uI^zCm#>V>rm!|oHZUd^aiX};g3jwVci*jc z?Ec$qc6OJ|%@cAa~r~Y~<*qZvXIwj&JaZt2_ z9fi-=fM3(VE~6jF0n2pkXFtYWc3!dX+=qO4_JA{yY6Bb&P;wv#Q<%fBzb5DePa*+` zx8QWk2Bh-|IG7dQx~Wk{W9c5lhMYtPt_B-kee2_lr_(aKg zz0x`prPh1Byq+1!Ht#pj&+ExgW>aOG{VIX3B1D{`-G-mIlEzye{j^_X1Wt)9*A?Lu z_BaYBVQAj(Iqab>8ko9_oMC@gJNtUZK}91zET8SsG-VwRk*F zT2Qw-+W@&LJ!+f9BY)+C+Ow{j=vk&}jSt(y7LrrXh&*0;5GN26Vt$DY#~Ru-iE2!u zUH$H|^+1Pi-)V=E@!QBgEC#GZnlV@pp z^@4Uj-hJGn{cJ03Xv><5C(>W8a^F!-=@7&I&iWbsR!3bLtP_rHK6cVW)z;$-ya}hW ziFvPP9npb(ciTbGVDBDla2`M%crw}RwDo5S70jWSAQClF>(Vxj8zMVi^=19CC;%GR z#+66y6Sh@gUlxo<<<$1*w;?luHVk+^UJs^mz4}Hnv}l(?WO)WD4FP+UL1G@_h*JHu z&)vq&$Au+8B&Xi%<8|XS zNk%=Qf7x#-4Uvfjo$QeoBTH)w^OAvVB21C=_{@|Uy8v4G*eNby*zHVcGEMd$p+u=id z?Z}~hR@r}>RUWv_2JK~0e|Z7R-y$-HkAZd5uUJ>%8hU;FSVpy2HFg8y*w4Ab$=lCL zk|3+mX&i`0Jdb;(C73Z8?GsTKyh!>YAI$YWyj-7;oiSm2vtvT~6i#wx$E|ceCUU*U z(cT?qw;`#D2&>xQo@KHZ2dyY4h%CusNe4uIy&EC-QI`6gAJq`Mfb+B0!_yYH?EVv+ zM&Q3aBF&B1E+zE!QaIh4T)DC z=XvJCytwz-JFp?o7ZWzhR%f=0; z2cLuLX+iCR+6NEWfjjQ9-tr=dXLyLGBgKqVkKh~_tPlr^D#p^t9N?p2-!LL^B9kLO zkT|MH4)Os=K&GJRWG9(*qLAu_1JDlwuczx6PZ{-8I@Z_q3P)VxJP74>+={yd4Z4ge@?!C|U z-trYJ5G|2XrgB8AgYr#np_%~q;lOxgNXHHRvC@VCj0tkZaeT0^Xq)Vl4duvBoI8Y3 zFq0j0ER(m-BJ6#I{RPf{SKu9s8p517CnkBt9L^)CUh6~Ox5e3mphI@}&fCon?nmCJ zndZD6(qnOB87hZ7+JrJV$4O=l5=qV~C_8d$WD(KQG2Uf`3o^gaKdyJRC@Y_VC?`dR zvFZ_=dIfy{E6jArgIr}$4n4}IJ;J`wu`ZrpgyXoPO_964pi5LNCq?R;Hi}c@~CvCJZ zX~45s=@_SgbHzIs#>%O+Tm&$EY^}bySz5ju^9kEL8P~MiVED%?9tZ0IVY8IOiZ< zjy=XaFA!95Vue*$cO^*Gg+o?bJY+M69supPqX+M|*1-qN=8joq`IyeFdfi!N${U1( z9-Pbp=MS84@j@2X9+IDM1ycJ_w)X?dXPqdKgSd8RokM$cYh6uuTki)NQKt=aNP2dJ z%Q|MUm5)se#k-u_B$+_i>y^Ti6Azn^Bdu&BT!FcAE?NAw)V4AwvqA9*72#F{(1 zTF1~M$Hb{Qn$Dy0L^oJ(^dqGpq*52}EJ1_vfD%Xiv1c$V#+uiR$c`J*lk+&i zt8;ur1Js3MeAnl0vi{f{f)B0 zeXL??U|*4Rr-N++hpb^tLR7^2ODw#qf(obdN$%9qjN{Td^UC@d_BG6QJc%Z+Os`MQ zBOl+vzSYUVGS zNEqSSCTA(1QH}~SBr$D<o;1b-xdupmIhqcdHlfv2(EKW9NXfcZVT>2n|BW^K@+BMEL(pmjKmTbR>uLJBXi zuPb7lOE?BuXN)^?5bsEGn3HpK>uFR(^Ti!<+IVkzdr=8=3CAYKEIISyIA$EnVJ=Rb zrhK1ydWJ*@`<`OZbt!$wV{He5wr@r!2q3^gGdwLQ(m_NhA2^Ste&a%nr9AOQ@Ab>sR5M5n_4*QT- z-)bN_kIdI^Su68c=c!hn&WOepp66 zp#$m80P-Gk9$A#PJOqu0h!4{KN3k0JoKGRsd2Hf%uAwh@C2sl9VY`3lT{d^yF6;Bn zJq{Tj{^}p3QwMq32vOuoJYLp={7n+3!7p( z$;m$DsjHTBjKFIX(^kVitf9RdHcgAV?Ro6ac{t4nt#|kk+I|P*16Xx2XEy0Lu`jhr z(8MVox9Pn_K1ZrkSvPXklSuW;9RWN%Z-PJ@)UEugXzd*mEuxtk~90neakUIRq8)NEXm{%PJC!ym00Ad z4?|WIHpwQBqt@phURj)9>R4j}j%1SyJ|j`DG!JkcByS*HP#rW0Ut*#*Y0GdHm-zxI zP9iXpteSYew_vsIylt%EBy#Ss%^teXW)FhEXTW*Ivf4VR7xLUIr0;-2`J5!yc+Hm@ zBYuqXWmZj7FlXlB_*SPF@BIKf;L=@{^b)`_H*Mjl3#H+2>q3mC76W`lRR!EuBZ$Vlm|; zOeeB6*8z2H|DHoObMHZ{wo@2zINRu=vV2j3_2gp33MxM~5*1C0pgW^<)_64_IgiZ- zoX4&l$ho;Wn?E+E1-sMc^P5cTgTguU9>Y_a8ayhC3nc488`se;`cZWQHJepAkk0w+ zR38UY&lcxqY-#SO-SdT;&1PmXKG8>V9#xD$=2t^FFd}2dYnP_bNP)Cf7?d(n8?tcD zsn2pM#vz|*H&w2qkeiUxsg-S(juF&_Jj~q=!GhigdWg7jop~b{q{$lfQ@d$Y1mfApD%8o-cv|Jk zyuc}YKT+rH4L!e-lP%N8KI>EG*f=FQ9C=Qh6SZj@;FzWV*I3uI<`igx$Gq88YssdT zm+dS6{7<&pL1nJl@pMcNiZ!sNNLGE9i#o2qGBAUfdc8vO=?f- z5;En%I*KPsw&Y@-fpnhF7@br(AJQc;k58M#U0n=IfLP=sc}kA75)1K3R*;;6bC>+s z;b<2a@QowO6oBm3F6SJCuOAB$E{vCyF6&p6Mwt&P$pOQsU!6>j7ac!*xT|?*l8;{{ zY9gIGkC+c2^A|Jts~8^&2&dJcpXk`G=giwoF5r`oxE1in%%CIf&Q;(yZbf9d! zj+IGl{}@?fK|dnb?5dx-k++NV?=pStWa#yvG`}$L38X*@`#{U$WM7n1T9BTPNW`<1 ze!9ZQH?J2Lcxk!;a}zD^zfD(#ILIA^#-}RxLP4 z7jY_KV>wI1coeDeNM&}Dci*ROpOG~L7uOmri zQI;~V8^fV@U9P7cgrsBG0mHEl}R3FNpwDF$Nd`P5u_{ZB)&`m zM@tX(V{+>+ckS5WS>>U8hRTBuX?>igd`Yy?cw~8D8?x6!Ws@skkN5hxU6hgK6YW)5 z`F?P{>mom?l@7A{fhUY{EIaWIwS$z`eiUQiK zu;N&cVw&7u^#+f2tIn`@XOuc8<)?JXM(xS_SaB)d^GWF-*L2$*QJr4%r zB3T{OYyxKq6PUx=d?^mi9(1u#;bejN@C{Ryp&H?n)+FC1VtFHc)EQvfkln_)^a>{~ zVtKC9K4eHd!a1j%*Dp`UI1gjXeJ%mtBx<2b0bjHty_2W+P!Um{Bjlphuthcicj#4fWTva@y(;E45PXIn z4!RDA@4#aCBV4r(j*%Y57N>$D(Uzx{U8`HCGGU$Cq;=|3)@`h_Zgbk!opqk=xcDmD zcG2aw2$_8zoa5t?t*~BqQ7q??Q`WTpd zd!3ebyI6ZsD18JD)7%f>yzW;n^W&311?fKXkqgXeT*oyxq>kdrnA!mHkq9AUKy9$)GCj9 z<&CT?_JT+gBNhdAquQ%BV*}#BrbQA7wNR>n&^cE)NH&~!VV{VOBcCOc^SHRIj*`=e zL8Uj1khd0wlqd6}EDp*XN0tq)x4HQyXsRq1Ysw3=$FO)~P%)k2U>_VhUqo0&9?oQN zZ$r_>Dc7Ymsta}jpZ~xhrNhbo;~5X1`{|&K%X9qc0)T^(>C%VJtrBO0iG&#G$n*L- zrFeWG4BIeFInz;eo$8wOY8xXJ$8;%AhLcQ+E20P#;$1G^Yt=vn{)utkxXOJ#{meF7o+Gn@};f; z9Y+v<1MSHEL(0d0EEj1|7hQ4ISS*nGH&GgwBFQ-LSLoc<>yf7&lF1eJzLH*ilxWNP zQKkx;C<9!-u7L3!$270_bDcXfbHw@>>vSCDJR%vdSwwzb5Aba4xL)%Njib$(j5-u- z^Yn?rmUhZ3Y$HC|FrJ^x20ZmkgojABo`#Eyk5{JQzQ*y5_SdVJb5J+_hTYj`?XV`C z$JrU281Tfk-L=7T%PN?Y>Jxn4P&xX#q>XDbBFp4a?r~z7K9@ZvQKVs?4TUL_g`DC+ z+Aoq*yD1ma$&^UCJf1BHd6+U4WwE44>B#eZ$fZm?A#4fSr?8uH3nCA@q)R1A&dFm| z$V%@T$`aGoImf2+te+IEjkpI>IPyrg!*Rax5Vk4oAP)-WM@0tcSQqc}qzEe1Esu9q z=zT+3fm~Mzhbm*(O!RmGhAvZ#TSyQGIB}BW*sWp6!%>8ej$;dUU991K44f{gk9m$4 zayT70c|0A*c6Gv9)hRfRlh$j%d4%KGn^u5^VmbNiekt{CrfDhK6x-lLT4W4<4vh);Du9<|0}Uv(oN43z^%=TQp-9XfO- zZPg)(b8%$Cv|z?9F-^v?c*;H}Ei%x@6&aQxClLd1es0k^OKs>Ir~q^z?&P6HBP|pe zsa!TLmFG?y1_9&HEj-hp1KDchEQBv6Nb7Y`eu;~ex9g%zZ$q+Ex}?u|(y4rgp$73S zTh@bDLFqhZ500ZA^GA-bgVAO_&dc=LiZjoQyu*{;Da!SDR%zIVA97KaXF)E;D~}|n zvRp3OhCbP5_K9cq$xeE*ape`l;JG7T;7QKv4Jx)l;UQb9J#Mtl!{t+#_M2>1ayidD4PO2 z$Sp{9a_;Kj&Z4Jer?_Oxu=I(Dh?kr;nJ(;;EY4sa??|$~+z-zAO`9Rvvq^e#eN$Wt zOG@04>m7N#?{|t32S{X3Pyi_$@eCK`;M_MZ3I)BSEUaMS#kf$V)-XTJGkrNXek{=e)-HR@H`}%gA7vZPxx$*;F0sLe^HI%nY_PQ1>PwSWTdG*6 zGlBdjkRQ_X=VFi#U(TaT%zAKNLqz`2fYd&yCMPGc^|oa5Gh@_NZ!hNn_LPSc!QT5~ zRL4Ttrr^=1MH{9|X_H-^m-8VfPx|pR6dz@d=(BJ!9y@eJdJ)P`b@Vts6aI}qb7NQ6 znxRO}BONmCR9;eWXR1Icb3KSpd6XwR#mgQ<$1!m^kLWo5Gs6td);n+@s}1ZZK3|47 zBpM;lGs01Rl*QlG<3GtL4y1opAYl}?mi=wvNblU!V$WxJF;4namg^wn6Z$NkX|g&* zo;=xs^GF9$&Lf-#_8)V=sn^j1`_VRd==`UdR3D^96+C|*oL&YZX|XcQE$z6YQ<$=s zKPr>COzz})iI|pQaps=lQaH-?CL|r=lxJo`nRXNlI?zfxPC^A;AzVxw>Bi>As6zVS z9#?2fs(Vnhdn{M_WT&=-ed4K4vostxisJ#~2a(1C9jX`?FySo}UUkxyCrpNXk+sj~ z9uFS&^?vEapI1jzrgf!}tj7L5>Wwy!Q|1pL21dO`-hZxE$)KP^Gvm8G%5SPsSCo3K6L+Zc`d($%ZV& zXYwe|WFiSE&O?!B((o$B1&U>|-TE=tpI7kb>k%51#d5sI+l~n_-jUied<4 zY(tOhSQ_sPOOFi?9}?e<;IZVlf9W{V(eo>g;UMBG3I~$KcziwhtRVc2=uR`f-W&J4dx( z#kttqoX^QhD1uJMb>gZ2LiRZ(DCNO;Qf5yb(--0r4W~`|H2)9VMSL+YFHdEr@F->V zLA#WGs7^VjU2Xf*ZoF}RZV5dJB|C?-FIdLYQZ2eYUqSS}#YxQN) zW1$I$lFtRUS{>cGURvPufV}buW9&&k;7}NC(+;D~^Yru~Gfoa0$n{Vpr>)&?yYm=& z<|gi)BAJ|FW|X*hxZ7qnXeYS{U&fQt+9J{|Yt)&<=c4rYLvR>5?B?c=S#MzhM-zWT z6Y(JBkF2ywnQ$@9bRMCPbJs;!6_Gt;sa!86UDA7nJzU^J&KsqoK2av8bY9l5E@bbk zmAWXWs4wy;H9Gc_^=>PiYy(h=r^mOkC%6 zpgfW;I2=cgcipz;EfYA76-$0%o(a}FcN z$!R$>hha8nHq2p;+rI1ld3?XW-)H~bd)&v@bziU3^S++X`0d|Sb3Q|xH@V882`L`W z+AC%m-E51PpoA?J0|3G$uDwX5@Qf8bW}L^WgcBAdpAXnJIVc?V1+Pp(%LFw(_^5p74o}*C4HW8J!spDrI!HcijH#<$ z25!DvJd(+{v3ABbfmG$4^;=p`*v>oHuID@N+<+(&1PglJj2rT@wq1CT3EjJSKP7uT zB;JJBkr;b=-(=lurjJResJ>%Bq%=u^v!WU0t}oxX)ugymHm+sZ5`O+uF_eSY=QZvL z_dWB3-j}W<7nCNv`Qw(~S<}lfxbiQZfXf4JA3N{si)M->W)MZmA4ogDRuVeTk1EFJ z^*9LhYoh{@9A|4d?x2(V3Kxy7<%-+v$NQ8jq$&_24+Ejk#}KSFx%VI#(!v%F^ZuKYzjl3HhEG zx*l1ykX_C9{%IZSZX^Aq-pVs;upP%iiA278O+5wE&-O8A?i+V;0+w6hT?Irt+@4U`e4nR( z?dQafd)p`a=GR)#O4;2GnxtKOSlp;QiC-%}3tp4SO$3+$Ud7@oyGV zSkKef%>$E?U6C5(%?A^1Fu30Jn0fTDqsK59iHz{=?=;La{@YQS?__>PF zs*<C6$?Twjj zphLdCM6OJFRHSLAI&r<-_q)$tD3NrIasJfu5@@qWRHN86A;|Wk!gz@;dN5N58&k_) z={>zr@qGC4{=JWVYURO21`77ijEF<_F~BaJf+7~jw%E$NwA7Nyim2S!;5C!M9v0Kv zaiw{OR6=PF5)`pj2-!D@*n9+XEcfodY-Cbswd81A^g)78+;(IhlznO67nMp-xbAaR zPb;0vrb}E$^_};$1lH6s%v5*)L-rQJEqG%&hk`PwZ->NgEF_bDZFyfgr@Wkub>t7o zdV5o2%-l{?%@wE)DqD~FzL0XL(L| zHcI+JxqLFS%i(MR^wBy&H!}*n#n#xOlT_RsnNmqtrTTOuUAL3KuIgr zC`YzzTv^p`sc^^24HLf;I%EH9EA>NWdt0Xs0jOewTdb4AK3%KIhD zyTV6)Z$}?Knb2z$tW+4;v;ZwH?H=34$yr1Q=EzB0xq{8Dc9^{d+L zr%h8nJe_=8aP0Y6>1p43LD*>Y*@NJgf4%|Xg7seu#Uf?`FADCm06p9>f%?|roLwkp z|7y0FC5~Gq&XYa_7VtS=-d54ReN4c0JWVBH?>h%#s9a)bFw#C+qfT+@ci^^kyv^#& z$+FovQH|%)^SZei0q`dnZ4os*+vt&wv)-K!7lDPZW?_;6&#Z(;T)F6-)^$!o^n9of z>bwLNhxL)K=wGyci5qAc8fe_URlDCL?RId~J9Ej#!4xNd&)1}7;S^A2^|AlghcHE8 zYE!ISs8QVt;b(sR$l~e;lSIv=um|Q}byH2e){IpQYv)*dNIHTj5bYIz%H3igZ>#u4 zAhB%U;s-=92S|DVmj|8qZB2BiSMbt7g%Krq-t z6mw5!k!=mEo?NKEGRrIxaBjZIB)8+2*1x;`R=kS7f7GYPJbnPQlve(M5}k)y0-bsw zp3auW+Y^|l8J!q26e#005oXS}7kX*=X_$P}zSS>KAw>v~d%3KcB1QR~0~Iz%Vj8&P`f;%I>~%Ab$E^Dr zmbY)PlnfpxUCn170*}5K3j070cVIq>k@&yoVh%;dMbG0Ow@w#9e1E)s<}bX@@cHF6 z2OhP^j`lPKb3%^ab`cT9u+JA?%%%c3K8M*p}z2G_!OzxVqx7iuHz zV>T|V)-?Pn$vMjqU$95_% zP|C01ofFP|iGNEn2Y{=b>9kNHOl{(gqTKk7LofcDz*v=hdNqS?I9!xO0a^?&z5DwR zVq$i+F=EBkZ+$wb;`FW?42H7trgT#03P7FZ^$RWqN3zgbRrsQU?Te^XzR(kS4Igmi z+CQtl%hjgD!gW^>h)8;jt^4p|W&U&J^FNwu^AbXTSiVQc zZPgV#>6&!_#{Xr4C&_vQ#`FuN4+~8Fu{_ERvi$0Q(ky*N{IC>EiG`-cK(<>2h@m8@wP0ZaT^WhMZJs`2k3`l(=UE1(n zdPI4lvq%wD#?R|g`||15PgWpSGF+`((xijgL?XExPlHRAQtB+I(#R{fDTEu$4X znf6NOEnE2PU&V~qJ#w$}NSkmMIK;WOzepFUqpL;M(eC*fS1=Gw#+KE8WOgszFSX}4;t@P2owzP z-86^Kn?H@Og6|ub!q-@@JBh38PC<52D}j|XCKYBD^MHK@qZQEm$~ePuI6e?{N69+v zc8TagntZ{CZ5c9Ha8b;bEcu35}=Bfb7c9@Erg!VxeN7CNxc@rG+m-ccE_#hI>deioBwIR zzJ&(i$835}i>NGRo&Eo;C(rOUjLXW4@Bg9pu)@H<>Fae8H-VfIZ*%?Kr6`@M0PPY-OIo;phKl` zQ+S^mSB?E&#uEJ#GaCR8{^DWaBlpIR+O>e{og1;Fm8_wWRK@zj0{f=|)o$bYrF27p zetoHsQ;IZo0w+n5w%Lo2igeuM)0rwhRj}1Rr>5PS|6V;sagxKgw(94 zXKa(ImZMXa3i7kvQq2L*&*nNy=uknuj^}KZn>8)$uz5*X@mA)j+FstVMYyMSE$7jq zte$CZM+;{XGYSs#ND@Kx4&IV_mQQ6ZD#5()TTDgi4Sc_>UVt^cEP3Nx1A12&WuiGvyd$75t42LTXwuo{c^l_K9@g7 z@aefo!6scM$;dc)y{4@yo90T%-MTW*ZCfkWNS%OOR$o_ReEl(NH_A8!I2p56FQ$TV2{LbemWo%AS`93d{At22)@-;z7gr%SbbwUv!oHzq&LpE#85A{Y6+#@98*!6tT3)H(+vPSZ%H**O~v#=%`Hg~m%QyG6X?>4wuejNUBhoSXB@zl0k3%hu7v;fo2F@jfm%kegJC4E1_Q;Ap;5kXwSa7c%QDdu z19!)tZr=xn#)=EvEB~Fa+;*QNq;1{M`FY~%z~0N}!O!ck1G8E64K&g~vC#9<@uR-` zstu638V*cbLgsd2CiD*UAk-yY#lMH&^iK6R=NhN};+&#|+%lFsGe9MQAh%x4(b~2^ zS1d2Nu>@1A;}()(D1>`K*2k#?8z~%apo0SphcqPLl_BZQf1Gn?4>Lv@M*uo5q{(#U z*sr-hSK=0kqJZnogj#uV6xc<4ik1aLBN9~nLqUT!eX zo5AfXSRbcxY38zmN?dR{H5I;`8j%HdurXsnj?u>AQJOJh1DXEgWp&e^Ut)QnPWuE@^KA6DH7ee34<~51?@t5x&ic#BjV0XVD1lp|8p2Lx;noT#f zSNt0JIF(ntMWR%Yck;3Q>9XqzRuj=x-==a@z0ACk&n$QEO*>=j@j^P-#Q9<6r$FUs zE!x?sFpc5eKg9gbH&Y1cFX{`x`eB<<#_H{`<)$JX~>V)Xm@od zn!M2W>7k1momo3>9B2Uq`Pe{3g?rN-lxtaQ2DxgA>YVJ4tH74}LWEY$_lM3+9KR&g z{lVx`zaO}RrW5%=v%qVme9G*hhIe*EmV!rpVjG-RRu@%FODX(h%uIO|{w95VvAI4{ zAGd(h(Mf8qMjc*XA09lO0Wc_lPWhH2Z&fB;wisvosv3uJ0Fk@w2?ZC)IFRRr?~ov^ zY#Mv_=K&q8DRI1kk2|>LxBv|gBRL$Ev~v3`MK^^PW#W2F7~JUncS|-;T)AOru=mC9BE#^DCk&!7B0M1FnBvq9XrPsE?H7 z$Bcm&BEO!We5G?KvoqOy4Jfgd$YJX%Cd`~mG4Ur>M~Y|GWo)5?T9$nr!YZGtA?ynw zApV+Y*1HZ*1|^_ewh+x`EoZMg2d`H){*1w&&G^LhrS4ZDXL6SO?r_cDlJRb|3%Os= zEVuLoj}&jNT#V|MtDe#;HCz%GR`I)|9(HC!c0Jk%U#^Upuw_)UlMa#l+J_Oos-)j6 zy;zd})c%TWz0bK7UrVe@O(|~Wr@0@x*U48>6tQ-R29GLJ+R_C-fSPa0^jaV_-bL*@lthVJ62TgXf7e{H0`y^ zD1U+nFiJ*M@Rx~lPj<_W4;J=Kc_>+7Fw{mPL_w{Ayj*0hBuf%es z>+m1#9+7V7Z|s#wXWlZf+q)>@j~N50usj{o=T_k$^zhwrPIaeD6agn!jc=lgG&T)Y zbmbJ3z_GJF8DDvd$19aG&_<1JYQXp@;nM@6-hFZ)mG9tvyP$X<(ECtd`?S2eLbgot zMvo1%M*Or>khDi#$RB@QMxs0-7PT#jn6{<98y)XOtnhC46_LE&Q(lYeDeT^7&WxM? z&W!WQ(cT<-_1xo~4+usM<%wz%aJhS&3qXanFF*Gev*qEVHvZA^Vc6bho|q~B5;a^M zfN}SFi&+4;Z0*PdK(PbV&dqLfaRkb8?MH+?hl=PpPE;7N*)m?@4mUk`rw%JUs?_9B zt!w+y&SO&=^s-zwI*v1Ao+{!YWL~OR=y<3^ ztt!V(9l10TZaI%fTxalQ=tEwlm-se9MGq#O+#aV@!F;ES!^BH|29^?mkZpn5N$__= zR6lkUvv<3+$7+P-N8BqO91q||^Jm&kSj^|0x#Wk_?}W9g3rlR{>2qvLq^qRQcKgrx@njy-kQ?V~h-&Z_&RPMJz~VC(}X zoxlODezapi1e#LIo1IrzynaCOaoaV()Tzm9;MYPrS^e&jbg$SdZ3OA(QuA_)mS0*( zCnAw!{@rR?7gwf~a_pDLu!qwHv!{&~nNITV+%k~oFft>=x_(t@yaR7`G1;tF3Cq6* z;)uJi$hLT4AWxR)8XL!#fxh3KavR9A86_j=#a_7^}A(X?9Q9P zVWo4{`iHfH0@<51qZRr7rlIeysYw zd*nmXCVs*>^{C6Xaf7_u14rYiW7N87d)zb;icMdyE%TU=o!FFablZ|&zvy=K&8AXg zd@pW&kAtEXL>*(M>B_%mZ#tD#{jKr-yzJ>DH9(LC6E#{g8TSc~SYx|*-MW@_+99!0 z_8C>WYz0fY+G;6as{3jaog0gyBw~Zw3p8mAii^Mz(YbGW&lroCKUBcoVcWVSUXT!S zvB8r+rh%lNr}|DrCAx|ATtNj}Zj~mQ;;_A*Gpk|P+0-8Gx?6&^_*}KN*#xg#+-h`o zcnBrvPT#%@sgniN`UZ2oy6McG*^XV7xmpSF=~eW@AEBt>vBnk7SzBP&haQQ4oYT#0 z7Lt33hLDd45cFjfZNXe15-A+_(i%bO5g&d#%qKsY@xEEsgh&Yg+epz4t4j@RO!HCp z&{#FQ6EGPkH=QLBd@JFTtc+aHryQ4VNdaTnP$J1IJ}6_3sa{fZK<@sNFdD6a*jn>% zvDyh_qbbh=<5K((R`3eY?WJy>rta=XR7Zuzoaz|Oam^~zyN>?5r zl|L;;g#lmKs0yuC51PYxeis?!#-9;}t^B?!cp7z$O^+Pfg#8q5%uD;J(DtSjgDEl& zG&oFY}Jc2%ykYo7V>A1sNp3eDF&tsva6-rods@Oi&ilBtEK;IHWFHOH9HUSWw>Jev>S?1iA6s*3I+ z!CRk4$NC<@=kucqd4$lTv?I)_&Im>Yl1`g5Zf+AbI`QLqM4r~mPfaX~5PeVx~Al3hm)rB|Ara=6=q^$K?_nYjkmO#W(Z9}$V3hd-$_u5znC~1Ks-N4O647pE@V0p=?pA=Kh0lYUj*#K~@#}zxql$xFjxfO_}O1l7L-P%_H!t z8?N@-?}?dZV?@K=;q-2#^vcZ}2*xe~EWvhp_Mt?s;nDH!nvMh2mQhxqc;>**X#_@# zN_~ij)a@d_n;~-*_C-f!G@=?jm!|k$<8}lX{nM~NLF7$Cwy&J8Y3LdnWsfsB@R#i# zFWbBrl|bTZnivCpA6{W2yc(7KhEsS};jBgp4jS$)uQ?y-?E1y*_%rf7j}|ghovW<2 zzxE#qNTQNScBSPv$&Xb_HXH+pr09z9TG6lBr*#64TGF^%ziDjhSb#4vgt}6k=Wg?O zQG@7_f?Xm5LBj@R6V{Ri2^+yjJk(VBO8?M*RYnOI;E-2ehW154^vh2Q%fB(U#m<5? z0mmG!iNfB(3B2Wx1MZZ*-O@!_USyn)s7j4-S@#qMBZ;;>F&U<_MuI@JUHsRDf#ca80&0Q|KzLrx>22IW;3R- zI8_b4Tj5dV4BkNU1DY(mpfSeNY5JA|B;}!s#iPM%INy_Tf?cnHANoZPODR8X(zc|W z*=_d9@Gq!X04&RG>UUlLs-2aU2f03ON8qw*12D!b_zR7OZhke2nBA|P%&1n`?6`1u z@0~@qGoX77G}H;YwMZfIqCC1?`Z9ig%kx`egBy9jKm(duh4;q6#@EoSEk`d)3?DhW zhytj){RlPEtH1u?OOu-oGd4x5#Eo!g>}4)0>XnXGymhhhDwX#yQ&6=h z+aEGlmVDTW7pz@LpqZ({ey%98X(f+al*sxfaV+?qGZLHs(XVd_v97MM!|#mgK{nS} zOcsB4I#EJ;Z}u+1j_dD=_U^J;6uq%Dr2R9)yo6mBePklcfOp3u}hf$ zb*fF9|90i91CJu`^^9;q9d&^~QjPgi+3Qj^%S)#2u z^!oU>RNLa4NQF%Va=rP`UHRmZJfw@#GeJQ-4tC=*-~92s(pXok{)&XQ@BP18s6=C> zaun4vdAHnuzgLs;fbCWfVmtDvM^vbbtz8R2B@-c2aXWQt@s}_5_sQc7+(V*i?G+wo zsJ(c}FlBl&c)Eaa%tYd#KNil;N5I4Skhop&CSUqL_Pl;E#yH8wnvMr09>}9ZQL5zK zLmvd;wi0#vg!ASn_`M8sCP$y)>@mp)S4X;)9x0WLT7F-iI0eD%xY_$)vuJLNR`^~- zFS%_?$?7uP{`~$j@?o0ixk+EpEw;^fymN6H;HWc9#w4?b-pc6akA}tm7m&nFj$@7! zT+M(9zb!U|0fCt{Y9^Wg8=eSKaS@5Lx@kZ8bKd@wbA!1G1{5vHsuM3P-$;jfx1FEp&?A^Fm|U8yPSvq!9NPwVTBjw zLzW%_Dp8z*Lk7BsyXzR>^3OLc)HLJZ+f`*ksCHL6{aG}{u5sZ-)^dUWmMaW;foeFOylg$Juj228UJwU+|t{IXyhbDy6-L_Qp&_2TysIMgunsG=OP+fnz=P>&jQvRz4 zP{y{(Q$pN3OeA!nkFhg!mq`YC}#^DxIqv?{R!0m;WlLemGhMjWXlojgu zK0Em_giSDYGWuHAA89BTbE%Gv-{2_*5~`wZrZEb$YSAMkvQD?r7lSOR`ItVOVNeQ` z^-H5;i3IM+ zxuD-A^s>>(T|h>~V$%YrtKVQ|3v$#&Ov%uA41Cmu!Npb8Ng6T>R^h(|EAs{N5(aN2 zpYPWQ1@LrU5A{a@cpobSU{)WNVJ&LR-~ zb#?1n$Q1olq;xbB0Tnl5?csG|g1dh~$T#rGpqsxHV{HPWnkvU$ZPW?UoC8lJwRy?d zbTRi-`+xZ3Pq*!o7*D~*<)N2V$GejCb~}zv)u{jSg5I#{{x77G|LKb7C5YKu`{z0z z%tdgh@|``W8Y>5mymF8evoO}r(Em>-z3E~r+XNu)1!|9_?Jw}iu>{1vHk$=Yw26M* z8e86l3aI)EOxesS#;x5`2{>Y+(!`M*>nUc+IYX?du1_!r=fASTALo?|sviOTy-^pH(q-pSlw z>;G%QqT`v(ecUoX!Y^)Z6juG<*O#nhg2<AA4S^nTf=>GsQ!~AUk diff --git a/windows/configuration/supported-csp-start-menu-layout-windows.md b/windows/configuration/supported-csp-start-menu-layout-windows.md index 6a290c38c7..d241981f97 100644 --- a/windows/configuration/supported-csp-start-menu-layout-windows.md +++ b/windows/configuration/supported-csp-start-menu-layout-windows.md @@ -20,7 +20,7 @@ ms.localizationpriority: medium - Windows 11 -The Windows OS exposes CSPs that are used by MDM providers, like Microsoft Endpoint Manager. In an MDM policy, these CSPs are settings that you configure in a policy. When the policy is ready, you deploy the policy to your devices. +The Windows OS exposes CSPs that are used by MDM providers, like [Microsoft Endpoint Manager](/mem/endpoint-manager-overview). In an MDM policy, these CSPs are settings that you configure in a policy. When the policy is ready, you deploy the policy to your devices. This article lists the CSPs that are available to customize the Start menu layout for Windows 11 and later devices. Windows 11 uses the [Policy CSP - Start](../client-management/mdm/policy-csp-start.md). diff --git a/windows/configuration/use-json-customize-start-menu-windows.md b/windows/configuration/use-json-customize-start-menu-windows.md index ff779e6965..a39aa6a2cc 100644 --- a/windows/configuration/use-json-customize-start-menu-windows.md +++ b/windows/configuration/use-json-customize-start-menu-windows.md @@ -26,7 +26,7 @@ ms.localizationpriority: medium Your organization can deploy a customized Start layout to your Windows 11 devices. Customizing the Start layout is common when you have similar devices used by many users, and on devices that are locked down. -For example, you can create a pinned list that includes a common set of apps, or remove the default pinned apps. As an administrator, you can use this feature to pin Win32 apps, remove default pinned apps, order the app list, and more. +For example, you can create a pinned list that includes a common set of apps. As an administrator, you can use this feature to pin Win32 apps, remove default pinned apps, order the app list, and more. This article shows you how to export an existing Start menu layout, and use the syntax in a Microsoft Intune MDM policy. @@ -52,19 +52,19 @@ Starting with Windows 11, the Start menu is updated. The apps are shown as a fla The layout has the following areas: -- **Pinned**: This area shows some of the apps that are installed on the devices. You can customize this section using the **ConfigureStartPins** policy, and create a pinned list of apps you want on the devices. You can also remove apps that are pinned by default. +- **Pinned**: This area shows some of the apps that are installed on the device. You can customize this section using the **ConfigureStartPins** policy, and create a pinned list of apps you want on the devices. You can also remove apps that are pinned by default. This article shows you how to use the **ConfigureStartPins** policy. - **All apps**: Users can select this option to see a list of all the apps on the device. This section can't be customized. -- **Recommended**: This area shows recent files that have been opened. You can't hide this section, but you can prevent files from showing. The [Start/HideRecentJumplists CSP](../windows/client-management/mdm/policy-csp-start.md#start-hiderecentjumplists) controls this setting, and can be set using an MDM provider, like Microsoft Intune. +- **Recommended**: This area shows recent files that have been opened. You can't hide this section, but you can prevent files from showing. The [Start/HideRecentJumplists CSP](../client-management/mdm/policy-csp-start.md#start-hiderecentjumplists) controls this setting, and can be set using an MDM provider, like Microsoft Intune. - For more information on the Start menu settings you can configure in a Microsoft Intune policy, see [Windows 10 (and newer) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#start). + For more information on the Start menu settings you can configure in a Microsoft Intune policy, see [Windows 10 (and later) device settings to allow or restrict features using Intune](/mem/intune/configuration/device-restrictions-windows-10#start). ### What you need to know - When you customize the Start layout, you overwrite the entire full layout. Users can't pin, unpin, or uninstall apps from Start. Users can see and open all apps in the **All Apps** view, but they can't pin any apps to Start. A partial Start layout isn't available. -- On Windows 11 and newer devices, you must create a new JSON file. You can't use a file from a previous OS, such as Windows 10. +- On Windows 11 and later devices, you must create a new JSON file. You can't use a file from a previous OS, such as Windows 10. ## Create the JSON file From 5fd6e5c58e492303bb084fa104b9b26cb4d7f0e0 Mon Sep 17 00:00:00 2001 From: Asha Iyengar Date: Fri, 3 Sep 2021 14:27:13 +0530 Subject: [PATCH 0175/1214] Updated-Files1to20 --- .../auditing/advanced-security-audit-policy-settings.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md index b1b0dbf35b..85e0d38f53 100644 --- a/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md +++ b/windows/security/threat-protection/auditing/advanced-security-audit-policy-settings.md @@ -21,7 +21,8 @@ ms.technology: mde # Advanced security audit policy settings **Applies to** -- Windows 10 +- Windows 10 +- Windows 11 This reference for IT professionals provides information about the advanced audit policy settings that are available in Windows and the audit events that they generate. From 035ff0a4b331e2c1877428ed4d2596704b6387ee Mon Sep 17 00:00:00 2001 From: VARADHARAJAN K <3296790+RAJU2529@users.noreply.github.com> Date: Fri, 3 Sep 2021 15:44:49 +0530 Subject: [PATCH 0176/1214] removed word as per user feedback #9934 , so i removed the word **Infrastructure** --- windows/security/threat-protection/auditing/event-4768.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index fb7930f6d2..e73c3e0daa 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -322,7 +322,7 @@ For 4768(S, F): A Kerberos authentication ticket (TGT) was requested. | **Field** | **Issue to discover** | |-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| -| **Certificate Issuer Name** | Certification authority name is not from your PKI infrastructure. | +| **Certificate Issuer Name** | Certification authority name is not from your PKI. | | **Certificate Issuer Name** | Certification authority name is not authorized to issue smart card authentication certificates. | | **Pre-Authentication Type** | Value is **0**, which means that pre-authentication was not used. All accounts should use Pre-Authentication, except accounts configured with “Do not require Kerberos preauthentication,” which is a security risk. For more information, see [Table 5. Kerberos Pre-Authentication types](#kerberos-preauthentication-types). | | **Pre-Authentication Type** | Value is **not 15** when account must use a smart card for authentication. For more information, see [Table 5. Kerberos Pre-Authentication types](#kerberos-preauthentication-types). | From e8c02c2bf71fa560ab840f8a6859607e8a8d09d0 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 09:11:30 -0700 Subject: [PATCH 0177/1214] update instructions --- windows/whats-new/windows-11-prepare.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index f2dedd5144..677e65d57f 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -7,7 +7,7 @@ ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay ms.author: greglin -ms.date: 06/24/2021 +ms.date: 09/03/2021 ms.reviewer: manager: laurawi ms.localizationpriority: high @@ -45,7 +45,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### Cloud-based solutions -- If you use Windows Update for Business Group Policy or Configuration Service Provider (CSP) policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). +- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the September 1st optional update or later ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)): **product version** and **target version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only target version is configured the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version 21H1, even if multiple products have that same version. - Quality update deferrals will continue to work the same across both Windows 10 and Windows 11. This is true regardless of which management tool you use to configure Windows Update for Business policies. - If you use Microsoft Intune and have a Microsoft 365 E3 license, you will be able to use feature update deployments to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. From ca479ecb16a7ee5efa4ece4dccc06dca951c51fa Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 09:18:23 -0700 Subject: [PATCH 0178/1214] tweaks --- windows/whats-new/windows-11-prepare.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 677e65d57f..1e02cc6857 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -45,7 +45,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### Cloud-based solutions -- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the September 1st optional update or later ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)): **product version** and **target version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only target version is configured the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version 21H1, even if multiple products have that same version. +- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **product version** and **target version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only target version is configured, the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version 21H1, even if multiple products have that same version. - Quality update deferrals will continue to work the same across both Windows 10 and Windows 11. This is true regardless of which management tool you use to configure Windows Update for Business policies. - If you use Microsoft Intune and have a Microsoft 365 E3 license, you will be able to use feature update deployments to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. @@ -56,7 +56,7 @@ If you aren’t already taking advantage of cloud-based management capabilities, The following are some common use cases and the corresponding Microsoft Endpoint Manager capabilities that support them: - **Provision and pre-configure new Windows 11 devices**: [Windows Autopilot](/mem/autopilot/windows-autopilot) enables you to deploy new Windows 11 devices in a “business-ready” state that includes your desired applications, settings, and policies. It can also be used to change the edition of Windows. For example, you can upgrade from Pro to Enterprise edition and gain the use of advanced features. The [Windows Autopilot diagnostics page](/mem/autopilot/windows-autopilot-whats-new#preview-windows-autopilot-diagnostics-page) is new feature that is available when you use in Windows Autopilot to deploy Windows 11. -- **Configure rules and control settings for users, apps, and devices**: When you enroll devices in [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), administrators have full control over apps, settings, features, and security for both Windows 11 and Windows 10. You can also use app protection policies to require multi-factor authentication (MFA) for specific apps. +- **Configure rules and control settings for users, apps, and devices**: When you enroll devices in [Microsoft Intune](/mem/intune/fundamentals/what-is-intune), administrators have full control over apps, settings, features, and security for both Windows 11 and Windows 10. You can also use app protection policies to require multifactor authentication (MFA) for specific apps. - **Streamline device management for frontline, remote, and onsite workers**: Introduced with Windows 10, [cloud configuration](/mem/intune/fundamentals/cloud-configuration) is a standard, easy-to-manage, device configuration that is cloud-optimized for users with specific workflow needs. It can be deployed to devices running the Pro, Enterprise, and Education editions of Windows 11 by using Microsoft Endpoint Manager. If you are exclusively using an on-premises device management solution (for example, Configuration Manager), you can still use the [cloud management gateway](/mem/configmgr/core/clients/manage/cmg/overview), enable [tenant attach](/mem/configmgr/tenant-attach/device-sync-actions), or enable [co-management](/mem/configmgr/comanage/overview) with Microsoft Intune. These solutions can make it easier to keep devices secure and up-to-date. From c745c9b36fba66ff65121e3c1bd4036e8d2d9f71 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 09:22:33 -0700 Subject: [PATCH 0179/1214] tweaks --- windows/whats-new/windows-11-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 1e02cc6857..48240c5e85 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -45,7 +45,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### Cloud-based solutions -- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **product version** and **target version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only target version is configured, the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version 21H1, even if multiple products have that same version. +- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **Product Version** and **Target Version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only target version is configured, the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version 21H1, even if multiple products have that same version. - Quality update deferrals will continue to work the same across both Windows 10 and Windows 11. This is true regardless of which management tool you use to configure Windows Update for Business policies. - If you use Microsoft Intune and have a Microsoft 365 E3 license, you will be able to use feature update deployments to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. From 5d93c27bc8d4247869053429c0888b44044d571a Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 09:25:54 -0700 Subject: [PATCH 0180/1214] more tweaks --- windows/whats-new/windows-11-prepare.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 48240c5e85..09f40237a9 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -45,7 +45,7 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### Cloud-based solutions -- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **Product Version** and **Target Version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only target version is configured, the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version 21H1, even if multiple products have that same version. +- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **Product Version** and **Target Version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only the target version field is configured, the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version Windows 10, version 21H1, even if multiple products have a 21H1 version. - Quality update deferrals will continue to work the same across both Windows 10 and Windows 11. This is true regardless of which management tool you use to configure Windows Update for Business policies. - If you use Microsoft Intune and have a Microsoft 365 E3 license, you will be able to use feature update deployments to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. From f8afbc2df3012830227ab2421d91cec18aac6477 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 09:32:45 -0700 Subject: [PATCH 0181/1214] more tweaks --- windows/whats-new/windows-11-prepare.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/whats-new/windows-11-prepare.md b/windows/whats-new/windows-11-prepare.md index 09f40237a9..b301ed3de2 100644 --- a/windows/whats-new/windows-11-prepare.md +++ b/windows/whats-new/windows-11-prepare.md @@ -45,7 +45,10 @@ The tools that you use for core workloads during Windows 10 deployments can stil #### Cloud-based solutions -- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1), but do not enable you to move between products (Windows 10 to Windows 11). In Group Policy, the **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **Product Version** and **Target Version**. The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only the target version field is configured, the device will be offered matching versions of the same product. For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version Windows 10, version 21H1, even if multiple products have a 21H1 version. +- If you use Windows Update for Business policies, you will need to use the **Target Version** capability rather than feature update deferrals to upgrade from Windows 10 to Windows 11. Feature update deferrals are great to move to newer versions of your current product (for example, Windows 10, version 20H2 to 21H1, but do not enable you to move between products (Windows 10 to Windows 11). + - In Group Policy, **Select target Feature Update version** has two entry fields after taking the 9/1/2021 optional update ([KB5005101](https://support.microsoft.com/topic/september-1-2021-kb5005101-os-builds-19041-1202-19042-1202-and-19043-1202-preview-82a50f27-a56f-4212-96ce-1554e8058dc1)) or a later update: **Product Version** and **Target Version**. + - The product field must specify Windows 11 in order for devices to upgrade to Windows 11. If only the target version field is configured, the device will be offered matching versions of the same product. + - For example, if a device is running Windows 10, version 2004 and only the target version is configured to 21H1, this device will be offered version Windows 10, version 21H1, even if multiple products have a 21H1 version. - Quality update deferrals will continue to work the same across both Windows 10 and Windows 11. This is true regardless of which management tool you use to configure Windows Update for Business policies. - If you use Microsoft Intune and have a Microsoft 365 E3 license, you will be able to use feature update deployments to easily update devices from one release of Windows 10 to another, or to upgrade Windows 10 devices to Windows 11. You can also continue using the same update experience controls to manage Windows 10 and Windows 11. From 99738c3f09bd6e166b4dbfbaf3283e37fec73201 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Fri, 3 Sep 2021 09:50:39 -0700 Subject: [PATCH 0182/1214] fixing typo --- .../deployment/update/update-compliance-configuration-manual.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/deployment/update/update-compliance-configuration-manual.md b/windows/deployment/update/update-compliance-configuration-manual.md index dcb6a6b2fe..339e8ed571 100644 --- a/windows/deployment/update/update-compliance-configuration-manual.md +++ b/windows/deployment/update/update-compliance-configuration-manual.md @@ -67,7 +67,7 @@ To enable data sharing between devices, your network, and Microsoft's Diagnostic | **Endpoint** | **Function** | |---------------------------------------------------------|-----------| -| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. Census.exe must run on a regular cadence and contact this endpoint in order to receive the majority of [WaaSUpdateStatus](update-compliance-schema-waasupdatestatus.md) information for Update Compliance. | +| `https://v10c.events.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1803 and later. DeviceCensus.exe must run on a regular cadence and contact this endpoint in order to receive the majority of [WaaSUpdateStatus](update-compliance-schema-waasupdatestatus.md) information for Update Compliance. | | `https://v10.vortex-win.data.microsoft.com` | Connected User Experience and Diagnostic component endpoint for Windows 10, version 1709 or earlier. | | `https://settings-win.data.microsoft.com` | Required for Windows Update functionality. | | `http://adl.windows.com` | Required for Windows Update functionality. | From 049062c09173d7050ceeed3c663f386f6805157f Mon Sep 17 00:00:00 2001 From: gkomatsu Date: Fri, 3 Sep 2021 11:04:41 -0700 Subject: [PATCH 0183/1214] Removing Windows Mobile and adding Windows 11 --- .../provisioning-packages.md | 86 +++++++++++-------- 1 file changed, 49 insertions(+), 37 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-packages.md b/windows/configuration/provisioning-packages/provisioning-packages.md index a3b4e25f84..47f42ccdec 100644 --- a/windows/configuration/provisioning-packages/provisioning-packages.md +++ b/windows/configuration/provisioning-packages/provisioning-packages.md @@ -1,10 +1,10 @@ --- -title: Provisioning packages (Windows 10) -description: With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +title: Provisioning packages (Windows) +description: With Windows 10 and 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. ms.assetid: 287706E5-063F-4AB5-902C-A0DF6D0730BC ms.reviewer: manager: dansimp -ms.prod: w10 +ms.prod: w10,w11 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay @@ -14,34 +14,35 @@ ms.localizationpriority: medium ms.date: 07/27/2017 --- -# Provisioning packages for Windows 10 +# Provisioning packages for Windows **Applies to** - Windows 10 -- Windows 10 Mobile +- Windows 11 Windows provisioning makes it easy for IT administrators to configure end-user devices without imaging. Using Windows provisioning, an IT administrator can easily specify desired configuration and settings required to enroll the devices into management and then apply that configuration to target devices in a matter of minutes. It is best suited for small- to medium-sized businesses with deployments that range from tens to a few hundred computers. -A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows 10, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. +A provisioning package (.ppkg) is a container for a collection of configuration settings. With Windows 10 and 11, you can create provisioning packages that let you quickly and efficiently configure a device without having to install a new image. Provisioning packages are simple enough that with a short set of written instructions, a student or non-technical employee can use them to configure their device. This can result in a significant reduction in the time required to configure multiple devices in your organization. -The [Windows Assessment and Deployment Kit (ADK) for Windows 10](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) includes the Windows Configuration Designer, a tool for configuring provisioning packages. Windows Configuration Designer is also available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). + +Windows Configuration Designer is available as an [app in the Microsoft Store](https://www.microsoft.com/store/apps/9nblggh4tx22). -## New in Windows 10, version 1703 + -- The tool for creating provisioning packages is renamed Windows Configuration Designer, replacing the Windows Imaging and Configuration Designer (ICD) tool. The components for creating images have been removed from Windows Configuration Designer, which now provides access to runtime settings only. -- Windows Configuration Designer can still be installed from the Windows ADK. You can also install it from the Microsoft Store. -- Windows Configuration Designer adds more wizards to make it easier to create provisioning packages for specific scenarios. See [What you can configure](#configuration-designer-wizards) for wizard descriptions. -- The Provision desktop devices wizard (previously called Simple provisioning) now enables joining Azure Active Directory (Azure AD) domains and also allows you to remove non-Microsoft software from Windows desktop devices during provisioning. -- When provisioning packages are applied to a device, a status screen indicates successful or failed provisioning. -- Windows 10 includes PowerShell cmdlets that simplify scripted provisioning. Using these cmdlets, you can add provisioning packages, remove provisioning packages and generate log files to investigate provisioning errors. -- The Provision school devices wizard is removed from Windows Configuration Designer. Instead, use the [Setup School PCs app](https://www.microsoft.com/store/p/set-up-school-pcs/9nblggh4ls40) from the Microsoft Store. + + + + + + + @@ -75,16 +76,27 @@ Provisioning packages can be: The following table describes settings that you can configure using the wizards in Windows Configuration Designer to create provisioning packages. - - - - - - - - - -
    StepDescriptionDesktop wizardMobile wizardKiosk wizardHoloLens wizard
    Set up deviceAssign device name,
    enter product key to upgrade Windows,
    configure shared used,
    remove pre-installed software
    yesyes
    (Only device name and upgrade key)
    yesyes
    Set up networkConnect to a Wi-Fi networkyesyesyesyes
    Account managementEnroll device in Active Directory,
    enroll device in Azure Active Directory,
    or create a local administrator account
    yesnoyesyes
    Bulk Enrollment in Azure ADEnroll device in Azure Active Directory

    Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization.
    noyesnono
    Add applicationsInstall applications using the provisioning package.yesnoyesno
    Add certificatesInclude a certificate file in the provisioning package.yesnoyesyes
    Configure kiosk account and appCreate local account to run the kiosk mode app,
    specify the app to run in kiosk mode
    nonoyesno
    Configure kiosk common settingsSet tablet mode,
    configure welcome and shutdown screens,
    turn off timeout settings
    nonoyesno
    Developer SetupEnable Developer Mode.nononoyes
    + + + + + + + + + +
    StepDescriptionDesktop wizardKiosk wizardHoloLens wizard
    Set up deviceAssign device name,
    enter product key to upgrade Windows,
    configure shared used,
    remove pre-installed software
    yesyesyes
    Set up networkConnect to a Wi-Fi networkyesyesyes
    Account managementEnroll device in Active Directory,
    enroll device in Azure Active Directory,
    or create a local administrator account
    yesnoyes
    Bulk Enrollment in Azure ADEnroll device in Azure Active Directory

    Before you use a Windows Configuration Designer wizard to configure bulk Azure AD enrollment, set up Azure AD join in your organization.
    nonono
    Add applicationsInstall applications using the provisioning package.yesyesno
    Add certificatesInclude a certificate file in the provisioning package.yesyesyes
    Configure kiosk account and appCreate local account to run the kiosk mode app,
    specify the app to run in kiosk mode
    noyesno
    Configure kiosk common settingsSet tablet mode,
    configure welcome and shutdown screens,
    turn off timeout settings
    noyesno
    Developer SetupEnable Developer Mode.nonoyes
    + + + + + + + + + + + - [Instructions for the desktop wizard](provision-pcs-for-initial-deployment.md) - [Instructions for the mobile wizard](../mobile-devices/provisioning-configure-mobile.md) @@ -117,32 +129,32 @@ The following table provides some examples of settings that you can configure us For details about the settings you can customize in provisioning packages, see [Windows Provisioning settings reference]( https://go.microsoft.com/fwlink/p/?LinkId=619012). -## Changes to provisioning in Windows 10, version 1607 + -> [!NOTE] -> This section is retained for customers using Windows 10, version 1607, on the Current Branch for Business. Some of this information is not applicable in Windows 10, version 1703. + + -Windows ICD for Windows 10, version 1607, simplified common provisioning scenarios. +WCD, simplified common provisioning scenarios. ![Configuration Designer options.](../images/icd.png) -Windows ICD in Windows 10, version 1607, supported the following scenarios for IT administrators: +WCD supports the following scenarios for IT administrators: -* **Simple provisioning** – Enables IT administrators to define a desired configuration in Windows ICD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. +* **Simple provisioning** – Enables IT administrators to define a desired configuration in WCD and then apply that configuration on target devices. The simple provisioning wizard makes the entire process quick and easy by guiding an IT administrator through common configuration settings in a step-by-step manner. -[Learn how to use simple provisioning to configure Windows 10 computers.](provision-pcs-for-initial-deployment.md) +[Learn how to use simple provisioning to configure Windows computers.](provision-pcs-for-initial-deployment.md) -* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use Windows ICD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. +* **Advanced provisioning (deployment of classic (Win32) and Universal Windows Platform (UWP) apps, and certificates)** – Allows an IT administrator to use WCD to open provisioning packages in the advanced settings editor and include apps for deployment on end-user devices. -* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows 10 Mobile devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use Windows ICD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: +* **Mobile device enrollment into management** - Enables IT administrators to purchase off-the-shelf retail Windows devices and enroll them into mobile device management (MDM) before handing them to end-users in the organization. IT administrators can use WCD to specify the management end-point and apply the configuration on target devices by connecting them to a Windows PC (tethered deployment) or through an SD card. Supported management end-points include: * Microsoft Intune (certificate-based enrollment) * AirWatch (password-string based enrollment) * Mobile Iron (password-string based enrollment) * Other MDMs (cert-based enrollment) -> [!NOTE] -> Windows ICD in Windows 10, version 1607, also provided a wizard to create provisioning packages for school PCs. To learn more, see [Set up students' PCs to join domain](/education/windows/). + + ## Learn more @@ -164,4 +176,4 @@ For more information about provisioning, watch the following videos: - [PowerShell cmdlets for provisioning Windows 10 (reference)](provisioning-powershell.md) - [Windows Configuration Designer command-line interface (reference)](provisioning-command-line.md) - [Create a provisioning package with multivariant settings](provisioning-multivariant.md) -- [Use Windows Configuration Designer to configure Windows 10 Mobile devices](../mobile-devices/provisioning-configure-mobile.md) \ No newline at end of file +- [Use Windows Configuration Designer to configure Windows 10 Mobile devices](../mobile-devices/provisioning-configure-mobile.md) From 47ab294a2e5c691fed43ad4061837172c50010d7 Mon Sep 17 00:00:00 2001 From: gkomatsu Date: Fri, 3 Sep 2021 11:16:10 -0700 Subject: [PATCH 0184/1214] Update for Windows 11 Added Windows 11 Removed Windows Mobile Revised ICD -> WCD --- .../provisioning-how-it-works.md | 22 +++++++++---------- 1 file changed, 11 insertions(+), 11 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md index 5942a86179..b0bacdf90b 100644 --- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md +++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md @@ -1,7 +1,7 @@ --- -title: How provisioning works in Windows 10 (Windows 10) +title: How provisioning works in Windows description: A provisioning package (.ppkg) is a container for a collection of configuration settings. -ms.prod: w10 +ms.prod: w10,w11 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay @@ -13,15 +13,15 @@ ms.reviewer: manager: dansimp --- -# How provisioning works in Windows 10 +# How provisioning works in Windows **Applies to** - Windows 10 -- Windows 10 Mobile +- Windows 11 -Provisioning packages in Windows 10 provide IT administrators with a simplified way to apply configuration settings to Windows 10 devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from the [Windows Assessment and Deployment Kit (ADK)](https://developer.microsoft.com/windows/hardware/windows-assessment-deployment-kit) or through the Microsoft Store. +Provisioning packages in Windows 10 provide IT administrators with a simplified way to apply configuration settings to Windows 10 and 11 devices. Windows Configuration Designer is a tool that makes it easy to create a provisioning package. Windows Configuration Designer can be installed from Microsoft Store. ## Provisioning packages @@ -69,7 +69,7 @@ When the provisioning engine selects a configuration, the Windows provisioning X ## Provisioning engine -The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10. +The provisioning engine is the core component for managing provisioning and configuration at runtime in a device running Windows 10 or 11. The provisioning engine provides the following functionality: @@ -82,7 +82,7 @@ The provisioning engine provides the following functionality: ## Configuration manager -The configuration manager provides the unified way of managing Windows 10 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings. +The configuration manager provides the unified way of managing Windows 10 and 11 devices. Configuration is mainly done through the Open Mobile Alliance (OMA) Device Management (DM) and Client Provisioning (CP) protocols. The configuration manager handles and parses these protocol requests from different channels and passes them down to [Configuration Service Providers (CSPs)](/windows/client-management/mdm/configuration-service-provider-reference) to perform the specific management requests and settings. The provisioning engine relies on configuration manager for all of the actual processing and application of a chosen configuration. The provisioning engine determines the stage of provisioning and, based on a set of keys, determines the set of configuration to send to the configuration manager. The configuration manager in turn parses and calls into the CSPs for the setting to be applied. @@ -130,7 +130,7 @@ The following table shows how device provisioning can be initiated when a user f | Package delivery | Initiation method | Supported device | | --- | --- | --- | | Removable media - USB drive or SD card
    (Packages must be placed at media root) | 5 fast taps on the Windows key to launch the provisioning UI |All Windows devices | -| From an administrator device through machine-to-machine NFC or NFC tag
    (The administrator device must run an app that can transfer the package over NFC) | 5 fast taps on the Windows key to launch the provisioning UI | Windows 10 Mobile devices and IoT Core devices | +| From an administrator device through machine-to-machine NFC or NFC tag
    (The administrator device must run an app that can transfer the package over NFC) | 5 fast taps on the Windows key to launch the provisioning UI | Windows IoT Core devices | The provisioning engine always copies the acquired provisioning packages to the `%ProgramData%\Microsoft\Provisioning` folder before processing them during OOBE. The provisioning engine always applies provisioning packages embedded in the installed Windows image during Windows Setup OOBE pass regardless of whether the package is signed and trusted. When the provisioning engine applies an encrypted provisioning package on an end-user device during OOBE, users must first provide a valid password to decrypt the package. The provisioning engine also checks whether a provisioning package is signed and trusted; if it's not, the user must provide consent before the package is applied to the device. @@ -144,7 +144,7 @@ At device runtime, stand-alone provisioning packages can be applied by user init | --- | --- | --- | | Removable media - USB drive or SD card
    (Packages must be placed at media root) | **Settings** > **Accounts** > **Access work or school** > **Add or remove a provisioning package** | All Windows devices | | Downloaded from a network connection and copied to a local folder | Double-click the package file | Windows 10 for desktop editions devices | -| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows 10 Mobile devices and IoT Core devices | +| From an administrator device connected to the target device through USB tethering | Drag and drop the package file onto the target device | Windows IoT Core devices | When applying provisioning packages from a removable media attached to the device, the Settings UI allows viewing contents of a package before selecting the package for provisioning. To minimize the risk of the device being spammed by applying provisioning packages from unknown sources, a provisioning package can be signed and encrypted. Partners can also set policies to limit the application of provisioning packages at device runtime. Applying provisioning packages at device runtime requires administrator privilege. If the package is not signed or trusted, a user must provide consent before the package is applied to the device. If the package is encrypted, a valid password is needed to decrypt the package before it can be applied to the device. @@ -157,7 +157,7 @@ After a stand-alone provisioning package is applied to the device, the package i - Watch the video: [Provisioning Windows 10 Devices with New Tools](https://go.microsoft.com/fwlink/p/?LinkId=615921) -- Watch the video: [Windows 10 for Mobile Devices: Provisioning Is Not Imaging](https://go.microsoft.com/fwlink/p/?LinkId=615922) + ## Related topics @@ -178,4 +178,4 @@ After a stand-alone provisioning package is applied to the device, the package i   -  \ No newline at end of file +  From 07394c37a641872f6822760b783d7e292dfca23a Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 14:20:08 -0700 Subject: [PATCH 0185/1214] remove article --- .../planning/windows-11-removed-features.md | 33 ------------------- 1 file changed, 33 deletions(-) delete mode 100644 windows/deployment/planning/windows-11-removed-features.md diff --git a/windows/deployment/planning/windows-11-removed-features.md b/windows/deployment/planning/windows-11-removed-features.md deleted file mode 100644 index 12f618fbfe..0000000000 --- a/windows/deployment/planning/windows-11-removed-features.md +++ /dev/null @@ -1,33 +0,0 @@ ---- -title: Windows 11 - Features that have been removed -description: In this article, learn about the features and functionality that has been removed or replaced in Windows 11. -ms.prod: w11 -ms.mktglfcycl: plan -ms.localizationpriority: medium -ms.sitesec: library -audience: itpro -author: greg-lindsay -ms.author: greglin -manager: laurawi -ms.topic: article -ms.custom: seo-marvel-apr2020 ---- - -# Features and functionality removed in Windows 11 - -> Applies to: Windows 11 - -Windows 11 adds new features and functionality; however some features are removed. Below is a summary of features and functionalities that are present in earlier versions of Windows 10 or Windows 11, but are removed in the specified version of Windows 11. **The list below is subject to change and might not include every affected feature or functionality.** - -> [!NOTE] -> Join the [Windows Insider program](https://insider.windows.com) to get early access to new Windows 11 builds and test these changes yourself. - -The following features and functionalities have been removed from the installed product image for Windows 11. Applications or code that depend on these features won't function in the release when it was removed, or in later releases. - -|Feature | Details and mitigation | Removed in version | -| ----------- | --------------------- | ------ | -| Windows Deployment Services (WDS) image deployment | End to end WDS deployment workflows that use **boot.wim** from installation media are affected. For more information, see [Windows Deployment Services (WDS) boot.wim support](../wds-boot-support.md) | Windows 11 | - -## Also see - -[Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022#features-were-no-longer-developing)
    \ No newline at end of file From 1e47b7dceee7a56b758ddc1a93e178918834b316 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 14:23:21 -0700 Subject: [PATCH 0186/1214] remove dupe link --- windows/deployment/wds-boot-support.md | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/windows/deployment/wds-boot-support.md b/windows/deployment/wds-boot-support.md index b484c3dc45..f141ef1446 100644 --- a/windows/deployment/wds-boot-support.md +++ b/windows/deployment/wds-boot-support.md @@ -109,5 +109,4 @@ If you currently use WDS with **boot.wim** from installation media for end-to-en [Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022#features-were-no-longer-developing)
    [Create a custom Windows PE boot image with Configuration Manager](deploy-windows-cm/create-a-custom-windows-pe-boot-image-with-configuration-manager.md)
    -[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md)
    -[Features removed or no longer developed starting with Windows Server 2022](/windows-server/get-started/removed-deprecated-features-windows-server-2022) \ No newline at end of file +[Prepare for deployment with MDT](deploy-windows-mdt/prepare-for-windows-deployment-with-mdt.md)
    \ No newline at end of file From ecbd27bfe59fec6ec3043a1370f5bd91ac7f00f2 Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 14:28:53 -0700 Subject: [PATCH 0187/1214] rm feature file --- windows/deployment/TOC.yml | 4 +--- windows/deployment/planning/features-lifecycle.md | 3 +-- 2 files changed, 2 insertions(+), 5 deletions(-) diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index 6602391574..8daccb955a 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -71,9 +71,7 @@ - name: Features we removed items: - name: Windows 10 features removed - href: planning/windows-10-removed-features.md - - name: Windows 11 features removed - href: planning/windows-11-removed-features.md + href: planning/windows-10-removed-features.md - name: Prepare items: diff --git a/windows/deployment/planning/features-lifecycle.md b/windows/deployment/planning/features-lifecycle.md index af22f20db2..6aa1667383 100644 --- a/windows/deployment/planning/features-lifecycle.md +++ b/windows/deployment/planning/features-lifecycle.md @@ -30,8 +30,7 @@ The following topic lists features that are no longer being developed. These fea The following topics have details about features that have been removed from Windows 10 or Windows 11. This includes features that are present in Windows 10, but are removed in Windows 11. -[Windows 10 features we removed](windows-10-removed-features.md)
    -[Windows 11 features we removed](windows-11-removed-features.md) +[Windows 10 features we removed](windows-10-removed-features.md) ## Terminology From 163f72577ee9815237b05cf42dde843a01deb2bd Mon Sep 17 00:00:00 2001 From: greg-lindsay Date: Fri, 3 Sep 2021 14:35:24 -0700 Subject: [PATCH 0188/1214] fix warning --- .../provisioning-packages/provisioning-how-it-works.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/configuration/provisioning-packages/provisioning-how-it-works.md b/windows/configuration/provisioning-packages/provisioning-how-it-works.md index b0bacdf90b..71b38c30f7 100644 --- a/windows/configuration/provisioning-packages/provisioning-how-it-works.md +++ b/windows/configuration/provisioning-packages/provisioning-how-it-works.md @@ -1,14 +1,14 @@ --- title: How provisioning works in Windows description: A provisioning package (.ppkg) is a container for a collection of configuration settings. -ms.prod: w10,w11 +ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library author: greg-lindsay ms.author: greglin ms.topic: article ms.localizationpriority: medium -ms.date: 07/27/2017 +ms.date: 09/03/2021 ms.reviewer: manager: dansimp --- From 9545dc05845bb583d26b759d16da3822d10907cb Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Sep 2021 17:23:16 -0700 Subject: [PATCH 0189/1214] Changed word wrap around image via updated image wrap The layout in my browser looked bad. --- windows/security/threat-protection/auditing/event-4768.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index e73c3e0daa..f06e21d952 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -21,7 +21,7 @@ ms.technology: mde - Windows Server 2016 -Event 4768 illustration +:::image type="content" alt-text="Event 4768 illustration." source="images/event-4768.png"::: ***Subcategory:*** [Audit Kerberos Authentication Service](audit-kerberos-authentication-service.md) From eba388115f2a0cbb600ef3112c9ea7c43db74d7c Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Sep 2021 17:28:31 -0700 Subject: [PATCH 0190/1214] Corrected notes style --- .../threat-protection/auditing/event-4768.md | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index f06e21d952..55854d8774 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -35,7 +35,8 @@ If TGT issue fails then you will see Failure event with **Result Code** field no This event doesn't generate for **Result Codes**: 0x10, 0x17 and 0x18. Event “[4771](event-4771.md): Kerberos pre-authentication failed.” generates instead. -> **Note**  For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event. +> [!NOTE] +> For recommendations, see [Security Monitoring Recommendations](#security-monitoring-recommendations) for this event.
    @@ -101,7 +102,8 @@ This event doesn't generate for **Result Codes**: 0x10, 0x17 and 0x18. Event “ - Uppercase full domain name: CONTOSO.LOCAL -> **Note**  A **Kerberos Realm** is a set of managed nodes that share the same Kerberos database. The Kerberos database resides on the Kerberos master computer system, which should be kept in a physically secure room. Active Directory domain is the example of Kerberos Realm in the Microsoft Windows Active Directory world. + > [!NOTE] + > A **Kerberos Realm** is a set of managed nodes that share the same Kerberos database. The Kerberos database resides on the Kerberos master computer system, which should be kept in a physically secure room. Active Directory domain is the example of Kerberos Realm in the Microsoft Windows Active Directory world. - **User ID** \[Type = SID\]**:** SID of account for which (TGT) ticket was requested. Event Viewer automatically tries to resolve SIDs and show the account name. If the SID cannot be resolved, you will see the source data in the event. @@ -109,7 +111,8 @@ This event doesn't generate for **Result Codes**: 0x10, 0x17 and 0x18. Event “ - **NULL SID** – this value shows in [4768](event-4768.md) Failure events. -> **Note**  A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). + > [!NOTE] + > A **security identifier (SID)** is a unique value of variable length used to identify a trustee (security principal). Each account has a unique SID that is issued by an authority, such as an Active Directory domain controller, and stored in a security database. Each time a user logs on, the system retrieves the SID for that user from the database and places it in the access token for that user. The system uses the SID in the access token to identify the user in all subsequent interactions with Windows security. When a SID has been used as the unique identifier for a user or group, it cannot ever be used again to identify another user or group. For more information about SIDs, see [Security identifiers](/windows/access-protection/access-control/security-identifiers). **Service Information:** @@ -149,7 +152,10 @@ This event doesn't generate for **Result Codes**: 0x10, 0x17 and 0x18. Event “ - Using **MSB 0** bit numbering we have bit 1, 8, 15 and 27 set = Forwardable, Renewable, Canonicalize, Renewable-ok. -> **Note**  In the table below **“MSB 0”** bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left.
    MSB illustration +> [!NOTE] +> In the table below **“MSB 0”** bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left. +> +> :::image type="content" alt-text="MSB illustration." source="images/msb.png"::: The most common values: @@ -186,8 +192,9 @@ The most common values: | 31 | Validate | This option is used only by the ticket-granting service. The VALIDATE option indicates that the request is to validate a postdated ticket. Should not be in use, because postdated tickets are not supported by KILE. | > Table 2. Kerberos ticket flags. -> -> **Note**  [KILE](/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9) **(Microsoft Kerberos Protocol Extension)** – Kerberos protocol extensions used in Microsoft operating systems. These extensions provide additional capability for authorization information including group memberships, interactive logon information, and integrity levels. + +> [!NOTE] +> [KILE](/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9) **(Microsoft Kerberos Protocol Extension)** – Kerberos protocol extensions used in Microsoft operating systems. These extensions provide additional capability for authorization information including group memberships, interactive logon information, and integrity levels. - **Result Code** \[Type = HexInt32\]**:** hexadecimal result code of TGT issue operation. The “Table 3. TGT/TGS issue error codes.” contains the list of the most common error codes for this event. From cb0080914f28ec187aeccdc186467b08b6de47d4 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Sep 2021 17:29:40 -0700 Subject: [PATCH 0191/1214] Labeled code block --- windows/security/threat-protection/auditing/event-4768.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 55854d8774..59ba63d70c 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -41,7 +41,7 @@ This event doesn't generate for **Result Codes**: 0x10, 0x17 and 0x18. Event “
    ***Event XML:*** -``` +```xml - - From f1704dc9a9a4e6e9f8cbdb5f08990aee12a47c78 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Sep 2021 17:35:39 -0700 Subject: [PATCH 0192/1214] Fixed broken headings Headings don't work and are not rendered correctly when HTML is next to them, such as the SPAN tags in this article. --- .../security/threat-protection/auditing/event-4768.md | 10 +++++++--- 1 file changed, 7 insertions(+), 3 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 59ba63d70c..81482d1771 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -191,7 +191,7 @@ The most common values: | 30 | Renew | The RENEW option indicates that the present request is for a renewal. The ticket provided is encrypted in the secret key for the server on which it is valid. This option will only be honored if the ticket to be renewed has its RENEWABLE flag set and if the time in it’s renew-till field has not passed. The ticket to be renewed is passed in the padata field as part of the authentication header. | | 31 | Validate | This option is used only by the ticket-granting service. The VALIDATE option indicates that the request is to validate a postdated ticket. Should not be in use, because postdated tickets are not supported by KILE. | -> Table 2. Kerberos ticket flags. +## Table 2. Kerberos ticket flags > [!NOTE] > [KILE](/openspecs/windows_protocols/ms-kile/2a32282e-dd48-4ad9-a542-609804b02cc9) **(Microsoft Kerberos Protocol Extension)** – Kerberos protocol extensions used in Microsoft operating systems. These extensions provide additional capability for authorization information including group memberships, interactive logon information, and integrity levels. @@ -259,12 +259,15 @@ The most common values: | 0x43 | KRB\_AP\_ERR\_NO\_TGT | No TGT was presented or available | In user-to-user authentication if the service does not possess a ticket granting ticket, it should return the error KRB\_AP\_ERR\_NO\_TGT. | | 0x44 | KDC\_ERR\_WRONG\_REALM | Incorrect domain or principal | Although this error rarely occurs, it occurs when a client presents a cross-realm TGT to a realm other than the one specified in the TGT. Typically, this results from incorrectly configured DNS. | -> Table 3. TGT/TGS issue error codes. + + +## Table 3. TGT/TGS issue error codes - **Ticket Encryption Type** \[Type = HexInt32\]: the cryptographic suite that was used for issued TGT. + ## Table 4. Kerberos encryption types | Type | Type Name | Description | @@ -281,7 +284,8 @@ The most common values: - **Pre-Authentication Type** \[Type = UnicodeString\]: the code number of [pre-Authentication](/previous-versions/windows/it-pro/windows-server-2003/cc772815(v=ws.10)) type which was used in TGT request. -## Table 5. Kerberos Pre-Authentication types. + +## Table 5. Kerberos Pre-Authentication types | Type | Type Name | Description | |------------------------------------------------------------------------|------------------------|------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| From e0a2435af96be4e6cebd4b89a1f8ac1c1739466c Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Sep 2021 17:41:08 -0700 Subject: [PATCH 0193/1214] Corrected font weight of table headings Table headings are bold by default, and the font weight is heavier without formatting for bold (**). --- windows/security/threat-protection/auditing/event-4768.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 81482d1771..340264fa1e 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -312,7 +312,7 @@ The most common values: For 4768(S, F): A Kerberos authentication ticket (TGT) was requested. -| **Type of monitoring required** | **Recommendation** | +| Type of monitoring required | Recommendation | |-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|----------------------------------------------------------------------------------------------------------------------------------------------------------------| | **High-value accounts**: You might have high-value domain or local accounts for which you need to monitor each action.
    Examples of high-value accounts are database administrators, built-in local administrator account, domain administrators, service accounts, domain controller accounts and so on. | Monitor this event with the **“User ID”** that corresponds to the high-value account or accounts. | | **Anomalies or malicious actions**: You might have specific requirements for detecting anomalies or monitoring potential malicious actions. For example, you might need to monitor for use of an account outside of working hours. | When you monitor for anomalies or malicious actions, use the **“User ID”** (with other information) to monitor how or when a particular account is being used. | @@ -331,7 +331,7 @@ For 4768(S, F): A Kerberos authentication ticket (TGT) was requested. - Also consider monitoring the fields shown in the following table, to discover the issues listed: -| **Field** | **Issue to discover** | +| Field | Issue to discover | |-----------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------| | **Certificate Issuer Name** | Certification authority name is not from your PKI. | | **Certificate Issuer Name** | Certification authority name is not authorized to issue smart card authentication certificates. | From be7ae41db9b05b8f7e9bbc87c6307de7099b15cb Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Fri, 3 Sep 2021 18:16:28 -0700 Subject: [PATCH 0194/1214] Restored HTML image reference, though curiously... ...I've had little success with docs.microsoft.com respecting sizing of images. I don't understand why it apparently works in this instance. --- windows/security/threat-protection/auditing/event-4768.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 340264fa1e..9406edbf43 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -155,7 +155,7 @@ This event doesn't generate for **Result Codes**: 0x10, 0x17 and 0x18. Event “ > [!NOTE] > In the table below **“MSB 0”** bit numbering is used, because RFC documents use this style. In “MSB 0” style bit numbering begins from left. > -> :::image type="content" alt-text="MSB illustration." source="images/msb.png"::: +> MSB illustration The most common values: From b9a96725e62af48b3ecedad954f4d801f48e7f62 Mon Sep 17 00:00:00 2001 From: Gary Moore Date: Sun, 5 Sep 2021 10:31:07 -0700 Subject: [PATCH 0195/1214] Added "address" after "IP" --- windows/security/threat-protection/auditing/event-4768.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/threat-protection/auditing/event-4768.md b/windows/security/threat-protection/auditing/event-4768.md index 9406edbf43..64156ecd85 100644 --- a/windows/security/threat-protection/auditing/event-4768.md +++ b/windows/security/threat-protection/auditing/event-4768.md @@ -321,7 +321,7 @@ For 4768(S, F): A Kerberos authentication ticket (TGT) was requested. | **External accounts**: You might be monitoring accounts from another domain, or “external” accounts that are not allowed to perform certain actions (represented by certain specific events). | Monitor this event for the **“Supplied Realm Name”** corresponding to another domain or “external” location. | | **Account naming conventions**: Your organization might have specific naming conventions for account names. | Monitor “**User ID”** for names that don’t comply with naming conventions. | -- You can track all [4768](event-4768.md) events where the **Client Address** is not from your internal IP range or not from private IP ranges. +- You can track all [4768](event-4768.md) events where the **Client Address** is not from your internal IP address range or not from private IP address ranges. - If you know that **Account Name** should be used only from known list of IP addresses, track all **Client Address** values for this **Account Name** in [4768](event-4768.md) events. If **Client Address** is not from the allowlist, generate the alert. From 5df53ceb023d8e4c9f3bab62fe84928c8ce5edd5 Mon Sep 17 00:00:00 2001 From: Carmen Forsmann Date: Sun, 5 Sep 2021 16:23:50 -0600 Subject: [PATCH 0196/1214] Add new Delivery Optimization workflow documentation --- windows/deployment/TOC.yml | 2 + .../update/delivery-optimization-workflow.md | 39 +++++++++++++++++++ 2 files changed, 41 insertions(+) create mode 100644 windows/deployment/update/delivery-optimization-workflow.md diff --git a/windows/deployment/TOC.yml b/windows/deployment/TOC.yml index fdc36528a1..216bdb78e9 100644 --- a/windows/deployment/TOC.yml +++ b/windows/deployment/TOC.yml @@ -48,6 +48,8 @@ items: - name: Using a proxy with Delivery Optimization href: update/delivery-optimization-proxy.md + - name: Delivery Optimization Client-Service Communication Explained + href: update/delivery-optimization-workflow.md - name: Best practices for feature updates on mission-critical devices href: update/feature-update-mission-critical.md - name: Windows 10 deployment considerations diff --git a/windows/deployment/update/delivery-optimization-workflow.md b/windows/deployment/update/delivery-optimization-workflow.md new file mode 100644 index 0000000000..d560a58ca2 --- /dev/null +++ b/windows/deployment/update/delivery-optimization-workflow.md @@ -0,0 +1,39 @@ +--- +title: Understand the Delivery Optimization Client-Service Communication Explained +manager: laurawi +description: Settings to use with various proxy configurations to allow Delivery Optimization to work +keywords: updates, downloads, network, bandwidth +ms.prod: w10 +ms.mktglfcycl: deploy +audience: itpro +author: carmenf +ms.localizationpriority: medium +ms.author: carmenf +ms.collection: M365-modern-desktop +ms.topic: article +--- + +# Delivery Optimization Client-Service Communication Explained + +**Applies to**: Windows 10 + +## Download Request Workflow + +The DO workflow described below allows Delivery Optimization to securely and efficiently deliver requested content to the calling device. + +* When a download starts, the DO client will attempt to get its content metadata, from the DO service, which is a hash file containing the SHA-256 hash of each piece in the file, typically piece = 1 MB. Separate metadata that is obtained, through an SSL channel, provides DO a way to verify the authenticity of the hash file itself once it is downloaded. +* When DO pulls a certain piece of the hash from another peer, it is verified against the known hash in the hash file. +* If a peer provides an invalid piece, that piece is discarded. A peer that sends multiple bad pieces is banned and will no longer be used as a source by the client performing the download. +* If DO is unable to obtain the hash file, or the verification of the hash file itself fails, the download will fall back to “Simple Mode” (pulling content only from an HTTP source) and peer to peer will not be allowed. +* Once DO is done downloading and puts together the file from all the pieces it got, the caller using DO (ConfigMgr for example) performs yet another check for the entire file as well as verify the signature of it prior to proceeding with installation. + +## Delivery Optimization Service Endpoint And Data Information + +|Endpoint hostname|Name|Description|Data sent from the computer to the Endpoint (Field/Description) +|----|-----|---------------|-----------------------| +|

    | Geo | Service used to identify the geo location of the device in order to direct it to the nearest data center. |
    • **Profile**: The device type (ex: PC vs Xbox)
    • **doClientVersion**: The version of the DoSvc Client
    • **groupID**: Group the device belongs to (set via DownloadMode = '2' (Group download mode) + groupID group policy / MDM policies)
    | +|