4444Interactive logon: Sign-in last interactive user automatically after a system-initiated restart
Disabled
Shutdown: Allow system to be shut down without having to log on
Disabled
Shutdown: Allow system to be shut down without having to log on
Enabled
User Account Control: Behavior of the elevation prompt for standard users
Auto deny
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
| New or updated topic | +Description | +
|---|---|
| [VPNv2 ProfileXML XSD](vpnv2-profile-xsd.md) | +Updated the XSD and Plug-in profile example for VPNv2 CSP. + |
Updated the description for AllowWarningForOtherDiskEncryption to describe changes added in Windows 10, next major update. |
|||
| [DMClient CSP](dmclient-csp.md) | +Added ./User/Vendor/MSFT/DMClient/Provider/[ProviderID]/FirstSyncStatus node. Also added the following nodes in Windows 10, next major update: +
| ||
| [RemoteWipe CSP](remotewipe-csp.md) | Added the following nodes in Windows 10, next major update:
[Defender CSP](defender-csp.md) |
Added new node (OfflineScan) in Windows 10, next major update. | |
| [UEFI CSP](uefi-csp.md) | +Added a new CSP in Windows 10, next major update. + |
Cannot verify signature of the downloaded Office Deployment Tool (ODT)
Failed to download ODT
User cancelled the installation
Failed any pre-req check.
Failed to start C2RClient
Failed to queue installation scenario in C2RClient
Failed to complete the process. Possible reasons:
+Another scenario is running
Possible reasons:
+Blocked update by running apps
The client is requesting client clean up in a "Remove Installation" scenario
C2RClient command line error
ODT cannot be used to install Volume license
Tried to uninstall when there is no C2R Office on the machine.
| Home | +Pro | +Business | +Enterprise | +Education | +Mobile | +Mobile Enterprise | +
|---|---|---|---|---|---|---|
|
+ 4 |
+ 4 |
+ 4 |
+ 4 |
+ |
+ |
+
- What's New? + What's New? |
- Configuration + Configuration |
- Deployment + Deployment |
- Client Management + Client Management |
||||
- |
- |||||||
| + | 
Application Management |
- + | 
Access Protection |
- + | 
Device Security |
- + | 
Threat Protection diff --git a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md index 4987bee4f7..0015a73387 100644 --- a/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md +++ b/windows/security/identity-protection/hello-for-business/hello-deployment-guide.md @@ -19,13 +19,13 @@ ms.date: 11/08/2017 > This guide only applies to Windows 10, version 1703 or higher. -Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on asymmetric key pair. +Windows Hello for Business is the springboard to a world without passwords. It replaces username and password sign-in to Windows with strong user authentication based on an asymmetric key pair. This deployment guide is to guide you through deploying Windows Hello for Business, based on the planning decisions made using the Planning a Windows Hello for Business Deployment Guide. It provides you with the information needed to successfully deploy Windows Hello for Business in an existing environment. ## Assumptions -This guide assumes a baseline infrastructure exists that meets the requirements for your deployment. For either hybrid or on-premises deployments, it is expected that you have: +This guide assumes that baseline infrastructure exists which meets the requirements for your deployment. For either hybrid or on-premises deployments, it is expected that you have: * A well-connected, working network * Internet access * Multifactor Authentication Server to support MFA during Windows Hello for Business provisioning @@ -34,17 +34,20 @@ This guide assumes a baseline infrastructure exists that meets the requirements * Active Directory Certificate Services 2012 or later * One or more workstation computers running Windows 10, version 1703 -If you are installing a role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server. +If you are installing a server role for the first time, ensure the appropriate server operating system is installed, updated with the latest patches, and joined to the domain. This document provides guidance to install and configure the specific roles on that server. Do not begin your deployment until the hosting servers and infrastructure (not roles) identified in your prerequisite worksheet are configured and properly working. ## Deployment and trust models -Windows Hello for Business has two deployment models: Hybrid and On-premises. Each deployment model has two trust models: Key trust or certificate trust. +Windows Hello for Business has two deployment models: Hybrid and On-premises. Each deployment model has two trust models: *Key trust* or *certificate trust*. -Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest. +Hybrid deployments are for enterprises that use Azure Active Directory. On-premises deployments are for enterprises who exclusively use on-premises Active Directory. Remember that the environments that use Azure Active Directory must use the hybrid deployment model for all domains in that forest. -The trust model determines how you want users to authentication to the on-premises Active Directory. Remember hybrid environments use Azure Active Directory and on-premises Active Directory. The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and they have an adequate number of 2016 domain controllers in each site to support the authentication. The certificate-trust model is for enterprise that do want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. The certificate trust model is also enterprise who are not ready to deploy Windows Server 2016 domain controllers. +The trust model determines how you want users to authenticate to the on-premises Active Directory: +* The key-trust model is for enterprises who do not want to issue end-entity certificates to their users and have an adequate number of 2016 domain controllers in each site to support authentication. +* The certificate-trust model is for enterprise that *do* want to issue end-entity certificates to their users and have the benefits of certificate expiration and renewal, similar to how smart cards work today. +* The certificate trust model also supports enterprises which are not ready to deploy Windows Server 2016 Domain Controllers. Following are the various deployment guides included in this topic: * [Hybrid Key Trust Deployment](hello-hybrid-key-trust.md) @@ -55,5 +58,5 @@ Following are the various deployment guides included in this topic: ## Provisioning -The Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. +Windows Hello for Business provisioning begins immediately after the user has signed in, after the user profile is loaded, but before the user receives their desktop. Windows only launches the provisioning experience if all the prerequisite checks pass. You can determine the status of the prerequisite checks by viewing the **User Device Registration** in the **Event Viewer** under **Applications and Services Logs\Microsoft\Windows**. diff --git a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md index 8a37191b30..529ff6e574 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md +++ b/windows/security/information-protection/bitlocker/bitlocker-basic-deployment.md @@ -17,14 +17,7 @@ ms.date: 04/19/2017 This topic for the IT professional explains how BitLocker features can be used to protect your data through drive encryption. -The following sections provide information that will help you put together your basic deployment plan for implementing BitLocker in your organization: - -- [Using BitLocker to encrypt volumes](#bkmk-dep1) -- [Down-level compatibility](#bkmk-dep2) -- [Using manage-bde to encrypt volumes with BitLocker](#bkmk-dep3) -- [Using PowerShell to encrypt volumes with BitLocker](#bkmk-dep4) - -## Using BitLocker to encrypt volumes +## Using BitLocker to encrypt volumes BitLocker provides full volume encryption (FVE) for operating system volumes, as well as fixed and removable data volumes. To support fully encrypted operating system volumes, BitLocker uses an unencrypted system volume for the files required to boot, decrypt, and load the operating system. This volume is automatically created during a new installation of both client and server operating systems. @@ -182,8 +175,9 @@ Table 1: Cross compatibility for Windows 10, Windows 8.1, Windows 8, and Window |