From fb68fdc9fa4094e2d79b96b46a3d2c9c45db0cf5 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Wed, 31 Jan 2018 07:34:22 -0800 Subject: [PATCH 01/28] removed warning when using set-adfscertificateauthority cmdlet --- .../hello-for-business/hello-cert-trust-adfs.md | 7 ------- 1 file changed, 7 deletions(-) diff --git a/windows/access-protection/hello-for-business/hello-cert-trust-adfs.md b/windows/access-protection/hello-for-business/hello-cert-trust-adfs.md index 227053e01a..d5f526f94f 100644 --- a/windows/access-protection/hello-for-business/hello-cert-trust-adfs.md +++ b/windows/access-protection/hello-for-business/hello-cert-trust-adfs.md @@ -346,13 +346,6 @@ Sign-in the AD FS server with Domain Admin equivalent credentials. ```PowerShell Set-AdfsCertificateAuthority -EnrollmentAgent -EnrollmentAgentCertificateTemplate WHFBEnrollmentAgent -WindowsHelloCertificateTemplate WHFBAuthentication ``` - - -The `Set-AdfsCertificateAuthority` cmdlet may show the following warning: ->WARNING: PS0343: Issuing Windows Hello certificates requires enabling a permitted strong authentication provider, but no usable providers are currently configured. These authentication providers are not supported for Windows Hello certificates: CertificateAuthentication,MicrosoftPassportAuthentication. Windows Hello certificates will not be issued until a permitted strong authentication provider is configured. - -This warning indicates that you have not configured multi-factor authentication in AD FS and until it is configured, the AD FS server will not issue Windows Hello certificates. Windows 10, version 1703 clients check this configuration during prerequisite checks. If detected, the prerequisite check will not succeed and the user will not provision Windows Hello for Business on sign-in. - >[!NOTE] > If you gave your Windows Hello for Business Enrollment Agent and Windows Hello for Business Authentication certificate templates different names, then replace **WHFBEnrollmentAgent** and WHFBAuthentication in the above command with the name of your certificate templates. It’s important that you use the template name rather than the template display name. You can view the template name on the **General** tab of the certificate template using the **Certificate Template** management console (certtmpl.msc). Or, you can view the template name using the **Get-CATemplate** ADCS Administration Windows PowerShell cmdlet on a Windows Server 2012 or later certificate authority. From f0fb2acd7f9540974cd1775a341e6b54fe2077fa Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Wed, 14 Feb 2018 06:40:17 -0800 Subject: [PATCH 02/28] Added SCCM deprecation to FAQ --- .../hello-for-business/hello-identity-verification.md | 3 +++ 1 file changed, 3 insertions(+) diff --git a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md index b0e4a403a4..96d449f9d3 100644 --- a/windows/security/identity-protection/hello-for-business/hello-identity-verification.md +++ b/windows/security/identity-protection/hello-for-business/hello-identity-verification.md @@ -71,6 +71,9 @@ The table shows the minimum requirements for each deployment. ## Frequently Asked Questions +### Can I deploy Windows Hello for Business using System Center Configuration Manager? +Windows Hello for Business deployments using System Center Configuration Manager need to move to the hybrid deploymnet model that uses Active Directory Federation Services. Deployments using System Center Configuration Manager wil no long be supported after November 2018. + ### What is the password-less strategy? Watch Senior Program Manager Karanbir Singh's Ignite 2017 presentation **Microsoft's guide for going password-less** From 6932c98890e743ec6480254944f5bbc7d3a845e6 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Fri, 23 Feb 2018 13:00:45 -0800 Subject: [PATCH 03/28] adding multifactor unlock --- .../feature-multifactor-unlock.md | 100 ++++++++++++++++++ .../hello-hybrid-cert-trust-devreg.md | 5 +- .../images/multifactorUnlock/gp-setting.png | Bin 0 -> 39725 bytes .../images/multifactorUnlock/gpme.png | Bin 0 -> 114371 bytes 4 files changed, 102 insertions(+), 3 deletions(-) create mode 100644 windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md create mode 100644 windows/security/identity-protection/hello-for-business/images/multifactorUnlock/gp-setting.png create mode 100644 windows/security/identity-protection/hello-for-business/images/multifactorUnlock/gpme.png diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md new file mode 100644 index 0000000000..31859ed9fc --- /dev/null +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -0,0 +1,100 @@ +--- +title: Multifactor Unlock +description: Multifactor Unlock +keywords: identity, PIN, biometric, Hello, passport, WHFB, hybrid, cert-trust, device, registration, unlock, multi, factor, multifactor, multi-factor +ms.prod: w10 +ms.mktglfcycl: deploy +ms.sitesec: library +ms.pagetype: security, mobile +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 02/23/2018 +--- +# Multifactor Unlock + +**Requirements:** +* Windows Hello for Business deployment (Hybrid or On-premises) +* Hybird Azure AD joined (Hybrid deployments) +* Domain Joined (on-premises deployments) +* Windows 10, version 1709 +* Bluetooth, Bluetooth capable smartphone - optional + +Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. + +Windows 10 offers Multifactor device unlock by extending Windows Hello with trusted signals, administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. + +Which organizations can take advanage of Multifactor unlock? Those who: +* Have expressed that PINs alone do not meet their security needs. +* Want to prevent Information Workers from sharing credentials. +* Want their orgs to comply with regulatory two-factor authentication policy. +* Want to retain the familiar Windows logon UX and not settle for a custom solution. + +You enable multifactor unlock using Group Policy. The **Configure device unlock factors** policy setting is located under **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. + +The policy setting has three components: +* First unlock factor credential provider +* Second unlock factor credential provider +* Signal rules for device unlock + +## The Basics: How it works + +First unlock factor credential provider and Second unlock credential provider are repsonsible for the bulk of the configuration. Each of these components contains a globally unqiue identifier (GUID) that represents a different Windows credential provider. With the policy setting enabled, users unlock the device using at least one credenital provider from each category before Windows allows the user to proceed to their desktop. + +The credenital providers included in the default policy settings are: + +|Credential Provider| GUID| +|:------------------|:----:| +|PIN | \{D6886603-9D2F-4EB2-B667-1971041FA96B}| +|Fingerprint | \{BEC09223-B018-416D-A0AC-523971B639F5}| +|Facial Recognition | \{8AF662BF-65A0-4D0A-A540-A338A999D36F}| +|Trusted Signal | \{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}| + +The default credential providers for the **First unlock factor credential provider** include: +* PIN +* Fingerprint +* Facial Recongition + +The default credential providers for the **Second unlock factor credential provider** include: +* Trusted Signal +* PIN + +The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. + +The default signal rules for the policy setting include the proximity of any paired bluetooth smartphone. + +To successfully reach their desktop, the user must satisfy one credential provider from each category. The order in which the user satisfies each credential provider does not matter. Therefore, using the default policy setting a user can provide: +* PIN and Fingerprint +* PIN and Facial Recognition +* Fingerprint and PIN +* Facial Recognition and Trusted Signal (bluetooth paired smartphone) + +>[!IMPORTANT] +> * PIN **must** be in at least one of the groups +> * Trusted signals **must** be combined with another credential provider +> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can be used to satisfy either category, but not both. + +## Configuring Multifactor Unlock + +>[!IMPORTANT] +>Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). + +### How to configure Multifactor Unlock policy settings + +You need a Windows 10, version 1709 workstation to run the Group Policy Management Console, which provides the latest Windows Hello for Business Group Policy settings, which includes muiltifactor unlock. To run the Group Policy Management Console, you need to install the Remote Server Administration Tools for Windows 10. You can download these tools from the [Microsoft Download Center](https://www.microsoft.com/en-us/download/details.aspx?id=45520). Install the Remote Server Administration Tools for Windows 10 on a computer running Windows 10, version 1709. + +Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. + +#### Create the Multifactor Unlock Group Policy object + +The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. +1. Start the **Group Policy Management Console** (gpmc.msc) +2. Expand the domain and select the **Group Policy Object** node in the navigation pane. +3. Right-click **Group Policy object** and select **New**. +4. Type *Multifactor Unlock* in the name box and click **OK**. +5. In the content pane, right-click the **Multifactor Unlock** Group Policy object and click **Edit**. +6. In the navigation pane, expand **Policies** under **Computer Configuration**. +7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**.
+![Group Policy Editor](images/multifactorUnlock/gpme.png) +8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values. + diff --git a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md index 57a3df8925..866c851a11 100644 --- a/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md +++ b/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-trust-devreg.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 10/23/2017 +ms.date: 02/23/2018 --- # Configure Device Registration for Hybrid Windows Hello for Business @@ -495,8 +495,7 @@ For your reference, below is a comprehensive list of the AD DS devices, containe ![Device Registration](images/hybridct/device8.png) -- object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration -- Configuration,CN=Services,CN=Configuration,DC=<domain> +- object of type serviceConnectionpoint at CN=<guid>, CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - read/write access to the specified AD connector account name on the new object - object of type msDS-DeviceRegistrationServiceContainer at CN=Device Registration Services,CN=Device Registration Configuration,CN=Services,CN=Configuration,DC=<domain> - object of type msDS-DeviceRegistrationService in the above container diff --git a/windows/security/identity-protection/hello-for-business/images/multifactorUnlock/gp-setting.png b/windows/security/identity-protection/hello-for-business/images/multifactorUnlock/gp-setting.png new file mode 100644 index 0000000000000000000000000000000000000000..47823d76a8add15a4d82c01735578dfa61dab54f GIT binary patch literal 39725 zcmcG$1yo#3w=LSiU4naXg1bv_0wF+ff&`b~?(Ul4!5xA_aCdiicXyY!JKz7mbMC$4 zjPvdpUJOyN*DO`CXNn;0BD4@|0pXCy8(go78Vb4#nAC@len6_u!Fscl`ZIZ>5vrA zgk%pii5c4I+nQS2n_5|dFyKkafp!FNyQr15i>;}#i9M(ob%+;eMfuxmYp4tE`p(|e z!Vtu9iwX}Mfd?N^v@)`H(zP`NX<5I5yCeP`+|*9rTo>qS3#x6aiUOM9z|E?vyQxACwQV1haz4gd#+XB*vitWYVS>H+dZ3ccGsi z6>kq0N;e|HY$CgMPhXF{Ute1v@(pzpdS#U0PZdp7%g^FvqA9hVo4sfGP?$i@&1W5m zWmcpxjH|wrPD9KT-@xM}5qe(B4L;03tS74&c9(A3Qn+aXzQC}r^4 zOK$tOb-gVl!>_BKpLV$X)T$2{iwg%j29lUM1Rvz;s2efUmuis`hF*zUUx(f{J+J>c zbM-ktCpb5UL^rK_n(Q|5I`HhDb*6mf*V{)SOlv{4D+o^~8<=YtOg&c2>y*+>PApf~_qe$9LE90c zQaCuM#l7Qi-U+N`m@!tZ_qBrVADPIU8p?}L$Y>9cXuaNkZ2h=M6hFc9Hq7VRWc6o6 z*>lcYCjxmw^jyJZ_*1PsxwF-iSCHaqdSoq(kl5rep>_Sqca|K68Ed~G}gad*hXI(s-D>U>`R$+0fkCX&bB$9Ni+ zQ0npeP@^86i5TsXFuUoYrW+)CMN6ERHLyNlNiIcULxX+MdB#kRC3WA@_s-isZ?jXBd zMf2$jQpsEHwtF`!BO8{#o=CbyVBr?`j{54&I5EPeib5We^LhnSA>J$1w5hW0xqK0A z+9zIrb|%CncGMlf#1L$<$J_Uc30!S?gkG|nMb>=TqZO>Tg+JvMU|zR$zv@?7vU%iQ z!VwZ{C+9lbr%vzrgDi$=-WKR2k0O(3iU>9{p~nQm{#e*m_TU=^A#ri7pI(hlW-S3v z&o~M!%L&$VFOmer4<9K{JkQZ+Us{l16Zp=%2o@nHseJ2dmr#=xSr_=riH|w*z01UA zicuZse!TBmk9s}(;(i<<>SLQw)+<0;u@@rxXNV~dl25ZPoNOI6#OZuxUD4Sf!fJ7C zizmm6sY-XRc~5Uv^qTvlGl&e=NX?fxj9-sTdiz%&mW39hv1(4P z8o~b3js&At(0&$% zscG#7{z=!~DM?RkmCYv>t=?)mrp=VY(Yj+!48i*Nz(vbPq(HA%YUgI{rMmS9vMQ4s zQnKfVvl;LP$c3NzwDmFygTz$ZuBE!A^U~(@GA(q=>R|{;taj2x`C<2|U$E&h%%yLY z>0{tUZRZ6Ro%zqer=wa5yAR!Wx!azI_b!*`CvA=aJOi#9aH@IGQBzN7r&$tCSYON!xpJ1k) z{~q$gZ|wWH=)~agpL@R%LR?!)waxmE{F_aW%@&BbFZ)z&9?z{dSNOc;daZh2 z7teT#pM)g5<;oxveOI51Xc@Ji&^A|oC+amodo`b7RR7pWPB047Ddu3 zNa%4O-V`(YE`6ecToAo5IbqV%WIN+H4*3jWJTx6UygZ+!Y?DH?0DPft@U&q`hu;&&{aaf4Am? zUEdI2fR6zFXo3d~0V-U7XgKp*vpJ$`+G|Z-FKHJyg*qr@h8MMsF-4;m=qM!OE;q=Q zeI&MN3Fzv9P489LMhoQQTFZL#&Y5L2+kW7XJxKE|YP{M2c}b-isoBh>y> z)`g+N6X3Hw!FRaYJ@#4v+j7aUDN*0G_2?zFfvbkP$dp51xMo)g)r>0ny;yfZImAn5 zZ~3M2xO!tu*$Capa~m_ziE!$KI=7OsN>{4rbXqSe&#P*W=SJgPX6ZRA@k-)B1pcG1 zYbLT}jv~R;l)xU+5(VyYJ^c&4l>cW$(k!J6H)+uY9V_95U zvo`k!y>-tcjb|gTj+@=vqw5pfgLg-bkk*3SusFm0E%DO!Y;+xLRw-?}ErKLMZiRy7 z++}Zc9z#xB_Z@J~tAlVhjiV)}`Oi`@)E=^awq6;N-BMG7ObK=F-?!Wl!FoDsHw??2 zC**63Ju-nZ2;-lT@4nS5{@DUNSoxagTp9v}7pnWN|3QT0z614-GQ6M`*2z{Sltm`O zzSs1HXH1Rw)4cjV{isr}j&AG|uwQhz4Ga3lcd3+s@}u4 zob~H55GY~UemXv;;=W#CXx6)8wesC^o;+O=^o_XVf_}uu!+b-C+@_DTx)NhIt*>2* z;v(VXt*0WBPSNq2j6Oo!*f_PE^a`65vy;5^@~7vkn91_;zfDv33X)MR+hFqYBvD;; zC(8RiYeV2|!*td^gtYYMZ1HYzs((>fEcOHBq3)wN54{!hJY`n@VLyrFleM^XbTI4G zd#5Fz_fA7y0{a&_Uz~99-=gQ@-^M@s?HpZLIs+h)5T*aE!cy+6mYBF!W%fI=tYj>m z(+^;5`aS}l2@EiE*{PbqpJONfL2wGv`W-TVJIG$XM|RSF06A&Dyi=(73vb1bvKvpk zC2yCC8noHgpZC(-&b@}++Rie-$TT?oLTfia>5wPa2mI+jfa)jb5a2US?th77|HmCP zG^+TLl9QfZYhOFfmLIX6c0Yr>^J_R43c+U#wh!Z7hxQI#^&kdWA58rYz8xR75I5E4 zc<{F>Y7j7?2`+})z9<|!elJm04;5TJlvuCJPy(IQAfHCO-{Lq$U5)HGmF%W)WctB= z`fy3daVe`LELbd=(?Z%24wGVuWt}D2+4&PyRN`ChpPlD!vX@a+Q?0R71Qv)-Y^+?-#hQEF;jr zen70g&8jX`d!DFX4E^#4&uG19y=ngZtoqQCGmNQarh)fRQcS^8NlNO(W|JPVAcq% zoJmJ0@4D8@&7vCcy4xgqw0`bN$83G6aDWHDET1p((GyOIZ8B)w0tck&q%TqQ_A_9K zqhN{Uxa7$wl0n`ou~*oSGY+bm)#C|UnC#ADTHDF6NAN8*$2D11T|U?qLweMOj~R+| zC|U5taySFJ;-(B^Tj&G(Fw(w%C`uZZq#vWQ+_kVY+`4U-xNXtY8fcumCL>+dTj8=d zLk%U8>fhg*N;N7)g-M(Hr0OzU4~wG+a%T225N&Je@%Wk8u$#@0F18jC?(>e2yq*(U zNIHD3Ehows1GbT@1dFWc-9pKMzH`cQ${?PGmi# zwRCQlVw3F-Z+#{hs&iz@Td4-g4J8xI&GDg}-s#xfq!6S&y2-1l6=>ao$3lSDrWZcg zBDMk1aORa4o{XVyNgaHdZ>=kYYQBNVsKw{$&g3dIjVGYWbDo@REopXS$J`4Z*G9F| z=Y$a;&JnF6l{F?pmtm4j$S1S}EOn=4F8!?t;M?GFCJ9%V1gl2X*b9Zt-(W@JG}uDD+D zYRG5)u)iNro>P_lgkG%>(PN_!feiZL=b%MwpDmV{P&_QK0kUQFA2;N44e-%E=Dq6v zP1W2q$Q75J5Ce9lRLO~NSKRXCdWpQ6F+kQ9dz?p$wW!7;uP7_9wl*H_gxaSLM^F8v zM++{vjU~Nn%{MsVkDFxy1Mc-G}y_fQZq8WX~=d7 zED>|%Nzx#sK|eegmXP@=^j4{=O-HAM4OSd~yHB4jh{{I8!Sp!21x|*j#F}0!haZd7 zKxe&&S%5`+LSoq>fe@#9E(e_*NpHWssV%~=aJpDj`Fn``XD0b=olFf$VH@SOylSZt zlKtTTO1Mvl@1$My_cT*OhCZEt=iu!Pr+wtEF*4FSw8cVJz${GEbu4;jVE=HAgKN%eX5X{|`BVKJ|DW^MJ1 zClCJWnwkUGbAOi6bt2K-17mq7OtnVUg_g~^r1_{0ny3mhFWE}{%!D+3iI7XJ{0GRl zpNp%zI6EGDTb-G=|D?B1wcgXS8t<$fuB!P-8X0a1tw0Js?U66l-QXNO=;Z4@J5d*> z;(Tj(*;Ol)p{cD#FA<-Ycliv3K0a)?AflGW6LyP4upPm63l~|+5KCc+$c|B*Jjym# z>4Z2^<3M&26x-`d8^Hk?#!UBq zSQ@5!sL4A+QQt_^b-eNpRc!~9hQ=(fYyxzJgA1*PlOs){I(~tfkm(nhnXfjQb>@uC zNBlGO_(goZXtw*BHDw0r6`zZ>89w$ItPbXD`fILe%Li8z(fL34`ga`=2y2eNu`liu z+d24b591+36{ddIy2aXD?76@FSdzM@X|ZLG2AP|XY3oSDSqPm!Ca0fTM5#y`sb6IM zPvV1+F26@Xkd4isHsP7hGiTy3s^xZG|J?^$P zqt5$#Nywk=P9f`-gX=ciZbMfB4T6Nl*wKkr{dm=^r-Ybi-w;IVIXfpYna;zR6BGBa zwuJLuQhGO#{IZN@<(g2LAmk;~1~V5E%qqa5_E**MiAQS|ezjCI~R*i#R5bhEiJ z1v(XKZEAa~21aGsU9frTgOED!Utdq{)w&OX#s$89RpPkXQurBac z*b3w2MF8W4{+YA2pX0*Xx>GT51bw}_wHIMKc1t3YK(sSynV!XIWw&^2=j953s`$XF9>5gLGuBfJpr60 zNPIzq?g?{jQ83HySmtlE=jp;ZaSD6!UowN&BbuGCKV-h4q#W~&o13^nsv%yb(npVLWr!^A7!fj|g=R6dTju@PD9Y1Y4^;L$F(MO?TshaRzP zA5gtIawBv*01b|twsaks5JX1AWt!tNI}QbAm-jiQtJGk0qFTg#N<|}F4J~o*PKSDo zA&F3nV7ADF9-X@0yrV;O=Q0JXvmqPfne~A^)?&qXnqUz$bdwug_{zNg^zPug}U`s9CT6zBaJ3q<38=3TeC-n%btk|@@gmg?PZL+sTpAl;_~?47+QtJRSit_mH8UR=Y0P>TJP7aIyRm~kDf=A=%@huV zU)fYMI$xhPj))i)(?*1Cdh~_g{ACD8e?VnOsG|EX{L<{ihzM(c?-mfk|4aH{r9n>C z@DcFLRD4jOXi<0y_F#^)?0?tx)F0FvPUD&~@&Azv{kLT4|GvWnpzx0mTLKZM9|a&x zCLOFBw-gxKp(%@@6HR7U@T)2gZe#L4rh=)OdwO~RULYpMzFz#bcI1a`;@KCmrI{~V z%DWkho5Bg@LzdMYTJn)sITF}u%`4$6dQ`i>RG!bQu9Dc{1q1}JB#`QL$e@>JHv`lJ zaA0;lz84oc;$W7Cp-2y3gbx2FHj}F)A}VULD+FV%-i{g{AAf9Y%sZ9OX#;4%B_ZLe zq?LwoW6~%J&E)-XP?I%f9;kj-So`QC)?82Q=+<0bO6*vt%YaqGP~AZ^?%3`y-C0`a z^$y0Z8IQ8$1AqV`0hVFv0-Q0n5=q9nOtaoMG7`m^pID6^+kCkJ>uarLK)0Sx@20S% zBy6c>y`GXoEYt})Y-pu%L2*?U`{}!Q6xX$L=e2WtNXp#u2ett)#P8fZ|5o1Z^VSXk z?>@b3!PrXK%f#)DmUPnJeW;@3Rk`FhMoS?d-5QF<7WQP!5b^oN4M_6-gBck3xE_vlr;V`Ia}|C~C(SX@nUkTb4bmS){hlFPiyQ}LM) z>&jW4|Lr2Bg_|447%N;<{u^kT4}R3$R>4U>BeG_+^xn21QtHEg{hd_!Z z}%V`O|F)tuaiskWTS0aEwk9^nh6gJH5AB_9}fbn zR}gN&7@bpE;ukMPL1=u%Ji4*{TLp+~~8&hzL@0a`GcbJUl#H0)ojE6A7M~ zZKZ4#hGd0b@o2V+(e@;rmNj2~m#swp_>B|oF?2oC7VEbrCUetVhE!CIY4pe7@kjC> z-$9|Q<$M@gle2Hu`|WM^5Oxgm3XxY=w)PIY8N70u+7R|mAM?0zX>u6Zq#X=ep}Um_ zc45J}C?z{PJCQ?~J^lVtoz}?Tiur-dr5Tw7%{v-uIM9@zq6xAaCf?}ysv#VH!xM7ym8FZQX0$85Tm5`fB6+7T zcIs&6kUMy*N-I|>r-}nsM%ud!YU}IqI5;@qe^35EUx6iYN824uM{QgVK*Tv~gGAk< zsQ@7_^AuR3CNbdO^w1beESu-LV8p8YWp@a*F$D;RT}0ECBcZ?DfmO}gLW|L28JC@s zDkFurvb1FUoGwV@*f^OlN6y8is*?#&LK`tJ$mCDHRyDR!+~IVe)_3S})dhh`Q-FY? zZVdV4iu}=ecQ_d~VGufbIIkgM*vM~iyQ9hF(mp;Z@*)qL8=qiZ?lh~Jg|?mRYc7)p ztz7x>alr|Os?odr(|28O3~qn=?J3egdLIm{Cv9T@1Ix;{E8vkKLp-6Gr%rD64c{npJW7Bv!U{AB37f{xQNV&>J4SP)RwTgNe+yEru zfYIFDoeNW)s-kmRTZQIH z@BWd<$U3`ugJz`y`TtSUOtJv)4Ib^k*X;fWVJMvbKg|qaZy*q0Cz78(qwEYP2LX$P zuTBKMUYn0e;)S$Or-y7!-7VvuKr_oefE+QrxEHv}~vp2fkP_ zT|CxYU0~APZjRakw<52i5;*_In4EzD+0@iDQNWFJU|@jRc!Ut_d^a~YX>)=2!O>}s z;y%5Y9nlBOm_V%4tVVth@^{ns#V014q+rW7V4+wSa5%tZWn+W}8Lb)|}CZ$zQoZL|LuhzU{L61zDkbX z^9ejV7~&!%GLFv=*UWNed!i0$iSE+7Lp51BwR2q4nT-e~5h`~ox!FxJDG)5d*pk^7 zf@zjY)$#r#@Qz;0dFKYVOnu5Ic> z3G()O>h(fWf1NJ#!~$8bcR=$4{sf=$b#^&EtX3$es!K`<s#LoK%fes5X7 zjXh`1S*OW3l*~06O#21|;DsMCZ&p7P6E&AiRF{}sjamVi2Okjcw6xp)hO0n+OL~v- zFPPOg(mR(mcG8f*xyC6Br8@W=4wQ;D>)%>6Ut`}KF9!WF9_={12A&&0Xq>CHB3W@g zWB@v_`tmdx#Rj^ZS-9Tw0t*7ScneX9zCuecUQ%8PwHN>S=NXQ7=}F2M@8sb4)W(Mp z?&(afWJP@NCZ~Eosc)BlHF8@1+w#os=&J(`l}Gg%;EY(0|K*Hg%dn}wRG3auy=FfG zU-%;I3{JVvd#Ja>(KiPJB<-%Jxfl)_P zl>TU%Kq8wl3fR54-IxPNjuh}Yz=BEu@NQ@5m!E*!%{O;<&0I{b;#{M|;fXTWx#z>< z0j@hfQGHJ3%~kk<4&Z__XLlVx29(&u?yX7?GBGMXLU?c@c=kc-o)+jNjxt_&7NO!^6YN7Yz*zzL}fTXH`z(Fo^%uhq9c% zg1o;1N)m!H-lMnMksMtg9Et(3H!e@H??&LQ!qeYH(gX*e>%-XymoI+JMAJOWFTYV+ zOi}h}PT%H>B4u@t)BG}C42@pV)79cC)Q}O`g=j3H0TLkotOEbxTg+Z)DZ<6ajb^t7%u<; ze}U?i8fyWx>T6|kIl_JhQ)ohR>nPrF)oPUO{f!eqpbl+@|9i!_03NNcujlr7u%9~y zP)o$p(o*n14Uj&O!6DUZU~VSVB1TP;CrF(5Ru)vxLg3c{XW^tQHhrfAEfFC=jLNUI z-4;w9>I{7vludd# z381z9f}r}@$WU|GAByx8J&sp35H#4e=Hl7a5YXHEpd&EKMS+RqAtw+oi6~dWgp#l$ z9U?6~324p)L3>;Aij$0GHDZD9f-C*y<;5Uq&G&e!##CmR112*(F;y2px0U{B%!w#oosk=y-2%Q6Gr)Po5c!7x zE2lZ9#C0cpQ__GK)1u*QKgH$xFeZw+J}ybJT@(jJMBM6e8nnU z(P<1FxA+GudZ_rA+CyN+5#sQ0wVycX{B+)n9NZNI&$JKbRmv<4PlyQe+G$Qv~r~Lkcpt?_rUraYYMlF znI}SRq7YH$c8=*JQdHT@lg{dvJ4x+sJB9AJx|_SgB4kZ?=2^1nv~;*H7m1(_8+cyg zX#HzV5kJzbet&o-@!tT4Q8qcA78puaQ(o@aD?Xc6MhWMRCQ`PS(C+5!m2vK`V4$g& zGU&+Ep8X@E-BC*X5rK8X7m~W7)k&KT{Tf{?<{WMDsRG{9we1fqY59IcV1Zc#hsTr_1rR_he#p9PRIZscNQ^LdedoabFn|)huJ#n zjK?IDJmj7A!>kty&-vZ~m0wn7D-8Aa+pLVt8Xx~?mg^wYGahMH4iLK^u$104vRIR= zuC(Xkn$vhY_qXzn);0lb=l+uqEq#FVdm}k>@47D_15AJX`r_M;jHTqsNOGuMo zFZ%;the=X-(~Wgv18Zmn;p6%soBR0)J!zhWd7OPd_EyVoMxgd9p1 zq1!^4YyqFa+Y6a{;p_?WvW@zMPK0B`gCgUEwcHqoySxecOg*88gWn|{C`Old&L{O5 ztf;dcPfJBDo7j$C0s9!V7Sl^i(~%(vuQb(jN5zCGSJc;H>_0iUxTvcHfj#xc=Ed?` zl6N9xUV_tof)fY3|B&JEk786$mC}O-UzqtS|F#BT+u^^XlUPzI<}z7jB>fuKvu{cx z>5?E#R@7+Oe|w(T$u|-9tQNU}1Vza*n$`aYm1*77++`9{E@lR8OLt1Jf@E+NbKwu_ z9F+m#C})VpQc!{;ydo7!Z3d%pdh4<5XkZZ?q&g3EKzpZdO1CYhF@G2(6VDpH@EDC| zc}xLcqge1EWlHgPcnTl6DN^Hfra%&XA;LFBgvkVZph1=*Pdl_)>?VRM?53;w4Rgq= za}?2Mi_(rWZRJ`-j05I{j1{&QtJ>d$gTWvpTSu%>7C0; zSA4!xCUtZ;7dax&9A&*bWE#lbmq#3^7w=d_e} z>V7v=0{60?H`s5Uyv!0Y`~%|g`E7e&(OiuTq1IJ|@9Aq^qKQ$4b3LR0gE1xfw(f${ zopOJy5Bk-K(0l&j54j{*jru(0t7BtnO)gM5sO zDxe*lJIn*`lZ}6pN1jQieSZ*3O)L*68pOd#!v^qE4XFg^jpN13< zXRSTRZcn9Xh4AgU04<)08p-n3ks33ZO#Q5du7vXk!8K@I4U`+%tKK32Ur$9ZicvKG zubJH*0l2K>c|dY0H=WD_=j+4_5&>}{yS$wF;Q8_K@%(Nx>hOi={@-$p^}kBw0qX)& zAZb(6eiUyo6#OFR<>gf=diF0$6d2}!QudSke_W?@&hxiq%7DAY`7hG^g0I8>mwLy( z`)`0yXd^(AgX0N8{wcnq6a(thgAH)L{iE-|%PT5EzWcEi`Wia8`5#>-{&N=!s`?OV z$2b2f+WHpq>HmGd@xK>v{hN|iRT;qk&2#+D|6f!lQGu7c&3+W&K(G(_XNrMtv6a9$ zlz1^(0NlUZ_?wjZ@9Exu%Lo4l9T@WbXDt{4=KoQI==&pG|KKT{eip-I0eD+(d4pfP zhKvG!6SF@Ux}A}S1)JCg^R7F5mHFvp{T?U)arQ5>jNSX}dVD=)wV^y;B^yR%Km=E*e8*&kuAAu-Rl8gfOlX0U)UmHxsgQzprn zP&AK!?r@mK6k0=Oh&e%H9i@eTuO>^0Rhf+WEun_dw^V|ei42b=mDqTV_NV0FEUHKT zFG)QaFY3LcKDUrw#qPy)oMWRQA@lSizu9VJGJQJ3xnEFEREo>|5MuGa_ zq3|a)RTpK6x4xKem&*2^$aG*IV2Ic&;u{%c7gVdRPoxn@qCn94wVuamM>0mi$`&9e z9efbO^eePf7a_D&4h1lC)85;aE8F5CGw~2}%Oqe5`IUC1B#pn0?~&M4|D)dwm4$*U zZsJz%^6Z4XOte~lqcl5?q?2dO`MVSUR=6+TG)6-o_eZ$!JOdxxEdofLTbOo|vtwxnu z$0tH^GHL#Ewg#|+W(9Qf?1iX*q_6*?_)`cc2`A|rE4&V3@_J~s)K|j{dQ~>;BW{7D`JbRb1 zK{w3G?V%96HQ zio8$B0pA-L%3CI2>XLA1HEAOZz6zWlgebeht7<#lHHbX&*z?`9+?*CU@*DI%rVOzB zAmZq^LA5NCUan;P!fPqLo14}WvDP$cmOpb2f60cqciA=?*mB8RAcQsQXMK$E*gnfu zS!f>DF$GbQZuR{9F08$^IdZf>&458z-IEVRY617*lGsbHk{}9lHr^Q!ZGYvN4Vu{D|7* zM}WdXi}JQW>3zcy(Ke$1ik=DVI(PN)7WH-3I>cebKjZ25srr@k4E2W$8K)A zsfs&JGFpP&7t7BVYBD)*e~1*Dd652IoQIk!y-4`2olun?R}({`Zm90mHu2Q9q&! z7d;+VjBj3y>)qKZDwxCxN5?QI??ak`cq`NAfFgP?i{>;~I3J9#+`f}-{xP0{Qx|H; zz}M7<4~7td0p02gD}&1CDu48xh<5lNX*H+Vp7UShGez*fO6iD|ThuxKvHP*wq9!Qv zdmbmc!EZ4`BY{FtfW@>MZSq{jv@E{7SJpx(4#*{xUVbi0U5}K@5fb%o(SJJyGky6k z$Ak9SSUnKob=!*o1qpiL5Jyy~Z-nQ4zp;|aFpExfS<$d7{G=wCz$_A4%25ybK8Lmc zt;-QNNupG92^t8YV))g|&jl9RQpIjnl*=c8#XpTf#XDvd~0FQdH8 zx1efQfhq0lrWa_hcOBz-XP%s6C;Q2Ex+MxLpB24G{4nTOzK(Nwg2{^iSXb+ zc-Q+2PfLzaPKtAt0HMHn==wCF-=Fs+qPv>94|BY@S z1QISwQzMXZ7vyI7X?7fM(Nn13(C!MCGe0L(=OFDZ1zM!m4`iQTEO-%E5X76JO@H!Q+p|IB+Wm0PVF zPG~H~FgH;lkvwOqTGay4iseEZnA>cX$EgSH?2>3fc8fc?Wkb4a50l26T|Wtu_Xs7_ z<#Kg5AuRU?u_P#n^korb2DIX_&lwJ$lTgN{7(4qPM+TMK-XgwR=|0j)SPo$|E_Raq zIz~05&++S%S^#VRcK-(mOV(fCctH^|2`zK-$t9kbk%o{-@?qvN@OjE8TeOk>hM7Bw zXU=5v!?fonZn&-+)zFsK1Ep9oC?zd@lBN1_V=()v3^fv^iYLzq>OWnjGX! z%bG0J+Z2eossZ~J%`(Z4v{TL`p5{CdaAc+3^^ty5dSvzn%%6eqFyNRzK~2ASb0H zQb#T8&?~!rLOH!0Jv~cPeOghiX>B4uZ2nP#p~v0Y`Pd}HX_LyXvd_EEdDtxJ&q>>p zhgEwE412kL0Jk7yo)Ybe6rx;$9PQ!z_=O+49T=K~JKpTkaM{F|tGS7DO{VB35?n=(6lzfq~_I+P{+^u5R z=56F{&-sIAG7+5VknXI(-EaGTlC#9wZ1tgck2;oU-hl5N5YT1=t!T8Db)rr~=!^t? zcWas6O3a3r6H9i%CkDurza*TlEw9P0c)+%5z6yLa54gKQS=)W(LAbj8)@YtOh4wOk z!Mt*>4Q0pwOzw}WKg{G6;02JX?}Ov>1K1(fW${)z_CYEphZu8XkuR-xtXw4B-m3TTBXW3)kx&1XOtDb(5<#FuP!NcI ze96d7PN)V8JCLc^3-Z(J6WoYfbK;xT+-Krchc2?L3*g5OTm_wyI)6+~%gRx+Jkorn zNxF4N3&UO^sPt8ox>zmiLu4_as%!vVlDy&^-cY+MAE78KUyZfMnn%AQ*S-)C!XCX zF4esJIa;Sys5Q(yaxC~>=1III(*5^aJFHIIT-^J4@4Ny0z>7eHc4Fm87~(A@Zf@`A0!hvXEugY3NSivMk0Y*~#Qu34{Q zbrgF^uj={mnaA7GSEDD$7Tzi%QJrU48pq%0&l$F!K*fr}#xLUJ#~dfmpoe82p}v;s z*H-`&19cAM=r-uk`@JxVsPSU=Df$gO0QkjTto^RTxVDRnu3!uP2$Vtuo95KCwvt2% zy*T$>obn1OFYk6~$XtLkAh{?6w43LJa_U$e zGUl>p)+5rtNd&o@^5uTQkW(p%_SuT8C^lY~mGTN%JF`NT;ym(uRt+By7=p^;b1E@f zN_LYnHT6<$B3lZd8&9vziKQt1<}0P3!aP6W1Aw)WQ`Qh(qOm89>gM%g(#7}|lcaNx zl~UQM9z=e`b2g=moawtzDbgAjAZY|O4)w0-)N>-~=zJAP(?nZ2Y)MpGUBtrlJ6neN zdH~8i?6>cK&Lm`|aU=ghzyUror7i9GYva*tr*Svv+>i;r(~PSN04jBP=KCHCPe3ah zHqO{Y`jK9>o-m@)AmMkMj$)x^-q_0y0N^JXO_N98#}%S^of%p;Z*vVs1?VNaZ!4=X zV#dR7FUCej4Admq^efwF#XtzL%N;t(G2)$`NAIMvPC4DX{^2%BK-efxq*Krtz zDz#AXtir{j9q^)Z#D!%hl%VTHRV9c>_QZquXh$}Mwz=zfur#~$S%_wOc=}qV+e;Aryr3lwR z9v95v@~3tey!`yp1l2v=Brg@ZVO_6zJDT>ztLQp;;>E02WOY=`;JhgA_wKHkiA8ui zs?Vju@g+@lB)cR@Lq@6JK*Ldx^oyvWE%tgyDE{ea65QPl50POLAG9zMTnLV zR^MsvGE+o?etlwQuXt zp+7o-i8%Q$KK+n!-@bSdEFwzkWWY;9lQn+_+$VZ=@y#>s{&` z+&kBLTq*&r^kz_iIWxkbxHO-+rkV^yv7%JlvMa+aBI>k@nkmHnGS^+m=?kzEwLu;7 zexRQlWA`5(W~@u%(l0Roh{;7KF((ATw4z^A#^ls@P1dQMXtpdea@M89_9$?RR1e0Z zI3LC;f_I+K3wlUIe@S=<`eTWP$Do0knlONBxsxwg>_?zinH>5}ejb1LmLs0%hkH%= zAs-TQgHj*N<+h5pZNwBJHQa&IgfZI$g~%$*&~Kqk=_PwR4a_r>c}NO!Hmt5 zo8z3i6#kr|u3Gmtc-h^#X{%9}8Soyln49@kMQ}+;3spnQlx`9GdK;?% zSJZ?-%n}kP^Ty{~Uk1U|yalb3;MTKD;76-_C2_CaR{e?oZ|f zg$vdH!`XXBHPviIC|_ks4jqZ#M%&)a67hC z$4R|Yr_Au#$`>EMTaV8sv#-ui7U^sVP+w!rk&0}bXV z+f37biMlt9>L7W6*w3;==LtQAlUr*ZMRalZl06>FTt^&Mlg@jIEwQ#b zg!b%-e3pM{O>r8&CiqssxR7yd?|DV;SkFyd$fTf`sMX%vYusUCy}c-jROe)Nyux$$ zuW^iW*fn+$x;UbBbUJ4PS>6>=sVwL&It;bb*i9BhT5NxZA~r$&ajHU2FG8Gp#qyv4xW1CjwgoMZB4&f z|2oc+iHJU$e_XKjI_?ScWYajS%=PDJ=aIntq^(V7SG3TiRuJ-;5!^#^4IBDa;4PF%>8JJ-N;Er80Os$|vatFyCqNO??@XT$4r*Rd+49;P3jANjj+h9~`aU0+yFQY;Uoe4jXV=UaxPgmaBGtd@HM0ds3_)IVsZ(O;QCzzYPIbkfzp;;`debL=P?=a0YLkLcxmj#NCZ=V9R~ zluC*XI6~;i$L;SYk2jQhGXv;d_=oY%5mz?HT<>1pa~>U2c@9Ux4v({5u^Za4goffX z;WEWPg9Gf(ykT#r>>ROQwh5NX)$gQ-Vk2X2jp*s13&3x{jCCag-QDf=pHKj~5x+Si z_la@tCu2`VXQ}Oj_q?MU{0esPo9rW&KhF_P|ExYD|Mv-Li>5`KS*hCc3Ij7Of-b$$_7 z<`@8v10bm9^&_pUSAJ<)_u`kW|?FRW&he#$98nP`THaniAiW+Pzz05qp^zFqBf` zaKb1=N$2ZU(ev#WqQRg*QrqH>9&ThZ==WlDM)+-t{esPBPary_y1E35N&Z&zAIiMC z6$B_uWfxVZHx?1RBlCTDg1lAE7nBO0t zin=^ccxZ4Corj)e3%rAWC)FNysPC`HU;_!ZN22np<;}P2P17@=Ci=xwD&CW>mO0+$ zG1rQOp2QW-GYt|`;ombl8WVPJQc2FZm|yGnXP${PmeII}a{WN-Qbztjj)HNfPt;6v z)GWU^w1~CX@7wIkVHfYFMZheTs;X}s(Mjrys#caK%!)r#gPk;#4Fa}hFwfO>yQQ$5 zaPV#03LF;V?#J=$X#^vN5nQMSP8Qa6%o~W!2rZZWrRHFPWS)LDR$)h~YypS5)Im3R z<3_rjOR`wbmK?qy-`aUf?zs=3dq4yg4G)u$8Wccp}jfV9dG8F`{_1Z##<`+ zt@Cygscx0lj{0ljyK8FXO4s)*$NDR|c>FM=%C|!DOzNO>m{;n14?U6`9;ftCEsfqX z$r-ozAKPCK#VMH=t80_;VQ!4J3EIMz&!ImCZF32Csq-Ob2?fnP#rkWUb0x`;%Exi> zPt`~Gsj$PhatZIGG;Hr->f&>$78)9V9=AS|WZet29b>}e&Y4o)z#XP}T0h0%-iCwP zTlh4=Mk=`j+cO70d0kZ$`eMu${5Z@WYfooov4DrPY-%K4KMV9^#MPwiIvFmk7kNZi z+M(E8vZTu?mi2nz9L$2?aTVVO<)*q^8`TO1**Jx<2ee?uKFIFr(zq*Uu4{>W?}8U_ z2b#=gXd;m21LZ+aIiF!cd|34bh+NwDjiJ5oa9`;-OKEK$%v+3k4qBhp*{rUW*$h3$ zyeq57FWt!H;l>JDQFH2)71hxnueJu6@*I2|ddI=!!|j-S9XY8bd6EEql(G=4uzMOW z`h_chD*13REy6)O6c;dCRqkxO6r4~7zG;;tF79p+yh5dZkFl2)xPFM1I3jml&CXzj z=s|J=j-4131}DQcy?T`u{sEWWb)QVEaHjsIzmv%8 zg!MEz1wrg|70;!Q4MV#R4h}ke^d?&W9@4&7%EP$r37^g?I}Tvx z;s8Aa9^md?^_K3zg9qO+IL(F)23N$Ak!$mD3Nevt&zz)n;LL6Rys4>4N>Y;U^aOB( zuGS37?FCos!tT_LhcHq+y{-r7an}>GvzdUOS1wd1%vZK0CUjK`XS4Lz^HkZ-mF?~9 zlmO@T2!TMDwlOg?TU#9|)~-BnJ{Mn*3z_EP->b3?wfiz&Be>^#iG;*uX3^6|wIWhV zRl|Gd?a90J&o++w9!|Zylq4kYm_t8*bdl%dTAK(e*LdM4q1Uv171#yxhb0@Z2PVmD z(R*ej^&oZaYv+5q;c@3&B1=~>s@9(eomxO=@GrC5v1`pM?o^w(^-Ro(=#{+^Av@Vw z*)vA|6Q)Et)$I1$BsbzAtBziwp%sphLKVAaddygU%dtfxANy>8hz~*urqFiEqGtSv z86#*xqwXtDSjo5PxI_~7y6rQF`P!7_d+(n@?s95|)^j&W>NS?lee<@&c7J`gYYy-B z>53{|s-3PO8_@2;?!AqQL0JE}Aq%+9=% zPTPYLLAZj+qy=bB-u4Ic-ht9L=F=a!`D?Ue^1tBGYXRmhMKp8iF5%n3WYUTT#+`?D zg$ajKT)!ITq&KZssP)@l`OOdH4tZ-#ct;RqRt5V{C5hM`^OWyQR058o>t{ut-teuo zZYg9P`l$J4SBmrVxF!={pp${*9ZPA>dUQ$%v$@`8Y4F2rf7Lf-h^79}8r^=l?q)#m zE1$&*^Q{uY-=(I&4gycenaxKvU-^j=pwJ?yd}a^Op)2Qmssn2fhsr2g29PCXDC z9}JmxKXz&TZq_Z2tt=zpiymmdnjy^DOKxuaCMGeB(Ijp)jHzbioFLWa+Uy6uH`$KK)bYn3 zktX||)C?hiXw|R-GP%8M7{Tr}nSP&H-X-BWBVf9GHPuGwYFVt^magoA9DXCbQ6nZp zp~QqN2K=b5?7HkIVpQv}Q9u&w=)<#D`P`NFP_ZRYA;9e3R|u}mlH1C+CQ_IF{IT%G zNkxiUIAWD}F#hnnvW${=IZI-W z`AtGi^IS5ekINCYxUNHX%)Nn{93OT5{J6xx>&1k?Usn8thR7&+hv=f<>_g9naw(0S zY;o1&z6u&ZUbl8^^f1kKR86sg&^MYCzr@m`n6$4Q5Mi>ilE*Ih8}E zu}7}`L1%qxtaH~$G>W_ngIOzQ?b8a%4jK;6XF2<9HMN!_JRH@`+j@cINZ}{zPEzEN z%ZaL3A0j?k6QO8RN++P!mQhJeoecV|-3zf$J!v(j+CWy-ny#kkYP)#0J2tSC!3!bxQYShQ$BTHLVRSjN}Leif= zxz_42U)LswgZ0M7-*Jt^dLU4C46B04#-r}Vd3p}pQz<=jsgI%p97~|(Hr-Q=dM*<8 zY|1fLJoQ8YS9iwcHXE@(_qEC*+A z)lfYt9jFOZObA@we6SuPj`0Zbu)MR2nq-MR3-R&M=iuNd`*NGa7G6^W(9HS2K?xyo zJI>lN>fU32CX0@*!|M-s-b<)aSEHtU9;g*0PEJk^18ps}2!xyuU21BoKj4HPU6*@XehAR&9D927h(@Hx$E` zo;0ThEGTIkypj!Rs7=6bYYj&AM$c&ljOXyX2Aro3>elia-ey`yG{hi&)cVlX^_$jO z=s5SfkUqpY>sI`*F$k)ZR-=AVXV^8@f_&2{`{GR_a&i-s?&;N#fG#XX){Of6i{MECfj(a_*=oC zjUy}a1Bl-3e2=2K8eN!*Bi9d0BYU#M$_E+Z%KrW0A8E@g=O(Ds?vJ}B64eB*F^)q& z#P>z`iv(@?p+(C)4_3WqkT@1bwHR7ca!^S7@x7_>VLYv?tNnTKk)N%Mz>6LR+=IQz zOvl_$xdNU6Pb4+2gCzYywH`B<1$hg}^VURzF@emAS*%5JEgG}Fdwg}fTjw?>hp5&w z@V;w609uqdaC#!!kT5+HHK&@}wAFIhK%8+)j55`4dH`KFt8eljJUwZ8M+v;7*1UUZF(jh zZJ8!~bR%?atHF6cfCSN1%WA_G`2ZyYnO%uab#7)gKR^g&rok z)`zn2Ko@!PwcQIN(e8FLV$YkiBg<6W)_=mYBlUy-PEdiL;^Zgn8fDwyd#Th+?N1kj zS+}?~$!5;q1!w#=PTW0~ zIC%bJ?=hmeWN_A+*hf6hSdej-c6mizCrsEX7kr5)HiPbJsyhcLg`9srT&>07K!@}5 zZQCwF|D$r`-{B&!TvI?NubaKz^3T@{Iny%_f>ofxLb#d(*zjg6OG^#0-tyz&zse3T zUQ=sEKy!omgCsL3n#-c*u6E`S7UULtF8C|EE?&wI2FcR**V~a|1O}@-(FTO^u zG|j832Pxd-e2b|H1wUo(ePEuDmS^eaGTIxbzuhx>pevXhUyIPRB!UJOI>uQmySDoc ziC!w-P7|NP&dYHRbmQtz*$3QRTYq~Bm+}wiwsaq)FV&>&)3U!}@+nBrO^`aX3BZ1_ zfPnsD28U)Xu-{jS0=4SG;})-6=BljMrJ5(khL4y2B4=)IDT;07o_^oYs~crSn0WZ@ zsoX=Bn9iGQb`!?p@YyJr2Tk2^RbSG3a*JIR4$=e0tG~y%U>e1|xZA#Rms6# zIZLxUgzL*E;Tj3qXX#wzb^Q*dZxf`TJSbdQeCzsqOSTAc?UCg5H67y*y>Zm8@>>}9 zqf#UBc5MjYn0AQ%_bt#c8nC-g}^o0-zb#-I>t_*`5Pajkdw3Y*#4 zoa$!~4cB8us}?q8$sp&Z#<$g!O{oI@TANB{_q-r`td+Ook*{g&l8$>1w_I0lx6ADb z!8B`GPaW?+dzsl$3(PY){jER^Y|9|N2ERI!I(eru*uEEkP8qSZZXSn9^cfi240BEd zhZf&^+qeJ4`7;vv2E}U+mDfsxe|iS&G-l)ZqStc?^e8>%kI{u;~`` z^aVJ6$Rv1rc`tzA7ikYO#k8PNlv38H|-tY-7UQCOa{EY>uVv4h*3sY|?Y zF}Z1WckQjdi!Ys+Ci*2vf7G@!WFdhoEH74?8rJMRt>p*jA`c^|GY35WdraWlm-yg; zg(&^;7V9a2%gaH*?CtL4I2Pkdzn8F(w)%S;o=tp@J%JkKUoSvzi(l*=`j_wJ*m#)eB3_Qu;{q@wEn$o!Czj~wY zhLpGKo!FXvUyg%UpcwGopRzimRlU~^mwuOcFO_WNa^1uMHl^wPdrMKrAAL+A|~mj5ZgyTGU82{Ob{&0BL~RECSaTR zvFeY#8Q0^i!Z)aDBDF$t7NjWgf;j0CJDAb78N)%hHPdy$G@{evl!)Nwh!VElOM@4<7KwXJN<~V} zTr8n0Ux#^HX`O+V+Hx1B#79ikmCa5;rX!Mj*w@`eMFrY*%uM7jzb^Z{ydAthtkfHM z5mM)_FzR=w4u{ z7^>N)<kgnmuIz3({!&h3yOywn*dU|~J^^!qN*f0V310a*jgB^aW8s;4VudAz z6aY%q89sZOzn>}&LtjRUjv;}oCt>Di)fLfIv};MEd}hQ4=#H(QKA@2-sdar#bUh9< z)`l|?4Bu(yMRWm3jndVO&G=kFcbn4@C^IXH^2_gx^5oM0(NhwaRc>e0qz1DqzI5#^ zN5+(DOdvG(xaU75VV{1!6njFw>+<^Z9+VkzY~1?|u<_*be}^pUfDylnUa#s`!5vze*?wuA}!vx#7QY zgsE{e&oh&M_FJcC9C-4re0;zj z9zulU{5UyFl`B6k2aYFPfUV(S%|)?aTU8DJf-v*$+7G`HnFqv9M|hc6JiRW-I7&-P z`yXtikE2jn{)OFLEsb2cZ2wd2X)E2~@q&6hr5Q_#E=8{ZJqFo)((GNWzo)=46s4lilI zpTBcSGbK-AIA9$51d%_-PS#K%fgw4qs*&BN>R zw_3g;L=XJF#hsptX%iRjyg4w1=xSn1Y4FpbOH9IOz2kj&+%=L_c*iHyxP_@B88%2# zZN@n^S3Z3&XDkh38j}NFZG;kHns;Mlx2nG#n!Mg>*;)7ySa}iXPn07wK--#eS6mempq4>}7 z-%4HuV&c&(3*8trFsLp8Le_2-re@5!Cb17Dd6xD>!{PU8_x5cGZEes#!=p0TP^PFe zQ`qdodyjx5kH6m>;s4Gp{{;d}lf$cyW2oa@ir!I6lK1UeTpdNs3RErh|6G4Xtu**E zFwf*;yJY_r$ne`A4%vHfo!JpH!-XaY>w@|peMGgAvV~><`G{a1!7?`Z5c#ge$GWcy zC&-lOC$EjkF!LFmrkB|Wew@w%Z>l=&wk07k2&3+w!>u>2tA>Sd2;(0sX(&wCIqH7& z;UQX!=?oB=E3Kwc!)k*~s*_%He&a_cOK3aCB`BEI<5dHnl=N)r^7LWW#xf7=hFPW zbQWHE)Rv~Uv~Bg(-AVk$?@w8U%@hS}y1v#ZriSql%7?56@T{?WGp^Zz#$3@K+I@)X1d#~?j_ z+Cl0dW;-}aX6=pOB7|tmY>S@PmQtV|3CYhFG-gJ=EA_2KA9a%zl`HF_mmy_53YID8 z=8V&4>Ey|KVAF8u4*%A!yE@Tgt8*iB&r~TVa?sdc#N9axP~EhvuCI?g2t~qlD}2Uu z_4I;H9N`b~l{qU<7iAsly;~x_SCWATMxi2slTagilMo7s*K2dO%|nQl5=uHNyF|9g zN(F9iIqT7??^J&xQJba-UAe9$P75FJt_Kb zewD034=s*H#`aBacWo{N^bw~??vVRcbr)z9N;S6^vr?qA!$ti#T9^`ee*P*ef6UQh zO~PArzUHrpZkl5a9qpRzX?ogHP3E@nQ`E7fEAe_q5Qr*gWn10Kihm=LuIJ3ie5r=H(>qQ?5rg&weJ!)cg*p<&1ebSW^y4qJqz{`@L= z4_!lL&aP8~*TeJ8^*XIw11{>spFVy6)PfJ<){N&oAH^WETqq9fB}}~^=C}`smtv*N zoS}+M>Q6f*GyJ^ z1dVI^werFSmwpfX8P5@UwOqMQgei|Fv#YXGcKmV=v!Z0ZJC5N=d&hH+fr-`;IpwtP zHRQD@LNUtY%6nV{|3|67-((TochBHXTEva$v${^d6>oXMBn)|@rVlOC2E8)bRij^c zd~ZKpaNO82GuiOrnGH<&LVE>oPDrgM!!)Pg8lu*uv5sZs4SS|k3wDp!Wa>kM5s99g z-*X3}E@n8LwOEf9@oo6oFyumH|C8>@Jp0^9;#T6A(X9AotK84#jR!qxt3p=iMl&ZF z)d}Klt06Vgjb1X0r_*F-!I{`J;hs_GsO#cbCjI5uFM`#wYNS(dC0Wc;hvcH7@NhKy z-pd9T)9`$*@1%m-^vj&`VrNI5o;zaQ_CV2F7p82h$gq?%aHq1c@cdWF@4=2Encp#$ zSNpV!JFr;3+AWz}a!ha>h(44BxYd2Y0uF{2>bYPJX$$jWiR5^d*`+o>%RY1C&leAI zJDN==ONEl!l;ntFK8eA4bLdNXoD8es(Bw?oxqcp>mZeT@eW$SymxP=lxGavvCT#|=geF|3O$ zR3+?#IvOOkGhg;PClziU#l`d~8n)=Uepn@=%#))6a@v>{Pu;3?>hdueo2dJ~R@yDiVWF0tV@t)}W z^pkg7h0TG`d4M`ucQj4#f?x;DRal_wL*P`8FT{=AI`khbru%doAp1M_B&L`QDt=j2 zuFW*lpYrIv3%I-KnM-cPaAu;3WRd~@op^%2mI9Kzxs}^Grr*SXz&?epw^O8Q?S{q^ zhl7;8FHOe+gb38phe^@#zW&#V8LV8>VAZA7nk+8z|56Mf>sudGN6s850tSOpH(GFk zTX6!&*3rE@*RiCD_5IN59C?8|MS3Q3`c+3J`M=Gs2Olt~scma$q{#$tZ>I*N%*rOj z&f+`8G-E?@pE+yyFS+K*cXWt->17%0#lEVfxQt^qs{Ddd1Bvc<>g2wHIlXJDr)^%P z+c~{MLUPwd+0z#VUI{KfYz^$sI{N3z$OfHdAD-03xWZ18Lqb_w0uX|}TbBAtt@P}A z0QVbkG+n>7@3*CYa~Z}AbOWhFoz~k!UK@M{?#PMVs!uz1#Ps#nrm0G5>zMbZ<^FVI zJN{Weg{kR=3P8_Kx8t8nRt7;1!|`4M1wNGe(Ulh*sWvniLuV75JSw+raoqEu)R((|4XF&oU^LdoYMu zE31U#r`&3HW>_JIF9a?)N&&BZsXWFIS=c}1^>O&zS=dD06!Jcr5at~>K$@Q?aQ;oe zlf|iYrPq@Q7uM{;Eo{iA1Qt9nOgMPj$*#P%s^5v)$00{TtV!xDkJ7#kA)m{(N!Z$! zIX*Eo8>`C(%GhDKxHt2jKQYV7=#aU;G%^FF^HIdqItqp=0*O@&THs;qX&)xzgEW5<86AXe$E&)8T`BoM@5r44yy_%*z5fjMC79EISnM)t)txsbS`jhADoy&H z+EBeMpg~+RRfH|x4_~~s-ZE!jAd<$tJvM5qZH8D;Zea0?m?#{`XQ`6Jjj?bYj-}Gy z`GGiTPrW6(A%9}9#gtyG+D!N^Tkp)0`d%&B6JU44)kJS3v5d)4R#lvDc;W{Ry=I9f z^2XxH4Ari0f=Hz~oSQf)aTd{P2}vVJc-ig#r;T@b*(zZGA^LD8SHjIlg7m$O@gFrO z`H{E~Q3Tg2OaO!O`L#Y&8C-%1njL9sS6#u%-+AM3<8UpU#p!Uxv~t7KVVQFF*OPr5 z>N@fi>*@)N4!Bx~-!bqSUZ=12$F6Jv`U|Q@%kQr&HS?HGg!LXI66w&$`53|t*yA;*P^M(HfI8@4^oInhay1+643wh#Ip@l}sKXD`CWVGO1(UzWyCY2M2j&pJLxj z!nX-(V)_$3Ak8KJb4>Yw@8(ss%)AU8)80zgW$?+jh#{@F(J^k&cpmcH?;T7!p_K`bs?=+-%zVzO-ltXI=EGDFm4XLb!`Gjrz zA=@4+?aBKqHxXu2JnxkH61hY0s2_Q0uI~C^cG(>#>>DD*UoiQ9_9@M_G0s|>$(<+1 z&JwE<gsAPndI=nuGdt`k*Ad}v# z=+yd;+tJK#A!p`fJUNNw+~OKQz*5cr@~F!fcn`6IUj8XN{4e*m7^CA?X$KGmbzXPH zAE)}|Wf@8B^{>j(y2d{uJS<##U|cK_+3m=;#Xt@p z>|&iNBG8+Q*V?^2&0A-rH2wtC0FEqcKls|mJ{<#&jn^+Tm2x=zk~Jzv<3qfpD>P<) z2D#e-27te_-2aX7A6~Ilgq2;;K7SRn^2B(~7)m0gHpNGI{PbZL+#Ay9WDN&OlIGM# zNEzw|#EKbwl|?+~HXig#Z41Ro(H)wAnEkV&9f{PiFk+5!^6;G^LdM|dA>g{W*z-Qu zta|l(v^LiXl8hFYIRFiKaJ+>1o%m_VY?e(A$o;faUwBk~ArJ!(mRoi$Gq($oAe_(4 zm}X~Xl|SYuNt+xPh>eZS%QgLdNXvY?$#Kw2L5ekU z)mzT?&M?u$6ZhiZHvobi0?<-VQT>k3q~ZYp_?3RP#{zr}w*;%(p=PZ#Krn)E$wZqUJ`X*j?mgw_I2{0qK$r7ljM{}M?W%m46F zT-e(FL+#^o*qh;{de7Cc-;!?x(t1X@G?QWsDsGZ2CLwtybSN^XmOF3zYG(bc!|A|KHM#%V1F1n^{+U7G zyLi@?C7!{8NOy*R6ez$)q|`tdpLz1x=Z`vD8wtrYXCh#fnFX~y_JeezWHs_qgHbaD$J|WyFP(}3k|=ULk`HcR?ntkXG{HF_{rW(6y>B%H^6xqz`Ff}{zH zL-Kd^@=B~w$xVJVAtxoCpe}DIUE_*~LvkD&z%H)+`PY>X3Q*SL$Y zdZ54oS{{?Y-;0?q;$BVL=-2}A=K>w72~-aMwd-?NLf$OH z>KGpvDO+CvS5X&!bIg&|z(uUfzdD@734QIZ5z{=%on9>QGRH}IiVHL3hI#{%e@Zbq zq@GaanmFd9ojhDi0|+DTWK>v`PAkAvzTyR_@#x@e72_fZ>0YU?xSZel$Mm$+AK8vh zH(3(}k&z1`y0kMTWBROHah?~z(IvO6qMF_F{3_DaQPvgXd#nAKTV#9foX#h{)zO&d zdw2byGkVgm@Sw*RYM_+8lt%{XTC({4Gi+{t=4{(Au!slw`sVO1wjSbO8ozLVJtsd5 zXG#!_oMp;IkR2JJZ4;|7g+fSQhG(wUEx*X(e@Yh83k9zh_LtUXqNB-DJ)2l;}fk|faoSIX6 z<^!jxLBJ)ABVEe?+|#}5b&Vd`hRY3CNZ!A`K#9i3hv!0P#C7v?DMDRK3yv_h4u0Uf zO&}Mqj6@p_&q+}?Bu9jTrz3Y=@?B@c2aSXPLp2q~(Bk|f#_9@F-Ml=h6t#XrSzvq2 zN{aEav;go)7SGs@6v2^zx>aaw)8(^0+f6xR|F_ErX3EjM5^=7>LD5{D@VdI0sHmvV zJ@xhVH%?vRdTcO2dPx1uvAuHPf7AJlUIya2dky_2i}9G2YH}>kVX1AJU5lj;{AZs+ zT~DX^Wo&;oev%Aq297?oy!7qoU?7~C{GOT2i^RcIJ{b4fw7=!TzhX%ao936l0g<=9 z(qhTo%;UG`Dd}f7#7^oWkE;O{B8IJ_-v_z&hM!jG*j}2$a_4TR06}QsvGnIPhK_s5=XSEtL1 z!MLy9F&o8Sq{4Hq>|n=qSkh>Irx&s)HC>CN+oQ{bV8U*j9HaB;|HzHtvKM7CHxv>} z5Nbx@JHf+IZ?E<5%2xeu)1e@}VAz0Rd5G@lzh<}G`C9+VJmHJ+U7LEtqc-m4SDFdD zjtTERG{(E( zv~}+^zGX#tI^^uhm!Ia#S-Dq*!PLZtn300mPx{EK*h%Lg+Q;rp%Z8tNnz!{94?kJ_ zDy#*h=Jy3}qQX1)2?@_OK5{aTv~hR6(!2+Z!TR4Z$az04H4}zqT0BqlL(kSq3^(6C zddbXVfeG7%IVA)OB~dm`B$!Wsl>Oy#f)mnUNt=@Q_>l9(0P7N_J}FH?LI*qz`MFN! zSE-DFng-(2jy`aj4Q1(<&vkhS4qMqu7Fre^kfmY?0g%mG_d*vHEYGv_ZV_ zT5ojyK0dok=a)v(dWx4l%FBdN;END!#%&KM(75f_ zyW&M!I92>=m)>b68u1A;AKyH?gP)hT--Os_ykRy(mRyf2K{ea(KY;>*!y~Yn;u{M= zdZO6e@mv&NbuNvFyBT#T@@clJXKgy<)aEFKe3n#w0$z*_P9>uW;{m$X13X;4**^@Q| z5IPLJIG#4%*F|z_;xp>{eoVCYa5~m#X>mD0B2mp17_& zND*S1PjsjrxT!!UTlw(~_Kyt6)-iR?~IS;`cG-R#0=-7%lGtHI~Ep2bbp&Ug*?&tVn}1GyZ+4SbWBEbc{Zdg zFsOvcye?Y}7;^0fa~y(#f;NTt1qATG4)zdK$n1Hhd#?QE{dAzEK-gmEF0XxI)Qrqa zioe2Qn+nEud>Hb8`Z}5%;MKVHznb#+&A%ReacYVl?Vff=p0Aivuh|#PUrb~y3g@P|pbx8>260}wRtoptH~^*Lv(k$)^xqQmFI*C^eHfb=bDv^gnGCUqyU3zCP)#W=9qKWN;fis-#dV$QThU8$>>q&+tTd(yT8Zhbt|Ap*`@D@s~f}pYue)`x$EO_V`m=<%&nk#Kt@G z4w&IbA%%4YeNq{AU~qqBt!hj+djYP0({1dc05feE_$zv0+*s5QX)HB&y)(P6Gg`sY zqxZjUARlbZ^ADn|$}&J@(}$L;fZZeF&4l~Hyau;&vnEmqw)HjN_B$K62whfhsJY%J zoe@-IX6Ben!TmR@u2A%Rm%IqRb<#c3GJ7Z4q zXSvSp+OV-(lhU&@c>TP=z8^q}f*=Zus8F_hfp@6?h>5J> zHIN!)XsN-?!`vv*7-l&UQ)NHT-JHp{hM;U|_<+9+=)SnlIE(;bZ*CqxY)doN&U zL-k-+YHf=_k!5s(#Mzex{sn`ggJiZPUAY!5rK0$HphVURSbx^C8z$6apFce^IS11L znizI#x(@I~LiJ3L`&r^Rbjv@@3ue`if<4J*8t*8LR8o+gy2TNB4zku`iwek;60GDk zZU^7tATGztbzcRh)Kdeo+I$mPhWcNH7u8csf={|MTCah{!!STaGc)-sLvcb!mAR&q zZ?o_*zXOG3yg=7#btqDeK4jEAF;Xf85)>4`a?uRXlG%2780cTv^d-Eo%`Z1Avr8Lz z>WU7BxoY>nP;TkUiR5;y9M91^d6pEIPnw^;fQ%V*R3lBL;K-Sv1Qu_#(#8%iSrTWxC+DEBIV(!T_7^Kr~yk%irwz-oQ292;Qjwt&;X>Y2*eqZ_c|A?B>y8${YNkTpYZm= zx%U6_W7cJkhSh=Rx74uE(2O`h#^mPIJn{y=#k|n=F+&^9BRt`yK1^k%$-1xwbK}p% zA)mul6XxARWZ%y5Kvf4W^KUa_=i>Q5+1j0fjO2?ED{BEVBM*w{q^ZaHfi_E5Z)t0 zV~8x13bSeHfH}&=Tt7Vx#he`A&98w+%6=JS z(Jm^=IP~!53rW?iAY%nOFFGAc|7NZ|MOezvzADwb{V4Tn3nhC%v+Gz&mhGd!o(^7Q z+JxAKRzZkYFY(+~)Xn67DZN2eY_V2w!lW+7D}H!sbY}-yd91i(X_*ck(Lq8CZ%krF zgDoo2V=Jmdr#o^MI7i*GW&f#PLF9tr9YFL;MrSd0XZ!c>q+;Goz=Lb{-Q8Y_mg5!% zY(f~72?OTPa}$@aTE8LQrNJqhUuS7&<&$Gyt51W3sXY@0y$sIP#^pDf<4twprsJ#a zt+n@}fIH3RaCBSfs8{4dvQ-1G0MyWNNR`h&keb#cfm zp3CWwD%@5wtilmqvFo<>O6ey5D{sL5M+S7VTh--9ipN+z4YC?p!bMkI@)m9svBBvLY=GlAS{G%to zyYUgxicq6BU0wnf%R&eIn>_9;X4O&4-)HnWlXj$0(L$P^f8FbHD0TZ$be8?b!AKS; zGQZx>Y7a0;TAVH^?m0?*`CoZpM{bFHq%yLZzIaw30f5_Qps38!l41tCE-MM~wPUJ1 zARFw2ElY&$Nu46eGa8^b*EwQbC#qBs9Xu~S8d$C;U9`E~iY{OP48#6A5|#rtKhDCu zW6&t`x*utwf)jRYq6h5fKW`zHr%O^@?I&JdWB@AA-7&Z(IC^D4^Z26wZHj_PkSwP+ zOd>icRb=x<(NRK{XT;#)SGnC@C>N$Fp0!(U9nx%`GKKY6TxqWOvUT5_ml7KSq@^K^ zMS_JO9_W9T^}F8RY5mYdPvXiigoD7AkHx?su#y% zPv_`?6bfS)TSN6;{c>>Qkq)cFRs28gooiH6R~E-pYo+Q?YDYyy9u8OpMDRsG9{YtXXS5%*UIRQ~ZT019zy>kWk9$9;6dG(BKxLKULHk(M_ z?&HU4z2=etYP>m7+kKt4FDw?5)!1~S4V}M>yZ3m-{lrNPIPC?t6x(voWaR-Q_59Aw zN%O9jZ9UnoV*ub!ar?%jZf4umskYa}8Q&Y<7G#_RWpRx;JsrO=k*F8{*c|M0&>v7UzjOgVg*MD(m)*numA*vl^rU-Q4t*OP z;&%4MsV#4PQX0=ceFF2s&;rW}8T{AHY7S|-hzp7ekjlG$W2lrT!uhH;aoSrgpOvT=Zip(8Weh2r^Z4pUTLmJn&%=jYr=q+LR*}CZ=@LXw;}Fq z2J`*SMJYQ4vA4`k64#fG<`&&hbS~x}IHN7Y2yUycI z2!|7DMe+nS+W;)N1YiVlPdy8k^{xlAScr?xN_)E(lFsJKNOtd_KbNeT{8D0F|LBQX!_U(1 z!~BG;eHjrYVe|*t+o>knBnq)`(#vmx(GnU)9#5{c+ZU}UHh!4sE7S>@9-kSE*teSm z#@VPIrhCQs*50#c$nhB0J8Ur!0OuU(B%1*1D_ne5 z`}LGU^2q_Cjd8d9B1rBfQy=PPvZEy)Roi{~v&&`v-KXD(nG4lgX+6uZU@VHjBh-2Tj}T@iBdZUf9#3l@`>R8A%v{xv0qGj$5B(HrQm6KZz&;cHSuCIm?$-xlPL%OS zh~pd8`(W(tuBmegx%JT$XM02AwkAJ3JQ!2^dM4zrYPtf6xzI-KZ~`Md+% z?$mG$*Lvlzfat#wA2qDP@t5|aEe+gS#a_$%jvHltx->}g&3!JpAo7nm0s0N991ctJ2O_!B3a4kxHqR5i{rEF z(2o=Ok5FBiJeiIsF7m+=sXCij?zoR1)RKZjSK#H*IyRVqPu0uXYgAFafWid?DVa3y zWGj}cg(GjG5Y}z}Ucpp-M;5GBF_k~`i1bw4k_zEfUCPgtK~@0yw1o+zB9?JDsBU>j z`i_9A4<$9PaKs2uc`KoxjPMJwq|pz56UC&~|9;IBky!SB$S#N z@wP5Rr)+fkAS5L5vgl~NKUS=R+E%^C9Fs3deJmE?duyLtEHjcl793v)Qdwtb83rj*;?kc5{Y z=8Nu@H)mG;1g6uz`iCGLXx@duiWXkN34(1SU#=DmIJ);uirZO&UJe6g#0%tfw1gQ| zLUis`tA{b-=cEP~hAF1vuD{f@n=fq5PI==FDKd9!W^aVZ!UqJw&G=1xyh@ZNn6;NT z>9V>gWSsTh_AO;E2VDx+G{;K>oS;+n0s?ab;UbGsUQhvl4x61fe&+dQ`wCen+{FpP z--}NzBz3yoL8-Q4=P$Er9lAT@*6-o$PxxM{7?xBo33Nr%?s%Eglcc9497Y0pS9yAj zl3}bmMsF}z4x?rYN^jVlv~{-G*&vG#Q!QQPNCoyM8RG`Qr}eb6hR5)mho_+?x8$>Y zc*1=W8PD7>ycT-dw3@Mq8+7Smbx)+nicdRej}N3T>)o_osvZ&FGlAs!k7}LSt4?=a z@JuM8&2*%baU*zf0~CROO>n|Fp4cOvb(cu3me#&-DsqjSZ>wg?+9-E8Fz@i)6)pa! z&tAFBv&&_!IdlDZT0Qww^%BVGV=X${oBnw0GXffwT!>eAm=jXJE#&DX6@Ar5*}*NW zZG`mSF7pLbD+#vSAm}K3L=xH@Xl6LAEB6pNT)Y$iIC7x~Z!VlY=V@=+SYPs6AJXR?WUMAtA^V3E}A8`G$cq{c)jLZ${Y^IPQLw-NwZ_8!8Z2v{LtjSTAf zO7I-@8!w^t%2TE4bBs`SmDlu?AhWbCRh`FqKB;a};wwOtl4g`c$Uo-D=sy=-fw?fm zlC;4PzRY|*`0wCwc$Nk0s6_A*Dno?+v>vt({|0gy>#DF3((D zKG-{f@{0Rj0A0i`K$n8Kvze2XgNv2D9f;!g16H7)@TOnh-oew!%JPE?sF18r0_Y|E z+v{Zh?q=wH7b{zHknkDVZQzsJH=k(PTe!Htb20}RIbd#v6aBrom9v@6J7B02sHV9x z66hwl>DGDYWM^e(32LTa3j+G^|9#)p$;=#df(h9E?=X3LTU&EG7tm>6d=t=zcQfpb zm5YrzD0gp!9R#`$QdW5O#v^rS7UJ_}JPmUICs_>oz^$*SLVoXVylHMc-k8F7Z7lX+ z+?tUQ+i@z@W5mnXLwnQXMFx7aMuBXTJZgU?n2U5P{Y~%2=|k?9J^eHCH8*KrULkjk zxohxy-B~)4+1)}Qrcaga{UOoZVCS+-*G%16>R_GVt%14>=i;~~$C76Xf7?Ucx!Ued z9ly7pGvn^H4s^Kdez3M}<*E@z?+tJ{oqr`ygyO%E3KF02K>s;a2hoA92F*n0!^O1!txGZU12a zJ>EKd0A}zsPSv9O@$=KJWcAT`k1W5rgZN-1x`vck^WW{VeDAvM8_+Yns5*!&A;dsW z5u*mP8Be(JKp~gDUDSf6MK+T|$7ZtUqbhHG9QQkY%I!6J0`8JWG39S*_Yg9N&$;&t z9NITQt(TM+8olvf*ReQhh=_A?cG1mL3y7pOq?Zgz@c!!C-nWHjIKO7H{&jA=GG12U z(U4-ioo<0CmrB=tGizhNgzQ9{drFm=`JG?7kGTU9oGzA}y8vJ9ZY~a>&pUM#8%Z1I z$@PgrUq-I6m@d^6Ln$mEy!c|RFuchcdr4Q=2~;S{6{0(NTtMC)Qy%Ce zAkmQdLrg%PSFo2@DGhb}3|vEO*HcR#oP?zUIV+s<)hpl5w5j?bdVFoKbhvk+gOZVdlDg zgzW$5r{pOq34eq0ciokQ|A!EA~)9e++Sc{9L5C{GIVfzBgYVD(XGq`4k5S zk9cFKSwSHy$0MqVE8pV1vLdIuNF&#$$aSuORz0YimX}Lt>~?NL2{8M~z*HtrOFtbB zjlq3EHV?nYl$Zk4kG#}j_nIp^>!n)#k1~($Ytyo-oI1^M;^aN7FTCzO^f2v*FLz2= z$%yxvdXHbH#!!?sZ6&;M6on~kXw|WrVv1j?)kJFel!N7WE%+EV@8@GsV)Fbyu&RJzInIod8AZgAwS-ioF!CVF$&T zMP*%p`}9yS2i9&_fg)|g%e<-E>xOQOT;Zv7i?i*_;_Sosd-%Sp_GEvw;-Fp=a{V*! zy{b8oT$w(2=;AVKeN7CmODIut2}=P-)(}CSs_$2LAm={4K`U{{e@;V93_x!Fx@0Yv z$+!DmSV~uHHGvieuN%;FCPySWa%O~Y3_(giygR=th3GM9+#_At9dg)1dE^Y9wsP$uMjvS zMS8x!-mx3d*QE6|wl3DAa$J{w(;@fK?UDPX_nDV9O=?0+eyv;*Ik`D8&wWn(t^@u< zdyNXgdx&D{NxEW5n3iR~y_+#dind{AB8?W6dYUWbkE={%p*Z|gQ~EV|XR0tVVbN^h zVsAF}L{v6|%@rML1CCM~7-W$c7C&1K-2&m4yc^?}y>EG(X%nf+2et64O$RP&`H;^^ zeIqsggiXuhm)j%T_QGJ~{?i^9c=~HKdnU31z$z6IfcO%AlW0m3jEw zZ2Faj_3q1;&`qrFN@-f#^N1>&$lzdxPz62wv^1+b1xL)=-Jm=w2qDPB9hH*gyXzmk z2?8eBN*~>=XS-AAP93FzwPACkq;V=>6HH-u%Q0ppn=d(tE{wV^K#$!W5(_5UKV#P4B*`p}q#;9+6;#(>PbF8T(qLq;ot^a;DazL*SsU*-C&$|C^Zaj*Pq`^FdFQZxGR3U1Go zI^tAmABf95r{Z~UNojM9a1B#-BEiMeusGk4obuy^_QNl<3(MWdk8Z;kLsRY1cHG~S z3>k~km~(71_JX^pHiAF>+~b>!RYf2))l*<*EG*Hn6uzYoUXRg%L>YD4lu7Il*0$e5 z(U)w-kn5s_>NMFR-%#1c%7_qQ-optV5)h!@G0t}2jxNdymNjK|D+esI;=JsS&sQX{ z5P27olJDloKD&DcIbLpj%xCiEKSzf`_0K=_mTUJdjXN0Ey7%cV3QRxFtBv>>X7qdP ziy1Was5sAJdnD&#feuW+biCHy)VKs#y^wf|oSX5qckWyQRaIF)@&>9UhE}FNIUf^z z4lS^=)u&`$0=Ic1&KbYO<_koctNE|-Km6z|aFV?w$p#4X`697@3f;v1s>)%r-H%Tj zb?9rcZ@yO_JwHsP_=s=&(9xZ`di?+frWp-<0h|EfJLb#=Si-obQc4A#2X?(LCh9z; z$oYABC4@0j<$jG}k(~p-Y;c=h&$Z|J+50D`#H{B8)WH(p%Uc&BtmC8RBaYD%%P)(G znQ`(M=;=zk*euPTjb6<+rl<*~N5phwJdKEqYW6%Zr8R8US(omo_*r+DiCi;y1V2zH z*8=HF|Gf(n45B%@?%OW_6E2BocN3xhyHie zQyjpe|2B5ejrRU+sURWH{|x@n25P1Y!6P<#`bWgGTV%5OOE(T%#e0K|#Gye(d$nN@ z-n}C6>X^)>Jv!@<&u~7k9C)_f9WdVyu?#DL4A*r(=6_H35GG;)3R|92yPB*SL>Sk4 z(hxT!QJ*$8_qR!~HP=>iFT$qjYk!`?9!e(mOJo{Rx_?pDvNvgyG{`(H;(#R5XRB{f z9en%yfL#Zfo$6SVr>K{S{0Vh}CaXu%$5coA5Yw5qRiRbB!k?%``b3F5BD1@HgVm_z z*MxYWyIG$02CXamv7cBX`1NG9Tcn!qTBy=?lycl$z{dI%9o?;_MHw;|!ldVc?8eV#SN@8O|jAIu$10G0TQsyWwpde0Z zCAM3-5H5|TMLn_0ke;Yw*h_2R4sicy$yeh+I8&2YgwW?KVEq%qtC{{sWXt+f9wS}s zzg4;AI>X}MCP35PmZx$>rl&Q~w!CMqH8#7UHbbAR!knrzpY0V;_H}&;&>Y{iY8o(K zz~VH5wVckh6JD-1SI22zA305{Mbp8T-Ix2@=RoqHcZ)z7GC`kAWkYQ7@k5LJKZyk6uhgLb!v}lCbELN3Mb6v)#5T4pofC^YV-nvFDA> zTKjbK1G(&yNV?E}w!Bg3dv%&rOe&{-3(z|UW=!QK?sU0Sz&`wS++bUKH43Uo>= zrYo(CUZ2&z^_DE$k@PM?mb{{3 zH}-!pr4#lmyr z*L~GOc)fUSLi~LqXiK!Z)bHAhr*%J z{*-+=>g{Q;hs%C6zJms#s`eg3@~l?^A{nr&11Uee(3@r4tQou(->O;`o2*v5f9D7P zogZaoQ5_x6BSe^fmkoO}5(wQTnB=+`WOmgY`zPhHN5Y`e>*eRL>rkD#L;9FJzq0&H zGt-_}4k--k=xHY@HiMLtzbv#q_3Sx(pSFNGE+c;A%3VWn4O&6akH=TMNJQ-u+ROpA ztAbiGVcs?@)mo2 zQ#YHWzT5|9V{_iiM9Pf9r{KN5OS_(RaHKS!Gb~M_YW8{+y*6yV8?x;U@BawDP@<y+`-RMzYGaS++gau-@d%x43nZid6dckF!anT@(|8|VBx%@J~a zMv%uDMahxuYBHxTCQ7A5o#5kOy0oG1$+*-}pWxGv_*ir@g}?nq?Xf)2F^o{jj>T9s zyW@G+y8+k|5p=7jw$z?H61|$?vAmGN)#O2eum+p#*G}MrK*fnmDqFQ+8I+K0?c(;L zEau#2mA|H&1_v*U()vy_mRapm0eES@g_S{KskF`l!4IblT@{)g)~Mh@AC$>&B5MvV zIXT5`7hYiRb*m=xrB-I9i0>GNnMbf0x#<`V-YL+rPxm|Zq@$w~bJ^g#BHLMS{)EFI z6f6_@3SazC#U^iZRICok~(?Eu6Fm-N1@_2tT z%+QCuycMSHAzz-IY>oysdY=jSUb<)(>EmYE-7&!wJHb$K51`)rLNlVLj+gV1P8*e( z!~?^LAdSe*J&+p`edlVWap) zOqwmDc`%s%q@;b{PDeAhX3TkO*?d_9*P#2j>ziV~*mX|PgHuF93TgR|jrao_*<+Cg zZ#Z^dZ+@vmt1LY=S8wZ2GPY~ybEiu|9|ws7xXrt>ISnzvOxebWJ>^&WmBqE`59ZIe z0#SQ))QLi#0?6I#SXL$a$-4D`#LfsnP)uMnesSGLLJC;)_+I@#qVF~L8tCc!b;vb4 zRpX^s8m3Z+w`E57D{HvO6`4pmW`UfP>BGVhpt53|buY;n#F~dQjp=In@j4yFe9j%l z_=~rf#7JFTT@77^6*=f{IT*I(G%$IY^*yV;A)espvZ3lgLWkX->LZ&Pvjicxpiw>$%bfAr|XI8#y( zs+ZT;{1Dzmr+TH4kYJ@e@upS^ zS84mILF0UBB39a#B1^VV&mi@&CJ(g@^K?C5KSQI*$zsvznCnf9^$GNmd6SivbQDx_ zp@aTbGl*xwB&-dV={@CE8~@xn(eKz|aFLN1wUaah*6D(VnGQ(TUAq@}>#1phBJh3; z;~{8x=tm>NAqbW3lK9cHG2+W~w+C3AE#<18M}8?959%%%EuR_=t`(mdwVJIC3i?jp zyF8QqCgXegJ$|jI%HcwXeSf<%-f^~S-emgAc@n^C+%zL@?uh|e)CU#=z@8)-K^m7?;kJwD5h$Rt*_S>%LNQS_t_w!yxGD-LRln)}fg`M^L_i&B| z^X2ho0HvYVyd$)8A}|{pu&gLbPVMgr@WVYH1M!GZek=zgrlJCi-tUo9`c>ft5v0ql zEdhMhp=FGQh!$7156X>Mv}U#D-4f^v^oiz`9HLW6W}$)C=x!D77QbKT4=WN7_58S~ zzoW-qU4JYWnu1KK?lV40cD-d+g=6j%R3LlKnnS`g5FDmbI}h%PkT;lqE9$?xLuOAB zKD1GLi_Z4)tYY$HPTea*>PyTZEI2b~T17icNPW%XaNbcWZr|HYliyJk#9==9H$NCopF? z@h60dC-`kPI$)E|;T(f-wCN>dinm{E{=!;KnK*edY;99qH2EwL9g# zxrK!*ze0IlDz7s)lZx$3*Cq5-j?$K2Rm?a{={STxXw=~iTVA5WHUDIAp5O_N(%$TWFR{5-eXPC<|OBor^;P)rlqxAfV5*$w}k_=X+_l`=2LmaYtnLc zG9E@Re7gbeH#gPz%|HoNK6_%2ZAIw6OT%#XIHGI=!Jbwo4qm=aIK9iqbE-*?urg?1 zEz#1~=Y=JDl9Rzsz+nx?1>6xtMrZTXzQ27*UfxmBPd*EGV6^}KQ=`cbw1xT`^1rA_ z*ys1RJVmxk!&3(}w4nnvyaOFp$FEToMThgrw<*~8-nD+IMb0}9O5ei9VpC0gYHt20 zhE46I9w33*uTk=YCSA&z8}J6vh+VIO33_{`#^t+)V*~!U9Urei&A-Iw=h<-K?>I0pbhf%O`t1*9;K+0uoFKK1(!+P@Y?e)i6J4gF z;CW=elXbf#eY6)y?qcwYD>9e^v>-jZFb42e%g#7r_LFs>Fo>93}fC3VvnT9{v zw0(Aca1?JB+yf#IZ$z%^3GI>fA@&D%t>lRCNg0}JNlmoSK^bPWDcw4$oh!YASj!-4 zIX+I4tDm-oGuKLX^krY(yIdA3K(0fvD za6EbdERzZ0r84%Gfy`YxDs{B&FSgN&*yskips`4OE+3RM9=;os>2xf$4f413)?g;M z^}&Yt4#6#gNs;Q^?#I*aP+_3lDTz>MplJfpr6i|X8;b#n zo`DkRze_Muk>%?8U$$)Ipz@2SUsWR>nMspCvfnfmWDKC6))q$0EBZV+FxPi-2Dua zP&ruxgs42hfA7EYXFnzb^>7V+tR5k+;1!$z_N$vUzlm1&ys6b2^JZ87`HI6ErqA)w zR&xy-CCoC zTu=6^T6-M$Ha=yCNm$Fdk|unM;OQe=PxBQWn!b8DfrzT3q}Ss2t{O$oLw{~unr#kM z*D&@E3_gCJrl<6-qb#0U#d~@R>f0}?^l#r;Hi%5ZUZ}+j!=d5xH@n|R4cze<=_9x% zZjIh2UT1$Y23C1H@K`{;M369Mr*w_4(fNw#zqJ5QDo!%%<(@Axu26ITfXYl&AFJkB zS)N@p{B{Lj_JPHh_v@*y!mTG=M<~z9A~*gc|N0W97_5a!9vXTEYD4&ypozR0=oIOX zBMFr~L;Cw7#Lk}?Z3kXv$AI7dIVrRAh9`Wdk8(18b$iZeMXD$F*W*!^nyiOgRc~J@ zn?Ku_96BI(Puo`MB7y1Y-H94tl4+5I{kUIaB_a2QL0Mgsz`6)Jxl7ndQM2du(uuV< z*wrtrx+Yh2i7rk^t-Z_EQbMuU8X*PyY>{E+`sMLs;qFI;*(LPC9yt`13$C>xqHMeOP-78f!W1dGR zGB4F|FIwIly9NeomZ;^C%^&;pXyX#)8!D=ia`B!?1e~n)-kx!@9qQXBaGcvpyh31~sYlmUOawzfKyzO<3F zX?N)s1A}BOE(4cYG?#cltLslvu*01nun4-tB&MxSi+fH=ew0<{hatTTit1{NCr?-N z=`7~>DdH0V53$<&&LX#y&e(@9vOE{tDLEpqB$LerK3!gV*pnMVt1!x+q^S2sq2J2h z*f@GOM91A%ytm-6E|c5ytY{)d{=l|H)OWNy=WBi9GQ+oN+6Q}8w%{*J>fNdH>_{qfW520alOdJDN_1=&|foy@8)mXSrdAC;5Ic>+GNAt7+py6!@4KEHs>o!F7 za=oBC4ONwEd**H1i=C_IgM}Lk@0i16c21@&oF}(azj7Ei8e@=0$ek8ny7gU38vGLb zNCj?|E^uQr(mq;7c=@%`lzhYpM}qA}<3l_i2+#kW*P9J-98g54BhF-Xs2M#2g2aB# zAJhU@-`A}gZhc@5p>02?a~(TB>vq}4Qw?1b)oaQI zJAPrmRTihqN$b~QAkQ`{QW}ePv~?xIl?o8xLKrLHH%E+)Q?WpBlho%7?30V`h79m_ zH)#KDn42L*->ny>pk~p})2~7r;*>SD6&+-1BS#iuLA~XrfT@f!BM0guH!p@m*UeSa zZogIAMAK?nzSh#Fh+^@hZ@(91rKbyrM^m2hR8iwACh=1dOHqBB9)~g>Yz_QyFv8U% zziRxhZydC;rB+r87t!=dV=yD5Dyf){3IG8{p(GgaRWMcp%``PUe@#e_S{D>@CTcL- zVHV2u-HkRA{#+rsJWY1VqoeWF^{r7x(gR>J(NCn;`2CIZo5Ht~gMIJxoQSrFW7uM^ z?76V3XJ6*YybS*-G+{s+SST3iIPh(c>hdKCTlx33_3FpH2JS!1H@SNwn3X;|N0dRe z5#(>}dbcM~sNDJ(So*>tl%^>J$PmtzS>ViH93&D1WV2FlbXp-js9fCWh zwl;{(Ump}7zLndC)K({qFP~g{moN#Xd_1T=S@h{Tu7H_jsr6!s zVr~S(&O@0F=Ey}t;Trexnz|!OW_Q^u4=u?<2~m<{THp3Q~9ao~e@t zYFcWPYV>PgYBDHafI&KA^vr=Rbl@9|^>&FZ)Jx(&a!~=~az5>DI+sHYWIF)mprYzX z+&`w^n@jfZ=*4cvHe(!p2*M*}!cqZeS?qa~>-J_-4_F#b-Jx+2uXE>KENN)!r3{!T z-^A@||s!>i^3%OO#@b)~F+OGpCeU0h5n8HdM% zQv>;Rp-BF6#`*Q>J}aAiSZLwSmjw1Yk!o!PgWkHGtD<=l`-#(;29X-aIln`=_^|uK z#VW>oMjB`hBr9_>#*=Bq)UNhGWd%!>WRLpB<&P8_HJI)p`GJh`$c3@r#cDC>gOAr_ z`vRbm5$G|5PgCm?s5IgoA?WGp>dK*fNlbfaVehfy*?s??#Dpa{r2$5L3tQR}wE_5| zP1ZX_yx-eN-S|KA_e=c32}&jViMw6^e$U8S``gpfb*PRwdxVo+%>3P%oym~CNF!eW z|6n?iN&pUJ1MBkHUrk?mu1X%vsZQtDzeME0cKqv7aiR?OkawZmqI0$Swa=lgs;xM; zYz&RQDr2qx=lt{0yT7(=5Uvqdj8n5cRg5mQ&J{>Y^jpp(BfDgYi=@%SIO&YM3Hd%A zQLcV#>G!~PAb#)x^i*LfSXKO-f-B_Ki%!y11OmP9^xwE*o6a5o7U#Q{uz z_4~`Y{^LhLqVB_)_MG&DbEZ(c%j^%vogRjPxG>AU73Oj)(Vf}1okP7a<_JtkhW%Q| zY^0+G8uwnMBdL#1-jkdLLi4*^i;?p*8Gj5f-x#l-udit|5@yo@NSoj7OJKWAPyg$~ zuJ>~tx>q-pZt`&=P$kgyt=j;z%$<*^=7e5f^fN-M9XWX$(WKTBc0W-Xkay$G<5G2( zu1w&ICkE~?h^i|IgOdyrc4(dMZLV_854n@dwBH&kRpU$~&)cvwi4QWBwguV4{H!}m z5xqYVI9Z>|2J8?r*Wsyo;o<@n`oDy~V1Buh|P$o|owzA%`-;T1mvWv5vw1+u&N z+||35eXETXkU#VI^Bqd-*I#g0{d$HAacjY7X0LFg7xOA1k$J_RmVJm%O5PhCb)w9{ z>O7o!XRQ}u^a(4!9Lk7q_KCUHm^0~)xgpqALvlL79ZyxX(byOFy_LwbSu$tXyo-(p zpjM~zgE%TyAyz{UU+qfX2SD)5%2Rsm(Og$qBa1OsN=G!*N|oEX1NL(r15eo5N>bg~ z!AxA8DTIeBT0c9ni&uyDL$0#+Bs#4|TjC&p$X@XWiBk^e81e}SqWx|HBLZnZLjS2N z76Vb~ai=EhuG({N-5l^3uI9HFk@r$NuX$u(_gvxd6sFR>z|;A+1IZ1^*1*mnSyDfb z;J=`rk_h2*CNdC%z$=#&SIAp3?jui#wZ z0f6l60e~cEe|d4v&-r2ZXHFs@$oHKmpbw@EC7F_5J# z)wK9C;ZRm>pMU6agyJMo7zE^TLf{wk$g^ts69*5@7>j|G-|&x<`yJXJw`78+_1}W! z?3mur1n}c6GbxN1>j-;|JxOJ&C%X!g*+ zI1y)^eQq;ILZ{hxNZq797Eua;m)3bbw2B@{Sz)bv?llO}G#{#0I%Kdts+7MRR`4;+ z4GeN?nOvwFd}7ATM}P@ZLX}ZI{J3MnGi-^04Og-PvPypxfY$@ z(b#zxyd@*F;_;Ki=yT_gYc+GF*d#5()EUC@xPr&MN#A7e8NV@%(xTb|&`eftz88np)JG>AH%vNVj`8d;d#){hjxibV1NUEe%DplTk^g zJytQL-~26n962+PcA=d9zUD_%?23gcrSLX`B>>Fc=~C}0tiO&P^ErPK@)6mbII?hw zeWs~Lv%{qns|Su&VY_qn&iw5?bNzc*D>^0)mi8Lbk5&*gN2?z1?_d0?*3u&(EJd5%5* zR9g=_#M-`ARXumBc=H@^orrS|z{1`-guUL==P%6Eo4H(l(}jTjiH~6VA)HS9Y0xC}I@vOHCejv4NfgSP}YhKfsa?TLy3~7&IhRGwD13XRaQCNZhf6(jQzd?9wrs;^gkb zoH~lq<-EmVO`f#hHESar9y>0FjK+WI6s0G8aSxp8q#p|?-K^5JX@^F@c=av` zdV<%&@zMDbdaHP4?b!Q#31OX-LcZ+UVK_1EEXmy2@RzzI*;9zB!fcBAb`L&n+-t3y7GOGa%=;D*TS|i!pG^L}#T(qVrW>4X99g z1#MJOW(#1UYODHh=KOA&uOk;;hkV>o z7WS_p;#90_I)V*S$7A1|EUGG0F~7=GeF@5`C*Fw+SkuuaFmXQ0uySbrWrV{!n;!Y- z6k&L^@&d@h*NLNKYhKzhT|9)tY|RiNrypxA9obZN#%H=7ad{y+jLWm8wsnv2j4kI3 zbnts?qu}e@#OU?X=oF;^R_iJqw7o|(zGOi+3k!RpZqt!3KP2HQ{uTs-0A}3ct!v1< zU8{@H{_wEoZ&jrWGg=XK{J_LbT;)hk@+eW1SJ>#3=s8|*w?PR1*Km#}H3ni#h}bXt zmR`h9w54KOU({C+uN7C7%^NH9S1v#Zwy(#&>>Xz1#K`PEGlp#I9zN!IH;h_n_D6oS z%ff^BmZDUs$h|nt_B3kw6^j6)Rxm{kL_UJ*E>xc5RB~L^$kkH-6`C(<7Qu~SA5Bh$ zJTK{V%cw#&)B zND!gvPGn3vlb+>cSg@#B?4sqcE>SO?iddVBfH}z zLfY+uUv^YsH$+pXogp-@1r4bUQ{eAJK{*pC>Pi}N?!NC^6%FNCY_XKX&_kof-8M*H zK_yYZ^0QW*r!hY;EqjXaOHoXC_~Zpfo5B8u5}y6qR87}q@uo1Pp3=EATjo|pFMr3Y z8ordR3)bY{_Jd0Y3*K)A*C9{tJI_5w3VVza#;;X9cK?I=$Qw69(_>j9yk$c*K^vy` zl8Lg9mOo?5BrMzR!PNK>?J(4grciJ!enVn8ZqafMGJuz_S1mEgPezi6vaGo0fnn*0 zNYrpWmD>vY)5~sjHkiDBqvUvmD9XtT>>>FbZ5h#HXHYv; zkw}$aX^KmRB_%Z8z$#@bGtRGWH5}h1K@k__PEzq{%e>%V+47|PqlrjA1)CfW&QwLV zA{p^RTJUTAx`}TxCA9~E+{=i$Tac~kkv!7b-x<@f)AL?N-R%ri2cF&;2Es>5E*ZFw z4ED_rwI90*`aV1=*RF80!&@-xMueKoby2lL$v8|`%w(4hDVr1ecMN~{1?jv6^n4B$Ps2?+{}B3;u+Z>jtS0No zLnQb>poev|m{Yg13rRvcljbXiPP_U%8#|IgqeA&@Mour3^Itfyx~cuzP9-YL>-%V zr7b`|kjgnjKpb8=kF*WiTHM!W>rd@gDH$(a3@;iR^Sx75l@I$eBb7_gPk$2mOI?qf z#prR2C;hf=BBNnqe|c$P9v4nY=35y=!zi7h7%zY~cGKL_#O+zqx1(`X_e?l_7WLR0K zD^vtvA~lln3K=@k^W>^UM_z(#{UQ?V_g~>kiL$Lrh$yv}uXNU+nD-*&p`hvmNh;&4 zA;MzZeGm7BtNFMsJt^2G?dT{I;Lxnsf87EKW21`AuXpB5o!6Tv-CP-prqS!bdl9H% z2NO=3X6zAfPy5qrxjyF!)FLgLFGlo$sEDgspN|kz-^z2Yq5KGU0{i&|Tr(F#t}J>C z6x<0qF8y)KfB=a*zOyy@)+?PN{r1a~?TaSNRnsZ{6qX!k-yo0ZE|cM%O)g0QrV@dJ zukC*Z2WL%OA)Cm4%s0$_k%^o<-I;0wQly?+c{#sM&j19&fWS2iSQgn8>Oe&7?c?22 zb!ggl+RvT!`uV?jLGh$DAnhn5iEEJa7hxC2sVJisfNQdAnE&FXySq8*(KD(cP|>au zzSytX%9kkv-}2=Z>Yw6b1e@r}sqeB@7-ty}UE{w1&`yva(vA00>euhz?dqqHqDDuARdok%v`Br_DQG;9i%)HqI$bo@+=6Tq%2?I6U%@Icg$R17e zs5iHi1sF892xOngVRij*NNYI{&FijsOi+ULUH*WzB@c@>a3%`8DxF*iq*?MG_Yeb?Nl+|0GfkrUEn=zzP{3rxJq@?N#)S zw)TYn{I{sV*u6A{%O?B^Nd-?>%RzEmc?DS6LB>kiXF;TSDy2YC zP}X)*BX7Cus22BG!`HCTrXbgPrZk{v)k$hwlNQuLVuIj_uywEzg-%5T*i!iH-imZJ z;H@lwxWw;s63bh{V) zLjMG;@9`Go`qzWoNTsZ617%gL{qP?X<;hOChn#$YwEoOp4+>7bxHxOGz=5~trp`3C zc-cfp4Mgwz7+ayP1Gk^#RwbV*l?Vg5@o4@3AbGFI!SGUx3nz8i>o+p9P>??}+1Y6d zYZ@b<@4+sCHwn*ryyeN-;sZYsw(|;lpIxu3ux;Do2PQSA4?)boqnsfrCp}8D)jTNU zu^WOv)YTYz-M@9lwinY>93mmD?yf4Qo5ZRJmthKLTpE6oJ=)x9MA zW$gY7@X3jUxwnwYQjFvpN^!tKjNp2y;x&KLkX@jxsF;F4Wp%UTz|E2&Ekt?ru&hT=#Rh+t^urGPrpNS^j0x$169sOuc z+-LPrdD61Z`96(9)z_Dn@l7#+2&gvz^Z>q6x4OZ*Kzt=uP1J$MZYrI+u2Xeu6{OW?KtOTaT&1w_Rcbg1d!dyNa__#A>mR8DaMe;Yf+u}K` z)13hlsXqSiOY9MX5q~lFqSC5_*iS_lMr!!qgrrC4W^^eAtf-moUL#rYI5Z^p0waD; z_O8!vin@&O*f`FK>)0J1AD*YrAGojRXl_S}A*&ZsxCgBB2YUeDu$e^wPzXdMTz_b8 ztu00L z{?q*`3aJUTSNf#wKP3;dVS`{li_sd2O!RviM^Mlq8t$mA6E z;@VlXW)ejy`cB4petZ$gqPs|R0tQRodE4!rk-F2hjM3ita|t8-mLS$$pyWCLfcl!x zYr)3g*3ad^VgA|!)=8(#Kg%DQK6wTtjtjbI<7j*fe=o|L-8&Uak() z!D7OG_RxRj{P78OOo|mQHO(>8qsdFglOfL}UBwoo3(8@=8}dM3d$cw1f-(ngkmP9b$a4E80Po#AelX5c*VqnljUkp@FJEP^mi&Ce9?JXG*s||8Ux2o@{7pJu$$-@Y*nYNp<7#GK-oo?kyCK&+djVR_ zZ(j5L`d&y#ZAM(&^o3i?nIn(vWCy%%pUKo-YrdkX+!D-wo;`nn9@QkpP>MJIr~C?V z*no6wZNd=2{8(Yu%k?6~v%%Z992n^lqzhtLHthbk_2lqfia1R>X-4h_V1-B5~f(IRjpb0^OyE_DTcL?t8 z?(Q(aU1aa?KmWP6j$CS{pqQeE>F(A2*xL&?ayWS95RSo!*=0dfqG%bFG_hl#FhGKM z-vkp#cSm27tJyY@ZNWMt@}XmKlg5VYXv z&b^0d>L_DeceE#E#oIG_2UF8m4~&N7M(|p%%L>Y0r())@7>a2LyL4(B^SK`QM9iPy zSk_Sh3q4^;Qu)sd@=95JfBbG(P1-LPMv3@U7}OH< zmlk>mj^YqopZTO9*PalQaIzDY&(=HJFHT=NqE?rh^OW9$y92zAnCp$?#%y#G68p1b zx7fX)*}-Ixx7aknX6=5by6zUtz>nJ-k&0WB8U~x0io!>GO2BHKg?#~N>nxMY-Oloz z!pNI}j@Ylcl&Y?JrK_F5 z^9ZCCYcIxR-43g!YfswI_<(|;2HwA<=z|aq+)8UM+1VU}t@1;S-s<77?a@kAh>qLt zrHf|8SF}yY9a>>Z;a2Zt32^L*#%%rh!_)B6JW`E)a^O;n8ov>(#XbL(^IC0677wDi ze|ll(n|XXYN9V{|9uOsF;l`Wjgcswo7+8wLa4)5tx0yH!i0i8}B48rAn>S>eFmj6~ zM~d~k>AkDtC(1vwtG(w_M=~@9oGHyJ;-1sV8j_bY=Z|F#t+1M&r)cn(P*YZ_p(D2; z$Dt$A1HNsylyU1S1Tif5^tU_pDXH+Hvow8bhHoC$x_%N1d*bU&yIswi752#nBr(oK z_;Iq7$?ZP*P{!jgMO$YY|0&Hm>(-p@FHgE|k9JB`%ik~8*KsS34W*)xvRYA_E55q7 z%)T%DETL|8|NEtOH|$Dgs8exap;Uo3$Kl+cj4;BFr(vgk zyBf8gx9pC)^j@6t_`dn%Vu(LXJU@I-beDcLhG?OvNMKW)f$JkJ{;2GO(zO>Xp*zOS z)L}W|QDvZ$j*poVm8#@GF>OVCTyu6W!@UD{NX ziecZSERq%2U=9}$baqRiYM-|UdqVSIA4fF%{eJT)%jy~p9rA~m_t?uHBRzz85VI39 zU^m%T#`b*~GJmgZ;FZYqKv-$!)iz@@4fD%&3mv>j^j2j%e*B{4o=4fBc_`)vt@>EF zV@i*R&zWqzgMzKXxyFa+yvXXohWs()82?FijOSJ!n$vKZ+cPIAb(4 zEUPDZC6>w9b}~Z|kQA0%!PznJJi7ARqmfQsEVCO;z4l94kZZQe5w^;3j)5dEBSYs4 z1C0@X9=_A^w@*1f%tuE=xHAFbg}?eYm2!5U4je@czaGKMygk~R?Zj)TjP`J`ri5mT z3^c%RIMks=uy@juj~up7l6e1c1=IAzqt`1Qk$WaA@?!0WTE@d%0{svFygUt4CcJ(LUs@AxZ~FY71A zhq_Dzwu+{5oU7!kxS4aBtMju|?dy5Cw-;U*e|JlsOMkS|D>mD$ni@&ED9)D>Dj&R? z`fcTJrL(S2PoKG0l^<(4yE`FhYS_=F!eYTBQckVvH3fh?&(ki5JtO%xS*ikGZ)F^ed z$XW7QDEI>{77Ez$hiv1%a#B|@7g_cviQQIE!4-Dd2gZ;Q#do;PZ*sBkBVPOsuISYCE#8U@d=t6k5KS^J;#ql2TT3hHYhiI_4f!*K+Irx8PmPKwj)|F~lTYl`ipQK9Cz zZC%Y*+Fr1tO?N`WWx?0c@W^nmHDF9Tu&_nvG%LMaelJ3dL%0 zU6DOJ&?2;I2esr*;#Oa*S}ZB0aH?4S-0B>BSpRLEGUxW;h{Jl(gru-@e&%#@*|-B+ zgzaobxll%EM<7x!eh;HJfw95CQ;Dl0I${AdY4@fj<{vI-#OU7 z*f3SA$3~Zu8Dy1Y&7Ej~a|ab_Q5??Y{su&qio;I)Jw!T$Rz+5Ru8OcS!3LlAOPBMo z4?1-wLueMmE%1}AU2%97mx9Q9jp;>eN)ka8S%)!*Ch*dl>S%oy)Yg3YnFn&{C1mG~ zoXW$f1vQ`4^W=#v6D4*wP&u++uU{|^IC=7wtXejS#K@KeO=pDeH_YtU&Yd1oC7hKs zxpTeexOarnHiunlXLuT#FfyRKPlBF`oDW?)uibT0)(W2@L%_Q)kKDNaH0bILklrg) zOya_)Q$T}fA+Mv>@^A)+MNDPq+v3V$A8u`)d?5n^0$YNfw$~7H+s_8CH zpY(b(9~&MZ`}dM&ZlcRJIC3|(4RxQkL_Q~)(~YICz^*LoA9^r7STEabl0IM&Z(C0F zzW`a`?z@S-6(oD)BsqQ(ExT=bFseh0ibyh^z^2x7@=C}vi|VyxDJ|yaFHMg8!NzM@ z^npMf9=pjm3wE*AZj|H$Tb;|4sf7}=RcSho7@)Y$2WdDs7#1d8#w4eh%#DAky*FNy zlbdFluL~g@FEJ!Qvm961vtD1rID3enQ}Nx1LO#bqNf`0c%haC1(97 zok$Y$z(q*=Xov^OzUlE@-p)>a9N?Aq^*DM!?-Oi^+Ss5=5v?~?I?51Opd6^-6@Akqon47^z|hva>gy! zIyF1KZW^COvdR6|S0qmBQ*TyKUR}ICyM}+bStJZE_ne&1V|yTsF8jsJls&{<++ah$ zyJ1A7OxJ@Q^2#`)F{%8T4^OE-pq^ByUx9JFAx}Q%)qtfxKfX@EBufLZ0&nX40V~z$ zD}1bb44rOQTNc`ma|u~R>YCFNoD+F`l7BAZ0^t0}Xo`B>2NlDl1zYCmwk2yykn{D^JI1BSKpH)&-+wu;%uC(=5~yR$XwiRCFbikH>G zFVx~O34SZPKpXfB7+$##JyMv zJd!zE&5e^+%tbV@bN9|u4K=1rdVN<*jEhE`AB~pR2yK+?!$!F3O9}x1OuyOgk0y9A zS#q|LA|!Y-Li)It9(eN;iEQIri|em8q(`3;!4r@H0rAFTiKqYKHN+nckC{`)1n43| zH5Dl7F&Rcg9BOQj^-FD^sWQ-?T{^C?oc-o@pg?m+;be-lrxt|+@7&z7kSb?cWikug3z-euoODN(^s} zRPfi`64(8{jUP_uli>K;S(~o*jF5`u?%k2MYItSX=TB@NrNw!||7i}nU1o$I z8^lMFJq)zBQ68kLJ`4#)ff+dFJJ)Th9x)!+(n+NdW(&z(L^fO9d(qmdf2FX}*sd>= z-Nf6k;P^|&xn-#9(4;X=NRuchR7i08sJZyR8ZS(o`T>*1@bRd86%|B>us>y?Ir=l? zwAp6Xps)kJb-Md^4$c|^JT_gw-!hJA+Pe-#pSx=EqDnloT?++=!o%sh)}~;hIo~SJ zu+hGIT#d{=(iDyMzi&|ZJvYU@V2e-Y?U$B^uf_Fy1vn!go(IIwbetU<6p#FfF#7+swPJEJV|G3JNCJ%q2s~3Ci^AD`@eN+ zLgV9&0E!(q&(GtqC{S#ZQ}EAlfdEQq_jq6>_%LB5VZq0N+v>^P4}}WGZg1Clx~1IS zx@}cxmCr7;qYZT8%SjLz?6K`T^y>NlAx#Gw7<~8EUp)Qo;7y?goe5O0X6OWzl$yF7 zDsZ&&Tp;dC1|^?1fPf>baDh(_Z^&m6kK!HX^)*{^p!=&=xJ3s#WEXuhR`$rUy&&^a z=!1CgKdp*RJ9qFablATFt^BJDc$=kyV+4*HD?UiFXRW#*3$Fjji7#kUJRCEsi*(D# z%5ATeX(?%xWcU!FG>Y3)Si1ng5f7i%pnZDe!VoHo!Qs5!&pJsM8rbS2MZ?Gpl|A0TY*zA7K^=IkJ+B^IaHwclVK#ew zxakq;wq0~**tf0gQVy`~+#AM*KgE(KT25rYp_Tq4BEy=lq-v;ZvYaRe@GFV0wM-UB z8gcnt56zUwAuDZ>XDoI|zoQR~WbQt?g-$av83BYG=t%Jg;|eV&J*ja{KmvgA9>ZCV z_l&?(OyO1-BOiOx0x1Yy>sEZU0bw2Bktjd8 zf&DyH_K$x`He-(tF2_c!`OQQ7Jrvw0C)U3ENY*6WtkNa+A?XkIe*+*sZ_hZ3F zujoewO-}ZII>`!)0nu9}h?WNPd~nBz?qj%>cg9J}7we)5KeDuQ0KyR*(t+DlPUx#J0 z9?u~0>}#Hryv=mh7MKFLD9n~hOe$;I@N-eKSIMKWDaEj^1(}Xzu97WeFY+VCPv4+rWe(HDCYLAwe1)?-Vold`C zXp!dJjm@?`xMgU{Z=qshIWd}rMpcRDS(ra6=bU3qiGugDGmdcb+~oIbS>O%jSB$7e z#f)uxUr&qQH_3np90VONucShwF02$DCNnnBLdMwHK+KJ2$HY%ww+bMh$Jm-@Ab+-R z0|r57VR*l;O38WN5SWI60|DG4z))21d)Lv{3fm+c!TK^MRIQf1v9Tu4t!LxJ+LtvL=4>}n9Wj|#d-8fWFYsfg zY~QX{j?iIko34q@ht)-R!Ax#PD56Qj+)iBRCnj9e&%Q&4R@GWsd>G2xRk|M<7*Dxy z{HD4kTm^xBxgt$#heIVlOe@r^*b*|)YAcrgSg-_KBd@egVOI)j9_cjWcB?Q>IM^B!5@%uNW#@T2yR;O5 z4T^5{V79{T{1M6wlCeMe(IE&8L216dv_01_c>3xkz5=|85wr3}@Y7ASRYCxF@2fcL zJA7#=X)X3e0HveNsBmi`+iiwA@g}Zns2R~Jzp3TIC~}E;p=bj3@QH?XszX+!-uYhp z6V9HC+=EKld|4kBXKvb@!+Mh!39V2vdAdB~XmZZ*M{z#+Zya62?#wHsmN|}cZ(&od zlsd}?Wy%(W=(|GqdjZ3@BS#R{f@Wy$Dh^9+MMY$Me0=>dWObQzqs41Qo%czQP87~- zlc~F{(5r)O*yU*zA)1&kSW#MH%(>AW+}!$XVDDl%L?4JoFAU5 z%RKnSWb4QEfe|kQ z4V^1ycxFrKsb1u5cv!7G=y#fS(D+kELqsm#4F*?C+|v? zT6VU^BmK{d*$j97Hq1Hy1z6J*tbFCHe<>?^SEBs^ou#2@5I!NlEIO!i`LB_CO zZAT!z+tWxa3IG;_ku&_5KjEGWVdN+#N33ruiRG6O(w3yXb^n2|aM=WK;B3)x(BMMz zpCph{8W-`vpKr#1Ir8b4@s2o_qtnmRExvdLZpC^i50@k6B^J_~@Bz!j+ z(&Ak$nV&EHxa8MB_xv^NW*Cp-9Zpr3Mi;o?&Pn{oh>M|g3hs;JT<{T{zyeCORl~qj zo2KFNrrp3zsxWZux-Z3a86$_HC&PV1h!NPn3rt&YzRxpsK%B6iXQHko-#vnOcYi&5 zmW6hN325zL`-!;3)nabB(EtJX`O&Xc94=0Qa>%G^ZY$rA5{iHY-=~zu?q!O~_sE&K zPipWml{7E~;r)9%v;D>u{Ij~D*4$DG8awskn@&zbQp~v{j$8WOKS`eEtLv5N|Z4eze#af*BXSM4}lwz`%GqgM8*8G@pGU2I$#pc~(Ys0mJ+jSbeSh9*fX9U5I4x)|^e^;huS?=v8Q$G+O12)l z*#LNjUVIGbXA&r{UOp@^bXMQdDg>DXB^Nm^x~49#F@e-LiVi7zrm9sbZ5+7FeUS_>{=5E`)~@Isltql&_zsT^n%bpjy9H z4*7411%a;>V)NZ6TbT!TC1!9B2ZYU-EkaH$9zsN>^|O&PZE<8{9St)`=mba>$4Q3V z7`1GlQ8&WW7;43}Fy6Mnvok6SgtANF%`0Sm6M6+Fn)ma6O;s-RKzp0e*=g6i{OO=E z2UAAxTk9Br6fh4DJKmlNo}Zr&m{k~8)Mcw{Vfo>74TIk`n9p+$Y-I}IClX~87GV@E z3oZa>klhmeyiRwvI_N-#o$2v9hvyOaiWfRMt&!{D-6F0Pvb$7^E~0Z+zgz7C`oiZu zWh244Ls`7QIGpmmU3>FI2_EMNr;#o3|B1`YJzz>s#y)*ik3tZm+xp)wn~Uc6V|Cft(aaXww^oh$kzTlf2o+j`O9BW_?-7%^DH`HhlxD8D!Y#x zf&R{?(uVon3fDOnPAOG>44zoaU#mdAFDPAp@o&;DdhhGzuB+j zVCV#F=LeX08v1GeaR_y4miq2=zF7DK_}kcyD}TS}w)2`kUy;5g!v8a0JuVMVaH$iC z0<=DuHYz+YB=f>A(hr&mkB!QO)4d63vpL8O>KWFC)Zr)~Kr6ua>W+$gLKEjs^hZ@0APqQ&g5ZfRW_4 z$za2)om^s3btV0NgW@yt9(N(Ih?jJ3^TA?}5*q~kBR-{wy_*hn;}?*tx>QyH7uf9A zE|=D8KMm&kngps}K8}%X6~Q>v`NIzlVx9BH&6|C8JvY6PErmUP!7=hOy=K&;bb~50 z1++MYsxHyAmme7YB}u0;Ar_s0rUIv*RsB?)f+ba==J6@{Ojd_~E1p?70N?7b@tB<7)2wvGce@VRN}$y9 zN#Z^QYn}^5%<(GnCiP-rN&9)5Z{yW93txP#&Jq}3=}ix|2{m4<6*k^?TMhPlzw@NL zyY^hSy1%`fCY5Mwrv)t>x=KE5S%ymk_6!*7h|I)&Dt{DpyOxrKD#sGT8yrl<|NWrI zMDbHIV{WFaB&|)MEY3w=XMEfXcBQ-a#CS@HU!?oV^EjsDyo1(+9aZEk0)R`=r(jT2 z?}4nzK^%RC=2IGwKN6_6Z>Cs~HW1sa)8RKP^wsA=Rh4ldHQ5XQoyqC~(; zZ08hDhT)H((BZ3+dlO6F=ODyRHI`G__W`qF-<1s9;}VTtt?mF)uVZ|Q5xycR4dEWA z;bk9J5aUI*lpHaz}z?0U|kYD5&!6-YMBtvIGKZ@YJy*f=mEN{?ta zD;*Fd+U_QhokJjCfge*ua{V}_f(i6x!g*39^{)+c-wI$8QQ_=V%j-|5N>)Ju2~Ue~ zw_}P?b`lc}?YS?C-Sncy{;=aiaJDQQVMk?mstd?y{4?g_fQAJz+?tDHw zU=)*^=iSJ8uWd|-V$975#0jC)-@ zifhtX$T_WzaFuVSzZ#c@3y9{b+$AHk6n0v45$*Qv?@$z<(r){m4$BL!XbGm@$J%jo zHcoO`7%APBqLsaY-6c#bNG*%@?+a=U{%mm+h`1z_YS8VSf zIwVIhyN30|a&y@8Hn<{g1Qr1esJrvnTzw9E_rhXNEo<}0=>G|gNzby@~hkEAPczSx&?AY_8^#LLK>KrY;4PyTF>Vq{?#l5fWfXsiR8^jARZg_7x4M`un z;g_LzHMfN&5CIVi;8iUtzUFXFfY<>?MCa34Sao%q&TfTj!WoiL?$W(q@Hex08{6>A z+_FtkqEE^=TDm?_H|hH2zH*uw!*C8cSM@sAy@vl*IjGV$DetW;DR2-;fibZN2&_g? zqoFXfrm|SYRDE})mf(=Eluy~@-e?C6xPD>b?|&()nzFzo{%9t^>!P=fpx?TWzWZZ& z=1;x-h?H4?^8o@;%CC4zRS_X!_EZ4N=f@5_8I)(ILS>yF>jEcQ4(@f6$FS+YOG%7V z=Zmc`qA0;*$I#I4z0D%(y@I0PF!C?!Blf9ke_)FLk#`oiE8#Zo?}S|7_pY9nkZH7E zzegq6ria*sXdB))W$nz5t3OgvxQ^=f7$BiTNqmt{p8Gn>DlW@lm(5_ucLf!W9|j2w zCX~!_2@@(_bgPkF9e+LOks11Voj+7ASM9h44r+GAaeI+{nI6n&KWVl{bnFa2r5F@+;*x7-3-HPd_k0zr0C&C5n0izf3no7Cf= zEJJZ$6PWW+2}pW8>QBxj<@_73cTl4zm1l|FxdV$CDyiuz{z!as8eyey3U;*)r!bwl z6}YLm!B@6`#Xfo^(kt^)5GDtZ++3BT6!M6BUEjVjpTcf)EvxwMqeRdFg;ZEDt(%^! z?<|k6oaOC4EiRi5F}oZab(hQcBQ*fb+qt*3_L#B5rymm=N4NQe7 ziM<|rmyQ+ddE$c@_Kowp;l)#-PPhZR4>~*jC6%6ynr;t27Ftz#{_e6W=VjKb zkGejtk^AqwnJJOk2M!2my@CQ(KQ2`rkBapyW993XF>8c9>ez9ymf*fkQ42a&T^LS` zk%67AJ~^bp(bzJv2nx;?F25@*fAP-sD<`er-aqtt;K$_DplmJx74!qdnJ*zq;%sZ& zl&%VVvrlf{Llc$5!9wr^#>{ZS!N>`jUqZe+Tb9z2i8(HiigB>dXeM*u7$@F+Pt7Q8 zq?#EQ=|HzJf4I7Uqw0ooZpAD~>4xBJmmxHqN1E1JC59g@wJBHmUfAI!aKAIqWm7L? zb^H};E~2m;!$xUwu0G@V%eTjHKa=62VrOYUz1kjFtY_DC>TIn!4(8tRW8BXMrAxwH zIzIEChf0zUtY67^tBvAEn^W%tzLweWh9v3{FW==IW~Ze_N1@h;q^Awo;rPFKu=oBM@~6kA zQm%iM8n2UAI#+IWphb=>EB?&+1LFkhJGi~&I2IgqkK(JJ`T9nFa2D~}w0ca^1w#97Dsx+ZH~_qOF)r0OT9)(w;a;|5vy2p=-iQ6g&(Sp*n%>0H-LY5ejC#8vJq|BC}%k6_(Maf&ZwqDg2li2Vh z!+?r@QG3l?g1m9D`Vd zBbU4mKG^5JnCYJKsjJgUUEg9WvJuhQMlIYs8q_h&!CGBva%1SZCSi%|6POy-zi>BY z;s6(gJYv{~CfKaZgeuhXR78Uh=0BBqz}@cuwsM{t;d=R3Y0yNhyeA7TV0qfzOC9FJ zC0nTxc7khxb`i9ef;4M}Sf7ym*_LYJAFNJnrBb(to-U`IKPdhapPYSjIwz+mDCU!8 zPL}#6sk#9{lVS4;YAOsEN(VV?0CBVF5Bt=POPh8RXQ-xBpxS#4*h&KJPWgg~^FFkM z*_7_))>5KebS6wO5riaS1+^I4{3My*}V+inA=IBUa%{B6&i8*l?pMu$T=b)G}I zV&-p;PTa*9GzYXG&U$8x_09tW#OuI$s|!cyjN*A88^?rO)oC zDmM?``Ek8-_wW<&-YyIFNW;J%Zi_s*jXVAG7bd@+2`3Oy^WCY}cm5wf-#-apk}N6| z3;iIT0DBpo7crSh(PLm709NXa)iY-t#^~aSnd1QIU<{^@^~qQChd(1Ii~B-#$M7fmO^Y=&It?w*}h!Or5$&Me#(}<|i)iZ{O?K zVEUIatG@(r8fPWk%#{w(htejZHJS8}Nf;0FzxY66c?$n`G> zC!gxTuPznNSTTt)sUW2iudo4;MZGI&TH!GFhYuCNC74dJaKKxjWTX=miH$TfU4tM3 z@;V~&c|bBj6vYBm!~cDjR0nRu0d1C#_T50?W|89=gD&9r4a#7yR-Qzo_m|T+MPfAN0eoRROsxlHLXZnOk9R_z1BF5bD@XA`g@_(3KAOZ9f6HiVM#?Xyw68Vxbq zD`SZQD?Hw$x^3U{+XHk}H`Ub-ID#1Yx{+{0ub3GymU3q;0nP`XrAVAR&P{!&-|{V9 z3z!ssmj82H^bc3-cOWj>LXPIWq5p>DhbJGUFpv{{#->`5u!to3?qJF-`)G1re$BQ{ z=Y&7x!3_Q~&)(u-3#0mw$X_-tc@j>w5em@uArdnmWd?}iuTg1LZHI^`B$~B=Uvi$X zRs_Ev9V{p6(yRNh&g2Wpvku_QU5M?q$ABxaXCH7!Y~?E-;Sqhi!~k$9m)mZiC`!M1TK z37xl-Cj&Cf(_Ece0y$KE&FBf+x)^FUVNl7g2vGT|&)I(+#AKR--=9L%KQYUYOs$Xo%q{MkQ}~R4@pNjud-XhNAyUl6#4d-1dD zn0ox*XeQy;=BnL~7zUVaqtcG-)V;<9Ba#yJYL*Q$?$gvY;){Dtw(#jDr$9s#2$vdD zi~JKVtylw$fTWzQLxW4L0-E7>6Yi|C_me>;YP*=0DpCe@bpOgBYPJt*#m$fEys_NE zcpP@SZb#_wu4lWiMFg(|^XpP^z?RCK_n5bdW7;sR5h|{8i$&P2G}s-5b@3!hx3i*L zFYL=Qu>s*b`K+k>0{A_z%D~}p2Rsi#%@_Q0|ga-ftAA=rizzC*tr7o%rQR)<8PkM$^*b-J;uZwZ zrdq4Q9V{nj`KwZ@9h|XGczYekkIITRsA=)6Y4-og`>4AQ=TCiA+tc|qziQp4l>Y^z zGM&7VnYn!(xL6>w=bRSj%Vfk=MJpPw)gH7gHT5UU3of%UE@W};8v*v1o#RXcD(BDp z&2}>FyngJ7%RJms7issHb$Y!Z&3jI!d!t3tMtN58^a%sFYs&o2pTv^v_+)MkK4Mty zD5MeAd;xO>Lxi;EPw#PH!5bz-Iii!KC-pwee2CkcuF3l^(x{N5?P|vBj=k%cKKTee zlsZ?)fsnlKRL%*#cRMIC@UI;G33l*JDvi>7oQcwi(64(U>;=z%VE2D|$r^aLULdX0AadiAbiP4=f5?(1XJms>=(c?Qk50rk*+9yQK6!ehAhG2m3I zR{(JGcKYacwhl6^IvbN^d7B;Oeo)pEBwS0cWnbQmDJnOFjfFdK34U0=9RS z2zmvCer7Pv#oDIHZ9#qvSRzK20}EHfGKBq!3}Lqno7nJeYh&56ZckqQoy&8$Bcu<@ zG7V0Jf6mV!7mC0Jd@c^?Nh@V%9YhibR_>%K6=|*xjd29yCxLl~58?cIX3D z65Og`D}%~|Sdo@`uU@yMylmw}Ss zzNKHhiXl52O9Hoi>A-YLqBm{3u>*YSIA%RlTzD8do2@N^i4WDs{QMEv!IM2^0HBF! z$}sEJw!SlXumq@$I!X7GVYmh6=*0xA&l8G|-KOCs(KAU@tMAGkp|2c*7gdnjJqHX@ zLPDAR#$#kUN}9AW7z9GPq9GIzFn#A^yeLX|~c`cM%zRREz3x%=5fbdEI! z__FWXJ*5~UgK5NYl%EhN_YO(?T3vxS>HO1_AeXw>rqMn zClyf$5#HWu6EW&QD%l>K9^M}3oTqPL2S4J(9Jh2&g!4h$TC}9O5DW+Hc19?;ZRRR> zpayPq-AyhK=2T%mzTR+3Dc76TK)jNyf9VRc$^V>GFwq4KrGi6pQ{9W`m}2|G2e;ye zP2++1-x&}eWEtiV5gGR6mgP>gim3j}4gT@U>dpVj0A|h7KmS6!|71c{aZ*s~ZP#JV z@{pQ_UKK3ivti{kVhu!EM1eVh<<||w84-$B*v%d$os*sSr`R|ggF6B-9d))Pi#>X( z20#9dy87XynfQR7$G}HPMCL6eb7*;2FWXbGju{j>4EU8jBrYcd18iQ8=czpM8h?9C z{a-5O$MwB<|5h55%@FnFAk;`67Npzg8V% zzA9P^))Tr;wqEn4Df+Tz0nmDW+WW_=sPY~q!=LVnJ;_JenAp z7Ufn7h32&-eX#6Z3zuwv&tFcko$A&osHagY4DB(WepJA&1Xdj^zpaQt(@|#<`Eg#z z5&S18x0l(Ow7%D-g#N=V#9?pZ=W`JBQpF}R`afBK{ps^!mnO9AkE6H^K*zPOp`gEy z#}5ua_19Wlw*bhU!`A>rra zr6$)Vec&d?&d;La8@z9GK!q7shw;a8)c+6?W&2eIJ>KC&gEe}sQ~C%Kh7NufEnZR? zahk2c)cq=!#OU3qXJgMK;rl%MD3@`7xc)rf)g({uow_+3FuG_iao<9bo1$aRNbdP^ zg$o#sNWi7t#Skgk#=)uBCr~TGo zBA~f*)GT`mKrW;pox9_?w~yB?1`vvWa*7UsxhO6Eyya5LQ-2yc?J@b6jYv_9?Vk`u z{X;=avNN-wSIhK?!GKi$T&iYTCkFU{gUb}O$qWA}P&1*!d=5)W<-hcls0TXzx!|np z(%Bm5GQZEyRD*DD+Y{%G?k6f(Md)G6T2Wd=>woqUuY{|{jywLtFEpAiHR|r}bXIle zZgdA)v$yLwuvU6=RiP&{=UH1`>KFO`CA5EbvTVL5#8Y;0VxI;xz4gysT;%uiekPuS z2i|=yh?c}_3~aB4J5TN?45Jgjm=&)&Q11Ywqg^F!zn%aNr0;&Jwgg_U8WsQozc)U!V* zKWh=srvkrQw&c-2RM89g)Sd6r=Ar3V|8SC*$>{NJ1QPZCdW&yXCJ=#vGr7T+cEXy~ zIdjmhNG%l27S2!ca?EubSyEJIvU;v4iyp)wCD){sh0#gX&S%k&@=R9-R<6G_69W&y z_7$B5-nG(0m*PD?ap_}w}KP^<>75X{w>4a z=^ip$ks&Rv5qBc<`$Lvl{8eS73yF5V1E9+Iu>)~PuQxa6*HB@h)VWUJE=xVYxlRmQ zTEN-1vT)!O~o0 zF{r|PT}Q|-gn81bxE|04<6BcKhm|E#)7*z0Pd3Ydo=;-Fv}JcTfmzeR@;k=DOhHV<|8q*eVp_hG0iyskLky~Trz>D5zWHL^{h^h zD_b_R-b_3H+54pm6cDIOnK_Qzel}VtwJ=2)IXoN1=9D*#hzyQt+<0ww zmilc^m@yjc5VY_zA~H*G!yuUb6vf+`Tcf7a!YUk8N)7Jn}TI~a5LtkXbhLvYcTYu^hCrei4}s0_f_943nJaq#@UTzPPwEjrvNv` zqV9z}`6@ea4a7sYb(Zg9faCBQ@JiCik=1@kX6`{}EB2su6?^S8YwG+g)LVxp6^}Uk_wDYu zhdv|0D1w_jg*H=S?+x9cGz+42fah9!nmjz6A0bQAsKV5P7vbZmlYelCc^?%t$8Zyn zCiW_Fu$l3ML_^2~GT$N^5dem@%C{rWk=#2dO_v5xc#^IR7+1#iAn*1a5fP{W*;ewj zfg&UBI+Dl@3=$^khQRXe3z3^P%uM_%CT9DQ`SCzz&F#AYCVF#I*!91ql4UL|STjHLFf?3)IQ8AP z*;g3&#a+q2Z%wz7BC}#s#=OA3Qe$YzdU2VgA;T^?K*H@J^XJ*Vz-FyS1pIvW>vBBg zU_2g6dvKC7LGWQGt!Xr{f;&6@8!aUX+pQl0hG*G+Yk&Y$T(?E&bvW%6;&I$G4b}TA zOrsg~xBaPnE=BPV=Q*Fs0;B;a|2{n$Gs!0n)TyFzkP)otbhS7%}IX0>NE_yK8WF*ARlcy9ald1{!yF?$^0_bC_QJ86d-R{9IwU)Ljlrs*735>>(a|Gbm7 zG)asnd_nP>fTl1ONTp02W|vaW3i}k+p%`bQ+JH;Y`D{h?g3+V!&L4kc~YdPRaVhQ9JgIIBKZY&XC{WseSKk?6u?R>{EQKgcx`*7#I^dn<+Gk z+DZ1bo;FX6N5ZxI?5hGf{gXDYeWJbZyC<#z>xXvKn}}FM)Z8;|W^{Jat8y5V)3xEN z!;(O24r-gv)H6lTEjz{^D8zBQZtaYBGMB=?>i7I?bHfNG*4G<8SjsrF~6K^n0goyI5zof!E!>$e# zp86I3#;Ei%g4;ibI}unLn48p~F@#65KVHfI$~VBlCadrEE2TZ)<@TS`oES>v;da!h zqL4OqVS5M7?dJ_a9=E+#3qtGIga!YpI;_7A5Vn5uOzPGd;Ogp-HU&&Z7&kc)8CvGY zu2W4I0jth!C8K~xq+z~X?2ZJrqKjNDq~hSfXUBFr`a=bAiCK~a`x`%3ruY3nCn!Me zn}dlir`@>n($PW6ncVklP`~7#x3`()JG(xq7L}#`aKblhHKEvz&H=cEy|nqjT^_9{ zpu;lG7|5O2?bet^NA_~sXdYUxit@F!;t#7NzPsRpF88jTpOSkACmsCvyS&0250BY| z>4Y(HMo=GJUPFNhf1CxFUtig~w3dTy5b5WKhy`0viCbp8kOn@!BT+bO5%vfJ{8o_! z6`@gGmI>=EpJ&wpgU6CR*aw7DelhV0ZXfuJh>*y(F~zV$8*FKl2f^$}+uOu4o6(l* zlq1l~F=xpAaxYNa3W&9bHQY999D4?$8@99u5_|t_=NgGQETc6rDwNt=5wB5m( zX&XbyC_PSS0`B)#FeeLUW!wX|YrSC|UgM$r`!eS&cb!nxW>nqH=>7M|;ins{ClD*( zo;!itDJ7rKHg2`<|2NeKH~}-iE{^3sSs&K4jQ|BgpojipiALA#+989F`jwK*YlC^1 ze|zw}a@_nZl6oL~maCG{!?8sRF)Ozr(uPj3S7QVq|gtu z)wVXcCx~g0Qm%iy+fdonboT1o<`eRr$EefCJV74@$?%Iv5a})3gOj?NXZ+y%bKuEX zQd%N9O|&X6Qgql4?UGM)54Y40`oWf70xzK|;?T?|WVt8kL5qhqd9TCHJt5_{5Qu}; z{D2+ScEQ6dm}-&9L^=2#^c~yX1$kN!1#Xqx%0bV!eLs4p#)?l##o;jnxie-8(eY>| z?ID{oILQWdSC)Wxif09)u$hmUd3XE`nL8Jbl@66-Sz}k?iB|QV#w9q}(`yKn1Y?8< zhe_eR^z=btL}%JWEISXk0f7 zjkc#*3RQeO@g{VaYlZ6R=*Leueyxg5=x!}b9=PrY!$#hXCzmEC%W4n4@#V5dq-Gwi z4Z$N=Qln>ZH=&6u9nmux%KNNNset<0dsheBn-bZF?7`8=t- zkbFHIiSgx)&C_6!RyXu=y{xv|W!TJfQNhT7Uf72BE7 z4pGdY^7nT-tW952#&u${iiN~XwX8i2d#QH zxLn+pCAAV32n%c`QtKuw#LBh*(`ekeGi5kCn7`?0TB0 zWLE#9LdhujEi|SH*n?%~*V;bU6f3QE;fEPuyRqVu3sd8}63yjccPX=ra2TOU1Y|UQ zF1RuHhn>jwX}d6w6SxSQ){8prjS?*pUtd2IacMDRP|nax(SkSr4A^0;21;)|o2gve z1gN70zS}=pkgxwJAlYq~p=gm?w+99P)@J4d!HdY(Td%$pd|EFPL8caP%Rm7d1{^zY zgTs`IQejqVdMpznEQ{*eQ_G!^n~}Xv8JtJW!l5t`g8Ev#NXE-3R;@XX!_n$1vVz`% zY=#0&FvgzCR;8;pgFFaUokZM48pY6*3+X|Ir-10lCT5=2V;3~~sYo$pKB_(5B2W7> z;YpUuLR<}d)?2G%gppKYB*7%&pqCJq$!qDZ#0(?P!pmE@8;BK0I1>ZGCyE#?-Mhi4 zHaL>nh>d$^bRv_9k&ACl&7!w4Gdro8pz2EWU#KbQjg}8fj9oPr_0A-W>6}kmd>9`d zc@x_d%o*7*$wyu$V=407`&PgN;3)UQ{H&}I_#*@g8$Xespd5tmO1%*mmVYA=j)IuO zmOXv$;Hpwe6VmxR8ndB)0eV$E#1+epI{Va9&pwZ@H1j&FA>v}Tzvi(tQPZYDn+jj? z3vF=2j&^)}k!I$QFb)4gb=Vuj33@Bho{f$C%{1JAk#7wRQgP#Klt`LtpTSw^8f*2- zNS2qI)J0P1x3tP-?!0j&`kDkhoQvvM!M~5k9F}e*kww~^dF!Bysi2N__2s?~t?MNZ zYrKKZy}SYW2QR;%S#63tKOmiCfUl(YN6st6^*3m$cMb%=au5DqKOp$b5(Uflt(V*_ zywfIiE?s8sh|LIcEp-W*>rLEFa~cMx7|cpEnaAsHUv1&+&?DL;mfKpE5w(slB7rIQ zO0Q|=cGiJC*v9kF^Mz3kFMWGoMVv!q^~Gw|iF8aE2EUvojq65=)Hcri5XWUl==Wt`mmM^5 z>$Pdc2y?(wS~J!3aOt=0vTAVMY!dLYbimiyE8oN^qrQ;&BUa?G3QF%6T&h@9a8KC4Tcx~^2KsbZSJOHwG{89 z@}ceP+nA9FWkk@08M3VCcOF+&NeCk$@l$0)ZAn)Au)eyejh$g}_QL5%NhKGX5C|Ea zAl*v;sZHI9=hNPo-|zh3bH{%w{>GG(Z+Mf$^XV5>j^b}`Lq7qg?o~e%?|eB)??uxe zH>+I52Grkj$^O7fBz1pZqP8R6S3f+YIg+eRd; zB*uB{B7MSSLWPOf1i|~PRY5y?CLtS{!*G+xUtU1kxsmye+{?FKZ=Gu0P@U`BF1QY- zf#=J|v_e05%`@?Aygqqr-D6v#7u81<)^KCI=$F)ZdXCdVe6@BZJ;?qPdct*bl(=|) zcaq)nPBp$B8!m)2U9CS`d3kBCTej|{7nIWZL3T@PMJqVXcfEak*ln%38?K!pyv!X1 z{mGR9(t4Z;HmwwZo-+pE2LC2?e)V*seUR6j;d^J?6QayJX?0kc=q_cvo5>Cu;Bmbr zaGkf7e*;@(2MWR55fKdas{%E-lVk*n@h8YG>XV6g ziAb6#3Ud;FfSM2X8lEX0$|U{~WIw!U1xfEumz0tnikO<_$%ip9$6l!@2Rsu9vGg01 z_BpwUqu;G^m5#o5?)Q|PSyS|*$37CRU$*h_lXSVrP1QFFfU+~)#>3rP)%SXXVaD(> zxv1L=_Y{vZ2`@I0eY??e!M46A6eJ+KyOeflp4yEx6*$wJ^x7n`qOQQ0CDr zWG6U~^RdmbjfLy@W8EzKh$_y{CIq=hKKD)WKr`8i^C>V51IVm*g8Zo~va?He!fGr} zGu=H`w`qogm};qbJMC=y%_u{fI>C%MTu2B)^_#RiIY9JtuVqIY4a2zgm}hjW z>5hq*P$mJ1Kyo!^#s^?aij^ZPbLAQJpJs;2(e3clk^cn6QlzjoAB5Y%p)$OeQrd>r z3F&xeT~hQGDr^~>DS%+%P%HWh4H<6^^bFr{2+^a{AsN&B(T7LI48>L9uSGabvOsBT zpCT}&{gkC5sAkn@CAq(4o!SHvis~pg6yvIsemvi1Y)XD&&>1i}x;sLeywo-z<1w-G zFZ+~LUJ^bgw_wp7{0f8j&+hl-bnAX6U(aO+{Ge_psWzkhAyOtDXf3+DwJTCO^d*@F zu`5MPX@%SM=G9g0aEZ2}CKT;6=-l9P@#^a8h`LhrsI_a&h%x#j@G5ff=2Na0DyUKD zI}qZn>MGm)-YBQaiaz{MvI{HwdMD*G90*45l*w;>s=19kj1n|^3)K=+VcIsK3+WVI ztDymjsQ_o?Av0-f|9UmT7wCW1%H^hIc`-v3ROqJ`Ywc>fw|x4uB(80}`+T@F!D|8@ zn0mR`Tr{tFq-T z@s;%0TA~`4t($7p-IY&Yt0wZ4Pp9N8@1O6-)RqLL?G5j?9?;L0YOWX5u(#e#Db%bN zX>SfGw+$q-YH#+l8i%d-Q@O15Q#Cjqs`Wa2PrUcc-XgiH;Oy!pvGB;^4;FhDZI3?B zs4YlM>cvF)bc5mQ)pi~}>GkIXtldlZL8~xBAuc7=%P=mRr|?JT!ld}G;I?HMc1nKX z2r0t^VTVIR@Kbr!t>;=WRsH!0uM-jUb>^q@Xg5Jc{ilS^Fvfm%6Cx z4cfjaugxnJIBLv1tiI7UuypzaAD zJT6lWTF)Gmpk$-jc~B~u_#qIA^PObzGpVP_+!D`F2! z*`~!-!udSNz~R`EZG{8lK8l3fSmGo0Zr;M@x?GU0tKa}@TvO$Z#WlVY9(Uc(5mqeU zFibJ|WK!<(#DSU!QjcMTvoIQX7k%NTw_J(hEpE*N^Rhabqty?4irvCU(~*O1NOHG_ zgKpEQ?!R2{{%xye@SKs(^*S8MTWl>88D&kv4jQ;m4iV0cjHn{28nMc2L;-bx@r{xd z5?r<<6H<%u$JqM8_#>kyUmO;0UJd5kMs-9v_}#_b2UQh-UzJ7cI)u7^AH#c8`fSH? zOtDRJ6-cykAhDdfDhUa3og{p-En=SWEj3O&BQ|gNe1@I$A$OBAEfqcE@{m;BlON78 zYZ(~V=iQ(Yg$N23n@|@^#O&tg&`gjKp|blV_pee7rxr z(NC3W?#g%i=k+oeD)sl9Hk9t9ii0Sz`j;o-#X)W`4jIuu7$RI7&SVyTJK?r8k+=YP zCYRYAYU&zsJ31hry`7tC`7YBdAW_RTSQ~k%<8$*>f@LAyzX|Qj2X)W<080%#audGF zN=^xF5S!>lCezw!PycTgAS~U+&oGbZ{8*L~zYKbKXt8`*>U3K3!0LYN2H8(3{kQ+F z0$MpiLC2oS6M~Ci>->3$c=L^Y-E{0n3jRnB?d!QSF8o;wWXhN)pn=V2a!`9boidl* z7HVVZ`DK~clBinnMZTfh$oG^9IqV_X8H4zVFxu?jPW1M@(#-P~{A!G$>3avPtu?I+ zveNGwR{NL>sHtPQ1J7H=wx-8f4{ak8Mjb>T2e8(+V2I9nQ8+Km!w~db`=&n=?bHhc zuZj!0^M=pvR$Ikodv?xs>)3f;^LWne8zq*M_A3KdQKlsec1z@6^e?z8^vWf`-xHy(-hYyXuY~OAW2tL=foStC6X!B-(-q*D4gCbpYwP=zx*?>W5`nK_hOyYS) z2=zrcQaj3MskP)zc$madEpd*O2gd0cipE^pX6F`tn-`c~8*k*TmSyTI&LN%EG1zH`cqb&#B~QwjF1K?szDQ!n}Vhce2*C5*dF=9n27cPq`5sI zu759@g`xz#0`3ka@Of`kK+^Qc?%`tJD}}T96m6&R=xvVJ-OuscI*)q9T*tB7GEAc{ zjSCmADqAUH9D_;a12PX7gtG6V78*J#-NVgu;}1%yst;mLOpjD&qAns0cPnePU_uB}F@_P7(DRBkl$xQX7}C_PZrw!F2M?jmU;sO|SqDC)&I{}6rgu7d_0gOYpa zih2Krubz+hDrjU>Qm}R~!lJ@}b0-Dn?HgP0dOyA_?prn>FZnZ>99wym`KklMdiEaD zyHnQO>-ey3C)*720mw*qA$w_@sxEc>ui9Ow;Gvg)^dA@K!peWzy*j5 z(=W-{l&em+GK0&rTgHIv?8ReZ!C!0zcyNcE!OJr5&uVale1w6h8Ocb#`W_%4Y zE#?qo-P+Z4FhdDQA@C5`x6|TSfpikKdG7dPIHnRef7Xgy=#5tE@r{`at)tc>SWM$S zMk1;P7fm-_IFelzMjBO0|CY>-!bS!oY~R_AM;DHwpZs5^L9c_lbt(02($9=L*ot%F&j8bY z{d>tprTIW~@P2Azgsyc8+IY75++nTd9v}JhmF3MeM)=SP&f#UU=+L)K1H24;q2xYC z6`<46zR@;G#(m`R*gwn8jmb=&A0R8Z_C`tm#E>@t<$}-UN>eGD zAAb?cW1s~H(w{;V$qaRWHF7WxppiR`GsrYp7gDu6`hU(#08$rHI2f#~1_ti=Q1t%T9pndJi_l7y;ecsac_UU zwID&(I_gAk3K}O7{M$IVJc{_8OYxC@#qRlv5BPir7=nnuLxAY*E^rJ+{%OJ^Vm`|Q zZA3RDW`k)IigOTC75!kg(kn7Z`30>};Da9-W3 z7&2IJ{L)W6EKDr3lifhOV5$o&w<>6zG4LEn_J)#s7(SS3nYI7#@PIFvlAUI4lBo3KkR=86R6Ge)v~`CHaY+V2oa)>DDoE zo1?qa8d~OVjS$pbP?b`v+i^iOUXhqwRzPZNpod#-HE4{AN=SbC`ZYNR;zyOk%fLOiLgtr`*pr7e_Jnt+&%-e)3e8!=9NE3vN%H+2+Xzp0i zp8_)sJgCn2J+YWLQHA3RECtIADd_69|i1Fib*1qxGiE6gYZc_8NV=V zoJXp`5smy-k8_NiCZUw+Is1s96Jz+Xzp!JoQciV}I+2}C^XGmi6Y>s0%KI_)$?$P) zXd6JRuu&+6sK^1{p=4yW4ONz`w=2e3`}2-@%{*&Cq61v+lgLu6n8)nxRivI*VplRS zXhYvH;>x1(n2-K`wqw>6QL7p_VfYgz?=aDxlf$JgY8Nll$xO=`XAF0|My?QxqkpaB zbb(4#V84K5gg1h>{nX z(tU_*l+_Mi4*3W5NXHP2OxoSU^ch)*oq3N$lCtk7Qexv<#gf2e{+gki@!dx5g~LQq z*+3qV8kd#5hoD=Hqt52r1JNN=W1>B;K;0ik*UB}Ph1Wvl5f00hByL@RRakiRIIRit zTe-j;J?ZPBbKjcOUKtg9^e+@%0jhgPeBPnt_NH{-*kJ0t$}eVDXu;7SE9E#%GnMv3 zu#0H^MNLFuX@gMmcTKI@-6cCUhBoN-+vXKRSv3>trD!NUI`LKANAnF#nizO&gv}Kk zQC<>!45k_*#vP!2N3ya9TOzjVm*6t^)MMn0l+Sf+?*M(TaIRKwWgDAt>`expBm+o1 zB~!OeDmZNR{0sD84!%La>T&kp5O1zyTv%|TM4|?dfLhi zDneL4rc=iVQLcRw)1Y|>u0Jco2%>}X(3QS1>fQui^<;7@D!?W$P8;T3{;?q5PBj_? z^CB91#x9;|2AW<is22KFdAu1uv(~Vcrk0Zi`tV+NQCeE5 zy1gZ``Wrj4CQmX+@wAIVjD2}y&*KkemDYvlO7_d5Ukl>u?N@#3?N5E`-A{kj+wR8H z+up|1yKYuG-wt4(o=q36#V2ax2)b_?+8hR!1t}KtLf~Wz+?0>l=lw4EX`j`oW!)f_ z7vJ@wod_}+iN}RJc-#TQ`wO+0K&BOe+$4fXQ$TJq2`D8ZcR!AOeQXGl!uaVkD6uz@t09(20AKh)EYYe)ndTrW)>JiWTRwUfZGYRb^E zv?k!0x^IpYPV}mFoDef<6C=&M5I_g^hf67g4f`W*$1UF<)tzG`l|C8TYpRS0ch71k z+2M+JUu#pF^D=zj5YjP4V>T4TRmF6uLViad6x0PpZzD%RuK04#Z}^HNNv}kJxz6me zZGV#kQ&$+dS)?Ag3vwjHns?MmwDFsKXN4U}l3LMBXd+`Y!jEs*ZgU_7GuS2$txFmG zWm+g=%5?B=%73^Z`u0B9mBE;_IbD~i6T!-ui*!BffK5jJ%XVZr>X1vf2`-@2yBW0j zhx_>stO#gE`zL89Cp-3<@3Q4QtQ2My<|%*43#D)OopDJf4h>!(1j1pQVs;TNS@+5G z4w4N#+DYQ!C9OE-?ZUt}cyN6_Xy>~&$D4dri7^~SI(nl*QO=>+LBPS)A{_k+J?$IW zUWu{CT*sGX4RwURjLMCr?Z-`tSRN}NA-r<7Ip}`&8CnfCt^QF_^R1G{OF&qOi(#e_ zmj|$I%-qsy0U&Te&@#p-!y~SY2J+;E{+IK#9;O+UB9v<~R<*PY*Bn}uYJ!d2+)@v1 zlWkS^s|T=x4U}K7v_$L50E;;0kuc-5Ek#1Q-bmD`PUdHlr8*Fn{pU@>kFiCf^)z#= zUYShl`yTy2h;NMcx+IQ`kNQAx1E_vI_}7~-n0n6pppcldt>Fe=jqz{HPHZojl^65< z(U!YBjgs(3R*F6I20L~ZL%`wwSU|BMU8TX5UABz)mc-B*6XVxK>-{G}6uJ?`^Y^Ar zCpEDUpl!S$ntB z)88^Y?@UNsHlow%=9LYSzeF&pR9odxnaDYctWLEqt7?3H=1l-cn{|1*-EO#?QFj6A zpUk(LS`oefqNpPS?waOMbxi4hP-aoc-r?oHzbuQXVpU#$`1^LTi5I_Ngn*B_f}f9$ zKVbMQaBDEhB!cX@o9G#wYSrq3!3IcQ0830*{Cgcm%zm6xc!ZCL!)ecew&rXD(8RuP zJ9Bj?ne{f2FNYuw>K4HFrd8E1;x;rOsR1|E z#~6y>>n=+P7d-)j!E&`xs%+1&TR}4N%!(VWJO2Zif13j0$~fr9B3$db{7zIJZ#UX! z+M&f1UI-5nCjSwk-gfh)@kkngU0R%S9J8Py6x!6NT-?-!{o z-gDZ^*`BYD`g%oM7}NWmEGG(9&DGUp%j7uBo2EY|OoXZJSLUx2 zz*x6L+I9bLaHMn;19Nat-2h)2(ZfE2_x5y57dW}2yuk9GAK~=mEu3sbbm2UT1VSS# zFKudOg!|EJz{0y!BB)ntfen;*novTR_**zuRO180fSm~}UhQ1wfv+|ZV`nst7O>Qb zg8{hSrFHUG8a)h=^APa8Vfyc%vLG<(^iz{vHn{!1|dn@lox zz*m~N!fIbwW^_Bn8Ajup^zAF0sW+?L-$-#Dmfcr? z4F!>|eIZKK-MY&YyL*nrEahXWs=S@x&v8tqe=Qwmcs7JOwU}S^8V3UzoL@Nb@bOUX zGG@5Mt+V3w7X2jAVMeC4<7RCiakAjP0@St6rtNI|ko-8pg=GWqQIfVl-KrK5P5(+2 zRr%a2>JoyYV6CSO6Omq-;Kx(btqimFQjc;Xo1-e zYXZ<=Ecdm0t%io|KsRf%LL>M4cXYoXRY!tQ*=@OMfZwxo$7O1+~2D=E2ekME^>tW}Ml(PsHbyEqCy-I4F zx_JOE5Y;)36+HrprYB}loCBs|_IlZV59E+V0~`>#y*lBte%yV2GSOyt%PU}+Mz{(` zfk{rHWiWl2Jv7=Yy19Cw*m`)jC@5x%nDp#0;)iZdO;H-lR&A`O#NQzfHn`ixCXB2Z zpl>72w?tpep3E5YcMZ7uFwZWxD(mn6u99)NR@5gnlrq5MTq@uk%9`K#I$Y!Gej7AT zrkG5Mzq0Y9H_fX@^D@e?b8ja72RZuF{s;@q*^v1m>v}|Nrc3@zG7;eK>i^;GkV^2_ zv&tjB)p8lA;&z55qa~kpF^Xt^K?X4UByOF-RDN?-V9;O5$h8=@?arT5{a*q{Iqk2& zx!Wa8rzJ(n>M$jERyWNDo%Vr$)y>|~WJ?xc0%E$`T%u-5@rMY_i z7niFjOgRo)TX8OYO6Amf<{3uTjD|`&Ogk~3ky?DNOq@foN+z>Z8|Gfle%mH^g(H^W zxBFPffqnAID!p^X#?P9CTKx>uzt~PK%j~w#o3&v=FdeMI05i@_T z=jou%ws=7~ku9vWRwzn%u!P7a@H{J;BCf7#@Mk!BONbYNgjUi28JGF_VhrI|G5G+2 ztE%WMLdb`L*>$8KTsaKQvCZ|4L-L#@_ohL+M@$++6*4(`q4bKLuSn0)78&#K!dZ5z zMFROC`l(z+3LIk(w!TBQW^_L@;<&G_Qx8cOoEXLO+iD9}67?7a;DKMR(#12otdiD| zGftJ$Rpv?(#n=ddKj%4^CAm%U+8fjEI+eeAN1z8-Jev-n4FfR`zyotuPc{*4HO>%u zHo_9UIuH1e^0;|2%DCCs{VuZ-GaqiGKJyR0Pk7~IHV3@7=;%yU&SGXDOS*TUSEQ9A z{XJKUE}rj$!93@dV${mptW6bV9KIvsmGhjnd_31@1Y>p{Z4@j zbF3BSE!Rh9W;J6}j@-#LUcSKTYc0$8?kpJC04^n#oP`Ts$TG#39_ejI$P4lQ8!o|G*UA67hT&p1L}m?b%nuki3*Dl|dxW z-PEuj;_$YG`g+vD)<8=`VYu^VUGbu`AwY5`=UwE)7#4;yw84v&vI zn@)>OqvP6(kgM|AXPv0{+)+BJW+phcd%^v9GXw$4$QKAL=+afyO&%8_ZUMlPtKwrA zmwG-2d9}KLdbec5#mgUfr{$4yeG!8_S)bAj9E;H@Vi>Ww#R?A*V9Ids@`;<}c7e{W zs*)eHvo&UD%m_9s19DO9HGwsjrsyPmqfvz3%|28cO8Pbjm2TPubp@KWf6+Bx*i6(L zvtLZ*`%QU3$Cg-QmX%tbzP|sgamEk0wo~UG(H7ictS;#R_ege-*!R@kuS_eK~RF@hZ z5}lsZ1{9PngZW9uqxBgX2@m(;&a`|mB>JoXbMuKi3Ex_a9M)%1AkBD7$bxR*K$LZ( z_xcvlPAr-o0*7w_@npmJCs%MbB;t#S)hnM9Ua$15Ot+#Xz<^QAMP$=)9-zdS!6_Rc zmZ{X*CdN%t6P5L+c_U+VUo-coh4{QBks{@HEut)tQR$|T0=o@T{eTIWiB&xKlXGD{ z3^Ls_NJr;vQemDVK-`M=t$MS@3=2#;lwuNaC0-Ws**vZ1V0Yq36J}Y)*MRuTfjc2# z#F8E$&E+fHTvBQB6*wN86p^r`W?wKl@QITVT+R!)1heGca_|YJo5JlGHrA90ECjkP z5ji-x=>}cL$s`y}T7Qnq{wDA*6;3p1*H~ zoMZq5Kp&uxUmK|yALqaiw;zFqX1CQ+%DsC$5mcyNtgLY=1H>mic9x?9I6Jf6Q21Jg zvbnI;dO92h_Heig+6^)Nq^3ry#Vd^%Kulg{s#C9GC^af>kJxnYT5~96;m6jcVI8p@ zigNLOBzDBTjyWd({0*>y@yUlnM5(HYTdu;J7+~k5T_s33h9792oq=kzF!U5jVJ#<7tB?f1cV3i7E!WG${jEndBf*&K?)M1r%GyLX%Gz0X=-NPz%-X=F%-UZ3;Myjg@}EKFvJho0Pt}K$ z_{8oS($;rh3!ZLB08Ni2l_;<9?qCi#`T}c||2hp*BuJ9fW6JTrS)W`-$V9m)haB`( zmz5W8yUp}}vjD_p&CUg`a`L7!k1r-2p zLA!N`3VQMRnu6hZgBqiFO@@?3lhUsZ{0|7GUKe^WHk2UtM<1AdY>roxGM@aQ*{ zNjwsX^G`7CGnm+DeA_;i^7GoGhthM05YAgnj|!NO>LY*lQ~qL*zu;go>0+1>^e)grBSi^UJcpgOTk&Z#BXaY3oxG)sByRO{tiY4(&(DKq?Yd?&`>8qDu|*U^UA=$q+$$grgN?Jx7`CmG{Z05N*q6BhH|xuNymT0M~q-d2&pw%w^d|2&=T z8Q-2by?#*C@hdTYDt!(~VL^aNphq8TY$PO{+((c%?IKa=7Eh-r$E){(SMRdFwm<2o zyjTli-DTatLy+j5C5r`5n#1U!m~8IX*L!IR%D2_&R!w~58SIcADByA#ExIo8U7QYO zC-*#vU8bat9Bt0(rQf`?VmOxDne%uCJIL$M0d8-A>S#g1U~n@K5?M35HNIKCZk=V< z{14DU`+tWW$*GD-L-Qj{&%|XOHtW;Y&p4y%r<4yw21f+k?-@v|LVhvrajq`@er3!i zYpl3r(n@%)S5}0+KW_T?j6p8?c+*~-+lH+q&g zi(Bg3$=tA1L)Jq?`3?q1a+Pi02m0EhmEM~hlj<1(x(ORw*@ZLN(F5>`4C@vdlWoKU zPB+N|N+V2M;y-J)vaW9!ld$l%4xd>h)~)VzWg6R^z>CnovKSkd&3x}tywhAWI#r}) zOu9MyH9dbQ64lz)Yn-fkwxvdt*bSsP%O4H`DVJ(I)3lw&k=eE<2P7J~!_OGCQkNF> zm+3QC_ijk`59tfW_Sr)oRfE@7ROic+o7AU)xBTFfS76^mYWudsVw#E6O}q3lPDJli z?MqY70|zVL&_WvxnvQ9^MeNA)8wG@?+hn^pA&?5<;h-=|6^$CcsGN5QGphY@^m#A+ zkbE(d^kj>fvFE}U9b%YhYR<;f4XN?%zuWKiGvjMgL}Ld5Arq?5nPy}hM>}Id^+yg9 zdubC1U%EdGjfR1>QD)wUuzRW;_{Q2fR`_XKJI)yly`AXHPI@Ui9$c67sqylr;=;iU zu}(NEpRA+CY>O@7=frbe6Nbl#t|jUANDLQcEe%ikDV6qxcygxS$h2nP;~B?RrT5j* zxIy_lt{m(J^u@QO$)@)Y@*dO*W1oYfcGb)6;}^>dSrPo+n6N_}v==DXCkbF5Gzo9* zr_Jj#ZO9derPrW(V}U8*RL$hy-C3J`?Ziu()p94dBOWylbwPKIfpK--fyW^$*vy2#3+rm#1F6 zkSfYgTdIB{p&~a$B+MH(RrZ-QNA7rmKGhI>ER@SL`Vp1YGrB?AZYM>l=|HI0Rc(5h zAu?Tub8my^w+17j7N~I~C$vWq;eQGxEgOdOO4UJ3mgKa76Fk;w7tPD6$CXzU;8MaL zrLLfAy=PZ8sB--DxkZ~JeyK%Q_qp|M^Xc`Pi}Nm|;UQhmF6#%LjS>^$L-@$kGn+9D zRQ=0l0_1hip%=faidwq)-PttrB-8huy9vH$Mtm_oq|3oiAA$k&GehH_=RkU>A~CV~ z?&lct-rrb;(GD@fG6Dph4lF?GBQ`cW!A=YBwk$U}m2HVmw#9blLNi4r@vJPqp@om2 znM(R!$<5W(K10nFkj@&c{!wTiXnR6CNEp0wh*~v7GnjTrKA0e{PUs?+!4dAXm4Dp& zT{fT&47f&7h8LV}g&ifl{}$$3s?(ZAfT?uO%BQH=x)N07R^KQt!1g_Cp$Gt3*B^^C z-8Y-iDm)#`VkC`M1qMf@aA$cM0w2i|8_ztfYRdFE$Jx+y8=tKB@2$+SN8kCac<4LX zLL{%xqj%vxd0f;LE(3R@s)-I6bnCAehDd3c@fQ4KtDYROs6S=Qw@OT(v@p-qTt>=p zIX{=PaKEl^MM`a{T3qf$b8ew(fe52PKsfk4sQvOt#Knfo()^szkyF=5j#fAR<=w(T zPEi?%pxha+OB=U4hU123)B*RuwA9?hwMneiSMpzx+k>MmYuSg@9;vy6_u>(dR!?xE z>n-O=-7(47H#i}I%xeqyF*ahdTC;TEeqEL5DIm?a13bTqvl7|uHGkg35a{T9UwYX2 zFOQM`sR9cu>fiThNH{(N8T{-|^YHuq`ZbASO#NSG@P6=&ybPV@x-t`yl@B7o2>KT? zN!nBN`)Y)M==+!WG{Gg_5XCCZUeXWc`qBr{znEO|w4hzVDm_!IOSN)x@$XniUS;#K ziQ@@ zUFDb5jA)g#nm-i@zRIdv$71uGmYRx;&mea=$%Pa(&A`j%#kPQ2&}s>sQ9XVDYrJ&; zsu7|osXAKM?BB?&hSc^O_PQf;3$pqj$-0yAi?T*>IiF-lV6J$Z0ww?VIBHpS^FVJC zed=}-g2q6{H_|#jj>-AYw>64X|6-~mgoU-XRyA4r7+*Bugpgb7T?0mclZd}HSAc`B zfr8IK*6tr%YHqQCK$dUupJ|*mr3I-fGzarMa`a<1!Cju3QMqGZBNsdAw)v*sL;g9w zjPv_Bw6bf1N8Y}5!k_QRQ+57^yq0;YZ6j}PMr^zyc~-CF>bAR{7$yg#ppJ#+?SrPySLGA?vXncjav;FV=g9{E3jr=yo=OxR5uU zG_;AZ3V~9JzkmnjVI)XEgo+6bGhr9GVH)2$0-Ld zDHCW-R7X){kj7}4au-%b)5HHT9saHRa+R1+BIxpinu-2&5jF0tb-5$qMI zlBDiFUtLOG|DsnN`5>O&>9#W!0bE@E=O~%?6>Hm{RbVU@~>j`ccvde2kJ=pMyej zSf%~gyyo2Erg64O{yd<=q8vES?)Q{Vlvx+ws!FvZO$JV4i2} zeXi%^1u|17Cze5ZYsoWfYE{;N$nct+U!QsCPJF#zM0ix|D1O~^+MHo@+>gFh5%2bU z-f1MGS@Qa)=jL^LxXcD-K`kzPv)0Zj#|7d~DpXL`mmv3LH=q36U1X0`TUALqleRHS8s*rwRA4$aQ^7me)EG~O1Lc)R zF@DOb&(`c`T2f_X;hXffk+IR1nmhF=()a=xG(3gP7$mb$<;@66)v{C)W48~tCg;PK z&jH>Gk8zR4lIqdJW>T=rwf#oAVRx_FM2uzL{!d`?T=MqTWbiGwFwo4eHXmPj+KrXi zUH>oE-a0JGuk9KJQABA`Iz&XeyH%8uPU$Ww>1I$;DM30#1f)9$7?6~d9BLRsI);X! z=DP;{-Ov5J-}64-{m1u*a2$wUd+%${xz}3fI?o;SP3(^yE9z{E&g;XzqpX-unO8ts z?e0Z`g!%rArwXujT2)r*A_3Qt2fh-Y*v0?h34xSGUe^!}sCi%jZlHhF5Oo5@v4Czt zMry8g^^b5dfdo<;n*wD)PuZ1CD^w4j_l%Qn;XDaTH|(`PSh1$iEOA|nJe0?#A^la* z7gYAPWEm{redMi1uCyu_Bg68IfSCSAw&pt<_n2jLtsM{<8Mf#9Q+_C%1HN zXxN3bzbN8NRJ&WSv{H(JnMVNaeWshMO%N;nP41rN{rDh#yav6C=3aHQ>lwK7Fr?5I zxx6hFVuN$+{DX9vC?VnZLI=UpM(l5|mxOb{@9 zV;cGJ3a(+aT`k7B-dHXEfj%lOG?B(;F*KtR0KhheYv=@U)DKPZb zFR+?cgK)v$fJm|qs#Ii_C19T-7XG`qX5I+o=&j`j4> zIvz1;u-ntPEx|vj@r_z?d&a9wPn>4AoodNu&Y^cej@-;ADcCdXui)T=jm!k}05N*t zAbP5N4=lNM_9zfg2S%iV-+)67@h`tu{Z$<-g#Hx4NCUhZumxrWq@jS)HJxahf?L%& zgM8|S^NOaA?7%%2;WIS~qIW-TKTo{F*v0D&V3Kt!rZ+BI3!9_m-DRQfnn6duRJbWfPq?c_V*XV1H%oSFV|iB8y*n3n!RnC<}@lv>+r- z&e7HmAj*8J`!gEZ-zihm)?50S6iiYFL{YF3b`o^vyZ>?^0-(ReGy|B*J6zf)Qgz_2 zqW+kUhYUouxN3U&4>K^jp*!QVz?EWATNEb zq8bzxGb~yb80se$9#(D9eS(c<(Hp7n7zBgfgPY#aHfcKaWa)d0tebFklcZZr=}_Wh zruH~PPSO!rXekJgMCNi3_!x^|RYF#t( zIR(@)zC-JhXweV7IiH<%VO-b9Y!Acjga<(fbV#5?hWK=R=pOKAKM8Q8ghA5g^KUTN zOB{H@w1K`9hxpzPe^;4DEO62S6<|1O7M#@)g}3sjh~AS>+nC;cnol8g@P>A~BzP?n zak2e04942t+(dZ&xL7$4Ilv}h%Q3=S$7w zEA)5>e~@wi*2|Q~Q1Pxo8*nt$%~;x+G3oB!Lz#y?COy1&GbP5)!ruUlNq0pvHzX%E#xlahuxr+U#wpBUs9~PAeuqfTBsWCqMET6`gDRWptbV+YM!@(7dnXOV3)!-r&WQ6-Q7&`Ss#8I=BD(8XpuH4a79>IJ{L8 zh-PD~_lX8CI@5v*TcxC2qo41I)#gydR@{szN_4a=kbCE@&CA$V0JIBvcoWEA*(n}f zgeIA)zp)Hv2Wn(&$hpP;rD4!cjaJ25@!y^5mCF*9bFSmSs1a-g=-%#y(8(|QzMJ0Dgl?#9cc zk6ThAfxNsi)}BKDEs=52m`jWmJ8*_uK!vUiTD_)oD zoFIKf&d_js;Z#}l3UE#6Vvjd-(+Ypn`g01rZuP%C5BudD#_Rf-xhm+pA)j1z4hX0& z8%7$hO?veCdZQ-2|M#NQN>@h4IN0+HYYUTzoB>kqzhdh8vrN#Hw`22>Hqe`vX9fxA z55do`!W90q4jx^BAfSi`uM0qM1_H1Ft=fq&avO4DL6nM$D0n()BvN|_x^CK#$6UjL zbG(k@p3`z|5!o>8OC#9Q*(W#pwy|dN3KU2EFQdr*Fj47eWNlwsI<#z6W-?;YR zHP_~x`@^-PU!%G9Ta@I#bL|YZ8MokB))4OT0vw?E3m!JTXXJ0y+6}$AGiKN5pYwP3 zdhfschjF`Zv`%ZbG8*I-%{aEemLFipFi?u$f5eWHaH>!~IJxkokKEt*1JJT3M&pcF zKP5bbC68bxKjODGnLM?}t}>3VJGmYQ)JNixLt^fWN4C*`qi7(IT%VSyiiZRLufSf) z)(ChIjTr*-*1s4_+W;x_;XctbkEylYB=>3u{1SWG8Oo1DEhA_iQp8SxPXv@`$*h7! zQSeyq0_oU~ME8OgQP8Z#-5E{3hLKJf= zk~=~Tg?p~+MuVqrxb%>MU&P6@2c^=Dju;pq z8H|$RoTM@}PQWxB<)SM+daIEWFDS4y+xCVb32;koG0FVxs-+AzQn_S_0{{x^r|5P2 zasjd%5#TG{;o5r|DJ=h0zP)cwSg7@vS=_ghrLE5ZgWHsk*2=dVnlMZBL$&2x zz=!_c#s;dO2==N2ShCEgwp|~G&5GGV%Qw&MZkjp27U|;AX;*DcW+f`&8;l?M=31>o zfG_X%H1uDong)6_6+r;kxpNXt3-AwY?b?Z^mTF8yO7ns28o4Df{U|a1WljeQoG|ML zQ74anJfB#*$%>{T0yW7kMB>Cz_oi-=)c?E-q)r`uZS-%JPq63! zJr5p47|kImUX5|IkR>nf{(2N49R}0+9mB4f&#rkShEpMzw*2dhtQhZOt?RBO>2*~@ zybC@K`IRThK8CFN^FaMzZSE>TUtUsqVu)w!CezTL{q^{XAq<;nxB0<**SeJ1>2}#t z0vVUq5Q~CCft2YWlI*{;fP0ZJO6_jZh5=)Q%aQ|DvL!m_=NuHuv3Q;ec>nNt-{;mc z)fjVGE@_b-c{dsDvtJ{@-!dHzRIPN|agu?kL8;bUT=;4M6U0d@KgAByKB*7L-nlve zcph3iH8*DkHUQdbh?Z3TmdT5^s{OQh`n>KztehTW@TO0m5OpQ{A7C6-i*6PCb8?scDaF=3?L=<;REq~%lGWbr8_n2q$FMPE3&L8ov+HtoN#wX zSfM~hm4}vn<-lRO+jpp8$+`)&@5$^!BhZ%R(Du zZb@%s(v~5ThIZr{5afpq0nqX<#aa#B*Q3RT8pU^uN+!boY(ja&$dLdBfI+)wqg9I= zhAxxbK8f?m&Ic2PFH-kYm-n|10)Dw4vtK#>q>fyLf)}aNDu`FcACAg)>q=^E##yRx z@C8%{sCfEbpaHJO_T%%2ye**8h}CqwE#%rAS12aHU!Mjx^6UerN&YQQa+7C6R~spZ zH+(h8X-k4BmFi4Qe&E#d_}0VS;@9!3PWQ@ib5NZ?|6DPn>*tWTCSPm)#4EljBTG}r zlft|D8#$H|f1#oep)CdgQzc}=8%V6ICD7p5&w=bVVEF3ZsxJV_C(`{BT2ck<-RPG3 z@(VL+G}2sWjp28+hAJrvGYFOGEN6X6cqxmSnJX;!wHVn&>xro!S5p^JSsuH>7!i(V z-_dT*RU7c`=;Rw?zL2dapjD&%)fe9jP!@&lD2NJ%6)npd}Gn7xYE9w z@3XK{2|uYu%95~RmxlKs_i)tswDS8Oi8NrHbl1$wrSudLK5=WKQ|0v&Ol6kLq*bKE zkSUf_8Iz1cK`(Rd8|&K=D4ae8=h&Pbjrlag+Y?FtBzyeTAKZ@aG%`#Mk&zQluj;eH zIXl3)#|qRyu}v^h$!7u#`VQL9mRFS$sc&N5o`7pgE>4C!sS{GJ&Ti(f7M^5?y^s6H z3vd>L*LtBlIOy3B^XVLs!zR`{<%ZlFjV88d+a6HfJdR=4ASbMJfk|W>K_z;39>kz< zu-cS5)>9mV8l6WDEP`mXS3d@%AR9{z#rxpDVKp=e?QgJXj4%oC>27yVx6;Vyzk}(v0C|>590Ar(-V(4ROq+Xq&ayU__ zQ-cZ9Nwo>*+~mjKw#h8r#|yMtb~@gfj`p-0*@CcBX9|esQC%U*V(VSH#@=*%)U?WJ#%i1#1Q@hJ+@fSIKOCej*E5|l9g+3}< zaeyMUnl|sFfKWERCu) z8XIL>T#eJeGU2W7W9$3e4soyxfx2sN+00#UM_}@NJ5wc*L2VDG>}!!xg6*1L@SeWA zfp_b~4`rXuqGad%KC<1;`*V9;LB$wg%0Q|V{zGR91GHv z4=3J{>0GfrC%PIPqt1!Pvw3uUnP@MCr#tiJvfsAdaxTee zGyXm&@AwiE#kk?zyDDm=}e%&cX^OrP9nsMlNs2ZHyVCDUVhcGpwZD6 zb07D2_^6H}|5>QWgF3N?tbN1}tCAUfSnvM4-?`5l96r=&{iNyLu&J*Pq`CXq52u)? zVb-sE!G7J13;t9bb)G)M;m`{ox^|sD8pgp;ukfF^$40lB{W~&jh0SktTLqZPhP|lr zli26XljH0ZS#G3ljm-p%8|r0WU)o~VI0|0r9+PHqf#ynmZy;~@O<8TW!1!kdoWvGM zuES-PM>7_N-sVkig(p_)g1K?>Ke?F`@bENDQ+qdvxbg9%O)2k=@|XDE&@&Zk;tQd6 z23zh#yr9o26m0T*ZYlCSw9_D7&MBDL`_Sy;W3@+;TTwU<$b=`(?gg5Cw6LVWdfL?3 zkii<`1-3nE(RO$w0p})rB3(lzSo_tAPb%Z5s&9-FtJBcFqkHqmjL%lwyt3@Ms(lRA z5X(^h7a{1V*|9TCLW5Cak7Gmrq}L!vlb1)~ZjOaEL6J1Zxo3L|)Skl?_z>Osai=hC z9(luU@Uh$&f4cr}++Pjx^XV`ncI7B7*-U>-(E`I5DM5`);(3O9A-^klT!wKZ{a$<( zAst$#r!1ICfeZOP@aKI|x=!Tmt=A&aJU0j`p2B;tjj*elb;wOhaZ!YF#VK$KBu6c@ zHKZ8xymYbs>^*bNVqbqHs7`1Wb7!YyfcJX9!8Yxso*30<0vPR@%u9lyrb4IqB<=hx z6ceVC5URXN>l@XRn1L~J{5R=+<7ono&K3h#&rmWxDYejCyVNe8uj2)~%ZA8pyHqK8 z&9YMelb2u1H8b4jBVPO*_+3~gef9W)lWJ)^Av^bc zn$1&x{Rq29r+0yAIHmT4$wnHnq!`y)W^2>E@8&azv6joVGkfzFn-j37wpG{!XTyh! zny3n(V5Ljuh6B%YI7v{#+2%2&GL&h}!@gD|xwN6@MIE%pMUql)AcQ|iFIc2961xzY zcbg_nabnguOLqGp!B=9bx>rg z+I}+|cM;O?bYj&W%+U=nI@-yot)jl!t(EPkGT=KUmpO;1;-=N~Y6*K{D-aHskU>u& z{Br#WYOJHcay08YG)@h^dJw4Hd_Gv_y?2h1JI)tk>y~PA2_j3<@m>fk+k??HDQqAD z`WNe}#66K=1{a$U>mxE$b<{8}y@%1KJrdK+tc3ux;hPyUT?}I!VBNB6FHM57Io0M_fT_`E=>Od_)({RD z2Ivbf+-}n3l&#-7iJc9VpOqzZWfz|C%*w2i^#TwX&Y<(O`(ufo)=o?HYT=R6)t}hg zN>7gZ`jgK2saA%~(v4ywui;{)B~K>Q6dF9}U%9yydG8m0b&hui0dUW z%Nj+06#Tb;?>cq^K-Rp}py3B_<%-bdg~pKLUP5<^rU<0IzNf|xDh#^1SP5#1$h|E< zde)pjF9iMrJ$4L)oaTPdw*?tAx)rQ6^&{ ztp>TEEs|=izG^Di^6+Ta*vy-%c)Li#x=yWh?jE&KDUJ5y z+2UEg8RY(U#I04_aL0ie3&27fWi=g)0}h`}d*UPK}SsQ-n3&`>{`#W2a(r`?ey`z5hSmR}P z0d+QTV@YU3VJYv{O!SCDF45=4=PaAaJFvEk5ofC((p!pjPYt_!TfC+IJP4;k%%cSB zA-UVR%x9rL5L4YGc_QRQXWjQOLi{iv^n9p2t3>1qdGw?ThH(n zgc@Y>jP#VT+Lo_;&ci?FJj~fO<6;4wmH6H;%=)6gY4!Ez>SibG;lP(o`1_>`kE>>3 z6lWd1_w^bIfkm;tWGG|gSiEP|#RrX62b3nvA5+dYVj||s1Lhhrolub{bFBO-V`TIS z_v~8XZ?-&N04F2+bk3wGGFSPA|S2qIS$Y-OWJ;moRvC^XUqwd0PBGLCrKpL>*P9K$PRAU+K~f1*Mr~=c^r> zr1L6TB*$@fDZx@vynuXlr8q_x>mANm@*rFfqsP%&R687<*{ZBcO-&cAHID@M13EHT zSl5EFV)Mm`fGl3Tw=U+@=qfiqM z%3a9NwaDWOB;56U9fjyU1L@E|p+j&msb`!Sv46rG;R0Fm>#1MAV{-{{*9yf1Il2%FTq! z`>YvQ3lxd0cS4h!Og!%kA53dfb2`_Y2XxS8^9>tj+~Q5<%*y>4;HR$=00M@LOpEz_O`-V>YtV@-%nTEv%?5|KGye{YHXQs7qa zla*sn7Ib{7;QNnIX?D#qdi7X-htF`R7(c#?92+b}m9fkAlqW~rTaO}Qj4@J-?a0(d zP^}cI8_ZAc?9?N=g!)5%rklspJyh1y5_;@LSHPv-v#t5b3{ll$E+wV<{Q}k>iaCOZ zEwipL1$q_Yto>*Z+b40@58}@8fI-YBk>Aux>m&KIF5HjH?g#aDqfI^Ht{mMdmbpuh z6b9}+889))eD|J4|E@Baf8$5hGRjzvI8AJu*TIj(QVO4JyK?9yf3!jYWk5+ghlP8v5wcs7 zm%Im4&4E*pq)*f;>?VbjsWILOiFwH80JiqgX7SB#7O52gcoZ)` z4Z@?|6EmxleJ6m=!7D3>i1YRy72;T&+nrUM;+o#S)a9|U_!~|ZY zD5q~p>u%{OR3nuCRAs- zrzqoGFFIQ(bNRt_e3A0FWWy-ozryq_1l_3;-!^7Bhv!{_Z8J3T+><}ns2Ai``?u@R zq(OCk@;CE~Pk0THgG~o;PRNO}&Q<%t#_ro~0bfdpd-D$X=m=g}hJwYGo`?E1D~h3V zbXZCW&QrT*xH*%24L3V-IqgP@ONOGm%Nm`mCS|CbM+e=6P6Hl&GRNYR=s4b`Gkqvr z7jU;3z*@=XZ54wThw0{S?$X{cSsjn~ssziWe43oz0MYk@#2dE|#MWYhb+)JnKAHCA z?Ua`jTzrUQDPJ+&V=KK6b<}e`ydirJ*`P;H++zVj(SI&;`xl)fLzy<>;A8f}xuc)hIfTp|FIx`-+a<-{|mzHd=u|B2HRUQ_g{5~Vh(Qj{>o)9h}_LzI< zX`3Edi?gZKw)<{so^w2Acl=u^2J1p-^({(8vO2SN;)6!~g&$1h*71RP*)#*A%c4Hb zpDmrfCU}jGE0JO47#@#=$hZ@KV*`zGwgaLg7>{FIDd+shVRt&!o_FW3HUGNSoTeIY z=*=deOX~G}?);lVxL6u%Do2$geUhqG4*RHhbSlrD0E+qSk)cHY|Ah=^70zzL-ices z^N-XTr9Ru{rwOsN7!pIHhwyFBgB2wLTJfITS4nRM;Z?8p!ok{Hqi=-LW+X$)SikkX z8he#R!$?J)H1+WMTwaW3q``O|4vs&XY98)Y_(skm@Cf(;dc6PotE^bd&K}1wXB`~A zA`8<$yxno;Xb9u4lmyU;^X+pAjEy9?`H^hWM3&HlmLY1{^KGf=kniY-e?7EjOL#xf zLwz9Y?NI~D0p`3kj@Si5=sHfiLGKVTsQ1=z6zu*d(ss9F2=^;7h109CSSPcQEF`>e0| zCkFzud#jM={=3+S;>f+hUUC&`%B3_zma*GT{7QU$-+1B+MA|=1v};zZJgLscyPv;S z0GYU##9ycH{4sO?q)Y(6#QI}K{~T)-1E{1W)039~yd!jRRr?tV?^1@sIWMAW+ogU~ zHnvOA)n)TKzFd82=o2eq#uB18hnq&fBO~rxLU29*+KHBRjMH6NsXbM5`zvftKv41lEU{SaxoWL-)a2w98Gw$dQZovm| z+lBmBG;o#kT=6u0%+_Hc5(-4LT_W(vZPi-iIpdI=t3!DgupwxXllYstN{x>vL*~EM z#u``~^1K_C7((qG^TT#ewd<&)U(l)wbDU9 za>e$>SV#Z&j^{on9l=Yf{_qZyWu#;Gu9wd*o}wQL^_XlWZEcSH4xbJihmWyy5YeZ_ z*3G>&k`V1)wPvXw)VeZQ?#l%Qbg&~o0nU>{)}e9nrO26_fRXX@+oNAp+=Q5e^bH0* zckadHaI&qA1Rc9wDs_}Ix<9-I7bn|U1c7mP3M~XKl>T#NHl}vtcarFx(=Q&W)qpaa z-3z*ZEWD~BmN$Q*INqryBmohx0egr%hsAF#-j}!*XjOu27dr3%%oX;>*E>(4mu2`K z7not3N10Z$k)3agL<&X{dWc zEF?Aya#kI3Z<{WW|k+af58P@|g}vfz@>?bD7LF z)y@qkwrKjInsBo!GBY${GxH$4kD+;)Sn9~V{iY1aUWPIk{Pi^ zHLEB5_K4REDsNx7@4xtP>a!j(lT(uN(rVG4HfQzK<9+`GmYr80Ts@=(0Uh|6_4FBG z7w+Sf0&xxBfz)XS0ZzL_1`E=kA>Y|wGUvtpS_tbGxtFo7z+g7bQLZX$342q6Y3$H? zteiyk%yyB_JUVpy-Ups~)s)II=SW=IWmk3{x%TAE#XZJ*0pNv($*@Mz$g+h4pg!y3 zagL86vT3t8UFDh+jLwwr)Gc0)zj>XMrU=fv`thmMduqRPBSSO^a{z63H)@6H7qBd=>WY@5dU?3WjE!VMTaK2fO#I1aA>@ z++eX@^2Oq@x23rbpIZ*+g;*E|z_o&^p&xX4d7ui~K@bbGVhVD`^VfX8;@_~q6xzkA zdK9fO=;jgSl<#Vub3yr_QzYlKtu{sMD`qrIJ`-6@s$Cs@} zOQ*2D1XZN!;<#HnYDzis2wqSfc@c_r0ufZ*;P>}#O(gyZ(^~XX1s0%-D(&o7H^a^? zzb$jYCjaGWdxJkmQfVbf6ytvtv;U1YlraC_X@lfn+K_yHFVM=aGeYAqn7-t`!n$Ip zAf^4Ra=WBK{-bzv%9S4$rH+YDsfG|*`r1hxyD!5-6ZOa+lvI7@apXb$K{H3~HCN|r zz0occj!!p9^7W|(pg;_fxhV`^=HiQ@V%&@7TcXpzu5~$bly+YHV3%i490ngv@$A zanh7B`seL38p2LFxu-i*+~J+Le0F8q6Z}y*cw-!xyF`-zl~%2_#yF)A(HPLtZ)JdU zR{>-Rf6P&Mvf6-(I8SP&@{Wm^bIoqQLPI|~ovYtG;m_c`rsyX7nnLPXGB;C~PPm(j zJ#Yt|$Jal{t;es=Dk_DS56@BlTCl5plx*|)=ln6Sl(zy*&s(ASWR&MuR=lGRe8J)P%m!=Poe{UdsQ26Bg6X|25szIkTM`HffNh zPp^|^l`UUl)81cl&K>d+QKt7bYTWXbEp$S9l-GA6Mh6}E_d$U0y@6%-3iU?#9RO(Kq9Sbjx)cC%2gX<5htM@*5g1!-WB=?oTDq){tY z)qlJI)5kkvkd;mZs&OUV6mhFuo3*00wrjgaz!7d_?%)trqy9nt=VY!;XT~EmShrE9 zO!5sKeBl{5+)H^y&cYZ4LgPjpdc6ujmXthSJ9G?txN~>HdiP#}z@_uZn`Faj664|} zYYSbT${Ew^D2Y=+xSa<06+A*?7K%PLLzrd${Fr{a%BkhXH9)w=qERykd>C&2VUQ$_ zjwi^=%18buxfEl{qiV17wz+oJN!)I)P)znz%}_u~r85l-a`E{Vy0UfR~u`gWc#lfM9T3Lo&+g`I{s#_hmW4ukI>ek`5GoCSjLZredDq+vI>^NDy13xJO+Y>0x;j|3 zwUYpY&3Id_2F4qE49Msmp)97%sm?#I5 zUdz|)E*M*;<4q|^Wic<8c5u-=Vs}RSXMYfYCoqZduxA?K+z*(sRKMIO&vRe6)H8qPV0}r^35n>CW6`2W(5W)DJM*}C?)Pr*_-eI14HRsdTi-LhG76umSodmACpTU= z433s`PEB~nP%jkXURov$@+<&53_G?&^;V7ZAT zY%dMi+O`Gi-LdAHO)r~(Z&wtEW-Xh{wQSinYs_n<9)2DkbDpI%#V}aZbUbo-O7L#; zKJuVF!FD6db&$_kVrZ3hHKN8_v{WR&4$3L}J?%ZjCvym2im=$_%2i)Lpe0=yH)oTU zM@ItKC@=*ClbmYA4aX^{s6I4= z>=(Z(TktKOkp}XBfR;e8vW78<%s^F5+4rGU^RHuiHG58}s=RHgCaju2UnJo5$Gx*H zBz@(I1Ha^&!n!JIl97s`_DSw>_U%BTrxmkXzF7rKxF%dc>2k!`NEEs1k+bI=irRgA zVqBS5u2R)nm0T%01fZlEt=+W~0s=Q)?|&|G6@yq$?Q z!^P79(KD{G&hn=q?~j*^r#|g3_ve6>?H?<7MO~M_gW66atl6D?)#QWVuX9vt7%R)c zGY)*UbE^cmsRi1a?S)9991I^y&M6+600qHwGmSCThHHBNrE zJT&yS>v~U0p3A0X#DGxq#6PIW)UD{tzqLZaEDW7>(rS5~A<)kQ9XAH&K@zO>R}$v1 z;W_BDvV+Fz(i+3_lr3;sIncg#k0`}7*z1PyUJ7>gb* zGYJRmZ%%NbBag63JXKU!OFv1sN}OJ21@(fdwniCnr-2l%F^ZtbIG{r>l-nPtKIwMW z<&7-x$pdigHZhd#Xmc*h`ZSO)G|B6jknnA#AJVG>{GPIF>+JBgnXgXN8%PT#?h~h}9}Jun##)A)L+9H2Sv$8HT^Fz+Nh(8M$LueEPWxt@ ztdY3Icnl+)62ssOMlr(WLiojmx569nx;@ihdo)9fb|_ayfA9^~TMH$ZS!Z~OZyMGq z&6Vh|A0d3c`Nf=w5u=Gl{pc7crcKE})3RR59g}#){t*WS#?Nu4s;m^`c|Z6c^m6kk zVYRC!hgOPW>2XBBb^}^YS-Tmumv(D(uxY)|)#mv6Ntoa4P?e^nc)3qznUpVe z5qyCt=CJ+8FQ|77ikQGTT=vYE@o2T|8Hzz5XgjRsqONJbKd7lOHe+v#oKof77zFX{ zpV>8N9!He#s(ZV(NzZO>;dx0ezn(U+2FEtqsxvv-I&RQ}`*)m$`g@CdTX4#}@wP}4 z!`KqXI>0lS-D&zW9oVdEkS)4dbSrqM-MP8XKNF0m<(K@O5l}wsGuKj5Mp<; zwNNGT&qtf?x&Z^D`)%P3_-n#GP={IX>7n2~?TUt?gYUSg=XK}XtTPvcamVe-#M@V| zb}?=T?rWa(vLj{B7Jk2%fWgl$$3Np9Ld@-`)~6m(-%3P>JB6#Kz+|y{whQCaemO zm(nu4MBK8m@mlYk6#hr+)#rG#sW}j{t)96LFWxKL6wSK$&D0REOwo8XPXgFOn)Dl1 z?8n%|0$$co1GxM&25Xgt;>n4hjf$cNk!QUS+>Zo;8YHi323j_U5z@^a9;it0b?VTb zt1n+HE(J$%G&k<7mZiYpB3=92gcU?D#~LdEZ`N|bn)lk&cZgVFt!G01A!^H)=B^U zDPWYXX(R}wnZ1I%^z03N^UrfS99{aOblj!>n5=+bcFunbzxkH#|7K(O^Y6Ae&~UO@ z2=t?uFb|r6YK9}p(SVrXrWuBxJEl=De1OziTW#zcOO_L1zgy6Lh z@V9ZqV|RwXqw~DqjfYXPvpQ!Muc*q%t;nskxvF=^v8=6xYIg^Ja~1e@JmiHad4BK$ zooB4Tt|`HGkbV4gwg0O`lo1nTOuqGYjRtfZq=FCJ#g&>jyp%rrUp@n+BIT;G3>RY| zr553rL#o)!yyI0@x}HjA#SJR@QVEcf#yw6Qk?8Df+G_Vcl5}ry!T_gqmu}WLuSIC# z3A78LrXs*oTdDca*4Uvwx4QFx_o(V^b?pKwK!^*zKhe7l{} zyGFmTp7zmZ$%A3p(RWoo(vUEfV;gJim@c3~xFjs~xEnkzu$48OSl-sHWxQwpwoN&y zqe7vvdDJ6-Rmsn)U((p3uv>+<5Sp7{+LQITaAxS6siNSce?A&7kF{=NtT@D*e!(ND zvM?)6D8>f;?0C(`t#Djn^@U|zy)hxw6L3BZVo0{aO$A!0%A5)RaiHQanY}ZxiQ8v{ z@3Jf|%YMA&(y`7a>W%m9VP6T){P>*rWrg^-~-HHQI~)gcU= zp>j=pRWytPUdfJEGy#UziK`RO|0=`jbA`fo2k*OdY?Bsq-3#$6oZg+glfZI9LF%gZ zsG0cd@8JlRI6xFG7kZ>=F#j6&6-KJ=jptERZ8O?JoZfYswU0s!kXah9NpP-3IlZ4k zj&LWsf&71l(LrNwJb^>qLqL{7wr{g*iP994Y+!-dS<&r^-HV-Fh~#k-{C>tM!AD*$&Xv!|s;f76T_|ipV6k#XrCo5H| z$A(DvUp_i8lC7azRA`6s6N4ZpH;2!*ndtlNSI@Ysv#>Kq=2W5es@-xl6K=N#4( zU*s!{z9fhOl+N!x=rYNZZI!=-GQSdfQPevNiYkKM4PF8@d^Y{ak#L>)g!Gagx`zuI z{%@L-cT)Zc-W%M*BHbU~D8?RrQtuBHqVD2+#rHiUFQ>e}r*ZoQrJ)^TiANUvjV}i( zBhtF8`TAT6*ZX&`+=T@AzRJvhasYzwmk^oR-Q1fE)A+OBhZFs)Zq8T5D3^)RiVD7R z+S0wUSmQ#DN}Yo!PNl9snlrU@&KKatTxP+SL3HO}7=b=c1^vVt3Z2HHgbBD7xj$(X zz#bi(xn0zE^YBh%U!OSts{hewb(&H(SH7B2oC#ct=e7I{g^o{oYQ8p!frAgs=%B;! zz^yDM_0VwCBXOV*@Ybm55ZcC&OKgrZM)jH>c?)`5dr7Qn2^}5rtf@;4CR0Md)1v7% zycrOf=K|^V_UqW06r#acbR6rej$220=5trEzKndhbgR>4py>^e>PAZzX=>{sB4*Yy zyMQ^HTS2GyYD5}HkjsJXsz&j!0kSb^`)%Hh@f~{(GT_`Va%*i$!JJcE|LVt!kCU^u zvYEOvD(x@DXk}s=J4Ts@j*hZf?H*CvLOV5-&e(Gd3wohkvq>6Wo%OM2V<~F{+)}D< ze^0Gt2tozZdrwJ-%N4goh*_9jV zh)@Ouk#foi&~Lm7{BJu*&RX^WbodJ&_)Gz0%l(=AKkPkFR#{sk$=9V2{xRYBfQTVi z)AI4O|BI<-SzpB7Un;)a`?4BkU_A9zTz{F)RF{R*rMm6@mA3h8B;i-ovh0Jw+|6^ofH)i>o$E^H>mc!{pD!i}z3%3tkem;~$<(ZidE@6R=z#G-2R zY&X3t+X#xD6&YJeZZ;(YR*H;73DG%-<8NOq@7kYIm5Qd~J-v-AH}K8uUuPLn&;TUg zh!pBM!9KBFN`>-wvy>IFOH#`chFRQc#U6pLc(S2``*5K@9P>*6QsN^#z#f*JkK)@f zF5UL<0(=FFbPI}5YF9&R>MSEP-?e5mQ>i29=TlAYd{Z{P`Ku2~x|_V=klSX{>Z<{9 zk4ZO4SG$oK>cOv~Gk_QP&=8s9Ar7Q4d-tl-tdp;j`?_2Q06Q)GmJE18Wx$EtJm>6i z5uIjC%3)7h0o=_y7l_Nj?o&_Hf)T;ZVwA=C#*LXaB!g zVCASDjb3yqt*CJhDJLq0ivlKJm|z@}DcOX&hI!bjYg$PGojakF+WCFY7lX<86i<%zm;eaD9{cJ6 zMJ+@^hy6E>yEs9MQEA}<2N!hik4YtIXy-%o;938yjbM+L>HovpTZcvUwQa*75=u)- ziXZ|a-Kn6UG@^7P-O`OgNeR*tB2vD za^T_2-fOSD)_I+AEw6B4B-yMPcXP!XyA`O}_qeJr$imo3^rExP37`Y}lA%l77J$Ed z-=~EA{|TpJTa)6Kc>snT&4^8RYLAE=A_3Qwk)JwGp1%$D0)SU%(-!IEak?3 z5?f2m!*#C%D3$K3#)Xz7HhD(LkoIu$k-@Vd2h;a%ok(qb8Cnwoc7wm5RVQj-J%6Eji4|A|P84v>ZguVm2z^9K?4+{a~)xCEY` z#5x|6@9r@J<;>E4yk2XQiAv`dQE1;DF&jRZ_+Pzo6mvg%>((j4oJvn2jNpGM8F zc|mr|-v{TBXK;2OE<{%ITxOFBusZ1qPv*{!5!7GK_HHyzRqo|t8c270P<5e)zU;> zsR3qT6JDx&qqIy444|aD&*MUgQFRwPms4TTJ&edb8>Tcs8Us*&&x2m+%`)kx`CJ#zCQh@7X%g$bb}<4V za`p01DUebe1Nge&JFlb5v4$0m=yvpx&}ZCZYa;w6wjAd`gy|l}{y)5v^;`@8r+0E6 z<(;e=fgjZ6j42w;mEAD@M@~rype5oXKQx0Pv4Zl{rA;@^4J^Mk)bp+w&on*F_}Wl@ z^6QRux6AwY^HDDDAKyn=ZXm|)|7K8X=oq;x&p96zGWI@-P!M-4zMNnZM>EZETbI>x z0PSOD%hf_E8O#WR9iCozCpHK&=wEN9HV??0$}4p6t_z&+^^gV$3Lu zzW>VRbOgY9p?(`dREATrunZvF0lGMxjbEmP9tV2^N0>>ZE96r@7BqA^k)+V*co7L# z?R+_0uhZFb>2bjv<@$n`f&k~i5k=SgC|LiR_eFyg5qYcgD>m3;r3v}jJc)ejzSD^U zrNQ<5^TroHc#7YpI|KJr%-!I#;0_X5Z_wqYWzU6Fy`v$n2f^Lf^IM@2@?sM{dU@|t znhCor(gPl#7bn`I(~Xh`*>T?6bugPK6qcR$@E;6^BIV1aK{}$BKjUc|Ya9FUrF|pe zmy54n1RR-BHm9xB^-KR+GD1ogG#}@pA?+(PXmVrjf#|SD@7U1jzK*gpNA%volGk6g zI}^t%)|bZ}#eYDMdOPr>|MzeG^zMt~gzLAPtxAZA(XQYXwLaP&Ytq%e8bC%GeE8CW zld~|wRpBnBXw z#SO^ZrkMJ?3Jed6Zl&Cx@gyEoWq{%BnB|CDl4W4H9%x7pfN$5>v+=U{NBqW{NLD+J zt)oLNAT|1x zhfv-t6y`>cj?3rH>dJ1xdN2kUC4rA3JwF!ZD{X6=mLQ;;KBZqckeL1o%FF?h?}f~< z%vd}D2^9!~iII)SxL$vY)-neq;JJNL@4Y+;aqRbMkcMcAg4Ra^KD;%?x3(9Uw5Wby zfLaYhA8O8GmU`R=(B$?_f4QNKr0}V+HmWxBzEL7AFg_GI`D7#Dq7Rz{3<+ z?&zg$!=?FJ`sVsrbCAOSv}717-yz`X*4Jt_BX5l73tEd76|SjB*I|d~p)ByTJ*V#D zjs;#N1xbg{G)se1l*e}ES-*l!*1>r3mVy?r2GZX6N$}ST02Ec$s28ir{S7q_=Ahw? zJCc|(b6fwN)%9wCWeQ#X>1u7@#C)WQ`Df<^!e&Y9tbs#vNU0PI6m-=LaJ9bh()f8c z;9Lp4%tCAE=so(wl-{pMQp2wwlAqxW=p+7EP^>oK^Sk8bvY z&qD$GY5N87bKJnIGF}F6S8vd9ns&kSVJ}vz>d4sHNlMl+!U%}ezefe^ft>w)qR8FB zVsapLpOTY&dz89wJk{jchRF|Y7qS^OoR1p&<3_e&iYc=e_YpQ47J2m}i8&(`BX@+) z8LqC4WNBM-3u9_|>{9xCBpMN;>PzFWHo5!dZew#F0O7bBla{j+wR$NQeu$>5ZH4n! z{Qix}_P=N9*E!mow%F$Bx%fX&0*Bl`h-{_u+5`)=jhvJFtMo^J zeWGT6z#!+`t7ZEJjaFpEkX{i|8Mmg_*PTNJJxxKG)mX;F;A=oEIWKl%NBF;^AJ2=r z{IBT8d7gbyQ_rL0l2z@8G5j*QUsnosAF|gdoKR; z4ZDhw*{lL=ggc1=5ptT!U8s&3;Be- z|JvzWD{RnDt)r>QbRrI)=eoVSy5Y|6OXf$V%Q!w#gE?B3EwHn)SY z5`XwW$620ZgKh#4XDVdh0uW#P$R>g8<@Gdc+xoNrKzzJ<6+j5+8P^kYb{XFI4@A6elX{zYu}N<##v6l=y)_EOWorSE+z#TfvpQ@B)*~gNhsL0Y@Aq z-CmGW*M=JBXyHmrfORRZtd0?rio0aS>Ii*Uv5L;!!FpwSQ}xjyy~%4%+SXh=H}h)%y! z{t(PCOk#G=nP0iCBZs(fzumZCo+akE@A0CE;qA+d26W`4w&GlKOIq-7ogAZ`NBzGd zR@LYu57DWk9lNhW3V%{ZS>>qI(F-{Ka99?veyS3zUpuyyaT_B? z=5`G)K|`x!5_Qh=-cq9W%Xyx7NwTkNH30VcfZtWAvlQ7T*s2vT^o-&Jf#Y3h`C z+w4h!#`>DMZU&2`(HP+1KXtuF49p|N2_4*~XK`~%#bWqO8uPtmGjO%G@HooYfk((PR=2-WKe3_5w_qZPs z<3FZL1*^p0`8Bn8I(?Ddi7qW1M}ikFLWC01Ze$=AJgz-=-y`C#7`vTRbI0zkwGTZu z_*U|bJ!z(4S(a=Z4J;ac@|UYsF$+BWF_Sr?Z$&&G@O~i=ihT0*U63-{Xq<3LicGT1 zs5pVwXCC`9iUxiWt0zyj;>Y=_#@4$pD^@=owt#(eVG`1VXLwxB zEgubAY(#I(KWPJjRitYUJsQDH2>PS6X7RpPKeS|pJ8}@jek)e5iR+8`7x3boUrX&v zI`&BZzG**3p;Z!elvBKUILA0s37#czGlKE#5`vTYVq>Z^*^P%RJ z&0gnTt5}jz(#1{*hk3=gBGjU8U%kG)iWZOZIxd)v8d-Y_+2x~fdW}!MUCGaII#B~Z zlsa;Gbb$l$dSr*?2?nf6*cz60 zA5x~&LF4ZB{(dT3K7!kU{m%)g|{0pgMB*<8$(2c1ij(4}V zw{qGLVa-p@E~G{O5rC>NHwEJLmz}C2$GL;WTLJsH&HcF2bc;v6lZshQuDFI?XBoZz zOWiLGPq-NU9{*cO4-HGcwzIBU;VZGjWFed3>}P{&@HDUGwQL+IOf-4iCO>&RIP+y0{4IU- zGXI8z*Z3Zh8~kkkXgf)_#`f0+9gN@a7FY>AE_h7!%1XE`K2Rj)!qHs!qVoLdc{L7P zVll`n4&JQ4DqkY;Ro`#$;5MrO74v5ofkvBGeQ`ajwo%IF?=%c|Sf*Zm-bp{b)4Hb% z4u&7RUbA}2xXy6>`P$8Fas`T=`=G6^?Yxz`DDkMS8s;3C2qh5}=TuJ|F(qHso#ZQz zGt&oqVB82a-tu8!E4($)6<_dbnagfo43b9jTOju}iowkn8=p8a;N-1u;w>5q62MEU z*(-eB6OKg8lUy9N*ewtaBTObWF%izD5lcdiyBd<%a5Hh@O^WDRA?<9Dh9XIVZEOT_x=kH&0zi7uRN=e zd>*XsUTl1wCXHAAgy(}>N36S4h2)4YuX`(poZ%YYAKy&bxYp$`le@&d-y;2~D}}FN z$YywdjeBZs|Ks4oTTI}i2IYj*`afq+_qcV%-kVVf3aPSSu68`9*P6D=J?!QKy_o9e z?Q@g0`*E$z;%2iSR#$Yp!&h4xT?eA7FJHyG&9o)%#o9WJ9i01gcoc%|)C|u27|+u9 zH+@p*-O2uNmt+>-#4vamvk0)vladI@Di%s<&I!q~9E=4vRp%dR*nEGZM+i5KihzdT z?x^TQ!Y9v>>F>T5e@F?c9P6=t)z?ZsXpr8aARg49nGKxMYr#DH+4!D?$0HHct(kv& zpx(2ZFPh8bnTu!9wr%&`|DZnhTVq0XUqgCF^XN!V6-3-h@I(7;1qwf>^R$nHq%bF_ z%DaVkuJe=5#Xi48HgQhBuHnfp--xZZhK@ZR!;3;Bw+7Z9o=6>vTmC+JImvKUVlG+p z15XLK{@o+zZg@#J!I?aSLDnfex@XN3J6xLm9h(Vt_iqI$T)u`O zYkYP_}@7udD7oR)vzpCbEO#ig(YY~#akqM73l(<^iI>s#C0Ph}|`J}ag zQbcf@RZ>y(1XCa&U^CiAX_f--0LxF7Ep_W?;sDm?dpv}%fFIa<-5N5r6ice)4J4(` zMaCM(3e8h)V=@5DtD#{QUF2e`EQ>Cy2k6>Js4dIX=c%Wv*zCmmbwjeIovM7Pn_|%0 zidxGaYUe86K`)$ca!*B`zV+ywR1$}7rfc%9yG7q4>NY2PaQr#3A(xO&D7^_H8f@vF zR1b{j2YCLU(OlyLMiT&Q(fowicw#WUkfd--KNynumT3hE zGg5r`F>G-&I=Jc2;@;%U4au-oQvsQWi$Ve)BZJ>J z^NkC^&YGMoAbR``!jH{acCns!X2w+FAhnQQQfrWJOeV}Fg>_wbmWI7Tx_F3r`s%r*JVR$WNul7pufyqDb! zFMn>Vh7%7-dT^cOj2J|F6DiMe2#m^e)_Q0a}@QpTh=8R zR}aAS9gx^?vqn_PlBm9n+%HUgZENTg@oxRVyU9{8eOai{AN8HU(UxLCQ-7D;whmW} z(A>0;j^d?FB{@;sUAmf)bt-}=P@arpK1<21D=ugWXtVJY z$#t8#bRE@`rXNX9Bw0)iWBR>MUIm9dG%NH|9kn(%x-QZz9O7@$&F~U==4WAw`n--Y zl^lR98_K&D9%E0r_pxZly4w`NRhFBeBL4BlOJj9C^B?uyqhvX#4NaW&H4p@ivq zMkQ@>2@Nb|6@4 z`E=a>^1*mR$zE40jU!#*ZcudLZrYjz08K&?bRuj!!iyhvROyTgLLOV~-W?wuaNnkV z9?h4Lbk|wAVreTgA^j<>IHml#85B!AeX`qY`}qPDuUDI0z6Abt?GlbdebI5lgkr8z zzub8~j=5=zpX;{_Z*ra{Bo6`9R^GZ8Zj3Vw*n(?2iDo5<8@l#f7wV&Ia=(PsY}yt` z;LjFB*}^LtZ`N$qYBxHC1#~fe9$3H3Lx&B$I)0cTe5E}L04%{X(1Kq|ze9z(yF92rx?{OAu;Pba2#>7C}q zEki-gT4>bSZGysgXP3k~O)x1O$Ms2Aji4tCllw`QFLH%X+It0aW!<(I%#&G1ot&Cg zreE+P=ZTP!iya49>fXEit;I9~vU(djCW8DpmR&J^ABo~ktza%>7jW*24T(QB z79W+2h3W^Ygu4oGVHHAk+r-(pE~Ib=)y1bpdedA$SUYZ5bAIH`ErCyX5y&CvLA*I?F;@SZdGcHCe&_{Zhf-m%%Bwa8^2Z zxoH1T2lmP5;h>$Zk33zJU&>_qyT$aV;TQ%ZMSfcDYl5Q{^Dy@mG{8$c+@@Kp;>&;F zf@K<36Ah+k(Y>XguzT;G!S>I z=mBq_=Ct1yS^ZSvAS@pPQo^QV?g9HEXIhUM%l6={sxbsme~wl$?Rw~&SBRdzx|6Ub zxYbgWV8~3i8IfhA!*J`tHaktHe(;pSHC5;orb1ka%V&BDE66~_umzlq(H zDjvNFH=?`luuqO5CpIozjUe|&E>QZ@?*SpxeKpYyJ-+ben_Jkwef!5WZ~7cRoz&^d zwYH*qpwz&JaZO2!YsUE@e;PbB3mTPSZiEcFjyvi6>G6S>U2;|z#cG>O^HU5E=hjNH z`}nljFA-B37(>MAg;lrErszQl0t3|aXN`Dr)(3g9-fyIo>P{#7>hkQ>Wg>C{3kgMH zDagJRq+O|6+6dGLGu9zXpd&KO$>oRn0|o13E}jwa=MY*Q?CslKf?p zRYE(f-&Sd@fkk2{!x_#zxM^Nn_oc-K=Dvy0)OHq733ra1OEn#vl~Roczeo#@HF*D} zfpl+@=J~tfL|G_-(~okRKRj*VYxP0?yM8xVlE#2DjhdVF$VR1>SXj zxcU20sJhjJUtIaejw(7Ao6jUqmnvQrZ?f);pLR4o?{*=T-yK!tCMCcj_Vdqwxdg;P zeGfLQrI2;t>T1{<(e3$$?nqkUC^|C}_2nUK9X4gU*rwKqlD3Ir>?YHO~nwEhyWyU`Afu>bTc0)EP z-gnjWeyO@&2H1+p#ORAEu#ht;V9$$s!=INHkPFvIINb~^Xf#c!dh_vtWJtRid8&){ zSuVM2L3T2sSw_j{^;s1=?rT#XFPj{7n2Nvm6=vIxkJ`p%kf9&&E zn5pYkZS`DwIT|+Y5+tRfIv*sv(E#N}CJ&9phS^mBqdO&wVl#~7-g6Oa^J%?V-(&vg zu|+3Hvz_Ce#8~|rT3FS-uFv(k<@RWPLFqwV*5C>FBGav)%@qq-$RA`}9L()`tKoP4 zot5>ksXoME6wvy z;3+o+e}1&Z1JzeI2#uM7(u;RWm4hDnt2W7^UTjZyU>O8j{C1fUv^(t3vIbj^@)Sm! zARUtWhOSeWVPO!*Sdr+vjL8mk1~ws(xHrmlLSt^|1sEH$u4{WqcjTmhvxAQ{>U{I| zc{xWGCX+uueDLI39RG@Yd(D)g>+qNT3O-J-q-)Sio=KR<1IpNisLmstPN=%j^G3i9 zR`(9Mlf3l4e~(3b*RtnWi_ZGu!juY(0}v}WvkyP5jhIRd!c`E=`AGD|Rx1tAVEA}6 zckDAtcQ+$XizbDXZMhF}f@gNBy9)4HQK02XaM5+^d)Sz+X(nMTDVPi>vo zA4Uj3hp)dR5e2Fm#8NI+WXpL^Dwe+nkv^h4pn6ZCJ+7JjW4o*ahaUwhEUi8U`s0{+ zYxY*4@NWmdo#`Y737CdB%pmB+o`N(lEBuzv{U)hLZ=c!+6N13-+*_YZQzt8apR1rr zmQ*QJGez`|0Lz4V1!*_c$J%iC4`~@JQf2eJeHwDCIVo}CM#O;DlQo_14jMM*+V0K_ z;B2?f3?aNbOP{^H7Owlj{!r)8+A2JpzL`qQv^-!z+b({-B#NJwmO0`sai0`*710)g zlFD+^-fxKhCj$lL>}=&^nC!abA;_a^ykv98l7FazI(A|N!5|jB)wuoj7>%@5f>8#= zp(MWqt)B@f<$RCWtU<6*;^E>6)dz>W3pdV^_di2dl-Xn8T{qgwjxA8Z*jckS6 z=-nCtSSMc>&kV`*B13^Sa}Yxbtgd~#sOo;>gzunXdeGLZZvJ&GxOyM`;ki#dy;NHT zwWk^Goa|Sa8!_SnEoz7ul3h6(ZID|o28^H`BlYGckC~r0n7Sy9FB0adkGP!OOfo(a z0jSCNE&iZTs*8~{Y6qpNoe}*h?)x@qOT0+#DDAzQ;ies}cP^ftyqFve?lMd_F(FXd zBXov^MXlDoirr47y%=~lD26jr=9ySr?i4yoY!rflfPpT+ZtEV7t$lgJ0s;?5N8XO) zE@Z`t@1I1gxvPeVz-)o*h=+{KKg^_f|Yg>QHQ(u*w$|A3*4pY*l(!=RGTjKDUtWR9>*Z+C}TB+IskGyiGSEJ0Nj@PTro>Wo6 z0V;i#erY-#laQOK6;MFj!>Y}QWIXzN0uR>sFf1iDw57VFR%m?dHRwuXm_G8Mnc?NaIo zkKPG(^_H07>n2I;uP~V)clwfQ@W}R}l;tn6h!;rGZTo*WLnVep`p2 zwuE`UeH-5KbBPMIoQO!xXf-9gFuF8ds$8aChan-5;|!@&Ue66owntbC2=U3Gqf1yi z?0gw|A<2E7=y{ zhAQ2QG<*V{!@a5P`Ih%L}uB)bvSK}H9vt35h?PUTu}vEyy8 z;n9!b037-9(?X)KZ5MH61D)24Min2A$bH@9@%TE-vW~4~AA>Bgn@_s*5a_uFq(aqe z_qfpP3rY7QsBsl!DZujC&zbTx6{E$d@8MVB1LhPoHpusG03y!AJm`pX`x8Nef#A2+ z9F;K&2aAZrP0{qfl&kpopYS;-(;@cWm{>PRb&b8xqyTd> zB}#2TooF=WqgubENgsaa2FpdzkG zFb$|=1X1rdBs~gRGcxpAXH~F2^rDoBX!q}K1OTy~;(RzVjYC|hfteEp7aVVJn^edB zy`ik+JR*#N?yHvh?Hz@}Kwhc6BafDv@JvH^IF2TNPP4rsiFx_xCuXCD=5m7|vN`uo z{)0>lCg6lCLO>F@qFHa2t+H2fn41m=>XoHmf4~d$ITe3es^7Wp!A52fCL^ReIHVLR zCo##JT;qNe>Uck0AjN&OT1oJY*tZX6yfb6g6!@1bhJeyQml+M==U|gzD{54XH-3W2 zn1(vIO@KVd8fcOq(dOVuRbX!F-j4z{_n;1*86PHHKisW*6ZecwChlgv%l^V=V=Z=v zH(rb67+PMP0=6seS+fu2T2E*S2G!uU`yhvCMD(xPesqgUU_&1fKvVC08v-<}aK|~?(ZiaH)dF;`=l$Ec-kN%{8|WvbWNvva0_a>H@=O5lF^ukn#D(`O{2cjM#*WhT zb(FKeD12VRaFp4#IUU>)ujcg*>M-bluvbTSH}hX zgBsm}Xm^JHoqS86+a(fADF9u^AA!(4T$Y69IP#3uq?*-t^+3dfmot+1_ZsD#Ew+=< zKx#yJz!u|Z+dphg+CM4)d7xKhpE7Bdin=e7rH z+K?><@kU+=vG1)C#!XJdYa{0=@!*OjPN|a5Y z%o6xK3jz>0Qj}{K0Xo#Mp_$Hn{_2|ze{h;a8mq<4mRv4-cR$10 z#-~<4_0Dz9XU|WJkQoC=$AIn?Dr9hJJ!`1ecG_|U*?>VMUi5@TX7VN@UUu@Sz`uoK zcOU*md2Vqlq4t%>RP0l{HBsE0-v;fz0u)}MRta@iZAP((@agxtjCq(~t-g4*46K6M z9W2LIVd)n#@%U;0P*ja4jpwsXF(YTze59%V8K)MPHZ+F3v3w}T>u_CBzq)ihh8 zYUUxi^60b^n+>1Z6>o6*P#3_r++10BeB5?z)?>4PV%v!%Fs(roOSQRSS^Ft@A>{U| z&Yc$T37tu){sJdkt8-v0+&V^-)?+IAc;x^m&V6k$y}sw8xV@R&CYX?mi1I!NH;Fr2 zYYM5EGHF1{-d@~Khb+F?no0qGt0(HGnjQ|BuORK)d<8AGbjkaIZX)db8ikUR?qE(D zRqCn!#OHKsxfptE4)9u>PMOm^dw*e_$Mm$(qD@Bcyf{@+mjxIn#p5FYDO|rg!2(YT z0I)$tpVlDG6W|}$%ZWMZI8Au;c6XL}7;u?PTQq;eGO6Ap8M*rj`t89JIQiSHXGrx! z|K0uij8i|NYa0R{UI5hNk;|9u_warJwpFVeL|w715o1=|bU{;yw-6fAcdMe5+-re; zcZ`LreRk3<)9JU@vA5|4T%>%{y*PdYXfw(3`ysN2vgd((^#Ge}*TTKSIN&Vmj2Hm~ z6WEqh?1(rjGs!=_&Jx8YhgP5)+gpYv<_7}M$;tA3+y#zMs!-63oa zB2*wLZ;CYloncmOj?v{t(Mn4kxCq$p(#rWcrbqEBRrPz4`U5Il70Spy!&yAnP$ zF<+|eiyL^la+G&b19tPOgie6F{~A%_-l6p8 zi;n0M2=WY*(eEcx1jr3}ay0IbDqerzDw|=%5nt=NcFX9(I|UrDT~V}Eryu2WwC%jy z6=@dwA{Ec?{cWS50-FzA+fUd^^NRRh&CAX#p{9i=jimQ}s0(b!`Rvdhav0W&;dzj& zBgJq`QjrO+m8wGJ(YFgw&>KMDzCW35eJ#bJy^kg`%_)~@cE8!;JKHC?4!V)(HsVzY zRHU8Bjb;tp&v~XlR_N)Imu)#B_tE^(K=Ik4$oBA2?#8uZEo_?#Yn5M+`GXf?`lrSkvw z8j`-8hayHE2LZ)bLcuuRPfVK=&dZk{-#o>&#Rr&U$Mh4;=5Q$Sv~T2xig?3;n6S=J z^S)fFsYimNiJy=0KMsB}tGLgLnZ_j}Vc!UV13=n|xX(I};4Q|=kKPp{%uM+(B7$%H zzzn_tbn*EwnBmuDIDi%P@?}Se^yhXO*U9|2^W%ECs;!K%-ATOZLYE{!=dZ2;F%xx5 zDch<(c2br9OG{0_cQ^=Kx3%%c=U#L_SENLSp4;Qiydu=|X zpuye2Rz)-Sbji?`MUTBxx%{;*toDdq@~NnuV2;5U=||DN$GRG%z@RI6WqPK4Zyr{N zhHlPk6Y)~@52wrn0{=aQ4#C(3=>*M-$;BK{^sg0CjWv|0&-?DXYtW3+Cv9idDz;U= z4$WJxgqygygS-GOY!SBZ-iWPji#@)fLJ&Xd4Ie zlniUGXq9A3u()uTfw^wcYFI^SKPdS2taz?Tnk!oYVhfquoyj@@_J|=h8|-nIPK1t} zz+D%@zd~jS+CP#M*$tpR!uGEtJUmK4)*J=0Edo3QLDp{Xbtb_n-#VgwGV6*uCU)AKoWW}_iL|(9iw>fqxIyeV6D7nmiPB;EE)ah@j8l- zyle=YJo9`OG97Q^E3<88E;aUw_MOszn;m3aR}LjSCRP;i1&&rK9J5NICJY+k(PO+i zT1je>uEO0PVgfaUF^w z=B2_q9YQj)bXc_7^w^|y0f3Ypyo#om2S>+%YSwPs~S-_i{>VI8aB$oYu2rj1`)p^Hj$63kM? zi}5wcA}mzD#UYq|Ov0cQ{<9gGF`cPlmp zZ}s~vcXMB;jeODTv1FnVMHF48ON3FFW^&cgi)uEx;c^?r$>k13rM0YdGt?M2X%x$jpKFj)pZa7@fa>dSfv_eh!B0Ov-LR z0k@l@f7fius}QR7Fp}))N7XcE8l;SuN<%7o5Y(P0G0aadIj`cD;kKIdfAT47+W;cj zy{pD7IqSFG18|T-i23{rfHSFjC?H=L_v=lwzTdo;qc^m|eR^q{+!$nI`H8J_A=cxV z-7*GXE~~nCcJMjns&#rEj4#}}Z!~)?dTYXnBx}ZlQF6h*RE+cD@dQ2ltuSlkRmey+!jam5%T;LzbJTQ z^;67&u6LvokHYuqx6X048falMmn!dCVHM5Jy*>?LbwCtj5{g$5*w`9*u70-;N7!ef z!rvT!mlIDL`Nzq)dtLb@(Dudbs_l!3=_D=C!`Z}ioG>EzBA?buA@Zd|!LHsw%QxD>tv<1x_HiWp!^dO zznz+f@%V-CmZun82U;Ff3d|T0K5a_;LHbF&!=)vHlVAHC{q_*KyA(`QN+x~6pEM$ zC`Tam0ATW~PyKEto;t_xDhZuUbzjwY2HCZ}E0`J>GvOGz%zNFg_86vHofmO3go=-M zSZb4R)>G+j+76U=Y796;)YC*@Q~IG447fZ{kc7IVpGx6s)Tr5nJC*EdqEwFaYqO-0 z;dAAEz1*eEzJm_FQ7(~a56Kq|ioH@X*U@v7U_lQdtN?_JsWFDaHKOH7xAD`*o&_gR zZIn78m@lGM|nvu4!zT^1FjIb z4@xMJtda74iw!G77utS)1Ga!(;^hAFN%b^iO4Tjni%zE_H}OaV2cm73KO`cfT&+qB^8T#oF&WY5@$*?FVoPkUy6ASN@o={gnC;9-P0a6i5o> zk4eICn10i(0VwnDuFoXLYIlL@lWgU46N5=;tI|_>Y#6OW#x0<9NZ<^`uqW)6eOsI# zOnpWkJC1_;wBalgOI2Hl=iamI9iSH^GEy9aFZ~A-%Nay6H@p+4G(PI-ZzjnM!!MPm{LoTT(jBpniZk z_(W@PE+AXoQ9zDk7O*njo12yS^23bsai}uI`mRefRQ3y7)%2z0Pqw+w#x)4ji$k}| z1s#XPq1xa$>7gpzRHz>}`Mf$&ouzC)!wcbESA-N;pns0tj+6-N6sKSoUw>XK+jgqE z*rD;+acyFMzzesD2b;K?TCVE=u@Q1Y7SY*IDIb5EYXQPE2fI9IC;^=O6YM`?vC*oI zGYi=m=FTK-31W}f$itq0vkC)HI{^z{_kmb6BP1WPF-}WJL%1CGjY5X51m%yg@J+c0 zj>g!S05KpgRM%++&HSwT4|9Ufc_THYGwXwmUi(disOkl`T*EIS2n0&=tE_-mT!C`{ zK^Zya$lbvkxcI-~sdf%Q0g^RFA}=G+;?@(~tp`Sm`P>0z;Ji|jrR0PEdmJRiYx{2y zvb6ILoZyM`>>rU$f=~bM_qKGKhu0DFw>)ri^nY#8=R+Ixr!Hoj*H0zR69X3CGZHNV z>f5gG=@;LPG{-$ibHr{)`fZL9-=oTQfIiP|`6kpJ?4QEK`RyTPu%q}5fTpwj>2E~? zNVB=OgToPC5%d|$;zD~D^gn&3Kjyc5%hBPr4o_{XK~oXmN>GU7|BuSQ@c@X7I71wt z`7%#9Kl0OuMeA)_eRLl5W{~Gza{{kWZ`|#gn8x$Dm4+=wTYy{GOwCZf^}!RE={}rZ zs+Xe)R~E>dRW%=uI9-Qp)8#FF&BUtDHbV2AGV*`Ous`)T`7$vE(m|sKE;4@XMGzc` z0r%N9+sV1;9*0|fwFZDvY=hTls2}p|gz<72S08qsi`-|#O}L#BPC7&}O%PN_2=M<3 zaR|X%H=;rLN>1xHJ!Lk3bd*6hj0je+-%t_&m z%1W>(qGRr&S<|&TM?|-)!(&8d0kKcX$Q&&GdY1oQ%ec-D9|%GOYgg24kE`spfwU0`#cpJec!yf(=MfrM)$ci=55J!6UK^KkueofIIVmM;*1{N1k*GShkHTZ(`KDJ!=J(szavz0 zOQ*8zU=?d0r@bOB5M8EF+ZwPlq#1G)+;+Dq&C4Op@H7|&;-4g$D$T$z zTFByp$}@nmw&R@7V6MR2S}Nqf-}oRK~Ys4FW29AnZFdB%tA!mJH zR9j4+d**uN7Vg~b`fezEZAfg=I~{7^5K~LZDjW7)OEx_BIoN$Xi(3AR^4NT%qeqt~ zU=3fT?7LEr4tK3fZUNj!!#V&eppF;V@yb4nFHcOS^en0Am9)CBg zZ)}LV+Si9{C+a>Abw!|}ovXk6AFk-yV%;>F|dS59(m;OSJArU3FAL zu#wvti912q)o=j_PHp>R4EJqas!{khkHjluz&jd*34Uy8#(K@m^1{d05zsR=bMqK1 zbl;(646-X7=zko+$n!!)Fd+B+nx2&NSzcsnhpHwz zU!8^Hqo_Bfl6?mKmPOL~;b`D0T`cT_VIo?h{%i;GfXYPBvc=M!F2b>UG% z^Yk+-hZI&N2gA#voBEYvBKm%eAk)zYo2t^>SBDCuijqxW2A)u(4{o$eN;(LhSOhYi zZdh3+0qZy^FPP(JZ9J)5UY|=z1bXz@_yXG8*~JYi7PoujoZr)Ij0#>5Ihi-xEKq^UTD$RcQ0oS}u60Tk{LFJ^dl^f9q z{Mx=-2tdQw#Tzq4T^bYuGP0z;l`b<1J;7 zHKlfMmiJ~@+W$Q#T^g_tIMvB(YNzfCLUlU^=O1lW*|!mbh%Kk_!0kTiUhcI8RJATV z;FBG%)%>p;9@8f2S(1HzcUqb@0ya-O$QRaQn9${@^C_STel;-_VgP6&0Rlku`rn)A zkjdF1YiJfaZIYAb`A{@VZ^q_1ax%~T-+nv6y|gQF)U&Vde(T`NI|TRc?6BolzADhFNnqzr-o((mB-?y!F-&7hc~;rKgksA)kSo zTF&VqB1~sRaq!j9N`Apv0O_FpAoC!cKv3xHi|9_I{%j-K3@h01v(T}yIu`>K)I^zP zL4awtB!Hj*<^$$uq&9hV^456@u-mlbbsxd?3q()78a+j& z16tB-DUzfEI!I425H*KA%ROIzQ+)=UijCLMeJ3r40o3~6uxZ`7|RzU6r znk7Z-{L+MrQ-td4#yS0+7S~Rid9-P(rf_@{FrWxS_guA7PM?J%r+MwB5#xf&%Xbkd zP7P&YF@}%%0LLEVE?FL`kFcP(^DMWjuC`Z1er&Pj}&Lqave7)LtYpTjG<%h znGYE3QtIcMO!u>h10gO|nM`<-xr+r=TQS$x~qfyO}7LOY*~bkoU#XEgzjLohrncKXPaGLX5;LQJG?JJ<7 z>fU}2At5a)NGl2|ASE4xq5@JPN|(~zIlzD*AtfRuB@NOcogyV2(#+7^9mC8$1HAw5 zy=#5z*1BhT);ep{v(Mi9iQn^kp1t>)^U96a<~lVR*FJE+&kx^aLj5s(oM%9l+ESqi zE>nB=ODDu2SI_Xa%eCAizF*gu-ll^#kL!oC0p3Uthbo=up{Jf$eDi)l^5U6OuvO@p zC<{WMZabvz6t!TDTAP*oW$dOi;t0@<}Z^FSy$F zRF*XS%(oQ#(=QOCp1AO|#By2ty&}iHaJy1iqa&SX?l0|#ZhgGpeXHWZbj~FNhrHAb z2*LTo)7oL)6?)y_pH=yjo2bwey7Lsq{X)TkMUffp_tt}GqKks^HY9cO!n*nw7cHS5!+-9o^vhKrrbh^soZVY8ADZr>7QxX)M|=ES|xtT7v;}xgBPk z=a_It&UJ5zVzE16_F#QHe;ou||7W3xes;P#TV};5C+)O);5%%(p8M##B|47fH3+1K zcg>fUi_KJHh%vEDwroES^aKPPZZc81+2olK60n=^W9Sq;uQn*{N#jGDy7sIu7&ew3 zkY5YP49Bb|a$x-)|B?EVHZ3?ij=i6a`@~K9-O9O6{wR{SmGT(P-FG{x= zIV=!kiV|HBQo!liv{yjLmg*)649wp3(8sehN<9k=z-pzsxjsBCQ~zZJ1wfd_Y!dAe6atFyP=$X3?fcb52SDig<-^xPr=}^+H zbo746TQyzQLVdKSGyahEI}R!8h35UYkKljRHTo;<3%m0;HpBm%SA&ty6tb{j4qrj~ zPS&603sUug!LTp!T!T?vX~zl+;f@Hl@-Zh+I1HMxj!E_J+SG4#&<#3 zGx`WPuI`T0fJ81;ic%fgE|#%&$IEV?Z`e4dS1VYqyYI`7w-1!>#1#nfM-nQyHiET8 z>t6(SIX{to>CeOSd-%J}cQ#&*vEiMF@CV!ubFpqVJ27?P#9o$PpHEd~?S*KcBZ$Qs zH}g)b?GJF(toi*eicUlCdL;yjJ1yim{5)$^DACPyt#V#|NYv$lDI?IfZZ+=Uz6!CY zuo@lboG22;-wO#^>qM;R=rh$kcRce7$VfJ&%9g_)JH44-7D}e8rdOX5ru$F#9L&rC zTx_g^Ln+;n|L5#1%o+@xa+UI)ED@_VZu(o)z4$fyl4GIm_j|B#aDZryI9px!nWzm9 zV!W5GW)ICEyT+=|NT5by7Fyn%iGm ztbI&HZE)%s#ZCVMsh^j8J}oXP@n(1uOyty_pSv&%x%Fc7z75syH^58;lULok9R_5!S*O zTx7;(%|2tPdZ0?=g%9}4?DOw0+?;~k{~gR=v}XR9Uhw=IB%5c zG^$pV$m^{i}0C&6@ zegg`HYCAuepn#s^e8m^7)Th!F>D7 zQiTb_&ru8V8v%y#19&H5L7t1m&=;+?Nnow~4fBH2#W{=Krif$s*eM+%LFPLA2T%R1 zIcFhwe29vt_jA*@hcc*@WfA=C^`)fj0^479@|FB3j zp*)}4=^sPgon3&%WyT8bO0Oplo~{C(2SUqYRQrzah?eEWWP`~_Qk8ecp!BdcUrmq@ zk0&ETgNPwto#t*9^y-(YYi2i}5?61({Z9~K(v^{a5k&Cpft39CBldQ365D15QGDG_ufkhTMB#j#N$!925>M{J!yRc* z93mC4m53y|KKM~hlDnCpAlDcR4qS2P&4vVoR=Uk%DO%a;s}sv`T>yBs4Sp2`fR9(O z=*F9W`WISKjoTJl;(oE#L#`Y26S!+gg5VL3c6lN<1uJO+2L zj*?#u?Y%+NyJUS=f^mCd)JBo0wxuvco{|%5tF$nWga7@In6%;s`{L3ATwarFhaIA@ zyK?3hE;fmg1j-1Bs#-zII&3RQq;SN#v(h-V6gSLzpkCw-=CX5(rNr`j%8%We* zWJ%S^FIW~Q_8JSTACcgoUS1dnr6D9wx&8G|v0_3_az693`<&}l5{Wb`DYwgvq8rOe zdqkmTSI1?8Kd%uzo@tcSXL>O_Bu?;nq00}d;TBka93ao-xMn)~ zRNF-P;kuZ|X3@YFk$V~UDa38`*XClfp)7r}U+;q+B8i%?tO9;MoNr4RC7-EqgWqO) z!Cvrg+kaD`b*&jZd0}w1b8mB#lBPONn>9-BfFyqLnIHWH)!o zfkf!+S{GNMZ`LaA4UoI*840sz7Ceh_vu4zkJDs3EVEHv@{lT&}buHx8T{7__CUM=y zRTc$`kQbvBw#>RUBAu)o6&%pIoSY!mM3)Z*p8Gkxy|U-+-!k2V*XF91`1vz>3U0bT z4?MxSE`EeB=yt@%Futt;7hCaukTUnixQq{CusWB0Rn zO80Kol&53#B%n?DUKc?AfP{>r)^Akz=v+weycWKPzc^;##f z4s#T-SC1!cqWA%O!Z1VKo&Tt?QQ2<<;;M?WZ~f>9_04#8U2&Y z=eO+h+*kTl7^;5I+P_EmTE6(k@r~Kl*raTQkag$kJ3c8UiVV-WpC5wzjryLMl(FZ= zGoz0ezDwIHz~W>aogYFzW%r^j(DVJXI}$sXu;G)#m8pw^ocWA zrKKc|UTIq>Q#-K!8WfNSlQ|U7kwt5fsa=kR@-BFY$t(>Qsa^vR>ix+MY)hUN!ef@O zj^5YKr!G*k=BQJH5F%Z?o;kBRT3Y@-nfWX%>CB2-)^)6eUP8*_nx;drP?bjn+u|v8 z8a1(-iBYcPdY5CCv>=b?rC+UQVWVX;IhZ6v>-WXRfQ)W3;$*jtfqJC5NcEJ}YH&c> zOW`#oD!b9sQlG?;UVB-6SJ0zR*i4km?31gDphvB^^NI*XhB(yo8N@DsK4WQ-Q;M29 zE)g_obXeDXS6Rd1jLRuaRNuLIv%0Gf0~}7%o0VOnhFX{L_p-t-ij}Rp$RIPBSJf`u)H!YgH!w zr*&#Xs6_(OoCW?O_cmW|k7g+O@|^|d>g%`rCJBG)1X$dAGaT{5oOnIeiCv7KoIN+6 zMb4TiajjN_&>$LL!rbW<{k_4f=&>XV!XB)LkE-zOoBXFSN#I6-fP z&HGp(Nb&i@cPUQK&(*>p&GiP*K>tgSw8hrel1jid6AxJy6yadAwioVD82lh>a;-t6 z|GAVl2}6Ts9F4p2Fgomy)VL8WgW^M)4<0B_b^JWhq8yq8MnCSJ1X83u;I%m{ExZ>) zDq#@KERn|cLQfVDu9h)~y8YPgwV^Q0j&YOJs;VfT;GrS!t+oy8&m`dP=;ZRx#a}y? zrQ=*dv3xjseMq}L+OmR{o`rKp`$xg$xNZv&a1|?7dfZRbz7UmmJ{UGo7GzHLZv0W% ztll_jsJV@H#8rX{(olUHdY{#*Y!B?K;S4TPC;GSp%$kb&z)6)qKD^|1HQnu}s_YV} z_2GcWZ^}uBFAB4VrM>3F<0Fr^uK|ig<74lcjaq%0Xg6Xzdlc$c**$vF~g3gKT@gK}TN#!(p`I zhfKdJlYqQY!>zm~SwNI;u=2i&Uh06ppFhd4L*|^C z2Kr@dx}BHO9FA=%0DTCiEH5my?tb=Sdd!I z9wd+J7Y$5hiY2UAso#t$kC3PlgOY)xmeK@n8q)$4g^t+Vd}`n_@WeVRl!MYLcGK9N z)|daIOxmV=TbyOnHyf%(r9{h4)T!y!1uJZ|hBGAJp5g0b4$kB%1~(#?jAe-bxdmza zrSCBX|XaX;e^F& zw@3ZY%Fk7Gon2$V{a}1+ugG}026gKs5oMh}@*VKHFuiRx>ez*w9~JV|Vch#D&7IKS z8$L0Vr-Dc=HjGnIjxO8jeLD&M!eYVOZ_!8BE+Sd-R#7lql^{n5JCJLix!{JuSN{~Aw+FY4utV$H{3N`R#Ba{FXX@S^LYu+4DPYQ< zL-XSaBvO*7m4vG)g)-kCnbl62CJ*oR&pc=u=u*9U?b1O|-P6P_^gMHO+L%zcac$+( zqigWOqQki{Z-adPjo;H?P&0v<(DqD6EW)1?)H9cJ$j&Ag~z7 z(!Cg{h4L>(K(20m-BfYt`iG)M+eSxa7>gzK%U|JQHV%p_Jx!p6cJGp_3c8Sr z*Vpfn0BaMKB~wgZvlY}4bPUMqMcGfxoy=)HKcEXB3SgjcH{+f<%9ie*=|^oqN+vXEnpKDZZUsi|NVw^4l~B5|W+ z`SwWPOTp>P$vyJlQkoNbV`t0!!i2vE458oOuHsydt?!pjtXC%F4Ypb~{#>Cxwpv=_ z&GKW}SoP~Ocj@UwJnqu7>tC&cIZe?or=;fNkxk{vlhl>0qNV0jElVH+1W)>(_&kGf z>(a)`f^Zs__wBW_-vs?%Z&g4wMy|=>GZlAGF!kSHF1!aMOy1?`Ag2+_=AkD!E;)!; zNVU`?N(?__EI@o7Bkn6M%=N2jkVxEPxO&@K80UMkkIBQTOVzulvI79uZ{pfmPz^Ku zD$}-TZ7idw8=k6Sxj}A2PuDsnj5qA4e2RPhj@VY{UMoR{)Ba{YIQ717@ST6w{4Lz#=cGsG)U?<;MeW3ivXVAJ~YIvqFZM( zYcaU*A&DoYcl;YS$oe+_`(^Y0ofAl{iReWzWQLH#9V-3QXt!(BT^Job;`$HCl!hZJ z(Sm0O)(lqm%8ZVq!~jITaY7zY?vZK}dEX>)X?gfoiFD0)VW-Pc>h-oP^Yy)|SmOI_ z#+57dIn?g6CI|6`B-Z=J{pKin{zF8{VW20?2eM8%e?=k?p{bb7)&^e_A#dNE@*$hq z4XK9fYxS9Y1$XDzX|8T^p9vi=UaYRFa+wKaJz7z%7sjc*j%hVK{9t3U;~Ss3%h9y| zZnx^!EQrLk56mmoUw5{MzFp1#?U2QDzyv$UiC#0BcWzaAIP7=VR_ zFxTx^e?_rP8qr}Go%y`uy`{)YlRv>@jSaLOKzi&UBKz{dVp7T1zvjawH48n!(OUWR zvVKp$>lyE!*cn2r=*fTll4}XB9)c)As|59a<*a;;K5!DBoAto^GmB zQw9DaKVpz4Sm!Sg?liDa<39t;Kv$ zGl+9Y5gWq5)Hf-ktw~!{Cz#gVJ4xtmNfUD+?`=qaYaW1Z{EEKM?1$A1l-wBCS6^o6 z)KcPLlGH&%!=upJF^Fv{sG1I6zHKRz9GKIZXRR*XiKHUWW@`RT*#w@7^5+9L$X3|0cVt4}^i*J;k!ozX4 z0yiSUb**R<9OkrF?|xR->BY$##j`uPHTp6upS2qI-Qc577jkF%PUi~nzcA@$0@Y*^ zX+fb?G@@SRH$i89yo#p0Fx_`Crn?iD3~bD^>O76;Q$LB970-#6#UmH`PDdG$?rV>tPuoW#RW-5jA;Nvn(iPdnJ1L^<_yEs)m zVt)Aze}uOxLKQ!UI#izH?X+>GxvmXPt`!#F@P#!;477G5Nxqy$b9fCNSLBNIY!%BQ zoq^q%yjxd&`y7fkD9w^;uq-p3YTyg38)2oO{T#$$&IXNdOvgfC!J7;kZX}sQH0s7z z54X$p2M?!~px`mc&fiGq9Jh2A%V+~C1%kaeB zH60%*Q%-?jOy&jqv6UF|E&Jxh3u1q`mf&Av(g3*xY~a!a5_$dCV?*wLC>23;yg7LC zj%{w_aF>(w1@?G$(>DbV2wjIIE_z1QyCRMk*$wx{_Sp-LdBsmHT~0h=7x-9y@l&-#6mCY#=QQ3cTUa ziK0Q)$4b+;>KaHgH7GI$ZO;vGUR#CnLFJyOjs7wV4HlKfU}Wx{-3O6H>}(#7d5a@u zWPGz3SH&-TWiO$G1B9A42u@XG&Om*YqUnA8qp1fM;jEcwCpLna zIv;FmBlGP4{K32Ig6VxX0B|N4cCwA&&tH#!z0g8y-6;ZeLpDWq+?LaeXcZg=WV~LG zO_|=6V4aKz0(z}xaD{7`@y02>)h6K1ET?0M_0k;lTe%U;q;gnst*U+!oT}zE7VO{U6+z6r(}zBNdaJ@|H)}$uS3{W z6!)rOF;>f$muTy|kv}(+xq;-ohyI0d$PbilUJS+_!xoVV=cfQ#knprhz>$&+4rFXko7ki4u)>7Ten(VV6Eodx-#+^)1a{sBbHTX&jKd<@Q$HT!_R3zatD$>51{?UNJ zr_#M^*1Hs|sw|gU+ZmrycV$Y9c3e^Duvd}{Yb!ZyB7PF!iXgEWUI;VnFw76RzP!>v z6%bKxTJPWD74}Lst?=hAispo!h;3JF#K&|SU;s()L1?X7a=iIEX!=MVyKp>B_2isN z%%&ZHQ~ow9TmsxJEpeCSAZolSk}P!OX{}2?aW9mL#~##V>aJ;T@3qAV3okN{Iiroy z6GtE)x)?cX&U`#hk{Yrt#!+kFL~SAvdkq!emYm1==MaDJuyjK($34iVDJnic|WD?7`a_{s4aYz?+ zxdBY7R{RaWKD+HtWfKuUTgWhZENpxG{7tb`FKK|bE^2+(>rPQ!) zwTqb6;N;T@%_Rb+i2X0R_)Ls(5k-=yA@9D-R`h1x_bq~PAXsHPfif%LrsXXUm$4f(Lz#?x; z=0(t@BG%QlucpFF0eZ@lH9K#kJ7BXkOH41@%$1VVAvP~7pN`W$q9PSAj%FEL%#)QS z&u7#r>!o`a4-HjPxp>*!<2N<{6NObehFXnlWxS_SO`<=xO_@9j`odbRhCK=M5!veH z+c7#XddFwHl{)TSwXm+x0#)8aT>5b-pRvSdIxo4RHm{!(L>~c~;#b-|0mYY7nwd$6 z4P=i(JBqjbR+ic|TQ`|M2jYQ@F z;9`v1Oszjbf#9j^pJi6on024qF zxR%7NsHZAq_c&B)fj$|U)sY?XgXe{2_;d(vZE}@zH0k9O#=m&jQa6`5864>Z`NId| zos9XfUz#}tiWxn}LXtfU(v`+{^gAEiyPQk~*;!nS4KWaR+3SOYIuwTfVy@wDpGu<>2Ag_)3a~><1c-)%U1{$tNR|@pRawskX3||Of7vMUMb@P z1LL@X9)}NrG8u69*Py1(Nf~vp4CDBB5uW**pwl3s$AuDSlwS!u&u#=63tKA8z$b2!or#5f+!~39U*>^Z#BbAAPy9Cx(m4@|A4j1DON_%G*OI~}s54vTJ z`vqKYYHRd0qI$j{egzBDDaL^_^ri*yT|A=2nlIwpZ^f4TsY^Pc3txygBHKTV6_svGB(;dG>SC9m1YbOVj%lD}7jkAl7 z@n>?L#1ULeg{8>sUa&=G7)!*O#bfc?-hiK`lxFFEnj3ebltJQv-cyVnG4O211Ki}g zjXc*WJGH?i@{#b;w;?~+y)R(?=CdmtOi90Xmd5HR@ zF))ukgU4QyZnx5#P1OLHi3gn9C(a^p$BibaNiO=?_b! zi#mH?{>+axZ>n_n(Z#Nx4pS;zFX;9yL61x3sukVw@Es9%YBwEIFlp|ZD9<^vG&#U{ zXM=+qbU+(14S2?6Vv6I7XP?-1H#fBiu;m^RHDG8|xfPScu(wtZefEW{hCL>b?~aBV z02~|~Vp02Bf$LnnK8~2LR+qkd6)@T2v^$BBeF8ja2;$tD`x$L(x^OxsQlT&TK;$mQ zqwW6n#R5PjSAf{xBjDPv1;D%{#|p3VS-4T|iQCF$3Q{fB5kuXN&f|2Yb!YHi`PDUQ zcxAuR6i3K$rRj{>N=ySvIe4qpx2HZid^{0J3=0?dTc6PTiOe3NxD%VBT6pKH#`Qw6 z()TXe5++cE(YVUZx@kjPfyJ_)tKwGOi9L!5)CIM#mKLVx31&;VY0}Xcl=HR47t5=X z=M{N)EH4@xy8Oh$sdqg&z1+X5R|SLxR$hs49XENh#!fqLCkPljfZn~t{X4!!3CiF9*wwXYqyf z9%Tm!1DJ7K4ZMJo`+27U)3#50TAkW?dsZdms51W?nh#4^Hmxy%X_xLhRr> z)#_9JQpCRs=4F$l3us4r+bs9ON3N{B>~&s`Zqw3$wi;Qn71lyr&|`zGfn(H9O3;{@ zPFLPy@w$o~&V&g4yH_;M&D{>}hSAu3IHR_`GbrrR2*6ER}(fRYJ4W&DP zYupv_rs(_xqfDbJF-*4}RLa!iZ6!iCVwG|HkC(bdHs`>b4kPOEI%v{NWwbomA0_o z?-$S#>^bN0owj*RIt>kIj0Eb`Ho)k#nu$(mySaDT;1cL>mM++tbmD#5# zZI4VM5%7+0K1=!&=|1vl9Ll>3In55^at{E156%k>_OZ1 zx>`0r1S_J6&rR%IRek^i!XgX7!E90obWg{IUrt7*#4i1X#j<-1m}Y2Q$ceq=l?JL! z(&#G2J9mHynBu+m?IOW$lT9hjgikz*qrz&zt}7#s4mb`BxtE zzkg(c0OY1E#q8`IDdO?>Hxj^XTArKH41b`Fn2No@pn3R$y2~X~6fR^X2z&;;HXzob zCr9R(EI&XOFJ;nAI~8`cagjTW?G^(A4*3MEnRS#B=jr$?u5jk*CDndsSCb$3ytLt4 z)|KYh2a4Jg-_9tzo_2P8h+0jgVsKa0cIY~B+FAl!)NeN)K>v+HFxiuLvKzC*7@uH}Ik-{5megM%$uUrqZcAXvO4 zX&54HOffjap+I&Sq%73L0}{Rqoi98|dI!esR=Q8Zr{zy-l7-7kUH%D=hF`}ak1^E( zCjvXrWMt_f?y`yW&)PtV?rUI`f_HrRjo>i|6I`k^-zZ+-%EcfB#Dj4&y8SG#_ zUEoYVPT{fS*?r^_hE;eUDYS9&Yx3Sk-&(~Y%;Ouc zhPdjA6{ZVqrgKY>pC)9NL2CHNe`&TJLk(Wx5o&J6aH7I&`|HYvpvwpAItL3s=v|&_ z@!B0jymd+5v4uc=ocNz9->MN6RxidAWaJ|QQ^cHAceHuO^3Pjv=t=;*xT*EITDlS+ zvLz*KOjek2n~$GlzHwH~dVvMR4ukIk*t)R<&0EGMYN>9jZZ7nqwB1iQd?wCXLU@M` zGJ4rs^t3DykhwGF=S^h*jfIr>RD0JYk?!8KU%b0)RHSq zyCQNYhqr>c1zYsIet%&LOx$g}cIav38^!3ovfIEAAB)HKW3(J5aO#YXpY*AJe+WNg z*Ks1$;^pn?`AVi%(A8~^c+A^{k*c;%m*b*!cXYlcR)zSUYktjs=!cH$uLWlNdSKXI zai|TpQF|YMvh6J?MAx@fba~D0tsdB{c;fL`^zm7N*sqt?>(`TP+?9!d>s)OG_e-)I zzRZ&D^!(6y+!V(AI;KOh#bvlSTFo`q|3)|D*E<}4f3CX8)F_DOmPo|`Z3SNZ(k^nP zb5%&I(ku$9jmygibQeJnt?+c9A8-6!v>o~+>$3AhvHM6Y!}4b0X&XsW;x_brJ_bn` z#DC9D_iQIyi~srZcX4|XQvZ=}7#<@q!XWA%kU)=aYxUg2mMH54|59E}U^c{sv6XD2 z!?T;C#AMWtv>rM0U=g2;apoAmULzjAhdUc+=q+N7_|}ddPZC#b-PG00t&^po7j_9y zbwY>YoWi~0J#J;{$YpPitg*Gg}@R;tVe z4^}pJ@MiEmDiCW3;TfaYcvi^trB!(BdSiD4|(okfIQ5 zDq2KnaVJM`XS|Q~uJNBVY`~gfqP3b+BQF*?5MW3gd6WHN$$gxM>_oG|&yoVRv;7>k zJRA9_bBMXrntpOcU12$Oe9G!aSCtf4vinh6%Y9TcJ4@%oTa~KvSNVmysdjxDKxpFG zEkO}S)ClSn%f`~*r`p-JaeT;j%^DThNXaT>i@d9fW^#I|*+M_l+i_@*Ji0?#gJgT; zG5*7$_qUfVcgy@z-`#d&W_w=XGcPS_t$VVmdWMzC{+BqG)5_|1F}Hm@^k3#Nwx^6i z?~=vKF~W@f6PYrIMl-s)Qpu_$wbF8;zO70oEzY-=?IHy>W%20i(+>E4<^CWE0)mBvw_LL5MqxQ;D{cEM)%Z^usHNExGWcg4ws)Xt< z2>Nm?A{@1-=jv{Sn;F9$)kAH4_02X0dM@&3{X0DH?V-QOyG3Ei0%5OJiUM|?rxVhh z_4O%qYiYHxan=ZmDl4A!#PgwLRdRocAM^OI`U`@i=hM17(4vbteO#U7LC{*He2SB1 ze3}HcvlixUNGrkB3N}}>s*Lw=CoAA|HJ3@OCSM)W#nyVgV%1so@niyH`-xH|A1k`3+X%UEgh^ zVGbLhz4mpY6K%}z9mJ*;Ax(^#hIcX$NycK~x}>VFNH~PY>KscLxJW zNn!?*R_Z42Gbtg|1g!AvQ_uDNcs# z{APP(wQw;cV(Sl4L!|5B%PUXlf>&)0MkC*h+Cx7c1*iS$ktEu$1mTszhVaNCk&_dW zdDSOrMi0Tclh2`jb~CD=()aDp)hw-IhnMTdcxVw36gSk$V@o*|?}}X{=Z};HA4bFW z(HvGs$mwre9oMSpjGv3W`wrH9A82N82?^?+!pVwPTf^q|??vn+g{xnCB|Qnkw^m(f zWa~KU5!AC?XpzU|=#`Ex&n@g~*p8TAD5(u2coflb6=2tkl3_ih^_j2m>X@1$ z59;W!c`(}>_~haJ)Z&TvNg{0>QaKe%!4IR}e6^i)l|9<-u(s=WqPAP-C6@P3+$s`LUs3U{0!&sX z@j<+g8}g0oyLKXFx$~QdHplQ<8mXfr3eH3$C#Qs|XVVS=X^%1+u9jeU_7~YMy#h@b zgAM%aO2(Tobu%lCtR4nUTM5@5_p@GBtvIW?X6K! z+k-`8PLi#Spq`lzhCymN>fW0*>Cbe8e|n9~%g1!8sk2(mkzHh%%kpq_@vZCms~N** z)tT|UEjBGXFDHa(&lfp_AJ14)C4?;^|GJ+IIA`+6o3E%HMDZzGSsO4h9qyVKCL~8( zDHpTb(tSxaS?KK@eGLf{(887I;$WQrqq#W+`Um5V+`S1#Knfe``ZL?{Wgbxybe4qXNEZzQ|{O#Bc?;SvctAfj7)2n2*&u zzwfP|t63XA97<;E!X@Jx`~123tw<2+l{Fn6(#;$WCw2+RK2)ns`#{U7)#9ux`b)3> z-m=#^b#TPD<8nHje96%i9#Z0XJ*AJyx$h|q@9ALcVX3I^3;LiZJV@;DP-#wktd;(M zKK&g;!qK70#KAZ%3Oz^T)Dd!qxE1Y#hkHp<_&WNV)==YV!pujJSCc|TZ^mDRt>h>! z#9f#`9`vN=e)_XSq>v)ane6k+KHaycq>m~NCY7!1b3FhS4TjHbCH`0q>*X~Cb3W)` zHtX8iuimF^V!)%ScQ}oiq}SgF47WL=D))J?5i|^Bpi$gS3A%tyAB6E!ScGo zUXnlA9y={AY7<;Cl-R-6iYMgWuNV2m6*Cx*TG{@nTlgIn9IYbXb&bYrYj-!xvbi39 zGZaO}NfOfu(0T6O_3`mbeiBFNBSSYnjl4InWwSsooAc*>PHtLm%^f}xh_Sj?oWM~J zdZ1Ad`fe$G@H-@71A-iFsZbCm_^f_)s?cFs}K(*=yO8TgDlAmDU$%Azndz zNwbG>a<0P@;xvQ1S-H9!aTN#_n1#HJ6(bf$ANTacHrC$<3JcYz^wJMkO1M;RwZcVZ zD(82`rUh;}bTkwfK75#U-&y_5yDYn@n1nfmeu3@yc+Yg_C%Z?Gl22?Zj}{QljB`hE z{OwPuzQ{<^u#dkRExw052w`T|(UNgByrJT{+>gG!J67NKdYdF;O_bdj;;qXGV+be*CH308yTC98u?luSAU%%-0%(|j=+~k zD*cW0b`4J1Tz)s+&i_7Oe7D{#3r=J_4i?Y`J40+~z?yF99T*Ah(~<&$O(kgk?vv_c z9~1=^FiV{Ar}JIU#zfM~kBS+1rK}cLr9X0_PG1IDUQVTs&KS(=K&s4so1rI)7r>amUkEBG9-^Ze~7kJRB=)Q&d9a4|`|0l)q%vtj4f^5Us3l8^DU+PP?` zl6*JOt#evZYd^YttE8m+-C+_eDiekESNhpMB42sWraPyXs%LwPr{sh-8sci2q&ohuV(A zPwtA!^DB{H*r&DeK2mi`^Jk1ErwFaSUN5)1;bM-U3_cxIgu`oZU_AK;_KzImeA_Io zH!|w;ci3}EO}DZWj_jRLtbDz#%~S7hiLlNi8sF5>D~R)^tD|dnyP5Ju$_22r$~~(n zhL44a>Ru&jf?@lDzep3Bv!Dir$GNV!{_f}d(QELtgL1)=uMm@WageB4jnj?>QJfx^6!5AObNtuagT8!QuS!0FUfYa-opRW zRff~q!5uGJ&#?}uWgHdC4re>Z;}7orYaCcHewt?8Q`Tik!bkWn3m?VY=RAhDH><Q`?0(%$eE1& zVOn}JZhA?ck%*M?rm2CCWGAhJz!X@aQGnISXJhesNx6Eo9O7tc%U5GRc@KFq?BRZ# zgbFFo6$)#R+j+p-L&;U63X z&WcvA3TRcFSfIjSHDNyfVR{LND)5~;h(Y^fyl!TJV-f3R3KfRc*-!N@Y=^Mou($K( zqb0^Y4h&axJR)xxYkAey`hP;NZdOdQA-sll{T){e(bK!Rg0tA&F03`SiO^ICk+uub;qi;hOZNL+lQ0ltdM)(k3 z47#Gk-`ua12tlmZi2m~2P^--Cfpgugs0ydH?9NdCMTmXBck&;t=lF6tbb+`m(6&2NVF;mGCtB`B-z zDNp1R*oL21K9q;vB*xqi1}*{@YWVK)LDC;@v=#(w*mXs&qB}{V2OAjCwkt>&5^D)2F zl>(ulFgJFF6F8ac*;dglYxEj#G=4Sp%sVU%smKD3GH<7!^Y%1ISd^z{o*k<=BB_|Hoo}7@9@;FR13N6nNS5|~# zjW^n91fO7+1qWjGTwj$;qguY0-d*j!?K&1 z&lY#WHuH>k!>&==Ynu&7=-)4IP{5Z5ms{~=tKP3_X--2sX!+P`cV`K9LsgoOr(8YW zyw8lH6lAqsGywEQs`lBuZXi4AAsu5!0n_QhhW^wDAso8vUxD1|7>GFY zVb9N6Fhf9>Q5#LUM+#rPy|ME1Tt2XJ*5!W<<9V=}uPAo-wd)OwHzp3hd;QA_?H%>s=^0rV+;jqO}lN-6qeT3>W8we`5ftKI<% zAkN3q@{jOgRj;i0mfGqsO%wfR$L_}u;+$v|yJ%|;$HhlYK)uU8^`TgK(v8SSt*Vr3 zP#K{E8J`4)QJCImRYextyup*>Vje+r^?N;=VxOGXZ)NYJ=hI;%I%b3tZhm!Z*kzlp zk!+7D{Z`E%s;TR=$Xjc-CsN9YyPtimi2aLw^J_$jy_aF3+{#DqO3ufn?Dsi+{zpq! z9uL*`hQ~e_L!^{!S;j6Q6NXk}Cy6ljU1S-{keIAdlqI{72&HU^VzSE?LUtPal3^HX zFk|L7_5Iz?d(XX}_ng1p=RVJS?|aVqTsQuB+?Pl-oI%hYWNll|4G2Y|*wF<#==b)P z1qFxN_pH?>$MRR+tfr~Gu_hc>(JLV}46G>_blY_hxV^EW%E{kfx$4{`H$VCA#|BO` zzue&Y$gboMM^F~Q{GvzX2-~B-Q_vT|6ZM~0`fz}qdd>tQ75jn8vK>j48N{xS1kBLC zZn+Ra9js~HxaFCl8)AISpEjiOt7x!^C?A#C2o=gs!W&6I6r~$Mt7&n@G1-PKRv%k!05Xn}+DzjMq49ERX3 zf?6W7akd{pxSJlg?gJ*~1vtBv^Yt1j#~n@PGV`pN^0F?wyw!aOSy?&hs&^%LnjhhQ z%+lLIrW6{XfBWad)VefZ>wB?JU2O%GdX3Iiu-5}k~zaka+V>u=6|Xd+=oxkDul zGfx_h+t~CRKCCVooBFWky(|P9f(;?xIHwb<(bX_?+!i`e&Mr4EuqXDhsy@lF`9 z^|8XXogXkZ%fru9T`;PSU5qHPHlFTnFg!hNz_Yp;QNXI<55-PQSHe1`aRnPU}R0} zDCt;cNb5K3)PxU<;{^}m0SpFOHS%^&t2pJeR`kAK3Kk`O3KG1K%cqa#)a)6XoNSl_ z+u2cwa#x=>g>0DPXYNBt-(pJga^(VjH|8|GT2^%{KhemKsi2`qFW5kZQkj!J8^HeR z&bA7z?X6~u#=_)Xm!vTVs_ogKmgoE11r$p2j2G5%%>SkK)Mfhz`yvO$g)M9sC@5b; zL7mU!Q+Q7w3j*tKq0=Tw*s&vB>BK#wWNT8;I&-T8h=owlO)PH4B&8QV(9n-nX;-cG z5fo$gP#fPdF+Iz4=Ep8M&8WFE^%0|KkdQO&3WJO>*j5VeEOuT@@J#-n1Zn+xf=FjN z?{${YzI)D2C0i$u-(FI2V3vj+j~sadz^t$MF1}cCHVGo;jh2|)E>w^SIj3ndo_-Q0 z(xDnp_>>0w6 z$NT95czGx8Mx11Kl5ptpME~8)IH&0YVLi7!UEOMz!Y5wVqFk;gB5 zZy4g80303YYOh;@+$s%HDPFeA6j64^GxKt1d}!(sAnUh{ylAax(H)o!+8A1g8Ko~} zZ~F9`+i%5c#@@Z_wVZ!bQ?Dxv`43(^EBFMHS1b>dixc3f2VIVB-7;K~IIE|qS1Wo; zWY(_gJfA(uYg7_IM=7`T&bS%ZF*e1tV0a>Nz-u`=kHGA>B19q{71Mf-ZW6#zQC`T@ zZo-C>7c$_WhR(J^b4GxP1OsMnstY?b*UnkkoN2a(RHd%7Js%t;cRi4{Yo3``!WjPn8>mCV$69an zrJ1z3iy_Bn#%AgHH3g&5P8DNN2eWu=n!CR|x>gy)*#V5Xm^#wA! zae%#MI6C*}g8Qd%UVy>dz|cr;$ptfw{wcLnA}h@CNqgQT(bI)@3?E#Ny?%VzN2Q#~ zZNe?jw&Q&uQewWp5{Qkg6LFhX9fM>$h;WCq>hb4;91SvLU;V(7t_XCAdpfSU>FQwk zKUrs$FYPEjI~MHM(71x;dk^7{8~<=SD0u5tu$P<;is%&?HQ)vmgN|gi8JE!o(|7B= zL^>EHI{V82V1$}0d!N?J{7((*_|*1QeCgN(LP!{tD95)P|AUNJ=YUi1Y&g+^Pdeh2 z0_X(>K@Q9Ial+4`#ftj^;GZ|6;$ccYiyvqdT-muMm!%G$=$*0+UdaQX8>3d|b~A zz@B3Rz&PL--NwF820e}5@Sl5YdGz5hFjQ0S)2MH@DAxt~lTrdwQm6VZT(GES5q5iN zaaaju4X)vVr+7%0Ywa!lo=lZ4wG(1T7YPCMxFxwbF!0LxfF6a^q=d`s9A?6&U-OS;6CnMopz zPFUrLb93>n{+O1}E)+%FPT0B;Q^0)Zib0&YWQKfE$)nEJJ^s(H;Pegr9M3#s28yeM zmx~N>9p73K)7pAj+Xfk05Z8E^{}>!0NENo94)9@krL2RjBw;q~pu?AB>3kInk^^jp zCgQoFKqHtgPOdGWiW{mq8~x+ZX`;a)9HAHZn5ox99iip4>4xU(7pFQk{qWaNjNPmg z1H+d0nb$L#maO{0=)7OtY!fg)$|mM5ruiX0Vlzx5vrgCR1(3E0^+dU*hq@+;4on^7hX`{0>98@n`Pv`qy^MXn5HK$b?87 z*nZp^ov01%U(GQEfK))Bj@DMtpsvdeQJuu));A$wRjDA@mQh7sxa{-DFjG~4ek^ln(kc1c$2gVe5b5d3MP}|ubatkTFPU?rS zfgUO*=p2o7U*ZB?4w85L&Q70tR?IIhFP*1t$CCnh#fPw=U$K0^)H3q-X5}Fv4oaK= z$GT8?FwcqzU4yiC3LUxLiFyb8BJ z)@fJkRc1IwC6lGj&XE6vcn{t0dQ$=4_gH^O4$j08A-8kIm1*+fxJaR4k&MD-^0z2r zj-U3Wg~oKw(;w)B4)Qr*q*IuXInbi)bbn zQgu6L^*gOTB^EWx2$MC47ua{bmp5L1LGFTt*?mCyNl`dW;KfB*qDw(#1kNOOLS^3`r-MlwEr69E;2iuDvSwJrV z)#0WN>g`)!b8J8Fd8_@Wb{j};{KD}XW|4lLjr1wc`Pus~NZ6x5Oyhn2uB8|N;&@*7 zY-Uh3Jq+m>m&5m=0lf}dt=u}u?efb~Befwy+mB!r^7JXd^aL(wdW9L1H+35zm3I!{ z?e1@FD%?X{el%>06R}qFW3@74=?lfjbQ%WLTOoBH^4M{-pui;w&&5*u^L7nS5D(8E zi!rs_ZC9FfMTXf=6Hhta5vcraWu8nekH#>5j_#C`#hzcmxk&SiLFS`0uixm?1Q2U} z$XJH1!kq1gUR2F$zo`K~uNC^mck3b)$c;#4R$^VLVvtVSWx6M(CzucH7d}Mg>!jUzym!)G0e2>6m*OZ`TA`Q+pYVHDl@rKgYjERx(6K0+`4u z`7;?;a-Ck)_s%u~xAxBOw}j>w+V22LgMW>%?DpB)P`|6O&aR48Ra9{O z9lMqZ9lJ}rnZ>;}59cRb5m}gK&}D{YT?q!f^exBk+8X$)Z>2F=TDNvDFSTCj@)-M% z`Gd@5l^7hkDZ%4m%9J^b9W6T=CO_2BOkqlZrYt*fzoG}pN9o32QKDO&vUW~` z)PGOjKab!|2;jf2zwK57I$&==-Kwq4HMi7w90Pmc{(xP@dv~!55EL9dKs0b4PvV!O f`~D9SR_PbBz8UL Date: Fri, 23 Feb 2018 18:38:32 -0800 Subject: [PATCH 04/28] more work for multifactor unlock --- .../feature-multifactor-unlock.md | 43 ++++++++++++------- 1 file changed, 27 insertions(+), 16 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 31859ed9fc..0af19c6bda 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -18,7 +18,7 @@ ms.date: 02/23/2018 * Hybird Azure AD joined (Hybrid deployments) * Domain Joined (on-premises deployments) * Windows 10, version 1709 -* Bluetooth, Bluetooth capable smartphone - optional +* Bluetooth, Bluetooth capable phone - optional Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. @@ -32,23 +32,30 @@ Which organizations can take advanage of Multifactor unlock? Those who: You enable multifactor unlock using Group Policy. The **Configure device unlock factors** policy setting is located under **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. -The policy setting has three components: -* First unlock factor credential provider -* Second unlock factor credential provider -* Signal rules for device unlock - ## The Basics: How it works First unlock factor credential provider and Second unlock credential provider are repsonsible for the bulk of the configuration. Each of these components contains a globally unqiue identifier (GUID) that represents a different Windows credential provider. With the policy setting enabled, users unlock the device using at least one credenital provider from each category before Windows allows the user to proceed to their desktop. -The credenital providers included in the default policy settings are: +The policy setting has three components: +* First unlock factor credential provider +* Second unlock factor credential provider +* Signal rules for device unlock + +## Configuring Unlock Factors + +The **First unlock factor credential providers** and **Second unlock factor credential providers** portion of the policy setting each contain a comma separated list of credential providers. + +Supported credential providers include: |Credential Provider| GUID| -|:------------------|:----:| +|:------------------|:----| |PIN | \{D6886603-9D2F-4EB2-B667-1971041FA96B}| |Fingerprint | \{BEC09223-B018-416D-A0AC-523971B639F5}| |Facial Recognition | \{8AF662BF-65A0-4D0A-A540-A338A999D36F}| -|Trusted Signal | \{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}| +|Trusted Signal
(Phone proximity, Network location) | \{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}| + +>[!NOTE] +>Multifactor unlock does not support third-party credential providers or credential providers not listed in the above table. The default credential providers for the **First unlock factor credential provider** include: * PIN @@ -59,15 +66,18 @@ The default credential providers for the **Second unlock factor credential provi * Trusted Signal * PIN +Configure a comma separated list of credential provider GUIDs you want to use as first and second unlock factors. While a credential provider can appear in both lists, remember that a credential supported by that provider can only satisfy one of the unlock factors. Listed credential providers do not need to be in any specific order. + +For example, if you include the PIN and fingerprint credential providers in both first and second factor lists, a user can use their fingerprint or PIN as the first unlock factor. However, whichever factor they used to satisfy the first unlock factor cannot be used to satisfy the second unlock factor. + + +## Configure Signal Rules for the Trusted Signal Credential Provider + The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. -The default signal rules for the policy setting include the proximity of any paired bluetooth smartphone. +The default signal rules for the policy setting include the proximity of any paired bluetooth phone.
+` ` -To successfully reach their desktop, the user must satisfy one credential provider from each category. The order in which the user satisfies each credential provider does not matter. Therefore, using the default policy setting a user can provide: -* PIN and Fingerprint -* PIN and Facial Recognition -* Fingerprint and PIN -* Facial Recognition and Trusted Signal (bluetooth paired smartphone) >[!IMPORTANT] > * PIN **must** be in at least one of the groups @@ -96,5 +106,6 @@ The Group Policy object contains the policy settings needed to trigger Windows H 6. In the navigation pane, expand **Policies** under **Computer Configuration**. 7. Expand **Administrative Templates > Windows Component**, and select **Windows Hello for Business**.
![Group Policy Editor](images/multifactorUnlock/gpme.png) -8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values. +8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values.
+![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) From 0b10162e7920bec4e897f77fc7e8b6df55b20d97 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 5 Mar 2018 17:04:30 -0800 Subject: [PATCH 05/28] Completed work moving multifactor unlock on its own page that includes configuration information. --- .../feature-multifactor-unlock.md | 183 +++++++++++++++++- .../hello-for-business/hello-features.md | 78 +------- .../hello-for-business/toc.md | 3 +- 3 files changed, 182 insertions(+), 82 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 0af19c6bda..5d77353c51 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 02/23/2018 +ms.date: 03/5/2018 --- # Multifactor Unlock @@ -73,18 +73,187 @@ For example, if you include the PIN and fingerprint credential providers in both ## Configure Signal Rules for the Trusted Signal Credential Provider -The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. +The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. + +### Rule element +You represent signal rules in XML. Each signal rule has an starting and ending **rule** element that contains the **schemaVersion** attribute and value. The current supported scheam version is 1.0. + +|Attribute|Value| +|---------|-----| +|schemaVersion| "1.0"| + +**Example**
+``` + + +``` + +### Signal element +Each rule element has a **signal** element. All signal elements have a **type** element and value. Windows 10, version 1709 supports the **ipConfig** and **bluetooth** type values.
+ +|Attribute|Value| +|---------|-----| +| type| "bluetooth" or "ipConfig" (Windows 10, version 1709)| + +#### Bluetooth +You define the bluetooth signal with additional attribute in the signal elment. The bluetooth configuration does not use any other elements. You can end the signal element with short ending tag "\/>". + +|Attribute|Value|Required| +|---------|-----|--------| +|type|"bluetooth"|yes| +|scenario|"Authentication"|yes| +|classOfDevice|"*number*"|no| +|rssiMin|"*number*"|no| +|rssiMaxDelta|"*number*"|no| +|sessionId|"*number*"|no| + +Example: +``` + + + +``` +The **classofDevice** attribute defaults Phones and uses the values from the following table + +|Description|Value| +|:-------------|:-------:| +|Miscellaneous|0| +|Computer|256| +|Phone|512| +|LAN/Network Access Point|768| +|Audio/Video|1024| +|Peripheral|1280| +|Imaging|1536| +|Wearable|1792| +|Toy|2048| +|Health|2304| +|Uncategorized|7936| + +The **rssiMin** attribute value signal indicates the strength needed for the device to be considered "in-range". The default value of **-10** enables a user to move about an average size office or cubicle without triggering Windows to lock the device. The **rssiMaxDelta** has a default value of **-10**, which instruct Windows 10 to lock the device once the signal strength weakens by more than measurement of 10. + +RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. + +>[!IMPORTANT] +>Microsoft recommends using the default values for this policy settings. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. + +#### IP Configuration +You define IP configuration signals using one or more ipConfiguration elements. Each element has a string value. IpConfiguraiton elements do not have attributes or nested elements. + +##### IPv4Prefix +The IPv4 network prefix represented in Internet standard dotted-decimal notation. A network prefix that uses the Classless Inter-Domain Routing (CIDR) notation is required as part of the network string. A network port must not be present in the network string. A **signal** element may only contain one **ipv4Prefix** element.
+**Example** +``` +192.168.100.0/24 +``` +##### IPv4Gateway +The IPv4 network gateway represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4Gateway** element.
+**Example** +``` +192.168.100.10 +``` +##### IPv4DhcpServer +The IPv4 DHCP server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4DhcpServer** element.
+**Example** +``` +192.168.100.10 +``` +##### IPv4DnsServer +The IPv4 DNS server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string.The **signal** element may contain one or more **ipv4DnsServer** elements.
+**Example:** +``` +192.168.100.10 +``` + +##### IPv6Prefix +The IPv6 network prefix represented in IPv6 network using Internet standard hexadecimal encoding. A network prefix in CIDR notation is required as part of the network string. A network port or scope ID must not be present in the network string. A **signal** element may only contain one **ipv6Prefix** element.
+**Example** +``` +21DA:D3::/48 +``` + +##### IPv6Gateway +The IPv6 network gateway represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv6Gateway** element.
+**Example** +``` +21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 +``` + +##### IPv6DhcpServer +The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv6DhcpServer** element.
+**Example** +``` +21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 +**Example syntax** +``` +21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 +``` +##### dnsSuffix +The fully qualified domain name of your organizations internal dns suffix where any part of the fully qualified domain name in this setting exists in the computer's primary dns suffix. The **signal** element may contain one or more **dnsSuffix** elements. + +Windows 10, version 1703 includes two trusted signal types, which are bluetooth and IP configuration The default signal rules for the policy setting include the proximity of any paired bluetooth phone.
` ` + >[!IMPORTANT] > * PIN **must** be in at least one of the groups > * Trusted signals **must** be combined with another credential provider -> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can be used to satisfy either category, but not both. +> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. -## Configuring Multifactor Unlock +### Sample Trusted Signal Congfigurations + +These examples are wrapped for readability. Once properly formatted, the entire XML contents must be a single line. + +#### Example 1 +This example configures an IPConfig signal type using Ipv4Prefix, Ipv4DnsServer, and DnsSuffix elements. +``` + + + 10.10.10.0/24 + 10.10.0.1 + 10.10.0.2 + corp.contoso.com + + +``` + + +#### Example 2 +This example configures an IpConfig signal type using a dnsSuffix element and a bluetooth signal for phones. This configuration is wrapped for reading. Once properly formatted, the entire XML contents must be a single line. +>[!NOTE] +>Separate each rule element using a comma. + +``` + + + corp.contoso.com + +, + + + +``` +#### Example 3 +This example configures the same as example 2 using compounding And elements. +``` + + + + corp.microsoft.com + + + + +``` + + +## Deploying Multifactor Unlock >[!IMPORTANT] >Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). @@ -95,7 +264,7 @@ You need a Windows 10, version 1709 workstation to run the Group Policy Manageme Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. -#### Create the Multifactor Unlock Group Policy object +### Create the Multifactor Unlock Group Policy object The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. 1. Start the **Group Policy Management Console** (gpmc.msc) @@ -108,4 +277,8 @@ The Group Policy object contains the policy settings needed to trigger Windows H ![Group Policy Editor](images/multifactorUnlock/gpme.png) 8. In the content pane, double-click **Configure device unlock factors**. Click **Enable**. The **Options** section populates the policy setting with default values.
![Multifactor Policy Setting](images/multifactorUnlock/gp-setting.png) +9. Configure first and second unlock factors using the information in the [Configure Unlock Factors](#configuring-unlock-factors) section. +10. If using trusted signals, configure the trusted signals used by the unlock factor using the information in the [Configure Signal Rules for the Trusted Signal Credential Provider](#configure-signal-rules-for-the-trusted-signal-credential-provider) section. +11. Click **Ok** to close the **Group Policy Management Editor**. Use the **Group Policy Management Console** to deploy the newly created Group Policy object to your organization's computers. + diff --git a/windows/security/identity-protection/hello-for-business/hello-features.md b/windows/security/identity-protection/hello-for-business/hello-features.md index 5c6fcc07d2..1800c4b80f 100644 --- a/windows/security/identity-protection/hello-for-business/hello-features.md +++ b/windows/security/identity-protection/hello-for-business/hello-features.md @@ -10,7 +10,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 12/04/2017 +ms.date: 3/5/2018 --- # Windows Hello for Business Features @@ -20,7 +20,6 @@ Consider these additional features you can use after your organization deploys W * [Dynamic lock](#dynamic-lock) * [PIN reset](#pin-reset) * [Privileged credentials](#privileged-credentials) -* [Mulitfactor Unlock](#multifactor-unlock) ## Conditional access @@ -153,77 +152,4 @@ The privileged credentials scenario enables administrators to perform elevated, By design, Windows 10 does not enumerate all Windows Hello for Business users from within a user's session. Using the computer Group Policy setting, Allow enumeration of emulated smartd card for all users, you can configure a device to all this enumeration on selected devices. -With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal workflow such as email, but can launch Microsoft Managment Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternativing between privileged and non-privileged workloads. - -## Multifactor Unlock - -**Requirements:** -* Windows Hello for Business deployment (Hybrid or On-premises) -* Hybird Azure AD joined (Hybrid deployments) -* Domain Joined (on-premises deployments) -* Windows 10, version 1709 -* Bluetooth, Bluetooth capable smartphone - optional - -Windows, today, natively only supports the use of a single credential (password, PIN, fingerprint, face, etc.) for unlocking a device. Therefore, if any of those credentials are compromised (shoulder surfed), an attacker could gain access to the system. - -Windows 10 offers Multifactor device unlock by extending Windows Hello with trusted signals, administrators can configure Windows 10 to request a combination of factors and trusted signals to unlock their devices. - -Which organizations can take advanage of Multifactor unlock? Those who: -* Have expressed that PINs alone do not meet their security needs. -* Want to prevent Information Workers from sharing credentials. -* Want their orgs to comply with regulatory two-factor authentication policy. -* Want to retain the familiar Windows logon UX and not settle for a custom solution. - ->[!IMPORTANT] ->Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). - -You enable multifactor unlock using Group Policy. The **Configure device unlock factors** policy setting is located under **Computer Configuration\Administrative Templates\Windows Components\Windows Hello for Business**. - -The policy setting has three components: -* First unlock factor credential provider -* Second unlock factor credential provider -* Signal rules for device unlock - -### The Basics: How it works - -First unlock factor credential provider and Second unlock credential provider are repsonsible for the bulk of the configuration. Each of these components contains a globally unqiue identifier (GUID) that represents a different Windows credential provider. With the policy setting enabled, users unlock the device using at least one credenital provider from each category before Windows allows the user to proceed to their desktop. - -The credenital providers included in the default policy settings are: - -|Credential Provider| GUID| -|:------------------|:----:| -|PIN | \{D6886603-9D2F-4EB2-B667-1971041FA96B}| -|Fingerprint | \{BEC09223-B018-416D-A0AC-523971B639F5}| -|Facial Recognition | \{8AF662BF-65A0-4D0A-A540-A338A999D36F}| -|Trusted Signal | \{27FBDB57-B613-4AF2-9D7E-4FA7A66C21AD}| - -The default credential providers for the **First unlock factor credential provider** include: -* PIN -* Fingerprint -* Facial Recongition - -The default credential providers for the **Second unlock factor credential provider** include: -* Trusted Signal -* PIN - -The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. - -The default signal rules for the policy setting include the proximity of any paired bluetooth smartphone. - -To successfully reach their desktop, the user must satisfy one credential provider from each category. The order in which the user satisfies each credential provider does not matter. Therefore, using the default policy setting a user can provide: -* PIN and Fingerprint -* PIN and Facial Recognition -* Fingerprint and PIN -* Facial Recognition and Trusted Signal (bluetooth paired smartphone) - ->[!IMPORTANT] -> * PIN **must** be in at least one of the groups -> * Trusted signals **must** be combined with another credential provider -> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can be used to satisfy either category, but not both. - - - - - - - +With this setting, administrative users can sign-in to Windows 10, version 1709 using their non-privileged Windows Hello for Business credentials for normal workflow such as email, but can launch Microsoft Managment Consoles (MMCs), Remote Desktop Services clients, and other applications by selecting **Run as different user** or **Run as administrator**, selecting the privileged user account, and providing their PIN. Administrators can also take advantage of this feature with command line applications by using **runas.exe** combined with the **/smartcard** argument. This enables administrators to perform their day-to-day operations without needing to sign-in and out, or use fast user switching when alternativing between privileged and non-privileged workloads. \ No newline at end of file diff --git a/windows/security/identity-protection/hello-for-business/toc.md b/windows/security/identity-protection/hello-for-business/toc.md index 81267549c1..86c01a544c 100644 --- a/windows/security/identity-protection/hello-for-business/toc.md +++ b/windows/security/identity-protection/hello-for-business/toc.md @@ -43,4 +43,5 @@ ##### [Configure or Deploy Multifactor Authentication Services](hello-cert-trust-deploy-mfa.md) #### [Configure Windows Hello for Business Policy settings](hello-cert-trust-policy-settings.md) -## [Windows Hello for Business Features](hello-features.md) \ No newline at end of file +## [Windows Hello for Business Features](hello-features.md) +### [Multifactor Unlock](feature-multifactor-unlock.md) \ No newline at end of file From ea50ef26fbf5cb58eec49de95411af495968733c Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 6 Mar 2018 06:47:22 -0800 Subject: [PATCH 06/28] fixes --- .../feature-multifactor-unlock.md | 41 ++++++++----------- 1 file changed, 17 insertions(+), 24 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 5d77353c51..5d9d741fa1 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -76,13 +76,8 @@ For example, if you include the PIN and fingerprint credential providers in both The **Signal rules for device unlock** setting contains the rules the Trusted Signal credential provider uses to satisfy unlocking the device. ### Rule element -You represent signal rules in XML. Each signal rule has an starting and ending **rule** element that contains the **schemaVersion** attribute and value. The current supported scheam version is 1.0. - -|Attribute|Value| -|---------|-----| -|schemaVersion| "1.0"| - -**Example**
+You represent signal rules in XML. Each signal rule has an starting and ending **rule** element that contains the **schemaVersion** attribute and value. The current supported scheam version is 1.0.
+**Example** ``` @@ -105,7 +100,6 @@ You define the bluetooth signal with additional attribute in the signal elment. |classOfDevice|"*number*"|no| |rssiMin|"*number*"|no| |rssiMaxDelta|"*number*"|no| -|sessionId|"*number*"|no| Example: ``` @@ -155,13 +149,13 @@ The IPv4 network gateway represented in Internet standard dotted-decimal notatio The IPv4 DHCP server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4DhcpServer** element.
**Example** ``` -192.168.100.10 +192.168.100.10 ``` ##### IPv4DnsServer The IPv4 DNS server represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string.The **signal** element may contain one or more **ipv4DnsServer** elements.
**Example:** ``` -192.168.100.10 +192.168.100.10 ``` ##### IPv6Prefix @@ -187,24 +181,16 @@ The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IP ##### IPv6DnsServer The IPv6 DNS server represented in Internet standard hexadecimal encoding. An IPv6 scope ID may be present in the network string. A network port or prefix must not be present in the network string. The **signal** element may contain one or more **ipv6DnsServer** elements.
-**Example syntax** +**Example** ``` 21DA:00D3:0000:2F3B:02AA:00FF:FE28:9C5A%2 ``` ##### dnsSuffix -The fully qualified domain name of your organizations internal dns suffix where any part of the fully qualified domain name in this setting exists in the computer's primary dns suffix. The **signal** element may contain one or more **dnsSuffix** elements. - -Windows 10, version 1703 includes two trusted signal types, which are bluetooth and IP configuration - -The default signal rules for the policy setting include the proximity of any paired bluetooth phone.
-` ` - - - ->[!IMPORTANT] -> * PIN **must** be in at least one of the groups -> * Trusted signals **must** be combined with another credential provider -> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. +The fully qualified domain name of your organizations internal dns suffix where any part of the fully qualified domain name in this setting exists in the computer's primary dns suffix. The **signal** element may contain one or more **dnsSuffix** elements.
+**Example** +``` +corp.contoso.com +``` ### Sample Trusted Signal Congfigurations @@ -264,9 +250,16 @@ You need a Windows 10, version 1709 workstation to run the Group Policy Manageme Alternatively, you can create copy the .ADMX and .ADML files from a Windows 10, version 1703 to their respective language folder on a Windows Server or you can create a Group Policy Central Store and copy them their respective language folder. See [How to create and manage the Central Store for Group Policy Administrative Templates in Windows](https://support.microsoft.com/help/3087759/how-to-create-and-manage-the-central-store-for-group-policy-administrative-templates-in-windows) for more information. + ### Create the Multifactor Unlock Group Policy object The Group Policy object contains the policy settings needed to trigger Windows Hello for Business provisioning and to ensure Windows Hello for Business authentication certificates are automatically renewed. + +>[!IMPORTANT] +> * PIN **must** be in at least one of the groups +> * Trusted signals **must** be combined with another credential provider +> * You cannot use the same unlock factor to satisfy both categories. Therefore, if you include any credential provider in both categories, it means it can satisfy either category, but not both. + 1. Start the **Group Policy Management Console** (gpmc.msc) 2. Expand the domain and select the **Group Policy Object** node in the navigation pane. 3. Right-click **Group Policy object** and select **New**. From 5ff0098c846c43e20d88b45754d3a930627d940a Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 12 Mar 2018 06:49:25 -0700 Subject: [PATCH 07/28] Finished Edits for multifactor unlock --- .../feature-multifactor-unlock.md | 27 ++++++++++++++----- 1 file changed, 20 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 5d9d741fa1..0ed18314c4 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -68,7 +68,7 @@ The default credential providers for the **Second unlock factor credential provi Configure a comma separated list of credential provider GUIDs you want to use as first and second unlock factors. While a credential provider can appear in both lists, remember that a credential supported by that provider can only satisfy one of the unlock factors. Listed credential providers do not need to be in any specific order. -For example, if you include the PIN and fingerprint credential providers in both first and second factor lists, a user can use their fingerprint or PIN as the first unlock factor. However, whichever factor they used to satisfy the first unlock factor cannot be used to satisfy the second unlock factor. +For example, if you include the PIN and fingerprint credential providers in both first and second factor lists, a user can use their fingerprint or PIN as the first unlock factor. However, whichever factor they used to satisfy the first unlock factor cannot be used to satisfy the second unlock factor. Each factor can therefore be used exactly once. The Trusted Signal provider can *only* be specified as part of the Second unlock factor credential provider list. ## Configure Signal Rules for the Trusted Signal Credential Provider @@ -128,10 +128,10 @@ The **rssiMin** attribute value signal indicates the strength needed for the dev RSSI measurements are relative and lower as the bluetooth signals between the two paired devices reduces. Therefore a measurement of 0 is stronger than -10, which is stronger than -60, which is an indicator the devices are moving further apart from each other. >[!IMPORTANT] ->Microsoft recommends using the default values for this policy settings. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. +>Microsoft recommends using the default values for this policy settings. Measurements are relative, based on the varying conditions of each environment. Therefore, the same values may produce different results. Test policy settings in each environment prior to broadly deploying the setting. Use the rssiMIN and rssiMaxDelta values from the XML file created by the Group Policy Management Editor or remove both attributes to use the default values. #### IP Configuration -You define IP configuration signals using one or more ipConfiguration elements. Each element has a string value. IpConfiguraiton elements do not have attributes or nested elements. +You define IP configuration signals using one or more ipConfiguration elements. Each element has a string value. IpConfiguration elements do not have attributes or nested elements. ##### IPv4Prefix The IPv4 network prefix represented in Internet standard dotted-decimal notation. A network prefix that uses the Classless Inter-Domain Routing (CIDR) notation is required as part of the network string. A network port must not be present in the network string. A **signal** element may only contain one **ipv4Prefix** element.
@@ -139,6 +139,8 @@ The IPv4 network prefix represented in Internet standard dotted-decimal notation ``` 192.168.100.0/24 ``` +The assigned IP’s in the range of 192.168.100.1 to 192.168.100.254 match this signal configuration. + ##### IPv4Gateway The IPv4 network gateway represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4Gateway** element.
**Example** @@ -211,7 +213,7 @@ This example configures an IPConfig signal type using Ipv4Prefix, Ipv4DnsServer, #### Example 2 -This example configures an IpConfig signal type using a dnsSuffix element and a bluetooth signal for phones. This configuration is wrapped for reading. Once properly formatted, the entire XML contents must be a single line. +This example configures an IpConfig signal type using a dnsSuffix element and a bluetooth signal for phones. This configuration is wrapped for reading. Once properly formatted, the entire XML contents must be a single line. This example implies that either the ipconfig **or** the Bluetooth rule must evaluate to true, for the resulting signal evaluation to be true. >[!NOTE] >Separate each rule element using a comma. @@ -226,7 +228,7 @@ This example configures an IpConfig signal type using a dnsSuffix element and a ``` #### Example 3 -This example configures the same as example 2 using compounding And elements. +This example configures the same as example 2 using compounding And elements. This example implies that the ipconfig **and** the Bluetooth rule must evaluate to true, for the resulting signal evaluation to be true. ``` @@ -242,7 +244,7 @@ This example configures the same as example 2 using compounding And elements. ## Deploying Multifactor Unlock >[!IMPORTANT] ->Once the you deploy multifactor unlock policies, users are not be able to unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). +>You need to remove all third party credential providers to ensure users cannot unlock their devices if they do not have the required factors. The fall back options are to use passwords or smart cards (both of which could be disabled as needed). ### How to configure Multifactor Unlock policy settings @@ -274,4 +276,15 @@ The Group Policy object contains the policy settings needed to trigger Windows H 10. If using trusted signals, configure the trusted signals used by the unlock factor using the information in the [Configure Signal Rules for the Trusted Signal Credential Provider](#configure-signal-rules-for-the-trusted-signal-credential-provider) section. 11. Click **Ok** to close the **Group Policy Management Editor**. Use the **Group Policy Management Console** to deploy the newly created Group Policy object to your organization's computers. - + ## Troubleshooting +Mulitfactor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. + +### Events + +|Event ID | Details| +|*********|********| +|3520|Unlock attempt initiated.| +|5520|Unlock policy not configured.| +|6520|Warning event.| +|7520|Error event.| +|8520|Success event.| From 7f054179c0e49714be61c9a23f4f7aaf39120d27 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 12 Mar 2018 08:40:12 -0700 Subject: [PATCH 08/28] edits to multifactor unlock --- .../hello-for-business/feature-multifactor-unlock.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 0ed18314c4..d661f6e23b 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -139,7 +139,7 @@ The IPv4 network prefix represented in Internet standard dotted-decimal notation ``` 192.168.100.0/24 ``` -The assigned IP’s in the range of 192.168.100.1 to 192.168.100.254 match this signal configuration. +The assigned IPv4 addresses in the range of 192.168.100.1 to 192.168.100.254 match this signal configuration. ##### IPv4Gateway The IPv4 network gateway represented in Internet standard dotted-decimal notation. A network port or prefix must not be present in the network string. A **signal** element may only contain one **ipv4Gateway** element.
@@ -281,8 +281,8 @@ Mulitfactor unlock writes events to event log under **Application and Services L ### Events -|Event ID | Details| -|*********|********| +|Event ID|Details| +|********|*******| |3520|Unlock attempt initiated.| |5520|Unlock policy not configured.| |6520|Warning event.| From 4285e11b5ef52707de66911132f23c9c3506f836 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Mon, 12 Mar 2018 09:11:44 -0700 Subject: [PATCH 09/28] troubleshooting a table issue --- .../feature-multifactor-unlock.md | 13 ++++++------- 1 file changed, 6 insertions(+), 7 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index d661f6e23b..fec8954348 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -280,11 +280,10 @@ The Group Policy object contains the policy settings needed to trigger Windows H Mulitfactor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. ### Events - |Event ID|Details| -|********|*******| -|3520|Unlock attempt initiated.| -|5520|Unlock policy not configured.| -|6520|Warning event.| -|7520|Error event.| -|8520|Success event.| +|:********:|:*******| +|3520|Unlock attempt initiated| +|5520|Unlock policy not configured| +|6520|Warning event| +|7520|Error event| +|8520|Success event| From 5edbefd5e5e1b16ca5722723461bd79b3f3a25e8 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 19 Mar 2018 22:52:13 +0000 Subject: [PATCH 10/28] Merged PR 6470: Bluetooth/ServicesAllowedList policy - added a usage guide --- ...ew-in-windows-mdm-enrollment-management.md | 4 + .../mdm/policy-csp-bluetooth.md | 91 ++++++++++++++++++- 2 files changed, 94 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 04192347f7..9fcd4410f0 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1663,6 +1663,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • TextInput/AllowIMENetworkAccess - when this policy is set to 1, suggestions from the Microsoft AI chatbot Rinna are enabled in the Japanese IME.
    • + +[Policy CSP - Bluetooth](policy-csp-bluetooth.md) +

    Added new section [ServicesAllowedList usage guide](policy-csp-bluetooth.md#servicesallowedlist-usage-guide).

    + diff --git a/windows/client-management/mdm/policy-csp-bluetooth.md b/windows/client-management/mdm/policy-csp-bluetooth.md index fb08f30dc0..7c004110fe 100644 --- a/windows/client-management/mdm/policy-csp-bluetooth.md +++ b/windows/client-management/mdm/policy-csp-bluetooth.md @@ -282,7 +282,7 @@ If this policy is not set or it is deleted, the default local radio name is used Set a list of allowable services and profiles. String hex formatted array of Bluetooth service UUIDs in canonical format, delimited by semicolons. For example, {782AFCFC-7CAA-436C-8BF0-78CD0FFBD4AF}. -The default value is an empty string. +The default value is an empty string. For more information, see [ServicesAllowedList usage guide](#servicesallowedlist-usage-guide) @@ -297,6 +297,95 @@ Footnote: +## ServicesAllowedList usage guide + +When the Bluetooth/ServicesAllowedList policy is provisioned, it will only allow pairing and connections of Windows PCs and phones to explicitly define Bluetooth profiles and services. It is an allowed list, enabling admins to still allow custom Bluetooth profiles that are not defined by the Bluetooth Special Interests Group (SIG). + +To define which profiles and services are allowed, enter the profile or service Universally Unique Identifiers (UUID) using semicolon delimiter. To get a profile UUID, refer to the [Service Discovery](https://www.bluetooth.com/specifications/assigned-numbers/service-discovery) page on the Bluetooth SIG website. + +These UUIDs all use the same base UUID with the profile identifiers added to the beginning of the base UUID. + +Here are some examples: + +**Bluetooth Headsets for Voice (HFP)** + +BASE_UUID = 0x00000000-0000-1000-8000-00805F9B34FB + +|UUID name |Protocol specification |UUID | +|---------|---------|---------| +|HFP(Hands Free Profile) |Hands-Free Profile (HFP) * |0x111E | + +Footnote: * Used as both Service Class Identifier and Profile Identifier. + +Hands Free Profile UUID = base UUID + 0x111E to the beginning = 0000111E-0000-1000-8000-00805F9B34FB + +**Allow Audio Headsets only (Voice)** + +|Profile |Reasoning |UUID | +|---------|---------|---------| +|HFP (Hands Free Profile) |For voice enabled headsets |0x111E | +|GAP (Generic Access Profile)* |Generic service used by Bluetooth |0x1800 | +|DID (Device ID)* |Generic service used by Bluetooth |0x180A | +|Scan Parameters* |Generic service used by Bluetooth |0x1813 | + +Footnote: * *GAP, DID, and Scan Parameter are required, as these are underlying profiles and services used by all Bluetooth devices. + +This means that if you only want Bluetooth headsets, the UUIDs are: + +{0000111E-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB} + +**Allow Audio Headsets and Speakers (Voice & Music)** + +|Profile |Reasoning |UUID | +|---------|---------|---------| +|HFP (Hands Free Profile) |For voice enabled headsets |0x111E | +|A2DP Source (Advance Audio Distribution)|For streaming to Bluetooth speakers |0x110A | +|GAP (Generic Access Profile) |Generic service used by Bluetooth |0x1800 | +|Device ID (DID) |Generic service used by Bluetooth |0x180A | +|Scan Parameters |Generic service used by Bluetooth |0x1813 | + +{0000111E-0000-1000-8000-00805F9B34FB};{0000110A-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB} + +**Classic Keyboards and Mice** + +|Profile |Reasoning |UUID | +|---------|---------|---------| +|HID (Human Interface Device) |For classic BR/EDR keyboards and mice |0x1124 | +|GAP (Generic Access Profile) |Generic service used by Bluetooth |0x1800 | +|DID (Device ID) |Generic service used by Bluetooth |0x180A | +|Scan Parameters |Generic service used by Bluetooth |0x1813 | + +{00001801-0000-1000-8000-00805F9B34FB};{00001812-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB} + +> [!Note] +> For both Classic and LE use a super set of the two formula’s UUIDs + +**LE Keyboards and Mice** + +|Profile |Reasoning |UUID | +|---------|---------|---------| +|Generic Access Atribute |For the LE Protocol |0x1801 | +|HID Over GATT * |For LE keyboards and mice |0x1812 | +|GAP (Generic Access Profile) |Generic service used by Bluetooth |0x1800 | +|DID (Device ID) |Generic service used by Bluetooth |0x180A | +|Scan Parameters |Generic service used by Bluetooth |0x1813 | + +Footnote: * The Surface pen uses the HID over GATT profile + +{00001801-0000-1000-8000-00805F9B34FB};{00001812-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB} + +**Allow File Transfer** + +|Profile |Reasoning |UUID | +|---------|---------|---------| +|OBEX Object Push (OPP) |For file transfer |0x1105 | +|Object Exchange (OBEX) |Protocol for file transfer |0x0008 | +|Generic Access Profile (GAP) |Generic service used by Bluetooth |0x1800 | +|Device ID (DID) |Generic service used by Bluetooth |0x180A | +|Scan Parameters |Generic service used by Bluetooth |0x1813 | + +{00001105-0000-1000-8000-00805F9B34FB};{00000008-0000-1000-8000-00805F9B34FB};{0000111E-0000-1000-8000-00805F9B34FB};{00001800-0000-1000-8000-00805F9B34FB};{0000180A-0000-1000-8000-00805F9B34FB};{00001813-0000-1000-8000-00805F9B34FB} + ## Bluetooth policies supported by Windows Holographic for Business From 97a435713a8bb20d1e26773cc2ec27cd51628194 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Mon, 19 Mar 2018 23:16:26 +0000 Subject: [PATCH 11/28] Merged PR 6478: InternetExplorer/AllowSiteToZoneAssignmentList in Policy CSP - added SyncML example --- ...ew-in-windows-mdm-enrollment-management.md | 5 ++-- .../mdm/policy-csp-internetexplorer.md | 30 +++++++++++++++++++ 2 files changed, 33 insertions(+), 2 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 9fcd4410f0..b9bf7dd558 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1658,9 +1658,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • Connectivity/AllowPhonePCLinking
  • RestrictedGroups/ConfigureGroupMembership
    • -

    The following policy was updated in Windows 10, version 1803:

    +

    The following existing policies were updated:

      -
    • TextInput/AllowIMENetworkAccess - when this policy is set to 1, suggestions from the Microsoft AI chatbot Rinna are enabled in the Japanese IME.
      • +
    • InternetExplorer/AllowSiteToZoneAssignmentList - updated the description and added an example SyncML
      • +
    • TextInput/AllowIMENetworkAccess - introduced new suggestion services in Japanese IME in addition to cloud suggestion.
    diff --git a/windows/client-management/mdm/policy-csp-internetexplorer.md b/windows/client-management/mdm/policy-csp-internetexplorer.md index 304792e860..38156a6d35 100644 --- a/windows/client-management/mdm/policy-csp-internetexplorer.md +++ b/windows/client-management/mdm/policy-csp-internetexplorer.md @@ -2129,6 +2129,11 @@ Value - A number indicating the zone with which this site should be associated f If you disable or do not configure this policy, users may choose their own site-to-zone assignments. +> [!Note] +> This policy is a list that contains the site and index value. + +The list is a set of pairs of strings. Each string is seperated by F000. Each pair of string are stored as a registry name and value. The registry name is the site and the value is an index. The index has to be sequential. See an example below. + > [!TIP] > This is an ADMX-backed policy and requires a special SyncML format to enable or disable. For details, see [Understanding ADMX-backed policies](./understanding-admx-backed-policies.md). @@ -2145,6 +2150,31 @@ ADMX Info: - GP ADMX file name: *inetres.admx* + +```syntax + + + 2 + + + chr + text/plain + + + ./Device/Vendor/MSFT/Policy/Config/InternetExplorer/AllowSiteToZoneAssignmentList + + <Enabled/><Data id="IZ_ZonemapPrompt" value="http://adfs.contoso.org1http://microsoft.com2"/> + + + + +``` + +Value and index pairs in the SyncML example: +- http://adfs.contoso.org 1 +- http://microsoft.com 2 + +
    From 2a3e2abdb69a9c0defc103f8c04b9bb9167f83ca Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 20 Mar 2018 06:28:40 -0700 Subject: [PATCH 12/28] Attempt to fix a table rendering at the bottom of the page --- .../hello-for-business/feature-multifactor-unlock.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index fec8954348..498c210e44 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -279,7 +279,7 @@ The Group Policy object contains the policy settings needed to trigger Windows H ## Troubleshooting Mulitfactor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. -### Events +**Events ** |Event ID|Details| |:********:|:*******| |3520|Unlock attempt initiated| From e726eede1c7e966e00cd5bfbe6fec25037a8e96e Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 20 Mar 2018 07:14:05 -0700 Subject: [PATCH 13/28] Fixes --- .../hello-for-business/feature-multifactor-unlock.md | 5 ++++- .../hello-for-business/hello-cert-trust-deploy-mfa.md | 10 +++++----- 2 files changed, 9 insertions(+), 6 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 498c210e44..7ab304b61f 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -279,7 +279,8 @@ The Group Policy object contains the policy settings needed to trigger Windows H ## Troubleshooting Mulitfactor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. -**Events ** +### Events + |Event ID|Details| |:********:|:*******| |3520|Unlock attempt initiated| @@ -287,3 +288,5 @@ Mulitfactor unlock writes events to event log under **Application and Services L |6520|Warning event| |7520|Error event| |8520|Success event| + + diff --git a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md b/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md index d2126063c5..99a39e91b2 100644 --- a/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md +++ b/windows/security/identity-protection/hello-for-business/hello-cert-trust-deploy-mfa.md @@ -6,10 +6,10 @@ ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: security, mobile -author: DaniHalfin -ms.localizationpriority: high -ms.author: daniha -ms.date: 07/27/2017 +author: mikestephens-MS +ms.author: mstephen +localizationpriority: high +ms.date: 03/5/2018 --- # Configure or Deploy Multifactor Authentication Services @@ -523,7 +523,7 @@ Before you continue with the deployment, validate your deployment progress by re * Confirm you saved the changes to the web.config file. * Confirm you restarted the AD FS Service after completing the configuration. -## Test AD FS with the Multifactor Authentication connector +## Test Multifactor Authentication Now, you should test your Azure Multi-Factor Authentication server configuration before proceeding any further in the deployment. The AD FS and Azure Multi-Factor Authentication server configurations are complete. From 4d4e8b1b8616555cf7456316b7f05dc12917fd69 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 20 Mar 2018 09:01:20 -0700 Subject: [PATCH 14/28] Table rendering removal for troubleshooting --- .../hello-for-business/feature-multifactor-unlock.md | 11 ----------- 1 file changed, 11 deletions(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 7ab304b61f..7e4a318c9b 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -279,14 +279,3 @@ The Group Policy object contains the policy settings needed to trigger Windows H ## Troubleshooting Mulitfactor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. -### Events - -|Event ID|Details| -|:********:|:*******| -|3520|Unlock attempt initiated| -|5520|Unlock policy not configured| -|6520|Warning event| -|7520|Error event| -|8520|Success event| - - From d328791b8cd9eec472add48bcf0378bb8efb3565 Mon Sep 17 00:00:00 2001 From: Mike Stephens Date: Tue, 20 Mar 2018 09:18:22 -0700 Subject: [PATCH 15/28] Fixed table formatting-- author error. --- .../hello-for-business/feature-multifactor-unlock.md | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md index 7e4a318c9b..b2d6b3e54b 100644 --- a/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md +++ b/windows/security/identity-protection/hello-for-business/feature-multifactor-unlock.md @@ -9,7 +9,7 @@ ms.pagetype: security, mobile author: mikestephens-MS ms.author: mstephen localizationpriority: high -ms.date: 03/5/2018 +ms.date: 03/20/2018 --- # Multifactor Unlock @@ -279,3 +279,12 @@ The Group Policy object contains the policy settings needed to trigger Windows H ## Troubleshooting Mulitfactor unlock writes events to event log under **Application and Services Logs\Microsoft\Windows\HelloForBusiness** with the category name **Device Unlock**. +### Events + +|Event ID|Details| +|:------:|:------| +|3520|Unlock attempt initiated| +|5520|Unlock policy not configured| +|6520|Warning event| +|7520|Error event| +|8520|Success event| From 1d57d4c4f4cab3fb20a364ae909fe88fc68cbf72 Mon Sep 17 00:00:00 2001 From: Trudy Hakala Date: Tue, 20 Mar 2018 17:05:28 +0000 Subject: [PATCH 16/28] Merged PR 6493: Merge msfb-ps to master LOB app time publish updates --- .../distribute-apps-from-your-private-store.md | 6 +++++- store-for-business/images/lob-workflow.png | Bin 0 -> 34107 bytes .../working-with-line-of-business-apps.md | 7 +++++-- 3 files changed, 10 insertions(+), 3 deletions(-) create mode 100644 store-for-business/images/lob-workflow.png diff --git a/store-for-business/distribute-apps-from-your-private-store.md b/store-for-business/distribute-apps-from-your-private-store.md index 3ce46baf61..2228ac8f3e 100644 --- a/store-for-business/distribute-apps-from-your-private-store.md +++ b/store-for-business/distribute-apps-from-your-private-store.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: store author: TrudyHa ms.localizationpriority: high -ms.date: 10/17/2017 +ms.date: 3/19/2018 --- # Distribute apps using your private store @@ -47,6 +47,9 @@ Microsoft Store adds the app to **Apps & software**. Click **Manage**, **Apps & The value under **Private store** for the app will change to pending. It will take approximately thirty-six hours before the app is available in the private store. +>[!Note] + > If you are working with a new Line-of-Business (LOB) app, you have to wait for the app to be avilable in **Products & services** before adding it to your private store. For more information, see [Working with line of business apps](working-with-line-of-business-apps.md). + Employees can claim apps that admins added to the private store by doing the following. **To claim an app from the private store** @@ -57,6 +60,7 @@ Employees can claim apps that admins added to the private store by doing the fol ## Related topics - [Manage access to private store](manage-access-to-private-store.md) +- [Manage private store settings](manage-private-store-settings.md) - [Configure access to Microsoft Store](/windows/configuration/stop-employees-from-using-microsoft-store)   diff --git a/store-for-business/images/lob-workflow.png b/store-for-business/images/lob-workflow.png new file mode 100644 index 0000000000000000000000000000000000000000..954b787e6da7627f8360d7347ba36175da5fdbd3 GIT binary patch literal 34107 zcmeFZXIxWjw=aqn6~Qi802LGk0qIRZML<9hq)81*@4Yu0pwa~CReC4VOCYESNS7{z zA}s+zKsq4=&WLNR{qD8Tx%bok-A{)vLXtV>Q^qsKzl``+SxJ`m$oV5wR8+Kb5AHvv zqB`J4MYZSsp@Zvt-u*Zy?+fB*hQ)#>-%zka`y zkot=L@0TY|GuHh5>+!6aUw>cuTv(c#`|p>(-4J!#^Vjc}l)Apq{Qa{1yZ?J@s{gwn zlxXS3Fu@iVXHv3*t=c;@UB&2hacn&%HLBdG2lA@05OI5m>{uu>M^71OQHA6HkI zMa!0i7V))?`@-CgP}Sd>TxPZ2PS)CL8E%$;@W#dbr4*W~DA;Sy@f-i#q~*bs!hKP< zU8mefuJgi$ET&uawU$&**Jp=M*E)5owxwL zSN*;AJUjKT+nP-){Ddj2>Lan@gIN1%v#khLLXDW_uHn#3%%_VCwChaHX0sh1L`S^4 zrZ-fth4j22tq4pmA68+H6<ol5q ztCMN*_;EtJGF{M~L~(lOMTN!LXj>Q5w$EtOUy?C?coB&h=2KLV2*WOu8eKitT7^2LbJUW)(_h+o&rNm3@1NV8 zd+T-1g?h0H9k|tzL>E2QUU^$ia`V}`ohz-u{@aeE$QF6V#bwkknK`S^muKtL+6V4C zUM&B_2W7)fHvhRpU_f=>pqSZC!uw0)?S;IE@Y7LWzEEA6UzVF(8y-W^JBKiN46E3{$@7J*Y`RVTA!-wS`JophOV413y{$4;xC?1(sUM@J%Sz+9I_9`o@ z*ySCj6{%lw=w_xAWr83vW(dXr;=_noD@)G=OJK>8%C|6{EzE)az_{r!dq*jRx zvS#^RlVEUgaGZp9wV=)L%#x60Rsd;$vtl@vQ>Q#TEsbUKl|k3g&|L9YV`Jk}f^B+% z9!euzO;t55Dk|!F^g%@&}?SQG2P;)biH^78VfChh0z&KZ-b9Cx+Ltzs=KEt`y{ zldL|QNs$}QtkGZc`cAJ2n=Uchq3JvLV#dGLuIWvLv0-$ zb$$K912kvNFy+=378VXfQn@w8ibJ9Qor0cTA|0b>dJ~gpn{BKMVJM@_a$t@IvHA5A zJEQ0N{L)X`+k-`h0j%b0bA55*o-Ppz`}Q}D+nK=<#qpVj^cU*k9d-l+1kB;q+Mf(w z*i=oQEh{fSSi2h+cYegNQ=FZfo7u&XZS*}Y10lOk*>?{dFG!)EzoVrC&-z7Ng(Vv* zHVzcD`gwdIwZX6J_tvR2z2^qjm~zE2@`7t*WaRW356X3M9hFR4tQ(u&zuBURPOWmp z$%lt9ie=VqPjhemu0JMT&R4Eg>rr-=TYuhp*V)-Qj>phHJw+)6m+U*5f8BbxQe}6E zd3U@b$R){V%RD++$YwaZrA0m?GtGIJx__k7V&QF-c;zr8h3x4w0G#!h(kD-E}sm0{n{pEHk73|2em zwT{*55e}Kekb=(f>8|tHj^3_a=@2u)DOy_Qb%rpD!2)9=o$!{HW@bOOi7T&$=%4?x z8m$?;jXTS!oz6_2k!8aD7D6x4lBd`tyN1dvVdCkOr8YHeh&xeY+S$)0Nt81-HB|_Q z1@PnP`$7|>(Tm8gqm-lf+;`HAjEruj-VUJ*F^csJJ$*c5B!lOK$vgj`pra*hWK&5} z>_C$MKYw;kj$A`S!`3!V(v}pHCL0L7x3l=JdLFVYdl>JZ&OW+V|6%I=ua8H3#1+{ZpX=zb)E+k8fV6pt(^D(W(}&oXX} zA|~Qny!Ye|4QV^t`|H?LHB37T2??R{6Y$o%qZ$uNxjz3G9-c2cX?tn(MeGxuHY{8BgUq7yF zZC#*%`IMf1|AL^^tqpvVWdBVe{pc{_=<>+eSa5l4SoFdoE#jp}6nZqY(PhDMdjIm) zq`zZK=>lgo((c1l#FQ?a-=0|~QP}Uq@C0>rb*4~jb8{Z%vC+{5%6r5W%0X*#c6E&> zg-zvWXWJ1`D5(It*w8Z45F{zewXX9&pOU;dIXO+V-USAFOGFDnE?^?rn3>)3)zs4? zIAd~i*^$N-JMC_a2k}J+INyZzzP>)LX}etq--7<#w~=c<;qR(#-+aW{+S*-avHh88 zo}Z_6JG@r8ySTdF-~xsEH>?#D6qHFWzDQ3o>htH%Cj_45bdY!8(k}fzI5NW6jn6JD zT=$TuPL>>PnOI!xUnxVQNAW~$6_xQN(Hcfa+fL(li4AVNM81d~3<{?58x@?AkTr;$na8!X?Zeocdbr0B*1=J zH{54uC7GJ6&FsCZ;=L4z;NQ?xS2x}vyk$!|w#1LB@gVc_UOc>4E?>So zfbgxQ6hVj)!f+K|x{l@g;utcLL(`%ugs~j=$k^EUfo8RLPJVtb51mj(t~!|mES8^helEEbjG-&nj4 zG<%$>E-dWuN?6M+=?YvV94Y%kW-ni>nwRO+LdySKo6)kz7h{q&fXSN;6MhK|vggJ>+jcJqL#c_VO0;$T`jWS6cS#^mUtl z#9C6{Z*E^=D|Q2*mJ21H-$MH5!veWXjVHQ}&TbG3G#hCB{QR&R6{8+`t!DLb@>kr> zYg)Xt-xzWA-0s+dSVg@WWxLfaDkesjX#9R?@<^urs1*P&K$G+@nXFL|j_vV6os%2= zd7bbq#LJ;9$unopFr@{T6c@LJu`4Pn`rv|>O}18Nu^W#h$xfdgtw-RTF{MRFY*cl| zjwOq^c5IKvnEv3xJyun9?okwy3wJjj9vP_Haju)*!}`}gTypr6E$>!p$?|B|c?Fv} zNz$9P#f%qAZme*=-}p457xtxGAb)Uq4e2|wt|Vt^b5Ypt^CU4oE>3r024K>yI-wzL zx`6tcl^&ZSK1&k@yca(Zi&%rU92)`G1>F@-!wv@y!_^fEk_g3>j1o2hfl@~njXV7Q zb$5m2xmY_exkw}uxsnC^l|wR67#mdkG;SPgcl!;BPJgyrPD54IP=hz9!R4NofZh81 zpow&&$6n712btfT<1;aX7XWIPW834isF}TfOrOm(uxT$E)sIL_Bsc`#cX25vR?zFa zeKAHwMV(#owDeSNs2aq*uT^Da{1tQ>HkSqT z5|QQxyu7^k*ky%>&dY`}3Dj+9xK>2f=H<0+?*PUX!Z`MupI;|n*qX~GhvK*`2MWuq zbvD^CFAvb%X0p}$-aRr}>)9S6Z%JJ?p5(c}v*HOUA2>(Hr?c5K4avLPrYod7S)vj5 z#G)1&pV>4TQzO?{J(n8j`?|WG3Vt2Yq&?a=KUlIh_2E%<+bnNFUhhJ_rcq7sK}S=) z6J5#5qOYkoU02$L;>W0qi%Zw$7T_Q>d`xN;wP4l7m8|W%EiNv8leF68amGhDIDxo= zi(eT(UsY#6DFYQu_L2Bn@2A$oK@fB60EO#i(LY%b&%18uTGRScVsk*xRj%6U%lC0R zx5Nz>)^qer8c2O>OjS}`TrMujQwgAjiHIwd8qb9)+3D%&r|k~k{43{wIZHMN={Ny0 zKi#Xo$CgyCA4ZEKaHZ&8Ez-Zrd+n_2Zt*CSfv#M*?yH5`jnR@3-)t8A^P=?p{I=~K zC~Utyxg?2GAFvx485wuQHCYQYwPjHr7Yd$j)Vz4eH(pSKtX+>IlI;c1lS zHH;x2#9B}@FxVA>|jtsQmwZZy<@rlx03jwFBTAa9t%~t-qBH;QO;`1 z0WR^CHa>}pmBt0W&pJ^$p&1ooPsiMGjG<$G4mVF^G1i3R<;tO$%f0CI+ic-Ly4BVW zjN4V#eEI4w@ZDog_&tX>98X=vqSVxTfEG$>6`zgPxMO#Kcbg>%!@)C={SHLN`qA~t z++$RWCY?zHUPNcEdY)A$8&qA|3xY8fWKA`-7>?Y7EusL+Z699(Fk*rkCvLBF#*bZa zY^h!x(^d&f2bBTI5$C~yOsT3GH1E7# z#aCbbS>8w?O)Df{@_=s{A*i$iPms9NB-%+_^w|(wNmYT`-pWsEZ`Z<* zTrkQZS0^f84S0l~+v{xz2~x=s+tvlpUrk3R4{AFoB6;QI8W3UF3vD)6e&1mfb7>p4 zb#yE#w;D{nst^_9izu^*9P@r6rfXBPB$FIkOJ2vcFCu)&&MPFOH^CCSfgsOmf&`*Z zxmQtVe$%|=0K&e(mb~NoPw;p z*ZMTu*W=c>9=){@rGO+6y&GMUM5fLY2B| zd_yjccx|*-)qsHIOYx}sY5ZDK;5RdR17V6(z#+7t`Dm|-s_LZk>mfiLtK>yr$*E#3 z4vvL6Jl`kn*e=Uz_e@QOcW?R0D-HlDq#OcoO%>}=+EU97WP9483}k0aOY>;@9iCSqPcrqdl6iKa9`6C9S%bw;d;N`_27`E z&Lo<&&;w#msS80Hi7WtuVw@|^VVLB|!VNjnh%_8X&#eK6iK0V=aclH<<%3`ZN|`Ez z;-3?}!@F=Ta+|x*#0_9dZFw53fiq}1)!Pe&s0H2)%Tk(xP86s;E0rJ-bxr#g!>V9h z)Br#U+KyT+bkc{ViX(lIXSIm`vkFDesEFGPMEc zip=Yr_xOO+uhoVZhG5{I#OU%VItwt0vWg07r>i5PS@M@0O+h%qaQVE4YQUE4^;pbh z{?@L(u5Lbj3^E3pp5ybryAKo<`}zxX)DZ~VcxLCYl+dP4(d2jfwobKhN#31flN_5jR)t2BvS4U%S5c>#_f67=Zorj}h@Jyc#x47T;EPt)6s?euEgCe^sF+}@#wYDBpcwj&W=c2P#B z)#ElC2Q>s@u|k}FzUU&IFH(|;RXCu^;o;YcF&E+>akH$R{rK}4w=sJatzFz3q9Zna z$-~$C?rDYl=>6=#@Vb=`JeR|s2>g%ueN`0VrM>H803GAI*cWFZW%0-+1GT31t}qsM za&o#ZCZ^NK()s@~oQF@-)8iqayD2&zNSZPz z;pdt#kUI&EqKRExe~jy+nC=XPGN;*YGkPhV3L8pjrRg2LWN`DJu~7Yg?nz$_`SxLT zRcy^SRCG1K)zfLYeox{8)BDMnj;u-NpQo1|p5$jDZ{+;b3$RwawDrUzTq0glg~kNt z@Zc$UW?j<%@*cE_C%foIB`Xj=Hg;?STxv%OlJ@L9@a9a8+~KX|`PS8$-L}U&5$R_1 zY^B&_-@lNfd_?DJWXATy>)dcS)MBMvL@L%=>OCp2DneYSJ@ z$<0&Ge>F^0T?{ndd%WgWQY(BqIF#75XY*7b&f#X%;XA*dE$N0d@a{RJe>17I=*cyz zFMK8PKBM|ElYUz_rp1>ryTrFClbb2k4ihJ9sV2Qftc&rdMG!=w1l zS{$3AxyAl3Z|txv`e@#(3fIrgXIKp)91cG5G!w@lJCeS9l9VLw4brC!XDOOHtmVwU zfBrmN>OIx^Nz_gCq#V6L?~z*w?ap<)f>=lZdA6C};55a*dzb9>R;`c$?5sb3$}`B| zj`_YjNM$&h*VKW}<3`gHo>4LQ!7#^V3jeakN@0O6-AuBc>n>5$>*6~2T;&beh&EG4 z{&I}>!5V$V!j)N?p^2d`JXAsVU}$zMnt#k>gLLQ&xs;DyU2JmxZGnsW;$E_o%6NK3rtCAdO_Ki1vN4qO~_yup64nQ=heng zMDw1t;Sa$*d-y2@YZRn=sA|f{H!pgO|$cpN+bnNCE zNy%G7PV01Y3cEhKyJG{(5j;GCNREQ*as#zj&&9=x+#NKZY#*y|UbozM8lZvpVt`p))Yg2=?7R-Z%|WO;|rw5<=@FKfYQFaG20WOw!MXS;76Xg4w0qhEXq_cDkS zMPKK!dU`i^9og1%;n>4a7nSFgr&>9_7jm@shDJ}#G}gRrQM!PH$(1>;=h=SFsR?3@ zJOgR=4U37MdFH5_K{X6nde!~x+4MPrZTkWb&9EpPUd@kzec*)qdQxq$@sbYh&&EOAd&?p06*}#EX9&xyp9!XUNc)ZdArZ z-ZhyVr?4XOo#=ArnPM{LWo!;izCU(ll>RM4q2Ga=+$ugzcy?c(ST_C6W=hkc*>+x+fjc+Y(3uJ)L!q#3L zl71O4#1vDQI&1{tQHFa{Z4&(Y40 zx3o?q=i1Dy3R7FQI+o20@sGp^so37WrI);wvfeVrLU~zWIgoY^f890C++l9OKb~VkF?n)cUwvHPP??x zmKy8(A;PlrT$QOqHmZZl`E06I$_$2P7f)Xov#vqcqNHG(mtubVLULp(ZmWoj4r9el z4#*cL8`W%;UxdRM_u&I3l0z8|lJ+gWKHZr#SQH=V;c;HuLVJ6_sg0t~iVr-tN-Mmk zK{^n9K*FNc(b=`jh;gCvqvb9!hT!wWjxOv6)D23)Qm+%A?3y+AMwf`c($-I~=@56VoP3$<<0*qV=41}(MKIEs z)OPF zd+|2ID=hupqpWz>!w&(SsE*I3NOX`-p*LtSO7W1ySWC^F)i?kU##)nMBTaukKV&xy5 z%UWLu+{2w&MfxPQ(cbz)k@(`#*eQ!^=TxPh(5J4t-1h&#+26T;gOc=A)?^tCC!(Bf zpK)p)O_>V3+$$)PjiC+TA$;Q=yG{RNlEc;2%-!CdyUWzZ^PO-A}b<{M|$wwx8t%6$2Y{MJs6*Cnn6^_IVwSD7vl#d`4rAT*$p&OT=t>~rpc`SHOhw&TG81f^k^g2nBU1~aS~>NQ;{s18+k%G zYLVhAg{|dZ`kw}^$Cv4jF4xl|ocR%fH5y}4Y4N5H9n48?o;xsq_T4F?=wc6&q$v6lR2f3CVN+2+5g+fV#ny2?s+lM8WRW6On& z7KwWXWsvI>es}9Z1?%iq=%D7;fk=}$&DXVwcT7DGw)^p>r<`iQuuf946)dr`l6ERA z!7XGXM37uoo$B#kORvcnv(+fGVi9DNiaW|y-``ymkmJY-fri@mw{ZIV(M>(Z+l;E*HQ7C9U^x zKkC*Y(ChLR`84$Tv^rILe%3X+e}3x|zeC5&{$l}OIsDn3>uklDe+xDm?wfs$Pzf)j zzyc_6@Q~wb0k2h3+LFVKOiXo5>mVrbX!mouXwD{l`Jcqyo}8WZ;%;q!e;R}!dt2Pc z0C_&|kYyTYvCXp_#4FA7`?vdaq}IX+)YWZ%6@W*G!-C?*HSYS!qCy`bH}{gd-mEio zH!oHH)Xc`nb@%IJ#U-LN@bY}>nmmdtrb>?;p1ss+;+dlljW({TF_kLt^($dI^X9^` ze~ask+OM>%AekVfdLwOpGppRzEI~6DYI$NUJ)qF!R-7NwFa2J76l}tX5VusgF7NM! z)Mi7U%b8DF&PZhwPg-1H=_UAc__qA0I{VNx)n19ZIOJ<}_rqFp!8yugG)L#?HlG#q z_bz!rQZh~t5(<55kET>!HU>83NE>2`EnsXng{E6Sr^LY zOLd*3yy=EnQH-NXfEd?nUR+3(QDftH8)#LG4&&=hz=fVJVU3o zkyLx)dQ;1FWS6bcwk@TkeR(*rp54`CBx#5HnoZRoi$@NS|zM9t4kYCl6UQrMiR)QX_erFC(R@@k~tD;oeBo?~bKA*dQ#I>F4Plx7-j=rQh6#Z&( zZ8jdIgdba|=WvEfMSc6omD6~ej$Va!oNn>w>O-CWM9rT` zjx;on^~!agywA--C!|q6Z_uSiIdg!P9d%erBrbfu&IeZVp|A(RQ3`VBt9iHMUH2~j zB12-s<2pGdn?^X}J;r_I>%?nLS3Ilp3n97^6QK{%XSxq&GG8$tNBwjL> zv9qfw#U|kMw|nUP>vEdvHQx0H;o*I@s=%MA0h))hH6cva{h$+b;G!%G*hnqWrenls`&G1`z*DY?qyAUdd9^dqDPQAO_>vgy+_{5yc`1^zy z0~eWtb2G6tT&~xu_+;|WLq_)4`4w;%7ntVz!$mAj!r4~NpMcwZfJ3Q&w8lV?s=Ev+ z2PBXV-Ep|Q{p<#UwbSw2F9Kbo^gw3Ssw7Nt08n{0#C!ipLQcgHcV&%ju%l5k8&}B) zqH?aeeCHo3+0H5luYh{C5Vd@|KgIoB2n#Tt=ks$5?TKQud#5h7~%mA_iSO+ zhkX(iN=~$9IA+OJH}A$nmK!ThyDhg%YK|?MyNZNRAgEYqdWz3w+a^0{x#|VZ=0il` zVV&@&I(53R$=rIbu?puPM`1?2J3huJOt|b{%vsnI+7Zw)!iZ)6=Wu%#Vyg>FD2figd&8 z9J?(s9Nl|SNOp*Uv?1`dk*o5#oo9KDLTGOtb04pjs^k&*leAv#D-)b~WjO~VHo&(VW*76TpT2{K z&%zxrvu7!|6&lL{%znuTXSO19B&=l{9PspX?|iXZ|t(=rYHQ)(l&a_#mQrSZ&DQcaV&PK%Q{GQ4B2AhD?WX`O;vnGGXvnDj*h zgti{peZgAg^wq%a*;NGVfaA9<=l<5~lir*-Jqbxj9*=?6u9$9Y6!4sR$8&E?4`NVe z_q#&-dXK2rTmUEbftumB`SpEzqQmxgo8KO0N;9KBn@%YgurN&Y^{;a38JzQA0X&Vq zXL_4DK>>laIdJ>kM&_I#X25looZ|7ltxX}ZuU|lg-N&apElH&cRiA-2%~v-VxQhnn z)p}swAoNvO*rNB0N7D>!cQl=O+O}zjrwQpv(!CbFVVB?MZPje+Dn>&LUpG0c>IK+n z0+?Biu=mI#fBhtzZNt?{sdu2~U=~`1&1;;GKPli~tPbz#A6#5}7g2$Urz!D2tNmN> zO7==xOGwwHTcXb)-ciH%rZ_8~KiJ$E-B??W@2Y$M$$*3aU7>QY%M$=+-*D`O^$rzV zdPT}IK^-5U8=TZjQoYJR8v}e6Q**0>c!NhUOY>GRn{TLhd5$VEevGH?B$`~V@1CbK zdt-7Hc<0N7bPCf1aDWe{&ddWjW6kE~D$xz0Wxb6I&bjfmi1FpAb}t_67q98g!WEeX zk%?Ou=*}dsOK=8t-JQeRHlE%${<8z)q~6Hsfacmf&thMYc@BDnk+X3!(r%sVq!ijHTrQw43lN9^A{uzIy>eDO zT}Pv@)6f2Ufctcd{jCskbRnt@=fv1(54_s%1WMu?;WTZddeZ|AcexXcMl$*KQ6ahyt{A2MQ>G8 zY}D~v3M3kB$d8ni{4o0Du0xqT{!HH=MDw_oS^ea` zA_yJ#*2t05{4V{GCKe;@vDm2{$dHM1Ot-R%m#)3f7tG8&)Z}tVpMSYw=39h6Rt56i zdWG)R`LOd3^qOLxUAl-#BrGMepo=X*7otFwj7gq|EluG$m6Su7d#*O?-npinVifLt zo=FMt0N&b{_%Weh{Tb^L3oPl<0DMF=y;tfm%~ z$;gJ9=g)-7f++ZU1gh`K@C+zeri(u=rpq*iCx&%wC=)%=sw4YaS|1#-;1S!T=OCmS zY;Nshf~!~A64s1-lWlD)HYhSq^qK_dY4T8)=Xn%gh2<^K52XK?yG5x;_L7#o`=3D) zA2F+{>;dj1zVDR<{^Dxobt|L$m+;48h|J&AG`?J1S@)L|chp&^6V( z70cQ@KP>K6+-a!431_Ot<@c54R6X0bOT`&?a=?PxvT8F7WFt{7EokOLvjwDd`b7@ND)NkUw=!}Z+ zlxzdSpT#0No6ToYRNa*PF0XcU?Nr;Un)uzLrH9vrDY>0O$vf%OLB|_RFdXz&%*haY zG$*tu>;#Yoz8%!H9s7ab7t2Z>5y*Mi^E-^E=L^aSC-*0C1it_~r_?;$ghk4y_*DtD z9~bb=x>a zJ1@KEz4a-)MzXLn_HweJE;*!in}_TA8ARkWl<<2L2yobhZ!VfG_0tsm$i;3h)RfH~ z`=JK6RJxjSr0;NiNQrWV)Gzo>RwKV`xE1aa9|OzT8qTkVHOJ-|7MW2e&ZOAjLXju5 z8%uc?=wn{}#e)vvpV_?#xx=RsSl+?OU<3HE{XpqUai$a#1^>|M3>C?vE-86k*N4`k z?4}g5t%H;+E^tlW3nR%BMy;UMxD2_49+>&sUP(oMyi)a%de1j)w5MU>`VS?gp&y=C z!kgT0zI8!=3%Be4;H_xMs%Oztg_!Zd-pK+yVpc94RMi$|&*K-Yr_)?$*dOE3FhI24Y!{QV?3prVt;!#qA{2H1o^$XF5q45_ zj<4FxK)U<{q0~fDBmL}nu#jQytAQB2wUSaX(9iv~m2pdVlRrewEcuT>83OeK41teO zhSoMo5DQ?+zh^BTb@C4RjqKvL)ot#V#^WWJAwaklI_4e%UA0E`4^Yt7!KT^i7pL3$k-> zTs&9w>7;k=*+C%z28G=REk_nyz=u$S;0Iu286OCt;RFnrz3qH;B&nx8*N<} zH^1pLXB{~OWHYpL{x8{mpyu~e&CtWnVzw091b7!nzn^nPV@NJt(lsgF(Rw$6(&FXF+na$!1@_)57PIV z&cGf}ln#pQ=4j8xk@m`@S@xA7Me1MG;$|%JfAZZGVU1BFbz~QmASfuXabJ)4j!i*D zzw~dqydu`K%U7db=OtOyNZKY_*S(1@ssnQdbK)aOCt%3?0v3@1$hMs3nE&GdcgPtq zi!H02`xwz**y5W6L@aJ&O)h$&(7yBFWNImjLeYq17^GW-E6B-J6q#^~EZg*}$ZwFz zdJI;>L_|u2uCHSHr$k3Kj$thY>PdMO^II|ciNToI)Vt@mK5DxoT!y7g|5A?X)ycn!Q{4)^pfRF6ezi0ztL3wMwbcu`9 z^57g2^fiiWFrk&iOhu8{-I?RF!SJBSd65H%xtQ6icM z1>msd@t_YYo9~&`*1x^Y5mg@<$8Td6_639hug*}6xV7vF_j6X zjYOihPG~FZ#)8k-kfG8Q+qOhgug!y)ONT4QY9@bxC__miO1@cl0E}!+dcJt1^Zr9r zHWXp2U6)kLJ3{Ie=A9=3Cg+)F#@#=%;}FVjCRy zhx8QUSkM9apaZvq+?Rq@9)}aQT^7EE$;q%ZS4wwnCN#?_K+^l@9@eImJ=onph#d9F z^6?-=YD?}Ok&E7`>;7Rqvm_CXxBGUl_UgsIrM$i4J{?cgg`6w^b7Dm*7O*Mi)0B(0 zzNF@GB@g&hzBm14y>81($&%~I7!K4`=P~ZRc>&^%A5|MPGbmz)mMQN#MLg^biz#}) zxHD9~L7s?!Vj;l2pv5;RJle^;{r>LVr^jiC6CD`SET`F;pme*w4;0m0+ar8|D{j7P zhj$%^uMx_OK-F1w9XP7UZ8uhP)O)tNwaww2$jR>$S=~Q=eI#Lx z&0rB%c1?^*Dh@CQuV89x8Xa{=L1(RY^F#=tp3EP*M40C6uX8-?^IqZAU4MGpX0dC< zBr#_*_pL`Z=qH?Q>zlivKk{A2vOp5n3|}ux7y!xTGI!znw?)YxEqJ~N5RxHYMZ275 z+p7RLs_rhmnbXuQ5D{tSI)+pXSXI%?iJAuUH##WnOt*IX(Fj*NFmdc)aB$-8m0(EoupFNb31PA&OeCriQX z{ZL-EV9kZ8l!gaEj+s!pLz1dKn$kH937R3vIKy0oeVKe_hFe1Nj!l`?Co(dZv$OAI zY;;E#q!KXa-fRW*0B7G~?zuJx0+FP}{g9p=^k*?OIJDaxj#p`ob$76?YM`=Cr)QLJGRw}qyfsqjyz6J5)n4!uQ-(kLrJl7vqtXtYf1zBShqb>$> z?QfIo(YiS#0c4^`iVgKxY9e=q&+6c|hNl6`;UM>%V9aj*?nVWMwCbS~>V8-5d`qTO z)|Qux{_E;QZcsl|0u1kLL>bLg=QML^QO+>a2p%=b`yMzCUd8_opIkWDx_tD+7%<~o zSC~P-&pcJT$2r%Jn7MMEEjH33xlne1Gw(2WJnBmoz48K8D#>-jRIGeEc^Ng znR~C)8cN@)diG}8>#kGS;-@Q!+YQge2N`O&)C^5~sV5Cq<=^wq7%Hn=YV5sOLzT+G z%@P**bkF_$&_^^3?IiF$(r=-#ELQZI`<~I7?=`sp7f1We!_GtXHRL~SG!wGc#2|s=6#3uZbL)zJVGP!hiR=6+9%juGwW@1zQ`!cx7< zOjQ2RZ1qoL&a*L!tPzpEe>(jtJJ`^a^wbb~f*u-H0qTe~f1l1lnJJH0Brv!rt@jHQSvU4PaJoX@K@svCBK@HUKD;@7m4CE0{lZcXtU95H^hz2E^30u z54}cfR;tlpuAG`a8A5rk*}K6LHQk*l$DlpsEl+81tOCd5m#()V0Oz4b>;tyyY;R;29 zYG&(e=?|7&@B<*Q znMy$SZu#ni-c;uMA&1DvW)9c}JpZcavJ*0VQfE8mFNEO+fv}?juTgp$z$CB}ap_jZ zAyLI&)uxSa4V|Wv`4GeSSJx;529Sgq)a*IHFqCG5iJsXmuE!6xmfyCr%5@4lyE`q& zcXubUl{w*>!??~;8NB}c|0sH6uE^$bRZg|%+4{BK><4o4?^&JK9H^xTA$G7wDlm=I7$;+NT~ho3n>=G7N>(FfosknhmeET;i2G)yWN7Wx~ZTbVIRAk#d-tO1uv_5 zl(_a|$KmpAiku=z5KH^3L7@grbDxN37#4aDM>B=>>oeyjnW9$K5ObF;`D9`nJhy9d?nLayU- zz6K2$xd7im(N%#YxHh=`R$l4hZ?^FJZeE#>4^5(*6)*`e*<8bFNJeI(gd4x2J^#B2oG z$5)rpnM4>v(?ThEOlKDX@O=i#cw`c<5~W7x&mRVW!EQ``ikU3>%LdAUGL^YAd4l9i zC({dUV44tbO`g4!hAw4j;S%rrIU9bt-dy2lVp`+a$XM3ssG|#!K7Ue=EYa#-ZmP_I z?4)R>3MQ4NZ|d48w$R9iPut}7@2G(Vg81aca?+r+>?c#xRRPXw?>J8;m>eGr-GSdhNP2fNG!bF@PM|G$!=E4`x zYR@}R2VuJ+_*XAKdw9|p{B^HkAXbSxN-qEn=7TW|=MZ03&h#I5I0bsAm>!>_bgWT& zg#pMz^^*lOO6eIp7HKln@w60H159Ab(FK=LL4=9BwOH@y$MV~nAWX($DCRK$B;%}L zO|29>>n6pEhYNE7z$!T(iy=LNo{)x;ZVIgh<#%rBVz`sFOEHs{o!{f|lN4(MtVznl zB%koB1G80kG%d_TB&CCk7eh*rbPR|5L@45(jOhefx%sUWNeny_2n;8{uE5;ryO$19 z8I-<}5jR1!y30K#vaw-yYN6w2#St@fiCKw!MGeN@=5fEW7YG$73;@0mf9!8aHR_JI z3{jnSU)LNs{1E*52-PL^8{z4oN?Pu8WFxggRRH%>J_zCvhy1+lndGRXbV~kOn7S{J zIOCjSsD)Q}fkp&XXWGwGnlSLr;1^RQ=JF7WksatyFkx$NK1SV!8L72)#mlY)^fS|1 z6{_AJ1(bSSjy+MLd3_O7C(8U`W4RcOyMzZu#vI3glmyMQ;0N+1_(g%&SQa0`i_HDViPl&N5_vfOr3-5LVRYanp~AI)@Tc0P(( zidrjW+jGg`na%#i-LX+JwU9GzW5;)oV7bvNMx%@UVbeyhjyv^eqsK?plopC#dDs0; z9Fp5=f4*^z?}e5JwLGe){}XLIv$YN1)pVNqc}3fMCM{gQ6OEdTx=~tQre7Ib9R~-0 zy5hpM(IbL9CPJ4uZql4B`d{sRXHZmWv~8oJ11KnnAkhFKK{6;va4-=?GDwstIp=6V zL~xa|_&jSk!VmkB=|JbooiR4tA z{46O=*pTQ*T0NwG*;*xxRJ7(wHs5pega(?6^t}d65=49aY~qP7dj7)RD#n6~6O)|X ziPpE2l|SCGCKQvIw>DH3^C)yO{Y;H~(%|a8rFrW{Zt=|QQBXZDHT&k~QnL(EzzGYR zsQIB;Hn?Mtu7GliXh21s_IqcqopPbPGb`lPxTD<1a<0jw`*mY*TcuXbr05U4 zbi{a|);^kc8xx&%W(94VO;))1wOTM?Z{zjhQoVJ%trg5=EIlEML));%i)Ak#`$b0g ztENgyLQSQjSGt4LPtirXS&!w0;JR1D)y_#y3*7>#yGj$Eiq;cZ7}Vb}{#I8ns<+TrtSmOD8ZsaH>^t+}yfExw+7zAZF;%R&k|)e}chLeU(+o zkTYA3=!8v1j!W`Zj(v)95>2&f(1|pD`=m{W)pG0*Z0-}2rRv@3@jm>In>A*GU+1F_ z=MyGmT{zaJ$Da!16q$Ie9vw#Utox<=wT{Xa*rdVxHmc%fS^|oQR&@U>cc@S2x;4V&*UbRKWD9nX*Vzyp;;iRa) zBvbk*bTl{j9-R^qJSt^I)t7iroRxYlN6x#P>H;_v&wlmXHwJKdzZM)A+X#STxVo(C9{NN zEh#7?L$9uE{o@b(h>|50uc`o}n}_dk%jGC3aoHq=f~36NB3q-SRq7;Ef`4blWo?hv zfs@Yu;4u^d#@d-afdNNZ<6*h54k) zm3aM>0wSywsXf*QW59MPqASrG)kzIgK{$MTpvib;PE)XN+jRfy2&d}3BBfQa8*gpKM@EoQJJ2qJe`|_?uTvo1Sjew>a4yN7Z_Shq$&K?K^T{ z*B>jc^<>QRp(PZpW~r1YCk`)Baq7^^#oggWbF#Br>E>C+*XMC)zq1i?Ok*lDam{&X znYI(lqbrTyji;Agrlj%SGjubefiv+~6N=#>Yv(898)s||l<5k>``5WJUc5oT?M|JP zoIeI*RE9+_Rqp%llqWWKx~1X28Sc*r`!(w5kRt+h60Hh49#*A_Kug)nSIF#3f8x zg_`&PWA%F6sIQc{^rph1TA}nf?P5uwny3XGMPt&vfGExZdl4ekjuCd=RCb)N+{IBD zjML2sYSM*gzLup}b7_=L#p#TfX>nO=iG4Q+O2H2Qqzb3$G;BOi!*H-hUfK837pLJCcTKV;VEk7<7zpK`OlYgR zF^=tW1SDDPp3u<0rqIJ&cji7JNgDrZ%)Iq&%IWG;TM5LAGeNCZH0eV zNZ9_lP`27sC+XBA&~#|3E-&(tiP@MYR|*{-2l$BfKNT4*YUGzc(bKgVw*Y4nbGALw zWM`_1PK{nnH0MjYU$IHTU2oi1Ue`#jjtatuc9=;+Ms1qz59ZPokKSLr_Ll*x3)kJ& zz@3?1H+s)ix9!Wz#Oh|iF=tTbboB^hvi6F7n8lRsH36!&PtJ*9oeM*+;2G4uGz#B* zw`Q{wz?8W-&d&YzV6}Z)@C=!E`O2M&w}oNd1w>7rEVD7;MjY|)IF$64eqx_4k3DAX zTx&3%XvL9_N7H-poQ(j0xq&I|+aEQSmNmW_)kNMaBovy*wRBIc;$00JfB1IIw+Hzv zYJ!|MNAJ|T8%^64vMkeLsHNuvtTqM`iLXk|M=#flG9?so zne(^YEuT<4M4`@xFS^Rw3Cw!u1Tio0YO{$Z?A)&)Ok`?S<*uysMmBfVW9;cQ{#13$ z*X@S>DQ!l2naVpovefzLQT3Zo*`zjt3kNq+oHI50MRY#X7T&dM@Jg#sc`BT=*&lJA zwNwgyqn$EHwRg)~EWFgLd^qj5hX->pm1SPS z62@5P%%?-Iy%dV7n7otR)T;pw%P5x5NQh}#O7u0++qlT5swmeqZ`tSUx|VyE$yCm0 zL4x9>!RNhBDr4fBvTc|RUGEwm;71))N#YE7#7j9lM?hNm6oE6OF+ z)9QaXh%G)4$j|2Re9u*W>LcayZOTXL9JUA(Id~hC`0+u=kc*P3dG}8CkW?uy__lrX zEu7$R_L;!dgqxaKyjFbO!u(hpbX8_Y|65^4 zvbeiT3=?*YUv#cf35eI8plaGu;oK-bGp*`zRNlDkt;f6Hv6q7agRx=mmZoawJi*ec zF&`TDz4u!>+;1w!Qc}GJUPfLLG9l=yUjo$2ATApyTV)rGh^2z94+iq zzhNvbW5mo3%ygQd9;!-PpGc!R^?W`Jo3d&Z_q2qSQiATrnMTqsTD3@~KzG=A7~WW5 zAZAT@ln^FhnrcvBhCx@9#eT;e$Sf64?CQC;c*wnF7Ek*m;VC>_t*f(ms0>&H=#lDK z1KZH|u_q7Qja6lgCMruUl9P9@EV%R!T4O&(d?PxPOl6e!+O^b7?}188&Pg4m@>??p z6YI-+%BmvfWLFFIi>~Zszb2-nd&A zvNH6Zdv$p@w>Z~A*c2`)zvgL&J)jqGD@keJ*UJ5b}1z@dSd-0mx-I@yr?Qa-vUqCZi z9yJBP_$~2Ejk;)KEyXp}$-}_nZI&sqv=!qXroHK9`_s#?w^oyWZ7o$tHdGqHrh_cM_cFEN~XL zsprgD`Tq1pv{HWu-eL^2TZYi)Ib<+H$Bb(W~(?fP?VGu=Fc zZWsWF1aw<5ZHcLl)Ti)ocJ9_FJ+<`wD4RGFKrwza(-5Gn_3@7O+y~?Mf=@|@i*s%c za+yH(FS=77{oDv;s7hCdceZz?1)c|Qg= z1+3e)#n}hv9J8b!gnvhwQPY^lQY}NVyGv7WYm6tSyQv)ZWG=B>7u`2NyVv15Tit3G zNx2}ks(1iIphQgFieZALV6~?|ZsagzxHNmxg&ehJGLYyd>fxsTP>dR(p`aa7V9zUr z?e;#Q5t6!rBiY6JsR?+9I&mu~>13=;4N)ySPgIJej*E5E8tjHUb1i_(cy{0P`ObZc zva@l9>9=Kez-K)1)vZYA1MG=42xB@LmK@>2ApAk|d8dQd{Oj_Aw>`%QIRodrj%cJS zEhlEU$V)`=*fZ6*faEH?74On*$^lSm#9D8(52N;DkGgMT%CAnNPxDS4ns%iPiFGj&FSqm!-3)bD(a$uYdh%jVeq(dGY2Z zSZ#cQUef%*Ct&;DYb*B)o6PpL3ZV?qG@aw8K$(8#3u=YrAI84k3&@t+RM+3E({1$@ z)NjmyjoIC9IdjllNwxk-Z$tK$hue^alwMULw#2o-;IU_vLBvX<$!d`9=^)MJ!<&b{ z!}5SX|1Q0@2Ch1GP6;r{6 z`W?lx{Kyh8S38N?OyHkUWrcRZ)!ooX#9E;uZUxuAAD)P0>9?z#?l{Y?SY!>0cAq8V!EcaP=}5YY#9 z3yMexa2Jnr6IX5H0+xPZ0bJPN(XUaQYgR(fYf_WcCh+JYcjuzQrCvHUjp9CaL#O`4 z$va+Wb?p{E4CH5(**q^_+XegM@P_ipo$7Tp5M}_fSp)W;^lJrk(T{39(Kx3W+VU)u zhYGz0L1Je6n4a;>m735=!cbL$%>&fht8KJ9Fj^XrjNme9c+P97WqQxeT1Xthrb!R- zFE8H~xS3TmXXjDwG#wceiU$dWv$09@JJH5&FI0ny)+m3&#e~$X=db|7>fAW1_j?1^ zM*GIu&{R-2#%{lXiAPS+o&W2n;p*p!{w|XL@jCh6)$sKc{u}~%Pwjijzf0%)+z7Q40 z)r%O0JJ%2}fyF-gITmv5AR3Nhd1EYfB>y~w=dP*)01{!^LkV#a(G&psUa>70X)|h( zjpTx6V%8}JU6p=!u;1lYw2dY(k#L~8ql^{i z<4i7$Vh&zuet(UlcPw(Xt`ax{k|JWl=GL0HZFlXw6Fd!3Aroiwn9J$3nW2NMyjzsn z=*TB2@rPsCj56q!w>OUL;Bb*E`YuOO!M@T2FGTUjgFEwOxl~N16PX{qyg1FoNPoQt zmD9F%gJwXPGZKM$8^uxYRTCr|(yFP#kDVJ@pP4cTMWPX8xir%cCVv-Sv&K#j5?s(t zx~*XXp*O&1712G7`qqbqVeeGW;qbJ3awb4ufJ-gZ82PfX>tuv=^LV;oNe(>m5rF}1 z%!@;_ieIEF4_B0LrQT?$l)t^X*DnYOEcE$B&3#-1t#PV-8ZIYOD+lB+*g3l;d!X!e zR7y>&Zi@Ci=i%n=c<1Ml(t;ik2ZeVSf2~9Beq`R{7%)2c3^GsHB)J71B!B|vlPdTz z=^|JrvjL}~W0BJZab{$FJe4(Qy*-l6(mO*-G3VjWon%@h_#kKmoFJ{JQx+lz7E)_t zr8$qO#2Hl}{gM|F+zk1wqun85J`GV7jAutK1ZIQ)9iw{C=e$EA)e_C^3^5O~U=`LH z$zt0-Dj?YaP$hxrLLfz~qpKQoU9jdEARQ3Pcib+LjKPN9Z!9?YV`n9Y9RF)QKK&XM zFYuh29O4JfKcA_F>>0ZB<)p|B0H*^r&GO9&yuIXTxKfG(&!2-t`08QB zh%FwFlJ~^LspK*S1hT9a|4a(D<*<$anVhUgZy~A446AY2=%|~VgE!5i(mZqHjR-67 zd7q0Yf!HEft(Fm%Sm*9Wqk2aPBjD7WpH=h`q*IiY7_ueW-__H}!+un+w{|L_vp}S6 zf})9H@|@1z%E8}GbjT%NfQSh`nEA<}`(3t+ny~&d_vf%UR=m-Iw+C+FnKb)rNX1yF zDjaF1w^wMQN?K>|ngIM~yzn9CwDMlW`&V;P#!QjZj0R;6o3roO!~b%<>`x8>C%=dq4Ij`n zZY4dimNVOfIdhn3Bm*k+8(<2Vve^_qC_0MVCmd$ZXj-ph=_V>=WsQHLPx>$ z;#W)6l-xP}J}rGY{cGqp!pQu|Gg{P0%5P$)!ayo1x2bS4t`=sDJvmchNRVyb&2cJHA}_4irRm9 zk^RMAJNC^OY({E#Z-pJ5@;YLRC|eSrV~>z*h>x?=*A}tf6f%uoG%;G5r|v@J5A<|D zGO)Br!V#%`u&jT}jHRd|Qwf<6$A5S4oxs5A1tJQ@i;tFd#TdQ2G+dU{B^f=)7neuN z?CezfVm#K2DD!X?zgCE%PMV>p@{=c91dK)N2mFDkwIXv!87njiMhy>cCg^%4s`$<) zH>u4-Vnq^t`0%Jdr>ShS&aUvu;7`Dm7>h$tiR)XQ>7S7#J52B0tIfC@Dj>yz_Oy`v z6W-M1vn7(#E-9CW7}Mt{CY&if=b$rOCNhH$wNtye|E2dXqFb)wM;zvHl%`2X02aM& zf1$J5&cvJ{blbd-e{WS>IvSP`o;)6ziy zbl>iL02(q8x3h0@6;TbZ58WbO=S|3N(<8W#!I2pY9J-K=8}#bt**{x-Eq(u?K|~`W zIDq1T&j;>RJZk*j`{jwZch1@pDcjTMYnqNCm5 z$KA>Ne#jjbcjyBY@Z(*7y!>7yYR-83LJx9ii0s=J)gNtQ^K6p&30Yocum!{k?1lN-U(Ya3%w%FW&sklc za{ujPmvrB7q1Jqn7r;3=CjMzTG|T=!Az5tESb{dA92=rv+j%J|ASevlw9eq5=MyfGH(RwO9t1C6AuT;ROJubtGD6RS^7_3^Qp_k!=&#=knS_7Zxi7689 zhv)tt2N_U?bE>t7qH1D0%X8!XxP&*RH3t+*$kACK1 zl2FIn1bhQhHVgIE?syQ)GW>nNKX2Tu;t}KYVo*gV17rj5@^e(QXw9Zx`2{MDXzWus zN})IZK1xd6w1mls6i-@q6@HQz^gdWk#iGYt2Yzp37+%Avx6%J|f8+(absHUiVzt_t z(rn`OO!*L{&&4g>*wukGjUr)o9AWhBe{2MK!5oESW+4KMTz?puX}Z~Vll~O95I~DC6bK$*lM>=PNtmBB$qm!4)%<8C%o;Fh^gAgbsp7I)yDpNYPvY1x}l*V z^+)*a)T@lA7sdBZIj;25?hJ|g(5Yju_u&sGDmS+Wa~xgCU|k3Q{_q5j*_ue_i}&)O zviQn@>}pcT?7At+FxfU$I}RR%ANFF{ld#FMU@Fm`|N7+2qlTy|7MC*+V6iXd-&gz` z&hT>IOw04MU3?^R10|IjK((;K9H6YNn&G`zlxc`ts_uKn2DZ?K7}S4QR?J&2XO4g5 z%Gca@&VP!gmD&H7>PD|+cW;l97$g(*FYjAdt&=4~`3N8-HW%jSLz$3@nwgoVuOI&E zc*1=IGHy0=Ys)F&mhF|rrfOUxEjs1-bAoljEEfW%#g&zTu&WQDGfBZ!4SpIGDB})A zmnl!5WR`NO)Yi#YgQBu_m19b7hZY9$P16eI=H{O*8_RZgciTp_IHRDZu3Ii5YdaqB7d|2nqq@1f_YV%HOEO)-I>}DnyUC5Yh`UUE znvITB22DrmC&CZ{b-RDq+`9J7?_4(2d=KYl$%2B9kvBB26_cUXsX!1aO|9?nb92Mp z8h=0Ib3R-u@4*KJdJ&f{kvBZ|uAGDFh?&{hGEk=tfdcTwz9JFjzR?YzB@z5`(U$Z@3)gL>k0G{ z7gty1Z)IBk=J#b`VL|cI*)F7fqNZk?E#uhOn6TG=nd{ouv;Oyx5um_2>@_zhc~z~* z49-Q-itpNG#ic-dPfyRrCKDyxF+DHr%F3fSI=L+dH z85vQA-YJgE))mxIZL9dWQ;KKKoS9u#%hTd%(p6JqN$+K4<#}-O&oJylDoV62*p4%%X`>Zm~~r<)h#+zewu1~%x^v#t#5ds z&}|?OY)qKsy@$bc-B1&`H}R}=%>t{}%4MnQ>S|}heN;}+2`+B=^0Ae7ucW-aF|Hq# z6cm0p;`GV64|^`|oQXC2CcwDHzwDb8KtxK!e4lx1r4C;NW2P zP?SNwr35KlS!AjtUEBr*bK72i%*%sK@*(8s=TFIvhq|7su%RhKb3$WP>DAR^vMU3F zgXU0#S9$4}5PTid z*Y#P}d{Goi`RB1{^fqB&Y+M{g2L~ewR@?BVBE;)Xn$|-Ro0SAQc6nUuCu(k_5v_bz+}yZ!yGwl$Q%xVx(V=E=P`8sWFjv zPfqH!9N9x&N2&X@&PbQ%78dsI3+>!Hi!x+)6{84x zKru3Hd-}MZFrdiSY;bkN^OKKpQJ-EY9@ObY3|Lz`_xLGNrf-a-evVW1M7|Q2mxl_j z8YNj{4oWl>C_2?SX4+!-v;@z5d)oa>87c70lvz+YZVNq?mw3ZHHY$xcsi z+Fzm-VUX|O@(<1*-*gc%<;tX!_was7+K4hI_LU$$aSVpMS*s6tI~&>*F$7YAs*hK4WLJluOHK0=E=udV|3L zG(Nv`2RaG0?56Ph?D*avK>g_7-CU#~jkOTe{5&NENY5G`@uM~BG$5PtmFupU#+smU z)$caZ3^BFzT@w@5c@pBo1E*gjEdVHY5T6D^cUm3K&DAVzu_|S!BQ-xdJXly=?QB;6 z^8F(K<98cbw;b3`sDmmkxw0}+9MBMn3JAD&g@&41vP^d5Eat2sH?=Z1^*abHP_h&n z48%UJo9OS4=vpB_orV&_N@{9R@4KJ1c;cGapsmTQR61-?7F4MgsiXJ5*Cwcr3MHbf zLak-Je}830Fuga%2CKju(qy1I{7M4E(ROQeFrCo*s}F+%_r8_q?H>=lPDdJdiVjXW zPS7%T!(e)}ps&B5d1KV6atw(#05DLrraQzd1^VX1;?uK3d8!~{UR({(<^IzHrce7y z2)k`$Xq3-EPbd4iM_JEM0XPVBE+RB^bjkp<*Uu};%ZF(ALMNPCR;Oij9uLf|H^VNj zN35(^JrO{ye_I)=WNygX`_P@?=H^D8Ws~H6xD(iP4Y14|zak*dFbI{dlauSJgn8&l zvoRR)Yzi!DmWs`Vpv|l~AfF(bJ}^u5!>Sd;V%3n<*Ae1;@!+0>1J^oD2Dr7Su=54`vf{>rkCp3MutV!d0cm89CJ59cH8G3N3<& zLgcB^r>yz%NKxG0-h->y`^anksJY)AmD369fVJm*4qDwyqPyBtY?v%Z;^S`t9n3`P;ziQ^ zL-=B*h-^>R8baDv?;@@_@y?|?FQ}rYr?RnAax;aDzny4Hs@7R88+`ycq~i=_X=i%O z^%#(*CUf-3kFTe?iPxlGyOE4CY+c+;vy`C!oa44B7lSN=?q5)Y{z^J#^Y}d_bjbs6*)I;_i#Vcj{}H~T($cv8n)dc~CT9W? z5?={u4riJ@3Gs2?3$t^yeP1tCJ%@X$3pd@Q^rV|k+)HHIfS`?Wdb2Uex;2!J1$xCo zxPiBWH7IUT5c`sk$QV6&LxW-hRmM?2-#pyg`vEo+5Idu$Ml6{oA2vVvu_TZKmo9Nr;F_Zwsm-BW|+qQD0wQ{T0btky5}D zXz>%r^5Qf@$ir;aTy*CgEuJaVmM|PD3Fzu3!NP^8Vy{0S@Og?zpCMVYzw!X6&}v^k z;3L1T+CCtnf4%F~gS#m?_(UWVPv@B4a>+ zn`wExTGOi39rVT}P2e*lU;#|c)3}V{Vn_Hly}ZjEsILN3#6IP(iFHtXjgs)&fZE#H z)4{*wNo_1_Ycvnk)<^4`w0nw8oDTU_#=6$+SvN|r(PE@X3PEb@(_hO`zW`|e>-yK@ zAb4}z@q~l~5G3JDP#@eBx=NUqx^E4e0PSLy;;Q=j0^AHt4lMjXq=*#QKLGbgm1`jq z1HFK+|%wiDJ6d5~~vcoh)1S$jG_7mcWyS407qA(Z^00G;ATRdl2e8|OkM z{CLWvCHZOO_P+gsj0G&V8|$6*V=7$ul56DzmVV{moGHBx?8~ zHT7fgAUMC7O*b$KhX)2CZG6rHXMWUD-xLe*3cQAuj+C9;f4=tlaf(FQ*eqGw ztjfw!ky~Ia5D-+MS>R5klY_$#4-Qo0!+3&F^Lk2@Jpn8#5pY9*q6%UgE0NB$nADnE z^=zkD5|@!?>1giTx5P*fKt+zH@vL>Ur%wV=ECLB4C2s*?x*Z1sl4a@kPWgcs#?{+{ z&~D8IOqntWT0-oj(yo#FXQZYwe`iu~bS&O+J>&NUREaSM_oD$xG%zRV%D8h2ZUH=$ zUf4krupgOsu&iy%8&-5*PY>G0X3nWnN&l+P{?)&|(dYhvkLzb(CRU{~(z3JC{>v9( zYbZu;8pfjPONFWPmtTMYK`4evF3f4i-lH?qp)(=R^B!Qcx3_o8GS*Fx;43|-BPhxY za;0^K_sDyug>rpvyJc7Qlo)uebfqV!+%*Kz(&L$~q@n&Xfi^3}pYzV_F67X2{v@Q@{3bWnO{p7$?TjrqfR%Og&HxPO*3eg3>TDHHT6pth#_703!SK)kJ zt94wf$8D*!2tvhyyOclBBH*S%awK7|U!UZwqXquJ1vykk|sgBcCnbtK4z6 ziN&(8z_j<;u!W$#gaOBuF0h0vjR@j4fH zD0EwaxL)MBw^bF`YgHO&QZeB&9hAc`3XL>jo`lB;AP~p)*Rni{e+&*>rbS%a<}ZFd zCPRD+6l0BFcvvr18SDbK5du1Zp6fBzB$9MgwAf#u5uG~^GvIqb@*0@M`1ts%t<%j> zOVs@}Xpk>i&=Ie7*=f#`_p!FN<>9x{(YVcNOTjoq)3~n)0sM_tB~ThXAO3=Mi1n;{ zS*O=XOl9ztLQ114QA@S`R>C9bIC~$+EP!7^iaK3TNHWTp>YqCU+e@K23I*$$wG7nBAKWjmuJ-&~IITF#H{VRc1X<82@kJ1*P9v66*77Uo z7#IuDWXclBT}4y^QdDYz6q2Z%=eLeu8hpc!GQRqRAGIF%<$GxBj3PI6AKazw!bxn+ z&uL9&I&hIQ@%NkI+4+gjQulsWK63_bxMkBq1=bWCOzQjPDWr+2H+p2upi3aT`_-^F zCr_U28y(F?0>7dK@5TqlgX>RkvksUKZPS;ZCW_WZI?lLoiMbG9i7> zkDog4e-Gq&yKSIJ)$)>4rPIo{n8oB{(I*Ygg>HB5`ctqtOx63pT84=^Ee(a)G5@|# zp!z4 z;sl|P2|bb_rOG-0zb_uI27g-s&rX`4e%Xtar7i_?G%zrbQ2A7_jO2hO2y2&k$4$nj zabM@wjYNL4y+!ACxHAU{5-W!5!^=+KrIzDW8eSOhCkD_yEp*K4rrIBo`YZvED1`M3 z-8#nc;_tJLBZQF+_(b7LB!6Caw$u&J{Pp_(_M?aYM4*1n;(zPgD*rQP_WuV)cHmzW o5X|$}uKd^E2>O3+k28))2;M~bAdd an LOB publisher (Admin) +The process and timing look like this: +![Process showing LOB workflow in Microsoft Store for Business. Includes workflow for MSFB admin, LOB publisher, and Developer](images/lob-workflow.png) +## Add an LOB publisher (Admin) Admins need to invite developer or ISVs to become an LOB publisher. **To invite a developer to become an LOB publisher** @@ -47,6 +49,7 @@ Admins need to invite developer or ISVs to become an LOB publisher. 1. Sign in to [Microsoft Store for Business](https://businessstore.microsoft.com). 2. Click **Manage**, click **Permissions**, and then choose **Line-of-business publishers**. 3. On the Line-of business publishers page, click **Invite** to send an email invitation to a developer. + >[!Note] > This needs to be the email address listed in contact info for the developer account. From f9807b4dbdf6f7135730e613a2fdd141ebeabfc8 Mon Sep 17 00:00:00 2001 From: jaimeo Date: Tue, 20 Mar 2018 10:12:12 -0700 Subject: [PATCH 17/28] fixed some cross-docset links hopefully --- windows/deployment/update/device-health-get-started.md | 4 ++-- .../update/windows-analytics-FAQ-troubleshooting.md | 4 ++-- windows/deployment/upgrade/upgrade-readiness-get-started.md | 6 +++--- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/windows/deployment/update/device-health-get-started.md b/windows/deployment/update/device-health-get-started.md index 70a781cb0d..4a72395427 100644 --- a/windows/deployment/update/device-health-get-started.md +++ b/windows/deployment/update/device-health-get-started.md @@ -5,7 +5,7 @@ keywords: Device Health, oms, operations management suite, prerequisites, requir ms.prod: w10 ms.mktglfcycl: deploy ms.sitesec: library -ms.date: 03/15/2018 +ms.date: 03/20/2018 ms.pagetype: deploy author: jaimeo --- @@ -72,7 +72,7 @@ Once you've added Update Compliance to Microsoft Operations Management Suite, yo ## Use Device Health to monitor frequency and causes of device crashes -Once your devices are enrolled, you can move on to [Use Device Health](device-health-using.md). +Once your devices are enrolled, you can move on to [Using Device Health](device-health-using.md). ## Related topics diff --git a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md index 6314e24f8e..6f9ab33923 100644 --- a/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md +++ b/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md @@ -8,7 +8,7 @@ ms.sitesec: library ms.pagetype: deploy author: jaimeo ms.author: jaimeo -ms.date: 03/16/2018 +ms.date: 03/20/2018 --- # Frequently asked questions and troubleshooting Windows Analytics @@ -25,7 +25,7 @@ If you've followed the steps in the [Enrolling devices in Windows Analytics](win [Upgrade Readiness reports outdated updates](#upgrade-readiness-reports-outdated-updates) -[Upgrade Readiness reports incomplete inventory](#upgrade-readiness-reports-incomplete-inventory) +[Upgrade Readiness shows many "Computers with outdated KB"](#upgrade-readiness-shows-many-computers-with-outdated-kb) [Upgrade Readiness doesn't show app inventory data on some devices](#upgrade-readiness-doesnt-show-app-inventory-data-on-some-devices) diff --git a/windows/deployment/upgrade/upgrade-readiness-get-started.md b/windows/deployment/upgrade/upgrade-readiness-get-started.md index c7fa20adf6..9d80d93f94 100644 --- a/windows/deployment/upgrade/upgrade-readiness-get-started.md +++ b/windows/deployment/upgrade/upgrade-readiness-get-started.md @@ -6,7 +6,7 @@ ms.mktglfcycl: deploy ms.sitesec: library ms.pagetype: deploy author: jaimeo -ms.date: 03/18/2018 +ms.date: 03/20/2018 --- # Get started with Upgrade Readiness @@ -30,7 +30,7 @@ When you are ready to begin using Upgrade Readiness, perform the following steps ## Data collection and privacy -To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting.md), which discusses the issues and provides links to still more detailed information. +To enable system, application, and driver data to be shared with Microsoft, you must configure user computers to send data. For information about what diagnostic data Microsoft collects and how that data is used and protected by Microsoft, see the following topics, refer to [Frequently asked questions and troubleshooting Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-FAQ-troubleshooting), which discusses the issues and provides links to still more detailed information. ## Add Upgrade Readiness to Operations Management Suite @@ -54,7 +54,7 @@ If you are not using OMS: ## Enroll devices in Windows Analytics -Once you've added Update Compliance to Microsoft Operations Management Suite, you can now start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started.md). +Once you've added Update Compliance to Microsoft Operations Management Suite, you can now start enrolling the devices in your organization. For full instructions, see [Enrolling devices in Windows Analytics](https://docs.microsoft.com/windows/deployment/update/windows-analytics-get-started). From 07d54eba25c058ef15a85b271a5023d38561be79 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 20 Mar 2018 14:42:32 -0700 Subject: [PATCH 18/28] added surface info --- .../bitlocker/bitlocker-recovery-guide-plan.md | 11 +---------- 1 file changed, 1 insertion(+), 10 deletions(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index 9e780394d7..ef20349b31 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -24,15 +24,6 @@ This article assumes that you understand how to set up AD DS to back up BitLock This article does not detail how to configure AD DS to store the BitLocker recovery information. -This article contains the following topics: - -- [What Is BitLocker Recovery?](#bkmk-whatisrecovery) -- [Testing Recovery](#bkmk-testingrecovery) -- [Planning Your Recovery Process](#bkmk-planningrecovery) -- [Using Additional Recovery Information](#bkmk-usingaddrecovery) -- [Resetting Recovery Passwords](#bkmk-appendixb) -- [Retrieving the BitLocker Key Package](#bkmk-appendixc) - ## What is BitLocker recovery? BitLocker recovery is the process by which you can restore access to a BitLocker-protected drive in the event that you cannot unlock the drive normally. In a recovery scenario you have the following options to restore access to the drive: @@ -109,7 +100,7 @@ Before you create a thorough BitLocker recovery process, we recommend that you t 2. At the command prompt, type the following command and then press ENTER: `manage-bde. -ComputerName -forcerecovery ` -> **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. +> **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because the OS will not boot after the recovery key is entered. Instead, the BitLocker recovery screen reappears until BitLocker protection is suspended or teh OS drice is decrypted.   ## Planning your recovery process From 004a68d447add51564f1e2d48909c8af6ae7808d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 20 Mar 2018 14:47:27 -0700 Subject: [PATCH 19/28] added surface info --- .../bitlocker/bitlocker-recovery-guide-plan.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md index ef20349b31..94f1153940 100644 --- a/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md +++ b/windows/security/information-protection/bitlocker/bitlocker-recovery-guide-plan.md @@ -100,7 +100,7 @@ Before you create a thorough BitLocker recovery process, we recommend that you t 2. At the command prompt, type the following command and then press ENTER: `manage-bde. -ComputerName -forcerecovery ` -> **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because the OS will not boot after the recovery key is entered. Instead, the BitLocker recovery screen reappears until BitLocker protection is suspended or teh OS drice is decrypted. +> **Note:**  Recovery triggered by `-forcerecovery` persists for multiple restarts until a TPM protector is added or protection is suspended by the user. When using Modern Standby devices (such as Surface devices), the `-forcerecovery` option is not recommended because the OS will not boot after the recovery key is entered. Instead, the BitLocker recovery screen reappears until BitLocker protection is suspended or the OS drive is decrypted.   ## Planning your recovery process From 701e7b2ea738a15f798faf0c3a9ca147e153011c Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 20 Mar 2018 21:49:03 +0000 Subject: [PATCH 20/28] Merged PR 6507: Connectivity/AllowPhonePCLinking policy - added to Policy CSP --- .../policy-configuration-service-provider.md | 3 + .../mdm/policy-csp-connectivity.md | 77 ++++++++++++++++++- 2 files changed, 79 insertions(+), 1 deletion(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index c5ec170ba9..7ab9c9e7f4 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -573,6 +573,9 @@ The following diagram shows the Policy configuration service provider in tree fo
    Connectivity/AllowNFC
    +
    + Connectivity/AllowPhonePCLinking +
    Connectivity/AllowUSBConnection
    diff --git a/windows/client-management/mdm/policy-csp-connectivity.md b/windows/client-management/mdm/policy-csp-connectivity.md index faf33814cc..e07d5f9e02 100644 --- a/windows/client-management/mdm/policy-csp-connectivity.md +++ b/windows/client-management/mdm/policy-csp-connectivity.md @@ -6,11 +6,13 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 03/14/2018 --- # Policy CSP - Connectivity +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here.
    @@ -34,6 +36,9 @@ ms.date: 03/12/2018
    Connectivity/AllowNFC
    +
    + Connectivity/AllowPhonePCLinking +
    Connectivity/AllowUSBConnection
    @@ -355,6 +360,76 @@ The following list shows the supported values:
    + +**Connectivity/AllowPhonePCLinking** + + + + + + + + + + + + + + + + + + + + + +
    HomeProBusinessEnterpriseEducationMobileMobile Enterprise
    cross markcheck mark4check mark4check mark4check mark4
    + + + +[Scope](./policy-configuration-service-provider.md#policy-scope): + +> [!div class = "checklist"] +> * Device + +
    + + + +Added in Windows 10, version 1803. This policy allows IT admins to turn off the ability to Link a Phone with a PC to continue tasks, such as reading, email, and other tasks that require linking between Phone and PC. + +If you enable this policy setting, the Windows device will be able to enroll in Phone-PC linking functionality and participate in 'Continue on PC experiences'. If you disable this policy setting, the Windows device is not allowed to be linked to phones, will remove itself from the device list of any linked Phones, and cannot participate in 'Continue on PC experiences'. +If you do not configure this policy setting, the default behavior depends on the Windows edition. Changes to this policy take effect on reboot. + + + +ADMX Info: +- GP name: *enableMMX* +- GP ADMX file name: *grouppolicy.admx* + + + +This setting supports a range of values between 0 and 1. + +- 0 - Do not link +- 1 (default) - Allow phone-PC linking + + + + + + + +Validation: + +If the Connectivity/AllowPhonePCLinking policy is configured to value 0, the add a phone button in the Phones section in settings will be greyed out and clicking it will not launch the window for a user to enter their phone number. + +Device that has previously opt-in to MMX will also stop showing on the device list. + + + +
    + **Connectivity/AllowUSBConnection** From 6148bd81471a71dd7a9d285bb0bc292c677e53aa Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 20 Mar 2018 21:52:35 +0000 Subject: [PATCH 21/28] Merged PR 6508: Configuration service provider reference topic updated --- .../mdm/configuration-service-provider-reference.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/windows/client-management/mdm/configuration-service-provider-reference.md b/windows/client-management/mdm/configuration-service-provider-reference.md index 691891af81..2ca9f64f6a 100644 --- a/windows/client-management/mdm/configuration-service-provider-reference.md +++ b/windows/client-management/mdm/configuration-service-provider-reference.md @@ -2631,6 +2631,8 @@ The CSPs supported in Windows 10 S is the same as in Windows 10 Pro except that - [CellularSettings CSP](cellularsettings-csp.md) - [CertificateStore CSP](certificatestore-csp.md) - [ClientCertificateInstall CSP](clientcertificateinstall-csp.md) +- [CMPolicy CSP](cmpolicy-csp.md) +- [CM_ProxyEntries CSP](cm-proxyentries-csp.md) - [CM_CellularEntries CSP](cm-cellularentries-csp.md) - [Defender CSP](defender-csp.md) - [DevDetail CSP](devdetail-csp.md) @@ -2640,6 +2642,8 @@ The CSPs supported in Windows 10 S is the same as in Windows 10 Pro except that - [DiagnosticLog CSP](diagnosticlog-csp.md) - [DMAcc CSP](dmacc-csp.md) - [DMClient CSP](dmclient-csp.md) +- [eUICCs CSP](euiccs-csp.md) +- [Firewall CSP](firewall-csp.md) - [EMAIL2 CSP](email2-csp.md) - [EnterpriseAPN CSP](enterpriseapn-csp.md) - [EnterpriseDataProtection CSP](enterprisedataprotection-csp.md) @@ -2669,4 +2673,5 @@ The CSPs supported in Windows 10 S is the same as in Windows 10 Pro except that - [WiFi CSP](wifi-csp.md) - [Win32AppInventory CSP](win32appinventory-csp.md) - [WindowsAdvancedThreatProtection CSP](windowsadvancedthreatprotection-csp.md) +- [WindowsDefenderApplicationGuard CSP](windowsdefenderapplicationguard-csp.md) - [WindowsLicensing CSP](windowslicensing-csp.md) From 1f6347f36ce88c886814fc343e741f023165b839 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 20 Mar 2018 22:16:34 +0000 Subject: [PATCH 22/28] Merged PR 6509: AssignedAccess CSP - updated some links --- .../mdm/assignedaccess-csp.md | 29 +++++++++++-------- 1 file changed, 17 insertions(+), 12 deletions(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index b08768dc86..48635d81a9 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -7,20 +7,20 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/01/2018 +ms.date: 03/20/2018 --- # AssignedAccess CSP -The AssignedAccess configuration service provider (CSP) is used set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device in the kiosk mode running the application specified in the CSP configuration. +The AssignedAccess configuration service provider (CSP) is used to set the device to run in kiosk mode. Once the CSP has been executed, then the next user login that is associated with the kiosk mode puts the device into the kiosk mode running the application specified in the CSP configuration. For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a kiosk on Windows 10 Pro, Enterprise, or Education.](http://go.microsoft.com/fwlink/p/?LinkID=722211) In Windows 10, version 1709, the AssignedAccess configuration service provider (CSP) has been expanded to make it easy for administrators to create kiosks that run more than one app. You can configure multi-app kiosks using a provisioning package. For a step-by-step guide, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/en-us/windows/configuration/lock-down-windows-10-to-specific-apps). > [!Note] -> The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting in Windows 10, version 1709 it is also supported in Windows 10 Pro and Windows 10 S. +> The AssignedAccess CSP is supported in Windows 10 Enterprise and Windows 10 Education. Starting from Windows 10, version 1709 it is also supported in Windows 10 Pro and Windows 10 S. The following diagram shows the AssignedAccess configuration service provider in tree format @@ -30,10 +30,14 @@ The following diagram shows the AssignedAccess configuration service provider in Root node for the CSP. **./Device/Vendor/MSFT/AssignedAccess/KioskModeApp** -A JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. For more information about how to get the AUMID, follow the information in [this Microsoft website](http://go.microsoft.com/fwlink/p/?LinkId=404220). +A JSON string that contains the user account name and Application User Model ID (AUMID) of the Kiosk mode app. For more information about how to get the AUMID, see [Find the Application User Model ID of an installed app](https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/find-the-application-user-model-id-of-an-installed-app). + +For a step-by-step guide for setting up devices to run in kiosk mode, see [Set up a kiosk on Windows 10 Pro, Enterprise, or Education.](http://go.microsoft.com/fwlink/p/?LinkID=722211) > [!Note] -> You cannot set both KioskModeApp and Configuration at the same time in the device in Windows 10, version 1709. +> You cannot set both KioskModeApp and Configuration at the same time in the device in Windows 10, version 1709. +> +> You cannot set both KioskModeApp and ShellLauncher at the same time on the device. In Windows 10, version 1607, you can use a provisioned app to configure the kiosk mode. For more information about how to remotely provision an app, see [Enterprise app management](enterprise-app-management.md). @@ -44,9 +48,9 @@ Here's an example: ``` > [!Tip] -> In this example the double \\\ is only required because it's in json and json escapes \ into \\\\. If MDM server uses json parser\composer, they should only ask customer to type one \\, which will be \\\ in the json. If user types \\\\, it'll be \\\\\\\ in json, which is wrong. For the same reason, domain\account used in Configuration xml does not need \\\ but only one \\, because xml does not (require) escape \\. +> In this example the double \\\ is required because it's in JSON and JSON escapes \ into \\\\. If an MDM server uses JSON parser\composer, they should ask customers to type only one \\, which will be \\\ in the JSON. If user types \\\\, it'll become \\\\\\\ in JSON, which will cause erroneous results. For the same reason, domain\account used in Configuration xml does not need \\\ but only one \\, because xml does not (need to) escape \\. > -> This comment applies to both domain\account, AzureAD\someone@contoso.onmicrosoft.com, i.e. as long as a \ used in json string.  +> This applies to both domain\account, AzureAD\someone@contoso.onmicrosoft.com, i.e. as long as a \ used in JSON string.  When configuring the kiosk mode app, the account name will be used to find the target user. The account name includes domain name and user name. @@ -59,11 +63,10 @@ For a local account, the domain name should be the device name. When Get is exec The supported operations are Add, Delete, Get and Replace. When there's no configuration, the Get and Delete methods fail. When there's already a configuration for kiosk mode app, the Add method fails. The data pattern for Add and Replace is the same. **./Device/Vendor/MSFT/AssignedAccess/Configuration** -Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/en-us/windows/configuration/lock-down-windows-10-to-specific-apps).Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). +Added in Windows 10, version 1709. Specifies the settings that you can configure in the kiosk or device. This node accepts an AssignedAccessConfiguration xml as input to configure the device experience. For details about the configuration settings in the XML, see [Create a Windows 10 kiosk that runs multiple apps](https://docs.microsoft.com/en-us/windows/configuration/lock-down-windows-10-to-specific-apps). Here is the schema for the [AssignedAccessConfiguration](#assignedaccessconfiguration-xsd). > [!Note] > You cannot set both KioskModeApp and Configuration at the same time on the device in Windows 10, version 1709. -> You cannot set both ShellLauncher and Configuration at the same time on the device. Enterprises can use this to easily configure and manage the curated lockdown experience. @@ -97,12 +100,14 @@ Additionally, the status payload includes a profileId, which can be used by the Supported operation is Get. **./Device/Vendor/MSFT/AssignedAccess/ShellLauncher** -Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. +Added in Windows 10,version 1803. This node accepts a ShellLauncherConfiguration xml as input. Click [link](#shelllauncherconfiguration-xsd) to see the schema. For more information, see [Shell Launcher](https://docs.microsoft.com/en-us/windows-hardware/customize/enterprise/shell-launcher). > [!Note] -> You cannot set both ShellLauncher and Configuration at the same time on the device. +> You cannot set both ShellLauncher and KioskModeApp at the same time on the device. > -> Configuring Shell Launcher using the ShellLauncher node automatically enables the Shell Launcher feature if it is available within the SKU. +> Configuring Shell Launcher using the ShellLauncher node automatically enables the Shell Launcher feature if it is available within the SKU. I. Shell Launcher as a feature and the ShellLauncher node both require Windows Enterprise or Windows Education to function. +> +>The ShellLauncher node is not supported in Windows 10 Pro. **./Device/Vendor/MSFT/AssignedAccess/StatusConfiguration** Added in Windows 10, version 1803. This node accepts a StatusConfiguration xml as input to configure the Kiosk App Health monitoring. There are three possible values for StatusEnabled node inside StatusConfiguration xml: On, OnWithAlerts, and Off. Click [link](#statusconfiguration-xsd) to see the StatusConfiguration schema. From f2a00934e98de4d58e396d233d37aa85d447daf5 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Tue, 20 Mar 2018 23:27:59 +0000 Subject: [PATCH 23/28] Merged PR 6515: Policy CSP - removed outdated list for IoT, Holographic, and Surface Hub removed outdated list for IoT, Holographic, and Surface Hub --- .../policy-configuration-service-provider.md | 230 ------------------ 1 file changed, 230 deletions(-) diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 7ab9c9e7f4..42c5737c3e 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -4459,235 +4459,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [WirelessDisplay/AllowProjectionToPC](./policy-csp-wirelessdisplay.md#wirelessdisplay-allowprojectiontopc) - [WirelessDisplay/RequirePinForPairing](./policy-csp-wirelessdisplay.md#wirelessdisplay-requirepinforpairing) - -## Policies supported by IoT Core - -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Bluetooth/ServicesAllowedList](#bluetooth-servicesallowedlist) -- [Browser/AllowAutofill](#browser-allowautofill) -- [Browser/AllowBrowser](#browser-allowbrowser) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowInPrivate](#browser-allowinprivate) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/EnterpriseModeSiteList](#browser-enterprisemodesitelist) -- [Browser/EnterpriseSiteListServiceUrl](#browser-enterprisesitelistserviceurl) -- [Browser/SendIntranetTraffictoInternetExplorer](#browser-sendintranettraffictointernetexplorer) -- [Camera/AllowCamera](#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowCellularDataRoaming](#connectivity-allowcellulardataroaming) -- [Connectivity/AllowNFC](#connectivity-allownfc) -- [Connectivity/AllowUSBConnection](#connectivity-allowusbconnection) -- [Connectivity/AllowVPNOverCellular](#connectivity-allowvpnovercellular) -- [Connectivity/AllowVPNRoamingOverCellular](#connectivity-allowvpnroamingovercellular) -- [Connectivity/DiablePrintingOverHTTP](#connectivity-diableprintingoverhttp) -- [Connectivity/DisableDownloadingOfPrintDriversOverHTTP](#connectivity-disabledownloadingofprintdriversoverhttp) -- [Connectivity/DisableInternetDownloadForWebPublishingAndOnlineOrderingWizards](#connectivity-disableinternetdownloadforwebpublishingandonlineorderingwizards) -- [Connectivity/HardenedUNCPaths](#connectivity-hardeneduncpaths) -- [Connectivity/ProhibitInstallationAndConfigurationOfNetworkBridge](#connectivity-prohibitinstallationandconfigurationofnetworkbridge) -- [CredentialProviders/AllowPINLogon](#credentialproviders-allowpinlogon) -- [CredentialProviders/BlockPicturePassword](#credentialproviders-blockpicturepassword) -- [DataProtection/AllowDirectMemoryAccess](#dataprotection-allowdirectmemoryaccess) -- [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) -- [Security/AllowAddProvisioningPackage](#security-allowaddprovisioningpackage) -- [Security/AllowRemoveProvisioningPackage](#security-allowremoveprovisioningpackage) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Security/RequireProvisioningPackageSignature](#security-requireprovisioningpackagesignature) -- [System/AllowEmbeddedMode](#system-allowembeddedmode) -- [System/AllowFontProviders](#system-allowfontproviders) -- [System/AllowStorageCard](#system-allowstoragecard) -- [System/TelemetryProxy](#system-telemetryproxy) -- [Update/AllowNonMicrosoftSignedUpdate](#update-allownonmicrosoftsignedupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/PauseDeferrals](#update-pausedeferrals) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/ScheduledInstallDay](#update-scheduledinstallday) -- [Update/ScheduledInstallTime](#update-scheduledinstalltime) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Wifi/AllowAutoConnectToWiFiSenseHotspots](#wifi-allowautoconnecttowifisensehotspots) -- [Wifi/AllowInternetSharing](#wifi-allowinternetsharing) -- [Wifi/AllowWiFi](#wifi-allowwifi) -- [Wifi/WLANScanMode](#wifi-wlanscanmode) - - - -## Policies supported by Windows Holographic for Business - -- [Accounts/AllowMicrosoftAccountConnection](#accounts-allowmicrosoftaccountconnection) -- [ApplicationManagement/AllowAllTrustedApps](#applicationmanagement-allowalltrustedapps) -- [ApplicationManagement/AllowAppStoreAutoUpdate](#applicationmanagement-allowappstoreautoupdate) -- [ApplicationManagement/AllowDeveloperUnlock](#applicationmanagement-allowdeveloperunlock) -- [Authentication/AllowFastReconnect](#authentication-allowfastreconnect) -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowPasswordManager](#browser-allowpasswordmanager) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [DeviceLock/AllowIdleReturnWithoutPassword](#devicelock-allowidlereturnwithoutpassword) -- [DeviceLock/DevicePasswordEnabled](#devicelock-devicepasswordenabled) -- [Experience/AllowCortana](#experience-allowcortana) -- [Experience/AllowManualMDMUnenrollment](#experience-allowmanualmdmunenrollment) -- [Privacy/AllowInputPersonalization](#privacy-allowinputpersonalization) -- [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) -- [Search/AllowSearchToUseLocation](#search-allowsearchtouselocation) -- [Security/RequireDeviceEncryption](#security-requiredeviceencryption) -- [Settings/AllowDateTime](#settings-allowdatetime) -- [Settings/AllowVPN](#settings-allowvpn) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/RequireDeferUpgrade](#update-requiredeferupgrade) -- [Update/RequireUpdateApproval](#update-requireupdateapproval) -- [Update/UpdateServiceUrl](#update-updateserviceurl) - - - -## Policies supported by Microsoft Surface Hub - -- [Bluetooth/AllowAdvertising](#bluetooth-allowadvertising) -- [Bluetooth/AllowDiscoverableMode](#bluetooth-allowdiscoverablemode) -- [Bluetooth/AllowPrepairing](#bluetooth-allowprepairing) -- [Bluetooth/LocalDeviceName](#bluetooth-localdevicename) -- [Bluetooth/ServicesAllowedList](#bluetooth-servicesallowedlist) -- [Browser/AllowAddressBarDropdown](#browser-allowaddressbardropdown) -- [Browser/AllowCookies](#browser-allowcookies) -- [Browser/AllowDeveloperTools](#browser-allowdevelopertools) -- [Browser/AllowDoNotTrack](#browser-allowdonottrack) -- [Browser/AllowMicrosoftCompatibilityList](#browser-allowmicrosoftcompatibilitylist) -- [Browser/AllowPopups](#browser-allowpopups) -- [Browser/AllowSearchSuggestionsinAddressBar](#browser-allowsearchsuggestionsinaddressbar) -- [Browser/AllowSmartScreen](#browser-allowsmartscreen) -- [Browser/ClearBrowsingDataOnExit](#browser-clearbrowsingdataonexit) -- [Browser/ConfigureAdditionalSearchEngines](#browser-configureadditionalsearchengines) -- [Browser/DisableLockdownOfStartPages](#browser-disablelockdownofstartpages) -- [Browser/HomePages](#browser-homepages) -- [Browser/PreventLiveTileDataCollection](#browser-preventlivetiledatacollection) -- [Browser/PreventSmartScreenPromptOverride](#browser-preventsmartscreenpromptoverride) -- [Browser/PreventSmartScreenPromptOverrideForFiles](#browser-preventsmartscreenpromptoverrideforfiles) -- [Browser/SetDefaultSearchEngine](#browser-setdefaultsearchengine) -- [Camera/AllowCamera](#camera-allowcamera) -- [Cellular/ShowAppCellularAccessUI](#cellular-showappcellularaccessui) -- [ConfigOperations/ADMXInstall](#configoperations-admxinstall) -- [Connectivity/AllowBluetooth](#connectivity-allowbluetooth) -- [Connectivity/AllowConnectedDevices](#connectivity-allowconnecteddevices) -- [Cryptography/AllowFipsAlgorithmPolicy](#cryptography-allowfipsalgorithmpolicy) -- [Cryptography/TLSCipherSuites](#cryptography-tlsciphersuites) -- [Defender/AllowArchiveScanning](#defender-allowarchivescanning) -- [Defender/AllowBehaviorMonitoring](#defender-allowbehaviormonitoring) -- [Defender/AllowCloudProtection](#defender-allowcloudprotection) -- [Defender/AllowEmailScanning](#defender-allowemailscanning) -- [Defender/AllowFullScanOnMappedNetworkDrives](#defender-allowfullscanonmappednetworkdrives) -- [Defender/AllowFullScanRemovableDriveScanning](#defender-allowfullscanremovabledrivescanning) -- [Defender/AllowIOAVProtection](#defender-allowioavprotection) -- [Defender/AllowIntrusionPreventionSystem](#defender-allowintrusionpreventionsystem) -- [Defender/AllowOnAccessProtection](#defender-allowonaccessprotection) -- [Defender/AllowRealtimeMonitoring](#defender-allowrealtimemonitoring) -- [Defender/AllowScanningNetworkFiles](#defender-allowscanningnetworkfiles) -- [Defender/AllowScriptScanning](#defender-allowscriptscanning) -- [Defender/AllowUserUIAccess](#defender-allowuseruiaccess) -- [Defender/AvgCPULoadFactor](#defender-avgcpuloadfactor) -- [Defender/DaysToRetainCleanedMalware](#defender-daystoretaincleanedmalware) -- [Defender/ExcludedExtensions](#defender-excludedextensions) -- [Defender/ExcludedPaths](#defender-excludedpaths) -- [Defender/ExcludedProcesses](#defender-excludedprocesses) -- [Defender/PUAProtection](#defender-puaprotection) -- [Defender/RealTimeScanDirection](#defender-realtimescandirection) -- [Defender/ScanParameter](#defender-scanparameter) -- [Defender/ScheduleQuickScanTime](#defender-schedulequickscantime) -- [Defender/ScheduleScanDay](#defender-schedulescanday) -- [Defender/ScheduleScanTime](#defender-schedulescantime) -- [Defender/SignatureUpdateInterval](#defender-signatureupdateinterval) -- [Defender/SubmitSamplesConsent](#defender-submitsamplesconsent) -- [Defender/ThreatSeverityDefaultAction](#defender-threatseveritydefaultaction) -- [DeliveryOptimization/DOAbsoluteMaxCacheSize](#deliveryoptimization-doabsolutemaxcachesize) -- [DeliveryOptimization/DOAllowVPNPeerCaching](#deliveryoptimization-doallowvpnpeercaching) -- [DeliveryOptimization/DODownloadMode](#deliveryoptimization-dodownloadmode) -- [DeliveryOptimization/DOGroupId](#deliveryoptimization-dogroupid) -- [DeliveryOptimization/DOMaxCacheAge](#deliveryoptimization-domaxcacheage) -- [DeliveryOptimization/DOMaxCacheSize](#deliveryoptimization-domaxcachesize) -- [DeliveryOptimization/DOMaxDownloadBandwidth](#deliveryoptimization-domaxdownloadbandwidth) -- [DeliveryOptimization/DOMaxUploadBandwidth](#deliveryoptimization-domaxuploadbandwidth) -- [DeliveryOptimization/DOMinBackgroundQos](#deliveryoptimization-dominbackgroundqos) -- [DeliveryOptimization/DOMinDiskSizeAllowedToPeer](#deliveryoptimization-domindisksizeallowedtopeer) -- [DeliveryOptimization/DOMinFileSizeToCache](#deliveryoptimization-dominfilesizetocache) -- [DeliveryOptimization/DOMinRAMAllowedToPeer](#deliveryoptimization-dominramallowedtopeer) -- [DeliveryOptimization/DOModifyCacheDrive](#deliveryoptimization-domodifycachedrive) -- [DeliveryOptimization/DOMonthlyUploadDataCap](#deliveryoptimization-domonthlyuploaddatacap) -- [DeliveryOptimization/DOPercentageMaxDownloadBandwidth](#deliveryoptimization-dopercentagemaxdownloadbandwidth) -- [Desktop/PreventUserRedirectionOfProfileFolders](#desktop-preventuserredirectionofprofilefolders) -- [Privacy/EnableActivityFeed](#privacy-enableactivityfeed) -- [Privacy/LetAppsGetDiagnosticInfo](#privacy-letappsgetdiagnosticinfo) -- [Privacy/LetAppsGetDiagnosticInfo_ForceAllowTheseApps](#privacy-letappsgetdiagnosticinfo-forceallowtheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_ForceDenyTheseApps](#privacy-letappsgetdiagnosticinfo-forcedenytheseapps) -- [Privacy/LetAppsGetDiagnosticInfo_UserInControlOfTheseApps](#privacy-letappsgetdiagnosticinfo-userincontroloftheseapps) -- [Privacy/LetAppsRunInBackground](#privacy-letappsruninbackground) -- [Privacy/LetAppsRunInBackground_ForceAllowTheseApps](#privacy-letappsruninbackground-forceallowtheseapps) -- [Privacy/LetAppsRunInBackground_ForceDenyTheseApps](#privacy-letappsruninbackground-forcedenytheseapps) -- [Privacy/LetAppsRunInBackground_UserInControlOfTheseApps](#privacy-letappsruninbackground-userincontroloftheseapps) -- [Privacy/PublishUserActivities](#privacy-publishuseractivities) -- [Security/RequireProvisioningPackageSignature](#security-requireprovisioningpackagesignature) -- [Security/RequireRetrieveHealthCertificateOnBoot](#security-requireretrievehealthcertificateonboot) -- [Start/StartLayout](#start-startlayout) -- [System/AllowFontProviders](#system-allowfontproviders) -- [System/AllowLocation](#system-allowlocation) -- [System/AllowTelemetry](#system-allowtelemetry) -- [TextInput/AllowIMELogging](#textinput-allowimelogging) -- [TextInput/AllowIMENetworkAccess](#textinput-allowimenetworkaccess) -- [TextInput/AllowInputPanel](#textinput-allowinputpanel) -- [TextInput/AllowJapaneseIMESurrogatePairCharacters](#textinput-allowjapaneseimesurrogatepaircharacters) -- [TextInput/AllowJapaneseIVSCharacters](#textinput-allowjapaneseivscharacters) -- [TextInput/AllowJapaneseNonPublishingStandardGlyph](#textinput-allowjapanesenonpublishingstandardglyph) -- [TextInput/AllowJapaneseUserDictionary](#textinput-allowjapaneseuserdictionary) -- [TextInput/AllowLanguageFeaturesUninstall](#textinput-allowlanguagefeaturesuninstall) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208](#textinput-excludejapaneseimeexceptjis0208) -- [TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC](#textinput-excludejapaneseimeexceptjis0208andeudc) -- [TextInput/ExcludeJapaneseIMEExceptShiftJIS](#textinput-excludejapaneseimeexceptshiftjis) -- [Update/AllowAutoUpdate](#update-allowautoupdate) -- [Update/AllowUpdateService](#update-allowupdateservice) -- [Update/AutoRestartNotificationSchedule](#update-autorestartnotificationschedule) -- [Update/AutoRestartRequiredNotificationDismissal](#update-autorestartrequirednotificationdismissal) -- [Update/BranchReadinessLevel](#update-branchreadinesslevel) -- [Update/DeferFeatureUpdatesPeriodInDays](#update-deferfeatureupdatesperiodindays) -- [Update/DeferQualityUpdatesPeriodInDays](#update-deferqualityupdatesperiodindays) -- [Update/DetectionFrequency](#update-detectionfrequency) -- [Update/PauseFeatureUpdates](#update-pausefeatureupdates) -- [Update/PauseQualityUpdates](#update-pausequalityupdates) -- [Update/ScheduleImminentRestartWarning](#update-scheduleimminentrestartwarning) -- [Update/ScheduleRestartWarning](#update-schedulerestartwarning) -- [Update/SetAutoRestartNotificationDisable](#update-setautorestartnotificationdisable) -- [Update/UpdateServiceUrl](#update-updateserviceurl) -- [Update/UpdateServiceUrlAlternate](#update-updateserviceurlalternate) -- [WiFi/AllowWiFiHotSpotReporting](#wifi-allowwifihotspotreporting) - - ## Policies that can be set using Exchange Active Sync (EAS) @@ -4715,7 +4486,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [Wifi/AllowWiFi](#wifi-allowwifi) - ## Examples Set the minimum password length to 4 characters. From ee9e7c35e3f0a253592d8b1e60fd963effd5dfba Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Mar 2018 13:32:12 +0000 Subject: [PATCH 24/28] Merged PR 6514: RootCATrustedCertificates CSP - updated --- .../provisioning-csp-rootcacertificate.png | Bin 27086 -> 47074 bytes ...ew-in-windows-mdm-enrollment-management.md | 13 + .../mdm/rootcacertificates-csp.md | 8 +- .../mdm/rootcacertificates-ddf-file.md | 1245 ++++++++++++++++- 4 files changed, 1221 insertions(+), 45 deletions(-) diff --git a/windows/client-management/mdm/images/provisioning-csp-rootcacertificate.png b/windows/client-management/mdm/images/provisioning-csp-rootcacertificate.png index 7a3f67195542f4a8af567f15be2ab413dc43dd1c..68672472c3d6416a371b76d9c12b194b0f326fbe 100644 GIT binary patch literal 47074 zcmeFZ2UL^kx;7kSM#ix)qoa%<#Mz2CDx%U`u#F4~L_t7WQ0X9T)Tm&P-g^lcAoLJIAcR2vClS#7eS4p?XP$>ld z%etD|zZd-;0)cGT`u)5f1hOds0@>{F-6rtK^=C(%!T$t2^fb>xvKsb{gFn8pJ)?65 z0(l+2m2=};@b?zi-;F&WkR27g{{*U#DOM0jp|{rgGgo~OQ!D)*Vx9Ow?s8*SZBbus zQQXt?qS#dT<8$dw1_d>-OTJRX5aJPA%WQlO-mdhuWi;M;r&N4pgxjae?`? zI$->Qc}(D&U++DSx0`(TXnTvN-EZti_vFm>XmJ|GTZNP1g3w#%75}Wj5-0Qvn#Nq@ z&O{B2ZT@Yb^KjiJwie4+0P^?(3`g{!>Xso0Y8od`${VVhi*FCTx_D|ub~NIY3gQak z05e99AoE@rVrpuHBcdidUWUtrh8gTI5-wHXd3eFHcT* zynyLXFkV(@7#a}X#VR7Rva;?Hu0q}#zJ5rOk&&?|^773y><^g0M+>VhwasKJ|8fHz zBQ>y`#@<#Q@CoOTIoBL{X+l;E8zul*HMO9$cMmY(*?3Xa)yaociCz?O*ESOQ3ZXtg znH8v?PnlqpoY%b_ZPkQSkl{6k&G&jx6{yn`X7@dw*wq2gdhKh@?&W)m3?GVW9y*5^(jSJYqxf%Z$ z>TB~wXv!34xHWyK^Bc%psI(aOg9w2b@M$|0iB5`R%+SecBIqHb&5*ad>cs-64fu13 z%S)YZ+G-W;>WbWXYZg-gGJ7V1BqJ@2->31uut|17jXq!$-U%!9rXg4cn;>KUE)*jp zBS+gKjpf{D3?sD)C-Mq&VmyL#XCGuXsF&p-BE?+_l)@AH_LAzhE=xRpBD$4m2!X6f zx3hW+kiVz_Q89les6Em5`IvDK%) zVQR#BneAcLG3fNhChL0DO0Ak<&Ms;~?2NulT-vyZ(7QQL!-(_|=8$~}UB~-nQtpAc zy|2=dd(w8dYz;hD^Ns4tk3|OtO0q0xJe4AaZmo(aU~f7c3nr^1wm!LfP%Pd`i;>&@ z>_YRQ27A9^_>ARC@08B)<86gK$-i2>34y(Ok+X1U;asxUOGT|6&sKiC3oXIKH52f& zRoU1n+105Cd-$Y(r*EBjW2?VJ3O?(pj0EI#KnuTy8&#~!I7i-R7Jn58|a;%DqimHqL5%NrUoYdIZNK+}VSQ108P!tY`#n107 z!(PrfoT8GYMXLKowXP#Yi||P=O;Zb@p4VqPNm4cMyH4qstge!nky5^ugzMb3uXO2} ziJ{t)sKqSWlTJmh7i+|CMV4Xx4P@+GF+GARh0UYgpdx2c;jt0>)lxl;lY17%wg=Xg zQ2Xds4v&40sSk}hSUXBdFB;GKqDQ~W+$MCi@!-)sr&4Ap^9E(fR|(QYoiQ~x&+IrN z#%9VEpLUD8YSV``O-^w5<9=hkd#s#%*Nq6nB6)|oYkq(HEooKU zaJ!N}te$F>J+ce9le*26Zb*r%3eJYiADnc`qdTamj&84CmKu2D%dlCy|Hzz8sebC& zWjvZ`*;MbgOtP#KT+t5Vl9ag z5W>XA5C~?pyw*sA{o(d>1G#@&Yjr7lu=*0z;=8r)fJF(&;a;KAT<(rru{!)9W44Pp zct?Eivd-tv3TUhBF&{~e-X_R=%yJvKxu1JPG%4;JMc^5sKe`c~W_wW?SgS!+O!Mre zEs!SLnUZ;W5by@$oc{U~_&VTL)O@jjTf5!`?YGiCM8y+J_9jIPEl==nqNu32NP1`# zM=W9Nr3P0qtAD~=?WYkn2!%F`p4t0MKlSyC2TGS#LlnUeJz`iw873NW?R9qr_i(QE zbZE5XN1W7r$&FpQ;`s@FXWFOuc;0fU^^R)J$AMv1CiG_~?iAjY;bU`mKG#;}Wb23U z;a(KFio-##?R0;c|6i4!xqU_%Csok)weC+JkbyPC=#FCFENybs{b8Dd;k9I=bN&Zhjbr6!Z)CVfu|!H1TfXlbyn8=YAeEA8)W zV|l~h`<%4){-0rr{X4O=h2jmV7nr!m6YGmRUM+z zcTuL+I$2Sj!O3`%V!wfF4no$nJE&pbP~9ztm`mH){682sKVbX^8$Kf&bqbiFn^ zr6pVT6Xi;)gVeh@yIq)r3v;d*#`pV~Id5Sf$Bx_P+dYLL7u+rc=wj^HMSA|15c{6I zjz8*sr$mLYk~~m^nv7aH1;px?epY*XyTf$bE*hpCn6wJY!579?o+l-pb&QIQEe^Yp zmw|d@UL>};)g9?~D)@%_9n5WWwHL$Nmwk5GV*HI32+Z?P)Ld{|p3lG|N}Ii~p{qst z6Up(;?S71BD>hTXwQ9R3^fc@d=F=dOvj@Zg|q4 zYh~mD3$!mQOftqTW_ZQMeN)({b)TfFnL{TPVh7%@929!sTpB<4ks^HlyCPSk;0icV zfM@n$jkGN9ijEhD{X(>^?(?4Nmt%U-bO?m4-{tf2zQw8Z)|&(eDQac&&XU7yo1Gu7 z_jdgHG&VKQ$58{EfW*Pvk%9TF7R}w-KYSP_CrECMojxyvY+>zxJJf)pwQGt%UzOK_ zgSh=v4(5NSLr9F%-D5EEH%)X3`@th4v4zow@4Qi`CMM5g@;^J;NV(O4GXE;aU|w9t z5b+b*b-uYRy<5w*E7?cyjKMCa_>AlL+6lXt4v)k1FJG3eesAON=<6UMcZ$*PAiX2i zfI`U=a-7gGh5mtgP%RX1k4~pbufAznDQKi*CM)I({WARC9AEdk`5{04;`#PSIYg2B z^jx-PyvOQUi_W|^cT1~V37Xb$F7$?4T&3VG89lzQGf*v0(D#)cm+i;Ktg0RHXLG-+ zxMCqD<)|4Q74<&*XUJ*jC3!?@Ber<5at9UZb@wD=;k8A8g2w@li2!6?v5;O<)tO|m zJo_6}#``X?kHOK$3BtsSz&>VcQ6gojBwz)9q-Ogh)iFR2e5j$Fm7oY2d^n1;Fg8xr zjYIo23N~2GYx847BRJuz#qOa_A;?>yda>+dAf6M|Se;rHRte~rwH9OQ(T2O4LEsr= zu@?e?13&frl!dDPQnwHpwc27^BP%oIpQ7US=&j(b@E4?`>FMdVGTNNpA%bcEQ`Y)P zCk*X&(;@WIJY+Cc0jHQ{PIP~k!$|G7@DP3L)b9JKEPF;>d7hp>K6?}b8B7Qh%|`or zl%K-h1YxoleV6;s!WS^ufW@KH)>D;GD)BpwMF>O#)#GDrZ9T$H?$m7$yM7DM)dgY03ZCsKCrUM55RLIQ45DJhLTG}yk&_C|y%;CMb6RSUe`llzWT zb#=euCP`9Y8X3~#hRSr3PFrEPq`*W$SuN-5FdCKZ{gS;9U>0n9Q zQ!6=w#G;f{u>lZ_L*)=>DIocHPTwgi44DBZ0+wh)*}cCGr8JhaMNbgR?n2#!Ay_vtVsWwGN~>eCL)8-Q zwN3fTf?}McEkZ}VViZaK*l7ppgznoXgHBMT2w~fN63g-i!6D0;i^7ODIi2vTqiT9BW0V)*84H< zVn`Fqa8U7dwftpA;4>DsX?F$|-;q@;t2a(q4%xJ)uI{vZ zbeNrAb%S%o{f-*?u^rnFPR=`=!XcM#J6Zh^-Zo`rWp_NaBp=PVfT_P)rJI?R^)&k+ zmHwkyEM$(QQi)%X`8$vf5p9k`1b#(DTR5Y*V};bH4lK zerJPpq@2^DiWF&f&Q?f6zn8)aF>bnZdQv)uxP?r{gT*}u1CO;pHZVt(;!RayD;7Ph-1AZ*9E0K0C% zt%~7$OrR#Nk_WC`gT{v~{)*Wz?PU#h^?NQ{gTBQkj+dBVzkhnXExc=9urAAHj}3uf z=j(^)T5PIpyS5gwe2LO*b2=vypL`qiD)1+-=k0T2HhoXpdg~g-@OOmUZsvPV{Bdc- zD`iSOB}9zeJfH{tgSoA%HdE7S@wQxVr2pG-!QW-H2vw$zNnTk|LQv#{V7O7k6!F7t zE$AhOzmNVLlGEWd-?vL8y?a**iOMfM{^mf~I~meoZ7MD7l63LF@OkoX+WF4I%L862 zCaIcR4n?X=rp!NeUKo{l(sS_5_%Y;S@fmo!x%CdE*6WU1>7=dUVmkYf-rP^OQFHij zfFiQHF?dd`&*CwKFr7tQqv!GX`K|Y_XMBvYFHASY86_I+@QOWuJYTV2V=^Joel9^$ z(Gql()m@{dG*V!q!Ktvt|73%sWe~rL^EB^7n{QXmN|^Dcl-Yq4L4lF30M3O z^>(}VPnm|bfw8*wIXAW*iqKwp*r9ou7?8|;|V*JFEM_ysfTlu%s% zxg7qZ6#I)1Po|0}43>?hx<>a>^{Qs0dEB{2AlRJ~sy9@tLRo%tC2qvECM3D`C>Rj4hG=KYBqhlF~_b$++)V6sH(_yjL{p_T? zqlNSZSxaa@Iw{#ZD{4}Fv*yleW!Bq3XW3;W>UzhuM!44iY#~;roV6Zi8yXs><=$7_T*GJyQj@cz*NinxTo?Ad|YvbNw~S8fb0+OzsU=sD$7i6>VE5@)iX3W7n7y zQqe|+hVQd?LQaz%TUcFqRqu)0z>>N*5V0qg-Xf2$x^s1VoTWO6*mnHb<`WbK@p(>BzXlzH7YqZr&dP2Z6S^x zwVLjVbmX|JLB4DD(P{*x95NgS4Y21@bc>%b8$gVft{cZMRn=`e9RhxW6y;Ve$?U+* z1UM{q#+jWI6GQ0+lr9YQmv~oDMIbfzNSFMYd?KGGCRT(`7n8T_Zmmxd(Uz(TpIuP9 z^(c}4=sC|Bs`#;gqLquBY@A*hWm!q1p9?&DY*+eXjAQ}Mm%M}97qTm&a|%XBTA=B^ zEHlB=OHDpn3H-RMO?RQffPH(MZIbw7W8b`j?YD3$2$aOc)9=6)A&-S|(LeRD*7VT0 z=W#R6VxQ;~pd_)M9UFhyCk5M3=}* zZgY9CR3rROqY~utHe7V+mF2VYtIY{V8)+pEm*X-F<3Wn28=+tgY<9B4Xx6jtD`}|Z zinu}(iTrn#zQGoKPL{W>TxHQA%VZw)GBDF!qINP9wIwPom zh?^NDq_~_$2PXNMSFtEoMc|p0U1_CRdH}O)>SZH0Zuu(d2xd-(lF48VexnXcUL?{% z=xGP)QykAtr>l9}NUMU!6Ifu$_(RS$d8LN5017YC8%c)-t-S!)K@f}4ON5u72W1ke zx>c$>3J?-m9S*(`v9YQpVYDX%nc-F;$VxbGZ#dxW!*OA}y>SzT#wB$IYu458r`qU^ zxa6yq?tB)FTCUCw2t3}yJ0hQvz7N%esera$!AW!chKr7N9uIDm|9pV` ztX1VmvLB<;-$Gs93+?NxjLs5xhUQDiQ9^y6&vI8b9(J<7@pesv4029a?Uo*pED1S; zvbWn@`w&zmj#2eq$ETyr~FzE{f7zCfo!}{0@ z>X0U%D@ajfo2>?@G_#l=Jsx8%6DP_kP4INfWEXO|I4l`**+mY~QcF4t{uyPNONghZ z$ucEBs)3|WkrO`0I=WYA4Bz_i8H{;ItOiVbioHm^v2PzaU z2GzHH&h%R$C3i|Ck=VAI7vc;WNrS<*aU-#+6CrvteMP%q-jG}0;i8=kDa)gmLZ5zqVqxbX1+1^{QcIOcT7C_P5_z~m_6`_@Q)fboflm8hQ@=vgm~R1z zLNmQ)YD$}Rb<^oPytQS%AqC8hw}T454Af^1l+sm+_MqUz3on|Q12XYhbFvtLF8<>0 z+3`-N=zauJVnt+PV1;L$KqcLFbYduC>$Caw-^6%OxSV$py6I20hx?`GQHP-))gXbq zXGt%T0?^Lvd|?aEBOg4Kk1!^j;_oj&e&U7r1!%E=$&O4=eQ;x6y}S2GR<`tx?N(7# zrC#p<%>4YX*hm;;?RTI;KHt3v_5AdB5fr)HoWh% z1(oVK`~rl(EO#d!n(#X+JK|-Wt(9F?^OM+ts6I1zcGP(c6r(E>`Bzz?f`=v7 zes7^_jsX$BZiM?j%$|XiZ8lLtiATi{Z^Ikg0&_WM$_(6{$=X-x+ObU3AMDxRePn$q zuSa}H7>a2#1f?3CG6U-qZ%Ee-5ww@94b;V8#8W(eJHZX|@;pd~2BIt}npJ7=(nW)0 zttFjF*{S_mSJEQd-=CF|nn|nIA~Gutbahy#{??^tMxLrsyMsD;{d&!CsbRC&Q;lQ` z$zd4pjDd{2x7~O8S6)U{IMU5(z9RK|k#73r(D;IBS?9?Dcq%GHKU%=EsFm8+v2(?> z+9kr7S)pt?E_87r&R6o`B*%_i0gA(4ZnEMuEX#C4FHWZeTiQJGQ!lHny11lIWh)%t z)H`W=KYnGQ*eWE<@6p73L32LawRir0Xx-5eG*xODs_yM}iZd**wtvwYZMa733%YS# zyaYF5E_OZyr6wIa5f4wtCM&`VyNw_9IJ?foW96@#M|2A9AwKz7{^+AOcFi&p)YdlY zN*SArU~?M#;i%^eAa;m5G@|rQlHOL7KjW6ZNMyQ~taLw5?#ZYch(t+1)v~$`rw{hn za{jg-1L<}YTx#g8!ZJRHSll5ff4*V)eh&{1f!5o^9Xc%QY<-=-9WCx-BJOL^fa#%4Q+jLl+C&y)Ow1Ki}#x79$Dg#yNWUqkwRFMOXxik${ ziLekTR9LJT%eYMtTy!%FQH)t$_>5VCH^yCETxdsM?q2M87})S0`=r?f#i<)hCiD-^ zi=PI5rHQ5UIxjD;$rkIc&D}>1pH!^q#RTs1hHTk@#C{V zlHlx*|KwH|5d5s%f3>c%?Pp3Y$8GigY=n>x|5l-;qQqCPT&?B@dDW28C!LyD^f+bf zkd*N35B%FHD_~y~cP@Q9t4(gG6^egBpB4T5m~v2wA5#6iLbP%)slxm7idgPDaKSYG z%XB@(Wq$?)6V$}ItP*9FTCX{#qzZ?>@n$;NsiA>Kl#{q1Bc^e}T)1Zs{Dw|_BK=B8 zV9ee>qmgz6+hs1O?%n(J(u9jNZMw;a6~=q@P=q4Z&2E3L8h5;aE~r1Al|Im@gS?L{ z5MN>MH*iTGNfqk3PLW-Lq>Cv5P;yRI0g^gBGsz+r4u zamjIpkE71wx!AOENqYKre?rVkp~|bMjT0!KvCm^9(E*+EsI%mHwcO>2R$8cf4&x|z z+>ecv#8|pKBPkOl^IntM*HE+IFoXTW!v&Swe&{U4bovM^)UIATFjF#9R7TC^#6m80 zhB$INf1ju@nJ;$)B)NPkyS9M;G!Eu~- zSXC(FPd!Rz`yckJzntG#9J`P{Q)JH`aDDzpTo2G-ALDM`({gM zp}WaI^`YuS#s0`%mQ|x+ZiPmnQ>o}8B|rZ4pemQL9i+QUCkuXF-;m~7lI)7CoJ4sd zFRKb9MSHA2Y%@-Vx_<22L@gQ;=(FPgvbuasr+d=|#DhRwM-;`*L4^6c|Ii2kUeW(! z#^E2>8Sq3}e~F^W)`0FUrLLf2_{AFd%EyzXCp%|Ltp5|$e?}kKke@S@TIDaB<*k}u zW0H7k?AX-u#_pJA(?9b8Y;WAQl*e8#F7L2A*jih0?W@fsPb=}VsPAZ^PaNb%lL{pr z7h1n;HF-ME3EdcOrM@9U*f)!8P>Y?Ncx}x5&{SV~C6)H`Qqz{|B<-{emAB229{S{| zNBG{mB4YaacEX0a_2$j&j@X$4=RAhqvu8c;lY}Op^iQ12>7kYW)b;rDQd5YJ?bRL! zb7x<(FMf2Cz)qU#Uh>n>qM)oND-Lv&bxZo0$iu!v&%3|-KDW%w;sIP9<`i(k?IROL zscMf!vgOh1A_Q_L%=7Y{?#kf-<14$ur#Sao9}R?~BnTMI(sBP`plId$FZXU%#E*3N z21GbAJ8FYw-C~IiW6aO*+-6ZDCsAVwo>*Us<)nOhKvl8(tMQG~vO_l}!OMFawypb) zXY?{rOm{#l*BGs~e%)Wzv^fV3Kvyp~CeD5Y+@BzV+S_w{CpFye0~zB-v?u<{-t`|S z(1xQ9-6zJYlz+>zM4{w4bpjH6Uwt5(l>XMpG4kOAf^=WmL>%By?yPD-HNM{m&f16? zl(w%y=7crdi`Ad=7YxYXD_zM`6YI!BMXmq z06#gTCNU<=7m>%$>D|{&FJrszW zH)(R$*p&6c{3F++5nl3XIRu4davh9{;ykh~2169I3 zgW-{pk+ZU20?+JC02aTH=D$~F)DAT~*B<^JE;0BEKcbv-C{>ZUI^v4eQf@7*poOmm zlz%VaUwf5*ykDX23hVN&y$&fAHm!@sHnLc@W0{iN1M|a&)J$&l&fdH)pGlgG6zljX zvqNp~hNX&VCag4+a6i~<4JBHdK_y;`?9i4M)tC1VQJr+*M2!`zuL~)K z&JpF31N^bOM4>-nT>MOPUIf-oP3P)RZm;q(7zxrI9}R?JSFssE*WEQq0$~Gx56zA+ z@dcoiSuRYizkoiG{~P9wjlxNholi9kJ6^oA|T8lO{mwfS>L;f?Kv6O2)A`_^K zl=}-_X|eJHh5*`#8Lhp2I&p&^MJ^2u0wmi`GwE95W_@HypA9pt-9T%V~vS_+njyZsK zUsC@$fv)RJfaTR+^SH;%V?1pH-AV(*1$z^oDeQ7ZaGkC`;S5xGR@&p3qft}_nkM}?+$Vld%B8e;8 zlOz*7^6Xs9l^<}_Gkuvv2k56LTR+(r1G6@0qt8bij2CM zbaH^>)I+?5n@LV}V(&hStU{T#$<0+F)6>5zI+kMk5wsWP6#dR6X4y)#@A@*=lA&%| zdS}sgna;xU%OHCVhcCv;!I)GiX8^J0&1KXl^>7n@jva{Wu1p3U#C|ACB*7KJ9OrqFOE1)2m*{qU!yApRR+)qhz3@Ri2`z6q%7hoqh)MHek4%T#>jR(NI7zw?wt?;Qw! z8h4G0Y zN$0?eaeUXB_)d zjHCw4NCKooNe*mc^PEpUd-l(=%;LS-QGJov{nTGtXySQh^~XZJ4ALvNe!#~D;h{uh zyN-}(BzoNw+?B!!|4l?1)T1?#EwL(3r-EJr_AzQ+;*sK<&VdStiTYTpYuT0s`O)6! zgY>7>-#dE`bkhsbl`b1^$ZBSR=&sE-vnHV^wWKQpAK*xUtA^wkx0l+nJ^q1_Vg z&a`9RzojE1k?uSY4!6EWQ?N&OS;}UHRVv#s{&e>GU-sc)_5jwROth7Vk{e(zFo*NH z1`gT<O8%(xqcN~LO69R|o`@vIIqi1opvPjgH0l5fju6|9d zHIky#741dF#H_H4ISdM`g_E#S0;q)B>b!nV5Ci??5r%q zDqVH(2D&i-UIe%m&dz4D-eSiQojnWPYRjvE6x$0G$zqV2U_O95-CHPZIN*`frYL(N zQuoco3c%HuN83Vc(AFnRS_mG183;(CL$W&{lIJLrK?{xQQ?HW)162FdD7383MEaB{-m*bj@$rW z(D0l2WCd_89yndCnv9|lK$YGaw&-h3uG~daACya#xj^87%BN~8Uh9&3Gm4fNeFMla zc*lFV6d!Nrd}<1HK)W%xrF6J%1pDT&d$7nvy-vUXGKP(foh~85R1jM<@Sm~%F<%aH zN8BnlAinB;=LD0v#EPA+|Blv&Tqu1-O90f4+14%m*G#MYO!_lhBV8qHVNS9AXPy$9 z(q1lqqAb5@_$0Fe^M@$aG^@IXg_qme0&Mx$}ER-6FAj9Joe-4ULigk0Q|PN z*aS4&6gK~)$f;0zi{=EfWv$JU+n@au_Nq^J_8vo=P(Zh??i8 zN>2^YdqD-Havp}mgTltoP>OC^RC27i2W%T~!SIui$Gd@`KBL#Pv^=U&vt{_!^QfG+ zjb!5AuM;|2eSZ6P9QbumHqjj`i2-`z>Et;KxG@#UyCF3=AgLWbmN#zP;MAq0wWU`y zrkgQ);UAY8RJlwdt!wFH12;Su?V+iD#Q_^I_L7ocu}j|)9U%^>1kzfCQ@r{TvQ%wylt7*V^1w8qoi0>eKcrif1Cs7`!laf1` zObP?NGL)Aq;e2jQaEmOTUC9B410>jh`>N*$*}=c$4^bpGe+C-H`4qBPKJiWHI65A~ zJ!8NQ&(;Zs9|a7Ay|}{N%`8B#jR&n_$hLY%1mG@Xy!(e~roH)XiFXp;kRsZTv<>_feyxOTs_GFBZ1 zo5O7ey(GYpoHqUp`F3qEZ)$um+#MCg6^%Pr*E8ppdTCCvidP+1at;XN z@v6Rn#a%2$tG>*1Kwq_9mh1^@A?!-TxOYLlSb9F})$#1Zo=P-=4`sAI78oHORS3Kk zsBMh-yles%#dZi+bKS=GL~+j0w;YzXx>7B)%~Y~;q5k~t#yn#SsTASxJBopt+Y~?? z7_a5L`&f8Ko2kL(K*w!1BTU2u4UI+3#sJrFcO6VcF3+eg$(I}QD7ZYRxWl&Vj9KDU zsq~;AUEMx|*a+-oNP67US?lw!eBYFJNBVv@dGqbt$JM@>&lTkYbcq)~Vt6d)C3~i* z;Avm})~tB40FcdL1;X2RwTy&@g{hpWL7A8f!wbn1Wnr%|7c(!#6>oc1i-%DQqQ-(R zdBr-VLmRp;YFy5t0zli08iWzn(Z+#7DjzmZyC4T!cuyo>ZX|(9`wyJLbY%nSIW-t6 zXXbce!+U+H`2}|Ob6aBBapUKS@h?=$oINvPeF`goJHWX3H?r^2+lXjb`46BV^>`;w zwtDMTxr;A{8V8i8;~yih>xRZ3nOkA~YX~_)9J>mbEFj3?Bhdy2L@mBSVN)AU;r}8s z4!9+K#i*meWAGQn`Xgl_Ws|Z_jkmT-MTlM+98U?l;*v{kZFbN(BB8s`r`|=qT3>wd z+5LFG{bdGor@M`I`Zn-*Mjb~u?xN3zc~TLbHAnJgmt3{x?$-lQi8p4&a5xT|O!H1azQqL01BS026~1K`sKqlpR_) zC3gup_CBM7p{MV5|T>4PYSxpTgrP@@z%&jZoQ% z40H7>yf{Hj6QOLZ>NWFen5VyhTXc(e?{Mj3#{fwZb<@EKP|7U2F+Lp4l7{%Sj`zJQ z&kPOVZNp0;MMcUJJD&Z@TkeU~#oO?9qxXP1whs{Jp*&(hFr5QiS@r?tc_RPMe=Yg@ zYdAWuJP*2ML3!TVTJnD_&$BxxPx51D9wqH-%&c^nIH<=x9JqcQzP z0eQ=92ULll@+#x^;5w-}`uT%x#^Ec+QLaxX5z>WwdVcBbd|M9yw7gap%K3S?Rob3R zif*fUs?J13z7MkFe6Vv`1~<0+sQKhnRV+ryU+ccJKGdJFp6dK8%pJ01Mn33N<8&0p zMRie1p-@y?<*(W$E(n&&{%bDsr>>FBpB%Ax(^qQtr)qRhr60ceW<=ZaNJCyvB;!xr zqSi|-RC>qLnP3Hj)=Qs2w-Jm_R+ipiC~#b9C}yPVAgBHkfm_7SJaOj^=>8t}Uk1wQ zoKYf_{G9I6(7Jec*N1jv7joN*zEpSWkBV-Acq*E!}eYEpB58nD5O&-BJJyP>)H7~-! z7o6l(IUcp7bTl_qN>H(ahy>loiI%-1pYsK(@4A5ZW(#*Opo@%^W)JL0ROYOSuZ0H%_POPYQLt7==jWj&Nk*92*c{l$Z$|k=?Sed`E?lDPw z9M@_5*9Pz4$O@%h*Bq^E-0a>O6OkK*QME!N#nrbry_q`30fofnI_S~z&r zJR72*@=ugOLKsJL-FVW1IUyzc4nQszIOSsfb+RSdtAqW`nqF7{LxxL5UK1ajw`NQ| z8a%apRl4U~TKB?kpQFR;Bo-+g@-;z6d|fcsu#2)q%3s9XYZYMM&4O~wT3#EVe{K6V4N;1E)!gV6ZN`#8nr&?vwIpg`+e z*I9May*`*t__Dfq#7-CMmMq|^a>W%@H#Fv8etEo&%&AW+i_P#48&YqYLDvr6(7XSt zSNa-s6BW*0=W9h46&0y)00;D^^%83^fbImI+47Qs{}GDk7qo=0nl*sL&i9EP47kPJ zuYy-rP*Bi;L?Mf=#UCgiN?~)B|3#?qaqb4>;ouONf5E!R_)XA;0r%qPKMm#MQS zhnl|!;i_qdy*whj@6`pY+aM^kt?wzhAFUD`&^T$=qjJw#f+R?G4BMd+r(I3o5gl$sVe(p zL$;Fi_`9*qrqPqFT00urDr%>+SYJbjy$Xo3f)wG-xEA=)Lr799hTrOxDH6=E!WZmHBTSR&ZjliQ^tU$r z3cRJG986`ak$ir`hrqX0ZqpNL@gzYE=pq6XTIm)ak0R{J)Hm^0DJZ*_B%z~sIw9|K zxlFl%DGd`HCz z3Ehh48=L=#7yU(P{#_E-e?qSj*|R6?YcjzSU~_$DPXku<9S{UI{?#B5&r1;Nw<&Ga z*H6!oKN8q*mb{^DPD7+g6B*D{B64p_xM3IYNjK|X(cgWKtFw}Lt+AmvP9qE-aS9J9 zbiJO|{3NaWQs4L+diA4)2?m0W^^u8y`I7zkI#b=b7;5w4CT=VPvr- zTO!uLVq1TmSR}i4IZXMN?)heB{_*%^OD78__*3z(xhz_gSXybo=Vd-$)k~sZUabO< zo6%VWW4dtloqhG8a2F4B(Lnj-Y_WY7d4&i1Gw2H_|FQ@#9Ne7Rxwv34YQF}_l5%NO zF9~k?iYETS{JXKfyU~-T7AYV(u1a3!GgzA5<@9J2g!{hg8>%$X_Nk z{xhfbe*=9uaTo_((}3CyR%0ST6f{G=e%wWTvv*rbrg&$&R&qf?XxD@8^^6? zkN%;^uKKN~x?jXVTeFqSv5~7f*@=q}N*^Lc_ZsRW2M$*FiRWgPl~N9bbZQ&gl`tB@ zh$9EQHYny5;UvImdD-A-umd1UA8e*MrpxFat&FnB<VpY$gg+peiP6+9){;yozlrEJ@EPs*qKYdH^qly4(z1JS!xK-Jz^+(qA(K%$ zAIksUS$22H9d&Gt=-e(p&|{jT^`ONEAJ#~Ts8;jC94{vg+yr-n1@H2<-H2OTOHdTX z8be1+tT1DI@kOSwCZ)F&N~n1?;M~G`Rb^u$9^z3q`eW}@X)Xo1^k@HuF1=X}FbYR| zPPR}3X54ix@Bxz_&q#rpW}Y(j=i9ec%_GHeh2L-pju_=;QxOuzAj}{H{$fEUXNn@tG0#kjj~V?3d-zU%VTJ z;rEQrzu_@YL4E&(Njh&HBj{1(m7{r)=Yhsc%TS}nc2H_hp-$K2*MeTwq1-Kym%I*H zCyuSGBIv*(g1#(G?^WsC+r9w*AWHaVo$~qwI`;20{t9_4#s{^*{2Bmsmt&?n)AV!; zL8CaB;)J4AC-9-Hmq^(v17?+l?Xuvc(G62-Dc%XLfawQQ% z|3Dqe-Nwf?ep6fpy{A~IW*Aw0)Tb@| zFw^A7TFZDfabL_8oQz9B89lD`puCrUV6(s_hn`be4)aevT6>?%GhZx>ZZ^n-_IXAn zFYKKrUQ zo|9eJ2wQat?wpvuwS_CnF>&O_xL0 za;+(Z-sO6FwaI!5{aJE2R6~}{8_%Sp*J@6g9#M&jA@x$-AA0EJ~f>fr$L6ghR5vS`l<0LVsCi+%DgR+W& zDi-uW0b?`d@jV~t2GcAObWbDEeq~<8Dk>^|PM%gTiVFiq{gLf$x%AdWxKgd6cUb3+ zbgBdB3!R!eh6Dq*c>DyiPcN8KAi}QZ?qgq57t2QbsF(IbfvFLJSwL>diOO{MkrrdC z$mP%DaTd_n?MOig8<@H#A2Bc*iVuSoHv2$kxBfdHF`vLAtBvjaktC7OHsSre zSyjCLdJ8Z+irzECo1?I#BdZc@qJa@0l3?5ekCg&Q4`Db!vHm%A29@)e0RT67QDAT$#ZHd9 z74W*{Q##nzn(kMF>UsXhGedM8-z}A{;*Anvf_Y|cIgcl|X?NeY;99Zq&J2=6rf^2> z(eK4~&}sxfukAG*7^LJywL!UGtD67ITmpm`_BA3qc!Nq%`q3lSCHM%Ua@n@y{ntSi2+A$F|oKTC;b$6Tnza zUtVAE2JvAtjCECAjHs;OKhDtbR!&Sz)P3NNH|(rvoi6mtwsa!sP3}xSE;#0%+*p(; z$sT&tf2emN*rT9D`0LizQMnPA>HvwyoV8hO5)(Xv|A2v4sPx{Tn#mCg|aX{_UHqAi)Y3Tmb1 z4G;CD3Tdmw;EfMqZi>TelZvUWY2@+xR%frM7hYmv zIff*&sYU2PnZg6wluEfJHeSa3SsNeyKcBC;`{Q42tjEP)Lm+mnPev%;pQa9?3@8|n z7$JEmdwt*&u(CY*o?N*S=owuF14DFU01K~c>?1HUARPHjh~c-`Ypeo&Q+B&qOt6sX z!_pHyHh4KA7x8uy;^L$CFy)^aZH7xPJwEr~|5gIn(*~pWIo_TlPYIaW{$|-^FyIL= zvUo;#3yvm$QV4M1{7kF&R)$Zn_J9$xO8z(gcq{lP|63dw1^{~g2^r$c{lS7CxOz*{ z@;tH+n2OMkLTjR?+UjE!E2MscY~mfCzrDTvcx$5zU^yCq86Ur+klZ>VfxW1>1E;iA z(Hrm|$86IK!8iqXEH++oP{4}!4DvBx)V8h++X^uoCp4C;qlczpt^m@Xt=@EN55Fws zgC%bVC=n3S;6j17LjPw7==S!h3P}Nx+t73#o8s?#?Rktl4)*^7_P{@aKPqGXXIKMd zUq%kEC6_{8!UN(ME2I`=rkYm{{CODf5YpT_9+ z+O*1GiC4aYi7iC+ZZOnoSMz-t>5-S}pvYQ>S<6`VjAWlWpFFw$m+ABBSq_xm;!oz_ z+YVd`uz6+cRfy~N^NRF-Tq^!69Kglh?+-L)u$j^_AovS1YiH_<`F-87jdF>~y`60k zsN83F{K}u1Ww8y|hu8+Si4P;@9=5)8vZ}|4P8)PJvX~r550h{9MR*F+m!@?}>jqAG zPRZH{Pdh6WGu6Js#%ws#u&>DfY;yfc5qUcP`NHLEpq;tJk>>YJp@o1cSDujW8jkX% z!gL18yo}Gi4FUy0*U{FYbKX0rt71U&;x-|zCj4bxP0cI{#q2ivw6$I7hG_;0t^vR- zQcLdKJ({8w<)5Z({KaZAFaZx6dK8zko?ew&H79*f6K}R^$VspZf7z0wO=z0t@3&6- z2ui=er4=)|b*XG%_RBl8KE_FfWFQ?1HC*2^4HSimRWksnVpgPaz5gJP(t4{)2LtQUXyz6Oa9w;KT>#iRc)b!9?GD!NE~H?sV1zaag2vnql28kf9?~8 zt@7(DCYI;H`#Se=UspQ2ap00dRj=j+MfnS^m zuHAu#iA@h_K5zThpy9?CjPFY6jmI{8#7e8b=eFuO;m%^ydT(vdNshj5|6XBmYnVaP zrJG@&)UgLDN^@n8ri}#9BOh2@rJPg2m*2T*F2zt}jVQJf&pGOU;Y=5_)@T#l$m*>= zZnM5UCp4j-*dyF#B2_&6nSmve#?6Mpn9XYafByWrqu`dH`bS84;Y_oHH@Z&Av!$&{H5S0IUk5>&hBgy8p z*U1I(H%z4E$}cW6b1d#9Tf~&`LVp6x+1-6(Qn%A$#n$@sRrHWh86{~$o;__X7LH96 zu!?!kaZwzYJ7T6m4TK>9SIE(oIY+Nm^ouwZDXvYnU(@(bn#BKdbl-O9zy9534|nLG^6k;uifKTF*-@(bhi} zSToJ{iL9B2HWME%D zE&!R6xN(9e;F`{u{3~>waC_V|#Zw|CH#KE(uXkDH(p@<3&i`sSKw|IMGusM;*4`O~kM}KL0}h?B0f#j{Wv3`Cit!rR`>^tWreeRs3Tjy%%RD{C=t=BS zn$0G6>0oW(=KEhFTJN=DRjNm~hAmTMbu@S&96Hat8@-H?G}IN*n5q(M^K^gq4}+H+ ziVQHx>^(S1XY!7=v@;1)wo93AOrnf|PzGZ|#%?eLjjc)XekRLWgu^rx{<7U}joD!O z&HwRm7(KY-l^H!IK>D@Lo)CZLmhsJu`yXr%PQcl+l#x!x zQe!`3tZH0mlBPc;M_H#-&BBbibNSN)_ph!Vd+GnKHhrn~EPWYEh5u$@xhrP-L^J2r z`NOi&)FxRh5PgUg`9^oYWsvCxT@FpZ!{}Mlq|g-UTGsc}MrCcR93@R$`R_7hfnhc^ zYny^ZoFW3TFV^5O%Qb--I?@wFQlXBo0>*oz!b)~0oVO3}dl6Afi@2OaYN9YlEE;u8 z0^*%pn@}@%nJv}5TiZTI@d@zwCMk7-dzpBcZl$@>;I$1aqeg(0flI~BB7tR3{+3I< z`0#}jm2tQo8T1orN*$rK1cU*C+SC{bm4W<&D@P>LknjDJ?3 z@~3cuA_ib~wjc0ti1~n`!uo85jY!G-q5CcH+r5MB%*0GSY&DdflDeIvkMr3oONfxa zf-b~WDP;!LyMF?jE{z_F!uQg1A*7lfVpH}? zzHa>9LsBM?z>ES(;YtyH6<`r@ZgjVsHx(kS0Ip%Bcu*`xDMFpgG1U)blN8Y@u>xqW zkyE;fkqb1{mz26O=$Yz=;9oc)vKqEpa*2-hTiE+9F0H_&)v6oyRH|bwUI%#aABr5%idPA@F+8NNl#I=)ATMHj))+R%x?bU z0F=-n@suc^QhdJPG7?DN#x7DA^>Amw9 z8=QEeb?4CI75A4|=49&{2e%xfr{gzb=WRw)dbma=F`p7CjCQYnjX>HZy8rG=L6Uvm z?_@fI_N{)vTYsq{7HQcS8=y_7hJ9?^H#~KtTHqdM9sGM_vYPD z7;A+wazmU5wBro6CLYx;!EIz69{X%|vht#tu%Q;#*F=dVyM#nO;@2)BKiE;aH({it z0~V`txa(o%&7msFnBv9+*f>e@4#ltR!*K$u?7!VG|BV=+rNBRV#y&sW0(8&tL2!Vs zyz}g{$A2y4<9|i(AKofz;D8)Pk>QDXIbdb{T8I`Li1G4$TNdFC$cT(zaH=RyiAs(6 z$h|dYS;VW;cmo%di2X=5~#8*#6dd&3b!IeROi%BT=6?q@h@5Q`-JSV8KUA+aIraFG@1vtQ1ee-BE z3cLQ@gLIWK48jt%sV!ozKH~alUtsyCC z!?XgzT1Q*wG&3qiSQ^?0U35y??f=4EUF1n{&^RfZsVA@czHrSM;{&OouVO$;j{|yv z(=PDGS(+#5s=>n_hk3po5W{K{Hq8L}&=K7B-;!5((_k$gWBcH6=-$1F*ol%5E|Q3E z4t`yy!oigm8BncV`Q3xpyad#6_q^)S-;_NE;QfB8PR*vTIN zv~rUY>S)ahb3FOL%V87(mhh~Iuok#&RltpoujKG}!K0Ee@4V{4ByAB-`*QK}Z=m#_ z#8CQvqZ9TN458-<+mrKg@7+=ZS4CBd!8-g_H+3p0IYRy6(xAKnl3tVB>s#8t!_{X2 zTzx~s$go$DS25nf&4kQ#bt6>`Stzx7+bZjt;0x-xuDt#;Q-0fHGRF>yf&P$!OCx#r z6yntuk~7$&izYI<&;S{3YeB1Tc%LEkOZRG0Z9ikc7s_`iZ4AeS9W8=;Ru(M>c^FS#%*e6bLgS54Wt#|#M9Le zqzLu7U#$IL0~G-8h_LNNw7`F{;dyIG0v2b+OK~<0Ws<*2q>6f2Jt)tR`E4D*;b7F3_J3)h*S0JV!>gqb#&+{P+qpDKf=B)?7Mw#)S{ z6}jXAwqq>)U(|(v%?1($`#oObb#1q>DC;w zwoL&@Gz4qzP0OETPKgeMO}D*@4K{+@ED>e9OLjyAvtQN)k|#odnHq>Y5(5k2B7w!i z`B%h*Df_)>B8YemXzu_x1(?W4{^ns717t|_Lq@7V4#D`dLKzp)7S!jUwxA0~FmmD@ z8z~n-LPSYr^hj&k3)wT`*Vswp0v-g&d=e!ET093|tSL_=0i?jrcK?eaWLK=J`g-Rf zSeh=5L{><gyHE)J*v+i zBk-sB>WIRbMm-LP1GkRwzste*dy%)O6(K7c?BeFWZSuq317wds@cj2${|47s1yVXh zHwpmxFC$?hY(ahiXe_TY#of@`5*E|>w)^8vg+aR3$k%PCW6%cT-&-$g2ofXu2?c$7`4Ec)!x?GgIOzKt|HE0vDcN z1jKWz$6XQs3<;l!nw-pqqvt#-77rZ3_%TOgC5SOM2EMN_#&HEIEy5=Lhfag^jPT?p z=!jF<7n5fV8!a3c)O1?l{Oyl&N;ejnzp9sKct2C!MD+*#_6(5$oEtv0r@R(+YteEv z20zHs1Fsb1&&(4tJtJ%_R&f)dC)E1}{Q9;T1?+=nf+qQBQ{VlK2EB)0ked!sdP{xC zn!9$1TJ6(%g6UR!eoOH%3Kej^E1oZtCB5 zn5nxv$dah|GNZh2?j2{d^UjAm3^SKPP;_$NRNwyAi)CodYX-!VZZROGAnxmZSZ}l4 z*z0;;E4-jZ;9YCw({PUU(EuZ_Lh()wT+Y-&F8kHwN`Kx}1mjF69)uZ7WfRWd*Q;3n z0HO#Y%6)bpKQfZyU%ca^&nUvcF8%QP((;5NSzg?W)6w%T*ILOx%|D{DiFf3uYLOtY z-tI>0Udi|p0R%w4m;{3Zn)4u@$gzNgNt693;+Z2Z0m)<@*b;%py~80q%s>Y@6*MAN zo^bcY<9D!g*46 zx95n|ku}^W>1kwX%PO!tsI@s+ru-TI(bzL0;@w4M)M zR{RTPA$?Mzjl2jv!6ABxD`2T0vIDaN`r` z7{AKR<$y#1hY4;8ND6bVBv`GeW*X?}>JMyd#@&H6e=6dMHimqL@ll!+s+ zIpes}CYi5u#je7H)?}2bJmB6di2w6napnaF@ITc#7~*l;#H58CQW7c8keoj}rFxY1 z4ga!u|CKAR-|K#^Y4GwhwOYQ#u`o=wwAvmW( zE(*H99fbB+f3f(@Bj{S)I;mAXL(`|P2G)6GZ?fb%^Um?~fHNgO_L#!A{U{MM=o z$N`F(TkU7{D8D8~%h^0+c1~PFykMW@h27epF}4Et`Lu zmj4Gi6Ng!Dk&3u&Ju?)2vDO5rtPo;$ad_)Q6#4$QUVjLF3~0jGIzCCZ zribk?%~N@p(UiIHN#|Uv7;iU4TqA~%57}ioO(1zSFxK270}RwTKsRul{DeIq_aAva z7s;m+3|JJpF3oYT>i(gNGxC;mM^Vmr{c4*Pw)#Z}+>1|Zt;NTZy%puXmy5R%N7zut zWp`$zU&!Hb2D|p6iabYF@(;CQAVz~)*S6LT`XeTVI`H_xYbaQTrY@~t%kBw_i9u=4 zyee<{$imB`VkE|c!$q+lA5{f5_x~_lu2ws=gZcJ;-2^-q|KXRhR#V6-Y5m(fi=?GI z?c4%h`#*{y`BRAFKOm@zHib`i$z!%@YKH$`>DCk%BSt4-z7ua*pUNgGc{^rUs_XBzlGn^pZ^KXyryK3kR>(LFz%)&;k;W$`4qDiUatkX} zw-#nR5-PQ<%ItBt+TAjHGTCqw3|qQ(M~&Wq$A9KN!N>QyqVqGGuqydJh-?e^@R`Vt z?ID#fIbF{=o-t6hZmHhqt_C}Fq%gCsbD}|^7obKj9TOwMfAmi``7S4>`(PN~?g~-SVvT)=*tGm2No-o) zo#7Z?1{$OQbq*AaSqBxN+bNoAt0<8mjU&Ad0NDo>_rOMp2_!7vG_}Y4{`$x4Jpzfy zV9VcbgJ!0(+wKpx^+zjet8AKrl_#-36-w`lf26Sd%SwS@9RaB1)!QAskid3{urUQ` zvYVvmE1;6xDvD85A)EpMa1j4#n0OXjrbbKLI{i}#Xn#?gIRgy<^GT%T)?I`_==!gp z{jxMc1`=KonZHevV)oY+sxUDUR}|$qEvc!=mrg7D*Z)aUqvZ`C@awf=O#7>6er?>y zsZ6xeYpxShz(u&A# z>rdqmF?5R^S||4LfoIyJ1^Ss=CwF6MMt#xNT%p<(np7SHL#7Iw3SPIqc$YHP6`k zP5-anl0bJJ1=0#@8#fvG{Vt13MFuWT-1xgZ{J(}o{JWP52I*gi>B>m;B{SNYpo$3{ zpj(z`Xa2G{VpFhGShhvn zA5~%AX(K__Q7%{-AFYwB3tS^5h?aKo!?=%NVcac#j7x^`jvx^kM&c$Kkb-rxJxAJ> zh1dsZIcXGZ4bTqkp_}z}SiSO>PG#O+nk??m?K+XG8V7#wZy!u#14L8G zu-$|G{#HR*rwxS-Cb+=mUeHdHW7?OF7@92iGUwO8&jJ;}<;nEfDguGF)1QaqpW|g% z*4dVf1vy$x9qFXn9VM*m1t0iO;bW40$Wh&eCloWu>|n&M7}Lz^_mnU8{l#<=<6`@O z^gDsU^L-H_UYi?O&Yh#J{fk#r(^0$i0$l-JcQ1-dtwxUGgu^JoTY2O~-YE0pvYJeBK({j? zkpIlsjY%XQ)eB$UpeUEQTkcMbZH6AGwnmK>_tEOBhZ`Q}_&ZPToV>jkbu7RZExbeI z%GL9PT#WF$=>OnLp!7iN&aS=XK)Xp9DRhdC=JcFbRDH1fVTQ@|ts%blA+R8%Zc4~R zh9Cij;P1=RRYBH1!ae^CndnaJjT5}NI=Ag7(WVTvZ-wo5G#7*q>)!&#Z-2z*mv0@P zDLUJ3&Ix)ls&5#)kw6XnT=wfyNv(DrE+e3FuzVq*i~w~cBKa)A087w^;%62g#+ZPd zA;7)|-)^yBGvbx8a>J%Fcb|*4Ht-P@-)dAfAt-*mav1#4KwySiS+bYoa0NaRhqRF= z`qo6#5X0sH`-BsHnc?|Y1t3cYglcm*9r?1=O{fP@ST-{&s@uPTz5ngz>;%q8@5RTb zPp9YPGHNEhvty|ZX*iQr4XB7$c>IomfsfuUkm~_^ot$;`)oL zjs4+~Mhhq8H3k-u8g(5WhQ3n+@tJdy65@QFPdyJFjn83hN3KJ*JaTRU;RtVKRZlWF z2u+mnr^#2m#qf6gD`%&hlvD?q^%Q!Jb0624`mi?Og{x&7hUQYa zMr=|6*{wR<`L}MU?9z3|)H$XR>lQ-iVsDdDeFIQI7Zf=drg}a9YUO^qo_T<`OA{+3Fx{kZD~^;}yHz$iv9zk7?9mE$ zo1YJ{wuH(wRH{`rkUb%l4M7n<2IN@NHZ&6DwpO?MjTUY4ZK~Iy9%}N26%gquTlJ{k(7kDxY#2EuGNS1CU>W ziWvajf;H!Kysn_=Ly*v+Ms>ZCOeHQIjM(1m3HgkyTi}{8SS*hztIwB-`{5{iK=p`thdY{6Uyjwu3 zG}yO*5R;H#<2HO=1$&JIP0CR)feRdw_D1U~Bf{L=Tp{vAm#^xpV7oBpd+BHd&7C-m*q>>?H&w5jRmzW zc?8oYXd-ln$FHt%8=7DY-DM5GQ({D%R3CSm(CA4?PJpxDE0ikjdFzfK9z#90EmNaS zUL0aW;`{|9w~tzuM4dd|myVts21s*NKwdcGHI4y`8*v;QpKsB9E{JA7mSwNF;tK5G#g8FYD%ew1>^>fmT=PT9dG~&;Y<`n zqsF5VLS^_B(pVx;F9g^@^z>|5>Y7YqnuT@{2DzMe2wCT4II@<(V^q-HAUtX!#zc`O zvuHoPHpLcG`GTa%dl)JIgKY0fq@Ule;yFOXnP>&l-)cix__6v-q|VGk3duv86w#*1 z?nb|AT67-QR>WA;!hQ%su@z8ntFugj1;pSW{c1Cw+kVH=c;qB(?gu5wZx;c|c)*rw z`7G1DlHd91Vu1>vL3W>nDiT3PHweHmG*l8?UXx3*tfDHq8{HPYx_wHS`*gH;!9Fg% zun`XU^pSZO+`}eh3GRx$5+vlT-Fp+nmNq3t48TNPe(_oq@=~-5>00(S2P05L4$}%5 zEa##@j=j~E(H9(W_X6MuR1FLWQWLG_>j=m()X*~ZaeQG5W(&VOtK2YX;Cl5oqrLRw z>%jX0pae{YgX+4N?EN5$MaZ4FanH)_wJ%FS@@!kiNGLEOu;Je!szi5a7~-;@hsS0_ zRPET*i$^GlB1ggP86|9-Uu0>veVD6Sg^rI|gmdQ@PhF&y1SC0pj{OCrTS8jL=SJo@ z>p~R6&=6xL0JrwRfy#jYuDxIw=Y;(>R#(P+lZo0T`ipaU4YCcLt8Oe6 z?PJ{B>igDl45!{t8Ohd*F66?mw)!Mjmng|)o{y4E+^XdC22))ZmNRL~u_@0B)jIxO z%cp^|5ZwNi#FC7T(aD6ql=N$zwXyKj8@AV^NeoWS`s3^eUTs7O6M1DZSC=* zL&27RMvC#s#Mck$z8C5)h(kX3m1o3nsH4h}XI*XyVlc((-V)2VXlQ`3Q42D4%z!ky zIdA)=-d$I=2TjB^**#I+PW8!7NA7k5$CB~{t;`L6%8D#G$@}e%4tI;Y?G0OsOIrm? z|C4bGZFYD~@h60dfkZ4Y zce7$l3jIPaUjM|1{+Z8Cw{#1~KIN4?0e?_zQklEj>+l>+hQOr1{w4si^>Sa)YYG2E`R7mQ11n*Ysv zj7oX+dVlM5bZVi0D9u@0yy9pAK=>A0kRvmK9K!Cm6%vW~-8)0q0{~1HgHiAQ%t_@& zwesWv(Rh>39RmOh`N^(!Ng~3~e#xVz;=u?Ookx<13_gIlOv!ZHt*zpYAtizzV0GIQ zBK`qBFWE-PLZtgK_=*1JB|GaSu$ClCoN+aGm$RV9hFiXMvH0(6 zoB)3L)G6*@-MbagxO2r1ZATLdxU~-kBW>4+N9Q9vu#SFxw>EDp=}xeqB}ZEYlw)l8XVir?f_jr73`K%a#VPZy-2EAuSFtyahN#7pGC@lH2736DfM$=vt$F326ZW%dX}6X(ojfhn3$-n5pknlR z7f0`}Zb~v4?GhJ`z;m>K=-8SFxvJ%Eabxtvh}hjXJSdfN&a(3=(hn`@E0VM7l#9kj z%Uxoez@Ey~vh%(VCpO2}6#1#tZVrMUo-m?;?0_1Qe9uO9>XHy#3_suCWz^KQDYBGa ztBpr9V)T5{LzbBsFaiN9z<+E-oPR1dU3ZyctEVmd>;W%VMQ;s{dRW_~uq>Q$kWfQ@ z%IQCsIRY>PamkX9f@VSrFWDm7YQ1m!0z>cuK0aetu^(PiIS#V->~>T_u1mabS4Tev zfwb{H^XwZ-lj}45JP?5l_~GoPk+`yaiM`?xUf_e6Fm|=hJEQDq6>>IrKi+7P;j>pU zJ^DXV_@~J575?PL1F8jt&CHMB7uTD=Xnw(_VuC*VA_lKE0YfXX{%W2iMp^Vt|7{Y% zw&ExMOpt+ipv6qpI>D@Su9_NuiPMdxfB0ZUDjOWNQ|?Bjin93Htdb!FKL8$BbyGZB z-8Fw#;l3eW=VTiJvF8fd5dF8#>wmCRfL97OE0GM%c$1I>_65Oi;f23D?c0JXO1!|j zqgh5${W@00(~`u@f+cB+z93q2G#TQ$*|!g}0+(u}>8y6Tw0e|3_0K+d644Kz6^I`I z(d20)6x7cnz4qs%=He*Z!48F|-gw&Q>S zR+1^QC&V7luI*l)T%8cPQ5o<_Kz*;c1vcF1GI?wwOBXuzx&5h#0{Pth2TGaMFU@U6 z4n$MQM@!P%<+yU0-QHzuXFS`C>O3Y&qZudSv=$3PJ z9QyKyQ_EYLY7<6`YfF}z{1hVWIhUoPiCp&{{(NQMS8axCS75m0sccVn)l-cSS%rm) z$gV|XJ+vP6j&M!>CU<*S_$}+^Seqbf1v7qO(UDU+at#>Wh6?P0UDO}oo4gcyG3-Oi z{RQ>Q8Y?Q5Yth|1^Z2b3ebAIF8!OZ++wV`wCO=iN?7OJB9c)LU0lnUosO@CBA>y|6 zO7-o5x9wUwM}KZv*1R(CLe}cOCHHmg(x5HNjE_ZbjLi#M9pW2sy&-B2FEATDVRg~x zP4f!Kbth`0hg?s1jZ(5ot$sE*zlk?79AK<_{xs(4?%*8gtHRWB!ZpL|j;GV!Us9W^ z(O_E=QYU<}_$JB>>eAww#o$b6L?=T{c_)Mvq1D)p{QK6NiK`7UfhzkD@2aLRXiC>w zSbJ;HwUxrRFKxX8qH~PY`aim8G$?KG%01=0(~t&Dk9T~M+v=aX{<5k;s9`fz0F5!P zkMChE{JEPMYpiv9`1`7RyY&nYNj6Gk1$2;7(mU&{!l%)j*|F&Zi+s<^sWZ2nRlei2 z`E+9W-a~+q8RQmyIhSE$`aHT!>D1P>Z)t=Jj!!Aj3VR-=XO)$`T3VRgJb5U@rNUIy zp%CrfIQ!`>gn9Qr%tI|YUu9`ed(gb>mngZS+oxnBof3PF-~5DRa$+{7j2JfNP%Zo; zj%BX=xIveHrpLY^@W{}kdmR3e;;}Bw^XSj8A56h+uP2&S5T<&v-Eg}RTGl{vmaK9V zO^w7s(C?e~&E79jQD}=Au|-9uQk+r7&4wU6QM`{d)e%(cwHn>ux_$8*z;zexBHQeY z#XCk2D*#HN-CwwyCfPloyuZCKd=09A>uj9lv%k2A_nF_W`7GPF^7ktQ?_Q%9Ars$^c>XOA4(fcp0s&DCv zF4t<9! za;EwhiRjYcn5-`%dTas>t$18b@M~gyEZ)~IG%dCQB+wy~Y2TEO- z+g)@i?aULHr>9M$(gp_H{lz1676b&hBKgK!)$|K<9-Q{qYHCuuYGLDNi-GpZ{ygwu zpgsyu(dOAheg>5;u{*aqjXwiemK#d8ksjP_ue6$e68l3DeiV?*YJ412#TeHEv z%5a?`E_(OP!>h~>kgx61O~3TLg@&1D_WdF_!XC26&yE2sNAON?T<+ki3hs_S)_e076|Wi!Vz`xxHnkv9T`V`^HedJ2 zFI3vTP!RXi>Rlgw#7|Ik2cWK!{XeCf%p1>w-vJ+_@qZHEl0H0jyk{P>A*=A+(GXhR zEKUiy<(DJPzt_mbxMjzCAUq*}3G%@RU43s+t23(4-X<{MN9?m>+s^-H?X{6#2AdnY z{*$i)+EUf-Vnx4pfNAzUySQ8vJlj+NcYPwwCc@ zeV3G28ILeO2EVRUQp6=cdf&sHuW$B{w@XJ?=}>I?`Sg3fKJW*1PG}C{fjh5Gx!l6u z2$a{=FgakiQA2C+DOU7PNLS173%peW%W>TW*GZ;oJDrRooznu78?VvAb^k{FL{ynN zl|6Gu=zeKf?zO@{3VJ^duG*rAw}8Ec7*Rm1`{-H_>pofriJjUqG-abH>NV7g{+^9( zHfl`I)lRk42(0pX6Y2&#l_cX+_wAf5a}?IH1-$NLa3Tc#SMji&(mws+&g2%sSo`E6M}*-oNVX`8W5dpq2zEsd9s5y}h2?m{})L z+pC#(BUE=^x;b;FeI`2TgZ*zn}+^j1dG@3xt`h25eZ?nY$?S18U$ z5hp7-TpI%&tbjCI&JN+Uff<#6_I(*pU=rW))y%l~Q^IwKlX~6|I0m=Hf=SyX3Nty? z=>NgnW%~wgR9bi8H39UpZE=$S{3k(E&+9f7gH<{Ccl1sX{#0k^{pJgqYoloE9yn6PX%Ejr&YNiM6 zA4Zu-N*iEUqe-T2ZQn?pxJ#yvNlibY^`iTr>i;HpNcX8zZm6Vl#}t7&v`Q^ zLQnt^wx!$xFw8OlOz1ZTpRkT-6J<+}j*6->bKD&|YDBO2gfvk=4lSB0?SOy0x^3z! z7XSFy&o6LnYc241nQy`b_IWjRc%SuBQF*6rtgJLhTzHyN zQ;N=E`qCQ8-+a(;_~QtvailP3ht71BCsbm50V`)S$O{4oyo&8BSE!_4yim>G-1_?3f zi#Flh)FRv(%6l=KFTBaX5{tfW`_H*0A1pA5(6m z@Gbjbh~ei-K$gg-7j{0k678Zg|XTb$=OGsP|{Q%lf6FE5kw&FP*qJ1wY?azwqS~RFC zWUC5$ApB&J6EOd3G1#@?0U+h&%Zs_Y1Vag0;N5k7cqb&{L)?6n7R}u;X}iml(_Nc* zNO)x_t#Co%1}jta6#$ii&hT zrcuw%mBUp{78%s1ubepa3R^ef&oCpeLmzUP`+N>swquL85d=awXw_GZ8B=Z7F{hIQ zpRWRsyCd|H8%VhLcx6@9J4+sc-Nmno?3TC*MHb|psVTt{bE-|4jSGleZk z_2YEs;_zY45jRDl$p+mk6Sc5C5hPnGj3M}FuF_dVh7ssX>Jr&k96}Uv$c+%B4FL?MhN<~$UgVAQT@pNVs3AF;`{b7RgFWucYU47 zB_#W(XMKfVWKKQ?7dxt`ddRoH&l952`V`Z<=7QyKesJaf6>&cXuZMU(eeQaZdvmcY z??71+MXvR5v0HW+r{nzqWbAg4nKe4!r>K>sxmqr3$#bCXDG1aSv?E^)IrK4hG%hZD zof3~CSCeDjC1E}~x$9p#0{-5!`s?SnPdFVn1|ULkg^lPj+*kga;V`$C3Zf6rk{;&P z%(?E7mdlPw?a(#Jv)t{KyxfxZIa0wF(fj7&2~^bmoDjM>xh^1H9o8=gzED~yKYE-( zHMaKM+IBV&6PF_@iOJ z0{D9q!9)CMxjhBJym3p{XPomDg%b&vJzu#OcksCn7Rx4^D{8{mnbYFW59k*@>6m`& zJ*1)x!*xq7EiB&YzEsy%IcCaa^zv^_|EA7?d9OoY$YL|!6~hWCaoIoY|1pFJ5rRgXb8YoHW8#4%Db%Fqn2t z&5qp>9Ji literal 27086 zcmdpeXIN8N+pdniGJ=XoQz6np0YSPIOh9^(CQ6YG5}FW-4G^TrCV)s&3B5@Tp^k+T zsx%QoQE5_=VCaN$)($iC`nKWxQy~@3wazFRl!J6tS2lgJ{yJgFk z1ITMvw6|>8ir=zjhvM#Ez!mo$fY-k5747X3%=Bib)nb?7a`@fhMnYz>Tr3(9kBOl=0la97-O zubF8Xa(b$$`V4JBewlq6<|%wZ(QGzc<=w**N4IjXm|XZGCVXl4$@b-^E{@-)@@uO7 zH`ZI?rR_`l2(#Aex-k*C&#fRxn4Pxqq^o4gV07bUcemcMlD&n+Bc?4USq#vQj@K3M zjr~YX8S}BVZKEprI~xD!HlzA4L{}-@vu#^U9$Y>a9k?=)=iIcxqiy_DtZCySw@9VX zhIMpHs#t5@ljl=YQ$EbQ*@~bJbmiTNCfZqxY7>ZQa5h;!{EA_Y83kkX!9ylKH8Y|TrXr%!f7;SeS!CJaSMlc%6PNrAqnkd|k5fv^OU5?h1M{;3 zLs42yI@apfY946pKItp4oScnU5~D`3ZP^}|xYC{8hSd;l+#<=%{18$=e?_~uwf|x| z-Rq#sWvVDVuv?LDJA!A|sZ`QD{n17!tAw%mZ>I*Hc&F5<1iZA|9a*mt*FnA%!X`GM z?1P?Dc*)B@5nR1SfL&0yaw7nV`gx2=-SEcqRbb4QF~dV`v--YL$^XnJIMDI(%PoGrMVDT7;}}ISUm1aM{w->L`SpEVF=|Lsh8fP^-FU?G9Bu*vu^TB z%_GQrIf4odzRnm+JAYc9c^0Rm-HMT+*Z&Y`)XOm{n7eTb4*<4 z=UzezWmd)tHr=2TQXKj2N>1;5>8}(YP+9n*^VwW*vM3_eZ_$v_5xvjHuVKG{fOJkw zMM3!RtVFut$ID3e6J|;->JwMXrDR&p77gstTi#t6+tJ%KBUR=FYmp{FZ6w1qUqiY>4(rZvTIEX(hIdcnOpoaDk)F@CTVf_EWa)NTO4z` z<+Z289)6zgN)`SK z?Gx+tSEaH+dg$MLDHTgn2jfm6$dpps(9z?_q55;BB5dDz=mTylbMI7+ZDTh$?qnw| zgDxVMTE4U<8=DPaYZl3r8)lf#YuWf@sqogleu!>EPF1#8-8;5j_@_E>t2L$3H>=QO zX6}>XET}<%hxbcI6HacCJ9Y5^7gT zDdKeAbt&4-vwE#!e{W2}b7%o^vHrVTRIjEs*M1=lg@g~O0T1@Mjjg(}4(=maSiah3 zc{_RhBQjcD;$ysic-;QDd&c5(HvHu8r~%`X+Q`u-sn?O2J7&MU4`NzA964d29r!gU zaloUl5-Vd;b04LXK?>NvEqhy()Wf6smJJv}nxy^37w@ImU*TjAf3ywClHgi7mMo6$ zb7j(N^662}LX{8Pr4B`O@DD@Vre|Lwn2yHqy_pp_rIUx-k7{&{Q;BP*_)NZj;b0Wh z(-U`A58FHO=y1FlTlX6b`_-v(3l zZ;kmrmZ7XKc+EiLHjUeYK%WH+v?&4ZT?yP&D<~?DcgWso@vce4Yz+MwjqzHO=995* zp`+r&vp($zcj~!Z%=yw?!wqDuCC0N!+F}v6#`LAT?waY1^r6MqP*TUk7Ma!pndHxz zL^l;9h{Zx)lr$$Kq6MnyJm;Qz*dOfl|jewEwxwvsFNZ$FkHk;U_hH*)^qk)R$CsxxOCosQU z`OM|i%5q}q+kunikhrAnbCvqu3Cg_5u2c;BkFp)PDjePsS2rH*6};0G#r}?K;~D7Y z_JzAqNn75&McXiTOA;t6-o0hr2E={c3%8Nz7YEOG3id`G|Nyi}&2y{nNrc&^@?1!6s4tu&pRArVQI{Ts5!lW>wUJ3Vo z&#$jAWk`+t-?L8&Y@{{TTYdkTdbglV?K0Gy1@TDo z>Ckz%ac!I#gZx!S&2$uHES00NtK*Yo1(kjMawT^5@kP~EGzZoPeKH7&hs!i3PtWF3iN^D2SZNrWsFH;Kk9?-4uXs+>1 z@e5U9&kJiN1cz*k?80U8}rPJi6rN z7mQ!%OgLO>OdUp>^0Kb|Dt;d#FLQV;y!Rn|xHeiGn%cJV#Hy#vY;I&Ep!Swmo~ra!8D9yom1P zvs1U6c?@E#JpwYhGM-ay5jCz0qg5tnuI)xKV|gFHNW4l?FcRC*M|^4a`#0f)OV^T7<(`FaYOqxf&0~v6i)~_0p$%7zl}F98Z=o>X zeIJG7_!t&!m(MEgo6KUK4VpDBnXz>?Z{N6>m}YNc2?f0=pdH9Pg2#aua!} zHXfG-VL<_=!)tfH;`uMkcV-;sx7C7rwYBTUtiA;6^LATT6_3;F^<(ZmJQjBZF=`^l zZHC?X3-|hiCPvUQQblvmwnBD?r0T9xXp%-=U8fj6t&t#V?bAGd(jZqRxlR3CmMaU- zZ<*fe*4NAmUGqK{cdbq67Clpa07cd`oEcqBBZp!49%xgsT252+aB=Z^;3plo2hlRD z+U8HY$AmC_G#xQ@O|viDCV9r>>aMH$ckyEWd0jjt`v=#bHgsPNU>vsL};_PP=uj~d#%(aLykYamWxW%J!N z5~l1V9AS#|;z*IV57jsnheo7|oDg|<2&+r4v3n}!Mi?|Kl{UxMT-q^RnLn#c;Wk%V zD9ki!FODxCcq^A^P$Kh*(tt6Y{}O(6!!C8f_&inH9nZG-^oj#&;C5AcjV_&a|H3z( z4Y4Py8;Cj9&~?tWdcM^~D4)Gyv5?_|Xk#t$H5;oXTd{7T-_bAK*Akdq=}|{ZyP9x>)pfsKQ^NZy0YRU(-=6G~mJ)amIo!Zi61%lDJd2s_6$Rh z7R%~iT6SSCZApBi+_@W-wNEadoE^#D9TOVI9_&E5o+FYO7BV*!6Z#@4#3aZC34)|> zsrp<~`fD|svItZBJ}0~lR>K*8WP(Km*EvvRI62h)5(+uI5`NXxF=b9!&ar?Zb=m(A zJ>MmsCX|Vf4dRIH!n*mn7$6<#z9w3Sg#=vtEl*>McUIl(7^=Qoai?12Ru?)og;lY$ zFR}Z8k2j~nw%EIi-zzIBZjTH+Pi9}2n@sS=jk&Z-q^6Uu{RODW zAfv<(ExvD6wsDFc!jnsPt9auK5g5P4z}HI@IQU=YlCE7W+Y_wQF*(TcL_@Jw;lb`b z1|4XM7{OxQQE@|8X)#vbd-~T{Bm@F<^g1Jd@r=WH4`ln?c61D5Vv4(pKx`1ajgv65 zebwCWw;rjK)vi0`1zLAUh>Wv^q-P%?JfW>!u8G|D4M#rHB-y+qaX8iDWSi#d{JQm` zh~Jyy$_BRs!03xlcG*adytr*E*X(eQ%d^)68h1&S^BZuI{-o6{I=$=zv)8t&^{*oszN3end_zN*Xb`86@mXrzG z#)9_MD3qEjde1#6ihVgU$1mW?E9XA;p|tI00Kr8e%6ei+i|hPFO|&<5_1kn~4d=as z19f!Eq*{yFex1aZBa-}HqbsT8prPN+CDE<{JAL_7)w`6j+g$Z^EbsTAURzq4(PQaJ zgKpQ+-9}A?{dT(JX?Mg`lDaRuLN6`#qp@B$-pjuT48-MH7Cp1yDABbE-Dy?rR5D4x zURZ8_SCO5aoj}}EdBZ>=oZ7Wr+B^|;h1Swte2XRU76 zl)3d(@7A++UXy*0_{)<_O`~e3`DHS5`fWlWmaK?_Tu7p{<6JL$>RX%R-t@Buw%d-E z$oryDM1v~E+Y3dOmuW;m1xQ&rBGV(kmkJf-^Ex6QLTp^Il^$!8pT0F^Qe3Rfh>S=h z9NLa3%Ea|gs5)6hQF__ql^jqHLxs@w-(J}`DYBr%q?tqS-hpXg`QLEs>XGY!}6kGAZnuD^a6 z0`5~e&0}^&MP=}6aY0YMqOUTgk0_(2DL#wpqoTjgefsvaOsZ~WnL-swJm1LKvZU+`6gNdHqY(#$qN@O;jlcYI*?C1366k#8{sVRd|A2 z;^jz};Dk}HjikPM@*8fVqiE{*+n!~Oh^F?XT9tI|`SVU*=C3*U32!?d?P5A_u?N-q z7|Lu}UB;j#OIwFVG{N42!vZi$5E6iYfp7r)3k4X9e|0%LhOTahGw9nD!fpfZY7K#C z50p%E8+yV}su*195wp~9*}gAF!WU_^`qeK$YcegU##r%D_Bh&u*j-pxjc+HDSOlbz zktCmnvm@%)z&ms@aFQoMs2Ed$`7-bXQLh<}+?SxHS`enS-T==z2nk3OjSfF;Bd>_&g;kAY zG!|G<*b!RdB-CJ~p%{ms{mwnJN^3sihW8Ow4+2 z@yYQ#6+{twZ9jz3AZWsdJ~ip*GssiZ57B;g+c0c0VX^1pm3@1Ubvg1=9m=YzURV+j zjh#Y)4&;E)<<>L4ZncglCbh@+q};!MaUgKEb+F)&afxpX$8DL`1UwjdoUV4Bf716I zkca9=aay~&d-+!<`*vH~F|vVS^`z{vk1bBwpF$AxoN^@LPbCI2O%?Wi`QkKnIRnxI zqKTqFecbF(FsdjNmz?1`fZuhu^Wv4!<1<~gt;V?)2|f1?56EvFVBNW&d||q>vd9mk zL&j?!#}QEMS2}0zb|rFRh=*c^o4uYw{Bb4+^{I{ROFP#&e;PM%TQOF@|~Pnut?vRFR5B}u)2_w8g?4< z6~|#L^Ug#s98B6*lXCP|;4SXVu!j)4NU5=+H>-cM4FrGrF*ZVb?Gt&h{j|$QaqVcp z{Jgum1Po0T3agOx<&jofi~MgLeEsIk2rV=Uo#IE1N}+BYJr=|>dhZkaIdu^j{=q&t zKqkhITpcUYM(-cJb_wj!k;7weAMK)vL^84Z$r1BK)Ln@#QS7M3vsfPD#AC24N(k=R zqC;{w0S~%w?OupOGNOJmLq@DV3`2o8EXwkZeqKOcs&I0?$=Z5Na@0neWBtgDA8v*K z;)TnR&U%e;CpJbkVHf)l7+Ni0|KRk19|>m=AfLGMUtNZ8fX#`e1lB?F_&F%Cq3X33 zGXjZ5H6{w|ca1b=vq~-H_EAl;1=ELQ*3))!t2=PENE_tgTY=TNh}_F~VF37}CUlAM z+E>69Vbu!NQmojPku{c|8+&qN5PCu}jP3|VXMf`0?0@kbHLO`^AEz_lznd;$;2>zs zf8=;l#7YF?rqUMyCOi8eLWpR}lirNh1D}lMZszG^RJA`tO_EgLm&D~jr597k)(Pe` zWghPBV2qIF;CbCxiQB^SLw=rPLH?`pudu}=ogzlZ0TEqa z)WJDsjE3MHhsE9+0WV~(O}X)`XSZqB!>Xlc`soYwokQxT%tgn+2#Fa`$O+TnzT}yM z;V3!vsjx=0weQBImhe`ZRN2=mqpOooVr_;4U3fwp(|oAkou_R5yGc-E#KRhA`cTBP zun%+J>9%iDcu|nUeA&5ul}XMS`s;aa_P3U-RuAdSv&~E$pcAQ`W7(iLs)Z^qI#n&>WcA7}ujhv( zZ6P^jtSt9U>%IKg$8B$nBNN>`o8AUbgC6;rjXsennxX8QC#$SK1cTr;Mrr#*umdP+ zgI@rjU<1J}8ekj74+E$Sp7PGeiLJn~Wj%j29J&xuJ|*-hBK1;A(Hs37W&Vkr&cU22)sQ4bHF&RP z&5EV6qfdusC-FNVBcW2A5_9CT?OkL7bTHEN?vcK(Q4hQ<+N2}(<6s)SdZ9_WiVxn* zD=igI@gr)V3)fyJ>`&=>T9Ln6{D#&QG=$VK7C$e3OjiHcD_pX!SMIFA5N(MI|BKVO z@B36`Fr-jbr`9sdid<`f>x3`RF+^_6%>}z^RsYw~x^e@Qh>ni~@Ll|I`{FIyjqeUZ ziX`aJz`{D#Vanv}{363j#2rOg)bsl$&V6(t&NyMxtJnsH7d(H<#hN^X`=+U#+`1s! zw8HFP-`_x*321c@`pqlR#c{2nm)-rH0%y-oU}d0QJ@KmOa4&X-i4(}hHj@~bP_s_` zCXQrWJj?*bKiVjXl#!JcZ!fRR;^LsjE1ZJdOW&sVf;*AwNFv~_sZrA-?I|k%F|;9< zwcmJEs)=J~W3%B#We^0{;^NoIb^eD!)$;C zjE9l_%NGG0jB#O`oxdFfLxzG+JNNsoCb}Aznqi}EW4&D#qgfSicul^iGB#RVR;7OB zN$YoIlfmy|+yrb{(meehsV20dYxnDEkX3{Z$LtMjeP>kA7Xck2!CTUB!o@i;ze(UM zN-uASMy+1tTgR5HW7J59pi8Fvd))lxOb&b1kmvX{FqGZ15i z(94>uF2&>8N-eM8IpKK$=@y%u^28J_C|otrlO#uOS#m*I$AdQZioRy-#!L-sOrn)< zaE*o2h~v_w@v7~mc4H}G^G&+BGF$G`%g5tRupbay3aRgk2VoqCLG zMb(fcivve<)1j6cktA)(HIX>6W>0tXcR7*Qih+2GMmsVkwue(VHiG_gyfh9`VfbN_r zbC>D&>&Ep0nI3Inm22YSpR0}TOq^wvO6M|Uhw zYsFyClNE{T zpL%*=rvU;ymAs$)ZMu3g+$Ev_@OFe6*zACxj3zcQ{PPf4GJFQ?x?NqSo+~$r(-=!q zl!qgm7CmGC^(|$uYwev6FE|m2M{+Lg7(4{;VM`+tBxMcUlIip88~U|A4jib19jlBf zh->7+JDR7+N^4qsJ>imu!8%syk|ApS?#5)z8l{59b?y~sUlUR@twIIc*olQJba_cbI6WL8oVZkC>bnY>zum?8`jE?_2r~l-sn0*=VR~97PxcRJ&D>~SF_P2fT zM%O|}OG&l*EeH6_WaQ{pX~CBBKVzT_3=Hgf3{{|nwhjR=UHewSEM?wdI>4Vhx0X=0TBBa@JNpv37M=Hosb{7>|2e(5GcmxYi z+Bo|>fzJ_P923ci?1Q00*++09(^7nlDLS2l>*Mx}cL2eYo*KPoV3cB4VovmZwc2Z1 zZ_4GvGi3aoXG>(Z0O{<34XA95YCUe@=gGjW;^}f#z`uFEDZCyUq~7F_UJ=kL>u4@Z z`J8`%%1X*EG0PUEx@weX1Ac9V{qsE~IqumChQD=-1vP|RFGO1LMxRr7KvkptC)-Q4 zRaY{%_$w@YFmCZP^F@x-(R-Jl55XRaH)G_}a(M!Citgx2RmZnTq~Js{-NT118>;pU z))lwZ@Nv{$c8y>?m8>O4jts>aJWFH}tFh8+xd3X=8-uPEaC zx@K>M{9H%Z6`y3>Es-;Fqe)tH(}4ZW3c$AHrwnh?ve9scNs>>Y#~;$#ZMv>`pf}ci z!R%kUW&(rvzbjvDQoo?41x(?eHLZWa2meFq>*0S{6Z`w;|F1O+8?WsMWFvNUWh$RN ztgdl_1(c_)Tr<_oT^(w%+uWBYQ+F|O-K}HBCZG|u^*|2Aac+D_X)YdA>S;hgwbZUM zbkBR-LRSqgjGRKc0y25Gq?6@xJ0%tsnd(ln;EY)dy= z9;p>xC?nr2wX!`T@epYYlEq=@{Z%Imo<*B$^V8Rt?ptj6c-XT%nKVB@JNpQb>z1dZ zD_zH1DLmBlMRO!c@jzqil`yu-6~3xOO3%XDl3U5UI54?Us78F~fmxgKntK+r;}u!* z#bFb3Z#(aO9Z}gw&CAP!``L_xm{f^Wqt$(!wi%?6w?>#x@+N9+5IDlN!t<*IMjDHz8VY1M>PM zPHnhhHn-GwL2#4P&dbep`2|c1GlC@JPcSm-R&}fM#`@dmbz{zz5}HoqOE=*rKj?g8C9{~0P6P9icIAv`DIv8X;RK@L&eekE|HfnZl>^z zBX|TPm<@4wb;-M%yuAxVA^cXq@xF0Z1bV`3`w+=dji4r9FO+;zrSYzZ!-Fx6; zby9Kt$(Jbn>&ic@&q&8WJOcGm6@DO>0(F9pNtqu3%TKE`UXzZghNpAr8DYT_V6yw~ zJ(nxicwKtbOy2XWq_r?0sY|1=e4@>O~aO-{)Oas41H97|J z`715_Gl6}*&pd8#l>N^0w!jM(W#MK|(3XiPEkQ})Y^}uEb=fC27q>ntKQNkj0FO6_ z5|()fm{DhND*$<}$1u|_e+48D`iMPm=r6zQbZ2js!_+G~bT1eJ^7g#zAQ=1|ZKRi4 zn0%Xkp@n};WQ0dn=K)XSr|PN_&NYoRy`H!Coji<7^o292pL_2Vnt+ZIEqZ+?UIYfEP^LethQHykZZ!sWVnkb(o?bsBv$)7@ z((h&N{y|pzrjJvPCtu&d!Kv;^Z$b0Egv=IMl6bDbaXI&tMM_nVtgFh~x7VGU05ffb ze%w^Qf3qRl+aDX)l(R7_-@ioeDMgg*v@pSFI_hRkF-f^w6lHi;RrPpa`V)I5)piM| ziGc7hj-0dBQ@7FQFXG(KRVA`)xcr&79>J65bV`qgpPI#|`k z;lwHKEAQPZOZJ?YPha)!ypHx7pE;}IZf-=?3Bq&Bnchn^oOGXwCf{?G{IQRZa1(w3 z2{}?BU1aRDxD))Krz8}uC{Qdzs4gH@QNLWq_v_+z*eknyU5EP3;4Eft_oCqV%~1eK zoaa+$d~l{8CP+GXs?6dg0-pF}b<^D>2y zu!m-La0i2A`%7H%?|BEzJcAbFun-fsVx>kQ3*i7Kh_I3B#QFJo8V%}y_Yb5CaXS|m zGOS>v&JEpzV8m|!6bx?$9&tC~;DjT}kN5@zm?ElK`ofGPOIHx6LuAX&osF)0W!WR1 zK1n#VV4e3_w-mSj zLxkfaWm4PuTA<@l+zrRtuMWpJ16bfn4Sq9%~+1A@uX&F*-sAd_x?S_Lpr7I1xuW|lhcI-dn z^jNDGOXXa1R3PVj8*49X%`7@@&<_Ny<%w*mA{HY!*ZW%*24XB1b|Q$O{A`M%nWiZz`_22BFo&HxIy9Ergx#8-)FeM`Q90rcHda@xdaLk2SDt-_V`OTP5TniBwH z#2D!C5XkQzLYoKzQ^Fu&z*2(sg&7`ZEF8BYk7G@Q#Tu+58n1v7`VMd#lmW4`v!}P| zjXYAZN_FbWhx;=En6UkDa`_*R{kAa!Z7pvUxqXF*0o_ ztiw@sBKN3ZOm{{r1Nc{nnh2I5n7R-T{`WLcIktGu)Pg_BZ%6EOf{;{h2%BuH%|=E= zwfNEvK}p$t_O*78p;lRPOJ4=<`^5Xh;AJ@3jkyU1gf$MA;;tb{nSe%Gl`P{`M+P;B zmhE+%L{}Jd%7{*A+cMd|t@qdDrrcTh5tF zNTp1g(RhCK=nn;_9sRBJKvkG)Iu_fX;6n5;Zqt5&ev3GZG7_np?)HgYzao_BQ9i(( z`ltrgjcSHsZPfdzGpM0q`# zdf!-pu${p&;uI6f?lJR-^>C1C-oXF`Bpp^lS z0YVsg^btG)U^f2>!WejjQLt%oVVXz#rDaO{m!@{M#x?pP2m}DXgVs1f+4C6Oh2j4z zIeS{{?_467NFmhNlzw)SstJ)1nmn*OiU$3(+>7o1JIZgr5W!0hX01-Y@L!n=OxQD= z#kbcO>@P5Iy+PB;`B+k`Q?H+vdZ5;1?SR3$OMRmbw;!J=s_*ec;?Ni7^dgh9m%DZ7 z?Rx`$uWbNQ=Yt2lQHP=UOq`=(?hS3f<0j1MxXZ>p6(%KVS$(ES+1tPDcIEq{#ma`QgGVXyP$Z_IS8Itv`#&OvL_syVv5#l_3||Y}m9m_? zyieCW3QJ2tK^icDkfkW2JO5pE>u216CO6F-qo`XH-T(RXdHN_TdfN^`AwB0V*!BVD zPvODQrhRB7Q9+jZu?MUmhCo5M=#k9;;tv*lll=o2gO~HArR6A$h^NN&uv!!BVt{0K zgd_DuK>z*S9tO{aq<3{ZcHMoK22mJG$NT1f77gZ=Ps`bx+mAh?%X11CdL#F_)Fcffw zA*L`_SRrDhfzUfp(pn*bomjtST4Z5`$-lHq4-9<|D!j_!m24vAJH;c<$Q8L)OFKo% zX(6pCPjO|!-)ug;@5Kv3ymS<7+wY)|8W+x9V^E0dwfqy?nx@kkT)Cz=56Z*%Ve5_C zNS=;STU;rl^a)fiy%aZT`@S>DX*h`!$5L>z27|T_4!*X;&?n1qcs|DB>&y(WS7d&# z;LWJ`7+)H$qfJg?_oBCL6PRde&M<{52@fG#t-k^_u#SxJT!iDWLV~VQ-({=U2cwx1 zWPRZ!1_e;dO@?@cTWZr#@w)yWlFsqDBXxCk6Rt-HE&HRR%e87?U;`IONhk%RCf#L| z_x>%h6L4I)yo<2_f(!sNItoJ7&H6559)dFe?{d!nBG6NFO*bA_Ba34u2|pDxxDoHA z;ngmT?Fo?{Q9EYP;^=?cl;d+bAE5(tpK71BiAu9?=x;tmCgzFP4(#e2vpkU@UVd&JvH{*A*aN47z3@+6OE<-~=`y z6dn2kYSpv|g(gkB(svwJ5}k0+=<*RvlS_aT*~jEhY>* zY0z+sjPlqY@zPHP$e$5)g`4qy&=hP-XL9oM^%6gM|Y21QG_R3GiM21GKD_9@M2hATYb3pF(&T$tU{lkPal5?lLakW)l+jYWKd5DMl$9#mvk}_v)|rs&kJ4`exYG{L0J<;Q1HT#V~0L@bi~WSHQOcRR8m_i+}e# zqhav@)L@N&jed3_5JO+FiVMjH)NexpI1SPY&Sk-RPIUrAld17uLo*Zz)_*%w`|{fq z&<)2}l+YXKs%b9eMqW!ZC&xuD5+`(FU1c3D(o<<;97rp3(>)cH4`}6+=|3KN&4AO8 z3FSbLdY#BVZx2q9E}f5A8L%b*rr5#3;qE5k7tj!Kbnq(v>?fdx9s4k01`k<-jUgN?#^>U$$KzE?%x&F3iYEm%6$mVYqqlM%h0V5r6U|2T9YDIC zJ#W!z_9%Pk_#OL;hzjEdJ^QMcYLSrkuFweTKt=uU`=NrHr%s;~kar#mEEBmhT|@oVYf5Q@I6U?P(Q5e+iqfNT zE0zoUAH$H%6lb%2H$EmqS-aa&eI3gc?^iw*=j9FfQbI9VO}@_Qj&IpgbkFTK=tymx zcopQ(NV?OYXm9+cXKtr;%EC}hn-lSVpieAAl8q}wrwE|b^OAh1?-iqUy4tp{sytV)N+eBSB3T(PeWb%NV$x-?KkQ=keu`@)bekRloIpC-ghuOD z1=6P5{iv)aM>lg46cHfCodSj1S7GPKv$rnq{o#rN8eFI4=WjQs9}v`merF3}p>>K~ z8Dy$yUN`UK+&;13(Pys^9oiSRwH|SKL1rxZLD?FU9+2bn;`N6&7p14ChqXy1P*Z#2 z^>Hub7|~OcmIZWXeC%=YddC3wJM)fprqwLv?1jFb<%9?s$}`_^XW<}_OmI}hvM^@t@UCClhNt*3RVoZf4FVc7|FKr^3% zTRY0C-ZWtUtK+nlnTFrHFJrdgaz4%{G$L0RuCxHdR4=|HEsH1ZuC ztt- z+TbABovTibLi&w*ezXS~Coj8FHzX4k8*_R6H&qQ5yV!a7P63dF7ekqiq*>`vo7H>uR}b#kWGMbC9r#c3@R2u>VyuG%SCypQZm$c~ z=5^3HBTYs=0x*NV5{(sO1xKG_)GQVw7e`;&!a~n(4PpT#w%+6t#nR+zk zwHN&v-%5Oy#!8hh$M&DR8vcp{sjdtEQCqt@z_;Anu6~s?QMpTd%!z|fMLV2tTo9;X z!D)-N57Hq@+se+yaA?2@94JSmV)z}oP2xXTw2PW7LlQ7KPC_+awmsV1X8k55G5eEI z%O$6G)KhI^BY|Y#a(eZ(SNg=ip1BQ;fjW|vdzN{)A^vM+6D*2}{mn9*jH=m@Op zzG5uQ9hY+$9B3~*-YrATfAr+&;WHT|&B5Ng7|b~$#3THtD7!J>BRYDBH>^P~C-ThR z-9RROo;uCRUZ6*^{+sL?i5UHb7JQS_7QbDDhnuXM&Q2*kniz9u&@Xy4JMYoff$35^ zkhKmK6t$R}Vxo&GE7H~kd8oy%C7jPM{9QBI?zF1N;DaiGcp67i`Dd?e_t4qn5wGL< zUee#)f5rJEG1l{wvvbzkQPd+z1KUS7$GO7Gi!8+cy-UiILY_-m+ZDBzs@aFssSkXw!ca?E`?c=g?IfXp`&JOc@fDP@ewTo& zESGYG6?E|h9lhB%yB6F^dd$ye!;}?H#;=4GULoal`psSU!6?}0 zM#@b9V*A)`m^ml-4fjzMMeNZdC)J%wd!l~0r zcjy7q?7V==jc^G*c2HM2&11GNQY=VqPWHLf4UydU+09pkW?R2ngin4b9!x*ztmIKX zgDUEp`XWU7F=+FRRh>2uIB=rF_-7)m&C@@EYNC-b^11QQm?Tg-G~Wd@jOTAl$ABrJ zA5|*DEQ+SH!NnUM*L@o+6Gcy?9(cuz@YS5J+XD;5mm5UxwXoE|pRlmE5SB?&3kYzaXVdZpg4PdLV=q4drXP-&H#y0_ z8m9kF;-jDs(O8W3^Cm0kRf3#99OlD9S?v9ApdVt2eq94=Q{Ac zO?Z;^!wWJf@(m}40c)q;<(B`96r4@vrqJLsiQ6XU@N01o>JSyoB}!j8IifuhKCwrS zwyvxPyx>e6b-eo?Qxej3NUXi?z_9YM=B2@J@=*)f!%9V#f6yFOuK$v!xepe79u} z?H2-TDUKM14xs|WMU(|5j41}-q-3}+(k(*HPRBw^d~R{R$^r+y!obvLnlTYsg5WtG zSlt`{kr3H1HfY%g9rUN%p*yLHV;(`4%Gmwfv0ZuXT075@M-!jA%Q|K!8IZ2j;MNRA z5erEq|1c8Pj5zbQ{$d>>I}2(R%M+Y%wEWT(43kMA(fbKm@+hRI{s-y$Tw&dodD$f8 z!FAUz4*Zc%Y}9#ZhRs8$FpAa_;5U*WV&70IY&{c(~2 zfQbQCFh)kw2ZQ%-Iw{BwK^}ME9%t(@Y+P;vM~+|}<$pjMNBjCd2$1xr%&OouA;QQ1 zZ{EBqC_;WEt`*d{3!MLkN!GuVjdp7OpGv|{1&or&5*J@`qKQ0OvPQl zf!`o42$flmn-tjUHGgzbrmGChN58Fy1#vfo^m(u#<8=Nsh`6f3od)M+-Cnu(F1J2* z>F!^!*2dw;x_@I+Em=(hq}&Mux#1kKZUV*liR%0{+I4C$Ok7^KQFR)yPRkKt<6zs* zDHN*Np^;VjX*t{3%O}EkD}J{6t2Qi?szXRyn-mUwD#E6j+yw_1^i{<$=Y~?1+EH1F zPKzqG-<{yQu+0H21>Z%^J0p`FiBFs`{-{#-yyq(zMrA_nDO6yAtycH`US@d@U)4Dn zN^zmfebGmWUWAu{|DT1uUn*P6O8rKr!(_iEh1)*@2qaDm#towCD-Xa{h=|okjX5$H z(6l0Lm$=O%2LEW9I@3nXy)G(ZbWcyVY!d@%C3J-%Q#Clh``DgjOOl#i);uvQj&?WXOIhM(wp>4Tdo{c=4Y=-2P`Ji_|jPZR-lNNN5( zr+>64!tvc)tMlF9PQ$$CuO>6sYy#f>jxdlrnacrWJ$50s=yv=yK{$5$*H0O(4B@!` zpFnEk!u#*Qa983Ps&7K(Fhnj*>O3cURU}xeL&@4Pe@ur7^zx-;Otfxh2fgq2BLr}X z6V|m@P9ICnkK&RQWgB#)7E2G;BN836h9QBnCk(FopKCdibF#zL^C{0g@X0X@?Il3X zU()C5Ad@7UqVB+5v6PaMassCjd3uQ;T=)+WU$_fI<&?LvDH2#9xq&y|2zDgtLO;uH zVD%O>A-XEsf71+tS^ty!0+tb;2S$mL_(~AY$W8iX|9}SyD*cIiUufnY;Q03}z2SPQ z8^c7f1c)I0zc{wq)k5WG3<`2WmOr15PT0!^#z{Qm<@qBfVb4#83zCm+(n;V67WQt! z1KFl+^JU=HJqi?u2-OwY{|#pTA`ywrjc*F;8z?=Ct{4>bxQ)uHqL$hyMC+dGlBKq4 zrqOxaTf(EsReL#gf%F9M7Yl^}lWyfH6(oXP3qs%uGOVwxH(s=2<$L;uZ+Ehtz1^78 zpqebO3vmJng{`$G978*%uE-rp!7&LJB{QVP7eT$c*Kv=mMF1k~T5Nh`-)0rBD0frf z``!nzs`qdG&Z^2jfym_SVQ4UkvBlNidOA<1z5YjDl?jKFmPqj+!?S@(yZZ0W$8FYw zfUkqC)_U{^vPj5=mYW}ol&6X
    ~2qxIm-XQGdk~nP)V0P`@wcw^wzB6~ffESCSsm;Cyqd)d9zY_Z_} zpCsd54zxC3x$00oD}0ruJF;iDNGE0 zdiBmJN1|fGQ*G@b>>~3n9?z0$5~Ss9YA?CAzEeukWb^PQajfOC`|mO#D%>M>1Y+P1b#-5Me>5!l!;KrkOZ z%i!U1p^kf%-fOhigf}HiFo8gwNQ}^0>(TJ^rO&Um1wS`SFnwhUN@IJYu}ljE(Wx*^ z&+R*Rpn*Nrk3gNM9o=y}8W6B3Vh|Je@%o5LKtmprj#(kr4?)USRa(Q_!N)hi#}T~e zY$iUmgHL8~0MT{_??z=M6&xK;c+Vg(LsQnK(%ZiE@hS_lMu?nI1~Lu6kO_Nu^)H~%v8jp1QbQU7KJq*}d8Rw$&a3u`nLc0FHi4mIuh$IlcqiSin?Ba@c0D(} zZf92cj*DdZ3bGYs&WsjndJOt`y&2D|yxJv&>2j^8HdefI7nX46K>mw#u^o*CJsYdT zasK_wVkrU>!>2DHjb;5kZw$S#c-HrKG`zz`M)LI?pQx0iPFJRC&>B4pO=t#mGFscV zf5QlyVB+ZIPk(|EOzeMNimSSlBFjoRr<9^DRC4$Rmo$b2f%eo{Uv}{vpC9<-pV_Le z?8pK;@{`h(b#7ZN_1CES)>ZF~qG0}s((P6H#utzqlI2yI&zvy25%hw$Qs>@4w@K4f z%=yt#1T3PDYX)Cjg~?!~K&B}ERj8w?;?e3#GsJtT?sRCSiKh?RhV7TW;`HVNQ5lHE z+2$bHO;nc9QvI)wLVATTDVVMY6_m4)9iSNpCOf|?isbD;p z9ohQQZBKnFt|M29CS_;p)V0TH5#b~)Wy#zt-FmFFrL4*Al+-9WiTitq%twyJEuH-| z>aUBtPVvW0sC!o3UCQlUe^=scf=)mT*+b6KE-wxNT5P1X0w$)+c48Ag)QvZ#f|x{I z;vv)<-anv9`El;O^iU!e@;|>M7Mp)_WIGRlaOObeILP$h z-;r9(KRV^MMS3Ny5q!y2#FLC|-`^?(V);+=G0q%KmIw6@`X>Lc(ylwKsdJ6@y6G)d z5o-|~XrdqpE=Uo%(6CHWricRsy)r}@mnDXPvZHB4O}M%!+07uaV)u9>1K zct%w<73U@lSL@x>-+OEqFL1kY9oPh_t+0dmfU60jISGKu>>-Wz4|N?j=9O#Ak4x^M z$<3!K;&eQ(U2Kwx$S+98B@*!$7Zx3Je+UTs&9a43VsJGn9k$~(s?-h(M}Cx+n|^do z+xDtHMtT**t2ix{T2UaEMJ!RpY*Lmzn?1mWe&cf!I{H-%+FJ;3oK~Vej4A3Q#Ay0( zk1}wLwmvQ?g-JQ}jLNeX*-}K5WlX|$;^~3cFTeQqW_(@N!jxJm5H20(_zecCrsrTT zV*sru7*=zR)8o=?4(+y0-`erQf5E*_q&Bb8RrK`AU-MdQ&SzmzAjrK&-?C~~fyp(M zmHRCLt!D?g%iUcu|5dsQX;T(!+g;P;LE4Q4`qj5gb?drLmgN~=x|qmybRNxqy5E3M zmbVuaL;>CI?A;9x?drXk-72bX>Gs%r%w1#oO4?4+=#BG=#Ppk~)Il?|V@Gwbd{n*) zt~4lc%wl-6e5zbwThZXr)Z7Z@gp_qQ0M@znm(e=rPV)^6oFEork%LQ~+1V=|Sw+HKvMX3fL%YfZ#qDgjaJS8V>` z_6Z2W(^`%L`lbMLwW#tgJ1SZiKnL)2(b>7hO;@Sx_`)Eb&(QZ0Z}XQ);8i(@zq_%c z2$IUQb#yI$X+4l2@lla(HDC|%u7)tFDVW;Bz~&_Oj%A_L4!4TChe#q~JNhAgTl==L zr!ylC$v~+YI%GL`w==y%^*ogr7wFtOA3g?@$-h7RQH~1y)%z9i$|{XO#48-4JYIL@ z%qkdjgxyE((MruzhfNIEWqGZDZ^Um)Immvrmh^f~xTOX3LYfq;2p%JGtyUa0$QYXN}Hn)EfvqN_DV|(xUaUb_) zmu1eT^(p6>_l(H$m{)KvS`3_%5>;dwY)^hURJ=J@HEZ7exXc$ay}xD_iHce>)dT8B zG;6y%)xAzAw&d(&MIVdM_WY7?Ez`YfB>H9Xe}{KL9N~n@^YLQIi+PRPzlq_c%+ZCr zm$#hj@?FD#Y+Y4roVa*ANG&I4lq-U`!F!q!K=JSR?s3Nk^3ASp{lEuvRzpmROrj^= zu=0y^#^Cx9wXWWIl|0;)%4M9a0u_a^@v)YT5Gz;?Yjue7xgh?`p)bc=yoenptCDDR zH_FzD(xjfU_55yG<-ZZ762{uikIkt{XZX1q2l+Nt5$o*pMQ)(PGQHz%cYxXFped7b zfV)b!OB{bA~ zvpC;QVuxLDvbTL><|R&QNu|T4atTJ_Sk zKLdg)t~7Q|1KZ+^ky)#7Zpbx0k^rYi$OoKZN|J--X#`_ZS`3$E%eak5TCOVjaW*I3 znHtyT33c~&MhaYMno}kg(F?@YCLKJe#qTzc4XEraJ)U254CfE}VgK<8kBU&r(VE3c zwl_Xo=2{d|yU$S}NF79=;hcYK5lODhVV9nL)`NowPGe!LtzJsmkr>F6CC`mcGm4nm zizz6g;t|8|RCj33&lwurvbwV(Oe1_)yLp7;$m`PcX5d(@AeX23f%f!KH7!5NT2svH zAL&gQdl+3oes@F)@k12ra5psEqm8|Oq*BJ*DJFix@g0SEzBg)H|B0T>qPJ5oI+t@R zW_n(1lk-CwrlBtPe0Hv8U%>6CtFn%rO57RA4GInQG0EjtYnue#9t+^cm60>J_cwZ- zfQ^h3Sq%@mb-1rnxHzneJX)G*hfSN26ZCCdfwbL+Os=o57t_0qULG(c{jF*;jai;p zS&cIU{~@dk?h-D*TvX#W&Hjg&ASfVo;BWa|7ghh1pPh^7<^1I-&s z3MQ^>pCx{=VY9hBU544C=iaE4hj@_chZ`LRg&Q?}YSRzJ%5lStFt}xlU zep`A!*-E`ECH{yjrox$=_K}2TV3%AO+PwJj={u*i7UO&3)?a)?H6{@=)L%=&-#nJr z=Bil)KWDP^pG}LING6+ypMllifS9lc==uNDPEPWJaE*4h?@a&rxlh1Er#x74*OQr_ zQa03qh?ABY!re_zK8(d zgW>hZ2sW&of>ohV&hO@@l%;1iELL-XHCe#8U5xdZ2e30_2i(Y8XNFD%RCKN+7jyHY zDSPmchq5|hg4EmG3f4C))Zd1_UnQHa? zje0TTUrDha$IF2Ee00?SfAuD!1dDBBFk}S#N53lJA51*5eY9lm_5mpd;f3!sRnviGzj~kn$9L5n}fiigvB9n-gKIa+T z#k0cKUDWGb&{bt@hb;hGF{qF4oIi?B2U|hyD_a4wuqc9sMGycM7O0!ROTqw>Wk4#y zW7#Fv13dyny3uO9xofHSX{crV_VJuHBSNuG=|EvkPp%2WWlu@{M}M{2lLbOl6*M=H zGW^50&T!YIQ4rgw@urg-j@Sblo@zX@a~h-(M$%?1#EQV~3Iy4!=7q3g1UE`IAJW-z zPs)rbK~LJ0+6I(4C)WThptWjlUX>sPE6sflu@%1;g`@K+6zu)_!8K1`bT0nK!OvkA zSTPY|3_=W+<+?8tr3wn0yF63b=1J$Gb%&4qG=5|Fa8E;a^>`Cqe7MEp1OUEM3UBDp zS19E0ll52Sc0362AXHv+XxDnWCH0X*n$5Qr%W04DTq^Q;I3Ljz&J7>rLJtuO`yYvuX`IgcRp9eT+TZi8j_eZFL>cod zUW^Fn*48VM6p8#65w_H+MkO_erTzJrytNP61`o+s6nicBw;&2dhHry0MZ;zv1T)J) zoknwlkn(%l5~AEBKzLst_;eTQeRXA=c9cmv@M2P$R5|SWY=Daqvis@>*EJ#8HCV^~ VtRiCt{12v2NXF(ymx=pB{|_@>rH%jq diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index b9bf7dd558..5965974382 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1345,6 +1345,12 @@ For details about Microsoft mobile device management protocols for Windows 10 s
  • OS/Mode
    • + +[RootCATrustedCertificates CSP](rootcacertificates-csp.md) +

    Added the following node in Windows 10, version 1803:

    +
      +
    • UntrustedCertificates
      • +
    @@ -1651,6 +1657,13 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware +[RootCATrustedCertificates CSP](rootcacertificates-csp.md) +

    Added the following node in Windows 10, version 1803:

    +
      +
    • UntrustedCertificates
      • +
    + + [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies for Windows 10, version 1803:

      diff --git a/windows/client-management/mdm/rootcacertificates-csp.md b/windows/client-management/mdm/rootcacertificates-csp.md index 8f5c11db9d..b7fa5a8362 100644 --- a/windows/client-management/mdm/rootcacertificates-csp.md +++ b/windows/client-management/mdm/rootcacertificates-csp.md @@ -7,11 +7,14 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/26/2017 +ms.date: 03/06/2018 --- # RootCATrustedCertificates CSP +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + The RootCATrustedCertificates configuration service provider enables the enterprise to set the Root Certificate Authority (CA) certificates. > [!Note] @@ -44,6 +47,9 @@ Node for trusted publisher certificates. **RootCATrustedCertificates/TrustedPeople** Node for trusted people certificates. +**RootCATrustedCertificates/UntrustedCertificates** +Addeded in Windows 10, version 1803. Node for certificates that are not trusted. IT admin can use this node to immediately flag certificates that have been compromised and no longer usable. + **_CertHash_** Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value. diff --git a/windows/client-management/mdm/rootcacertificates-ddf-file.md b/windows/client-management/mdm/rootcacertificates-ddf-file.md index 6e6492a240..03c352d150 100644 --- a/windows/client-management/mdm/rootcacertificates-ddf-file.md +++ b/windows/client-management/mdm/rootcacertificates-ddf-file.md @@ -7,17 +7,19 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 12/05/2017 +ms.date: 03/07/2018 --- # RootCATrustedCertificates DDF file +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. This topic shows the OMA DM device description framework (DDF) for the **RootCACertificates** configuration service provider. DDF files are used only with OMA DM provisioning XML. Looking for the DDF XML files? See [CSP DDF files download](configuration-service-provider-reference.md#csp-ddf-files-download). -The XML below is the current version for this CSP. +The XML below is for Windows 10, version 1803. ``` syntax @@ -28,7 +30,7 @@ The XML below is the current version for this CSP. 1.2 RootCATrustedCertificates - ./Vendor/MSFT + ./User/Vendor/MSFT @@ -43,7 +45,7 @@ The XML below is the current version for this CSP. - + com.microsoft/1.1/MDM/RootCATrustedCertificates @@ -74,8 +76,6 @@ The XML below is the current version for this CSP. - - Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value @@ -100,12 +100,12 @@ The XML below is the current version for this CSP. - + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. - + @@ -117,7 +117,7 @@ The XML below is the current version for this CSP. - text/plain + @@ -271,8 +271,6 @@ The XML below is the current version for this CSP. - - Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value @@ -297,12 +295,12 @@ The XML below is the current version for this CSP. - + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. - + @@ -311,7 +309,7 @@ The XML below is the current version for this CSP. - text/plain + @@ -363,7 +361,7 @@ The XML below is the current version for this CSP. - Returns the starting date of the certificate's validity. This is equivalent to the NotBefore member in the CERT_INFO structure. + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. @@ -384,7 +382,7 @@ The XML below is the current version for this CSP. - Returns the expiration date of the certificate. This is equivalent to the NotAfter member in the CERT_INFO structure + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure @@ -405,7 +403,7 @@ The XML below is the current version for this CSP. - Returns the certificate template name. + Returns the certificate template name. Supported operation is Get. @@ -450,8 +448,6 @@ The XML below is the current version for this CSP. - - Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value @@ -476,12 +472,12 @@ The XML below is the current version for this CSP. - + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. - + @@ -493,7 +489,7 @@ The XML below is the current version for this CSP. - text/plain + @@ -551,7 +547,7 @@ The XML below is the current version for this CSP. - Returns the starting date of the certificate's validity. This is equivalent to the NotBefore member in the CERT_INFO structure. + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. @@ -575,7 +571,7 @@ The XML below is the current version for this CSP. - Returns the expiration date of the certificate. This is equivalent to the NotAfter member in the CERT_INFO structure + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure @@ -599,7 +595,7 @@ The XML below is the current version for this CSP. - Returns the certificate template name. + Returns the certificate template name. Supported operation is Get. @@ -647,8 +643,6 @@ The XML below is the current version for this CSP. - - Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value @@ -673,12 +667,12 @@ The XML below is the current version for this CSP. - + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. - + @@ -690,7 +684,7 @@ The XML below is the current version for this CSP. - text/plain + @@ -748,7 +742,7 @@ The XML below is the current version for this CSP. - Returns the starting date of the certificate's validity. This is equivalent to the NotBefore member in the CERT_INFO structure. + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. @@ -772,7 +766,7 @@ The XML below is the current version for this CSP. - Returns the expiration date of the certificate. This is equivalent to the NotAfter member in the CERT_INFO structure + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure @@ -796,7 +790,1180 @@ The XML below is the current version for this CSP. - Returns the certificate template name. + Returns the certificate template name. Supported operation is Get. + + + + + + + + + + + + + + text/plain + + + + + + + UntrustedCertificates + + + + + + + + + + + + + + + + + + + + + + + + + + + + Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value + + + + + + + + + + + + + CertHash + + + + + + EncodedCertificate + + + + + + + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. + + + + + + + + + + + + + + + + + + + IssuedBy + + + + + Returns the name of the certificate issuer. This is equivalent to the Issuer member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + IssuedTo + + + + + Returns the name of the certificate subject. This is equivalent to the Subject member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + ValidFrom + + + + + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. + + + + + + + + + + + + + + text/plain + + + + + ValidTo + + + + + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure + + + + + + + + + + + + + + text/plain + + + + + TemplateName + + + + + Returns the certificate template name. Supported operation is Get. + + + + + + + + + + + + + + text/plain + + + + + + + + RootCATrustedCertificates + ./Device/Vendor/MSFT + + + + + + + + + + + + + + + com.microsoft/1.1/MDM/RootCATrustedCertificates + + + + Root + + + + + + + + + + + + + + + + + + + + + + + + + + + + Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value + + + + + + + + + + + + + CertHash + + + + + + EncodedCertificate + + + + + + + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. + + + + + + + + + + + + + + + + + + + IssuedBy + + + + + Returns the name of the certificate issuer. This is equivalent to the Issuer member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + IssuedTo + + + + + Returns the name of the certificate subject. This is equivalent to the Subject member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + ValidFrom + + + + + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. + + + + + + + + + + + + + + text/plain + + + + + ValidTo + + + + + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure + + + + + + + + + + + + + + text/plain + + + + + TemplateName + + + + + Returns the certificate template name. Supported operation is Get. + + + + + + + + + + + + + + text/plain + + + + + + + CA + + + + + + + + + + + + + + + + + + + + + + + + + + + + Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value + + + + + + + + + + + + + CertHash + + + + + + EncodedCertificate + + + + + + + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. + + + + + + + + + + + + + + + + IssuedBy + + + + + Returns the name of the certificate issuer. This is equivalent to the Issuer member in the CERT_INFO data structure. + + + + + + + + + + + text/plain + + + + + IssuedTo + + + + + Returns the name of the certificate subject. This is equivalent to the Subject member in the CERT_INFO data structure. + + + + + + + + + + + text/plain + + + + + ValidFrom + + + + + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. + + + + + + + + + + + text/plain + + + + + ValidTo + + + + + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure + + + + + + + + + + + text/plain + + + + + TemplateName + + + + + Returns the certificate template name. Supported operation is Get. + + + + + + + + + + + text/plain + + + + + + + TrustedPublisher + + + + + + + + + + + + + + + + + + + + + + + + + + + + Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value + + + + + + + + + + + + + CertHash + + + + + + EncodedCertificate + + + + + + + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. + + + + + + + + + + + + + + + + + + + IssuedBy + + + + + Returns the name of the certificate issuer. This is equivalent to the Issuer member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + IssuedTo + + + + + Returns the name of the certificate subject. This is equivalent to the Subject member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + ValidFrom + + + + + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. + + + + + + + + + + + + + + text/plain + + + + + ValidTo + + + + + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure + + + + + + + + + + + + + + text/plain + + + + + TemplateName + + + + + Returns the certificate template name. Supported operation is Get. + + + + + + + + + + + + + + text/plain + + + + + + + TrustedPeople + + + + + + + + + + + + + + + + + + + + + + + + + + + + Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value + + + + + + + + + + + + + CertHash + + + + + + EncodedCertificate + + + + + + + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. + + + + + + + + + + + + + + + + + + + IssuedBy + + + + + Returns the name of the certificate issuer. This is equivalent to the Issuer member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + IssuedTo + + + + + Returns the name of the certificate subject. This is equivalent to the Subject member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + ValidFrom + + + + + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. + + + + + + + + + + + + + + text/plain + + + + + ValidTo + + + + + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure + + + + + + + + + + + + + + text/plain + + + + + TemplateName + + + + + Returns the certificate template name. Supported operation is Get. + + + + + + + + + + + + + + text/plain + + + + + + + UntrustedCertificates + + + + + + + + + + + + + + + + + + + + + + + + + + + + Defines the SHA1 hash for the certificate. The 20-byte value of the SHA1 certificate hash is specified as a hexadecimal string value + + + + + + + + + + + + + CertHash + + + + + + EncodedCertificate + + + + + + + Specifies the X.509 certificate as a Base64-encoded string. The Base-64 string value cannot include extra formatting characters such as embedded linefeeds, etc. + + + + + + + + + + + + + + + + + + + IssuedBy + + + + + Returns the name of the certificate issuer. This is equivalent to the Issuer member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + IssuedTo + + + + + Returns the name of the certificate subject. This is equivalent to the Subject member in the CERT_INFO data structure. + + + + + + + + + + + + + + text/plain + + + + + ValidFrom + + + + + Returns the starting date of the certificate's validity. Supported operation is Get. This is equivalent to the NotBefore member in the CERT_INFO structure. + + + + + + + + + + + + + + text/plain + + + + + ValidTo + + + + + Returns the expiration date of the certificate. Supported operation is Get. This is equivalent to the NotAfter member in the CERT_INFO structure + + + + + + + + + + + + + + text/plain + + + + + TemplateName + + + + + Returns the certificate template name. Supported operation is Get. @@ -818,14 +1985,4 @@ The XML below is the current version for this CSP. -``` - -  - -  - - - - - - +``` \ No newline at end of file From 8d372a5586f6b6ff8440e849750bf0b57cf9749e Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Wed, 21 Mar 2018 14:42:03 +0000 Subject: [PATCH 25/28] Merged PR 6523: New topic for MPSA This topic is intentionally not added to the TOC at this time --- ...a-software-microsoft-store-for-business.md | 59 +++++++++++++++++++ 1 file changed, 59 insertions(+) create mode 100644 store-for-business/manage-mpsa-software-microsoft-store-for-business.md diff --git a/store-for-business/manage-mpsa-software-microsoft-store-for-business.md b/store-for-business/manage-mpsa-software-microsoft-store-for-business.md new file mode 100644 index 0000000000..970b3c783f --- /dev/null +++ b/store-for-business/manage-mpsa-software-microsoft-store-for-business.md @@ -0,0 +1,59 @@ +--- +title: Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business +description: Software purchased under Microsoft Products and Services Agreement (MPSA) can be managed in Microsoft Store for Business +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +ms.pagetype: store +author: TrudyHa +ms.localizationpriority: high +ms.date: 3/20/2018 +--- + +# Manage software purchased with Microsoft Products and Services agreement in Microsoft Store for Business + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +Software purchased with the Microsoft Products and Services Agreement (MPSA) can now be managed in Microsoft Store for Business. This allows customers to manage online software purchases in one location. + +There are a couple of things you might need to set up to manage MPSA software purchases in Store for Business. + +**To manage MPSA software in Microsoft Store for Business** +1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com). +2. Click **Manage**, and then click **My Organization**. +3. Click **Connected tenants** to see purchasing accounts and the tenants that they are connected to. + +## Add tenant +The tenant or tenants that are added to your purchasing account control how you can distribute software to people in your organization. If there isn't a tenant listed for your purchasing account, you'll need to add one before you can use or manage the software you've purchased. When we give you a list to choose from, tenants are grouped by domain. + +**To add a tenant to a purchasing account** +1. Sign in to the [Microsoft Store for Business](http://businessstore.microsoft.com). +2. Click **Manage**, and then click **My Organization**. +3. Click **Connected tenants**, and then click the ellipses for a purchasing account without a tenant listed. +4. Click **Choose a tenant**, and then click **Submit**. + +If you don't see your tenant in the list, you can add the name of your tenant + +**To add the name of your tenant** +1. On **Add a tenant**, click **Don't see your tenant?**. +2. Enter a domain name, and then click **Next**, and then click **Done**. + +You'll need to get permissions for the admin that manages the domain you want to add. We'll take you to Business Center Portal where you can manage permissions and roles. The admin will need to be the **Account Manager**. + +## Add global admin +In some cases, we might not have info on who the global admin is for the tenant that you select. It might be that the tenant is unmanaged, and you'll need to identify a global admin. Or, you might only need to share account info for the global admin. + +If you need to nominate someone to be the global admin, they need sufficient permissions: +- someone who can distribute sofware +- in Business Center Portal (BCP), it should be someone with **Agreement Admin** role + +**To add a global admin to a tenant** + +We'll ask for a global admin if we need that info when you add a tenant to a purchasing account. You'd see the request for a global admin before returning to **Store for Business**. + +- On **Add a Global Admin**, click **Make me the Global Admin**, and then click **Submit**. +-or- +- On **Add a Global Admin**, type a name in **Invite someone else**, and then click **Submit**. \ No newline at end of file From 9f2de57b533f017e390b0304582483f348f8b8a8 Mon Sep 17 00:00:00 2001 From: Brian Lich Date: Wed, 21 Mar 2018 12:40:50 -0700 Subject: [PATCH 26/28] changing build notification --- .openpublishing.publish.config.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.openpublishing.publish.config.json b/.openpublishing.publish.config.json index 9e9233eb13..efe7a5e648 100644 --- a/.openpublishing.publish.config.json +++ b/.openpublishing.publish.config.json @@ -476,7 +476,7 @@ } ], "notification_subscribers": [ - "brianlic@microsoft.com" + "elizapo@microsoft.com" ], "branches_to_filter": [ "" From 0d60902a79725bf3c4db3f6a7cf9a0c015738fde Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Mar 2018 20:55:45 +0000 Subject: [PATCH 27/28] Merged PR 6535: AssignedAccess CSP - updated descriptions and links fixed typo --- windows/client-management/mdm/assignedaccess-csp.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/client-management/mdm/assignedaccess-csp.md b/windows/client-management/mdm/assignedaccess-csp.md index 48635d81a9..f083dad4a1 100644 --- a/windows/client-management/mdm/assignedaccess-csp.md +++ b/windows/client-management/mdm/assignedaccess-csp.md @@ -39,7 +39,7 @@ For a step-by-step guide for setting up devices to run in kiosk mode, see [Set u > > You cannot set both KioskModeApp and ShellLauncher at the same time on the device. -In Windows 10, version 1607, you can use a provisioned app to configure the kiosk mode. For more information about how to remotely provision an app, see [Enterprise app management](enterprise-app-management.md). +Starting in Windows 10, version 1607, you can use a provisioned app to configure the kiosk mode. For more information about how to remotely provision an app, see [Enterprise app management](enterprise-app-management.md). Here's an example: From 7378e96c6918217fe7ebbf1a01cdca81e266e835 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Wed, 21 Mar 2018 20:56:05 +0000 Subject: [PATCH 28/28] Merged PR 6539: Removed some LocalPoliciesSecurityOptions policies --- ...ew-in-windows-mdm-enrollment-management.md | 18 - .../policy-configuration-service-provider.md | 5 +- ...policy-csp-localpoliciessecurityoptions.md | 586 +----------------- 3 files changed, 2 insertions(+), 607 deletions(-) diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 5965974382..66cacb8036 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -1175,14 +1175,7 @@ For details about Microsoft mobile device management protocols for Windows 10 s
    • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
      • -
    • LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge
      • -
    • LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey
    • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
      • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession
      • @@ -1193,10 +1186,8 @@ For details about Microsoft mobile device management protocols for Windows 10 s
    • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
    • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
      • @@ -1788,14 +1779,7 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
    • LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia
    • LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters
    • LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible
      • -
    • LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges
      • -
    • LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge
      • -
    • LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey
    • LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
      • -
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
    • LocalPoliciesSecurityOptions/MicrosoftNetworkClient_SendUnencryptedPasswordToThirdPartySMBServers
    • LocalPoliciesSecurityOptions/MicrosoftNetworkServer_AmountOfIdleTimeRequiredBeforeSuspendingSession
      • @@ -1806,10 +1790,8 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
    • LocalPoliciesSecurityOptions/NetworkAccess_LetEveryonePermissionsApplyToAnonymousUsers
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictAnonymousAccessToNamedPipesAndShares
    • LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM
    • LocalPoliciesSecurityOptions/NetworkSecurity_DoNotStoreLANManagerHashValueOnNextPasswordChange
    • LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
      • -
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients
    • LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
    • LocalPoliciesSecurityOptions/Shutdown_ClearVirtualMemoryPageFile
    • LocalPoliciesSecurityOptions/SystemObjects_RequireCaseInsensitivityForNonWindowsSubsystems
      • diff --git a/windows/client-management/mdm/policy-configuration-service-provider.md b/windows/client-management/mdm/policy-configuration-service-provider.md index 42c5737c3e..debb631fa9 100644 --- a/windows/client-management/mdm/policy-configuration-service-provider.md +++ b/windows/client-management/mdm/policy-configuration-service-provider.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/05/2018 +ms.date: 03/16/2018 --- # Policy CSP @@ -4133,9 +4133,6 @@ The following diagram shows the Policy configuration service provider in tree fo - [LocalPoliciesSecurityOptions/Devices_AllowedToFormatAndEjectRemovableMedia](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-allowedtoformatandejectremovablemedia) - [LocalPoliciesSecurityOptions/Devices_PreventUsersFromInstallingPrinterDriversWhenConnectingToSharedPrinters](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-preventusersfrominstallingprinterdriverswhenconnectingtosharedprinters) - [LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-devices-restrictcdromaccesstolocallyloggedonuseronly) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptorsignsecurechanneldataalways) -- [LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-digitallyencryptsecurechanneldatawhenpossible) -- [LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-domainmember-disablemachineaccountpasswordchanges) - [LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-displayuserinformationwhenthesessionislocked) - [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayLastSignedIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplaylastsignedin) - [LocalPoliciesSecurityOptions/InteractiveLogon_DoNotDisplayUsernameAtSignIn](./policy-csp-localpoliciessecurityoptions.md#localpoliciessecurityoptions-interactivelogon-donotdisplayusernameatsignin) diff --git a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md index 27c960d639..327397bc54 100644 --- a/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md +++ b/windows/client-management/mdm/policy-csp-localpoliciessecurityoptions.md @@ -6,7 +6,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 03/12/2018 +ms.date: 03/16/2018 --- # Policy CSP - LocalPoliciesSecurityOptions @@ -51,24 +51,6 @@ ms.date: 03/12/2018
      LocalPoliciesSecurityOptions/Devices_RestrictCDROMAccessToLocallyLoggedOnUserOnly
      -
      - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways -
      -
      - LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible -
      -
      - LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible -
      -
      - LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges -
      -
      - LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge -
      -
      - LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey -
      LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked
      @@ -93,9 +75,6 @@ ms.date: 03/12/2018
      LocalPoliciesSecurityOptions/InteractiveLogon_SmartCardRemovalBehavior
      -
      - LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways -
      LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees
      @@ -126,9 +105,6 @@ ms.date: 03/12/2018
      LocalPoliciesSecurityOptions/NetworkAccess_RestrictClientsAllowedToMakeRemoteCallsToSAM
      -
      - LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM -
      LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests
      @@ -138,9 +114,6 @@ ms.date: 03/12/2018
      LocalPoliciesSecurityOptions/NetworkSecurity_LANManagerAuthenticationLevel
      -
      - LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients -
      LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers
      @@ -784,375 +757,6 @@ GP Info:
      - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptOrSignSecureChannelDataAlways** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Domain member: Digitally encrypt or sign secure channel data (always) - -This security setting determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not all secure channel traffic initiated by the domain member meets minimum security requirements. Specifically it determines whether all secure channel traffic initiated by the domain member must be signed or encrypted. If this policy is enabled, then the secure channel will not be established unless either signing or encryption of all secure channel traffic is negotiated. If this policy is disabled, then encryption and signing of all secure channel traffic is negotiated with the Domain Controller in which case the level of signing and encryption depends on the version of the Domain Controller and the settings of the following two policies: - -Domain member: Digitally encrypt secure channel data (when possible) -Domain member: Digitally sign secure channel data (when possible) - -Default: Enabled. - -Notes: - -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -If this policy is enabled, the policy Domain member: Digitally sign secure channel data (when possible) is assumed to be enabled regardless of its current setting. This ensures that the domain member attempts to negotiate at least signing of the secure channel traffic. -Logon information transmitted over the secure channel is always encrypted regardless of whether encryption of ALL other secure channel traffic is negotiated or not. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt or sign secure channel data (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - - -**LocalPoliciesSecurityOptions/DomainMember_DigitallyEncryptSecureChannelDataWhenPossible** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Domain member: Digitally encrypt secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate encryption for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate encryption for all secure channel traffic that it initiates. If enabled, the domain member will request encryption of all secure channel traffic. If the domain controller supports encryption of all secure channel traffic, then all secure channel traffic will be encrypted. Otherwise only logon information transmitted over the secure channel will be encrypted. If this setting is disabled, then the domain member will not attempt to negotiate secure channel encryption. - -Default: Enabled. - -Important - -There is no known reason for disabling this setting. Besides unnecessarily reducing the potential confidentiality level of the secure channel, disabling this setting may unnecessarily reduce secure channel throughput, because concurrent API calls that use the secure channel are only possible when the secure channel is signed or encrypted. - -Note: Domain controllers are also domain members and establish secure channels with other domain controllers in the same domain as well as domain controllers in trusted domains. - - - -GP Info: -- GP English name: *Domain member: Digitally encrypt secure channel data (when possible)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - - -**LocalPoliciesSecurityOptions/DomainMember_DigitallySignSecureChannelDataWhenPossible** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Domain member: Digitally sign secure channel data (when possible) - -This security setting determines whether a domain member attempts to negotiate signing for all secure channel traffic that it initiates. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller for its domain. This secure channel is used to perform operations such as NTLM pass through authentication, LSA SID/name Lookup etc. - -This setting determines whether or not the domain member attempts to negotiate signing for all secure channel traffic that it initiates. If enabled, the domain member will request signing of all secure channel traffic. If the Domain Controller supports signing of all secure channel traffic, then all secure channel traffic will be signed which ensures that it cannot be tampered with in transit. - -Default: Enabled. - - - -GP Info: -- GP English name: *Domain member: Digitally sign secure channel data (when possible)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - - -**LocalPoliciesSecurityOptions/DomainMember_DisableMachineAccountPasswordChanges** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Domain member: Disable machine account password changes - -Determines whether a domain member periodically changes its computer account password. If this setting is enabled, the domain member does not attempt to change its computer account password. If this setting is disabled, the domain member attempts to change its computer account password as specified by the setting for Domain Member: Maximum age for machine account password, which by default is every 30 days. - -Default: Disabled. - -Notes - -This security setting should not be enabled. Computer account passwords are used to establish secure channel communications between members and domain controllers and, within the domain, between the domain controllers themselves. Once it is established, the secure channel is used to transmit sensitive information that is necessary for making authentication and authorization decisions. -This setting should not be used in an attempt to support dual-boot scenarios that use the same computer account. If you want to dual-boot two installations that are joined to the same domain, give the two installations different computer names. - - - -GP Info: -- GP English name: *Domain member: Disable machine account password changes* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - - -**LocalPoliciesSecurityOptions/DomainMember_MaximumMachineAccountPasswordAge** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Domain member: Maximum machine account password age - -This security setting determines how often a domain member will attempt to change its computer account password. - -Default: 30 days. - -Important - -This setting applies to Windows 2000 computers, but it is not available through the Security Configuration Manager tools on these computers. - - - -GP Info: -- GP English name: *Domain member: Maximum machine account password age* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - - -**LocalPoliciesSecurityOptions/DomainMember_RequireStrongSessionKey** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Domain member: Require strong (Windows 2000 or later) session key - -This security setting determines whether 128-bit key strength is required for encrypted secure channel data. - -When a computer joins a domain, a computer account is created. After that, when the system starts, it uses the computer account password to create a secure channel with a domain controller within the domain. This secure channel is used to perform operations such as NTLM pass-through authentication, LSA SID/name Lookup, and so on. - -Depending on what version of Windows is running on the domain controller that the domain member is communicating with and the settings of the parameters: - -Domain member: Digitally encrypt or sign secure channel data (always) -Domain member: Digitally encrypt secure channel data (when possible) -Some or all of the information that is transmitted over the secure channel will be encrypted. This policy setting determines whether or not 128-bit key strength is required for the secure channel information that is encrypted. - -If this setting is enabled, then the secure channel will not be established unless 128-bit encryption can be performed. If this setting is disabled, then the key strength is negotiated with the domain controller. - -Default: Enabled. - -Important - -In order to take advantage of this policy on member workstations and servers, all domain controllers that constitute the member's domain must be running Windows 2000 or later. -In order to take advantage of this policy on domain controllers, all domain controllers in the same domain as well as all trusted domains must run Windows 2000 or later. - - - -GP Info: -- GP English name: *Domain member: Require strong (Windows 2000 or later) session key* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - **LocalPoliciesSecurityOptions/InteractiveLogon_DisplayUserInformationWhenTheSessionIsLocked** @@ -1650,77 +1254,6 @@ GP Info:
      - -**LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsAlways** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Microsoft network client: Digitally sign communications (always) - -This security setting determines whether packet signing is required by the SMB client component. - -The server message block (SMB) protocol provides the basis for Microsoft file and print sharing and many other networking operations, such as remote Windows administration. To prevent man-in-the-middle attacks that modify SMB packets in transit, the SMB protocol supports the digital signing of SMB packets. This policy setting determines whether SMB packet signing must be negotiated before further communication with an SMB server is permitted. - -If this setting is enabled, the Microsoft network client will not communicate with a Microsoft network server unless that server agrees to perform SMB packet signing. If this policy is disabled, SMB packet signing is negotiated between the client and server. - -Default: Disabled. - -Important - -For this policy to take effect on computers running Windows 2000, client-side packet signing must also be enabled. To enable client-side SMB packet signing, set Microsoft network client: Digitally sign communications (if server agrees). - -Notes - -All Windows operating systems support both a client-side SMB component and a server-side SMB component. On Windows 2000 and later operating systems, enabling or requiring packet signing for client and server-side SMB components is controlled by the following four policy settings: -Microsoft network client: Digitally sign communications (always) - Controls whether or not the client-side SMB component requires packet signing. -Microsoft network client: Digitally sign communications (if server agrees) - Controls whether or not the client-side SMB component has packet signing enabled. -Microsoft network server: Digitally sign communications (always) - Controls whether or not the server-side SMB component requires packet signing. -Microsoft network server: Digitally sign communications (if client agrees) - Controls whether or not the server-side SMB component has packet signing enabled. -SMB packet signing can significantly degrade SMB performance, depending on dialect version, OS version, file sizes, processor offloading capabilities, and application IO behaviors. -For more information, reference: https://go.microsoft.com/fwlink/?LinkID=787136. - - - -GP Info: -- GP English name: *Microsoft network client: Digitally sign communications (always)* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - **LocalPoliciesSecurityOptions/MicrosoftNetworkClient_DigitallySignCommunicationsIfServerAgrees** @@ -2334,63 +1867,6 @@ GP Info:
      - -**LocalPoliciesSecurityOptions/NetworkSecurity_AllowLocalSystemToUseComputerIdentityForNTLM** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Network security: Allow Local System to use computer identity for NTLM - -This policy setting allows Local System services that use Negotiate to use the computer identity when reverting to NTLM authentication. - -If you enable this policy setting, services running as Local System that use Negotiate will use the computer identity. This might cause some authentication requests between Windows operating systems to fail and log an error. - -If you disable this policy setting, services running as Local System that use Negotiate when reverting to NTLM authentication will authenticate anonymously. - -By default, this policy is enabled on Windows 7 and above. - -By default, this policy is disabled on Windows Vista. - -This policy is supported on at least Windows Vista or Windows Server 2008. - -Note: Windows Vista or Windows Server 2008 do not expose this setting in Group Policy. - - - - -
      - **LocalPoliciesSecurityOptions/NetworkSecurity_AllowPKU2UAuthenticationRequests** @@ -2586,66 +2062,6 @@ GP Info:
      - -**LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedClients** - - - - - - - - - - - - - - - - - - - - - -
      HomeProBusinessEnterpriseEducationMobileMobile Enterprise
      cross markcheck mark4check mark4check mark4check mark4cross markcross mark
      - - - -[Scope](./policy-configuration-service-provider.md#policy-scope): - -> [!div class = "checklist"] -> * Device - -
      - - - -Network security: Minimum session security for NTLM SSP based (including secure RPC) clients - -This security setting allows a client to require the negotiation of 128-bit encryption and/or NTLMv2 session security. These values are dependent on the LAN Manager Authentication Level security setting value. The options are: - -Require NTLMv2 session security: The connection will fail if NTLMv2 protocol is not negotiated. -Require 128-bit encryption: The connection will fail if strong encryption (128-bit) is not negotiated. - -Default: - -Windows XP, Windows Vista, Windows 2000 Server, Windows Server 2003, and Windows Server 2008: No requirements. - -Windows 7 and Windows Server 2008 R2: Require 128-bit encryption - - - -GP Info: -- GP English name: *Network security: Minimum session security for NTLM SSP based (including secure RPC) clients* -- GP path: *Windows Settings/Security Settings/Local Policies/Security Options* - - - - -
      - **LocalPoliciesSecurityOptions/NetworkSecurity_MinimumSessionSecurityForNTLMSSPBasedServers**