From 288f3c13ddbf1a41e9bf511ccb16afe10d917aee Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 29 Jun 2017 00:08:14 +0000 Subject: [PATCH 01/33] Updated command-line-arguments-windows-defender-antivirus.md --- .../command-line-arguments-windows-defender-antivirus.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md index d3a3a91d2b..9553373b80 100644 --- a/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/command-line-arguments-windows-defender-antivirus.md @@ -10,6 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw +msft.author: iawilt --- From 477e675a6464bb053dadb0e61827de3fa332e88d Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Tue, 18 Jul 2017 18:37:43 -0700 Subject: [PATCH 02/33] updated old text --- .../access-control/microsoft-accounts.md | 22 +++++-------------- 1 file changed, 5 insertions(+), 17 deletions(-) diff --git a/windows/access-protection/access-control/microsoft-accounts.md b/windows/access-protection/access-control/microsoft-accounts.md index 4b54894c21..4cf7d0e09f 100644 --- a/windows/access-protection/access-control/microsoft-accounts.md +++ b/windows/access-protection/access-control/microsoft-accounts.md @@ -14,20 +14,12 @@ ms.pagetype: security This topic for the IT professional explains how a Microsoft account works to enhance security and privacy for users, and how you can manage this consumer account type in your organization. -Microsoft sites, services, and properties such as Windows Live, MSN, Xbox LIVE, Zune, Windows Phone, and computers running Windows 10, Windows 8.1, Windows 8, and Windows RT use a Microsoft account as a mean of identifying users. Microsoft account is the name for what was previously called Windows Live ID. It has user-defined secrets associated with it, and it consists of a unique email address and a password. +Microsoft sites, services, and properties, as well as computers running Windows 10, can use a Microsoft account as a mean of identifying a user. Microsoft account was previously called Windows Live ID. It has user-defined secrets, and consists of a unique email address and a password. -There are some benefits and considerations when using Microsoft accounts in the enterprise. For more information, see [Microsoft account in the enterprise](#bkmk-msaccountintheenterprise) later in this topic. - -When a user signs in with a Microsoft account, their device is connected to cloud services, and many of the settings, preferences, and apps associated with that user account can roam between devices. - -**Note**   -This content applies to the operating system versions that are designated in the **Applies To** list at the beginning of this topic. - -  +When a user signs in with a Microsoft account, the device is connected to cloud services. Many of the user's settings, preferences, and apps can be shared across devices. ## How a Microsoft account works - The Microsoft account allows users to sign in to websites that support this service by using a single set of credentials. Users' credentials are validated by a Microsoft account authentication server that is associated with a website. The Windows Store is an example of this association. When new users sign in to websites that are enabled to use Microsoft accounts, they are redirected to the nearest authentication server, which asks for a user name and password. Windows uses the Schannel Security Support Provider to open a Transport Level Security/Secure Sockets Layer (TLS/SSL) connection for this function. Users then have the option to use Credential Manager to store their credentials. When users sign in to websites that are enabled to use a Microsoft account, a time-limited cookie is installed on their computers, which includes a triple DES encrypted ID tag. This encrypted ID tag has been agreed upon between the authentication server and the website. This ID tag is sent to the website, and the website plants another time-limited encrypted HTTP cookie on the user’s computer. When these cookies are valid, users are not required to supply a user name and password. If a user actively signs out of their Microsoft account, these cookies are removed. @@ -35,19 +27,17 @@ When users sign in to websites that are enabled to use a Microsoft account, a ti **Important**   Local Windows account functionality has not been removed, and it is still an option to use in managed environments. -  - ### How Microsoft accounts are created -To prevent fraud, the Microsoft system verifies the IP address when a user creates an account. If a user tries to create multiple Microsoft accounts with the same IP address, they are stopped. +To prevent fraud, the Microsoft system verifies the IP address when a user creates an account. A user who tries to create multiple Microsoft accounts with the same IP address is stopped. -Microsoft accounts are not designed to be created in batches, for example, for a group of domain users within your enterprise. +Microsoft accounts are not designed to be created in batches, such as for a group of domain users within your enterprise. There are two methods for creating a Microsoft account: - **Use an existing email address**. - Users are able to use their valid email addresses to sign up for Microsoft accounts. The service turns the requesting user's email address into a Microsoft account. Users can also choose their personal password. + Users are able to use their valid email addresses to sign up for Microsoft accounts. The service turns the requesting user's email address into a Microsoft account. Users can also choose their personal passwords. - **Sign up for a Microsoft email address**. @@ -135,8 +125,6 @@ Users can disconnect a Microsoft account from their domain account at any time a **Note**   Connecting Microsoft accounts with domain accounts can limit access to some high-privileged tasks in Windows. For example, Task Scheduler will evaluate the connected Microsoft account for access and fail. In these situations, the account owner should disconnect the account. -  - ### Provision Microsoft accounts in the enterprise Microsoft accounts are private user accounts. There are no methods provided by Microsoft to provision Microsoft accounts for an enterprise. Enterprises should use domain accounts. From b69ac1c05a9b85962190d9c7b16c08712f34ecd4 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 26 Jul 2017 20:39:34 +0000 Subject: [PATCH 03/33] Updated manage-protection-updates-windows-defender-antivirus.md --- .../manage-protection-updates-windows-defender-antivirus.md | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index 751a8801d2..161fcb2346 100644 --- a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -65,6 +65,9 @@ Microsoft Update allows for rapid releases, which means it will download small d The WSUS, Configuration Manager and MMPC sources will deliver less frequent updates. The size of the updates may be slightly larger than the frequent release from Microsoft Update (as the delta, or differences between the latest version and what is on the endpoint will be larger). This ensures consistent protection without increasing ad hoc network usage (although the amount of data may be the same or increased as the updates will be fewer, but may be slightly larger). +> [!IMPORTANT] +> If you have set MMPC as a fallback source after WSUS or Microsoft Update, updates will only be downloaded from MMPC after 2 consecutive days of not being able to connect to the WSUS or Microsoft Update services. + Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: Location | Sample scenario @@ -73,7 +76,7 @@ WSUS | You are using WSUS to manage updates for your network. Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use WSUS to manage your updates. File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments. Configuration Manager | You are using System Center Configuration Manager to update your endpoints. -MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. +MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from WSUS or Microsoft Update for 2 consecutive days. You can manage the order in which update sources are used with Group Policy, System Center Configuration Manager, PowerShell cmdlets, and WMI. From d70e8586f7cbbdacb74bdd43329e9cd5ff12d1d1 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Wed, 26 Jul 2017 20:40:16 +0000 Subject: [PATCH 04/33] Updated manage-protection-updates-windows-defender-antivirus.md --- .../manage-protection-updates-windows-defender-antivirus.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index 161fcb2346..c25669250f 100644 --- a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -10,6 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw +msft.author: iawilt --- # Manage the sources for Windows Defender Antivirus protection updates From 205ba8e029ab49400da309477686911a989b29c7 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 27 Jul 2017 00:42:08 +0000 Subject: [PATCH 05/33] Updated manage-protection-updates-windows-defender-antivirus.md --- .../manage-protection-updates-windows-defender-antivirus.md | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index c25669250f..eb30b37ff0 100644 --- a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -64,10 +64,11 @@ The older the updates on an endpoint, the larger the download. However, you must Microsoft Update allows for rapid releases, which means it will download small deltas on a frequent basis. This ensures the best protection, but may increase network bandwidth. -The WSUS, Configuration Manager and MMPC sources will deliver less frequent updates. The size of the updates may be slightly larger than the frequent release from Microsoft Update (as the delta, or differences between the latest version and what is on the endpoint will be larger). This ensures consistent protection without increasing ad hoc network usage (although the amount of data may be the same or increased as the updates will be fewer, but may be slightly larger). +The WSUS, Configuration Manager, and MMPC sources will deliver less frequent updates. The size of the updates may be slightly larger than the frequent release from Microsoft Update (as the delta, or differences between the latest version and what is on the endpoint will be larger). This ensures consistent protection without increasing ad hoc network usage (although the amount of data may be the same or increased as the updates will be fewer, but may be slightly larger). > [!IMPORTANT] -> If you have set MMPC as a fallback source after WSUS or Microsoft Update, updates will only be downloaded from MMPC after 2 consecutive days of not being able to connect to the WSUS or Microsoft Update services. +> If you have set MMPC as a fallback source after WSUS or Microsoft Update, updates will only be downloaded from MMPC when the current update is considered to be out-of-date (by default, this is 2 consecutive days of not being able to apply updates from the WSUS or Microsoft Update services). +> You can, however, [set the number of days before protection is reported as out-of-date](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date). Each source has typical scenarios that depend on how your network is configured, in addition to how often they publish updates, as described in the following table: From 67998474d981e6a34b2aceaf05c40e9fc8792f38 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 27 Jul 2017 00:43:23 +0000 Subject: [PATCH 06/33] Updated manage-outdated-endpoints-windows-defender-antivirus.md --- .../manage-outdated-endpoints-windows-defender-antivirus.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md index 32920b478d..f067d7f1eb 100644 --- a/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus.md @@ -10,6 +10,7 @@ ms.sitesec: library ms.pagetype: security localizationpriority: medium author: iaanw +msft.author: iawilt --- # Manage updates and scans for endpoints that are out of date @@ -92,7 +93,7 @@ See the following for more information and allowed parameters: ## Set the number of days before protection is reported as out-of-date -You can also specify the number of days after which Windows Defender AV protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Windows Defender AV to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)). +You can also specify the number of days after which Windows Defender AV protection is considered old or out-of-date. After the specified number of days, the client will report itself as out-of-date, and show an error to the user of the PC. It may also cause Windows Defender AV to attempt to download an update from other sources (based on the defined [fallback source order](manage-protection-updates-windows-defender-antivirus.md#fallback-order)), such as when using MMPC as a secondary source after setting WSUS or Microsoft Update as the first source. **Use Group Policy to specify the number of days before protection is considered out-of-date:** From 28abde8bac7089425e20f988e315d75254378804 Mon Sep 17 00:00:00 2001 From: Iaan D'Souza-Wiltshire Date: Thu, 27 Jul 2017 01:26:07 +0000 Subject: [PATCH 07/33] Updated manage-protection-updates-windows-defender-antivirus.md --- .../manage-protection-updates-windows-defender-antivirus.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md index eb30b37ff0..393342fba7 100644 --- a/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md +++ b/windows/threat-protection/windows-defender-antivirus/manage-protection-updates-windows-defender-antivirus.md @@ -78,7 +78,7 @@ WSUS | You are using WSUS to manage updates for your network. Microsoft Update | You want your endpoints to connect directly to Microsoft Update. This can be useful for endpoints that irregularly connect to your enterprise network, or if you do not use WSUS to manage your updates. File share | You have non-Internet-connected devices (such as VMs). You can use your Internet-connected VM host to download the updates to a network share, from which the VMs can obtain the updates. See the [VDI deployment guide](deployment-vdi-windows-defender-antivirus.md) for how file shares can be used in virtual desktop infrastructure (VDI) environments. Configuration Manager | You are using System Center Configuration Manager to update your endpoints. -MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from WSUS or Microsoft Update for 2 consecutive days. +MMPC | You need to download the latest protection updates because of a recent infection or to help provision a strong, base image for [VDI deployment](deployment-vdi-windows-defender-antivirus.md). This option should generally be used only as a final fallback source, and not the primary source. It will only be used if updates cannot be downloaded from WSUS or Microsoft Update for [a specified number of days](https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/manage-outdated-endpoints-windows-defender-antivirus#set-the-number-of-days-before-protection-is-reported-as-out-of-date). You can manage the order in which update sources are used with Group Policy, System Center Configuration Manager, PowerShell cmdlets, and WMI. From 811657802efbe92e1cd0bf16363cfed6de9f9931 Mon Sep 17 00:00:00 2001 From: Nick Landers Date: Wed, 9 Aug 2017 10:22:55 -0600 Subject: [PATCH 08/33] Update to include SyncAppVPublishingServer --- .../device-guard/deploy-code-integrity-policies-steps.md | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md index 6b3f009321..390575abd4 100644 --- a/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md +++ b/windows/device-security/device-guard/deploy-code-integrity-policies-steps.md @@ -46,6 +46,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you - mshta.exe - ntsd.exe - rcsi.exe +- SyncAppVPublishingServer.exe - system.management.automation.dll - windbg.exe @@ -64,6 +65,7 @@ Unless your use scenarios explicitly require them, Microsoft recommends that you |Matt Nelson | @enigma0x3| |Oddvar Moe |@Oddvarmoe| |Alex Ionescu | @aionescu| +|Nick Landers | @monoxgas|
@@ -116,6 +118,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + @@ -184,6 +187,7 @@ Microsoft recommends that you block the following Microsoft-signed applications + From c8495ea5b4c047076386effceb09835a7f3b8640 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 10 Aug 2017 17:03:42 +0000 Subject: [PATCH 09/33] Merged PR 2653: AppLocker CSP - added two new SyncML whitelist examples --- .../client-management/mdm/applocker-csp.md | 66 ++++++++++++++++++- ...ew-in-windows-mdm-enrollment-management.md | 6 +- 2 files changed, 69 insertions(+), 3 deletions(-) diff --git a/windows/client-management/mdm/applocker-csp.md b/windows/client-management/mdm/applocker-csp.md index 8f7f3dd2f0..7564c89e41 100644 --- a/windows/client-management/mdm/applocker-csp.md +++ b/windows/client-management/mdm/applocker-csp.md @@ -7,7 +7,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/19/2017 +ms.date: 08/10/2017 --- # AppLocker CSP @@ -791,8 +791,70 @@ The following list shows the apps that may be included in the inbox.   -## Whitelist example +## Whitelist examples +The following example disables the calendar application. + +``` syntax + + + + $CmdID$ + + + ./Vendor/MSFT/PolicyManager/My/ApplicationManagement/ApplicationRestrictions + + + chr + text/plain + + <AppPolicy Version="1" xmlns="http://schemas.microsoft.com/phone/2013/policy"><Deny><App ProductId="{a558feba-85d7-4665-b5d8-a2ff9c19799b}"/></Deny></AppPolicy> + + + + + + +``` + +The following example blocks the usage of the map application. + +``` syntax + + + + $CmdID$ + + + ./Vendor/MSFT/AppLocker/ApplicationLaunchRestrictions/AppLockerPhoneGroup0/StoreApps/Policy + + + chr + + + <RuleCollection Type="Appx" EnforcementMode="Enabled"> + <FilePublisherRule Id="a9e18c21-ff8f-43cf-b9fc-db40eed693ba" Name="(Default Rule) All signed Appx packages" Description="Allows members of the Everyone group to run Appx packages that are signed." UserOrGroupSid="S-1-1-0" Action="Allow"> + <Conditions> + <FilePublisherCondition PublisherName="*" ProductName="*" BinaryName="*"> + <BinaryVersionRange LowSection="0.0.0.0" HighSection="*" /> + </FilePublisherCondition> + </Conditions> + </FilePublisherRule> + + <FilePublisherRule Id="fd686d83-a829-4351-8ff4-27c7de5755d2" Name="Deny Splash appmaps" Description="Deny members of the local Administrators group to run maps." UserOrGroupSid="S-1-1-0" Action="Deny"> + <Conditions> + <FilePublisherCondition PublisherName="CN=Microsoft Corporation, O=Microsoft Corporation, L=Redmond, S=Washington, C=US" ProductName="Microsoft.WindowsMaps" BinaryName="*" /> + </Conditions> + </FilePublisherRule> + + </RuleCollection> + + + + + + +``` The following example for Windows 10 Mobile denies all apps and allows the following apps: diff --git a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md index 2fe500388f..4c92784d4b 100644 --- a/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md +++ b/windows/client-management/mdm/new-in-windows-mdm-enrollment-management.md @@ -10,7 +10,7 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 08/04/2017 +ms.date: 08/10/2017 --- # What's new in MDM enrollment and management @@ -1332,6 +1332,10 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware
  • 3 – Hides overrides (encrypt, prompt but hide overrides, and audit).
  • + +[AppLocker CSP](applocker-csp.md) +

    Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in [Whitelist examples](applocker-csp.md#whitelist-examples).

    + [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies for Windows 10, version 1709:

    From 4b867ff7f0b0c73b40498030687261e439f013ce Mon Sep 17 00:00:00 2001 From: Jeanie Decker Date: Thu, 10 Aug 2017 17:44:41 +0000 Subject: [PATCH 10/33] Merged PR 2656: Fix typo in TOC --- windows/application-management/TOC.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/application-management/TOC.md b/windows/application-management/TOC.md index 1a3cdacf44..5c764b532e 100644 --- a/windows/application-management/TOC.md +++ b/windows/application-management/TOC.md @@ -100,5 +100,5 @@ #### [Viewing App-V Server Publishing Metadata](app-v/appv-viewing-appv-server-publishing-metadata.md) #### [Running a Locally Installed Application Inside a Virtual Environment with Virtualized Applications](app-v/appv-running-locally-installed-applications-inside-a-virtual-environment.md) ## [Service Host process refactoring](svchost-service-refactoring.md) -## [Deploy app updgrades on Windows 10 Mobile](deploy-app-upgrades-windows-10-mobile.md) +## [Deploy app upgrades on Windows 10 Mobile](deploy-app-upgrades-windows-10-mobile.md) ## [Change history for Application management](change-history-for-application-management.md) From 3c976eaa2366d40c778826cfd2ab855f55638928 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 10 Aug 2017 18:00:57 +0000 Subject: [PATCH 11/33] Merged PR 2657: Policy CSP - added GP path to all AppVirtualization policies added GP path to all AppVirtualization policies --- .../mdm/policy-csp-appvirtualization.md | 28 +++++++++++++++++++ 1 file changed, 28 insertions(+) diff --git a/windows/client-management/mdm/policy-csp-appvirtualization.md b/windows/client-management/mdm/policy-csp-appvirtualization.md index f3da2fb6fe..4720adffc1 100644 --- a/windows/client-management/mdm/policy-csp-appvirtualization.md +++ b/windows/client-management/mdm/policy-csp-appvirtualization.md @@ -60,6 +60,7 @@ This policy setting allows you to enable or disable Microsoft Application Virtua ADMX Info: - GP english name: *Enable App-V Client* - GP name: *EnableAppV* +- GP path: *Administrative Templates/System/App-V* - GP ADMX file name: *appv.admx* @@ -105,6 +106,7 @@ Enables Dynamic Virtualization of supported shell extensions, browser helper obj ADMX Info: - GP english name: *Enable Dynamic Virtualization* - GP name: *Virtualization_JITVEnable* +- GP path: *Administrative Templates/System/App-V/Virtualization* - GP ADMX file name: *appv.admx* @@ -150,6 +152,7 @@ Enables automatic cleanup of appv packages that were added after Windows10 anniv ADMX Info: - GP english name: *Enable automatic cleanup of unused appv packages* - GP name: *PackageManagement_AutoCleanupEnable* +- GP path: *Administrative Templates/System/App-V/PackageManagement* - GP ADMX file name: *appv.admx* @@ -195,6 +198,7 @@ Enables scripts defined in the package manifest of configuration files that shou ADMX Info: - GP english name: *Enable Package Scripts* - GP name: *Scripting_Enable_Package_Scripts* +- GP path: *Administrative Templates/System/App-V/Scripting* - GP ADMX file name: *appv.admx* @@ -240,6 +244,7 @@ Enables a UX to display to the user when a publishing refresh is performed on th ADMX Info: - GP english name: *Enable Publishing Refresh UX* - GP name: *Enable_Publishing_Refresh_UX* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -295,6 +300,7 @@ Data Block Size: This value specifies the maximum size in bytes to transmit to t ADMX Info: - GP english name: *Reporting Server* - GP name: *Reporting_Server_Policy* +- GP path: *Administrative Templates/System/App-V/Reporting* - GP ADMX file name: *appv.admx* @@ -340,6 +346,7 @@ Specifies the file paths relative to %userprofile% that do not roam with a user' ADMX Info: - GP english name: *Roaming File Exclusions* - GP name: *Integration_Roaming_File_Exclusions* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -385,6 +392,7 @@ Specifies the registry paths that do not roam with a user profile. Example usage ADMX Info: - GP english name: *Roaming Registry Exclusions* - GP name: *Integration_Roaming_Registry_Exclusions* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -430,6 +438,7 @@ Specifies how new packages should be loaded automatically by App-V on a specific ADMX Info: - GP english name: *Specify what to load in background (aka AutoLoad)* - GP name: *Steaming_Autoload* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -475,6 +484,7 @@ Migration mode allows the App-V client to modify shortcuts and FTA's for package ADMX Info: - GP english name: *Enable Migration Mode* - GP name: *Client_Coexistence_Enable_Migration_mode* +- GP path: *Administrative Templates/System/App-V/Client Coexistence* - GP ADMX file name: *appv.admx* @@ -520,6 +530,7 @@ Specifies the location where symbolic links are created to the current version o ADMX Info: - GP english name: *Integration Root User* - GP name: *Integration_Root_User* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -565,6 +576,7 @@ Specifies the location where symbolic links are created to the current version o ADMX Info: - GP english name: *Integration Root Global* - GP name: *Integration_Root_Global* +- GP path: *Administrative Templates/System/App-V/Integration* - GP ADMX file name: *appv.admx* @@ -628,6 +640,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 1 Settings* - GP name: *Publishing_Server1_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -691,6 +704,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 2 Settings* - GP name: *Publishing_Server2_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -754,6 +768,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 3 Settings* - GP name: *Publishing_Server3_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -817,6 +832,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 4 Settings* - GP name: *Publishing_Server4_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -880,6 +896,7 @@ User Publishing Refresh Interval Unit: Specifies the interval unit (Hour 0-23, D ADMX Info: - GP english name: *Publishing Server 5 Settings* - GP name: *Publishing_Server5_Policy* +- GP path: *Administrative Templates/System/App-V/Publishing* - GP ADMX file name: *appv.admx* @@ -925,6 +942,7 @@ Specifies the path to a valid certificate in the certificate store. ADMX Info: - GP english name: *Certificate Filter For Client SSL* - GP name: *Streaming_Certificate_Filter_For_Client_SSL* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -970,6 +988,7 @@ This setting controls whether virtualized applications are launched on Windows 8 ADMX Info: - GP english name: *Allow First Time Application Launches if on a High Cost Windows 8 Metered Connection* - GP name: *Streaming_Allow_High_Cost_Launch* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1015,6 +1034,7 @@ Specifies the CLSID for a compatible implementation of the IAppvPackageLocationP ADMX Info: - GP english name: *Location Provider* - GP name: *Streaming_Location_Provider* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1060,6 +1080,7 @@ Specifies directory where all new applications and updates will be installed. ADMX Info: - GP english name: *Package Installation Root* - GP name: *Streaming_Package_Installation_Root* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1105,6 +1126,7 @@ Overrides source location for downloading package content. ADMX Info: - GP english name: *Package Source Root* - GP name: *Streaming_Package_Source_Root* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1150,6 +1172,7 @@ Specifies the number of seconds between attempts to reestablish a dropped sessio ADMX Info: - GP english name: *Reestablishment Interval* - GP name: *Streaming_Reestablishment_Interval* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1195,6 +1218,7 @@ Specifies the number of times to retry a dropped session. ADMX Info: - GP english name: *Reestablishment Retries* - GP name: *Streaming_Reestablishment_Retries* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1240,6 +1264,7 @@ Specifies that streamed package contents will be not be saved to the local hard ADMX Info: - GP english name: *Shared Content Store (SCS) mode* - GP name: *Streaming_Shared_Content_Store_Mode* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1285,6 +1310,7 @@ If enabled, the App-V client will support BrancheCache compatible HTTP streaming ADMX Info: - GP english name: *Enable Support for BranchCache* - GP name: *Streaming_Support_Branch_Cache* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1330,6 +1356,7 @@ Verifies Server certificate revocation status before streaming using HTTPS. ADMX Info: - GP english name: *Verify certificate revocation list* - GP name: *Streaming_Verify_Certificate_Revocation_List* +- GP path: *Administrative Templates/System/App-V/Streaming* - GP ADMX file name: *appv.admx* @@ -1375,6 +1402,7 @@ Specifies a list of process paths (may contain wildcards) which are candidates f ADMX Info: - GP english name: *Virtual Component Process Allow List* - GP name: *Virtualization_JITVAllowList* +- GP path: *Administrative Templates/System/App-V/Virtualization* - GP ADMX file name: *appv.admx* From 71216f23503c9e6f31b776703b80ad83a267effb Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 10 Aug 2017 12:10:41 -0700 Subject: [PATCH 12/33] added new text for MSA setttings --- .../access-control/microsoft-accounts.md | 40 +++++++++++++++++-- 1 file changed, 36 insertions(+), 4 deletions(-) diff --git a/windows/access-protection/access-control/microsoft-accounts.md b/windows/access-protection/access-control/microsoft-accounts.md index 4cf7d0e09f..99a609d4e8 100644 --- a/windows/access-protection/access-control/microsoft-accounts.md +++ b/windows/access-protection/access-control/microsoft-accounts.md @@ -108,13 +108,45 @@ Depending on your IT and business models, introducing Microsoft accounts into yo ### Restrict the use of the Microsoft account -If employees are allowed to join the domain with their personal devices, they might expect to connect to enterprise resources by using their Microsoft accounts. If you want to prevent any use of Microsoft accounts within your enterprise, you can configure the local security policy setting [Accounts: Block Microsoft accounts](/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts). However, this setting can prevent the users from signing in to their Windows devices with their Microsoft accounts (if they had set them up to do so) when they are joined to the domain. +The following Group Policy settings help control the use of Microsoft accounts in the enterprise: -The default for this setting is **Disabled**, which enables users to use their Microsoft accounts on devices that are joined to your domain. Other options in the setting can: +- [Block all consumer Microsoft account user authentication](#block-all-consumer-microsoft-account-user-authentication) +- [Accounts: Block Microsoft accounts](#accounts-block-microsoft-accounts) -1. Prevent users from creating new Microsoft accounts on a computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. +#### Block all consumer Microsoft account user authentication -2. Prevent users with an existing Microsoft account from signing in to Windows. Selecting this option might make it impossible for an existing administrator to sign in to a computer and manage the system. +This setting controls whether users can provide Microsoft accounts for authentication for applications or services. + +If this setting is enabled, all applications and services on the device are prevented from using Microsoft accounts for authentication. +This applies both to existing users of a device and new users who may be added. + +However, any application or service that has already authenticated a user will not be affected by enabling this setting until the authentication cache expires. +It is recommended to enable this setting before any user signs in to a device to prevent cached tokens from being present. + +If this setting is disabled or not configured, applications and services can use Microsoft accounts for authentication. +By default, this setting is **Disabled**. + +This setting does not affect whether users can sign in to devices by using Microsoft accounts, or the ability for users to provide Microsoft accounts via the browser for authentication with web-based applications. + +The path to this setting is: + +Computer Configuration\Administrative Templates\Windows Components\Microsoft account + +#### Accounts: Block Microsoft accounts + +This setting prevents using the **Settings** app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services. + +There are two options if this setting is enabled: + +- **Users can’t add Microsoft accounts** means that existing connected accounts can still sign in to the device (and appear on the Sign in screen). However, users cannot use the **Settings** app to add new connected accounts (or connect local accounts to Microsoft accounts). +- **Users can’t add or log on with Microsoft accounts** means that users cannot add new connected accounts (or connect local accounts to Microsoft accounts) or use existing connected accounts through **Settings**. + +This setting does not affect adding a Microsoft account for application authentication. For example, if this setting is enabled, a user can still provide a Microsoft account for authentication with an application such as **Mail**, but the user cannot use the Microsoft account for single sign-on authentication for other applications or services (in other words, the user will be prompted to authenticate for other applications or services). + +By default, this setting is **Not defined**. + +The path to this setting is: +Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options ### Configure connected accounts From ca591c38c697d60b0162bca8441365fb745bd405 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 10 Aug 2017 12:21:06 -0700 Subject: [PATCH 13/33] added new text for MSA setttings --- .../accounts-block-microsoft-accounts.md | 10 ++++++---- 1 file changed, 6 insertions(+), 4 deletions(-) diff --git a/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md b/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md index cc479c5bc2..08f291c02c 100644 --- a/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md +++ b/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md @@ -18,11 +18,13 @@ Describes the best practices, location, values, management, and security conside ## Reference -This policy setting prevents users from adding new Microsoft accounts on a device. +This setting prevents using the Settings app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services. -If you click the **Users can’t add Microsoft accounts** setting option, users will not be able to switch a local account to a Microsoft account, or connect a domain account to a Microsoft account to drive sync, roaming, or other background services. This is the preferred option if you need to limit the use of Microsoft accounts in your enterprise. Users will still be able to add app-specific Microsoft accounts for use with consumer apps. To block this use, turn off the ability to install consumer apps or the Store. +There are two options if this setting is enabled: -If you click the **Users can’t add or log on with Microsoft accounts** setting option, existing Microsoft account users will not be able to log on to Windows. Selecting this option might make it impossible for an existing administrator to log on to a computer and manage the system. +- **Users can’t add Microsoft accounts** means that existing connected accounts can still sign in to the device (and appear on the Sign in screen). However, users cannot use the **Settings** app to add new connected accounts (or connect local accounts to Microsoft accounts). + +- **Users can’t add or log on with Microsoft accounts** means that users cannot add new connected accounts (or connect local accounts to Microsoft accounts) or use existing connected accounts through **Settings**. If you disable or do not configure this policy (recommended), users will be able to use Microsoft accounts with Windows. @@ -36,7 +38,7 @@ By default, this setting is not defined on domain controllers and disabled on st ### Best practices - By disabling or not configuring this policy setting on the client computer, users will be able to use their Microsoft account, local account, or domain account for their sign-in session to Windows. It also enables the user to connect a local or domain account to a Microsoft account. This provides a convenient option for your users. -- If you need to limit the use of Microsoft accounts in your organization, click the **Users can’t add Microsoft accounts** setting option so that users will not be able to create new Microsoft accounts on a computer, switch a local account to a Microsoft account, or connect a domain account to a Microsoft account. +- If you need to limit the use of Microsoft accounts in your organization, click the **Users can’t add Microsoft accounts** setting option so that users will not be able to use the **Settings** app to add new connected accounts. ### Location From 0e1a94f65653388b5d9a201adf7fd4e2d3b682f2 Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 10 Aug 2017 12:23:40 -0700 Subject: [PATCH 14/33] added new text for MSA setttings --- windows/access-protection/access-control/microsoft-accounts.md | 1 + 1 file changed, 1 insertion(+) diff --git a/windows/access-protection/access-control/microsoft-accounts.md b/windows/access-protection/access-control/microsoft-accounts.md index 99a609d4e8..01efb97d0a 100644 --- a/windows/access-protection/access-control/microsoft-accounts.md +++ b/windows/access-protection/access-control/microsoft-accounts.md @@ -146,6 +146,7 @@ This setting does not affect adding a Microsoft account for application authenti By default, this setting is **Not defined**. The path to this setting is: + Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options ### Configure connected accounts From 92e30f511a376cc8f9fc930027a7718f4d73dc95 Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 10 Aug 2017 13:07:46 -0700 Subject: [PATCH 15/33] update signature updates section --- ...equirements-windows-defender-advanced-threat-protection.md | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index 34e836f47e..25a94e2b8c 100644 --- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -120,7 +120,9 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the ## Windows Defender signature updates are configured The Windows Defender ATP agent depends on Windows Defender’s ability to scan files and provide information about them. If Windows Defender is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). -When Windows Defender is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender goes on passive mode. For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). +When Windows Defender is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender goes on passive mode. If your organization has disabled Windows Defender through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy. + +For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). ## Windows Defender Early Launch Antimalware (ELAM) driver is enabled If you're running Windows Defender as the primary antimalware product on your endpoints, the Windows Defender ATP agent will successfully onboard. From 6952682a3fcb015811f4f0e0d0d44071d320deea Mon Sep 17 00:00:00 2001 From: Joey Caparas Date: Thu, 10 Aug 2017 13:23:54 -0700 Subject: [PATCH 16/33] antivirus --- ...uirements-windows-defender-advanced-threat-protection.md | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md index 25a94e2b8c..2232344229 100644 --- a/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md +++ b/windows/threat-protection/windows-defender-atp/minimum-requirements-windows-defender-advanced-threat-protection.md @@ -117,10 +117,10 @@ If the **START_TYPE** is not set to **AUTO_START**, then you'll need to set the sc qc diagtrack ``` -## Windows Defender signature updates are configured -The Windows Defender ATP agent depends on Windows Defender’s ability to scan files and provide information about them. If Windows Defender is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). +## Windows Defender Antivirus signature updates are configured +The Windows Defender ATP agent depends on the ability of Windows Defender Antivirus to scan files and provide information about them. If Windows Defender Antivirus is not the active antimalware in your organization, you may need to configure the signature updates. For more information see [Configure Windows Defender Antivirus in Windows 10](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). -When Windows Defender is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender goes on passive mode. If your organization has disabled Windows Defender through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy. +When Windows Defender Antivirus is not the active antimalware in your organization and you use the Windows Defender ATP service, Windows Defender Antivirus goes on passive mode. If your organization has disabled Windows Defender Antivirus through group policy or other methods, machines that are onboarded to Windows Defender ATP must be excluded from this group policy. For more information, see the **Compatibility** section in the [Windows Defender in Windows 10 topic](../windows-defender-antivirus/windows-defender-antivirus-in-windows-10.md). From 7bf7332e4e01cfa54bff406bd8ca1183df780be2 Mon Sep 17 00:00:00 2001 From: Maricia Alforque Date: Thu, 10 Aug 2017 21:10:22 +0000 Subject: [PATCH 17/33] Merged PR 2667: DeviceManageability CSP - updated with 2 new settings --- .../mdm/devicemanageability-csp.md | 15 ++- .../mdm/devicemanageability-ddf.md | 107 +++++++++++++++++- .../provisioning-csp-devicemanageability.png | Bin 3409 -> 11842 bytes ...ew-in-windows-mdm-enrollment-management.md | 20 +++- .../mdm/understanding-admx-backed-policies.md | 20 ++-- 5 files changed, 144 insertions(+), 18 deletions(-) diff --git a/windows/client-management/mdm/devicemanageability-csp.md b/windows/client-management/mdm/devicemanageability-csp.md index 48dbeed8c0..9c71c56671 100644 --- a/windows/client-management/mdm/devicemanageability-csp.md +++ b/windows/client-management/mdm/devicemanageability-csp.md @@ -30,11 +30,22 @@ Interior node. **Capabilities/CSPVersions** Returns the versions of all configuration service providers supported on the device for the MDM service. +**Provider** +Added in Windows 10, version 1709. Interior node. +**Provider/_ProviderID_** +Added in Windows 10, version 1709. Provider ID of the configuration source. -  +**Provider/_ProviderID_/ConfigInfo** +Added in Windows 10, version 1709. Configuration information string value set by the configuration source. Recommended to be used during sync session. + +Data type is string. Supported operations are Add, Get, Delete, and Replace. + +**Provider/_ProviderID_/EnrollmentInfo** +Added in Windows 10, version 1709. Enrollment information string value set by the configuration source. Recommended to send to server during MDM enrollment. + +Data type is string. Supported operations are Add, Get, Delete, and Replace.  -  diff --git a/windows/client-management/mdm/devicemanageability-ddf.md b/windows/client-management/mdm/devicemanageability-ddf.md index f45881a241..a1f646623e 100644 --- a/windows/client-management/mdm/devicemanageability-ddf.md +++ b/windows/client-management/mdm/devicemanageability-ddf.md @@ -7,12 +7,15 @@ ms.topic: article ms.prod: w10 ms.technology: windows author: nickbrower -ms.date: 06/19/2017 +ms.date: 08/10/2017 --- # DeviceManageability DDF +> [!WARNING] +> Some information relates to prereleased product which may be substantially modified before it's commercially released. Microsoft makes no warranties, express or implied, with respect to the information provided here. + This topic shows the OMA DM device description framework (DDF) for the DeviceManageability configuration service provider. This CSP was added in Windows 10, version 1607. You can download the DDF files from the links below: @@ -20,7 +23,7 @@ You can download the DDF files from the links below: - [Download all the DDF files for Windows 10, version 1703](http://download.microsoft.com/download/C/7/C/C7C94663-44CF-4221-ABCA-BC895F42B6C2/Windows10_1703_DDF_download.zip) - [Download all the DDF files for Windows 10, version 1607](http://download.microsoft.com/download/2/3/E/23E27D6B-6E23-4833-B143-915EDA3BDD44/Windows10_1607_DDF.zip) -The XML below is the current version for this CSP. +The XML below is for Windows 10, version 1709. ``` syntax @@ -46,7 +49,7 @@ The XML below is the current version for this CSP. - com.microsoft/1.0/MDM/DeviceManageability + com.microsoft/1.1/MDM/DeviceManageability @@ -90,9 +93,105 @@ The XML below is the current version for this CSP. + + Provider + + + + + + + + + + + + + + + + Provider + + + + + + + + + + + + + Provider ID String of the Configuration Source + + + + + + + + + + ProviderID + + + + + + ConfigInfo + + + + + + + + Configuration Info string value set by the config source. Recommended to be used during sync session. + + + + + + + + + + ConfigInfo + + text/plain + + + + + EnrollmentInfo + + + + + + + + Enrollment Info string value set by the config source. Recommended to sent to server during MDM enrollment. + + + + + + + + + + EnrollmentInfo + + text/plain + + + + + - ```   diff --git a/windows/client-management/mdm/images/provisioning-csp-devicemanageability.png b/windows/client-management/mdm/images/provisioning-csp-devicemanageability.png index e8364c9bd7dafb8397f67dd805f72607eca622ab..136c2408629c7c9eac838e5f4065bb115f951c09 100644 GIT binary patch literal 11842 zcmb_?2T+sU)@}kwkuD!1MFCM!5RfJvl&T;_T2PuaK@bvpho~PS3L+xXn}|pU=`BP- zI)q+Bkrt_uP(rA8gP-S|fBv~M_sm>p942}9yY_1PSCadF}N+ zzGaP<5r`<;_o^S?_tGWaQs~PM@}DOS)PK998+=>bX#Jzc`*Zi85Xg;BObDPLdx;-f zNJIofE-7^NYD+9F1aiy50WBmfJi$>P&;1j_x>Muc%>Jn^ydH%?)Zg0by5k$}3gz!H3NoYi8YH!8r+!9x#K3&aQ5qKyP%zCAeHvcZrhp0R(5 zB5iEcR5Za&3Pm9hCN_42fk8A?{XsCwdvZIg`w)>CoC>#EjNZ5>i3(Pzhdaf^Mkt6n0C(Q2OTI(DTJiCL!SIJ7Ab3|C+eJ&|=!|O(Wn_*se zea8Zqiz1E>YnWZs7hW-BduDQKsVucD+|Af=BaUT=DmG$8V;>biDd9TO5u8F~Ts5e# zntmWb-LG1QNjlm68tlvBFaSt8Sr5VOlmm;Vks~R4c=Jb;6#W zZWZ$5>6EkT6XsVq+d`l<`Y^Aqwu-~<@oG6{+ECgLdmVF{;#H{+bUY$RWWos8yj}Uz zvY1f|BYWwp64{Ul)>_(5gPfCMc-U+_2cx8-Wzv|ExVTN-6fk5)6+K6_!*VzdKkp#F z_Lm{udAW|rtDTL-+@5`^eWyI9lTD~)C@@bfw< z=E6f2gs#4TMfOofl5t71|8s(%5vC8da@gBQY#aXJ*z;I7B9tR_-`-1Cm-7)w#_3`m zC~TbS=Jy9u(fl9t<_690Dt)>2&J$}+lFBO<6g9%7EnDtmOXf+HN*8dCr%f%#WBg3R z_b=8+$=yW^d>HFs-Gkb{Hu>z4K8($ib?R?03KX19()IJw*4Dl!A`O9bOEV+L zV+rt}o_YVi2v4%b3u$MPR+**bvw!qIkG|qqSXo2B-OV>YkrGp4YLmKJmfM~DH$@U& zVv$k$@LNt{zrqtVlEo&acC)PibLo-SG%!JC0x@}PTo8yu5_RQt%T#^Jb|zk1s%s7Q zDsIu5Nh^=SRa3{;@O40ofzE0{4zMOSt>nv)RNL(l0S|r}%O|P9TI9w1ZcSSl1aIobo2$g^G#>kiy&#jfpXGE`l2;J5a@fsXgQ=q+sBwcVRk!pfL! z@4$VTXDSDyN7C#ZYb)qSvQ#9Ou-ad&FJ7ESWv}TyTPO5nxrYQDTo!;pL{CBa4^BF! z4-rvg!*SnjHdR~Z1V^~Le4e(Rac5jT*%os7?uC@mUrnL+ZVk4C+^jiS_xa&qB%T=d zf<`{I2m?y^)+A?6mGtV|Q%2*}ioXP>Dd%L?!x_jEM857HsYoIhAW>|uZ_ z1j2Lu{1jbm;a|c2Zm;n9QtxRF9Yi{N*7N#%4(W!Z>qx8LzpE|T9Uo|Nmq(AX3lUp$ z8M?a@ft=^?k^<)Hm=b-BLvgddGlzxf?L*2zCpv(4YLrPo;Fea!I)&w4%0F9zLxbFIl&+@Mx*3z)*m& zKm|#=L?-;@BRTlQszK=vfXoo zN=Zq8Sc)?n%t~=B`&0xN<3KGshDhurG`LG0@a4e zSI6X}7z6fE_|8PDa8ZueO9%+k5xlrYi3R_%54>dKaB`pPF- zB&m9b^*Vd;C20}QaZ7gL?bAEA2A`IuT||0am!L_~&Sv7C6D0)s z3i;}46SCd1#o2js`RLsof90$9njeelPNhXj_t}V4wbSl5$t-iWo1uL#6%7muP5rJ| zB9;=MR3kiJ2u{6!|9*#n3xE$q+_|Ca!JXtK@+}?~S({q0LyLJKw9bn!ct=0?4QbA9 z<9t!^n$gyys}g=)71wMTjkUrAz2@CE30A+DJ4L$hxrCS9ZfRp?%n4#i8r!1xgjt7~ z6a+jmvV>!^Oe}e_WWMVVF)6Ihd3zz7 z#ZM0>ce>Z{32i6MfliYoI8Zm#(3wp>O4lc10`Ywj;T8NHuA0hNJw<|ebK771cKuCm z-bUtkf7IlRwmI{8;-GRgkFRWYe_eVtOpr3zUdUfa+oUr4R z6}?ul2Vgi5KHwQy$Ul23_d*it?ztE~Zh}X6P3|IngLh^UGX7??%M;&(Cb}y)lQtDz zC|fm3`X!64TS!r#>CDZTfqs0JJ8+4D@gC{rwdW(FD4Aeh{@>AGs1C^79*Z^&zz-g6 z&}c4Yr)uQm)Nt0O6BLw3bDD`?1ToK>+$J&T?2HtouLse^2OZCRns@5mW&~?eU^R=I zpCse`Lk!wi_eRh_o443|-@^5Q+#&V3R{)&Jgv~Sc7k-XJ1|G>bXWZJJX%b+yf7im4 zJsWmT(m$uA!HC_1X9Z~Q@={u&jvO|-gy7uX=oBU>cW@h1fipNZLz3Wo-n%El=0DDiF5DE9q%xVE+P+clM(9Emt(+tlV z^XZ-IV}#t$rr_GJK9N)l_$64_O$+J-I)_^NX9$uU^1ui@R0aj3NPvvNj~6gO6ILiy z-BI(B_Y(Qcf*MdLV>R?mk)slldwwd7jf??;G-Cb_F?NAuE)^79+@ zvDlU?f)t$wqTe2OJFmm(aU!$T?#=bm6_Z5VY`lj(XkVJvdt;TP^sc_syhuud9_yy1 zd{lJyfce07zzsk%vi_b=>0xQ|B-i0cPYE}pS(^yxq;QOosUxj!Q`dO-+ic=1WzBAfEyYtQn;l++x{>LZ@(QS4f(}0l@{wmzDkIht`8>Vh)~Bp?i}3e1Q8M~%VAwMGAT;b2cDf;tBbBKV#F;M=Vo4wVwSUb{3~79h3}N( z_Y`T<9CdV9Xr9d#C{8#pfrD{D5=UD%=XOuA> z;HB&`k_uaI-7AV8U7o6i&5N-hQi(wx_z4BlGTDuGKA?9cnTw0ds$p=A2-%>s>VTZ?ea>WFO@!3r zc&J!q`yqF%)`7pNvTkvw>EPLr_s$)9$=&kmT;#yh*PAm!Awk~J6uBNTBSFhm-@YgP zk@<=hQQRR&h1yU<%W4z9J_`O@#-=Q`c4rl!NWp;Fq9%C{D@QrlQHbczrv_ukZk* z?r}Jb{afYeyNP^;J-4^`-x5?>6QFFa`%PpzGH+z&UA`Z5);zL!Im2fN(fe(&RP2tD zwch#Gv*K@)hEJkCe6pZ1UD{bS$8}rv%*#m;3;eKXW+l4V`wjbBv+vtsF9{ z;9XB7k(^X_%FE#(CbALiMvnYpTVktz*6p=l?5OVj!j!6+2S-5py{0WEiQ))oiQ|up zGJ71%e|EONwaZ4jA8!|VR{bIT9xZ=$(@u<_Ek z&mf+M?}_@86%77rUWTS|fRo+GiD++cCus#9bwo~NozIcElIB%5U@Bmtm;r&X{9f|h ztqLpEy_-0rv~CB@IIIoWSeU^v>gedU;7&mv93|H;oow41TNFHP9~N7e=ENeCyqZf_Ed+r6Re031OxILzGH+7r^UH z(scFmGFG&QAbEbHjm&8_HXII@m6gRWR={_dzqT^!NvN((wR3lOZ;I9jgOF$n2=!6? zmRJzl8N|_~wUwPBZ_NoRNGatp1fB<}lqPwMaBMUHEAx*skh<~~fI^2OC{;$Q0l>WB zbPR^VrvM(_Kk^!2uK+c>6OMuP)!#^RoO|4a1ka41Y5W_Gevxg-uS zV2m*GlgjV)qLgMqX~CA58kEvCjIHwE8oMa3RF27Ce zm4H^j-R6G0REU(L8&WPV}$U}~i=8|(K_cOjO)W6Y04^--0 zI+ugmVLgR7VA?2nXmKk#wOZE5{;^z-QITS1nbuv~)Vfbq6_U#uSGk1a>;=`sx^n79 zcJD?0hody8v84VQ9SvR)5hDE&XMCqc&ZKjEgxg|oWAsqoV?Cdxf-^}x5LZSk z?cTxd;jYzwmEZo|o|uZ}r<5I1_94@Jh?FZVLLSG9#}zrENlMY4*DDIpBkkh@WLxDa z|F*sKp)%GpOgQW*SHL!pr+8Xj@OImJi=wgT@4=6@xGQ1(6t z^U}%qUfXHq(OI3P;5p@sNJq-l5np0*s+&6-rL(^H)bg?cgS~}L36bx8dqy7blro># z*FS!sFuUKotAJ>Vi@2!dyrKTq?B}3vCo)>;8f-J#eqz5JopVyU$70oSP-UVap58uU z>;>R}rTQnA`~rb%kT zhcC9hwHe|Jc!}02C`>q(_E|%y4qI>;ym3@1V`Xnc7v^=Ab5YPN2}P75?Lil0+~>oY z5xR<`S(`|O!NEbVDKxZzMTG@mhIQSmb~#r7WlD)6E+p}V_nD$%t0gJvJ#d#cd*)k- zJku>~Dj%>}9Uu&K zF0H7jC@W*XXupAt7q_3)e-H?O`PF8Z5ME;b>oY2QH?>8fz7k^pulz9<0{aOMLIa}` zmo(zROj88s^~cv-S~Agq)uyp6Ih#&Ax?_ci)742`iVv<7s~@YlX5e0Z*gHM_AwVCx z|JSSU_NjqeYt7t~HQt406c-{vD&!F#`({B)N=nYwsqvF-#E;JiGQyIsaLX-QrWaJX zK6aV=v8_5lct~Bjl1k4Q@wyeq+C8wn?PF@180Bgf(Xa#PBioV!*c$ykJt}`!M2yWIsSpiE~sb zlj4hiAr&(yvF_a3ba{Dn8-m?9(Ofp-Ltg0HbPZ>W~zGbtT^O@2N z&7i`NKUC}WV7qtDCrIp+2{)*o&d$!J<&UF?PbzmJq{f;15=Zi`KUa2R>(B zbZLKc>SC5^jA)9k+PI_|=;`4(J}Lz~Fk>l0@1>FS?G5AS4>r@w5@QwFTg}hB6Jh3& zoAAXYcP2`$bI!b>02Z&+xl2vPU6~J$*8cE8J~eYkX~)ADk?i02G8Efc9L+B%(m?bIaT=cXm8{;$maILmD+tJh6$gg#ufF4yHQReL3uNb zX!Z;<0R#ILD9%FOpy0!mnoZ}QG}2{fzsJdS+(7RK;2jDcBwc!Q`{V z8hWX;sHodBsGAL%&~cx<%WOLDO1b{Q%2QWw$ABQsEAn;~)+%%2gRF8C3Se@3hmvfy zQ$;1V&@37w{00mc-rhi`%gmi5SDMT{EM#`QRP>?ad5QXdY*y2YCC8L~AFrjL`?B?> zST9-3V`XXiT6Oy6|eUD{iGg51FVo+*1Uh6J5%gQ$*Sm_Z zZoFqk+#-X9zP~0e-e-9RJ0w}UFRp#4E@0CEGy(XQ(rI2B8(L>TP=xF=9qC17dj?ANGxFF= zJPp*+H-e9ChO&dn>ki-4Q5v^gBV*|1K9+yuIWq!za2yhHv2Y~$hQ_hRZ>%V|(v<$$ zgKrA5e{Ayq6#bT=a&B%eK0e-basnkS@$Khz78Vu&M}+LBP5%hIT6J`92U2GV!^kCT zzE`m|J-8psK0aS(6D#ZYilqFbsiGpH|2>8a)QzLKy|JP>flY4BE+KuDVx(u6vzJH( zxp8o?t!MdTnkXI|i{X~|v$B}VEK{EyRKph5}sA~??f^UR05%LhL>q+Ms{0|0E)H^?C<2(%jA~}qZ z?d|O)VUZlrN1dx{F`+XogU;fS)3?u;Rm<~z6CUO57dM2r*KkN+ffn;8$qCsZlz-e^ zfD}B!1A!doH@#Tt>lI=~wY+%s!rad+9A4=eDe1(=-(N7=)@k*|7py;{rKKf|sEz*n z-I{>8gmd+qo$D-*T+Gi3Yj?(YnWn;I>n;+y4wm&TDAx~eB(4`{6W#TR?wG3HV%M^Y z#`!K4-ex1l9|}n_C?~f^omBiU4GcsBie8)ilZuYy}eiV0n z6gDOnY3p{y%2qhrqR;(yhx3(;SwPsNO1%VW@5m&Tq%O`FC#U1d(uegzk-H#s^5O7y z7)`JGKaL7MdoV%lN?wTiY8&b9s`W9>{fBlqzBhKvx$VR?@3Y0GcIm{oiAFXPj4CT} zxv~XSf@LS_A}KARwd^Kj5!`r_A~)D`VR zwikZ~99&*(Gf+E7jaV;FU^mhJ{1C9yze@wVc&#!%rJ>7b{c5^At^8)6&*;ttRBW z9$8x}E7siNJWf1_@hUcXy8%q#SabC6FB%?xj{hlSuMNK*zi>VCfG454>aE|0i6nZ3 zulBl|t_t=)6-_NJ2KL*Y`T z)jSm4rvm&KcJaDFwi%I610?jd=@_G56k);5v)c{pf+Byo`tY-s=GM^w14*oxfi9FcFl#I!b8wW5cS0uED>? z6H{{T>)Y=(xv7vgAs zVBa(bwj1D4rsM2S7^@iboC9O^#RkJ(oN$Xydm06`ohZLvbTDN0K)9H@jA-UwF@4jY z#DO~Rc{t&I7j+7!M~Uw->uNhaIi9oYq=AMaV%q0WPo@hGzj;0M0_WpcU+~47&Di@RW3ZX6)7kl zD-t)1HDw(3UbZ>OZ|Spm!sgvT_}Jn}$zgu`H7;F~84EJd(8_}{OB<`Ms3^JNP9Ibz zQu5w+Av#JW>lLVX25>)3nJHCX>F;T?PYb#FyQuwJxH+51=f^o}^e?~qPPxj#yClds zOm))a{IFJoH>cP0MOo!v*PDdazol%xaR00L%a=Z;36&QS3K|>9_b5PYl`_Zy!Yzr= zo!idYo=;E55%t_;U*8>upFOwuQ)ph8uB)S?g`aWfw$xOI^{+2}Ux$Pj$BRPAw(J!3 zY+xttiu-PSdb3GSV4hL(nrTU#&|dccQL|ZqpV$;4PE>f?@4@z(eeO)S!oMC#vgkI$4>^{}aWH6y}f z(68LXSEu2@ISU2rpFOafXs81#1($x5HJUW@b@ue%zU_vdc2_odiO}e}+NOfXZLK~- z)bd)bqlKfAgQqY%TMUk?gQGgXlG9Cea~ApWUu%i)R_NNIF5qV(Sso%Q;i%QYt~l@cTi*F+d}Y0rvr_0=D>D<=<53|N1qv4H_JUy$~o#<8}|%$&iqc z6C{e}m&jM&_ME5&f(O$q=D8L0yzKWyPl)WY6=g?e+cWKjvgm^|jnQsH0+JNh3AXerFD@x8)g57S>@{7Jp?kk(u?Udm1`ThxLbN?B#g4Pzo zsY4oPVdBlqSqfYMd_BS6)SiOtNKsKqFo1j(e!&;Rt$IDnCpieHuQ2yAcO%N-#GwkH?$f%#&Z5fkE01n<-$?@kj9N0v*!n0}&0 zUY#T3mDbsj$f{z`X0w9T{(8ocFLK)*HpF9Gs<8QvsHFwQeMeh6 z{q6_DkNUyj&r!D>DnuEeuvFw@ai^B%@C_pi%u607rO#oA;c%>I$7m&l9;>q z&iP#}9BsaDdE|l~EYzOut;`GyN@GYiRLj7{W*o4Jwt~i+LvB|wE|O=-3UtJ@iP z>KHpGxvn99x!es#C|t$D<)<3;F;{lFWM;KK2Y&Vh+|z-zlM}&0KH(r`!P{nEG zH_u(rfq(Bk18$&?Wx1#i%5Q$7)iem(qdA$Jux}$3{pBqHH=fm&Pma=4?*d2Uaa^_S z$oyW_V|g5i4 z#MmQkC~mys>&Qf(<4d$nc1_Rc3A$q|KSKG1>*+VPPs`d^s6}(<`w8dMZ^R9)G`28G zsYSG26l<3cyrf8JWPGhc-kuYD5)iUdmS|{V!I40SA?l(r$m2+RQvE_CeT zerW7++~z#J*rtmC-9G|Ok`=5nL$k~T)`@2S`Q?+fAk{IC&4>S9cXSl~aWu8`r=~v^ z^GwBYfNsF_2zj3(Z5;o+@bV1#Dww~JlzAiPtv#xak>IGiKpF!$fP%97`@??+Q2$?6 zGsDnpp?Zn>%E8nFzZpN!35I6JZzSV{*=wv59x?hu3P zPiLCJO%=JqpqrrGyTPa^d%HIrQu7IppGP7EXy&lSQn6}wXYb1VEt(Q25XSChyk+js zf*=2tFAtkiu77jkQV-Gz4xa?mz2ngdaN5MdlJokwpJ5=bz@~h)KH#H0y5d?vw(p59 z)Y3s-+-G6$Djcs9mbL%G7r6g*80^<_^C6rzJU_3-%Klv2npc5eFyxE z==$}o*=XIaPD#IUwqM65BtGO2JK#y|Ry$-Z`y9Q^Dt(q*$1KU98T%4xswNyeR%F$% zy$yan)d+%!bm-k>m)?xewK`toI-_1t$IA<-lxl`2I$ldY{UKgk zNMLtsl&nj>diRZ7?ujHq$YnW8Q*=l$P^1@+~%8xmnuNrc;( zXQiANrNK{9&n4+~tw>TPi9T$QsWG3+>u^={ktDJ!Ooh`ND8G#Z2k052qR(^~zpR|x zTp$no(e}{}XwmFDSD`}_6D}XeUWuSunm?IP9X(M&OHN9hL4XQW980c&*?eO z1@En~Sq2o>)tM_oKEC{C2Tn`$oLkjdIj_f~r3+CS=SC`BGh7q7U7xvtWPb66;{&C# XE8*46hu>qtL&$A49n}Km2T%VGm)(+> literal 3409 zcmZu!2{0S#7LKJ_deK&^i>lkj)uMH~s1~V5Eo~L8R#n|<&^DAdK^xlCRz(}zb+uIO z`%Z#uNrVtdLFtQyWtN02Q};%XNpumxtbP z@&f>r@IRLn2~zkJ0FZur=k|RI=ahbz)IRr2`m;>(v&>G99EMk3s(0>ycOKKb$PH4+ zf|T8c7BZn_R?sp}Xc+>EDTI=VzU9`iiaP533seSla!udNjP86j2S1tQq}O?S&|_LX>$T>c$XsP86y&x&|6s z;}?e>i?8)hsD*#2hkt1pO{xz`Mt?|d<|a2!e6L4*$AqP#BU3SvsST0o4Twx^Ocpja zt1%|K%qqLgGaFNwP3L5D#W{`fc})rV*o^$9uZ6g8#my-txXh9cekrc5v^lf1C9SNJ zU*3|5#OI(|^D6QAmH3*f*1~E+=ijX*HH4B{%5Xig0*$dkV?5Cq1e%0GlMB&wB6?9m z4ti0HAyr}9Y8pwkxHdG7T;JS=X(2bXkQ?#L`BrjsYdfx$f+MuG5Zdqratooog+OU0 zl3R)Gc;e6x5}8P9Cy+W?Ny7_m5|Bx4?ZmcrQX7TX)2<|*BZVc$kd)d&mpR9WcL=0hlYH4@N&4vA-_G_ zLdi2vyWf&k8SbFqI(+hac*heioca`|mAu;d^si*@+iMvj0o7>UDD*vhb#;3(AmirX zorBup6`2%Nl6BsaeBVURFTY=o7V#HE;Vo#{7uK#_Q|$I%2X_glbMPgqc?rdhb{cik zUp5%xrQrk9=3eCP!^l2DkY|98;WYEdArRlSNjPgU&7DyJo8H?AU*}o(re%(m;EF;; zpJPm)c+AI0*~prn-CCUqj@3e`?XZ0#@H3JBWg)^MNZb6{!wYXIwc!in@Td2l;c_eQ zjw$*cU^arY?avdyPr4kxt@(&9eSGbrzBzH$w6BU}DQm)+{In0&lbz(y8JogqO!E#k zcs(O!Xa-bq2(KsSq-y8;rp(Ps>_Q4I2vthLki01Xhh29UUfStp8sD$PYMfa1i=KHq zFh{V9k4fKs(uKK#(reT({)*CYQpNp_|HltV>W4P2Q#BYEGMZ!L5wGe0Ni{;Cn|&og zJR1-m0oYd$8L^o8tUl<@((kB+yu!XB&(tke zIeiIn&pv`6gIy?O9Dme(%*?%^G=rQVCntIt?>nIEQKBZ}eLX1Fl?LNRsu$MUpLqdd z>+i_4!Jlivv{Fy#B}bg`-7pwz4nqwc=l6&%C1O@=RMi=mhnuB=S2I(^Z-pQl>}u4i z#&;$SXLj%E#Y3C1UI1q4uX=@7Ow*s!qot+r&)uy%`lw2@4}wdGSEyF1_9lqe#Gt+E zO4(=R>0_4Rvh2bVr6 z2rX7aC9Nel89e&<#CdbnfCh;t=({%enkvNqWqN z!L{`v0EDpkrZ?t5#II+mM|5;o9b2zmkx%Cz1Zya#kWTJlkUFI+8dbJmxa z2`P4==*uuTzb$c_YxV>kq%pZ-iDU^UP@-^~cwqllVp5=PrTamc3G|iHDK-2nmS0{} ze3@&21AjGM9dk)B`Z&_6h+eQAGk=6}926O%E)CoDUy=3AT@RQbo0F~7zZrDwe`jyX4$8l@bHU-M8t?qK3lqe+cYx%3dqYON#0?5$s@NI}N zh;il3tmy{pq=)xzZeKt~;#}Zwun|tNq#yb6j019kEwk~==)f0_f2Mp;xDhvIqw=9a zTBy7w&u~DBm#Z^^^pA!-ChL;i1FCR3Rs(L^3Ib z1J?KSmlpwoThFf^!>2_5cm&1z-X2TD-FEy#C$0EJy_(E9nE&7U240K(XO*Sl$PqEZ zUw5_FnY}+6$j}8hj>S+Mj$}=&nFZQU8Vc?^->44 z(mDkULp5jE^Zw(`otUlaBaeLcGt}rE>7!rHF@6@>d(risC1xmpy6-+F|;>^^7szVf8;jQf%$Z_vJKuTojGemSfx?gV1?PK|)x&JGSx6 ztuVRM=b>hNOMw>sv@)#s@!ji+c5{P7MLY9Q_mFYjuh?{6!iO=#(&hF8sXmBB^%xPh zG3aVR(?CW2nosE1=hM)d5>;Z-ppW(BxG()QXry48|4+&_z`yqBQ3JAONph(Cxk5f?8bt%|4TNnO|6@$M2`n*3x) zwW6SSBZA7n9Scki_GRZEu)(dM>6Zw5!2#8Iaa7n@nDq8I?RumcX0SnLg@BA?1Wx@R zmz0T`{LjPkyI);~SOfP7_w<&DA^t|f?nmi{X}Dm0q>PcQU=Q*-PD#p0qW?p<0Vrd; z^P%@joV<$E$ z&3`BQxG}VnRAcw&E?gS4xYQ@rq3+1BtGHv2Aa;RVO3(%|Y5BeVuD`QeUv+CPKix^t z141h~`zs62C3dNGSVn@S4gVEgQ9c&8MD5};Ib6n+zP9iFgHF-@KT>s-~266+WuN6Q#XFSrF`^mywTVih`!J!C2Y%0?QwFDf2S`@ z-_44RsT;%1YMdgk;>*Y4Wdtut=L9~5OY%9Bpe}Ak-r?`YPJXC_SkOb=9l4%Q^kMz$ z>I_!wVr}V [AssignedAccess CSP](assignedaccess-csp.md) -

    Here are the changes in Windows 10, version 1709.

    +

    Added the following setting in Windows 10, version 1709.

      -
    • Added Configuration node
    • +
    • Configuration
    • +
    + + +[DeviceManageability CSP](devicemanageability-csp.md) +

    Added the following settings in Windows 10, version 1709:

    +
      +
    • Provider/_ProviderID_/ConfigInfo
    • +
    • Provider/_ProviderID_/EnrollmentInfo
    @@ -1336,6 +1344,14 @@ The DM agent for [push-button reset](https://msdn.microsoft.com/windows/hardware [AppLocker CSP](applocker-csp.md)

    Added two new SyncML examples (to disable the calendar app and to block usage of the map app) in [Whitelist examples](applocker-csp.md#whitelist-examples).

    + +[DeviceManageability CSP](devicemanageability-csp.md) +

    Added the following settings in Windows 10, version 1709:

    +
      +
    • Provider/_ProviderID_/ConfigInfo
    • +
    • Provider/_ProviderID_/EnrollmentInfo
    • +
    + [Policy CSP](policy-configuration-service-provider.md)

    Added the following new policies for Windows 10, version 1709:

    diff --git a/windows/client-management/mdm/understanding-admx-backed-policies.md b/windows/client-management/mdm/understanding-admx-backed-policies.md index f4b6271552..b677cdbec2 100644 --- a/windows/client-management/mdm/understanding-admx-backed-policies.md +++ b/windows/client-management/mdm/understanding-admx-backed-policies.md @@ -119,7 +119,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b **Request SyncML** ```XML - + 2 @@ -169,7 +169,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b **Request SyncML** ```XML - + 2 @@ -209,7 +209,7 @@ The following SyncML examples describe how to set a MDM policy that is defined b **Request SyncML** ``` - + 1 @@ -292,7 +292,7 @@ The `text` element simply corresponds to a string and correspondingly to an edit ```XML - + $CmdId$ @@ -333,7 +333,7 @@ The `multiText` element simply corresponds to a REG_MULTISZ registry string and ```XML - + 2 @@ -377,7 +377,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -409,7 +409,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -466,7 +466,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -503,7 +503,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar #### Corresponding SyncML: ```XML - + 2 @@ -552,7 +552,7 @@ Variations of the `list` element are dictated by attributes. These attributes ar ```XML - + 2 From 69d2e8540d4de71125bbff28ac53f52dffe419fd Mon Sep 17 00:00:00 2001 From: Justin Hall Date: Thu, 10 Aug 2017 14:50:20 -0700 Subject: [PATCH 18/33] added new text for MSA setttings --- .../accounts-block-microsoft-accounts.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md b/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md index 08f291c02c..b2a0c2025c 100644 --- a/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md +++ b/windows/device-security/security-policy-settings/accounts-block-microsoft-accounts.md @@ -18,7 +18,7 @@ Describes the best practices, location, values, management, and security conside ## Reference -This setting prevents using the Settings app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services. +This setting prevents using the **Settings** app to add a Microsoft account for single sign-on (SSO) authentication for Microsoft services and some background services, or using a Microsoft account for single sign-on to other applications or services. There are two options if this setting is enabled: From 4593e08e7d6b6208617a7d9e9cafe8eee7dd621f Mon Sep 17 00:00:00 2001 From: Celeste de Guzman Date: Thu, 10 Aug 2017 20:07:25 -0700 Subject: [PATCH 19/33] added more anchors in SUSPC topic per dev request and added target attribute in M365B index topic per discussion with teammate, per PM request --- bcs/index.md | 72 +++++++++---------- .../windows/use-set-up-school-pcs-app.md | 4 +- 2 files changed, 38 insertions(+), 38 deletions(-) diff --git a/bcs/index.md b/bcs/index.md index 50a9709c7e..409a3f09ae 100644 --- a/bcs/index.md +++ b/bcs/index.md @@ -13,7 +13,7 @@ description: Learn about the product documentation and resources available for M