mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-20 21:03:42 +00:00
chore: Replace tab after unorderd list marker
This commit is contained in:
Nick Schonning
@ -277,23 +277,23 @@ Supported operation is Get.
|
||||
<a href="" id="devicestatus-deviceguard-virtualizationbasedsecurityhwreq"></a>**DeviceStatus/DeviceGuard/VirtualizationBasedSecurityHwReq**
|
||||
Added in Windows, version 1709. Virtualization-based security hardware requirement status. The value is a 256 value bitmask.
|
||||
|
||||
- 0x0: System meets hardware configuration requirements
|
||||
- 0x1: SecureBoot required
|
||||
- 0x2: DMA Protection required
|
||||
- 0x4: HyperV not supported for Guest VM
|
||||
- 0x8: HyperV feature is not available
|
||||
- 0x0: System meets hardware configuration requirements
|
||||
- 0x1: SecureBoot required
|
||||
- 0x2: DMA Protection required
|
||||
- 0x4: HyperV not supported for Guest VM
|
||||
- 0x8: HyperV feature is not available
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
<a href="" id="devicestatus-deviceguard-virtualizationbasedsecuritystatus"></a>**DeviceStatus/DeviceGuard/VirtualizationBasedSecurityStatus**
|
||||
Added in Windows, version 1709. Virtualization-based security status. Value is one of the following:
|
||||
- 0 - Running
|
||||
- 1 - Reboot required
|
||||
- 2 - 64 bit architecture required
|
||||
- 3 - not licensed
|
||||
- 4 - not configured
|
||||
- 5 - System doesn't meet hardware requirements
|
||||
- 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details
|
||||
- 0 - Running
|
||||
- 1 - Reboot required
|
||||
- 2 - 64 bit architecture required
|
||||
- 3 - not licensed
|
||||
- 4 - not configured
|
||||
- 5 - System doesn't meet hardware requirements
|
||||
- 42 – Other. Event logs in Microsoft-Windows-DeviceGuard have more details
|
||||
|
||||
|
||||
Supported operation is Get.
|
||||
@ -301,11 +301,11 @@ Supported operation is Get.
|
||||
<a href="" id="devicestatus-deviceguard-lsacfgcredguardstatus"></a>**DeviceStatus/DeviceGuard/LsaCfgCredGuardStatus**
|
||||
Added in Windows, version 1709. Local System Authority (LSA) credential guard status.
|
||||
|
||||
- 0 - Running
|
||||
- 1 - Reboot required
|
||||
- 2 - Not licensed for Credential Guard
|
||||
- 3 - Not configured
|
||||
- 4 - VBS not running
|
||||
- 0 - Running
|
||||
- 1 - Reboot required
|
||||
- 2 - Not licensed for Credential Guard
|
||||
- 3 - Not configured
|
||||
- 4 - VBS not running
|
||||
|
||||
|
||||
Supported operation is Get.
|
||||
|
||||
@ -19,10 +19,10 @@ This is a step-by-step guide to configuring ADMX-backed policies in MDM.
|
||||
Starting in Windows 10 version 1703, Mobile Device Management (MDM) policy configuration support was expanded to allow access of select Group Policy administrative templates (ADMX-backed policies) for Windows PCs via the [Policy configuration service provider (CSP)](policy-configuration-service-provider.md). Configuring ADMX-backed policies in Policy CSP is different from the typical way you configure a traditional MDM policy.
|
||||
|
||||
Summary of steps to enable a policy:
|
||||
- Find the policy from the list ADMX-backed policies.
|
||||
- Find the Group Policy related information from the MDM policy description.
|
||||
- Use the Group Policy Editor to determine whether there are parameters necessary to enable the policy.
|
||||
- Create the data payload for the SyncML.
|
||||
- Find the policy from the list ADMX-backed policies.
|
||||
- Find the Group Policy related information from the MDM policy description.
|
||||
- Use the Group Policy Editor to determine whether there are parameters necessary to enable the policy.
|
||||
- Create the data payload for the SyncML.
|
||||
|
||||
See [Support Tip: Ingesting Office ADMX-backed policies using Microsoft Intune](https://techcommunity.microsoft.com/t5/Intune-Customer-Success/Support-Tip-Ingesting-Office-ADMX-Backed-policies-using/ba-p/354824) for a walk-through using Intune.
|
||||
|
||||
|
||||
@ -14,13 +14,13 @@ ms.topic:
|
||||
# How Mobile Device Management Providers support eSIM Management on Windows
|
||||
The eSIM Profile Management Solution puts the Mobile Device Management (MDM) Provider in the front and center. The whole idea is to leverage an already existing solution that customers are familiar with and that they use to manage devices. The expectations from an MDM are that it will leverage the same sync mechanism that it uses for device policies to push any policy to the eSIM profile, and be able to use Groups and Users the same way. This way, the eSIM profile download and installation happens on the background and not impacting the end user. Similarly, the IT admin would use the same method of managing the eSIM profiles (Assignment/de-assignment, etc.) the same way as they currently do device management.
|
||||
If you are a Mobile Device Management (MDM) Provider and would like to support eSIM Management on Windows, you should do the following:
|
||||
- Onboard to Azure Active Directory
|
||||
- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties.
|
||||
- Assess solution type that you would like to provide your customers
|
||||
- Batch/offline solution
|
||||
- IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices.
|
||||
- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to
|
||||
- Real-time solution
|
||||
- MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time.
|
||||
- Operator is notified of the status of each eSIM profile and has visibility on which devices are being used
|
||||
- Onboard to Azure Active Directory
|
||||
- Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. Contact mobile operators directly or contact orchestrator providers. Windows provides the capability for eSIM profiles to be managed by MDM providers in the case of enterprise use cases. However, Windows does not limit how ecosystem partners might want to offer this to their own partners and/or customers. As such, the eSIM profile management capability is something that can be supported by integrating with the Window OMA-DM. This makes it possible to remotely manage the eSIM profiles according to the company policies. As an MDM provider, if you are looking to integrate/onboard to a mobile operator on a 1:1 basis, please contact them and learn more about their onboarding. If you would like to support multiple mobile operators, [orchestrator providers]( https://www.idemia.com/esim-management-facilitation) are there to act as a proxy that will handle MDM onboarding as well as mobile operator onboarding. Their main [role]( https://www.idemia.com/smart-connect-hub) is to enable the process to be as painless but scalable to all parties.
|
||||
- Assess solution type that you would like to provide your customers
|
||||
- Batch/offline solution
|
||||
- IT Admin can manually import a flat file containing list of eSIM activation codes, and provision eSIM on LTE enabled devices.
|
||||
- Operator does not have visibility over status of the eSIM profiles and device eSIM has been downloaded and installed to
|
||||
- Real-time solution
|
||||
- MDM automatically syncs with the Operator backend system for subscription pool and eSIM management, via sim vendor solution component. IT Admin can view subscription pool and provision eSIM in real time.
|
||||
- Operator is notified of the status of each eSIM profile and has visibility on which devices are being used
|
||||
**Note:** The solution type is not noticeable to the end-user. The choice between the two is made between the MDM and the Mobile Operator.
|
||||
|
||||
@ -16,13 +16,13 @@ manager: dansimp
|
||||
The NetworkQoSPolicy configuration service provider creates network Quality of Service (QoS) policies. A QoS policy performs a set of actions on network traffic based on a set of matching conditions. This CSP was added in Windows 10, version 1703.
|
||||
|
||||
The following conditions are supported:
|
||||
- Network traffic from a specific application name
|
||||
- Network traffic from specific source or destination ports
|
||||
- Network traffic from a specific IP protocol (TCP, UDP, or both)
|
||||
- Network traffic from a specific application name
|
||||
- Network traffic from specific source or destination ports
|
||||
- Network traffic from a specific IP protocol (TCP, UDP, or both)
|
||||
|
||||
The following actions are supported:
|
||||
- Layer 2 tagging using a IEEE 802.1p priority value
|
||||
- Layer 3 tagging using a differentiated services code point (DSCP) value
|
||||
- Layer 2 tagging using a IEEE 802.1p priority value
|
||||
- Layer 3 tagging using a differentiated services code point (DSCP) value
|
||||
|
||||
> [!NOTE]
|
||||
> The NetworkQoSPolicy configuration service provider is supported only in Microsoft Surface Hub.
|
||||
|
||||
@ -633,9 +633,9 @@ ADMX Info:
|
||||
<!--SupportedValues-->
|
||||
Supported values:
|
||||
|
||||
- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit.
|
||||
- 0 - Never send tracking information.
|
||||
- 1 - Send tracking information.
|
||||
- Blank (default) - Do not send tracking information but let users choose to send tracking information to sites they visit.
|
||||
- 0 - Never send tracking information.
|
||||
- 1 - Send tracking information.
|
||||
|
||||
Most restricted value: 1
|
||||
<!--/SupportedValues-->
|
||||
|
||||
@ -806,11 +806,11 @@ If the policy is not specified, the behavior will be that no pages are affected.
|
||||
|
||||
The format of the PageVisibilityList value is as follows:
|
||||
|
||||
- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity.
|
||||
- There are two variants: one that shows only the given pages and one which hides the given pages.
|
||||
- The first variant starts with the string "showonly:" and the second with the string "hide:".
|
||||
- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace.
|
||||
- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi".
|
||||
- The value is a unicode string up to 10,000 characters long, which will be used without case sensitivity.
|
||||
- There are two variants: one that shows only the given pages and one which hides the given pages.
|
||||
- The first variant starts with the string "showonly:" and the second with the string "hide:".
|
||||
- Following the variant identifier is a semicolon-delimited list of page identifiers, which must not have any extra whitespace.
|
||||
- Each page identifier is the ms-settings:xyz URI for the page, minus the ms-settings: prefix, so the identifier for the page with URI "ms-settings:network-wifi" would be just "network-wifi".
|
||||
|
||||
The default value for this setting is an empty string, which is interpreted as show everything.
|
||||
|
||||
|
||||
@ -23,8 +23,8 @@ In addition to standard policies, the Policy CSP can now also handle ADMX-backed
|
||||
|
||||
ADMX files can either describe operating system (OS) Group Policies that are shipped with Windows or they can describe settings of applications, which are separate from the OS and can usually be downloaded and installed on a PC.
|
||||
Depending on the specific category of the settings that they control (OS or application), the administrative template settings are found in the following two locations in the Local Group Policy Editor:
|
||||
- OS settings: Computer Configuration/Administrative Templates
|
||||
- Application settings: User Configuration/Administrative Templates
|
||||
- OS settings: Computer Configuration/Administrative Templates
|
||||
- Application settings: User Configuration/Administrative Templates
|
||||
|
||||
In a domain controller/Group Policy ecosystem, Group Policies are automatically added to the registry of the client computer or user profile by the Administrative Templates Client Side Extension (CSE) whenever the client computer processes a Group Policy. Conversely, in an MDM-managed client, ADMX files are leveraged to define policies independent of Group Policies. Therefore, in an MDM-managed client, a Group Policy infrastructure, including the Group Policy Service (gpsvc.exe), is not required.
|
||||
|
||||
@ -42,17 +42,17 @@ To capture the end-to-end MDM handling of ADMX Group Policies, an IT administrat
|
||||
The ADMX file that the MDM ISV uses to determine what UI to display to the IT administrator is the same ADMX file that the client uses for the policy definition. The ADMX file is processed either by the OS at build time or set by the client at OS runtime. In either case, the client and the MDM ISV must be synchronized with the ADMX policy definitions. Each ADMX file corresponds to a Group Policy category and typically contains several policy definitions, each of which represents a single Group Policy. For example, the policy definition for the “Publishing Server 2 Settings” is contained in the appv.admx file, which holds the policy definitions for the Microsoft Application Virtualization (App-V) Group Policy category.
|
||||
|
||||
Group Policy option button setting:
|
||||
- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur:
|
||||
- The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data.
|
||||
- The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition.
|
||||
- If **Enabled** is selected, the necessary data entry controls are displayed for the user in the UI. When IT administrator enters the data and clicks **Apply**, the following events occur:
|
||||
- The MDM ISV server sets up a Replace SyncML command with a payload that contains the user-entered data.
|
||||
- The MDM client stack receives this data, which causes the Policy CSP to update the device’s registry per the ADMX-backed policy definition.
|
||||
|
||||
- If **Disabled** is selected and you click **Apply**, the following events occur:
|
||||
- The MDM ISV server sets up a Replace SyncML command with a payload set to `<disabled\>`.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition.
|
||||
- If **Disabled** is selected and you click **Apply**, the following events occur:
|
||||
- The MDM ISV server sets up a Replace SyncML command with a payload set to `<disabled\>`.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to either delete the device’s registry settings, set the registry keys, or both, per the state change directed by the ADMX-backed policy definition.
|
||||
|
||||
- If **Not Configured** is selected and you click **Apply**, the following events occur:
|
||||
- MDM ISV server sets up a Delete SyncML command.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition.
|
||||
- If **Not Configured** is selected and you click **Apply**, the following events occur:
|
||||
- MDM ISV server sets up a Delete SyncML command.
|
||||
- The MDM client stack receives this command, which causes the Policy CSP to delete the device’s registry settings per the ADMX-backed policy definition.
|
||||
|
||||
The following diagram shows the main display for the Group Policy Editor.
|
||||
|
||||
|
||||
@ -107,8 +107,8 @@ You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that
|
||||
|
||||
More information on how to use Dumpchk.exe to check your dump files:
|
||||
|
||||
- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk)
|
||||
- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk)
|
||||
- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk)
|
||||
- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk)
|
||||
|
||||
### Pagefile Settings
|
||||
|
||||
|
||||
@ -145,8 +145,8 @@ If the computer is no longer frozen and now is running in a good state, use the
|
||||
|
||||
Use the Dump Check Utility (Dumpchk.exe) to read a memory dump file or verify that the file was created correctly. You can use the Microsoft DumpChk (Crash Dump File Checker) tool to verify that the memory dump files are not corrupted or invalid.
|
||||
|
||||
- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk)
|
||||
- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk)
|
||||
- [Using DumpChk]( https://docs.microsoft.com/windows-hardware/drivers/debugger/dumpchk)
|
||||
- [Download DumpCheck](https://developer.microsoft.com/windows/downloads/windows-10-sdk)
|
||||
|
||||
Learn how to use Dumpchk.exe to check your dump files:
|
||||
|
||||
|
||||
@ -27,11 +27,11 @@ Employees increasingly depend on smartphones to complete daily work tasks, but t
|
||||
Windows 10 supports end-to-end device lifecycle management to give companies control over their devices, data, and apps. Devices can easily be incorporated into standard lifecycle practices, from device enrollment, configuration, and application management to maintenance, monitoring, and retirement using a comprehensive mobile device management solution.
|
||||
|
||||
**In this article**
|
||||
- [Deploy](#deploy)
|
||||
- [Configure](#configure)
|
||||
- [Apps](#apps)
|
||||
- [Manage](#manage)
|
||||
- [Retire](#retire)
|
||||
- [Deploy](#deploy)
|
||||
- [Configure](#configure)
|
||||
- [Apps](#apps)
|
||||
- [Manage](#manage)
|
||||
- [Retire](#retire)
|
||||
|
||||
|
||||
## Deploy
|
||||
@ -365,18 +365,18 @@ You can define and deploy APN profiles in MDM systems that configure cellular da
|
||||
|
||||
- **APN name** The APN name
|
||||
- *IP connection type* The IP connection type; set to one of the following values:
|
||||
- IPv4 only
|
||||
- IPv6 only
|
||||
- IPv4 and IPv6 concurrently
|
||||
- IPv6 with IPv4 provided by 46xlat
|
||||
- IPv4 only
|
||||
- IPv6 only
|
||||
- IPv4 and IPv6 concurrently
|
||||
- IPv6 with IPv4 provided by 46xlat
|
||||
- **LTE attached** Whether the APN should be attached as part of an LTE Attach
|
||||
- **APN class ID** The globally unique identifier that defines the APN class to the modem
|
||||
- **APN authentication type** The APN authentication type; set to one of the following values:
|
||||
- None
|
||||
- Auto
|
||||
- PAP
|
||||
- CHAP
|
||||
- MSCHAPv2
|
||||
- None
|
||||
- Auto
|
||||
- PAP
|
||||
- CHAP
|
||||
- MSCHAPv2
|
||||
- **User name** The user account when users select Password Authentication Protocol (PAP), CHAP, or MSCHAPv2 authentication in APN authentication type
|
||||
- **Password** The password for the user account specified in User name
|
||||
- **Integrated circuit card ID** The integrated circuit card ID associated with the cellular connection profile
|
||||
|
||||
Reference in New Issue
Block a user