mirror of
https://github.com/MicrosoftDocs/windows-itpro-docs.git
synced 2025-06-18 20:03:40 +00:00
Merge branch 'main' of https://github.com/MicrosoftDocs/windows-docs-pr into stevedia-P2
This commit is contained in:
Meghan Stewart
@ -12,7 +12,7 @@ metadata:
|
||||
- highpri
|
||||
- tier3
|
||||
ms.topic: faq
|
||||
ms.date: 06/28/2023
|
||||
ms.date: 07/11/2023
|
||||
title: Delivery Optimization Frequently Asked Questions
|
||||
summary: |
|
||||
**Applies to**
|
||||
@ -35,7 +35,7 @@ sections:
|
||||
|
||||
- question: What are the requirements if I use a proxy?
|
||||
answer: For Delivery Optimization to successfully use the proxy, you should set up the proxy by using Windows proxy settings or Internet Explorer proxy settings. For details see [Using a proxy with Delivery Optimization](../do/delivery-optimization-proxy.md). Most content downloaded with Delivery Optimization uses byte range requests. Make sure your proxy allows byte range requests. For more information, see [Proxy requirements for Windows Update](/windows/deployment/update/windows-update-troubleshooting).
|
||||
|
||||
|
||||
- question: What hostnames should I allow through my firewall to support Delivery Optimization?
|
||||
answer: |
|
||||
**For communication between clients and the Delivery Optimization cloud service**:
|
||||
@ -57,6 +57,11 @@ sections:
|
||||
|
||||
For more information, see [Endpoints for Delivery Optimization and Microsoft Connected Cache](../do/delivery-optimization-endpoints.md) for a list of all content endpoints needed.
|
||||
|
||||
- question: My firewall requires IP addresses and can't process FQDNs. How do I configure it to download content with Delivery Optimization?
|
||||
answer: |
|
||||
Microsoft content, such as Windows updates, are hosted and delivered globally via Content Delivery Networks (CDNs) and [Microsoft Connected Cache](waas-microsoft-connected-cache.md) (MCC) servers, which are hosted within Internet Service Provider (ISP) networks.
|
||||
The network of CDNs and MCCs allows Microsoft to reach the scale required to meet the demand of the Windows user base. Given this delivery infrastructure changes dynamically, providing an exhaustive list of IPs and keeping it up to date isn't feasible.
|
||||
|
||||
- question: Does Delivery Optimization use multicast?
|
||||
answer: No. It relies on the cloud service for peer discovery, resulting in a list of peers and their IP addresses. Client devices then connect to their peers to obtain download files over TCP/IP.
|
||||
|
||||
@ -100,7 +105,7 @@ sections:
|
||||
|
||||
- question: How are downloads initiated by Delivery Optimization?
|
||||
answer: |
|
||||
Delivery Optimization only starts when an application or service that's integrated with Delivery Optimization starts a download. For example, the Microsoft Edge browser. For more information about Delivery Optimization callers, see [Types of download content supported by Delivery Optimization](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization).
|
||||
Delivery Optimization only starts when an application or service that's integrated with Delivery Optimization starts a download. For example, the Microsoft Edge browser. For more information about Delivery Optimization callers, see [Types of download content supported by Delivery Optimization](waas-delivery-optimization.md#types-of-download-content-supported-by-delivery-optimization).
|
||||
|
||||
- question: How does Delivery Optimization determine which content is available for peering?
|
||||
answer: |
|
||||
@ -120,9 +125,9 @@ sections:
|
||||
Delivery Optimization is an HTTP downloader used by most content providers from Microsoft. When a device is configured to use Delivery Optimization peering (on by default), it does so with the HTTP downloader capabilities to optimize bandwidth usage.
|
||||
If you'd like to disable peer-to-peer capabilities of Delivery Optimization, change the Delivery Optimization [Download mode](waas-delivery-optimization-reference.md#download-mode) setting to '0', which will disable peer-to-peer and provide hash checks. [Download mode](waas-delivery-optimization-reference.md#download-mode) set to '99' should only be used when the device is offline and doesn't have internet access.
|
||||
Don't set **Download mode** to '100' (Bypass), which can cause some content to fail to download. Starting in Windows 11, Download mode '100' is deprecated.
|
||||
|
||||
|
||||
> [!NOTE]
|
||||
> Disabling Delivery Optimization won't prevent content from downloading to your devices. If you're looking to pause updates, you need to set policies for the relevant components such as Windows Update, Windows Store or Edge browser. If you're looking to reduce the load on your network, look into using Delivery Optimization Peer-to-Peer, Microsoft Connected Cache or apply the [network throttling policies](waas-delivery-optimization-reference.md#maximum-download-bandwidth) available for Delivery Optimization.
|
||||
> Disabling Delivery Optimization won't prevent content from downloading to your devices. If you're looking to pause updates, you need to set policies for the relevant components such as Windows Update, Windows Store or Microsoft Edge browser. If you're looking to reduce the load on your network, look into using Delivery Optimization Peer-to-Peer, Microsoft Connected Cache or apply the [network throttling policies](waas-delivery-optimization-reference.md#maximum-download-bandwidth) available for Delivery Optimization.
|
||||
|
||||
- question: Delivery Optimization is using device resources and I can't tell why?
|
||||
answer: |
|
||||
|
||||
@ -5,58 +5,45 @@ manager: aaroncz
|
||||
ms.technology: itpro-updates
|
||||
ms.prod: windows-client
|
||||
ms.topic: include
|
||||
ms.date: 08/18/2022
|
||||
ms.date: 07/11/2023
|
||||
ms.localizationpriority: medium
|
||||
---
|
||||
<!--This file is shared by updates/wufb-reports-configuration-script.md and the update/update-compliance-configuration-script.md articles. Headings are driven by article context. -->
|
||||
|Error |Description |
|
||||
|---------|---------|
|
||||
| 1 | General unexpected error|
|
||||
| 6 | Invalid CommercialID|
|
||||
| 8 | Couldn't create registry key path to set up CommercialID|
|
||||
| 9 | Couldn't write CommercialID at registry key path|
|
||||
| 11 | Unexpected result when setting up CommercialID.|
|
||||
| 12 | CheckVortexConnectivity failed, check Log output for more information.|
|
||||
<!--This file is shared by updates/wufb-reports-configuration-script.md and the update/update-compliance-configuration-script.md articles. Headings are driven by article context. Updated with 8099827 -->
|
||||
| Error | Description|
|
||||
|---|---|
|
||||
| 1 | Unexpected error |
|
||||
| 12 | CheckVortexConnectivity failed, check the log output for more information. |
|
||||
| 12 | Unexpected failure when running CheckVortexConnectivity.|
|
||||
| 16 | Reboot is pending on device, restart device and restart script.|
|
||||
| 16 | Reboot is pending on device. Restart the device then re rerun the script.|
|
||||
| 17 | Unexpected exception in CheckRebootRequired.|
|
||||
| 27 | Not system account. |
|
||||
| 30 | Unable to disable Enterprise Auth Proxy. This registry value must be 0 for UTC to operate in an authenticated proxy environment.|
|
||||
| 34 | Unexpected exception when attempting to check Proxy settings.|
|
||||
| 35 | Unexpected exception when checking User Proxy.|
|
||||
| 37 | Unexpected exception when collecting logs|
|
||||
| 34 | Unexpected exception when attempting to check proxy settings.|
|
||||
| 35 | Unexpected exception when checking user proxy.|
|
||||
| 37 | Unexpected exception when collecting logs.|
|
||||
| 40 | Unexpected exception when checking and setting telemetry.|
|
||||
| 41 | Unable to impersonate logged-on user.|
|
||||
| 42 | Unexpected exception when attempting to impersonate logged-on user.|
|
||||
| 43 | Unexpected exception when attempting to impersonate logged-on user.|
|
||||
| 44 | Error when running CheckDiagTrack service.|
|
||||
| 45 | DiagTrack.dll not found.|
|
||||
| 48 | CommercialID isn't a GUID|
|
||||
| 50 | DiagTrack service not running.|
|
||||
| 51 | Unexpected exception when attempting to run Census.exe|
|
||||
| 52 | Couldn't find Census.exe|
|
||||
| 53 | There are conflicting CommercialID values.|
|
||||
| 51 | Unexpected exception when attempting to run Census.exe. |
|
||||
| 52 | Couldn't find Census.exe. |
|
||||
| 54 | Microsoft Account Sign In Assistant (MSA) Service disabled.|
|
||||
| 55 | Failed to create new registry path for SetDeviceNameOptIn|
|
||||
| 56 | Failed to create property for SetDeviceNameOptIn at registry path|
|
||||
| 57 | Failed to update value for SetDeviceNameOptIn|
|
||||
| 58 | Unexpected exception in SetrDeviceNameOptIn|
|
||||
| 55 | Failed to create new registry path for SetDeviceNameOptIn.|
|
||||
| 56 | Failed to create property for SetDeviceNameOptIn at registry path.|
|
||||
| 57 | Failed to update value for SetDeviceNameOptIn. |
|
||||
| 58 | Unexpected exception in SetDeviceNameOptIn.|
|
||||
| 59 | Failed to delete LastPersistedEventTimeOrFirstBoot property at registry path when attempting to clean up OneSettings.|
|
||||
| 60 | Failed to delete registry key when attempting to clean up OneSettings.|
|
||||
| 61 | Unexpected exception when attempting to clean up OneSettings.|
|
||||
| 62 | AllowTelemetry registry key isn't of the correct type REG_DWORD|
|
||||
| 62 | AllowTelemetry registry key isn't the correct type of REG_DWORD.|
|
||||
| 63 | AllowTelemetry isn't set to the appropriate value and it couldn't be set by the script.|
|
||||
| 64 | AllowTelemetry isn't of the correct type REG_DWORD.|
|
||||
| 64 | AllowTelemetry isn't the correct type of REG_DWORD.|
|
||||
| 66 | Failed to verify UTC connectivity and recent uploads.|
|
||||
| 67 | Unexpected failure when verifying UTC CSP.|
|
||||
| 91 | Failed to create new registry path for EnableAllowUCProcessing|
|
||||
| 92 | Failed to create property for EnableAllowUCProcessing at registry path|
|
||||
| 93 | Failed to update value for EnableAllowUCProcessing|
|
||||
| 94 | Unexpected exception in EnableAllowUCProcessing|
|
||||
| 95 | Failed to create new registry path for EnableAllowCommercialDataPipeline |
|
||||
| 96 | Failed to create property for EnableAllowCommercialDataPipeline at registry path |
|
||||
| 97 | Failed to update value for EnableAllowCommercialDataPipeline |
|
||||
| 98 | Unexpected exception in EnableAllowCommercialDataPipeline |
|
||||
| 99 | Device isn't Windows 10.|
|
||||
| 100 | Device must be AADJ or hybrid AADJ to use Windows Update for Business reports or Update Compliance |
|
||||
| 101 | Check AADJ failed with unexpected exception |
|
||||
| 99 | Device isn't Windows 10 or Windows 11.|
|
||||
| 100 | Device must be Azure AD joined or hybrid Azure AD joined to use Windows Update for Business reports.|
|
||||
| 101 | Check Azure AD join failed with unexpected exception.|
|
||||
| 102 | DisableOneSettingsDownloads policy shouldn't be enabled. Please disable this policy.|
|
||||
|
||||
Binary file not shown.
|
Before Width: | Height: | Size: 149 KiB After Width: | Height: | Size: 408 KiB |
@ -7,7 +7,7 @@ author: mestew
|
||||
ms.author: mstewart
|
||||
ms.localizationpriority: medium
|
||||
ms.topic: article
|
||||
ms.date: 02/10/2023
|
||||
ms.date: 07/11/2023
|
||||
ms.technology: itpro-updates
|
||||
---
|
||||
|
||||
@ -25,23 +25,23 @@ You can download the script from the [Microsoft Download Center](https://www.mic
|
||||
|
||||
## How this script is organized
|
||||
|
||||
This script's two primary files are `ConfigScript.ps1` and `RunConfig.bat`. You configure `RunConfig.bat` according to the directions in the `.bat` itself, which will then run `ConfigScript.ps1` with the parameters entered to `RunConfig.bat`. There are two ways of using the script: in **Pilot** mode or **Deployment** mode.
|
||||
|
||||
- In **Pilot** mode (`runMode=Pilot`), the script will enter a verbose mode with enhanced diagnostics, and save the results in the path defined with `logpath` in `RunConfig.bat`. Pilot mode is best for a pilot run of the script or for troubleshooting configuration.
|
||||
- In **Deployment** mode (`runMode=Deployment`), the script will run quietly.
|
||||
This script's two primary files are `ConfigScript.ps1` and `RunConfig.bat`. You configure `RunConfig.bat` according to the directions in the `.bat` itself, which will then run `ConfigScript.ps1` with the parameters entered to `RunConfig.bat`. There are two ways of using the script: in **Pilot** mode or **Deployment** mode.
|
||||
|
||||
> [!Important]
|
||||
> [PsExec](/sysinternals/downloads/psexec) is used to run the script in the system context. Once the device is configured, remove PsExec.exe from the device.
|
||||
|
||||
## How to use this script
|
||||
|
||||
Open `RunConfig.bat` and configure the following (assuming a first-run, with `runMode=Pilot`):
|
||||
Edit the `RunConfig.bat` file to configure the following variables, then run the edited .bat file:
|
||||
|
||||
1. Define `logPath` to where you want the logs to be saved. Ensure that `runMode=Pilot`.
|
||||
1. Don't modify the [Commercial ID](update-compliance-get-started.md#get-your-commercialid) values since they're used for the earlier version of Windows Update for Business reports (Update Compliance). Leave `setCommercialID=false` and the `commercialIDValue=Unknown`.
|
||||
1. Run the script.
|
||||
1. Examine the logs for any issues. If there are no issues, then all devices with a similar configuration and network profile are ready for the script to be deployed with `runMode=Deployment`.
|
||||
1. If there are issues, gather the logs and provide them to Microsoft Support.
|
||||
| Variable | Allowed values and description | Example |
|
||||
|---|---|---|
|
||||
| runMode | **Pilot** (default): Verbose mode with additional diagnostics with additional logging. Pilot mode is best for a testing run of the script or for troubleshooting. <br> **Deployment**: Doesn't run any additional diagnostics or add extra logging | `runMode=Pilot` |
|
||||
| logPath | Path where the logs will be saved. The default location of the logs is `.\UCLogs`. | `logPath=C:\temp\logs` |
|
||||
| logMode | **0**: Log to the console only </br> **1** (default): Log to file and console. </br> **2**: Log to file only. | `logMode=2` |
|
||||
| DeviceNameOptIn | **true** (default): Device name is sent to Microsoft. </br> **false**: Device name isn't sent to Microsoft. | `DeviceNameOptIn=true` |
|
||||
| ClientProxy | **Direct** (default): No proxy is used. The connection to the endpoints is direct. </br> **System**: The system proxy, without authentication, is used. This type of proxy is typically configured with [netsh](/windows-server/networking/technologies/netsh/netsh-contexts) and can be verified using `netsh winhttp show proxy`. </br> **User**: The proxy is configured through IE and it might or might not require user authentication. </br> </br> For more information, see [How the Windows Update client determines which proxy server to use to connect to the Windows Update website](https://support.microsoft.com/en-us/topic/how-the-windows-update-client-determines-which-proxy-server-to-use-to-connect-to-the-windows-update-website-08612ae5-3722-886c-f1e1-d012516c22a1) | `ClientProxy=Direct` |
|
||||
| source | Used by the .bat file and PowerShell script to locate dependencies. It's recommended that you don't change this value. | `source=%~dp0` |
|
||||
|
||||
|
||||
## Script errors
|
||||
|
||||
@ -6,7 +6,7 @@ ms.prod: windows-client
|
||||
author: mestew
|
||||
ms.author: mstewart
|
||||
ms.topic: article
|
||||
ms.date: 04/26/2023
|
||||
ms.date: 07/11/2023
|
||||
ms.technology: itpro-updates
|
||||
---
|
||||
|
||||
@ -52,9 +52,7 @@ Windows Update for Business reports uses an [Azure Log Analytics workspaces](/az
|
||||
|
||||
## <a name="bkmk_enroll"></a> Enroll into Windows Update for Business reports
|
||||
|
||||
Enroll into Windows Update for Business reports by configuring its settings through either the Azure Workbook or from the Microsoft 365 admin center. Completing the Windows Update for Business reports configuration removes needing to specify [`CommercialID`](update-compliance-get-started.md#get-your-commercialid), which was needed by Update Compliance, the predecessor of Windows Update for Business reports.
|
||||
|
||||
Use one of the following methods to enroll into Windows Update for Business reports:
|
||||
Enroll into Windows Update for Business reports by configuring its settings through either the Azure Workbook or from the Microsoft 365 admin center. Use one of the following methods to enroll into Windows Update for Business reports:
|
||||
|
||||
##### <a name="bkmk_enroll-workbook"></a> Enroll through the Azure Workbook (recommended method)
|
||||
|
||||
|
||||
@ -16,10 +16,14 @@ ms.technology: itpro-fundamentals
|
||||
|
||||
**Applies to:**
|
||||
|
||||
- Windows 11
|
||||
- Windows 10
|
||||
- Windows 8.1
|
||||
- Windows 8
|
||||
- Windows 7
|
||||
- Windows Server 2022
|
||||
- Windows Server 2019
|
||||
- Windows Server 2016
|
||||
- Windows Server 2012 R2
|
||||
- Windows Server 2012
|
||||
- Windows Server 2008 R2
|
||||
|
||||
@ -54,9 +54,6 @@ In summary, the Windows 10/11 Enterprise E3 in CSP program is an upgrade offerin
|
||||
|
||||
## Compare Windows 10 Pro and Enterprise editions
|
||||
|
||||
> [!NOTE]
|
||||
> The following table only lists Windows 10. More information will be available about differences between Windows 11 editions after Windows 11 is generally available.
|
||||
|
||||
Windows 10 Enterprise edition has many features that are unavailable in Windows 10 Pro. Table 1 lists the Windows 10 Enterprise features not found in Windows 10 Pro. Many of these features are security-related, whereas others enable finer-grained device management.
|
||||
|
||||
### Table 1. Windows 10 Enterprise features not found in Windows 10 Pro
|
||||
@ -64,7 +61,7 @@ Windows 10 Enterprise edition has many features that are unavailable in Windows
|
||||
|Feature|Description|
|
||||
|--- |--- |
|
||||
|Credential Guard|Credential Guard uses virtualization-based security to help protect security secrets so that only privileged system software can access them. Examples of security secrets that can be protected include NTLM password hashes and Kerberos Ticket Granting Tickets. This protection helps prevent Pass-the-Hash or Pass-the-Ticket attacks.<br><br>Credential Guard has the following features:<li>**Hardware-level security** - Credential Guard uses hardware platform security features (such as Secure Boot and virtualization) to help protect derived domain credentials and other secrets.<li>**Virtualization-based security** - Windows services that access derived domain credentials and other secrets run in a virtualized, protected environment that is isolated.<li>**Improved protection against persistent threats** - Credential Guard works with other technologies (for example, Device Guard) to help provide further protection against attacks, no matter how persistent.<li>**Improved manageability** - Credential Guard can be managed through Group Policy, Windows Management Instrumentation (WMI), or Windows PowerShell.<br><br>For more information, see [Protect derived domain credentials with Credential Guard](/windows/security/identity-protection/credential-guard/credential-guard).<br><br>*Credential Guard requires UEFI 2.3.1 or greater with Trusted Boot; Virtualization Extensions such as Intel VT-x, AMD-V, and SLAT must be enabled; x64 version of Windows; IOMMU, such as Intel VT-d, AMD-Vi; BIOS Lockdown; TPM 2.0 recommended for device health attestation (will use software if TPM 2.0 not present)*|
|
||||
|Device Guard|This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, they'll be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.<br><br>Device Guard protects in the following ways:<li>Helps protect against malware<li>Helps protect the Windows system core from vulnerability and zero-day exploits<li>Allows only trusted apps to run<br><br>For more information, see [Introduction to Device Guard](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).|
|
||||
|Device Guard|This feature is a combination of hardware and software security features that allows only trusted applications to run on a device. Even if an attacker manages to get control of the Windows kernel, they'll be much less likely to run executable code. Device Guard can use virtualization-based security (VBS) in Windows 10 Enterprise edition to isolate the Code Integrity service from the Windows kernel itself. With VBS, even if malware gains access to the kernel, the effects can be severely limited, because the hypervisor can prevent the malware from executing code.<br><br>Device Guard protects in the following ways:<li>Helps protect against malware<li>Helps protect the Windows system core from vulnerability and zero-day exploits<li>Allows only trusted apps to run<br><br>For more information, see [Introduction to Device Guard](/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control).|
|
||||
|AppLocker management|This feature helps IT pros determine which applications and files users can run on a device. The applications and files that can be managed include executable files, scripts, Windows Installer files, dynamic-link libraries (DLLs), packaged apps, and packaged app installers.<br><br>For more information, see [AppLocker](/windows/security/threat-protection/windows-defender-application-control/applocker/applocker-overview).|
|
||||
|Application Virtualization (App-V)|This feature makes applications available to end users without installing the applications directly on users' devices. App-V transforms applications into centrally managed services that are never installed and don't conflict with other applications. This feature also helps ensure that applications are kept current with the latest security updates.<br><br>For more information, see [Getting Started with App-V for Windows 10](/windows/application-management/app-v/appv-getting-started).|
|
||||
|User Experience Virtualization (UE-V)|With this feature, you can capture user-customized Windows and application settings and store them on a centrally managed network file share.<br><br>When users log on, their personalized settings are applied to their work session, regardless of which device or virtual desktop infrastructure (VDI) sessions they log on to.<br><br>UE-V provides the following features:<li>Specify which application and Windows settings synchronize across user devices<li>Deliver the settings anytime and anywhere users work throughout the enterprise<li>Create custom templates for your third-party or line-of-business applications<li>Recover settings after hardware replacement or upgrade, or after re-imaging a virtual machine to its initial state<br><br>For more information, see [User Experience Virtualization (UE-V) for Windows 10 overview](/windows/configuration/ue-v/uev-for-windows).|
|
||||
@ -123,7 +120,7 @@ Now that the devices have Windows 10/11 Enterprise, you can implement Device Gua
|
||||
|
||||
For more information about implementing Device Guard, see:
|
||||
|
||||
- [Windows Defender Application Control and virtualization-based protection of code integrity](/windows/security/threat-protection/device-guard/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control)
|
||||
- [Windows Defender Application Control and virtualization-based protection of code integrity](/windows/security/application-security/application-control/introduction-to-device-guard-virtualization-based-security-and-windows-defender-application-control)
|
||||
- [Device Guard deployment guide](/windows/security/threat-protection/windows-defender-application-control/windows-defender-application-control-deployment-guide)
|
||||
|
||||
### AppLocker management
|
||||
|
||||
@ -4,7 +4,7 @@ metadata:
|
||||
description: Answers to frequently asked questions about Windows Autopatch.
|
||||
ms.prod: windows-client
|
||||
ms.topic: faq
|
||||
ms.date: 05/04/2023
|
||||
ms.date: 07/19/2023
|
||||
audience: itpro
|
||||
ms.localizationpriority: medium
|
||||
manager: dougeby
|
||||
@ -31,7 +31,7 @@ sections:
|
||||
Autopatch isn't available for 'A' or 'F' series licensing.
|
||||
- question: Will Windows Autopatch support local domain join Windows 10?
|
||||
answer: |
|
||||
Windows Autopatch doesn't support local (on-premise) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Azure AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
Windows Autopatch doesn't support local (on-premises) domain join. Windows Autopatch supports [Hybrid AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid) or pure [Azure AD join](/azure/active-directory/devices/concept-azure-ad-join-hybrid).
|
||||
- question: Will Windows Autopatch be available for state and local government customers?
|
||||
answer: |
|
||||
Windows Autopatch is available for all Windows E3 customers using Azure commercial cloud. However, Autopatch isn't currently supported for government cloud (GCC) customers. Although Windows 365 Enterprise is in the Azure Commercial cloud, when Windows 365 Enterprise is used with a GCC customer tenant, Autopatch is not suppported.
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: What is Windows Autopatch?
|
||||
description: Details what the service is and shortcuts to articles.
|
||||
ms.date: 07/11/2022
|
||||
ms.date: 07/11/2023
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: conceptual
|
||||
@ -23,14 +23,14 @@ Windows Autopatch is a cloud service that automates Windows, Microsoft 365 Apps
|
||||
|
||||
Rather than maintaining complex digital infrastructure, businesses want to focus on what makes them unique and successful. Windows Autopatch offers a solution to some of the challenges facing businesses and their people today:
|
||||
|
||||
- **Close the security gap**: By keeping software current, there are fewer vulnerabilities and threats to your devices.
|
||||
- **Close the productivity gap**: By adopting features as they're made available, users get the latest tools to enhance creation and collaboration.
|
||||
- **Optimize your IT admin resources**: By automating routine endpoint updates, IT pros have more time to create value.
|
||||
- **Close the security gap**: Windows Autopatch keeps software current, there are fewer vulnerabilities and threats to your devices.
|
||||
- **Close the productivity gap**: Windows Autopatch adopts features as they're made available. End users get the latest tools to amplify their collaboration and work.
|
||||
- **Optimize your IT admin resources**: Windows Autopatch automates routine endpoint updates. IT pros have more time to create value.
|
||||
- **On-premises infrastructure**: Transitioning to the world of software as a service (SaaS) allows you to minimize your investment in on-premises hardware since updates are delivered from the cloud.
|
||||
- **Onboard new services**: Windows Autopatch is scoped to make it easy to enroll and minimizes the time investment from your IT Admins to get started.
|
||||
- **Minimize end user disruption**: By releasing in sequential deployment rings, and responding to reliability and compatibility signals, user disruptions due to updates are minimized.
|
||||
- **Onboard new services**: Windows Autopatch makes it easy to enroll and minimizes the time required from your IT Admins to get started.
|
||||
- **Minimize end user disruption**: Windows Autopatch releases updates in sequential deployment rings, and responding to reliability and compatibility signals, user disruptions due to updates are minimized.
|
||||
|
||||
Windows Autopatch helps you minimize the involvement of your scarce IT resources in the planning and deployment of updates for Windows, Microsoft 365 Apps, Microsoft Edge or Teams. By crafting careful rollout sequences and communicating with you throughout the release, your IT Admins can focus on other activities and tasks.
|
||||
Windows Autopatch helps you minimize the involvement of your scarce IT resources in the planning and deployment of updates for Windows, Microsoft 365 Apps, Microsoft Edge or Teams. Windows Autopatch uses careful rollout sequences and communicates with you throughout the release, allowing your IT Admins can focus on other activities and tasks.
|
||||
|
||||
## Update management
|
||||
|
||||
@ -44,11 +44,11 @@ The goal of Windows Autopatch is to deliver software updates to registered devic
|
||||
| [Microsoft Edge](../operate/windows-autopatch-edge.md) | Windows Autopatch configures eligible devices to benefit from Microsoft Edge's progressive rollouts on the Stable channel. |
|
||||
| [Microsoft Teams](../operate/windows-autopatch-teams.md) | Windows Autopatch allows eligible devices to benefit from the standard automatic update channel. |
|
||||
|
||||
For each management area, there's a set of eligibility requirements that determine if the device will receive that specific update. An example of an eligibility criteria is that the device must have access to the required network endpoints for the Windows update. It's your responsibility to ensure that devices are meeting eligibility requirements for each management area.
|
||||
For each management area, there's a set of eligibility requirements that determine if the device receives that specific update. An example of an eligibility criteria is that the device must have access to the required network endpoints for the Windows update. It's your responsibility to ensure that devices are meeting eligibility requirements for each management area.
|
||||
|
||||
To determine if we're meeting our service level objectives, all eligible devices are labeled as either "Healthy" or "Unhealthy". Healthy devices are meeting the eligibility requirements for that management area and unhealthy devices aren't. If Windows Autopatch falls below any service level objective for a management area, an incident is raised. Then, we bring the service back into compliance.
|
||||
|
||||
While an update is in progress, it's monitored by Windows Autopatch. Depending on the criticality of the update, the service may decide to expedite the update. If we detect an issue during release, we may pause or roll back the update. Since each management area has a different monitoring and update control capabilities, you review the documentation for each area to familiarize yourself with the service.
|
||||
Windows Autopatch monitors in-progress updates. Depending on the criticality of the update, the service may decide to expedite the update. If we detect an issue during release, we may pause or roll back the update. Since each management area has a different monitoring and update control capabilities, you review the documentation for each area to familiarize yourself with the service.
|
||||
|
||||
## Messages
|
||||
|
||||
@ -62,10 +62,10 @@ Microsoft remains committed to the security of your data and the [accessibility]
|
||||
|
||||
| Area | Description |
|
||||
| ----- | ----- |
|
||||
| Prepare | The following articles describe the mandatory steps to prepare and enroll your tenant into Windows Autopatch:<ul><li>[Prerequisites](../prepare/windows-autopatch-prerequisites.md)</li><li>[Configure your network](../prepare/windows-autopatch-configure-network.md)</li><li>[Enroll your tenant](../prepare/windows-autopatch-enroll-tenant.md)</li><li>[Fix issues found by the Readiness assessment tool](../prepare/windows-autopatch-fix-issues.md)</li></ul> |
|
||||
| Deploy | Once you've enrolled your tenant, this section instructs you to:<ul><li>[Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md)</li><li>[Register your devices](../deploy/windows-autopatch-register-devices.md)</li></ul> |
|
||||
| Operate | This section includes the following information about your day-to-day life with the service:<ul><li>[Update management](../operate/windows-autopatch-update-management.md)</li><li>[Maintain your Windows Autopatch environment](../operate/windows-autopatch-maintain-environment.md)</li><li>[Submit a support request](../operate/windows-autopatch-support-request.md)</li><li>[Deregister a device](../operate/windows-autopatch-deregister-devices.md)</li></ul>
|
||||
| References | This section includes the following articles:<ul><li>[Windows update policies](../references/windows-autopatch-windows-update-unsupported-policies.md)</li><li>[Microsoft 365 Apps for enterprise update policies](../references/windows-autopatch-microsoft-365-policies.md)</li><li>[Privacy](../overview/windows-autopatch-privacy.md)</li><li>[Windows Autopatch Preview Addendum](../references/windows-autopatch-preview-addendum.md)</li></ul> |
|
||||
| Prepare | The following articles describe the mandatory steps to prepare and enroll your tenant into Windows Autopatch:<ul><li>[Prerequisites](../prepare/windows-autopatch-prerequisites.md)</li><li>[Configure your network](../prepare/windows-autopatch-configure-network.md)</li><li>[Enroll your tenant](../prepare/windows-autopatch-enroll-tenant.md)</li><li>[Fix issues found by the Readiness assessment tool](../prepare/windows-autopatch-fix-issues.md)</li><li>[Roles and responsibilities](../overview/windows-autopatch-roles-responsibilities.md)</ul> |
|
||||
| Deploy | Once you've enrolled your tenant, this section instructs you to:<ul><li>[Add and verify admin contacts](../deploy/windows-autopatch-admin-contacts.md)</li><li>[Register your devices](../deploy/windows-autopatch-register-devices.md)</li><li>[Manage Windows Autopatch groups](../deploy/windows-autopatch-groups-manage-autopatch-groups.md)</li></ul> |
|
||||
| Operate | This section includes the following information about your day-to-day life with the service:<ul><li>[Update management](../operate/windows-autopatch-groups-update-management.md)</li><li>[Windows quality and feature update reports](../operate/windows-autopatch-groups-windows-quality-and-feature-update-reports-overview.md)</li><li>[Maintain your Windows Autopatch environment](../operate/windows-autopatch-maintain-environment.md)</li><li>[Submit a support request](../operate/windows-autopatch-support-request.md)</li><li>[Deregister a device](../operate/windows-autopatch-deregister-devices.md)</li></ul>
|
||||
| References | This section includes the following articles:<ul><li>[Changes made at tenant enrollment](../references/windows-autopatch-changes-to-tenant.md)<li>[Windows update policies](../references/windows-autopatch-windows-update-unsupported-policies.md)</li><li>[Microsoft 365 Apps for enterprise update policies](../references/windows-autopatch-microsoft-365-policies.md)</li></ul> |
|
||||
|
||||
### Have feedback or would like to start a discussion?
|
||||
|
||||
|
||||
@ -66,7 +66,7 @@ The following groups target Windows Autopatch configurations to devices and mana
|
||||
| Policy name | Policy description | Properties | Value |
|
||||
| ----- | ----- | ----- | ----- |
|
||||
| Windows Autopatch - Set MDM to Win Over GPO | Sets mobile device management (MDM) to win over GPO<p>Assigned to:<ul><li>Modern Workplace Devices-Windows Autopatch-Test</li><li>Modern Workplace Devices-Windows Autopatch-First</li><li>Modern Workplace Devices-Windows Autopatch-Fast</li><li>Modern Workplace Devices-Windows Autopatch-Broad</li></ul>| [MDM Wins Over GP](/windows/client-management/mdm/policy-csp-controlpolicyconflict#controlpolicyconflict-MDMWinsOverGP) | <ul><li>MDM policy is used</li><li>GP policy is blocked</li></ul> |
|
||||
| Windows Autopatch - Data Collection | Windows Autopatch and Telemetry settings processes diagnostic data from the Windows device.<p>Assigned to:<ul><li>Modern Workplace Devices-Windows Autopatch-Test</li><li>Modern Workplace Devices-Windows Autopatch-First</li><li>Modern Workplace Devices-Windows Autopatch-Fast</li><li>Modern Workplace Devices-Windows Autopatch-Broad</li></ul>|<ol><li>[Configure Telemetry Opt In Change Notification](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinchangenotification)</li><li>[Configure Telemetry Opt In Settings UX](/windows/client-management/mdm/policy-csp-system#system-configuretelemetryoptinsettingsux)</li><li>[Allow Telemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)</li><li>[Limit Enhanced Diagnostic Data Windows Analytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics)</li><li>[Limit Dump Collection](/windows/client-management/mdm/policy-csp-system#system-limitdumpcollection)</li><li>[Limit Diagnostic Log Collection](/windows/client-management/mdm/policy-csp-system#system-limitdiagnosticlogcollection)</li></ol>|<ol><li>Enable telemetry change notifications</li><li>Enable Telemetry opt-in Settings</li><li>Full</li><li>Enabled</li><li>Enabled</li><li>Enabled</li></ol> |
|
||||
| Windows Autopatch - Data Collection | Windows Autopatch and Telemetry settings processes diagnostic data from the Windows device.<p>Assigned to:<ul><li>Modern Workplace Devices-Windows Autopatch-Test</li><li>Modern Workplace Devices-Windows Autopatch-First</li><li>Modern Workplace Devices-Windows Autopatch-Fast</li><li>Modern Workplace Devices-Windows Autopatch-Broad</li></ul>|<ol><li>[Allow Telemetry](/windows/client-management/mdm/policy-csp-system#system-allowtelemetry)</li><li>[Limit Enhanced Diagnostic Data Windows Analytics](/windows/client-management/mdm/policy-csp-system#system-limitenhanceddiagnosticdatawindowsanalytics)</li><li>[Limit Dump Collection](/windows/client-management/mdm/policy-csp-system#system-limitdumpcollection)</li><li>[Limit Diagnostic Log Collection](/windows/client-management/mdm/policy-csp-system#system-limitdiagnosticlogcollection)</li></ol>|<ol><li>Full</li><li>Enabled</li><li>Enabled</li><li>Enabled</li></ol> |
|
||||
|
||||
## Deployment rings for Windows 10 and later
|
||||
|
||||
|
||||
@ -1,7 +1,7 @@
|
||||
---
|
||||
title: What's new 2023
|
||||
description: This article lists the 2023 feature releases and any corresponding Message center post numbers.
|
||||
ms.date: 06/26/2023
|
||||
ms.date: 07/10/2023
|
||||
ms.prod: windows-client
|
||||
ms.technology: itpro-updates
|
||||
ms.topic: whats-new
|
||||
@ -21,6 +21,14 @@ This article lists new and updated feature releases, and service releases, with
|
||||
|
||||
Minor corrections such as typos, style, or formatting issues aren't listed.
|
||||
|
||||
## July 2023
|
||||
|
||||
### July service releases
|
||||
|
||||
| Message center post number | Description |
|
||||
| ----- | ----- |
|
||||
| [MC628172](https://admin.microsoft.com/adminportal/home#/MessageCenter) | General Availability: New Features in Windows Autopatch |
|
||||
|
||||
## June 2023
|
||||
|
||||
### June feature releases or updates
|
||||
@ -36,6 +44,7 @@ Minor corrections such as typos, style, or formatting issues aren't listed.
|
||||
|
||||
| Message center post number | Description |
|
||||
| ----- | ----- |
|
||||
| [MC617077](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Windows Autopatch Public Preview: Drivers and Firmware Management |
|
||||
| [MC604889](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Expanding Windows Autopatch availability in August 2023 |
|
||||
| [MC602590](https://admin.microsoft.com/adminportal/home#/MessageCenter) | June 2023 Windows Autopatch baseline configuration update |
|
||||
| [MC591864](https://admin.microsoft.com/adminportal/home#/MessageCenter) | Updated ticket categories to reduce how long it takes to resolve support requests |
|
||||
|
||||
Reference in New Issue
Block a user