diff --git a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md index ef418d7c0c..7aa983fc6e 100644 --- a/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md +++ b/mdop/uev-v2/security-considerations-for-ue-v-2x-both-uevv2.md @@ -33,143 +33,36 @@ Because settings packages might contain personal information, you should take ca 1. Set the following share-level SMB permissions for the setting storage location folder. - - - - - - - - - - - - - - - - - - - - - -
User accountRecommended permissions

Everyone

No permissions

Security group of UE-V

Full control

- -   + | User account | Recommended permissions | + | - | - | + | Everyone | No permissions | + |Security group of UE-V | Full control | 2. Set the following NTFS file system permissions for the settings storage location folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
User accountRecommended permissionsFolder

Creator/Owner

No permissions

No permissions

Domain Admins

Full control

This folder, subfolders, and files

Security group of UE-V users

List folder/read data, create folders/append data

This folder only

Everyone

Remove all permissions

No permissions

- -   + | User account | Recommended permissions | Folder | + | - | - | - | + | Creator/Owner | No permissions | No permissions | + | Domain Admins | Full control | This folder, subfolders, and files | + | Security group of UE-V users | List folder/read data, create folders/append data | This folder only | + | Everyone | Remove all permissions | No permissions | 3. Set the following share-level SMB permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - -
User accountRecommend permissions

Everyone

No permissions

Domain computers

Read permission Levels

Administrators

Read/write permission levels

- + | User account | Recommend permissions | + | - | - | + | Everyone | No permissions | + | Domain computers | Read permission Levels | + | Administrators | Read/write permission levels |   - 4. Set the following NTFS permissions for the settings template catalog folder. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
User accountRecommended permissionsApply to

Creator/Owner

Full control

This folder, subfolders, and files

Domain Computers

List folder contents and Read permissions

This folder, subfolders, and files

Everyone

No permissions

No permissions

Administrators

Full Control

This folder, subfolders, and files

- -   + | User account | Recommended permissions | Apply to | + | - | - | - | + | Creator/Owner | Full control | This folder, subfolders, and files | + | Domain Computers | List folder contents and Read permissions | This folder, subfolders, and files| + | Everyone| No permissions| No permissions| + | Administrators| Full Control| This folder, subfolders, and files| ### Use Windows Server as of Windows Server 2003 to host redirected file shares diff --git a/windows/deploy/deploy-windows-to-go.md b/windows/deploy/deploy-windows-to-go.md index b4e13c5b8c..e657a15b9a 100644 --- a/windows/deploy/deploy-windows-to-go.md +++ b/windows/deploy/deploy-windows-to-go.md @@ -19,156 +19,138 @@ author: mtniehaus This topic helps you to deploy Windows To Go in your organization. Before you begin deployment, make sure that you have reviewed the topics [Windows To Go: feature overview](../plan/windows-to-go-overview.md) and [Prepare your organization for Windows To Go](../plan/prepare-your-organization-for-windows-to-go.md) to ensure that you have the correct hardware and are prepared to complete the deployment. You can then use the steps in this topic to start your Windows To Go deployment. -**Note**   -This topic includes sample Windows PowerShell cmdlets that you can use to automate some of the procedures described. For more information, see [Using Cmdlets](http://go.microsoft.com/fwlink/p/?linkid=230693). - -  +>[!NOTE] +>This topic includes sample Windows PowerShell cmdlets that you can use to automate some of the procedures described. For more information, see [Using Cmdlets](http://go.microsoft.com/fwlink/p/?linkid=230693). ## Deployment tips - The following is a list of items that you should be aware of before you start the deployment process: -- Only use recommended USB drives for Windows To Go. Use of other drives is not supported. Check the list at [Windows To Go: feature overview](../plan/windows-to-go-overview.md) for the latest USB drives certified for use as Windows To Go drives. +* Only use recommended USB drives for Windows To Go. Use of other drives is not supported. Check the list at [Windows To Go: feature overview](../plan/windows-to-go-overview.md) for the latest USB drives certified for use as Windows To Go drives. -- After you provision a new workspace, always eject a Windows To Go drive using the **Safely Remove Hardware and Eject Media** control that can be found in the notification area or in Windows Explorer. Removing the drive from the USB port without ejecting it first can cause the drive to become corrupted. +* After you provision a new workspace, always eject a Windows To Go drive using the **Safely Remove Hardware and Eject Media** control that can be found in the notification area or in Windows Explorer. Removing the drive from the USB port without ejecting it first can cause the drive to become corrupted. -- When running a Windows To Go workspace, always shutdown the workspace before unplugging the drive. +* When running a Windows To Go workspace, always shutdown the workspace before unplugging the drive. -- System Center 2012 Configuration Manager SP1 and later includes support for user self-provisioning of Windows To Go drives. You can download Configuration Manager for evaluation from the [Microsoft TechNet Evaluation Center](http://go.microsoft.com/fwlink/p/?LinkId=618746). For more information on this deployment option, see [How to Provision Windows To Go in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=619148). +* System Center 2012 Configuration Manager SP1 and later includes support for user self-provisioning of Windows To Go drives. You can download Configuration Manager for evaluation from the [Microsoft TechNet Evaluation Center](http://go.microsoft.com/fwlink/p/?LinkId=618746). For more information on this deployment option, see [How to Provision Windows To Go in Configuration Manager](http://go.microsoft.com/fwlink/p/?LinkId=619148). -- If you are planning on using a USB drive duplicator to duplicate Windows To Go drives, do not configure offline domain join or BitLocker on the drive. +* If you are planning on using a USB drive duplicator to duplicate Windows To Go drives, do not configure offline domain join or BitLocker on the drive. ## Basic deployment steps - Unless you are using a customized operating system image, your initial Windows To Go workspace will not be domain joined and will not contain applications. This is exactly like a new installation of Windows on a desktop or laptop computer. When planning your deployment, you should develop methods to join Windows to Go drives to the domain and install the standard applications that users in your organization require. These methods probably will be similar to the ones used for setting up desktop and laptop computers with domain privileges and applications. This section describes the instructions for creating the correct disk layout on the USB drive, applying the operating system image and the core Windows To Go specific configurations to the drive. The following steps are used in both small-scale and large-scale Windows To Go deployment scenarios. Completing these steps will give you a generic Windows To Go drive that can be distributed to your users and then customized for their usage as needed. This drive is also appropriate for use with USB drive duplicators. Your specific deployment scenarios will involve more than just these basic steps but these additional deployment considerations are similar to traditional PC deployment and can be incorporated into your Windows To Go deployment plan. For additional information, see [Windows Deployment Options](http://go.microsoft.com/fwlink/p/?LinkId=619149). -**Warning**   -If you are planning to use the generic Windows To Go drive as the master drive in a USB duplicator, the drive should not be booted. If the drive has been booted inadvertently it should be reprovisioned prior to duplication. - -  +>[!WARNING] +>If you plan to use the generic Windows To Go drive as the master drive in a USB duplicator, the drive should not be booted. If the drive has been booted inadvertently it should be reprovisioned prior to duplication. ### Create the Windows To Go workspace In this step we are creating the operating system image that will be used on the Windows To Go drives. You can use the Windows To Go Creator Wizard or you can [do this manually](http://go.microsoft.com/fwlink/p/?LinkId=619174) using a combination of Windows PowerShell and command-line tools. -**Warning**   -The preferred method for creating a single Windows To Go drive is to use the Windows To Go Creator Wizard included in Windows 10 Enterprise and Windows 10 Education. +>[!WARNING]   +>The preferred method to create a single Windows To Go drive is to use the Windows To Go Creator Wizard included in Windows 10 Enterprise and Windows 10 Education. -  +#### To create a Windows To Go workspace with the Windows To Go Creator Wizard -**To create a Windows To Go workspace with the Windows To Go Creator Wizard** +1. Sign into your Windows PC using an account with Administrator privileges. -1. Sign into your Windows PC using an account with Administrator privileges. +2. Insert the USB drive that you want to use as your Windows To Go drive into your PC. -2. Insert the USB drive that you want to use as your Windows To Go drive into your PC. +3. Verify that the .wim file location (which can be a network share, a DVD , or a USB drive) is accessible and that it contains a valid Windows 10 Enterprise or Windows 10 Education image that has been generalized using sysprep. Many environments can use the same image for both Windows To Go and desktop deployments. -3. Verify that the .wim file location (which can be a network share, a DVD , or a USB drive) is accessible and that it contains a valid Windows 10 Enterprise or Windows 10 Education image that has been generalized using sysprep. Many environments can use the same image for both Windows To Go and desktop deployments. + >[!NOTE]   + >For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=619150). For more information about using sysprep, see [Sysprep Overview](http://go.microsoft.com/fwlink/p/?LinkId=619151). - **Note**   - For more information about .wim files, see [Windows System Image Manager (Windows SIM) Technical Reference](http://go.microsoft.com/fwlink/p/?LinkId=619150). For more information about using sysprep, see [Sysprep Overview](http://go.microsoft.com/fwlink/p/?LinkId=619151). +4. Using Cortana, search for **Windows To Go** and then press **Enter**. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. The **Windows To Go Creator Wizard** opens. -   +5. On the **Choose the drive you want to use** page select the drive that represents the USB drive you inserted previously, then click **Next.** -4. Using Cortana, search for **Windows To Go** and then press **Enter**. If the **User Account Control** dialog box appears, confirm that the action it displays is what you want, and then click **Yes**. The **Windows To Go Creator Wizard** opens. +6. On the **Choose a Windows image** page, click **Add Search Location** and then navigate to the .wim file location and click select folder. The wizard will display the installable images present in the folder; select the Windows 10 Enterprise or Windows 10 Education image you wish to use and then click **Next**. -5. On the **Choose the drive you want to use** page select the drive that represents the USB drive you inserted previously, then click **Next.** +7. (Optional) On the **Set a BitLocker password (optional)** page, you can select **Use BitLocker with my Windows To Go Workspace** to encrypt your Windows To Go drive. If you do not wish to encrypt the drive at this time, click **Skip**. If you decide you want to add BitLocker protection later, see [Enable BitLocker protection for your Windows To Go drive](http://go.microsoft.com/fwlink/p/?LinkId=619152) for instructions. -6. On the **Choose a Windows image** page, click **Add Search Location** and then navigate to the .wim file location and click select folder. The wizard will display the installable images present in the folder; select the Windows 10 Enterprise or Windows 10 Education image you wish to use and then click **Next**. - -7. (Optional) On the **Set a BitLocker password (optional)** page, you can select **Use BitLocker with my Windows To Go Workspace** to encrypt your Windows To Go drive. If you do not wish to encrypt the drive at this time, click **Skip**. If you decide you want to add BitLocker protection later, see [Enable BitLocker protection for your Windows To Go drive](http://go.microsoft.com/fwlink/p/?LinkId=619152) for instructions. - - **Warning**   - If you are planning to use a USB-Duplicator to create multiple Windows To Go drives, do not enable BitLocker. Drives protected with BitLocker should not be duplicated. - -   + >[!WARNING]   + >If you plan to use a USB-Duplicator to create multiple Windows To Go drives, do not enable BitLocker. Drives protected with BitLocker should not be duplicated. If you choose to encrypt the Windows To Go drive now: - - Type a password that is at least eight characters long and conforms to your organizations password complexity policy. This password will be provided before the operating system is started so any characters you use must be able to be interpreted by the firmware. Some firmware does not support non-ASCII characters. + - Type a password that is at least eight characters long and conforms to your organizations password complexity policy. This password will be provided before the operating system is started so any characters you use must be able to be interpreted by the firmware. Some firmware does not support non-ASCII characters. - - Retype the password, and then click Next. + - Retype the password, and then click **Next**. - **Important**   - The BitLocker recovery password will be saved in the documents library of the computer used to create the workspace automatically. If your organization is using Active Directory Domain Services (AD DS) to store recovery passwords it will also be saved in AD DS under the computer account of the computer used to create the workspace. This password will be used only if you need to recover access to the drive because the BitLocker password specified in the previous step is not available, such as if a password is lost or forgotten. For more information about BitLocker and AD DS, see [Active Directory Domain Services considerations](http://go.microsoft.com/fwlink/p/?LinkId=619157). + >[!IMPORTANT]   + >The BitLocker recovery password will be saved in the documents library of the computer used to create the workspace automatically. If your organization is using Active Directory Domain Services (AD DS) to store recovery passwords it will also be saved in AD DS under the computer account of the computer used to create the workspace. This password will be used only if you need to recover access to the drive because the BitLocker password specified in the previous step is not available, such as if a password is lost or forgotten. For more information about BitLocker and AD DS, see [Active Directory Domain Services considerations](http://go.microsoft.com/fwlink/p/?LinkId=619157).   -   +8. Verify that the USB drive inserted is the one you want to provision for Windows To Go and then click **Create** to start the Windows To Go workspace creation process. -8. Verify that the USB drive inserted is the one you want to provision for Windows To Go and then click **Create** to start the Windows To Go workspace creation process. + >[!WARNING]   + >The USB drive identified will be reformatted as part of the Windows To Go provisioning process and any data on the drive will be erased.   - **Warning**   - The USB drive identified will be reformatted as part of the Windows To Go provisioning process and any data on the drive will be erased. - -   - -9. Wait for the creation process to complete, which can take 20 to 30 minutes. A completion page will be displayed that tells you when your Windows To Go workspace is ready to use. From the completion page you can configure the Windows To Go startup options to configure the current computer as a Windows To Go host computer. +9. Wait for the creation process to complete, which can take 20 to 30 minutes. A completion page will be displayed that tells you when your Windows To Go workspace is ready to use. From the completion page you can configure the Windows To Go startup options to configure the current computer as a Windows To Go host computer. Your Windows To Go workspace is now ready to be started. You can now [prepare a host computer](http://go.microsoft.com/fwlink/p/?LinkId=619159) using the Windows To Go startup options and boot your Windows To Go drive. -**Windows PowerShell equivalent commands** +#### Windows PowerShell equivalent commands The following Windows PowerShell cmdlet or cmdlets perform the same function as the preceding procedure. Enter each cmdlet on a single line, even though they may appear word-wrapped across several lines here because of formatting constraints. This procedure can only be used on PCs that are running Windows 10. Before starting, ensure that only the USB drive that you want to provision as a Windows To Go drive is connected to the PC. -1. Using Cortana, search for **powershell**, right-click **Windows PowerShell**, and then select **Run as administrator**. +1. Using Cortana, search for **powershell**, right-click **Windows PowerShell**, and then select **Run as administrator**. -2. In the Windows PowerShell session type the following commands to partition a master boot record (MBR) disk for use with a FAT32 system partition and an NTFS-formatted operating system partition. This disk layout can support computers that use either UEFI or BIOS firmware: +2. In the Windows PowerShell session type the following commands to partition a master boot record (MBR) disk for use with a FAT32 system partition and an NTFS-formatted operating system partition. This disk layout can support computers that use either UEFI or BIOS firmware: ``` syntax -# The following command will set $Disk to all USB drives with >20 GB of storage + # The following command will set $Disk to all USB drives with >20 GB of storage $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } -#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. -# -# To skip the confirmation prompt, append –confirm:$False + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + # + # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData -# This command initializes a new MBR disk + # This command initializes a new MBR disk Initialize-Disk –InputObject $Disk[0] -PartitionStyle MBR -# This command creates a 350 MB system partition + # This command creates a 350 MB system partition $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive -# This formats the volume with a FAT32 Filesystem -# To skip the confirmation dialog, append –Confirm:$False + # This formats the volume with a FAT32 Filesystem + # To skip the confirmation dialog, append –Confirm:$False Format-Volume -NewFileSystemLabel "UFD-System" -FileSystem FAT32 ` -Partition $SystemPartition -# This command creates the Windows volume using the maximum space available on the drive. The Windows To Go drive should not be used for other file storage. + # This command creates the Windows volume using the maximum space available on the drive. The Windows To Go drive should not be used for other file storage. $OSPartition = New-Partition –InputObject $Disk[0] -UseMaximumSize Format-Volume -NewFileSystemLabel "UFD-Windows" -FileSystem NTFS ` -Partition $OSPartition -# This command assigns drive letters to the new drive, the drive letters chosen should not already be in use. + # This command assigns drive letters to the new drive, the drive letters chosen should not already be in use. Set-Partition -InputObject $SystemPartition -NewDriveLetter "S" Set-Partition -InputObject $OSPartition -NewDriveLetter "W" -# This command sets the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer. + # This command sets the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer. Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE ``` -3. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](http://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM): - - **Tip**   - The index number must be set correctly to a valid Enterprise image in the .WIM file. - -   +3. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](http://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM): + >[!TIP]   + >The index number must be set correctly to a valid Enterprise image in the .WIM file. + ``` syntax -#The WIM file must contain a sysprep generalized image. + #The WIM file must contain a sysprep generalized image. dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ ``` -4. Now use the [bcdboot](http://go.microsoft.com/fwlink/p/?LinkId=619163) command line tool to move the necessary boot components to the system partition on the disk. This helps ensure that the boot components, operating system versions, and architectures match. The `/f ALL` parameter indicates that boot components for UEFI and BIOS should be placed on the system partition of the disk. The following example illustrates this step: +4. Now use the [bcdboot](http://go.microsoft.com/fwlink/p/?LinkId=619163) command line tool to move the necessary boot components to the system partition on the disk. This helps ensure that the boot components, operating system versions, and architectures match. The `/f ALL` parameter indicates that boot components for UEFI and BIOS should be placed on the system partition of the disk. The following example illustrates this step: ``` syntax W:\Windows\System32\bcdboot W:\Windows /f ALL /s S: ``` -5. Apply SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: +5. Apply SAN policy—OFFLINE\_INTERNAL - “4” to prevent the operating system from automatically bringing online any internally connected disk. This is done by creating and saving a **san\_policy.xml** file on the disk. The following example illustrates this step: ``` syntax @@ -200,13 +182,13 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as ``` -6. Place the **san\_policy.xml** file created in the previous step into the root directory of the Windows partition on the Windows To Go drive (W: from the previous examples) and run the following command: +6. Place the **san\_policy.xml** file created in the previous step into the root directory of the Windows partition on the Windows To Go drive (W: from the previous examples) and run the following command: ``` syntax Dism.exe /Image:W:\ /Apply-Unattend:W:\san_policy.xml ``` -7. Create an answer file (unattend.xml) that disables the use of Windows Recovery Environment with Windows To Go. You can use the following code sample to create a new answer file or you can paste it into an existing answer file: +7. Create an answer file (unattend.xml) that disables the use of Windows Recovery Environment with Windows To Go. You can use the following code sample to create a new answer file or you can paste it into an existing answer file: ``` syntax @@ -232,38 +214,35 @@ The following Windows PowerShell cmdlet or cmdlets perform the same function as ``` - Once the answer file has been saved, copy unattend.xml into the sysprep folder on the Windows To Go drive (for example, W:\\Windows\\System32\\sysprep\) + After the answer file has been saved, copy unattend.xml into the sysprep folder on the Windows To Go drive (for example, W:\\Windows\\System32\\sysprep\) - **Important**   - Setup unattend files are processed based on their location. Setup will place a temporary unattend file into the **%systemroot%\\panther** folder which is the first location that setup will check for installation information. You should make sure that folder does not contain a previous version of an unattend.xml file to ensure that the one you just created is used. + >[!IMPORTANT]   + >Setup unattend files are processed based on their location. Setup will place a temporary unattend file into the **%systemroot%\\panther** folder which is the first location that setup will check for installation information. You should make sure that folder does not contain a previous version of an unattend.xml file to ensure that the one you just created is used. If you do not wish to boot your Windows To Go device on this computer and want to remove it to boot it on another PC, be sure to use the **Safely Remove Hardware and Eject Media** option to safely disconnect the drive before physically removing it from the PC. -   - Your Windows To Go workspace is now ready to be started. You can now [prepare a host computer](http://go.microsoft.com/fwlink/p/?LinkId=619165) using the Windows To Go startup options to test your workspace configuration, [configure the workspace for offline domain join](http://go.microsoft.com/fwlink/p/?LinkId=619166), or [enable BitLocker protection for your Windows To Go drive](http://go.microsoft.com/fwlink/p/?LinkId=619167). ### To prepare a host computer Computers running Windows 8 and later can be configured as host computers that use Windows To Go automatically whenever a Windows To Go workspace is available at startup. When the Windows To Go startup options are enabled on a host computer, Windows will divert startup to the Windows To Go drive whenever it is attached to the computer. This makes it easy to switch from using the host computer to using the Windows To Go workspace. -**Tip**   -If you will be using a PC running Windows 7 as your host computer, see [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkId=618951) for information to help you prepare the host computer. - -  +>[!TIP]   +>If you will be using a PC running Windows 7 as your host computer, see [Tips for configuring your BIOS settings to work with Windows To Go](http://go.microsoft.com/fwlink/p/?LinkId=618951) for information to help you prepare the host computer. If you want to use the Windows To Go workspace, simply shut down the computer, plug in the Windows To Go drive, and turn on the computer. To use the host computer, shut down the Windows To Go workspace, unplug the Windows To Go drive, and turn on the computer. To set the Windows To Go Startup options for host computers running Windows 10: -1. Using Cortana, search for **Windows To Go startup options** and then press **Enter**. +1. Using Cortana, search for **Windows To Go startup options** and then press **Enter**. -2. In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB +2. In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB For host computers running Windows 8 or Windows 8.1: -1. Press **Windows logo key+W**, search for **Windows To Go startup options**, and then press **Enter**. -2. In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB. +1. Press **Windows logo key+W**, search for **Windows To Go startup options**, and then press **Enter**. + +2. In the **Windows To Go Startup Options** dialog box, select **Yes**, and then click **Save Changes** to configure the computer to boot from USB. You can configure your organization's computers to automatically start from the USB drive by enabling the following Group Policy setting: @@ -306,70 +285,66 @@ Making sure that Windows To Go workspaces are effective when used off premises i **To configure your Windows To Go workspace for remote access** -1. Start the host computer and sign in using a user account with privileges to add workstations to the domain and then run the following command from an elevated command prompt replacing the example placeholder parameters (denoted by <>) with the ones applicable for your environment: +1. Start the host computer and sign in using a user account with privileges to add workstations to the domain and then run the following command from an elevated command prompt replacing the example placeholder parameters (denoted by <>) with the ones applicable for your environment: ``` syntax djoin /provision /domain /machine /certtemplate /policynames /savefile /reuse ``` - **Note**   - The /certtemplate parameter supports the use of certificate templates for distributing certificates for DirectAccess, if your organization is not using certificate templates you can omit this parameter. Additionally, if are using djoin.exe with Windows Server 2008-based Domain Controllers, append the /downlevel switch during provisioning. For more information see the [Offline Domain Join Step-by-Step guide](http://go.microsoft.com/fwlink/p/?LinkId=619171). + >[!NOTE]   + >The **/certtemplate** parameter supports the use of certificate templates for distributing certificates for DirectAccess, if your organization is not using certificate templates you can omit this parameter. Additionally, if are using djoin.exe with Windows Server 2008-based Domain Controllers, append the /downlevel switch during provisioning. For more information see the [Offline Domain Join Step-by-Step guide](http://go.microsoft.com/fwlink/p/?LinkId=619171). -   +2. Insert the Windows To Go drive. -2. Insert the Windows To Go drive. +3. Launch an elevated Windows PowerShell prompt by right-clicking the Windows PowerShell shortcut in the taskbar, and then clicking **Run as Administrator**. -3. Launch an elevated Windows PowerShell prompt by right-clicking the Windows PowerShell shortcut in the taskbar, and then clicking **Run as Administrator**. - -4. From the Windows PowerShell command prompt run: +4. From the Windows PowerShell command prompt run: ``` syntax -# The following command will set $Disk to all USB drives with >20 GB of storage + # The following command will set $Disk to all USB drives with >20 GB of storage $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } -#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. -# -# To skip the confirmation prompt, append –confirm:$False + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + # + # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData -# This command initializes a new MBR disk + # This command initializes a new MBR disk Initialize-Disk –InputObject $Disk[0] -PartitionStyle MBR -# This command creates a 350 MB system partition + # This command creates a 350 MB system partition $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive -# This formats the volume with a FAT32 Filesystem -# To skip the confirmation dialog, append –Confirm:$False + # This formats the volume with a FAT32 Filesystem + # To skip the confirmation dialog, append –Confirm:$False Format-Volume -NewFileSystemLabel "UFD-System" -FileSystem FAT32 ` -Partition $SystemPartition -# This command creates the Windows volume using the maximum space available on the drive. The Windows To Go drive should not be used for other file storage. + # This command creates the Windows volume using the maximum space available on the drive. The Windows To Go drive should not be used for other file storage. $OSPartition = New-Partition –InputObject $Disk[0] -UseMaximumSize Format-Volume -NewFileSystemLabel "UFD-Windows" -FileSystem NTFS ` -Partition $OSPartition -# This command assigns drive letters to the new drive, the drive letters chosen should not already be in use. + # This command assigns drive letters to the new drive, the drive letters chosen should not already be in use. Set-Partition -InputObject $SystemPartition -NewDriveLetter "S" Set-Partition -InputObject $OSPartition -NewDriveLetter "W" -# This command toggles the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer. + # This command toggles the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer. Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE ``` -5. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](http://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM): - - **Tip**   - The index number must be set correctly to a valid Enterprise image in the .WIM file. - -   +5. Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](http://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM): + >[!TIP]   + >The index number must be set correctly to a valid Enterprise image in the .WIM file. + ``` syntax -#The WIM file must contain a sysprep generalized image. + #The WIM file must contain a sysprep generalized image. dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ ``` -6. Once those commands have completed, run the following command: +6. After those commands have completed, run the following command: ``` syntax djoin /requestodj /loadfile C:\example\path\domainmetadatafile /windowspath W:\Windows @@ -415,14 +390,12 @@ Making sure that Windows To Go workspaces are effective when used off premises i 9. From a host computer, either on or off premises, start the computer and boot the Windows To Go workspace. - 1. If on premises using a host computer with a direct network connection, sign on using your domain credentials. + * If on premises using a host computer with a direct network connection, sign on using your domain credentials. - 2. If off premises, join a wired or wireless network with internet access and then sign on again using your domain credentials. + * If off premises, join a wired or wireless network with internet access and then sign on again using your domain credentials. - **Note**   - Depending on your DirectAccess configuration you might be asked to insert your smart card to logon to the domain. - -   + >[!NOTE]   + >Depending on your DirectAccess configuration you might be asked to insert your smart card to log on to the domain. You should now be able to access your organization’s network resources and work from your Windows To Go workspace as you would normally work from your standard desktop computer on premises. @@ -430,13 +403,13 @@ You should now be able to access your organization’s network resources and wor Enabling BitLocker on your Windows To Go drive will help ensure that your data is protected from unauthorized use and that if your Windows To Go drive is lost or stolen it will not be easy for an unauthorized person to obtain confidential data or use the workspace to gain access to protected resources in your organization. When BitLocker is enabled, each time you boot your Windows To Go drive, you will be asked to provide the BitLocker password to unlock the drive. The following procedure provides the steps for enabling BitLocker on your Windows To Go drive: -**Prerequisites for enabling BitLocker scenario** +#### Prerequisites for enabling BitLocker scenario -- A Windows To Go drive that can be successfully provisioned. +* A Windows To Go drive that can be successfully provisioned. -- A computer running Windows 8 configured as a Windows To Go host computer +* A computer running Windows 8 configured as a Windows To Go host computer -- Review the following Group Policy settings for BitLocker Drive Encryption and modify the configuration as necessary: +* Review the following Group Policy settings for BitLocker Drive Encryption and modify the configuration as necessary: **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Require additional authentication at startup**. This policy allows the use of a password key protector with an operating system drive; this policy must be enabled to configure BitLocker from within the Windows To Go workspace. This policy setting allows you to configure whether BitLocker requires additional authentication each time the computer starts and whether you are using BitLocker with or without a Trusted Platform Module (TPM). You must enable this setting and select the **Allow BitLocker without a compatible TPM** check box and then enable the **Configure use of passwords for operating system drives** setting. @@ -450,7 +423,7 @@ Enabling BitLocker during provisioning ensures that your operating system image Enabling BitLocker after distribution requires that your users turn on BitLocker. This means that your Windows To Go workspaces are unprotected until the user enables BitLocker. Administrative rights on the Windows To Go workspace are required to enable BitLocker. For more information about BitLocker see the [BitLocker Overview](http://go.microsoft.com/fwlink/p/?LinkId=619173). -**BitLocker recovery keys** +#### BitLocker recovery keys BitLocker recovery keys are the keys that can be used to unlock a BitLocker protected drive if the standard unlock method fails. It is recommended that your BitLocker recovery keys be backed up to Active Directory Domain Services (AD DS). If you do not want to use AD DS to store recovery keys you can save recovery keys to a file or print them. How BitLocker recovery keys are managed differs depending on when BitLocker is enabled. @@ -459,134 +432,122 @@ BitLocker recovery keys are the keys that can be used to unlock a BitLocker prot - **Warning**   If BitLocker is enabled after distribution, the recovery key will be backed up to AD DS under the computer account of the workspace. If backing up recovery keys to AD DS is not used, they can be printed or saved to a file by the user. If the IT administrator wants a central record of recovery keys, a process by which the user provides the key to the IT department must be put in place. -   +#### To enable BitLocker during provisioning -**To enable BitLocker during provisioning** +1. Start the host computer that is running Windows 8. -1. Start the host computer that is running Windows 8. +2. Insert your Windows To Go drive. -2. Insert your Windows To Go drive. +3. Launch an elevated Windows PowerShell prompt by right-clicking the Windows PowerShell shortcut in the taskbar, and then clicking **Run as Administrator**. -3. Launch an elevated Windows PowerShell prompt by right-clicking the Windows PowerShell shortcut in the taskbar, and then clicking **Run as Administrator**. +4. Provision the Windows To Go drive using the following cmdlets: -4. Provision the Windows To Go drive using the following cmdlets: + >[!NOTE]   + >If you used the [manual method for creating a workspace](http://go.microsoft.com/fwlink/p/?LinkId=619174) you should have already provisioned the Windows To Go drive. If so, you can continue on to the next step. - **Note**   - If you used the [manual method for creating a workspace](http://go.microsoft.com/fwlink/p/?LinkId=619174) you should have already provisioned the Windows To Go drive. If so, you can continue on to the next step. - -   - - ``` syntax -# The following command will set $Disk to all USB drives with >20 GB of storage + ``` syntax + # The following command will set $Disk to all USB drives with >20 GB of storage $Disk = Get-Disk | Where-Object {$_.Path -match "USBSTOR" -and $_.Size -gt 20Gb -and -not $_.IsBoot } -#Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. -# -# To skip the confirmation prompt, append –confirm:$False + #Clear the disk. This will delete any data on the disk. (and will fail if the disk is not yet initialized. If that happens, simply continue with ‘New-Partition…) Validate that this is the correct disk that you want to completely erase. + # + # To skip the confirmation prompt, append –confirm:$False Clear-Disk –InputObject $Disk[0] -RemoveData -# This command initializes a new MBR disk + # This command initializes a new MBR disk Initialize-Disk –InputObject $Disk[0] -PartitionStyle MBR -# This command creates a 350 MB system partition + # This command creates a 350 MB system partition $SystemPartition = New-Partition –InputObject $Disk[0] -Size (350MB) -IsActive -# This formats the volume with a FAT32 Filesystem -# To skip the confirmation dialog, append –Confirm:$False + # This formats the volume with a FAT32 Filesystem + # To skip the confirmation dialog, append –Confirm:$False Format-Volume -NewFileSystemLabel "UFD-System" -FileSystem FAT32 ` -Partition $SystemPartition -# This command creates the Windows volume using the maximum space available on the drive. The Windows To Go drive should not be used for other file storage. + # This command creates the Windows volume using the maximum space available on the drive. The Windows To Go drive should not be used for other file storage. $OSPartition = New-Partition –InputObject $Disk[0] -UseMaximumSize Format-Volume -NewFileSystemLabel "UFD-Windows" -FileSystem NTFS ` -Partition $OSPartition -# This command assigns drive letters to the new drive, the drive letters chosen should not already be in use. + # This command assigns drive letters to the new drive, the drive letters chosen should not already be in use. Set-Partition -InputObject $SystemPartition -NewDriveLetter "S" Set-Partition -InputObject $OSPartition -NewDriveLetter "W" -# This command toggles the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer. + # This command toggles the NODEFAULTDRIVELETTER flag on the partition which prevents drive letters being assigned to either partition when inserted into a different computer. Set-Partition -InputObject $OSPartition -NoDefaultDriveLetter $TRUE ``` + + Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](http://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM): + + >[!TIP]   + >The index number must be set correctly to a valid Enterprise image in the .WIM file. + + ``` syntax + #The WIM file must contain a sysprep generalized image. + dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ + ``` - Next you need to apply the operating system image that you want to use with Windows To Go to the operating system partition you just created on the disk (this may take 30 minutes or longer, depending on the size of the image and the speed of your USB connection). The following command shows how this can be accomplished using the [Deployment Image Servicing and Management](http://go.microsoft.com/fwlink/p/?LinkId=619161) command-line tool (DISM): +5. In the same PowerShell session use the following cmdlet to add a recovery key to the drive: - **Tip**   - The index number must be set correctly to a valid Enterprise image in the .WIM file. + ``` syntax + $BitlockerRecoveryProtector = Add-BitLockerKeyProtector W: -RecoveryPasswordProtector + ``` -   +6. Next, use the following cmdlets to save the recovery key to a file: - ``` syntax -#The WIM file must contain a sysprep generalized image. - dism /apply-image /imagefile:n:\imagefolder\deploymentimages\mywtgimage.wim /index:1 /applydir:W:\ - ``` + ``` syntax + #The BitLocker Recovery key is essential if for some reason you forget the BitLocker password + #This recovery key can also be backed up into Active Directory using manage-bde.exe or the + #PowerShell cmdlet Backup-BitLockerKeyProtector. + $RecoveryPassword = $BitlockerRecoveryProtector.KeyProtector.RecoveryPassword + $RecoveryPassword > WTG-Demo_Bitlocker_Recovery_Password.txt + ``` -5. In the same PowerShell session use the following cmdlet to add a recovery key to the drive: +7. Then, use the following cmdlets to add the password as a secure string. If you omit the password the cmdlet will prompt you for the password before continuing the operation: - ``` syntax - $BitlockerRecoveryProtector = Add-BitLockerKeyProtector W: -RecoveryPasswordProtector - ``` + ``` syntax + # Create a variable to store the password + $spwd = ConvertTo-SecureString -String -AsplainText –Force + Enable-BitLocker W: -PasswordProtector $spwd + ``` + + >[!WARNING]   + >To have BitLocker only encrypt used space on the disk append the parameter `–UsedSpaceOnly` to the `Enable-BitLocker` cmdlet. As data is added to the drive BitLocker will encrypt additional space. Using this parameter will speed up the preparation process as a smaller percentage of the disk will require encryption. If you are in a time critical situation where you cannot wait for encryption to complete you can also safely remove the Windows To Go drive during the encryption process. The next time the drive is inserted in a computer it will request the BitLocker password. Once the password is supplied, the encryption process will continue. If you do this, make sure your users know that BitLocker encryption is still in process and that they will be able to use the workspace while the encryption completes in the background. -6. Next, use the following cmdlets to save the recovery key to a file: +8. Copy the numerical recovery password and save it to a file in a safe location. The recovery password will be required if the password is lost or forgotten. - ``` syntax -#The BitLocker Recovery key is essential if for some reason you forget the BitLocker password -#This recovery key can also be backed up into Active Directory using manage-bde.exe or the -#PowerShell cmdlet Backup-BitLockerKeyProtector. - $RecoveryPassword = $BitlockerRecoveryProtector.KeyProtector.RecoveryPassword - $RecoveryPassword > WTG-Demo_Bitlocker_Recovery_Password.txt - ``` + >[!WARNING]   + >If the **Choose how BitLocker-protected removable data drives can be recovered** Group Policy setting has been configured to back up recovery information to Active Directory Domain Services, the recovery information for the drive will be stored under the account of the host computer used to apply the recovery key. + + If you want to have the recovery information stored under the account of the Windows To Go workspace you can turn BitLocker from within the Windows To Go workspace using the BitLocker Setup Wizard from the BitLocker Control Panel item as described in [To enable BitLocker after distribution](#enable-bitlocker).  -7. Then, use the following cmdlets to add the password as a secure string. If you omit the password the cmdlet will prompt you for the password before continuing the operation: - - ``` syntax -# Create a variable to store the password - $spwd = ConvertTo-SecureString -String -AsplainText –Force - Enable-BitLocker W: -PasswordProtector $spwd - ``` - - **Warning**   - To have BitLocker only encrypt used space on the disk append the parameter `–UsedSpaceOnly` to the `Enable-BitLocker` cmdlet. As data is added to the drive BitLocker will encrypt additional space. Using this parameter will speed up the preparation process as a smaller percentage of the disk will require encryption. If you are in a time critical situation where you cannot wait for encryption to complete you can also safely remove the Windows To Go drive during the encryption process. The next time the drive is inserted in a computer it will request the BitLocker password. Once the password is supplied, the encryption process will continue. If you do this, make sure your users know that BitLocker encryption is still in process and that they will be able to use the workspace while the encryption completes in the background. - -   - -8. Copy the numerical recovery password and save it to a file in a safe location. The recovery password will be required if the password is lost or forgotten. - - **Warning**   - If the **Choose how BitLocker-protected removable data drives can be recovered** Group Policy setting has been configured to back up recovery information to Active Directory Domain Services, the recovery information for the drive will be stored under the account of the host computer used to apply the recovery key. - - If you want to have the recovery information stored under the account of the Windows To Go workspace you can turn BitLocker from within the Windows To Go workspace using the BitLocker Setup Wizard from the BitLocker Control Panel item as described in [To enable BitLocker after distribution](#enable-bitlocker). - -   - -9. Safely remove the Windows To Go drive. +9. Safely remove the Windows To Go drive. The Windows To Go drives are now ready to be distributed to users and are protected by BitLocker. When you distribute the drives, make sure the users know the following: -- Initial BitLocker password that they will need to boot the drives. +* Initial BitLocker password that they will need to boot the drives. -- Current encryption status. +* Current encryption status. -- Instructions to change the BitLocker password after the initial boot. +* Instructions to change the BitLocker password after the initial boot. -- Instructions for how to retrieve the recovery password if necessary. This may be a help desk process, an automated password retrieval site, or a person to contact. +* Instructions for how to retrieve the recovery password if necessary. This may be a help desk process, an automated password retrieval site, or a person to contact. -**To enable BitLocker after distribution** +#### To enable BitLocker after distribution -1. Insert your Windows To Go drive into your host computer (that is currently shut down) and then turn on the computer and boot into your Windows To Go workspace +1. Insert your Windows To Go drive into your host computer (that is currently shut down) and then turn on the computer and boot into your Windows To Go workspace -2. Press **Windows logo key+W** to open **Search Settings**, type BitLocker and then select the item for BitLocker Drive Encryption. +2. Press **Windows logo key+W** to open **Search Settings**, type BitLocker and then select the item for BitLocker Drive Encryption. -3. The drives on the workspace are displayed, click **Turn BitLocker On** for the C: drive. The **BitLocker Setup Wizard** appears. +3. The drives on the workspace are displayed, click **Turn BitLocker On** for the C: drive. The **BitLocker Setup Wizard** appears. -4. Complete the steps in the **BitLocker Setup Wizard** selecting the password protection option. +4. Complete the steps in the **BitLocker Setup Wizard** selecting the password protection option. -**Note**   -If you have not configured the Group Policy setting **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Require additional authentication at startup** to specify **Allow BitLocker without a compatible TPM** you will not be able to enable BitLocker from within the Windows To Go workspace. - -  +>[!NOTE]   +>If you have not configured the Group Policy setting **\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives\\Require additional authentication at startup** to specify **Allow BitLocker without a compatible TPM** you will not be able to enable BitLocker from within the Windows To Go workspace. ### Advanced deployment sample script @@ -594,21 +555,21 @@ The following sample script supports the provisioning of multiple Windows To Go The sample script creates an unattend file that streamlines the deployment process so that the initial use of the Windows To Go drive does not prompt the end user for any additional configuration information before starting up. -**Prerequisites for running the advanced deployment sample script** +#### Prerequisites for running the advanced deployment sample script -- To run this sample script you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. +* To run this sample script you must open a Windows PowerShell session as an administrator from a domain-joined computer using an account that has permission to create domain accounts. -- Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put “Domain admins” into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. +* Using offline domain join is required by this script, since the script does not create a local administrator user account. However, domain membership will automatically put “Domain admins” into the local administrators group. Review your domain policies. If you are using DirectAccess you will need to modify the djoin.exe command to include the `policynames` and potentially the `certtemplate` parameters. -- The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. +* The script needs to use drive letters, so you can only provision half as many drives as you have free drive letters. -**To run the advanced deployment sample script** +#### To run the advanced deployment sample script -1. Copy entire the code sample titled “Windows To Go multiple drive provisioning sample script” into a PowerShell script (.ps1) file. +1. Copy entire the code sample titled “Windows To Go multiple drive provisioning sample script” into a PowerShell script (.ps1) file. -2. Make the modifications necessary for it to be appropriate to your deployment and save the file. +2. Make the modifications necessary for it to be appropriate to your deployment and save the file. -3. Configure the PowerShell execution policy. By default PowerShell’s execution policy is set to Restricted; that means that scripts won’t run until you have explicitly given them permission to. To configure PowerShell’s execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: +3. Configure the PowerShell execution policy. By default PowerShell’s execution policy is set to Restricted; that means that scripts won’t run until you have explicitly given them permission to. To configure PowerShell’s execution policy to allow the script to run, use the following command from an elevated PowerShell prompt: ``` syntax Set-ExecutionPolicy RemoteSigned @@ -616,16 +577,14 @@ The sample script creates an unattend file that streamlines the deployment proce The RemoteSigned execution policy will prevent unsigned scripts from the internet from running on the computer, but will allow locally created scripts to run. For more information on execution policies, see [Set-ExecutionPolicy](http://go.microsoft.com/fwlink/p/?LinkId=619175). - **Tip**   - To get online help for any Windows PowerShell cmdlet, whether or not it is installed locally type the following cmdlet, replacing <cmdlet-name> with the name of the cmdlet you want to see the help for: + >[!TIP]   + >To get online help for any Windows PowerShell cmdlet, whether or not it is installed locally type the following cmdlet, replacing <cmdlet-name> with the name of the cmdlet you want to see the help for: + + >`Get-Help -Online` + + >This command causes Windows PowerShell to open the online version of the help topic in your default Internet browser. - `Get-Help -Online` - - This command causes Windows PowerShell to open the online version of the help topic in your default Internet browser. - -   - -**Windows To Go multiple drive provisioning sample script** +#### Windows To Go multiple drive provisioning sample script ``` syntax <# diff --git a/windows/keep-secure/credential-guard.md b/windows/keep-secure/credential-guard.md index dda79a977f..f2ae8518de 100644 --- a/windows/keep-secure/credential-guard.md +++ b/windows/keep-secure/credential-guard.md @@ -15,7 +15,7 @@ author: brianlic-msft - Windows 10 - Windows Server 2016 -Introduced in Windows 10 Enterprise, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. +Introduced in Windows 10 Enterprise and Windows Server 2016, Credential Guard uses virtualization-based security to isolate secrets so that only privileged system software can access them. Unauthorized access to these secrets can lead to credential theft attacks, such as Pass-the-Hash or Pass-The-Ticket. Credential Guard prevents these attacks by protecting NTLM password hashes and Kerberos Ticket Granting Tickets. Credential Guard offers the following features and solutions: @@ -91,7 +91,7 @@ The PC must meet the following hardware and software requirements to use Credent TPM 2.0 -Windows 10 version 1511 or later +Windows 10 version 1511, Windows Server 2016, or later TPM 2.0 or TPM 1.2 @@ -114,7 +114,7 @@ The PC must meet the following hardware and software requirements to use Credent

Virtual machine

-

For PCs running Windows 10, version 1607, you can run Credential Guard on a Generation 2 virtual machine.

+

For PCs running Windows 10, version 1607 or Windows Server 2016, you can run Credential Guard on a Generation 2 virtual machine.

@@ -169,7 +169,7 @@ First, you must add the virtualization-based security features. You can do this > You can also add these features to an online image by using either DISM or Configuration Manager. -In Windows 10, version 1607, Isolated User Mode is included with Hyper-V and does not need to be installed separately. If you're running a version of Windows 10 that's earlier than Windows 10, version 1607, you can run the following command to install Isolated User Mode: +In Windows 10, version 1607 and Windows Server 2016, Isolated User Mode is included with Hyper-V and does not need to be installed separately. If you're running a version of Windows 10 that's earlier than Windows 10, version 1607, you can run the following command to install Isolated User Mode: ``` syntax dism /image: /Enable-Feature /FeatureName:IsolatedUserMode diff --git a/windows/keep-secure/images/security-fig2-vbsarchitecture-redo.png b/windows/keep-secure/images/security-fig2-vbsarchitecture-redo.png new file mode 100644 index 0000000000..6bcddd364a Binary files /dev/null and b/windows/keep-secure/images/security-fig2-vbsarchitecture-redo.png differ diff --git a/windows/keep-secure/windows-10-security-guide.md b/windows/keep-secure/windows-10-security-guide.md index 87cd7086c5..82d0f23f5c 100644 --- a/windows/keep-secure/windows-10-security-guide.md +++ b/windows/keep-secure/windows-10-security-guide.md @@ -18,14 +18,14 @@ author: challum This guide provides a detailed description of the most important security improvements in the Windows 10 operating system, with links to more detailed articles about many of its security features. Wherever possible, specific recommendations are provided to help you implement and configure Windows 10 security features. -## Introduction +#### Introduction Windows 10 is designed to protect against known and emerging security threats across the spectrum of attack vectors. Three broad categories of security work went into Windows 10: - [**Identity and access control**](#identity) features have been greatly expanded to both simplify and enhance the security of user authentication. These features include Windows Hello and Microsoft Passport, which better protect user identities through easy-to-deploy and easy-to-use multifactor authentication (MFA). Another new feature is Credential Guard, which uses virtualization-based security (VBS) to help protect the Windows authentication subsystems and users’ credentials. - [**Information protection**](#information) that guards information at rest, in use, and in transit. In addition to BitLocker and BitLocker To Go for protection of data at rest, Windows 10 includes file-level encryption with Enterprise Data Protection that performs data separation and containment and, when combined with Rights Management services, can keep data encrypted when it leaves the corporate network. Windows 10 can also help keep data secure by using virtual private networks (VPNs) and Internet Protocol Security. - [**Malware resistance**](#malware) includes architectural changes that can isolate critical system and security components from threats. Several new features in Windows 10 help reduce the threat of malware, including VBS, Device Guard, Microsoft Edge, and an entirely new version of Windows Defender. In addition, the many antimalware features from the Windows 8.1 operating system— including AppContainers for application sandboxing and numerous boot-protection features, such as Trusted Boot—have been carried forward and improved in Windows 10. -## Identity and access control +## Identity and access control Traditionally, access control is a process that has three components: - **Identification** - when a user asserts a unique identity to the computer system for the purpose of gaining access to a resource, such as a file or a printer. In some definitions, the user is called the subject and the resource is the object. @@ -74,14 +74,14 @@ Table 1. Windows 10 solutions to typical access control challenges   The sections that follow describe these challenges and solutions in more detail. -**Microsoft Passport** +### Microsoft Passport Microsoft Passport provides strong two-factor authentication (2FA), fully integrated into Windows, and replaces passwords with the combination of an enrolled device and either a PIN or Windows Hello. Microsoft Passport is conceptually similar to smart cards but more flexible. Authentication is performed by using an asymmetric key pair instead of a string comparison (for example, password), and the user’s key material can be secured by using hardware. Unlike smart cards, Microsoft Passport does not require the extra infrastructure components required for smart card deployment. In particular, you do not need public key infrastructure (PKI). If you already use PKI – for example, in secure email or VPN authentication – you can use the existing infrastructure with Microsoft Passport. Microsoft Passport combines the major advantages of smart card technology – deployment flexibility for virtual smart cards and robust security for physical smart cards – without any of their drawbacks. Microsoft Passport offers three significant advantages over the current state of Windows authentication: It’s more flexible, it’s based on industry standards, and it effectively mitigates risks. The sections that follow look at each of these advantages in more detail. -**It’s flexible** +#### It’s flexible Microsoft Passport offers unprecedented flexibility. Although the format and use of passwords and smart cards is fixed, Microsoft Passport gives both administrators and users options to manage authentication. First and foremost, Microsoft Passport works with biometric sensors and PINs. Next, you can use your PC or even your phone as one of the factors to authenticate on your PC. Finally, your user credentials can come from your PKI infrastructure, or Windows can create the credential itself. @@ -89,21 +89,19 @@ Microsoft Passport gives you options beyond long, complex passwords. Instead of With Microsoft Passport, you gain flexibility in the data center, too. To deploy it, you must add Windows Server 2016 domain controllers to your Active Directory environment, but you do not have to replace or remove your existing Active Directory servers: Microsoft Passport builds on and adds to your existing infrastructure. You can either add on premises servers or use Microsoft Azure Active Directory to deploy Microsoft Passport to your network. The choice of which users to enable for Microsoft Passport use is completely up to you – you choose which items to protect and which authentication factors you want to support. This flexibility makes it easy to use Microsoft Passport to supplement existing smart card or token deployments by adding 2FA to users who do not currently have it, or to deploy Microsoft Passport in scenarios that call for extra protection for sensitive resources or systems. -**It’s standardized** +#### It’s standardized Both software vendors and enterprise customers have come to realize that proprietary identity and authentication systems are a dead end: The future lies with open, interoperable systems that allow secure authentication across a variety of devices, line of business (LOB) apps, and external applications and websites. To this end, a group of industry players formed FIDO, the Fast IDentity Online Alliance. The FIDO Alliance is a nonprofit organization intended to address the lack of interoperability among strong authentication devices, as well as the problems users face when they need to create and remember multiple user names and passwords. The FIDO Alliance plans to change the nature of authentication by developing specifications that define an open, scalable, interoperable set of mechanisms that supplant reliance on passwords to securely authenticate users of online services. This new standard for security devices and browser plug ins will allow any website or cloud application to interface with a broad variety of existing and future FIDO-enabled devices that the user has for online security. In 2014, Microsoft joined the board of the [FIDO Alliance](http://go.microsoft.com/fwlink/p/?LinkId=626934). FIDO standards enable a universal framework that a global ecosystem delivers for a consistent and greatly improved user experience of strong password-less authentication. The FIDO 1.0 specifications, published in December 2014, provide for two types of authentications: password-less (known as UAF) and second factor (U2F). The FIDO Alliance is working on a set of 2.0 proposals that incorporate the best ideas from its U2F and UAF FIDO 1.0 standards, and of course, on new ideas. Microsoft has contributed Microsoft Passport technology to the FIDO 2.0 specification workgroup for review and feedback and continues to work with the FIDO Alliance as the FIDO 2.0 specification moves forward. Interoperability of FIDO products is a hallmark of FIDO authentication. Microsoft believes that bringing a FIDO solution to market will help solve a critical need for enterprises and consumers alike. -**It’s effective** +#### It’s effective Microsoft Passport effectively mitigates two major security risks. First, it eliminates the use of passwords for logon and so reduces the risk that a nefarious attacker will steal and reuse the user’s credentials. User key material is generated and available within the Trusted Platform Module (TPM) of the user device, which protects it from attackers who want to capture the key material and reuse it. Second, because Microsoft Passport uses asymmetrical key pairs, users credentials can’t be stolen in cases where the identity provider or websites the user accesses have been compromised. To compromise a Microsoft Passport credential that TPM protects, an attacker must have access to the physical device, and then must find a way to spoof the user’s biometrics or guess his or her PIN—and all of this must be done before TPM anti-hammer capabilities lock the device. This sets the bar magnitudes of order higher than password phishing attacks. -### - -**Windows Hello** +### Windows Hello Windows Hello is the name given to the new biometric sign-in option for Microsoft Passport. Because biometric authentication is built directly into the operating system, Windows Hello allows users to unlock their devices by using their face or fingerprint. From here, authentication to the devices and resources is enabled through a combination of the user’s unique biometric identifier and the device itself. @@ -117,7 +115,7 @@ Windows Hello supports two biometric sensor options that are suitable for enterp Windows Hello offers several major benefits. First, it addresses the problems of credential theft and sharing, because an attacker must obtain the device and impersonate the user’s biometric identity, which is more difficult than stealing a password or PIN. Second, the use of biometrics gives users an authenticator that’s always with them – there’s nothing to forget, lose, or leave behind. Instead of worrying about memorizing long, complex passwords, users can take advantage of a convenient, secure method for logging in to all their Windows devices. Finally, there’s nothing additional to deploy or manage. Because Windows Hello support is built directly into the operating system, there are no additional drivers to deploy. -**Brute-force attack resistance** +### Brute-force attack resistance A brute-force attack is the process used to break into a device simply by guessing a user’s password, PIN, or even his or her biometric identity over and over until the attacker gets it right. Over the last several versions of Windows, Microsoft has added features that dramatically reduce the chances that such an attack would succeed. @@ -126,7 +124,7 @@ Windows 8.1 and Windows 10 support an even more powerful – but optional – If you’re interested in learning how to configure brute-force protection, use a test Windows 10 PC on which BitLocker protection is enabled for the system drive, and then print the BitLocker recovery key to ensure that you have it available. Then, open the Local Group Policy Editor by running **gpedit.msc**, and go to Computer Configuration\\Windows Settings\\Security Settings\\Security Options. Open the policy **Interactive Login: Machine Account Lockout Threshold**, and set the value to **5**, as shown in Figure 1. -![figure 1](images/security-fig1-invalidaccess.png) +![Machine lockout threshold](images/security-fig1-invalidaccess.png "Machine lockout threshold") Figure 1. Set the number of invalid access attempts prior to lockout @@ -188,90 +186,102 @@ Table 2. Data Protection in Windows 10 and Windows 7 -  + The sections that follow describe these improvements in more detail. -**Prepare for drive and file encryption** +### Prepare for drive and file encryption The best type of security measures are transparent to the user during implementation and use. Every time there is a possible delay or difficulty because of a security feature, there is strong likelihood that users will try to bypass security. This situation is especially true for data protection, and that’s a scenario that organizations need to avoid. Whether you’re planning to encrypt entire volumes, removable devices, or individual files, Windows 10 meets your needs by providing streamlined, usable solutions. In fact, you can take several steps in advance to prepare for data encryption and make the deployment quick and smooth. -**TPM pre-provisioning** +#### TPM pre-provisioning In Windows 7, preparing the TPM for use offered a couple of challenges: -- You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. -- When you enable the TPM, it may require one or more restarts. + +* You can turn on the TPM in the BIOS, which requires someone to either go into the BIOS settings to turn it on or to install a driver to turn it on from within Windows. +* When you enable the TPM, it may require one or more restarts. + Basically, it was a big hassle. If IT staff were provisioning new PCs, they could handle all of this, but if you wanted to add BitLocker to devices that were already in users’ hands, those users would have struggled with the technical challenges and would either call IT for support or simply leave BitLocker disabled. + Microsoft includes instrumentation in Windows 10 that enables the operating system to fully manage the TPM. There is no need to go into the BIOS, and all scenarios that required a restart have been eliminated. -**Deploy hard drive encryption** +### Deploy hard drive encryption BitLocker is capable of encrypting entire hard drives, including both system and data drives. BitLocker pre-provisioning can drastically reduce the time required to provision new PCs with BitLocker enabled. With Windows 10, administrators can turn on BitLocker and the TPM from within the Windows Preinstallation Environment before they install Windows or as part of an automated deployment task sequence without any user interaction. Combined with Used Disk Space Only encryption and a mostly empty drive (because Windows is not yet installed), it takes only a few seconds to enable BitLocker. With earlier versions of Windows, administrators had to enable BitLocker after Windows had been installed. Although this process could be automated, BitLocker would need to encrypt the entire drive, a process that could take anywhere from several hours to more than a day depending on drive size and performance, which significantly delayed deployment. Microsoft has improved this process through multiple features in Windows 10. -**Device encryption** +#### Device encryption Beginning in Windows 8.1, Windows automatically enables BitLocker device encryption on devices that support InstantGo. With Windows 10, Microsoft offers device encryption support on a much broader range of devices, including those that are InstantGo. Microsoft expects that most devices in the future will pass the testing requirements, which makes device encryption pervasive across modern Windows devices. Device encryption further protects the system by transparently implementing device-wide data encryption. Unlike a standard BitLocker implementation, device encryption is enabled automatically so that the device is always protected. The following list outlines how this happens: -- When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). -- If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. -- If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. -- Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. + +* When a clean installation of Windows 10 is completed and the out-of-box experience is finished, the computer is prepared for first use. As part of this preparation, device encryption is initialized on the operating system drive and fixed data drives on the computer with a clear key (this is the equivalent of standard BitLocker suspended state). +* If the device is not domain joined, a Microsoft account that has been granted administrative privileges on the device is required. When the administrator uses a Microsoft account to sign in, the clear key is removed, a recovery key is uploaded to the online Microsoft account, and a TPM protector is created. Should a device require the recovery key, the user will be guided to use an alternate device and navigate to a recovery key access URL to retrieve the recovery key by using his or her Microsoft account credentials. +* If the user uses a domain account to sign in, the clear key is not removed until the user joins the device to a domain and the recovery key is successfully backed up to Active Directory Domain Services (AD DS). You must enable the **Computer Configuration\\Administrative Templates\\Windows Components\\BitLocker Drive Encryption\\Operating System Drives** Group Policy setting, and select the **Do not enable BitLocker until recovery information is stored in AD DS for operating system drives** option. With this configuration, the recovery password is created automatically when the computer joins the domain, and then the recovery key is backed up to AD DS, the TPM protector is created, and the clear key is removed. +* Similar to signing in with a domain account, the clear key is removed when the user logs on to an Azure AD account on the device. As described in the bullet point above, the recovery password is created automatically when the user authenticates to Azure AD. Then, the recovery key is backed up to Azure AD, the TPM protector is created, and the clear key is removed. + Microsoft recommends that device encryption be enabled on any systems that support it, but the automatic device encryption process can be prevented by changing the following registry setting: -- **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker -- **Value**: PreventDeviceEncryption equal to True (1) -- **Type**: REG\_DWORD +- **Subkey**: HKEY\_LOCAL\_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\BitLocker +- **Value**: PreventDeviceEncryption equal to True (1) +- **Type**: REG\_DWORD + Administrators can manage domain-joined devices that have device encryption enabled through Microsoft BitLocker Administration and Monitoring (MBAM). In this case, device encryption automatically makes additional BitLocker options available. No conversion or encryption is required, and MBAM can manage the full BitLocker policy set if any configuration changes are required. -**Used Disk Space Only encryption** +#### Used Disk Space Only encryption BitLocker in earlier Windows versions could take a long time to encrypt a drive, because it encrypted every byte on the volume (including parts that did not have data). That is still the most secure way to encrypt a drive, especially if a drive has previously contained confidential data that has since been moved or deleted, in which case traces of the confidential data could remain on portions of the drive marked as unused. But why encrypt a new drive when you can simply encrypt the data as it is being written? To reduce encryption time, BitLocker in Windows 10 lets users choose to encrypt just their data. Depending on the amount of data on the drive, this option can reduce encryption time by more than 99 percent. Exercise caution when encrypting only used space on an existing volume on which confidential data may have already been stored in an unencrypted state, however, because those sectors can be recovered through disk-recovery tools until they are overwritten by new encrypted data. In contrast, encrypting only used space on a brand-new volume can significantly decrease deployment time without the security risk because all new data will be encrypted as it is written to the disk. -**Encrypted hard drive support** +#### Encrypted hard drive support SEDs have been available for years, but Microsoft couldn’t support their use with some earlier versions of Windows because the drives lacked important key management features. Microsoft worked with storage vendors to improve the hardware capabilities, and now BitLocker supports the next generation of SEDs, which are called encrypted hard drives. Encrypted hard drives provide onboard cryptographic capabilities to encrypt data on drives, which improves both drive and system performance by offloading cryptographic calculations from the PC’s processor to the drive itself and rapidly encrypting the drive by using dedicated, purpose-built hardware. If you plan to use whole-drive encryption with Windows 10, Microsoft recommends that you investigate hard drive manufacturers and models to determine whether any of their encrypted hard drives meet your security and budget requirements. For more information about encrypted hard drives, see [Encrypted Hard Drive](http://go.microsoft.com/fwlink/p/?LinkId=733880). -**Preboot information protection** +### Preboot information protection An effective information protection implementation, like most security controls, considers usability as well as security. Users typically prefer a simple security experience. In fact, the more transparent a security solution becomes, the more likely users are to conform to it. It is crucial that organizations protect information on their PCs regardless of the state of the computer or the intent of users. This protection should not be cumbersome to users. One undesirable and previously commonplace situation is when the user is prompted for input during preboot, and then again during Windows logon. Challenging users for input more than once should be avoided. Windows 10 can enable a true SSO experience from the preboot environment on modern devices and in some cases even on older devices when robust information protection configurations are in place. The TPM in isolation is able to securely protect the BitLocker encryption key while it is at rest, and it can securely unlock the operating system drive. When the key is in use and thus in memory, a combination of hardware and Windows capabilities can secure the key and prevent unauthorized access through cold-boot attacks. Although other countermeasures like PIN-based unlock are available, they are not as user-friendly; depending on the devices’ configuration they may not offer additional security when it comes to key protection. For more information about how to configure BitLocker for SSO, see [BitLocker Countermeasures](bitlocker-countermeasures.md). -**Manage passwords and PINs** +### Manage passwords and PINs When BitLocker is enabled on a system drive and the PC has a TPM, you can choose to require that users type a PIN before BitLocker will unlock the drive. Such a PIN requirement can prevent an attacker who has physical access to a PC from even getting to the Windows logon, which makes it virtually impossible for the attacker to access or modify user data and system files. + Requiring a PIN at startup is a useful security feature because it acts as a second authentication factor (a second “something you know”). This configuration comes with some costs, however. One of the most significant is the need to change the PIN regularly. In enterprises that used BitLocker with Windows 7 and the Windows Vista operating system, users had to contact systems administrators to update their BitLocker PIN or password. This requirement not only increased management costs but made users less willing to change their BitLocker PIN or password on a regular basis. Windows 10 users can update their BitLocker PINs and passwords themselves, without administrator credentials. Not only will this feature reduce support costs, but it could improve security, too, because it encourages users to change their PINs and passwords more often. In addition, InstantGo devices do not require a PIN for startup: They are designed to start infrequently and have other mitigations in place that further reduce the attack surface of the system. For more information about how startup security works and the countermeasures that Windows 10 provides, see [Protect BitLocker from pre-boot attacks](protect-bitlocker-from-pre-boot-attacks.md). -**Configure Network Unlock** +### Configure Network Unlock Some organizations have location-specific data security requirements. This is most common in environments where high-value data is stored on PCs. The network environment may provide crucial data protection and enforce mandatory authentication; therefore, policy states that those PCs should not leave the building or be disconnected from the corporate network. Safeguards like physical security locks and geofencing may help enforce this policy as reactive controls. Beyond these, a proactive security control that grants data access only when the PC is connected to the corporate network is necessary. Network Unlock enables BitLocker-protected PCs to start automatically when connected to a wired corporate network on which Windows Deployment Services runs. Anytime the PC is not connected to the corporate network, a user must type a PIN to unlock the drive (if PIN-based unlock is enabled). Network Unlock requires the following infrastructure: -- Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) -- A server running Windows Server 2012 with the Windows Deployment Services role -- A server with the DHCP server role installed + +* Client PCs that have Unified Extensible Firmware Interface (UEFI) firmware version 2.3.1 or later, which supports Dynamic Host Configuration Protocol (DHCP) +* A server running Windows Server 2012 with the Windows Deployment Services role +* A server with the DHCP server role installed + For more information about how to configure Network Unlock, see [BitLocker: How to enable Network Unlock](http://go.microsoft.com/fwlink/p/?LinkId=733905). -**Microsoft BitLocker Administration and Monitoring** + +### Microsoft BitLocker Administration and Monitoring + Part of the Microsoft Desktop Optimization Pack, MBAM makes it easier to manage and support BitLocker and BitLocker To Go. MBAM 2.5 with Service Pack 1, the latest version, has the following key features: -- Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. -- Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. -- Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. -- Reduces the workload on the help desk to assist end users with BitLocker recovery requests. -- Enables end users to recover encrypted devices independently by using the Self-Service Portal. -- Enables security officers to easily audit access to recovery key information. -- Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. -- Enforces the BitLocker encryption policy options that you set for your enterprise. -- Integrates with existing management tools, such as System Center Configuration Manager. -- Offers an IT-customizable recovery user experience. -- Supports Windows 10. + +* Enables administrators to automate the process of encrypting volumes on client computers across the enterprise. +* Enables security officers to quickly determine the compliance state of individual computers or even of the enterprise itself. +* Provides centralized reporting and hardware management with Microsoft System Center Configuration Manager. +* Reduces the workload on the help desk to assist end users with BitLocker recovery requests. +* Enables end users to recover encrypted devices independently by using the Self-Service Portal. +* Enables security officers to easily audit access to recovery key information. +* Empowers Windows Enterprise users to continue working anywhere with the assurance that their corporate data is protected. +* Enforces the BitLocker encryption policy options that you set for your enterprise. +* Integrates with existing management tools, such as System Center Configuration Manager. +* Offers an IT-customizable recovery user experience. +* Supports Windows 10. For more information about MBAM, including how to obtain it, see [Microsoft BitLocker Administration and Monitoring](http://go.microsoft.com/fwlink/p/?LinkId=626935) on the MDOP TechCenter. @@ -340,19 +350,21 @@ In Windows 10 and Windows Server 2016, client connections to the Active Director This change reduces the likelihood of man-in-the-middle attacks. - **What works differently?** If SMB signing and mutual authentication are unavailable, a Windows 10 or Windows Server 2016 computer won’t process domain-based Group Policy and scripts. -> **Note:** The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. +>[!NOTE] +>The registry values for these settings aren’t present by default, but the hardening rules still apply until overridden by Group Policy or other registry values. For more information on these security improvements, (also referred to as UNC hardening), see [Microsoft Knowledge Base article 3000483](http://go.microsoft.com/fwlink/p/?LinkId=789216) and [MS15-011 & MS15-014: Hardening Group Policy](http://go.microsoft.com/fwlink/p/?LinkId=789215). -**Secure hardware** +#### Secure hardware Although Windows 10 is designed to run on almost any hardware capable of running Windows 8, Windows 7, or Windows Vista, taking full advantage of Windows 10 security requires advancements in hardware-based security, including UEFI with Secure Boot, CPU virtualization features (for example, Intel VT-x), CPU memory-protection features (for example, Intel VT-d), TPM, and biometric sensors. -**UEFI with Secure Boot** +#### UEFI with Secure Boot When a PC starts, it begins the process of loading the operating system by locating the bootloader on the PC’s hard drive. Without safeguards in place, the PC may simply hand control over to the bootloader without even determining whether it is a trusted operating system or malware. UEFI is a standards-based solution that offers a modern-day replacement for the BIOS. In fact, it provides the same functionality as BIOS while adding security features and other advanced capabilities. Like BIOS, UEFI initializes devices, but UEFI components with the Secure Boot feature (version 2.3.1 or later) also ensure that only trusted firmware in Option ROMs, UEFI apps, and operating system bootloaders can start on the device. + UEFI can run internal integrity checks that verify the firmware’s digital signature before running it. Because only the PC’s hardware manufacturer has access to the digital certificate required to create a valid firmware signature, UEFI has protection from firmware bootkits. Thus, UEFI is the first link in the chain of trust. UEFI with Secure Boot became a hardware requirement starting with Windows 8 devices. If a PC supports UEFI, it must be enabled by default. It is possible to disable the Secure Boot feature on many devices, but Microsoft strongly discourages doing so because it dramatically reduces the security of the startup process. @@ -360,32 +372,36 @@ UEFI with Secure Boot became a hardware requirement starting with Windows 8 dev When a PC with UEFI and Secure Boot starts, the UEFI firmware verifies the bootloader’s digital signature to verify that it has not been modified after it was digitally signed. The firmware also verifies that a trusted authority issued the bootloader’s digital signature. This check helps to ensure that the system starts only after checking that the bootloader is both trusted and unmodified since signing. All Windows 8 certified PCs must meet several requirements related to Secure Boot: -- They must have Secure Boot enabled by default. -- They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. -- They must allow the user to add signatures and hashes to the UEFI database. -- They must allow the user to completely disable Secure Boot (although administrators can restrict this). + +* They must have Secure Boot enabled by default. +* They must trust Microsoft’s certification authority (CA) and thus any bootloader Microsoft has signed. +* They must allow the user to add signatures and hashes to the UEFI database. +* They must allow the user to completely disable Secure Boot (although administrators can restrict this). This behavior doesn’t limit the choice of operating system. In fact, users typically have three options for running non-Microsoft operating systems: -- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI + +- **Use an operating system with a Microsoft-signed bootloader.** Microsoft offers a service to sign non-Microsoft bootloaders so that they can be used on the device. In this case, a signature from the Microsoft third-party UEFI CA is used to sign the non-Microsoft bootloader, and the signature itself is added to the UEFI database. Several non-Microsoft operating systems, including several varieties of Linux, have had their bootloaders signed by Microsoft so that they can take advantage of the Secure Boot capability. For more information about the Microsoft third-party UEFI signing policy, read [Microsoft UEFI CA Signing policy updates](http://go.microsoft.com/fwlink/p/?LinkId=626936) and [Pre-submission testing for UEFI submissions](http://go.microsoft.com/fwlink/p/?LinkId=626937). - **Note**   - PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document. + >[!NOTE]  + >PCs configured to use Device Guard boot only a secured version of Windows and do not permit a third-party bootloader. For more information, see the [Device Guard](#device-guard) section of this document.   -- **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. -- **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. +- **Configure UEFI to trust a non–Microsoft-signed bootloader or hashes.** Some Certified For Windows 8 or later PCs allow users to add noncertified bootloaders through a signature or hashes sent to the UEFI database, which allows them to run any operating system without Microsoft signing it. +- **Turn off Secure Boot.**Windows 8 certified PCs allow users to turn off Secure Boot so they can run unsigned operating systems. In this mode, the behavior is identical to PCs that have BIOS: The PC simply runs the bootloader without any verification. Microsoft strongly recommends that Secure Boot remain enabled whenever the device starts so that it can help prevent bootkit infections. - **Note**   - With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device. +>[!NOTE]   +>With Windows 10, original equipment manufacturers (OEMs) have the ability to ship built-to-order PCs that lock down UEFI Secure Boot so that it cannot be disabled and allows only the operating system of the customer’s choice to start on the device.   Windows, apps, and even malware cannot change the UEFI configuration. Instead, users must be physically present to manually boot a PC into a UEFI shell, and then change UEFI firmware settings. For more information about UEFI Secure Boot, read [Protecting the pre-OS environment with UEFI](http://go.microsoft.com/fwlink/p/?LinkId=626938). -**Virtualization-based security** + +#### Virtualization-based security One of the most powerful changes to Windows 10 is virtual-based security. Virtual-based security (VBS) takes advantage of advances in PC virtualization to change the game when it comes to protecting system components from compromise. VBS is able to isolate some of the most sensitive security components of Windows 10. These security components aren’t just isolated through application programming interface (API) restrictions or a middle-layer: They actually run in a different virtual environment and are isolated from the Windows 10 operating system itself. VBS and the isolation it provides is accomplished through the novel use of the Hyper V hypervisor. In this case, instead of running other operating systems on top of the hypervisor as virtual guests, the hypervisor supports running the VBS environment in parallel with Windows and enforces a tightly limited set of interactions and access between the environments. Think of the VBS environment as a miniature operating system: It has its own kernel and processes. Unlike Windows, however, the VBS environment runs a micro-kernel and only two processes called trustlets: + - **Local Security Authority (LSA)** enforces Windows authentication and authorization policies. LSA is a well-known security component that has been part of Windows since 1993. Sensitive portions of LSA are isolated within the VBS environment and are protected by a new feature called Credential Guard. - **Hypervisor-enforced code integrity** verifies the integrity of kernel-mode code prior to execution. This is a part of the [Device Guard](#device-guard) feature described later in this document. VBS provides two major improvements in Windows 10 security: a new trust boundary between key Windows system components and a secure execution environment within which they run. A trust boundary between key Windows system components is enabled though the VBS environment’s use of platform virtualization to isolate the VBS environment from the Windows operating system. Running the VBS environment and Windows operating system as guests on top of Hyper-V and the processor’s virtualization extensions inherently prevents the guests from interacting with each other outside the limited and highly structured communication channels between the trustlets within the VBS environment and Windows operating system. @@ -394,23 +410,25 @@ VBS acts as a secure execution environment because the architecture inherently p The VBS architecture is illustrated in Figure 2. -![figure 2](images/security-fig2-vbsarchitecture.png) +![Example of VBS architecture](images/security-fig2-vbsarchitecture-redo.png "Example of VBS architecture") Figure 2. The VBS architecture Note that VBS requires a system that includes: -- Windows 10 Enterprise Edition -- A-64-bit processor -- UEFI with Secure Boot -- Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) -- Virtualization extensions (for example, Intel VT-x, AMD RVI) -- I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) -- TPM 2.0 -**Trusted Platform Module** +* Windows 10 Enterprise Edition +* A 64-bit processor +* UEFI with Secure Boot +* Second-Level Address Translation (SLAT) technologies (for example, Intel Extended Page Tables \[EPT\], AMD Rapid Virtualization Indexing \[RVI\]) +* Virtualization extensions (for example, Intel VT-x, AMD RVI) +* I/O memory management unit (IOMMU) chipset virtualization (Intel VT-d or AMD-Vi) +* TPM 2.0 + +#### Trusted Platform Module A TPM is a tamper-resistant cryptographic module designed to enhance the security and privacy of computing platforms. The TPM is incorporated as a component in a trusted computing platform like a personal computer, tablet, or phone. The computing platform is specially designed to work with the TPM to support privacy and security scenarios that cannot be achieved through software alone. A proper implementation of a TPM as part of a trusted computing platform provides a hardware root of trust, meaning that the hardware behaves in a trusted way. For example, a key created in a TPM with the property that it can never be exported from the TPM really means the key cannot leave the TPM. The close integration of a TPM with a platform increases the transparency of the boot process and supports device health scenarios by enabling reliable report of the software used to start a platform. The functionality a TPM provides includes: + - **Cryptographic key management.** Create, store, and permit the use of keys in defined ways. - **Safeguarding and reporting integrity measurements.** Software used to boot the platform can be recorded in the TPM and used to establish trust in the software running on the platform. - **Prove a TPM is really a TPM.** The TPM’s capabilities are so central to protecting privacy and security that a TPM needs to be able to differentiate itself from malware that masquerades as a TPM. @@ -418,95 +436,111 @@ The functionality a TPM provides includes: Microsoft combined this small list of TPM benefits with Windows 10 and other hardware security technologies to provide practical security and privacy benefits. Among other functions, Windows 10 uses the TPM to protect the encryption keys for BitLocker volumes, virtual smart cards, certificates, and the many other keys that the TPM is used to generate. Windows 10 also uses the TPM to securely record and protect integrity-related measurements of select hardware and Windows boot components for the [Measured Boot](#measure-boot) feature described later in this document. In this scenario, Measured Boot measures each component, from firmware up through the drivers, and then stores those measurements in the PC’s TPM. From there, you can test the measurement log remotely so that a separate system verifies the boot state of the Windows 10 PC. + Windows 10 supports TPM implementations that comply with either the 1.2 or 2.0 standards. Several improvements have been made in the TPM 2.0 standard, the most notable of which is cryptographic agility. TPM 1.2 is restricted to a fixed set of encryption and hash algorithms. At the time the TPM 1.2 standard was created in the early 2000s, these algorithms were considered cryptographically strong. Since that time, advances in cryptographic algorithms and cryptanalysis attacks have increased expectations for stronger cryptography. TPM 2.0 supports additional algorithms that offer stronger cryptographic protection as well as the ability to plug in algorithms that may be preferred in certain geographies or industries. It also opens the possibility for inclusion of future algorithms without changing the TPM component itself. TPM is usually assumed to be implanted in hardware on a motherboard as a discrete module, but TPM can also be effective when implemented in firmware. Windows 10 supports both discrete and firmware TPM that complies with the 2.0 standard (1.2 can only be discrete). Windows does not differentiate between discrete and firmware-based solutions because they must meet the same requirements; therefore, any Windows feature that can take advantage of TPM can use either implementation. -**Note**   -Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage. +>[!NOTE]  +>Microsoft will not initially require new Windows 10 PCs to include TPM support. Microsoft will require systems to include a TPM 2.0 beginning one year from the launch of Windows 10, however, to give manufacturers enough time to incorporate this critical functionality and to give IT pros enough time to determine which benefits they will leverage.   Several Windows 10 security features require TPM: -- Virtual smart cards -- Measured Boot -- Health attestation (requires TPM 2.0 or later) -- InstantGo (requires TPM 2.0 or later) +* Virtual smart cards +* Measured Boot +* Health attestation (requires TPM 2.0 or later) +* InstantGo (requires TPM 2.0 or later) Other Windows 10 security features like BitLocker may take advantage of TPM if it is available but do not require it to work. An example of this is Microsoft Passport. All of these features are covered in this document. -**Biometrics** +#### Biometrics You read in the [Windows Hello](#windows-hello) section of this document that Windows 10 has built-in support for biometric hardware. Windows has included some amount of built-in biometric support since the Windows XP operating system, so what’s different about this in Windows 10? + Windows 10 makes biometrics a core security feature. Biometrics is fully integrated into the Windows 10 security components, not just tacked on as an extra part of a larger scheme. This is a big change. Earlier biometric implementations were largely front-end methods to simplify authentication. Under the hood, biometrics was used to access a password, which was then used for authentication behind the scenes. Biometrics may have provided convenience but not necessarily enterprise-grade authentication. + Microsoft has evangelized the importance of enterprise-grade biometric sensors to the OEMs that create Windows PCs and peripherals. Many OEMs already ship systems that have integrated fingerprint sensors and are transitioning from swipe-based to touch-based sensors. Facial-recognition sensors were already available when Windows 10 launched and are becoming more commonplace as integrated system components. + In the future, Microsoft expects OEMs to produce even more enterprise-grade biometric sensors and to continue to integrate them into systems as well as provide separate peripherals. As a result, biometrics will become a commonplace authentication method as part of an MFA system. -**Secure Windows startup** +#### Secure Windows startup UEFI Secure Boot uses hardware technologies to help protect users from bootkits. Secure Boot can validate the integrity of the devices, firmware, and bootloader. After the bootloader launches, users must rely on the operating system to protect the integrity of the remainder of the system. -**Trusted Boot** +#### Trusted Boot When UEFI Secure Boot verifies that the bootloader is trusted and starts Windows, the Windows Trusted Boot feature protects the rest of the startup process by verifying that all Windows startup components are trustworthy (for example, signed by a trusted source) and have integrity. The bootloader verifies the digital signature of the Windows kernel before loading it. The Windows kernel, in turn, verifies every other component of the Windows startup process, including the boot drivers, startup files, and ELAM component. + If a file has been modified (for example, if malware has tampered with it or it has been corrupted), Trusted Boot will detect the problem and automatically repair the corrupted component. When repaired, Windows will start normally after only a brief delay. -**Early Launch Antimalware** +#### Early Launch Antimalware Malware that targeted previous versions of Windows often attempted to start before the antimalware solution. To do this, some types of malware would update or replace a non-Microsoft–related driver that starts during the Windows startup process. The malicious driver would then use its system access privileges to modify critical parts of the system and disguise its presence so it could not be detected when the antimalware solution later started. + Early Launch Antimalware (ELAM) is part of the Trusted Boot feature set and is designed to enable the antimalware solution to start before all non-Microsoft drivers and apps. ELAM checks the integrity of non-Microsoft drivers to determine whether the drivers are trustworthy. Because Windows needs to start as fast as possible, ELAM cannot be a complicated process of checking the driver files against known malware signatures; doing so would delay startup too much. Instead, ELAM has the simple task of examining every boot driver and determining whether it is on the list of trusted drivers. If malware modifies a boot-related driver, ELAM will detect the change, and Windows will prevent the driver from starting, thus blocking driver-based rootkits. ELAM also allows the registered antimalware provider to scan drivers that are loaded after the boot process is complete. + The design is simple but effective. ELAM is a component of a full-featured antimalware solution, and it helps prevent malicious drivers and apps from starting before the rest of the antimalware solution starts later during the boot process. Indeed, ELAM runs only for a few seconds each time a PC starts. Windows Defender in Windows 10 supports ELAM, as does Microsoft System Center 2012 Endpoint Protection and several non-Microsoft antimalware apps. + If you want to learn how to configure ELAM, you can use Group Policy settings to configure how ELAM responds to potentially malicious boot drivers. In the Group Policy Management Editor, go to Computer Configuration\\Administrative Templates\\System\\Early Launch Antimalware, and enable the **Boot-Start Driver Initialization Policy** setting. Now, you can select which driver classifications ELAM loads. When you select the **Good Only** setting, it provides the highest level of security, but test it thoroughly to ensure that it does not prevent users with healthy PCs from starting. -### - -**Measured Boot** +#### Measured Boot The biggest challenge with rootkits and bootkits in earlier versions of Windows is that they can frequently be undetectable to the client. Because they often start before Windows defenses and the antimalware solution and they have system-level privileges, rootkits and bootkits can completely disguise themselves while continuing to access system resources. Although UEFI Secure Boot and Trusted Boot can prevent most rootkits and bootkits, intruders could still potentially exploit a few attack vectors (for example, if UEFI with Secure Boot is disabled or if the signature used to sign a boot component, such as a non-Microsoft driver, has been compromised and is used to sign a malicious one). + Windows 10 implements the Measured Boot feature, which uses the TPM hardware component built into newer PCs to record a series of measurements for critical startup-related components, including firmware, Windows boot components, drivers, and even the ELAM driver. Because Measured Boot leverages the hardware-based security capabilities of TPM, which isolates and protects the measurement data from malware attacks, the log data is well protected against even sophisticated attacks. Measured Boot focuses on acquiring the measurement data and protecting it from tampering. It must be coupled with a service that can analyze the data to determine device health and provide a more complete security service. The next section introduces just such a service. -**Verify device compliance for conditional access to corporate resources** +#### Verify device compliance for conditional access to corporate resources Measured Boot itself does not prevent malware from loading during the startup process – that is the job of Secure Boot, Device Guard, and ELAM. Instead, Measured Boot provides a TPM-protected audit log that allows a trusted remote health attestation service to evaluate the PC’s startup components, state, and overall configuration. If the health attestation service detects that the PC loaded an untrustworthy component and is therefore out of compliance, the service can block the PC’s access to specific network resources or the entire network. You can even couple a health attestation service with a management system to facilitate conditional access capabilities that can initiate the quarantine and remediation processes to fix an infected PC and return it to a compliant state. -![figure 3](images/security-fig3-healthattestation.png) +![Health Attestation in Windows 10](images/security-fig3-healthattestation.png "Health Attestation in Windows 10") Figure 3. Health Attestation in Windows 10 Figure 3 illustrates the following process for device compliance verification and conditional access implementation: 1. The PC uses the TPM to record measurements of the bootloader, boot drivers, and ELAM driver. The TPM prevents anyone from tampering with these measurements, so even if malware is successfully loaded, it will not be able to modify the measurements. These measurements are signed with an Attestation Identity Key (AIK) that is stored in the TPM. Because the TPM hardware has signed the measurements, malware cannot modify them without being detected. + 2. Health Attestation is not enabled by default and requires an enrollment with a mobile device management (MDM) server in order to enable it. If it is enabled, the health attestation client will contact a remote server, called a health attestation server. Microsoft provides a cloud-based Windows Health Attestation service that can help evaluate the health of a device. The health attestation client sends the signed measurements, the device’s TPM boot log, and an AIK certificate (if present), which lets the health attestation server verify that the key used to sign the measurements was issued to a trusted TPM. + 3. The health attestation server analyzes the measurements and boot log and creates a statement of device health. This statement is encrypted to help ensure the confidentiality of the data. + 4. A management system, such as an MDM server, can request that an enrolled device present a statement of device health. Windows 10 supports both Microsoft and non-Microsoft MDM server requests for device health. To prevent theft of device health statements and reuse from other devices, an MDM server sends the enrolled device a “number used only once” (nonce) request along with this request for the device health statement. + 5. The enrolled device digitally signs the nonce with its AIK (which is stored in the TPM) and sends the MDM server the encrypted statement of device health, the digitally signed nonce, and a signed boot counter, which asserts that the device has not been restarted since it obtained the statement of health. + 6. The MDM server can send the same data to the health attestation server. The server decrypts the statement of health, asserts that the boot counter in the statement matches the boot counter that was sent to the MDM server, and compiles a list of health attributes. + 7. The health attestation server sends this list of health attributes back to the MDM server. The MDM server now enforces access and compliance policies if configured to do so. For a list of data points that the health attestation server verifies, along with a description of the data, see the [HealthAttestation CSP article on MSDN](http://go.microsoft.com/fwlink/p/?LinkId=626940). + The management system’s implementation determines which attributes within the statement of device health are evaluated when assessing a device’s health. Broadly speaking, the management server receives information about how the device booted, what kind of policy is enforced on the device, and how data on the device is secured. Depending on the implementation, the management server may add checks that go beyond what the statement of device health provides—for example, Windows patch level and other device attributes. + Based on these data points, the management server can determine whether the client is healthy and grant it access to either a limited quarantine network or to the full network. Individual network resources, such as servers, can also grant or deny access based on whether the remote attestation client were able to retrieve a valid health certification from the remote attestation server. + Because this solution can detect and prevent low-level malware that may be extremely difficult to detect any other way, Microsoft recommends that you consider the implementation of a management system, like Microsoft Intune, or any management solutions that take advantage of the Windows 10 cloud-based Health Attestation Server feature to detect and block devices that have been infected with advanced malware from network resources. -## Secure the Windows core +### Secure the Windows core Applications built for Windows are designed to be secure and free of defects, but the reality is that as long as human beings are writing code, vulnerabilities will continue to crop up. When identified, malicious users and software may attempt to exploit vulnerabilities by manipulating data in memory in the hope that they can bootstrap a successful exploit. + To mitigate these risks, Windows 10 includes core improvements to make it more difficult for malware to perform buffer overflow, heap spraying, and other low-level attacks and even which code is allowed to run on the PC. In addition, these improvements dramatically reduce the likelihood that newly discovered vulnerabilities result in a successful exploit. It takes detailed knowledge of operating system architecture and malware exploit techniques to fully appreciate the impact of these improvements, but the sections that follow explain them at a high level. -### - -**Device Guard** +#### Device Guard Today’s security threat landscape is more aggressive than ever before. Modern malicious attacks are focused on revenue generation, intellectual property theft, and targeted system degradation resulting in financial loss. Many of these nefarious attackers are sponsored by nation states that have ulterior motives and large cyber-terrorism budgets. These threats can enter a company through something as simple as an email and can permanently damage the organization’s reputation for securing employee and customer data and intellectual property, not to mention having a significant financial impact. The Windows 10 operating system introduces several new security features that help mitigate a large percentage of today’s known threats. It is estimated that more than 300,000 new malware variants are discovered daily. Unfortunately, companies currently use an ancient method to discover this infectious software and prevent its use. In fact, current PCs trust everything that runs until antimalware signatures determine whether a threat exists; then, the antimalware software attempts to clean the PC, often after the malicious software’s effect has already occurred. This signature-based system focuses on reacting to an infection and then ensuring that that particular infection does not happen again. In this model, the system that drives malware detection relies on the discovery of malicious software; only then can a signature be provided to the client to remediate it, which implies that a computer has often already been infected. The time between detection of the malware and a client being issued a signature could mean the difference between losing data and staying safe. In addition to antimalware solutions, “app control” or “whitelisting” technologies are available, including AppLocker. These perform single-instance or blanket allow or deny rules for running applications. In Windows 10, these types of solutions are most effective when deployed alongside the Windows 10 Device Guard feature. + Device Guard breaks the current model of detection first-block later and allows only trusted applications to run, period. This methodology is consistent with the successful prevention strategy for mobile phone security. With Device Guard, Microsoft has changed how the Windows operating system handles untrusted applications, which makes its defenses difficult for malware to penetrate. This new prevention versus detection model will provide Windows clients with the necessary security for modern threats and, when implemented, mitigates many of today’s threats from day one. -**Device Guard overview** +#### Device Guard overview Device Guard is a feature set that consists of both hardware and software system integrity hardening features. These features revolutionize the Windows operating system’s security by taking advantage of new VBS options to protect the system core and the processes and drivers running in kernel mode—the trust-nothing model you see in mobile device operating systems. A key feature used with Device Guard is *configurable code integrity*, which allows your organization to choose exactly which software from trusted software publishers is allowed to run code on your client machines—exactly what has made mobile phone security on some platforms, such as Windows Mobile, so successful. Trusted applications are those signed directly (in other words, binaries) or indirectly by using a signed file that lists the hash values for application binaries that are considered trustworthy. In addition, Device Guard offers organizations a way to sign existing LOB applications so that they can trust their own code without the requirement that the application be rebuilt or packaged. Also, this same method of signing can provide organizations a way to trust non-Microsoft applications, including those that may not have been signed directly. Device Guard with configurable code integrity, Credential Guard, and AppLocker present the most complete security defense that any Microsoft product has ever been able to offer a Windows client. @@ -526,7 +560,7 @@ To deliver this additional security, Device Guard has the following hardware and Along with these new features, some components of Device Guard are existing tools or technologies that have been included in this strategic security offering to provide customers with the most secure Windows operating system possible. Device Guard is intended as a set of client security features to be used in conjunction with the other threat-resistance features available in the Windows operating system, some of which are mentioned in this guide. -**Configurable code integrity** +#### Configurable code integrity The Windows operating system consists of two operating modes: user mode and kernel mode. The base of the operating system runs within the kernel mode, which is where the Windows operating system directly interfaces with hardware resources. User mode is primarily responsible for running applications and brokering information to and from the kernel mode for hardware resource requests. For example, when an application running in user mode needs additional memory, the user mode process must request the resources from the kernel, not directly from RAM. @@ -534,33 +568,32 @@ Code integrity is the component of the Windows operating system that verifies th Historically, most malware has been unsigned. Simply by deploying code integrity policies, organizations will immediately protect themselves against unsigned malware, which is estimated to be responsible for the vast majority of current attacks. By using code integrity policies, an enterprise can also select exactly which binaries are allowed to run in both user mode and kernel mode based on the signer, binary hash, or both. When completely enforced, it makes user mode in Windows function like some mobile platforms, trusting and running only specific applications or specific signatures. This feature alone fundamentally changes security in an enterprise. This additional security is *not* limited to Windows apps and does *not* require an application rewrite to be compatible with your existing and possibly unsigned applications. You can run configurable code integrity independent of Device Guard, thus making it available to devices that don’t meet Device Guard hardware requirements. -**Hardware security features and VBS** +#### Hardware security features and VBS The core functionality and protection of Device Guard starts at the hardware level. Devices that have processors equipped with SLAT technologies and virtualization extensions, such as Intel VT x and AMD V, will be able to take advantage of a VBS environment that dramatically enhances Windows security by isolating critical Windows services from the operating system itself. This isolation is necessary, because you must assume that the operating system kernel will be compromised, and you need assurance that some processes will remain secure. -Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can’t happen in the first place. +Device Guard leverages VBS to isolate its Hypervisor Code Integrity (HVCI) service, which enables Device Guard to help protect kernel mode processes and drivers from vulnerability exploits and zero days. HVCI uses the processor’s IOMMU functionality to force all software running in kernel mode to safely allocate memory. This means that after memory has been allocated, its state must be changed from writable to read only or execute only. By forcing memory into these states, it helps ensure that attacks are unable to inject malicious code into kernel mode processes and drivers through techniques such as buffer overruns or heap spraying. In the end, the VBS environment protects the Device Guard HVCI service from tampering even if the operating system’s kernel has been fully compromised, and HVCI protects kernel mode processes and drivers so that a compromise of this magnitude can't happen in the first place. + Another Windows 10 feature that employs VBS is Credential Guard. Credential Guard protects credentials by running the Windows authentication service known as LSA, and then storing the user’s derived credentials (for example, NTLM hashes; Kerberos tickets) within the same VBS environment that Device Guard uses to protect its HVCI service. By isolating the LSA service and the user’s derived credentials from both user mode and kernel mode, an attacker that has compromised the operating system core will still be unable to tamper with authentication or access derived credential data. Credential Guard prevents pass-the-hash and ticket types of attacks, which are central to the success of nearly every major network breach you’ve read about, which makes Credential Guard one of the most impactful and important features to deploy within your environment. For more information about how Credential Guard complements Device Guard, see the [Device Guard with Credential Guard](#dgwithcg) section. -**Device Guard with AppLocker** +#### Device Guard with AppLocker Although AppLocker is not considered a new Device Guard feature, you can use it to complement configurable code integrity functionality when enforced code integrity cannot be fully implemented or its functionality does not cover every desired scenario. There are many scenarios in which you could use code integrity policies alongside AppLocker rules. As a best practice, enforce code integrity policies at the most restrictive level possible for your organization, and then use AppLocker to fine-tune the restrictions to an even lower level. -**Note**   -One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. +>[!NOTE]   +>One example in which Device Guard functionality needs AppLocker supplementation is when your organization would like to limit which universal applications from the Windows Store users can install on a device. Microsoft has already validated universal applications from the Windows Store as trustworthy to run, but an organization may not want to allow specific universal applications to run in its environment. You could use an AppLocker rule to enforce such a stance. In another example, you could enable a configurable code integrity policy to allow users to run all the apps from a specific publisher. To do so, you would add the publisher’s signature to the policy. If your organization decides that only specific apps from that publisher should be allowed to run, you would add the signature for the publisher to the configurable code integrity policy, and then use AppLocker to determine which specific apps can run.   AppLocker and Device Guard can run side-by-side in your organization, which offers the best of both security features at the same time and provides the most comprehensive security to as many devices as possible. In addition to these features, Microsoft recommends that you continue to maintain an enterprise antivirus solution for a well-rounded enterprise security portfolio. -### - -**Device Guard with Credential Guard** +#### Device Guard with Credential Guard Although Credential Guard isn’t a feature within Device Guard, many organizations will likely deploy Credential Guard alongside Device Guard for additional protection against derived credential theft. Similar to virtualization-based protection of kernel mode through the Device Guard HVCI service, Credential Guard leverages hypervisor technology to protect the Windows authentication service (the LSA) and users’ derived credentials. This mitigation is targeted at preventing the use of pass-the-hash and pass-the-ticket techniques. Because Credential Guard uses VBS, it is decisive in its ability to prevent pass-the-hash and pass-the-ticket attacks from occurring on Windows 10 devices. Microsoft recognizes, however, that most organizations will have a blend of Windows versions running in their environments. Mitigations for devices not capable of running Credential Guard on both the client side and the server side are available to help with this scenario. Microsoft will be releasing details to TechNet regarding these additional mitigations in the near future. -**Unified manageability through Device Guard** +#### Unified manageability through Device Guard You can easily manage Device Guard features through the familiar enterprise and client-management tools that IT pros use every day. Use the following management tools to enable and manage Device Guard: - **Group Policy.**Windows 10 provides an administrative template that you can use to configure and deploy the configurable code integrity policies for your organization. This template also allows you to specify which hardware-based security features you would like to enable and deploy. You can manage these settings with your existing Group Policy objects, which makes it simple to implement Device Guard features. In addition to the code integrity and hardware-based security features, Group Policy can help you manage your catalog files. @@ -569,19 +602,19 @@ You can easily manage Device Guard features through the familiar enterprise and - **Windows PowerShell.** You use Windows PowerShell primarily to create and service code integrity policies. These policies represent the most impactful component of Device Guard. These options provide the same experience you’re used to for management of your existing enterprise management solutions. -**Address Space Layout Randomization** +#### Address Space Layout Randomization One of the most common techniques used to gain access to a system is to find a vulnerability in a privileged process that is already running, guess or find a location in memory where important system code and data have been placed, and then overwrite that information with a malicious payload. In the early days of operating systems, any malware that could write directly to the system memory could do such a thing; the malware would simply overwrite system memory in well-known and predictable locations. Address Space Layout Randomization (ASLR) makes that type of attack much more difficult because it randomizes how and where important data is stored in memory. With ASLR, it is more difficult for malware to find the specific location it needs to attack. Figure 4 illustrates how ASLR works by showing how the locations of different critical Windows components can change in memory between restarts. -![image 4](images/security-fig4-aslr.png) +![ASLR at work](images/security-fig4-aslr.png "ASLR at work") Figure 4. ASLR at work Although the ASLR implementation in Windows 7 was effective, it wasn’t applied holistically across the operating system, and the level of entropy (cryptographic randomization) wasn’t always at the highest possible level. To decrease the likelihood that sophisticated attacks such as heap spraying could succeed in the Windows 8 operating system, Microsoft applied ASLR holistically across the system and increased the level of entropy many times. The ASLR implementation in Windows 8 and Windows 10 is greatly improved over Windows 7, especially with 64-bit system and application processes that can take advantage of a vastly increased memory space, which makes it even more difficult for malware to predict where Windows 10 stores vital data. When used on systems that have TPMs, ASLR memory randomization will be increasingly unique across devices, which makes it even more difficult for a successful exploit that works on one system to work reliably on another. -**Data Execution Prevention** +#### Data Execution Prevention Malware depends on its ability to put a malicious payload into memory with the hope that it will be executed later, and ASLR will make that much more difficult. Wouldn’t it be great if you could prevent malware from running if it wrote to an area that has been allocated solely for the storage of information? @@ -598,11 +631,11 @@ If you want to see which apps use DEP, complete these steps: You can now see which processes have DEP enabled. Figure 5 shows the processes running on a Windows 10 PC with a single process that does not support DEP. -![figure 5](images/security-fig5-dep.png) +![Processes with DEP enabled in Windows 10](images/security-fig5-dep.png "Processes with DEP enabled in Windows 10") Figure 5. Processes on which DEP has been enabled in Windows 10 -**Windows Heap** +#### Windows Heap The *heap* is a location in memory that Windows uses to store dynamic application data. Windows 10 continues to improve on earlier Windows heap designs by further mitigating the risk of heap exploits that could be used as part of an attack. @@ -613,17 +646,19 @@ Windows 10 has several important improvements to the security of the heap over Windows 10 resolves known heap attacks that could be used to compromise a PC running previous versions of Windows. -**Memory reservations** +#### Memory reservations The lowest 64 KB of process memory is reserved for the system. Apps are no longer allowed to allocate that portion of the memory, which makes it more difficult for malware to overwrite critical system data structures in memory. -**Control Flow Guard** +#### Control Flow Guard When applications are loaded into memory, they are allocated space based on the size of the code, requested memory, and other factors. When an application begins to execute code, it calls additional code located in other memory addresses. The relationships between the code locations are well known—they are written in the code itself—but previous to Windows 10, the flow between these locations was not enforced, which gives attackers the opportunity to change the flow to meet their needs. In other words, an application exploit takes advantage of this behavior by running code that the application may not typically run. + This kind of threat is mitigated in Windows 10 through the Control Flow Guard (CFG) feature. When a trusted application that was compiled to use CFG calls code, CFG verifies that the code location called is trusted for execution. If the location is not trusted, the application is immediately terminated as a potential security risk. + An administrator cannot configure CFG; rather, an application developer can take advantage of CFG by configuring it when the application is compiled. Administrators should consider asking application developers and software vendors to deliver trustworthy Windows applications compiled with CFG enabled. Of course, browsers are a key entry point for attacks; thus Microsoft Edge, IE, and other Windows features take full advantage of CFG. -**Protected Processes** +#### Protected Processes Benjamin Franklin once said that "an ounce of prevention is worth a pound of cure." His wisdom directly applies to PC security. Most security controls are designed to prevent the initial infection point. The reasoning is that if malware cannot infect the system, the system is immune to malware. @@ -633,12 +668,12 @@ The key security scenario is to assume that malware is running on a system but l With Protected Processes, Windows 10 prevents untrusted processes from interacting or tampering with those that have been specially signed. Protected Processes defines levels of trust for processes. Less trusted processes are prevented from interacting with and therefore attacking more trusted processes. Windows 10 uses Protected Processes more broadly across the operating system, and for the first time, you can put antimalware solutions into the protected process space, which helps make the system and antimalware solutions less susceptible to tampering by malware that does manage to get on the system. -## Secure the Windows desktop +### Secure the Windows desktop Windows 10 includes critical improvements to the Windows core and the desktop environment, where attacks and malware most frequently enter. The desktop environment is now more resistant to malware thanks to significant improvements to Windows Defender and SmartScreen Filters. Internet browsing is a safer experience because of Microsoft Edge, a completely new browser. The Windows Store reduces the likelihood that malware will infect devices by ensuring that all applications that enter the Windows Store ecosystem have been thoroughly reviewed before being made available. Universal Windows apps are inherently more secure than typical applications because they are sandboxed. Sandboxing restricts the application’s risk of being compromised or tampered with in a way that would put the system, data, and other applications at risk. The sections that follow describe Windows 10 improvements to application security in more detail. -**Microsoft Edge and Internet Explorer 11** +### Microsoft Edge and Internet Explorer 11 Browser security is a critical component of any security strategy, and for good reason: The browser is the user’s interface to the Internet, an environment that is quite literally overwhelmed with malicious sites and content waiting to attack. Most users cannot perform at least part of their job without a browser, and many users are completely reliant on one. This reality has made the browser the number one pathway from which malicious hackers initiate their attacks. @@ -653,45 +688,49 @@ Microsoft includes an entirely new browser, Microsoft Edge, in Windows 10. Micr In addition to Microsoft Edge, Microsoft includes IE11 in Windows 10 primarily for backwards-compatibility with websites and binary extensions that do not work with Microsoft Edge. It should not be configured as the primary browser but rather as an optional or automatic switchover, as shown in Figure 6. -![figure 6](images/security-fig6-edge2.png) +![Configure Windows 10 for backwards-compatibility with IE11](images/security-fig6-edge2.png "Configure Windows 10 for backwards-compatibility with IE11") Figure 6. Configure Windows 10 to switch from Microsoft Edge to IE11 for backwards-compatibility. Microsoft’s recommendation is to use Microsoft Edge as the primary web browser because it provides compatibility with the modern web and the best possible security. For sites that require IE11 compatibility, including those that require binary extensions and plug ins, enable Enterprise mode and use the Enterprise Mode Site List to define which sites have the dependency. When configured, when users use Microsoft Edge and it identifies a site that requires IE11, they will automatically be switched to IE11. -**The SmartScreen Filter** +### The SmartScreen Filter Recent versions of Windows have many effective techniques to prevent malware from installing itself without the user’s knowledge. To work around those restrictions, malware attacks often use social engineering techniques to trick users into running software. For example, malware known as a Trojan horse pretends to be something useful, such as a utility, but carries an additional, malicious payload. + Starting with Windows Internet Explorer 8, the SmartScreen Filter has helped protect users from both malicious applications and nefarious websites by using the SmartScreen Filter’s application and URL reputation services. The SmartScreen Filter in Internet Explorer would check URLs and newly downloaded apps against an online reputation service that Microsoft maintained. If the app or URL were not known to be safe, SmartScreen Filter would warn the user or even prevent the app or URL from loading, depending on how systems administrators had configured Group Policy settings. + For Windows 10, Microsoft further developed the SmartScreen Filter by integrating its app reputation abilities into the operating system itself, which allows the filter to protect users regardless of the web browser they are using or the path that the app uses to arrive on the device (for example, email, USB flash drive). The first time a user runs an app that originates from the Internet, even if the user copied it from another PC, the SmartScreen Filter checks the reputation of the application by using digital signatures and other factors against a service that Microsoft maintains. If the app lacks a reputation or is known to be malicious, the SmartScreen Filter warns the user or blocks execution entirely, depending on how the administrator has configured Group Policy (see Figure 7). -![figure 7](images/security-fig7-smartscreenfilter.png) +![SmartScreen Filter at work in Windows 10](images/security-fig7-smartscreenfilter.png "SmartScreen Filter at work in Windows 10") Figure 7. The SmartScreen Filter at work in Windows 10 By default, users have the option to bypass SmartScreen Filter protection so that it will not prevent a user from running a legitimate app. You can use Control Panel or Group Policy settings to disable the SmartScreen Filter or to completely prevent users from running apps that the SmartScreen Filter does not recognize. The Control Panel settings are shown in Figure 8. -![figure 8](images/security-fig8-smartscreenconfig.png) +![SmartScreen configuration options](images/security-fig8-smartscreenconfig.png "SmartScreen configuration options") Figure 8. The Windows SmartScreen configuration options in Control Panel If you want to try the SmartScreen Filter, use Windows 7 to download this simulated (but not dangerous) malware file:[freevideo.exe](http://go.microsoft.com/fwlink/p/?LinkId=626943). Save it to your computer, and then run it from Windows Explorer. As shown in Figure 9, Windows runs the app without much warning. In Windows 7, you might receive a warning message about the app not having a certificate, but you can easily bypass it. -![figure 9](images/security-fig9-windows7allow.png) +![Windows 7 allows the app to run](images/security-fig9-windows7allow.png "Windows 7 allows the app to run") Figure 9. Windows 7 allows the app to run Now, repeat the test on a computer running Windows 10 by copying the file to a Windows 10 PC or by downloading the file again and saving it to your local computer. Run the file directly from File Explorer, and the SmartScreen Filter will warn you before it allows it to run. Microsoft’s data shows that for a vast majority of users, that extra warning is enough to save them from a malware infection. -**Universal Windows apps** +### Universal Windows apps The good news is that the download and use of Universal Windows apps or even Windows Classic applications (Win32) from the Windows Store will dramatically reduce the likelihood that you encounter malware on your PC because all apps go through a careful screening process before being made available in the store. Apps that organizations build and distribute through sideloading processes will need to be reviewed internally to ensure that they meet organizational security requirements. Regardless of how users acquire Universal Windows apps, they can use them with increased confidence. Unlike Windows Classic applications, which can run with elevated privileges and have potentially sweeping access to the system and data, Universal Windows apps run in an AppContainer sandbox with limited privileges and capabilities. For example, Universal Windows apps have no system-level access, have tightly controlled interactions with other apps, and have no access to data unless the user explicitly grants the application permission. + In addition, all Universal Windows apps follow the security principle of least privilege. Apps receive only the minimum privileges they need to perform their legitimate tasks, so even if an attacker exploits an app, the damage the exploit can do is severely limited and should be contained within the sandbox. The Windows Store displays the exact capabilities the app requires (for example, access to the camera), along with the app’s age rating and publisher. + In the end, the Windows Store app distribution process and the app sandboxing capabilities of Windows 10 will dramatically reduce the likelihood that users encounter malicious apps on the system. -**Windows Defender** +### Windows Defender Antimalware software, also generically called virus scanners, antivirus, and a host of other names, has been around for a long time. Microsoft shipped its first program in this category, Microsoft Anti-Virus, in 1993 for MS DOS 6.0. At the time, the approach of running a standalone MS DOS program to locate and remove viruses was sufficient. @@ -720,9 +759,9 @@ Figure 10. Windows Defender opt-in settings in Windows 10 Of course, system administrators have centralized control of all Windows Defender settings through Group Policy. The Windows Defender configuration settings are shown under Computer Configuration/Windows Components/Windows Defender, as shown in Figure 11. -![figure 11](images/security-fig11-defendersettings.png) +![Windows Defender settings in Group Policy](images/security-fig11-defendersettings.png "Windows Defender settings in Group Policy") -Figure 11. Windows Defender settings in Group Policy– the sample submission options are listed under MAPS +Figure 11. Windows Defender settings in Group Policy – the sample submission options are listed under MAPS **Tamper proofing** is the safeguarding of Windows Defender itself against malware attacks. Malware creators assume that antimalware software is implemented on most PCs. Many malware creators choose to overcome that obstacle by designing malware that modifies the antimalware software in some way, such as disabling real-time scanning or by hiding specific processes. Some malware goes as far as completely disabling the antimalware software while making it appear fully functional to the user. @@ -730,11 +769,12 @@ Windows Defender is designed to resist tampering; it uses several security techn **Empowerment of IT security professionals** means that Windows Defender gives IT pros the tools and configuration options necessary to make it an enterprise-class antimalware solution. It has numerous enterprise-level features that put it on par with the top products in this category: -- Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. -- Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. -- It includes integrated classic command-line and Windows PowerShell cmdlet support. -- Support for Windows Management Instrumentation reporting and application management is built in. -- Full integration with Group Policy offers complete IT configuration management. + +* Integration with centralized management software, including Microsoft Intune, System Center Configuration Manager, and Microsoft System Center Operations Manager. Unlike Windows 8.1, no additional client is necessary, because Windows Defender is now integrated into Windows and only a management layer needs to be added. +* Windows Defender supports the Open Mobile Alliance Device Management standard for centralized management by many non-Microsoft device management solutions. +* It includes integrated classic command-line and Windows PowerShell cmdlet support. +* Support for Windows Management Instrumentation reporting and application management is built in. +* Full integration with Group Policy offers complete IT configuration management. In addition, Windows Defender now integrates the Windows Defender Offline Tool, which formerly required the creation of a bootable, standalone version of Windows Defender into the Windows Recovery Environment. This simplifies the process of remediating low-level malware infections, which may prove difficult to detect and remove with the antimalware solution running on the Windows desktop. You can update signatures for this environment automatically from within the Windows Defender Offline experience. @@ -747,7 +787,7 @@ Another security threat that customers face particularly in consumer and bring y Whenever non-Microsoft real-time protection is in an inoperable state (for example, disabled, expired) for 24 hours, Windows Defender automatically turns on to ensure that the device is protected. Windows attempts to help the user remediate the issue with the non-Microsoft antimalware solution by notifying him or her as early as 5 days before the software expires. If the solution expires, Windows enables Windows Defender and continues to remind the user to renew the non-Microsoft solution. When the user updates or reactivates the solution, Windows Defender is automatically disabled. In the end, the goal is to make sure that an operable antimalware solution is running at all times. -## Conclusion +#### Conclusion Windows 10 is the culmination of many years of effort from Microsoft, and its impact from a security perspective will be significant. Many of us still remember the years of Windows XP, when the attacks on the Windows operating system, applications, and data increased in volume and matured into serious threats. With the existing platforms and security solutions that you’ve likely deployed, you’re better defended than ever. But as attackers have become more advanced, there is no doubt that they have exceeded your ability to defend your organization and users. Evidence of this fact can be found in the news virtually every day as yet another major organization falls victim. Microsoft specifically designed Windows 10 to address these modern threats and tactics from the most advanced adversaries. It can truly change the game for your organization, and it can restore your advantage against those would like to make you their next victim. diff --git a/windows/keep-secure/windows-defender-advanced-threat-protection.md b/windows/keep-secure/windows-defender-advanced-threat-protection.md index bf62da150c..01fccfad1a 100644 --- a/windows/keep-secure/windows-defender-advanced-threat-protection.md +++ b/windows/keep-secure/windows-defender-advanced-threat-protection.md @@ -15,7 +15,7 @@ localizationpriority: high **Applies to:** -- Windows 10 Enterprise, let's change back +- Windows 10 Enterprise - Windows 10 Enterprise for Education - Windows 10 Pro - Windows 10 Pro Education diff --git a/windows/manage/TOC.md b/windows/manage/TOC.md index 15f4e3b2bf..1eee1f803e 100644 --- a/windows/manage/TOC.md +++ b/windows/manage/TOC.md @@ -1,6 +1,22 @@ # [Manage and update Windows 10](index.md) ## [Administrative Tools in Windows 10](administrative-tools-in-windows-10.md) ## [Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md) +## [Update Windows 10 in the enterprise](waas-update-windows-10.md) +### [Overview of Windows as a service](waas-overview.md) +### [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +### [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +### [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +### [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +#### [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +#### [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +### [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +### [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +#### [Configure Windows Update for Business](waas-configure-wufb.md) +#### [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +#### [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +#### [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +### [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +### [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) ## [Manage corporate devices](manage-corporate-devices.md) ### [Connect to remote Azure Active Directory-joined PC](connect-to-remote-aadj-pc.md) ### [Manage Windows 10 and Windows Store tips, tricks, and suggestions](manage-tips-and-suggestions.md) @@ -16,6 +32,7 @@ ### [Customize Windows 10 Start and taskbar with Group Policy](customize-windows-10-start-screens-by-using-group-policy.md) ### [Customize Windows 10 Start and taskbar with ICD and provisioning packages](customize-windows-10-start-screens-by-using-provisioning-packages-and-icd.md) ### [Customize Windows 10 Start with mobile device management (MDM)](customize-windows-10-start-screens-by-using-mobile-device-management.md) +## [Create mandatory user profiles](mandatory-user-profile.md) ## [Lock down Windows 10](lock-down-windows-10.md) ### [Lockdown features from Windows Embedded 8.1 Industry](lockdown-features-windows-10.md) ### [Set up a shared or guest PC with Windows 10](set-up-shared-or-guest-pc.md) @@ -34,7 +51,6 @@ ### [Reset a Windows 10 Mobile device](reset-a-windows-10-mobile-device.md) ## [Join Windows 10 Mobile to Azure Active Directory](join-windows-10-mobile-to-azure-active-directory.md) ## [Configure devices without MDM](configure-devices-without-mdm.md) -## [Windows 10 servicing options](introduction-to-windows-10-servicing.md) ## [Application Virtualization (App-V) for Windows](appv-for-windows.md) ### [Getting Started with App-V](appv-getting-started.md) #### [What's new in App-V](appv-about-appv.md) diff --git a/windows/manage/application-development-for-windows-as-a-service.zip b/windows/manage/application-development-for-windows-as-a-service.zip new file mode 100644 index 0000000000..7ae85a8f22 Binary files /dev/null and b/windows/manage/application-development-for-windows-as-a-service.zip differ diff --git a/windows/manage/appv-application-publishing-and-client-interaction.md b/windows/manage/appv-application-publishing-and-client-interaction.md index 31ace970ff..ca6912ebd6 100644 --- a/windows/manage/appv-application-publishing-and-client-interaction.md +++ b/windows/manage/appv-application-publishing-and-client-interaction.md @@ -23,8 +23,8 @@ The Sequencer creates App-V packages and produces a virtualized application. The --++ diff --git a/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md b/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md index 820826c881..084189822a 100644 --- a/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md +++ b/windows/manage/appv-enable-reporting-on-the-appv-client-with-powershell.md @@ -24,8 +24,8 @@ Use the following procedure to configure the App-V for reporting.
- - + + diff --git a/windows/manage/appv-performance-guidance.md b/windows/manage/appv-performance-guidance.md index f00ba32b3a..5c2f1c51a3 100644 --- a/windows/manage/appv-performance-guidance.md +++ b/windows/manage/appv-performance-guidance.md @@ -247,7 +247,7 @@ The following table displays the required steps to prepare the base image and th diff --git a/windows/manage/change-history-for-manage-and-update-windows-10.md b/windows/manage/change-history-for-manage-and-update-windows-10.md index 340f28cdea..f43d1438fa 100644 --- a/windows/manage/change-history-for-manage-and-update-windows-10.md +++ b/windows/manage/change-history-for-manage-and-update-windows-10.md @@ -17,9 +17,12 @@ This topic lists new and updated topics in the [Manage and update Windows 10](in | New or changed topic | Description | | --- | --- | +| [Create mandatory user profiles](mandatory-user-profile.md) | New | +| [Update Windows 10 in the enterprise](waas-update-windows-10.md) | New section | | [Configure Windows 10 taskbar](configure-windows-10-taskbar.md) | Updated sample XML for combined Start and taskbar layout; added note to explain the difference between applying taskbar configuration by Group Policy and by provisioning package | | [Set up a kiosk on Windows 10 Pro, Enterprise, or Education](set-up-a-kiosk-for-windows-10-for-desktop-editions.md) | Updated instructions for exiting assigned access mode. | | Application development for Windows as a service | Topic moved to MSDN: [Application development for Windows as a service](https://msdn.microsoft.com/windows/uwp/get-started/application-development-for-windows-as-a-service) +| Windows 10 servicing options | New content replaced this topic; see [Overview of Windows as a service](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview) | ## RELEASE: Windows 10, version 1607 diff --git a/windows/manage/diagnostics-for-mdm-devices.md b/windows/manage/diagnostics-for-mdm-devices.md deleted file mode 100644 index 32998541e9..0000000000 --- a/windows/manage/diagnostics-for-mdm-devices.md +++ /dev/null @@ -1,102 +0,0 @@ ---- -title: Diagnostics for Windows 10 devices (Windows 10) -description: Device Policy State log in Windows 10, Version 1607, collects info about policies. -keywords: ["mdm", "udiag", "device policy", "mdmdiagnostics"] -ms.prod: W10 -ms.mktglfcycl: manage -ms.sitesec: library -author: jdeckerMS ---- - -# Diagnostics for Windows 10 devices - -**Applies to** - -- Windows 10 -- Windows 10 Mobile - -(which SKUs?) - -(this isn't really MDM-managed only, is it? It can be done locally/email?) - -Two new diagnostic tools for Windows 10, version 1607, help IT administrators diagnose and resolve issues with remote devices enrolled in mobile device management (MDM): the [Device Policy State Log](#device-policy-state-log) and [UDiag](#udiag). Windows 10 for desktop editions and Windows 10 Mobile make it simple for users to export log files that you can then analyze with these tools. - -## Export management log files - -Go to **Settings > Accounts > Work access > Export your management log files**. - -![Export your management log files](images/export-mgt-desktop.png) - -- On desktop devices, the file is saved to C:/Users/Public/Public Documents/MDMDiagnostics/MDMDiagReport.xml -- On phones, the file is saved to *phone*/Documents/MDMDiagnostics/MDMDiagReport.xml - -The MDMDiagReport.xml can be used with [Device Policy State Log](#device-policy-state-log) and [UDiag](#udiag) to help you resolve issues. - -## Device Policy State Log - -The Device Policy State Log collects information on the state of policies applied to the device to help you determine which sources are applying policies or configurations to the device. Help desk personnel can use this log to diagnose and resolve issues with a remote device. - -After you obtain the management log file from the user's device, run the mdmReportGenerator.ps1 script on log to create report. (download mdmReportGenerator.ps1 and mdmDiagnoseHelpers.psm1) This PowerShell script asks you to enter the name of the management log file and a name for the report that it will create, as shown in the following example: - -![Enter file name for input and output](images/mdm-diag-report-powershell.png) - -The script produces the report in html format. There are two sections to the report, Configuration and Policy Information. - - The configuration section lists the GUID of the sources that are applying configurations to the device. - - ![Configuration source Exachange ActiveSync](images/config-source.png) - -The policy information section displays information about the specific policies that are being enforced and on the device. For each policy, you will see the Area grouping, the Policy name, its default and current value, and the configuration source. You can compare the configuration source GUID in the policy information section to the GUIDs in the configuration section to identify the source of the policy. - -![Policies applied by a configuration source](images/config-policy.png) - - -## UDiag - -The UDiag tool applies rules to Event Tracing for Windows (ETW) files to help determine the root cause of an issue. - -(download UDiag) - -To analyze MDMDiagReport.xml using UDiag -1. Open UDiag, and select Device Management. -2. Select your source for the log files ("cab of logs" or "directory of logs") - -Investigating log content, identifying patterns, and adding a root cause analysis to the database (Advanced users/providers) - -1. While at the 'Root Causes List' panel, click the 'Diagnose' button at the bottom. -2. You will then be brought to the Diagnosis panel where you can investigate and tag root causes from the content - - Evidence Groups: When a set of logs are loaded into UDiag, the contents are processed (e.g. ETW) and organized into evidence groups. - - Decision Tree View: This view shows the loaded decision tree for the current topic/topic area. When a decision node is selected, a user can modify the regular expression and add/edit/delete an RCA for that node. Any RCA matches found in the current log set will have an 'RCA' label that is either Red or Yellow. - - Evidence View: Selecting an evidence group loads its content into this evidence view. Use this view to investigate issues and determine root causes. Drag and drop lines from the Evidence View into the Decision Tree View, to build your root cause analysis pattern. ([Learn more about techniques for root cause analysis.](https://technet.microsoft.com/en-us/library/cc543298.aspx)) - - - - - - Can admin pull logs without user action? [DK] Yes via the diagnostic log CSP - - - - "Run PowerShell script to process the file" – is that the user doing it? How can this workflow work in an enterprise where employees aren't computer-savvy? [DK] This is intended to be done by the help desk guy. - - Where did (user|admin) get mdmReportGenerator.ps1? [DK] Publishing on DLC later this summer - - In Viewing the report, how does the admin make sense of the source GUIDs? [DK] Correlates the value in the table with the entries at the top of the page. - - UDiag – where does admin get this? [DK] Publishing on DLC later this summer - - Can admins create custom rule sets? [DK] Right now, no. but open to feedback on this. - - - -Link to [Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120%28v=vs.85%29.aspx) - -[Diagnostics capability for devices managed by any MDM provider.](https://microsoft.sharepoint.com/teams/osg_core_ens/mgmt/OSMan Wiki/MDM Diagnostics - Generating and Processing Log files.aspx) - -[Redstone spec](https://microsoft.sharepoint.com/teams/specstore/_layouts/15/WopiFrame.aspx?sourcedoc=%7b7E8742A2-03A1-451C-BA07-F2573B044CBF%7d&file=DM%20-%20MDM%20Diagnostics-RS.docx&action=default&DefaultItemOpen=1) - -## Related topics - -[DiagnosticLog CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/mt219118.aspx) - -[Diagnose MDM failures in Windows 10](https://msdn.microsoft.com/en-us/library/windows/hardware/mt632120.aspx) \ No newline at end of file diff --git a/windows/manage/group-policies-for-enterprise-and-education-editions.md b/windows/manage/group-policies-for-enterprise-and-education-editions.md index 37005acc03..40c5250e62 100644 --- a/windows/manage/group-policies-for-enterprise-and-education-editions.md +++ b/windows/manage/group-policies-for-enterprise-and-education-editions.md @@ -1,6 +1,6 @@ --- -title: Group Policies that apply only to Windows 10 Enterprise and Education Editions (Windows 10) -description: Use this topic to learn about Group Policy objects that apply only to Windows 10 Enterprise and Windows 10 Education. +title: Group Policy settings that apply only to Windows 10 Enterprise and Education Editions (Windows 10) +description: Use this topic to learn about Group Policy settings that apply only to Windows 10 Enterprise and Windows 10 Education. ms.prod: w10 ms.mktglfcycl: manage ms.sitesec: library @@ -8,13 +8,13 @@ author: brianlic-msft localizationpriority: high --- -# Group Policies that apply only to Windows 10 Enterprise and Education Editions +# Group Policy settings that apply only to Windows 10 Enterprise and Education Editions **Applies to** - Windows 10 -In Windows 10, version 1607, the following Group Policies apply only to Windows 10 Enterprise and Windows 10 Education. +In Windows 10, version 1607, the following Group Policy settings apply only to Windows 10 Enterprise and Windows 10 Education. | Policy name | Policy path | Comments | | --- | --- | --- | diff --git a/windows/manage/images/checklistbox.gif b/windows/manage/images/checklistbox.gif index 8af13c51d1..44cf17b07b 100644 Binary files a/windows/manage/images/checklistbox.gif and b/windows/manage/images/checklistbox.gif differ diff --git a/windows/manage/images/checklistdone.png b/windows/manage/images/checklistdone.png new file mode 100644 index 0000000000..7e53f74d0e Binary files /dev/null and b/windows/manage/images/checklistdone.png differ diff --git a/windows/manage/images/copy-to-change.png b/windows/manage/images/copy-to-change.png new file mode 100644 index 0000000000..21aa250c0c Binary files /dev/null and b/windows/manage/images/copy-to-change.png differ diff --git a/windows/manage/images/copy-to-path.png b/windows/manage/images/copy-to-path.png new file mode 100644 index 0000000000..1ef00fc86b Binary files /dev/null and b/windows/manage/images/copy-to-path.png differ diff --git a/windows/manage/images/copy-to.PNG b/windows/manage/images/copy-to.PNG new file mode 100644 index 0000000000..dad84cedc8 Binary files /dev/null and b/windows/manage/images/copy-to.PNG differ diff --git a/windows/manage/images/gp-branch.png b/windows/manage/images/gp-branch.png new file mode 100644 index 0000000000..997bcc830a Binary files /dev/null and b/windows/manage/images/gp-branch.png differ diff --git a/windows/manage/images/gp-exclude-drivers.png b/windows/manage/images/gp-exclude-drivers.png new file mode 100644 index 0000000000..0010749139 Binary files /dev/null and b/windows/manage/images/gp-exclude-drivers.png differ diff --git a/windows/manage/images/gp-feature.png b/windows/manage/images/gp-feature.png new file mode 100644 index 0000000000..b862d545d4 Binary files /dev/null and b/windows/manage/images/gp-feature.png differ diff --git a/windows/manage/images/gp-quality.png b/windows/manage/images/gp-quality.png new file mode 100644 index 0000000000..d7ff30172d Binary files /dev/null and b/windows/manage/images/gp-quality.png differ diff --git a/windows/manage/images/sysprep-error.png b/windows/manage/images/sysprep-error.png new file mode 100644 index 0000000000..aa004efbb6 Binary files /dev/null and b/windows/manage/images/sysprep-error.png differ diff --git a/windows/manage/images/waas-do-fig1.png b/windows/manage/images/waas-do-fig1.png new file mode 100644 index 0000000000..e739d0b670 Binary files /dev/null and b/windows/manage/images/waas-do-fig1.png differ diff --git a/windows/manage/images/waas-do-fig2.png b/windows/manage/images/waas-do-fig2.png new file mode 100644 index 0000000000..0c315fddaa Binary files /dev/null and b/windows/manage/images/waas-do-fig2.png differ diff --git a/windows/manage/images/waas-do-fig3.png b/windows/manage/images/waas-do-fig3.png new file mode 100644 index 0000000000..66ac342b51 Binary files /dev/null and b/windows/manage/images/waas-do-fig3.png differ diff --git a/windows/manage/images/waas-do-fig4.png b/windows/manage/images/waas-do-fig4.png new file mode 100644 index 0000000000..3de9605bac Binary files /dev/null and b/windows/manage/images/waas-do-fig4.png differ diff --git a/windows/manage/images/waas-overview-patch.png b/windows/manage/images/waas-overview-patch.png new file mode 100644 index 0000000000..b16c211c59 Binary files /dev/null and b/windows/manage/images/waas-overview-patch.png differ diff --git a/windows/manage/images/waas-overview-timeline.png b/windows/manage/images/waas-overview-timeline.png new file mode 100644 index 0000000000..8488b2b680 Binary files /dev/null and b/windows/manage/images/waas-overview-timeline.png differ diff --git a/windows/manage/images/waas-rings.png b/windows/manage/images/waas-rings.png new file mode 100644 index 0000000000..a5446f3dff Binary files /dev/null and b/windows/manage/images/waas-rings.png differ diff --git a/windows/manage/images/waas-sccm-fig1.png b/windows/manage/images/waas-sccm-fig1.png new file mode 100644 index 0000000000..7557888301 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig1.png differ diff --git a/windows/manage/images/waas-sccm-fig10.png b/windows/manage/images/waas-sccm-fig10.png new file mode 100644 index 0000000000..b029618b67 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig10.png differ diff --git a/windows/manage/images/waas-sccm-fig11.png b/windows/manage/images/waas-sccm-fig11.png new file mode 100644 index 0000000000..fc6528e7ef Binary files /dev/null and b/windows/manage/images/waas-sccm-fig11.png differ diff --git a/windows/manage/images/waas-sccm-fig12.png b/windows/manage/images/waas-sccm-fig12.png new file mode 100644 index 0000000000..87464dd5f1 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig12.png differ diff --git a/windows/manage/images/waas-sccm-fig2.png b/windows/manage/images/waas-sccm-fig2.png new file mode 100644 index 0000000000..a1d7183a7c Binary files /dev/null and b/windows/manage/images/waas-sccm-fig2.png differ diff --git a/windows/manage/images/waas-sccm-fig3.png b/windows/manage/images/waas-sccm-fig3.png new file mode 100644 index 0000000000..cd406d9c5d Binary files /dev/null and b/windows/manage/images/waas-sccm-fig3.png differ diff --git a/windows/manage/images/waas-sccm-fig4.png b/windows/manage/images/waas-sccm-fig4.png new file mode 100644 index 0000000000..782c5ca6ef Binary files /dev/null and b/windows/manage/images/waas-sccm-fig4.png differ diff --git a/windows/manage/images/waas-sccm-fig5.png b/windows/manage/images/waas-sccm-fig5.png new file mode 100644 index 0000000000..5f215dec58 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig5.png differ diff --git a/windows/manage/images/waas-sccm-fig6.png b/windows/manage/images/waas-sccm-fig6.png new file mode 100644 index 0000000000..bd7df6f6d2 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig6.png differ diff --git a/windows/manage/images/waas-sccm-fig7.png b/windows/manage/images/waas-sccm-fig7.png new file mode 100644 index 0000000000..5b7c37b6a1 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig7.png differ diff --git a/windows/manage/images/waas-sccm-fig8.png b/windows/manage/images/waas-sccm-fig8.png new file mode 100644 index 0000000000..1db4dae84a Binary files /dev/null and b/windows/manage/images/waas-sccm-fig8.png differ diff --git a/windows/manage/images/waas-sccm-fig9.png b/windows/manage/images/waas-sccm-fig9.png new file mode 100644 index 0000000000..632b859232 Binary files /dev/null and b/windows/manage/images/waas-sccm-fig9.png differ diff --git a/windows/manage/images/waas-strategy-fig1.png b/windows/manage/images/waas-strategy-fig1.png new file mode 100644 index 0000000000..c12cc660de Binary files /dev/null and b/windows/manage/images/waas-strategy-fig1.png differ diff --git a/windows/manage/images/waas-wsus-fig1.png b/windows/manage/images/waas-wsus-fig1.png new file mode 100644 index 0000000000..1d0dd4cc6b Binary files /dev/null and b/windows/manage/images/waas-wsus-fig1.png differ diff --git a/windows/manage/images/waas-wsus-fig10.png b/windows/manage/images/waas-wsus-fig10.png new file mode 100644 index 0000000000..fe9f6a6447 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig10.png differ diff --git a/windows/manage/images/waas-wsus-fig11.png b/windows/manage/images/waas-wsus-fig11.png new file mode 100644 index 0000000000..0ad08f70c2 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig11.png differ diff --git a/windows/manage/images/waas-wsus-fig12.png b/windows/manage/images/waas-wsus-fig12.png new file mode 100644 index 0000000000..fa9fb5c7a4 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig12.png differ diff --git a/windows/manage/images/waas-wsus-fig13.png b/windows/manage/images/waas-wsus-fig13.png new file mode 100644 index 0000000000..d2e916dc48 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig13.png differ diff --git a/windows/manage/images/waas-wsus-fig14.png b/windows/manage/images/waas-wsus-fig14.png new file mode 100644 index 0000000000..a0c8e30736 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig14.png differ diff --git a/windows/manage/images/waas-wsus-fig15.png b/windows/manage/images/waas-wsus-fig15.png new file mode 100644 index 0000000000..fd59e9ce23 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig15.png differ diff --git a/windows/manage/images/waas-wsus-fig16.png b/windows/manage/images/waas-wsus-fig16.png new file mode 100644 index 0000000000..57a34228d9 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig16.png differ diff --git a/windows/manage/images/waas-wsus-fig17.png b/windows/manage/images/waas-wsus-fig17.png new file mode 100644 index 0000000000..13e755e456 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig17.png differ diff --git a/windows/manage/images/waas-wsus-fig18.png b/windows/manage/images/waas-wsus-fig18.png new file mode 100644 index 0000000000..0b13e936fb Binary files /dev/null and b/windows/manage/images/waas-wsus-fig18.png differ diff --git a/windows/manage/images/waas-wsus-fig19.png b/windows/manage/images/waas-wsus-fig19.png new file mode 100644 index 0000000000..b67d17a56e Binary files /dev/null and b/windows/manage/images/waas-wsus-fig19.png differ diff --git a/windows/manage/images/waas-wsus-fig2.png b/windows/manage/images/waas-wsus-fig2.png new file mode 100644 index 0000000000..ff273ea10f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig2.png differ diff --git a/windows/manage/images/waas-wsus-fig20.png b/windows/manage/images/waas-wsus-fig20.png new file mode 100644 index 0000000000..58fa43444f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig20.png differ diff --git a/windows/manage/images/waas-wsus-fig3.png b/windows/manage/images/waas-wsus-fig3.png new file mode 100644 index 0000000000..1247e2f874 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig3.png differ diff --git a/windows/manage/images/waas-wsus-fig4.png b/windows/manage/images/waas-wsus-fig4.png new file mode 100644 index 0000000000..9fbc673814 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig4.png differ diff --git a/windows/manage/images/waas-wsus-fig5.png b/windows/manage/images/waas-wsus-fig5.png new file mode 100644 index 0000000000..7068f487cd Binary files /dev/null and b/windows/manage/images/waas-wsus-fig5.png differ diff --git a/windows/manage/images/waas-wsus-fig6.png b/windows/manage/images/waas-wsus-fig6.png new file mode 100644 index 0000000000..6256f5d617 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig6.png differ diff --git a/windows/manage/images/waas-wsus-fig7.png b/windows/manage/images/waas-wsus-fig7.png new file mode 100644 index 0000000000..69d3e6fe6f Binary files /dev/null and b/windows/manage/images/waas-wsus-fig7.png differ diff --git a/windows/manage/images/waas-wsus-fig8.png b/windows/manage/images/waas-wsus-fig8.png new file mode 100644 index 0000000000..8ec17f2741 Binary files /dev/null and b/windows/manage/images/waas-wsus-fig8.png differ diff --git a/windows/manage/images/waas-wsus-fig9.png b/windows/manage/images/waas-wsus-fig9.png new file mode 100644 index 0000000000..dd430897ff Binary files /dev/null and b/windows/manage/images/waas-wsus-fig9.png differ diff --git a/windows/manage/images/waas-wufb-gp-broad.png b/windows/manage/images/waas-wufb-gp-broad.png new file mode 100644 index 0000000000..9fdd9e97f1 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-broad.png differ diff --git a/windows/manage/images/waas-wufb-gp-cb2-settings.png b/windows/manage/images/waas-wufb-gp-cb2-settings.png new file mode 100644 index 0000000000..97dc6ce41a Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cb2-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cb2.png b/windows/manage/images/waas-wufb-gp-cb2.png new file mode 100644 index 0000000000..9be7638ed7 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cb2.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb1-settings.png b/windows/manage/images/waas-wufb-gp-cbb1-settings.png new file mode 100644 index 0000000000..dae9866faf Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb1-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb2-settings.png b/windows/manage/images/waas-wufb-gp-cbb2-settings.png new file mode 100644 index 0000000000..2aa7bc212c Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb2-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-cbb2q-settings.png b/windows/manage/images/waas-wufb-gp-cbb2q-settings.png new file mode 100644 index 0000000000..8076b5a99e Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-cbb2q-settings.png differ diff --git a/windows/manage/images/waas-wufb-gp-create.png b/windows/manage/images/waas-wufb-gp-create.png new file mode 100644 index 0000000000..63c2ce74aa Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-create.png differ diff --git a/windows/manage/images/waas-wufb-gp-edit-defer.png b/windows/manage/images/waas-wufb-gp-edit-defer.png new file mode 100644 index 0000000000..40da5b7709 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-edit-defer.png differ diff --git a/windows/manage/images/waas-wufb-gp-edit.png b/windows/manage/images/waas-wufb-gp-edit.png new file mode 100644 index 0000000000..e39bc829ff Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-edit.png differ diff --git a/windows/manage/images/waas-wufb-gp-scope-cb2.png b/windows/manage/images/waas-wufb-gp-scope-cb2.png new file mode 100644 index 0000000000..bb29adf5e1 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-scope-cb2.png differ diff --git a/windows/manage/images/waas-wufb-gp-scope.png b/windows/manage/images/waas-wufb-gp-scope.png new file mode 100644 index 0000000000..b8e6863c82 Binary files /dev/null and b/windows/manage/images/waas-wufb-gp-scope.png differ diff --git a/windows/manage/images/waas-wufb-intune-cb2.png b/windows/manage/images/waas-wufb-intune-cb2.png new file mode 100644 index 0000000000..3e8c1ce19e Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cb2.png differ diff --git a/windows/manage/images/waas-wufb-intune-cbb1.png b/windows/manage/images/waas-wufb-intune-cbb1.png new file mode 100644 index 0000000000..6f1e815334 Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cbb1.png differ diff --git a/windows/manage/images/waas-wufb-intune-cbb2.png b/windows/manage/images/waas-wufb-intune-cbb2.png new file mode 100644 index 0000000000..b8eef5bb5e Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-cbb2.png differ diff --git a/windows/manage/images/waas-wufb-intune-step11.png b/windows/manage/images/waas-wufb-intune-step11.png new file mode 100644 index 0000000000..48db2f63af Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step11.png differ diff --git a/windows/manage/images/waas-wufb-intune-step19.png b/windows/manage/images/waas-wufb-intune-step19.png new file mode 100644 index 0000000000..5a68ca7211 Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step19.png differ diff --git a/windows/manage/images/waas-wufb-intune-step2.png b/windows/manage/images/waas-wufb-intune-step2.png new file mode 100644 index 0000000000..1c7a8a1cae Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step2.png differ diff --git a/windows/manage/images/waas-wufb-intune-step7.png b/windows/manage/images/waas-wufb-intune-step7.png new file mode 100644 index 0000000000..daa96ba18c Binary files /dev/null and b/windows/manage/images/waas-wufb-intune-step7.png differ diff --git a/windows/manage/images/wufb-config1.png b/windows/manage/images/wufb-config1.png new file mode 100644 index 0000000000..76185e86fe Binary files /dev/null and b/windows/manage/images/wufb-config1.png differ diff --git a/windows/manage/images/wufb-config2.png b/windows/manage/images/wufb-config2.png new file mode 100644 index 0000000000..0ab09d4868 Binary files /dev/null and b/windows/manage/images/wufb-config2.png differ diff --git a/windows/manage/images/wufb-config3.png b/windows/manage/images/wufb-config3.png new file mode 100644 index 0000000000..a76d1569be Binary files /dev/null and b/windows/manage/images/wufb-config3.png differ diff --git a/windows/manage/images/wufb-do.png b/windows/manage/images/wufb-do.png new file mode 100644 index 0000000000..8d6c9d0b8a Binary files /dev/null and b/windows/manage/images/wufb-do.png differ diff --git a/windows/manage/images/wufb-groups.png b/windows/manage/images/wufb-groups.png new file mode 100644 index 0000000000..13cdea04b0 Binary files /dev/null and b/windows/manage/images/wufb-groups.png differ diff --git a/windows/manage/images/wufb-pause-feature.png b/windows/manage/images/wufb-pause-feature.png new file mode 100644 index 0000000000..afeac43e29 Binary files /dev/null and b/windows/manage/images/wufb-pause-feature.png differ diff --git a/windows/manage/images/wufb-qual.png b/windows/manage/images/wufb-qual.png new file mode 100644 index 0000000000..4a93408522 Binary files /dev/null and b/windows/manage/images/wufb-qual.png differ diff --git a/windows/manage/images/wufb-sccm.png b/windows/manage/images/wufb-sccm.png new file mode 100644 index 0000000000..1d568c1fe4 Binary files /dev/null and b/windows/manage/images/wufb-sccm.png differ diff --git a/windows/manage/index.md b/windows/manage/index.md index 2996b55b2f..28c3d13437 100644 --- a/windows/manage/index.md +++ b/windows/manage/index.md @@ -31,10 +31,9 @@ Learn about managing and updating Windows 10. - - + - + @@ -44,6 +43,7 @@ Learn about managing and updating Windows 10. + @@ -57,10 +57,6 @@ Learn about managing and updating Windows 10. - - - - diff --git a/windows/manage/introduction-to-windows-10-servicing.md b/windows/manage/introduction-to-windows-10-servicing.md index ea13d5696b..cb9281365a 100644 --- a/windows/manage/introduction-to-windows-10-servicing.md +++ b/windows/manage/introduction-to-windows-10-servicing.md @@ -8,6 +8,7 @@ ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security, servicing author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/waas-update-windows-10 --- # Windows 10 servicing options diff --git a/windows/manage/mandatory-user-profile.md b/windows/manage/mandatory-user-profile.md new file mode 100644 index 0000000000..0fae89f325 --- /dev/null +++ b/windows/manage/mandatory-user-profile.md @@ -0,0 +1,171 @@ +--- +title: Create mandatory user profiles (Windows 10) +description: A mandatory user profile is a special type of pre-configured roaming user profile that administrators can use to specify settings for users. +keywords: [".man","ntuser"] +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +--- + +# Create mandatory user profiles + + +**Applies to** + +- Windows 10 + +> [!NOTE] +> When a mandatory profile is applied to a PC running Windows 10, version 1511, some features such as Universal Windows Platform (UWP) apps, the Start menu, Cortana, and Search, will not work correctly. This will be fixed in a future update. + +A mandatory user profile is a roaming user profile that has been pre-configured by an administrators to specify settings for users. Settings commonly defined in a mandatory profile include (but are not limited to): icons that appear on the desktop, desktop backgrounds, user preferences in Control Panel, printer selections, and more. Configuration changes made during a user's session that are normally saved to a roaming user profile are not saved when a mandatory user profile is assigned. + +Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings. Only system administrators can make changes to mandatory user profiles. + +When the server that stores the mandatory profile is unavailable, such as when the user is not connected to the corporate network, users with mandatory profiles can sign in with the locally cached copy of the mandatory profile, if one exists. Otherwise, the user will be signed in with a temporary profile. + +User profiles become mandatory profiles when the administrator renames the NTuser.dat file (the registry hive) of each user's profile in the file system of the profile server from `NTuser.dat` to `NTuser.man`. The `.man` extension causes the user profile to be a read-only profile. + + +## Profile extension for each Windows version + +The name of the folder in which you store the mandatory profile must use the correct extension for the operating system it will be applied to. The following table lists the correct extension for each operating system version. + +| Client operating system version | Server operating system version | Profile extension | +| --- | --- | --- | +| Windows XP | Windows Server 2003
Windows Server 2003 R2 | none | +| Windows Vista
Windows 7 | Windows Server 2008
Windows Server 2008 R2 | v2 | +| Windows 8 | Windows Server 2012 | v3 | +| Windows 8.1 | Windows Server 2012 R2 | v4 | +| Windows 10, versions 1507 and 1511 | Windows Server 2016 | v5 | +| Windows 10, version 1607 (also known as the Anniversary Update) | N/A | v6 | + +For more information, see [Deploy Roaming User Profiles, Appendix B](https://technet.microsoft.com/library/jj649079.aspx) and [Roaming user profiles versioning in Windows 10 and Windows Server Technical Preview](https://support.microsoft.com/kb/3056198). + +## How to create a mandatory user profile + +First, you create a default user profile with the customizations that you want, run Sysprep with CopyProfile set to **True** in the answer file, copy the customized default user profile to a network share, and then you rename the profile to make it mandatory. + +**To create a default user profile** + +1. Sign in to a computer running Windows 10 as a member of the local Administrator group. Do not use a domain account. + + > [!NOTE] + > Use a lab or extra computer running a clean installation of Windows 10 to create a default user profile. Do not use a computer that is required for business (that is, a production computer). This process removes all domain accounts from the computer, including user profile folders. + +2. Configure the computer settings that you want to include in the user profile. For example, you can configure settings for the desktop background, uninstall default apps, install line-of-business apps, and so on. + + >[!NOTE] + >Unlike previous versions of Windows, you cannot apply a Start and taskbar layout using a mandatory profile. For alternative methods for customizing the Start menu and taskbar, see [Related topics](#related-topics). + +3. [Create an answer file (Unattend.xml)](https://msdn.microsoft.com/library/windows/hardware/dn915085.aspx) that sets the [CopyProfile](https://msdn.microsoft.com/library/windows/hardware/dn922656.aspx) parameter to **True**. The CopyProfile parameter causes Sysprep to copy the currently signed-on user’s profile folder to the default user profile. You can use [Windows System Image Manager](https://msdn.microsoft.com/library/windows/hardware/dn922445.aspx), which is part of the Windows Assessment and Deployment Kit (ADK) to create the Unattend.xml file. + +3. Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the following applications: + + - Microsoft.windowscommunicationsapps_8wekyb3d8bbwe + - Microsoft.BingWeather_8wekyb3d8bbwe + - Microsoft.DesktopAppInstaller_8wekyb3d8bbwe + - Microsoft.Getstarted_8wekyb3d8bbwe + - Microsoft.Windows.Photos_8wekyb3d8bbwe + - Microsoft.WindowsCamera_8wekyb3d8bbwe + - Microsoft.WindowsFeedbackHub_8wekyb3d8bbwe + - Microsoft.WindowsStore_8wekyb3d8bbwe + - Microsoft.XboxApp_8wekyb3d8bbwe + - Microsoft.XboxIdentityProvider_8wekyb3d8bbwe + - Microsoft.ZuneMusic_8wekyb3d8bbwe + + >[!NOTE] + >Uninstalling these apps will decrease sign-in time. If your deployment needs any of these apps, you can leave them installed. + +3. At a command prompt, type the following command and press **ENTER**. + + `sysprep /oobe /reboot /generalize /unattend:unattend.xml` + + (Sysprep.exe is located at: C:\Windows\System32\sysprep. By default, Sysprep looks for unattend.xml in this same folder.) + + >[!TIP] + >If you receive an error message that says "Sysprep was not able to validate your Windows installation", open %WINDIR%\System32\Sysprep\Panther\setupact.log and look for an entry like the following: + + >![Microsoft Bing Translator package](images/sysprep-error.png) + + >Use the [Remove-AppxProvisionedPackage](https://technet.microsoft.com/library/dn376476%28v=wps.620%29.aspx) cmdlet in Windows PowerShell to uninstall the app that is listed in the log. + +5. The sysprep process reboots the PC and starts at the first-run experience screen. Complete the set up, and then sign in to the computer using an account that has local administrator privileges. + +6. Right-click Start, go to **Control Panel** (view by large or small icons) > **System** > **Advanced system settings**, and click **Settings** in the **User Profiles** section. + +7. In **User Profiles**, click **Default Profile**, and then click **Copy To**. + + ![Example of UI](images/copy-to.png) + +8. In **Copy To**, under **Permitted to use**, click **Change**. + + ![Example of UI](images/copy-to-change.png) + +9. In **Select User or Group**, in the **Enter the object name to select** field, type `everyone`, click **Check Names**, and then click **OK**. + +10. In **Copy To**, in the **Copy profile to** field, enter the path and folder name where you want to store the mandatory profile. The folder name must use the correct [extension](#extension) for the operating system version. For example, the folder name must end with “.v6” to identify it as a user profile folder for Windows 10, version 1607. + + - If the device is joined to the domain and you are signed in with an account that has permissions to write to a shared folder on the network, you can enter the shared folder path. + - If the device is not joined to the domain, you can save the profile locally and then copy it to the shared folder location. + + ![Example of UI](images/copy-to-path.png) + +9. Click **OK** to copy the default user profile. + + +**To make the user profile mandatory** + + +3. In File Explorer, open the folder where you stored the copy of the profile. + + >[!NOTE] + >If the folder is not displayed, click **View** > **Options** > **Change folder and search options**. On the **View** tab, select **Show hidden files and folders**, clear **Hide protected operating system files**, click **Yes** to confirm that you want to show operating system files, and then click **OK** to save your changes. + +1. Rename `Ntuser.dat` to `Ntuser.man`. + +## How to apply a mandatory user profile to users + +In a domain, you modify properties for the user account to point to the mandatory profile in a shared folder residing on the server. + +**To apply a mandatory user profile to users** + +1. Open **Active Directory Users and Computers** (dsa.msc). + +2. Navigate to the user account that you will assign the mandatory profile to. + +3. Right-click the user name and open **Properties**. + +4. On the **Profile** tab, in the **Profile path** field, enter the path to the shared folder without the extension. For example, if the folder name is \\\\*server*\profile.v6, you would enter \\\\*server*\profile. + +5. Click **OK**. + +It may take some time for this change to replicate to all domain controllers. + + + +## Apply policies to improve sign-in time + +When a user is configured with a mandatory profile, Windows 10 starts as though it was the first sign-in each time the user signs in. To improve sign-in performance for users with mandatory user profiles, apply the following Group Policy settings. + +- Computer Configuration > Administrative Templates > System > Logon > **Show first sign-in animation** = Disabled +- Computer Configuration > Administrative Templates > Windows Components > Search > **Allow Cortana** = Disabled +- Computer Configuration > Administrative Templates > Windows Components > Cloud Content > **Turn off Microsoft consumer experience** = Enabled + + + + + + + + + +## Related topics + +- [Manage Windows 10 Start layout and taskbar options](windows-10-start-layout-options-and-policies.md) +- [Lock down Windows 10 to specific apps](lock-down-windows-10-to-specific-apps.md) +- [Windows Spotlight on the lock screen](windows-spotlight.md) +- [Configure devices without MDM](configure-devices-without-mdm.md) + + + diff --git a/windows/manage/new-policies-for-windows-10.md b/windows/manage/new-policies-for-windows-10.md index 15b40a44f3..53f6c403d7 100644 --- a/windows/manage/new-policies-for-windows-10.md +++ b/windows/manage/new-policies-for-windows-10.md @@ -20,7 +20,7 @@ localizationpriority: high Windows 10 includes the following new policies for management, in addition to policies that were available for Windows 8.1 and Windows Phone 8.1. [Download the complete set of Administrative Template (.admx) files for Windows 10](http://go.microsoft.com/fwlink/p/?LinkID=625081). -## New GPOs in Windows 10 +## New Group Policy settings in Windows 10 There are some new policy settings in Group Policy for devices running Windows 10 , such as: diff --git a/windows/manage/waas-branchcache.md b/windows/manage/waas-branchcache.md new file mode 100644 index 0000000000..9bbd3db6e4 --- /dev/null +++ b/windows/manage/waas-branchcache.md @@ -0,0 +1,66 @@ +--- +title: Configure BranchCache for Windows 10 updates (Windows 10) +description: Use BranchCache to optimize network bandwidth during update deployment. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Configure BranchCache for Windows 10 updates + + +**Applies to** + +- Windows 10 + + +BranchCache is a bandwidth-optimization feature that has been available since the Windows Server 2008 R2 and Windows 7 operating systems. Each client has a cache and acts as an alternate source for content that devices on its own network request. Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to optimize network bandwidth during update deployment, and it’s easy to configure for either of them. BranchCache has two operating modes: Distributed Cache mode and Hosted Cache mode. + +- Distributed Cache mode operates like the [Delivery Optimization](waas-delivery-optimization.md) feature in Windows 10: each client contains a cached version of the BranchCache-enabled files it requests and acts as a distributed cache for other clients requesting that same file. + + >[!TIP] + >Distributed Cache mode is preferred to Hosted Cache mode for Windows 10 updates to get the most benefit from peer-to-peer distribution. + +- In Hosted Cache mode, designated servers at specific locations act as a cache for files requested by clients in its area. Then, rather than clients retrieving files from a latent source, the hosted cache server provides the content on its behalf. + +For detailed information about how Distributed Cache mode and Hosted Cache mode work, see [BranchCache Overview](https://technet.microsoft.com/library/dd637832(v=ws.10).aspx). + +## Configure clients for BranchCache + +Whether you use BranchCache with Configuration Manager or WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see [Client Configuration](https://technet.microsoft.com/library/dd637820%28v=ws.10%29.aspx) in the [BranchCache Early Adopter’s Guide](https://technet.microsoft.com/library/dd637762(v=ws.10).aspx). + +Whether you use BranchCache with Configuration Manager or with WSUS, each client that uses BranchCache must be configured to do so. You typically make your configurations through Group Policy. For step-by-step instructions on how to use Group Policy to configure BranchCache for Windows clients, see Client Configuration in the BranchCache Early Adopter’s Guide. + +In Windows 10, version 1607, the Windows Update Agent uses Delivery Optimization by default, even when the updates are retrieved from WSUS. When using BranchCache with Windows 10, simply set the Delivery Optimization mode to Bypass to allow clients to use the Background Intelligent Transfer Service (BITS) protocol with BranchCache instead. For instructions on how to use BranchCache in Distributed Cache mode with WSUS, see the section WSUS and Configuration Manager with BranchCache in Distributed Cache mode. + +## Configure servers for BranchCache + +You can use WSUS and Configuration Manager with BranchCache in Distributed Cache mode. BranchCache in Distributed Cache mode is easy to configure for both WSUS and System Center Configuration Manager. + +For a step-by-step guide to configuring BranchCache on Windows Server devices, see the [BranchCache Deployment Guide (Windows Server 2012)](https://technet.microsoft.com/library/jj572990) or [BranchCache Deployment Guide (Windows Server 2016)](https://technet.microsoft.com/windows-server-docs/networking/branchcache/deploy/branchcache-deployment-guide). + +In addition to these steps, there is one requirement for WSUS to be able to use BranchCache in either operating mode: the WSUS server must be configured to download updates locally on the server to a shared folder. This way, you can select BranchCache publication for the share. For Configuration Manager, you can enable BranchCache on distribution points; no other server-side configuration is necessary for Distributed Cache mode. + +>[!NOTE] +>Configuration Manager only supports Distributed Cache mode. + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using Configuration Manager](waas-manage-updates-configuration-manager.md) diff --git a/windows/manage/waas-configure-wufb.md b/windows/manage/waas-configure-wufb.md new file mode 100644 index 0000000000..e6c1f6e142 --- /dev/null +++ b/windows/manage/waas-configure-wufb.md @@ -0,0 +1,218 @@ +--- +title: Configure Windows Update for Business (Windows 10) +description: You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Configure Windows Update for Business + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +You can use Group Policy or your mobile device management (MDM) service to configure Windows Update for Business settings for your devices. The sections in this topic provide the Group Policy and MDM policies for both Windows 10, version 1511, and Windows 10, version 1607. The MDM policies use the OMA-URI setting from the [Policy CSP](https://msdn.microsoft.com/en-us/library/windows/hardware/dn904962.aspx). + +>[!IMPORTANT] +>For Windows Update for Business policies to be honored, the Telemetry level of the device must be set to **1 (Basic)** or higher. If it is set to **0 (Security)**, Windows Update for Business policies will have no effect. For instructions, see [Configure the operating system telemetry level](https://technet.microsoft.com/en-us/itpro/windows/manage/configure-windows-telemetry-in-your-organization#configure-the-operating-system-telemetry-level). + +Configuration of Windows 10 Mobile devices is limited to the feature set pertaining to Quality Updates only. That is, Windows Mobile Feature Updates are categorized the same as Quality Updates, and can only be deferred by setting the Quality Update deferral period, for a maximum period of 30 days. + +## Start by grouping devices + +By grouping devices with similar deferral periods, administrators are able to cluster devices into deployment or validation groups which can be as a quality control measure as updates are deployed in Windows 10. With deferral windows and the ability to pause updates, administrators can effectively control and measure update deployments, updating a small pool of devices first to verify quality, prior to a broader roll-out to their organization. For more information, see [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). + +>[!TIP] +>In addition to setting up multiple rings for your update deployments, also incorporate devices enrolled in the Windows Insider Program as part of your deployment strategy. This will provide you the chance to not only evaluate new features before they are broadly available to the public, but it also increases the lead time to provide feedback and influence Microsoft’s design on functional aspects of the product. For more information on Windows Insider program, see [https://insider.windows.com/](https://insider.windows.com/). + + +## Configure devices for Current Branch (CB) or Current Branch for Business (CBB) + +With Windows Update for Business, you can set a device to be on either the Current Branch (CB) or the Current Branch for Business (CBB) servicing branch. For more information on this servicing model, see [Windows 10 servicing options](https://technet.microsoft.com/en-us/itpro/windows/manage/introduction-to-windows-10-servicing). + +**Release branch policies** + +| Policy | Sets registry key under **HKLM\Software** | +| --- | --- | +| GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\BranchReadinessLevel | +| GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpgrade | +| MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
**BranchReadinessLevel** | \Microsoft\PolicyManager\default\Update\BranchReadinessLevel | +| MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
**RequireDeferredUpgrade** | \Microsoft\PolicyManager\default\Update\RequireDeferUpgrade | + + +## Configure when devices receive Feature Updates + +After you configure the servicing branch (CB or CBB), you can then define if, and for how long, you would like to defer receiving Feature Updates following their availability from Microsoft on Windows Update. You can defer receiving these Feature Updates for a period of 180 days from their release by setting the `DeferFeatureUpdatesPeriodinDays` value. + +**Examples** + +| Settings | Scenario and behavior | +| --- | --- | +| Device is on CB
DeferFeatureUpdatesPeriodinDays=30 | Feature Update X is first publically available on Windows Update as a CB in January. Device will not receive update until February, 30 days later. | +| Device is on CBB
DeferFeatureUpdatesPeriodinDays=30 | Feature Update X is first publically available on Windows Update as a CB in January. Four months later, in April, Feature Update X is released to CBB. Device will receive the Feature Update 30 days following this CBB release and will update in May. | + +

+**Defer Feature Updates policies** + +| Policy | Sets registry key under **HKLM\Software** | +| --- | --- | +| GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdates
\Policies\Microsoft\Windows\WindowsUpdate\DeferFeatureUpdatesPeriodInDays | +| GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpgradePeriod | +| MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
**DeferFeatureUpdatesPeriodInDays** | \Microsoft\PolicyManager\default\Update\DeferFeatureUpdatesPeriodInDays | +| MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
**DeferUpgrade** | \Microsoft\PolicyManager\default\Update\RequireDeferUpgrade | + + +## Pause Feature Updates + +You can also pause a device from receiving Feature Updates by a period of up to 60 days from when the value is set. After 60 days has passed, pause functionality will automatically expire and the device will scan Windows Update for applicable Feature Updates. Following this scan, Feature Updates for the device can then be paused again. + +**Pause Feature Updates policies** + +| Policy | Sets registry key under **HKLM\Software** | +| --- | --- | +| GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\PauseFeatureUpdates | +| GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\Pause | +| MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
**PauseFeatureUpdates** | \Microsoft\PolicyManager\default\Update\PauseFeatureUpdates | +| MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
**DeferUpgrade** | \Microsoft\PolicyManager\default\Update\Pause | + + +You can check the date Feature Updates were paused at by checking the registry key **PausedFeatureDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. + +The local group policy editor (GPEdit.msc) will not reflect if your Feature Update Pause period has expired. Although the device will resume Feature Updates after 60 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Feature Updates, you can check the status registry key **PausedFeatureStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. + +| Value | Status| +| --- | --- | +| 0 | Feature Updates not paused | +| 1 | Feature Updates paused | +| 2 | Feature Updates have auto-resumed after being paused | + + +## Configure when devices receive Quality Updates + +Quality Updates are typically published the first Tuesday of every month, though can be released at any time by Microsoft. You can define if, and for how long, you would like to defer receiving Quality Updates following their availability. You can defer receiving these Quality Updates for a period of up to 35 days from their release by setting the **DeferQualityUpdatesPeriodinDays** value. + +You can set your system to receive updates for other Microsoft products—known as Microsoft Updates (such as Microsoft Office, Visual Studio)—along with Windows Updates by setting the **AllowMUUpdateService** policy. When this is done, these Microsoft Updates will follow the same deferral and pause rules as all other Quality Updates. + +**Defer Quality Updates policies** + +| Policy | Sets registry key under **HKLM\Software** | +| --- | --- | +| GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Quality Updates are received** | \Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdates
\Policies\Microsoft\Windows\WindowsUpdate\DeferQualityUpdatesPeriodInDays | +| GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\DeferUpdatePeriod | +| MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
**DeferQualityUpdates** | \Microsoft\PolicyManager\default\Update\DeferQualityUpdatesPeriodInDays | +| MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
**DeferUpgrade** | \Microsoft\PolicyManager\default\Update\RequireDeferUpdate | + + +## Pause Quality Updates + +You can also pause a system from receiving Quality Updates for a period of up to 35 days from when the value is set. After 35 days has passed, pause functionality will automatically expire and the system will scan Windows Updates for applicable Quality Updates. Following this scan, Quality Updates for the device can then be paused again. + +**Pause Quality Updates policies** + +| Policy | Sets registry key under **HKLM\Software** | +| --- | --- | +| GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Quality Updates are received** |\Policies\Microsoft\Windows\WindowsUpdate\PauseQualityUpdates | +| GPO for version 1511:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** | \Policies\Microsoft\Windows\WindowsUpdate\Pause | +| MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
**PauseQualityUpdates** | \Microsoft\PolicyManager\default\Update\PauseQualityUpdates | +| MDM for version 1511:
../Vendor/MSFT/Policy/Config/Update/
**DeferUpgrade** | \Microsoft\PolicyManager\default\Update\Pause | + + +You can check what date Quality Updates were paused at by checking the registry key **PausedQualityDate** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. + +The local group policy editor (GPEdit.msc) will not reflect if your Quality Update Pause period has expired. Although the device will resume Quality Updates after 60 days automatically, the pause checkbox will remain checked in the policy editor. To see if a device has auto-resumed taking Quality Updates, you can check the status registry key **PausedQualityStatus** under **HKLM\SOFTWARE\Microsoft\WindowsUpdate\UpdatePolicy\Settings**. + +| Value | Status| +| --- | --- | +| 0 | Quality Updates not paused | +| 1 | Quality Updates paused | +| 2 | Quality Updates have auto-resumed after being paused | + +## Exclude drivers from Quality Updates + +In Windows 10, version 1607, you can selectively option out of receiving driver update packages as part of your normal quality update cycle. This policy will not pertain to updates to inbox drivers (which will be packaged within a security or critical update) or to Feature Updates, where drivers may be dynamically installed to ensure the Feature Update process can complete. + +**Exclude driver policies** + +| Policy | Sets registry key under **HKLM\Software** | +| --- | --- | +| GPO for version 1607:
Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Do not include drivers with Windows Updates** | \Policies\Microsoft\Windows\WindowsUpdate\ExcludeWUDriversInQualityUpdate | +| MDM for version 1607:
../Vendor/MSFT/Policy/Config/Update/
**ExcludeWUDriversInQualityUpdate** | \Microsoft\PolicyManager\default\Update\ExcludeWUDriversInQualityUpdate | + + + +## Summary: MDM and Group Policy for version 1607 + +Below are quick-reference tables of the supported Windows Update for Business policy values for Windows 10, version 1607. + +**GPO: HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate** + +| GPO Key | Key type | Value | +| --- | --- | --- | +| BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)
32: systems take Feature Updates for the Current Branch for Business (CBB)
Note: Other value or absent: receive all applicable updates (CB) | +| DeferQualityUpdates | REG_DWORD | 1: defer quality updates
Other value or absent: don’t defer quality updates | +| DeferQualityUpdatesPeriodinDays | REG_DWORD | 0-30: defer quality updates by given days | +| PauseQualityUpdates | REG_DWORD | 1: pause quality updates
Other value or absent: don’t pause quality updates | +|DeferFeatureUpdates | REG_DWORD | 1: defer feature updates
Other value or absent: don’t defer feature updates | +| DeferFeatureUpdatesPeriodinDays | REG_DWORD | 0-180: defer feature updates by given days | +| PauseFeatureUpdates | REG_DWORD |1: pause feature updates
Other value or absent: don’t pause feature updates | +| ExcludeWUDriversInQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
Other value or absent: offer Windows Update drivers | + + +**MDM: HKEY_LOCAL_MACHINE\Software\Microsoft\PolicyManager\default\Update** + +| MDM Key | Key type | Value | +| --- | --- | --- | +| BranchReadinessLevel | REG_DWORD | 16: systems take Feature Updates for the Current Branch (CB)
32: systems take Feature Updates for the Current Branch for Business (CBB)
Note: Other value or absent: receive all applicable updates (CB) | +| DeferQualityUpdatesPeriod | REG_DWORD | 0-30: defer quality updates by given days | +| PauseQualityUpdates | REG_DWORD | 1: pause quality updates
Other value or absent: don’t pause quality updates | +| DeferFeatureUpdatesPeriod | REG_DWORD | 0-180: defer feature updates by given days | +| PauseFeatureUpdates | REG_DWORD | 1: pause feature updates
Other value or absent: don’t pause feature updates | +| ExcludeWUDriversinQualityUpdate | REG_DWORD | 1: exclude Windows Update drivers
Other value or absent: offer Windows Update drivers | + +## Update devices from Windows 10, version 1511 to version 1607 + +Due to the changes in the Windows Update for Business feature set, Windows 10, version 1607, uses different GPO and MDM keys than those available in version 1511. However,Windows Update for Business clients running version 1511 will still see their policies honored after they update to version 1607; the old policy keys will continue to exist with their values ported forward during the update. Following the update to version 1607, it should be noted that only the version 1511 keys will be populated and not the new version 1607 keys, until the newer keys are explicitly defined on the device by the administrator. + +### How version 1511 policies are respected on version 1607 + +When a client running version 1607 sees an update available on Windows Update, the client will first evaluate and execute against the Windows Updates for Business policy keys for version 1607. If these are not present, it will then check to see if any of the version 1511 keys are set and defer accordingly. Update keys for version 1607 will always supersede the version 1511 equivalent. + +### Comparing the version 1511 keys to the version 1607 keys + +In the Windows Update for Business policies in version 1511, all the deferral rules were grouped under a single policy where pausing affected both upgrades and updates. In Windows 10, version 1607, this functionality has been broken out into separate polices: deferral of Feature and Quality Updates can be enabled and paused independently of one other. + +

MaxConcurrentPublishingRefresh

    -

  • Configure in the Registry under HKEY_LOCAL_MACHINE \Software \ Microsoft \ AppV \Client \ Publishing.

    • +

  • Configure in the Registry under HKEY_LOCAL_MACHINE \ Software \ Microsoft \ AppV \ Client \ Publishing.

  • Create the DWORD value MaxConcurrentPublishingrefresh with the desired maximum number of concurrent publishing refreshes.

  • The App-V client service and computer do not need to be restarted.

[Cortana integration in your business or enterprise](manage-cortana-in-enterprise.md)

The world’s first personal digital assistant helps users get things done, even at work. Cortana includes powerful configuration options specifically to optimize for unique small to medium-sized business and enterprise environments.

[Update Windows 10 in the enterprise](waas-update-windows-10.md) Learn how to manage updates to Windows 10 in your organization, including Windows Update for Business.

[Manage corporate devices](manage-corporate-devices.md)

You can use the same management tools to manage all device types running Windows 10 : desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.

You can use the same management tools to manage all device types running Windows 10: desktops, laptops, tablets, and phones. And your current management tools, such as Group Policy, Windows Management Instrumentation (WMI), PowerShell scripts, Orchestrator runbooks, System Center tools, and so on, will continue to work for Windows 10 on desktop editions.

[Windows Spotlight on the lock screen](windows-spotlight.md)

[Manage Windows 10 Start layout options](windows-10-start-layout-options-and-policies.md)

Organizations might want to deploy a customized Start screen and menu to devices running Windows 10 Enterprise or Windows 10 Education. A standard Start layout can be useful on devices that are common to multiple users and devices that are locked down for specialized purposes.

[Create mandatory user profiles](mandatory-user-profile.md)

Mandatory user profiles are useful when standardization is important, such as on a kiosk device or in educational settings.

[Lock down Windows 10](lock-down-windows-10.md)

Enterprises often need to manage how people use corporate devices. Windows 10 provides a number of features and methods to help you lock down specific parts of a Windows 10 device.

Create a runtime provisioning package to apply settings, profiles, and file assets to a device running Windows 10 Pro, Windows 10 Enterprise, Windows 10 Education, Windows 10 Mobile, or Windows 10 Mobile Enterprise.

[Windows 10 servicing options](introduction-to-windows-10-servicing.md)

This article describes the new servicing options available in Windows 10, Windows 10 Mobile, and Windows 10 IoT Core (IoT Core) and how they enable enterprises to keep their devices current with the latest feature upgrades. It also covers related topics, such as how enterprises can make better use of Windows Update, and what the new servicing options mean for support lifecycles.

[Application Virtualization for Windows (App-V)](appv-for-windows.md)

When you deploy Application Virtualization (App-V) in your orgnazation, you can deliver Win32 applications to users as virtual applications. Virtual applications are installed on centrally managed servers and delivered to users as a service – in real time and on as as-needed basis. Users launch virtual applications from familiar access points, including the Windows Store, and interact with them as if they were installed locally.
+ +
Group Policy keys
Version 1511 GPO keysVersion 1607 GPO keys
**DeferUpgrade**: *enable/disable*
    +Enabling allows user to set deferral periods for upgrades and updates. It also puts the device on CBB (no ability to defer updates while on the CB branch).

**DeferUpgradePeriod**: *0 - 8 months*

**DeferUpdatePeriod**: *1 – 4 weeks*

**Pause**: *enable/disable*
   Enabling will pause both upgrades and updates for a max of 35 days		**DeferFeatureUpdates**: *enable/disable*

**BranchReadinessLevel**
   Set device on CB or CBB

**DeferFeatureUpdatesPeriodinDays**: *1 - 180 days*

**PauseFeatureUpdates**: *enable/disable*
   Enabling will pause Feature updates for a max of 60 days

**DeferQualityUpdates**: *Enable/disable*

**DeferQualityUpdatesPeriodinDays**: *0 - 30 days*

**PauseQualityUpdates**: *enable/disable*
   Enabling will pause Quality updates for a max of 35 days

**ExcludeWUDrivers**: *enable/disable*
+ + + +
MDM keys
Version 1511 MDM keysVersion 1607 MDM keys
**RequireDeferUpgade**: *bool*
   Puts the device on CBB (no ability to defer updates while on the CB branch).

**DeferUpgradePeriod**: *0 - 8 months*

**DeferUpdatePeriod**: *1 – 4 weeks*

**PauseDeferrals**: *bool*
   Enabling will pause both upgrades and updates for a max of 35 days		**BranchReadinessLevel**
   Set system on CB or CBB

**DeferFeatureUpdatesPeriodinDays**: *1 - 180 days*

**PauseFeatureUpdates**: *enable/disable*
   Enabling will pause Feature updates for a max of 60 days

**DeferQualityUpdatesPeriodinDays**: *0 - 30 days*

**PauseQualityUpdates**: *enable/disable*
    Enabling will pause Quality updates for a max of 35 days

**ExcludeWUDriversInQualityUpdate**: *enable/disable<*/td>
+ + + + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) \ No newline at end of file diff --git a/windows/manage/waas-delivery-optimization.md b/windows/manage/waas-delivery-optimization.md new file mode 100644 index 0000000000..61932ffea1 --- /dev/null +++ b/windows/manage/waas-delivery-optimization.md @@ -0,0 +1,251 @@ +--- +title: Configure Delivery Optimization for Windows 10 updates (Windows 10) +description: Delivery Optimization is a new peer-to-peer distribution method in Windows 10 +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Configure Delivery Optimization for Windows 10 updates + + +**Applies to** + +- Windows 10 + + +Delivery Optimization is a self-organizing distributed cache solution for businesses looking to reduce bandwidth consumption for operating system updates, operating system upgrades, and applications by allowing clients to download those elements from alternate sources (such as other peers on the network) in addition to the traditional Internet-based Windows Update servers. You can use Delivery Optimization in conjunction with stand-alone Windows Update, Windows Server Update Services (WSUS), and Windows Update for Business. This functionality is similar to BranchCache in other systems, such as System Center Configuration Manager. + +>[!NOTE] +>WSUS can also use [BranchCache](waas-branchcache.md) for content sharing and caching. If Delivery Optimization is enabled on devices that use BranchCache, Delivery Optimization will be used instead. + +By default in Windows 10 Enterprise and Education, Delivery Optimization allows peer-to-peer sharing on the organization's own network only, but you can configure it differently in Group Policy and mobile device management (MDM) solutions such as Microsoft Intune. + +## Delivery Optimization options + +You can use Group Policy or an MDM solution like Intune to configure Delivery Optimization. + +- Group Policy: Computer Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization +- MDM: .Vendor/MSFT/Policy/Config/DeliveryOptimization + +Several Delivery Optimization features are configurable. + +### Download mode (DODownloadMode) + +Download mode dictates which download sources clients are allowed to use when downloading Windows updates in addition to Windows Update servers. The following table shows the available download mode options and what they do. + +| Download mode option | Functionality when set | +| --- | --- | +| HTTP Only (0) | This setting disables peer content sharing but still allows Delivery Optimization to download content from Windows Update servers or WSUS servers. | +| LAN (1 – Default) | This default operating mode for Delivery Optimization enables peer sharing on the same network. | +| Group (2) | When group mode is set, the group is automatically selected based on the device’s Active Directory Domain Services (AD DS) site (Windows 10, version 1607) or the domain the device is authenticated to (Windows 10, version 1511). In group mode, peering occurs across internal subnets, between devices that belong to the same group, including devices in remote offices. You can use the GroupID option to create your own custom group independently of domains and AD DS sites. Group download mode is the recommended option for most organizations looking to achieve the best bandwidth optimization with Delivery Optimization. | +| Internet (3) | Enable Internet peer sources for Delivery Optimization. | +| Simple (99) | Simple mode disables the use of Delivery Optimization cloud services completely (for offline environments). Delivery Optimization switches to this mode automatically when the Delivery Optimization cloud services are unavailable or unreachable. | +|Bypass (100) | Bypass Delivery Optimization and use BITS, instead. For example, select this mode so that clients can use BranchCache. | + +>[!NOTE] +>Group mode is a best effort optimization and should not be relied on for an authentication of identity of devices participating in the group. + +### Group ID (DOGroupID) + +By default, peer sharing on clients using the group download mode is limited to the same domain in Windows 10, version 1511, and the same domain and AD DS site in Windows 10, version 1607. By using the Group ID setting, you can optionally create a custom group that contains devices that should participate in Delivery Optimization but do not fall within those domain or AD DS site boundaries, including devices in another domain. Using Group ID, you can further restrict the default group (for example create a sub-group representing an office building), or extend the group beyond the domain, allowing devices in multiple domains in your organization to peer. This setting requires the custom group to be specified as a GUID on each device that participates in the custom group. + +>[!NOTE] +>This configuration is optional and not required for most implementations of Delivery Optimization. + +### Max Cache Age (DOMaxCacheAge) + +In environments configured for Delivery Optimization, you may want to set an expiration on cached updates and Windows application installation files. If so, this setting defines the maximum number of seconds each file can be held in the Delivery Optimization cache on each Windows 10 client computer. The default Max Cache Age value is 259,200 seconds (3 days). Alternatively, organizations may choose to set this value to “0” which means “unlimited” to avoid peers re-downloading content. When “Unlimited” value is set, Delivery Optimization will hold the files in the cache longer and will clean up the cache as needed (for example when the cache size exceeded the maximum space allowed). + +### Max Cache Size (DOMaxCacheSize) + +This setting limits the maximum amount of space the Delivery Optimization cache can use as a percentage of the available drive space, from 1 to 100. For example, if you set this value to 10 on a Windows 10 client computer that has 100 GB of available drive space, then Delivery Optimization will use up to 10 GB of that space. Delivery Optimization will constantly assess the available drive space and automatically clear the cache to keep the maximum cache size under the set percentage. The default value for this setting is 20. + +### Absolute Max Cache Size (DOAbsoluteMaxCacheSize) + +This setting specifies the maximum number of gigabytes the Delivery Optimization cache can use. This is different from the **DOMaxCacheSize** setting, which is a percentage of available disk space. Also, if you configure this policy, it will override the **DOMaxCacheSize** setting. The default value for this setting is 10 GB. + +### Maximum Download Bandwidth (DOMaxDownloadBandwidth) + +This setting specifies the maximum download bandwidth that can be used across all concurrent Delivery Optimization downloads in kilobytes per second (KB/s). A default value of 0 means that Delivery Optimization will dynamically adjust and optimize the maximum bandwidth used. + +### Percentage of Maximum Download Bandwidth (DOPercentageMaxDownloadBandwidth) + +This setting specifies the maximum download bandwidth that Delivery Optimization can use across all concurrent download activities as a percentage of available download bandwidth. The default value 0 means that Delivery Optimization dynamically adjusts to use the available bandwidth for downloads. + +### Max Upload Bandwidth (DOMaxUploadBandwidth) + +This setting allows you to limit the amount of upload bandwidth individual clients can use for Delivery Optimization. Consider this setting when clients are providing content to requesting peers on the network. This option is set in kilobytes per second (KB/s). The default setting is 0, or “unlimited” which means Delivery Optimization dynamically optimizes for minimal usage of upload bandwidth; however it does not cap the upload bandwidth rate at a set rate. + +### Minimum Background QoS (DOMinBackgroundQoS) + +This value specifies the minimum download speed guarantee that a client attempts to achieve and will fulfill by downloading more bytes from Windows Update servers or WSUS. Simply put, the lower this value is, the more content will be sourced using peers on the network rather than Windows Update. The higher this value, the more content is received from Windows Update servers or WSUS, versus peers on the local network. + +### Modify Cache Drive (DOModifyCacheDrive) + +This setting allows for an alternate Delivery Optimization cache location on the clients. By default, the cache is stored on the operating system drive through the %SYSTEMDRIVE% environment variable. You can set the value to an environment variable (e.g., %SYSTEMDRIVE%), a drive letter (e.g., D:), or a folder path (e.g., D:\DOCache). + +### Monthly Upload Data Cap (DOMonthlyUploadDataCap) + +This setting specifies the total amount of data in gigabytes that a Delivery Optimization client can upload to Internet peers per month. A value of 0 means that an unlimited amount of data can be uploaded. The default value for this setting is 20 GB. + +## Delivery Optimization configuration examples + +Delivery Optimization can be configured in various ways, leveraging the policies described in the previous section. The following samples describe some common scenarios that organizations may want to set up, given specific scenarios in use for their organization. + +### Use Delivery Optimzation with group download mode + +Delivery Optimization by default will consider all PCs in an organizations as peers for sharing content, even those that might be located across a slower WAN link. Group download mode is designed to help with this by limiting the PCs that can be used. In Windows 10, version 1511, group download mode considers PCs in the same domain and with the same configured Group ID to be eligible peers. In Windows 10, version 1607, the default behavior also adds the PC's AD DS site into the grouping determination. + +**To use Group Policy to configure Delivery Optimization for group download mode** + +1. Open Group Policy Management Console (GPMC). + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, in the **Name** box, type **Delivery Optimization – Group**. + +5. Right-click the **Delivery Optimization – Group** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization. + +7. Right-click the **Download Mode** setting, and then click **Edit**. + +8. Enable the policy, and then select the **Group** download mode. + +9. Right-click the **GroupID** setting, and then click **Edit**. Enable the policy, and then specify a unique GUID for each group of PCs. (This is not required for Windows 10, version 1607, since the AD site code will be used to group devices automatically.) + +10. Click **OK**, and then close the Group Policy Management Editor. + +11. In GPMC, select the **Delivery Optimization – Group** policy. + +12. On the **Scope** tab, under **Security Filtering**, configure the policy to be targeted to an approprite computer group. + +**To use Intune to configure Delivery Optimization for group download mode** + +1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. + +5. In **Setting name**, type **Set Delivery Optimization to Group**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/DeliveryOptimization/DODownloadMode**. + +7. In the **Value** box, type **2**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + +8. Click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment** dialog box, select the **All Computers** group, click **Add**, and then click **OK**. + +### Use WSUS and BranchCache with Windows 10, version 1511 + +In Windows 10, version 1511, Delivery Optimization is enabled by default and is used for peer-to-peer sharing of updates. For organizations that wish to instead leverage BranchCache for the caching of updates being delivered from a WSUS server, Delivery Optimization can be configured to leverage the **HTTP only** download mode, which results in Background Intelligent Transfer Service (BITS) being used to transfer the content; BITS will then use BranchCache when peers are available on the same subnet, and use the WSUS server directly when no peers are available. + +**To use Group Policy to configure HTTP only download mode** + +1. Open Group Policy Management Console (GPMC). + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, in the **Name** box, type **Delivery Optimization – HTTP Only**. + +5. Right-click the **Delivery Optimization – HTTP Only** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization. + +7. Right-click the **Download Mode** setting, and then click **Edit**. + +8. Enable the policy, and then select the **HTTP only** download mode. + +9. Click **OK**, and then close the Group Policy Management Editor. + +10. In GPMC, select the **Delivery Optimization – HTTP Only** policy. + +11. On the **Scope** tab, under **Security Filtering**, select the default **AUTHENTICATED USERS** security group, and then click **Remove**. Then, click **Add**, browse to the **Domain Computers** group, and then click **OK**. + + ![example of UI](images/waas-do-fig4.png) + + >[!NOTE] + >This example uses the Domain Computers group, but you can deploy this policy setting to any computer group. + +### Use WSUS and BranchCache with Windows 10, version 1607 + +In Windows 10, version 1607, Delivery Optimization is enabled by default and is used for peer-to-peer sharing of updates. For organizations that wish to instead leverage BranchCache for the caching of updates being delivered from a WSUS server, Delivery Optimization can be configured to leverage the **Bypass** download mode (new in Windows 10, version 1607), which results in BITS being used to transfer the content; BITS will then use BranchCache when peers are available on the same subnet, and use the WSUS server directly when no peers are available. + +**To use Group Policy to enable the Bypass download mode** + +1. Open Group Policy Management Console (GPMC). + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, in the **Name** box, type **Delivery Optimization – Bypass**. + +5. Right-click the **Delivery Optimization – Bypass** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Delivery Optimization. + +7. Right-click the **Download Mode** setting, and then click **Edit**. + +8. Enable the policy, and then select the **Bypass** download mode. (Note that this download mode is only present in the Windows 10, version 1607, Group Policy ADMX files.) + +9. Click **OK**, and then close the Group Policy Management Editor. + +10. In GPMC, select the **Delivery Optimization – Bypass** policy. + +11. On the **Scope** tab, under **Security Filtering**, select the default **AUTHENTICATED USERS** security group, and then click **Remove**. Then, click **Add**, select the **Domain Computers** group, and then click **OK**. + + >[!NOTE] + >This example uses the Domain Computers group, but you can deploy this policy setting to any computer group. + +### Set “preferred” cache devices for Delivery Optimization + +In some cases, IT pros may have an interest in identifying specific devices that will be “preferred” as sources to other devices—for example, devices that have hard-wired connections, large drives that you can use as caches, or a high-end hardware profile. These preferred devices will act as a “master” for the update content related to that devices’s configuration (Delivery Optimization only caches content relative to the client downloading the content). + +To specify which devices are preferred, you can set the **Max Cache Age** configuration with a value of **Unlimited** (0). As a result, these devices will be used more often as sources for other devices downloading the same files. + +On devices that are not preferred, you can choose to set the following policy to prioritize data coming from local peers instead of the Internet: + +- Set **DOBackgroundQoS** to with a low value, for example `65536` which is the equivalent of 64 KB/s. + +## Learn more + +[Windows 10, Delivery Optimization, and WSUS](https://blogs.technet.microsoft.com/mniehaus/2016/08/16/windows-10-delivery-optimization-and-wsus-take-2/) + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) diff --git a/windows/manage/waas-deployment-rings-windows-10-updates.md b/windows/manage/waas-deployment-rings-windows-10-updates.md new file mode 100644 index 0000000000..87b46bd064 --- /dev/null +++ b/windows/manage/waas-deployment-rings-windows-10-updates.md @@ -0,0 +1,76 @@ +--- +title: Build deployment rings for Windows 10 updates (Windows 10) +description: Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Build deployment rings for Windows 10 updates + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +For Windows as a service, maintenance is ongoing and iterative. Deploying previous versions of Windows required organizations to build sets of users to roll out the changes in phases. Typically, these users ranged (in order) from the most adaptable and least risky to the least adaptable or riskiest. With Windows 10, a similar methodology exists, but construction of the groups is a little different. + +Deployment rings in Windows 10 are similar to the deployment groups most organizations constructed for previous major revision upgrades. They are simply a method by which to separate machines into a deployment timeline. With Windows 10, you construct deployment rings a bit differently in each servicing tool, but the concepts remain the same. Each deployment ring should reduce the risk of issues derived from the deployment of the feature updates by gradually deploying the update to entire departments. As previously mentioned, consider including a portion of each department’s employees in several deployment rings. + +Defining deployment rings is generally a one-time event (or at least infrequent), but IT should revisit these groups to ensure that the sequencing is still correct. Also, there are times in which client computers could move between different deployment rings when necessary. + +Table 1 provides an example of the deployment rings you might use. + +**Table 1** + +| Deployment ring | Servicing branch | Total weeks after Current Branch (CB) or Current Brandh for Business (CBB) release | +| --- | --- | --- | +| Preview | Windows Insider | Pre-CB | +| Ring 1 Pilot IT | CB | CB + 0 weeks | +| Ring 2 Pilot business users | CB | CB + 2 weeks | +| Ring 3 Broad IT | CBB | CBB + 0 weeks | +| Ring 4 Broad business users | CBB | CBB + 4 weeks | +| Ring 5 Broad business users #2 | CBB | CBB + 8 weeks | + +>[!NOTE] +>In this example, there are no rings made up of the long-term servicing branch (LTSB). The LTSB servicing branch does not receive feature updates. +> +>Windows Insider is in the deployment ring list for informational purposes only. Windows Insider PCs must be enrolled manually on each device and serviced based on the Windows Insider level chosen in the **Settings** app on that particular PC. Feature update servicing for Windows Insiderdevices is done completely through Windows Update; no servicing tools can manage Windows Insider feature updates. + + +As Table 1 shows, each combination of servicing branch and deployment group is tied to a specific deployment ring. As you can see, the associated groups of devices are combined with a servicing branch to specify which deployment ring those devices and their users fall into. The naming convention used to identify the rings is completely customizable as long as the name clearly identifies the sequence. Deployment rings represent a sequential deployment timeline, regardless of the servicing branch they contain. Deployment rings will likely rarely change for an organization, but they should be periodically assessed to ensure that the deployment cadence still makes sense. + +![illustration of rings](images/waas-rings.png) + + + +## Steps to manage updates for Windows 10 + + + + + + + + +
![done](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![done](images/checklistdone.png)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![done](images/checklistdone.png)Build deployment rings for Windows 10 updates +(this topic)
![to do](images/checklistbox.gif)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![to do](images/checklistbox.gif)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![to do](images/checklistbox.gif)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) + diff --git a/windows/manage/waas-integrate-wufb.md b/windows/manage/waas-integrate-wufb.md new file mode 100644 index 0000000000..888779cb7b --- /dev/null +++ b/windows/manage/waas-integrate-wufb.md @@ -0,0 +1,109 @@ +--- +title: Integrate Windows Update for Business with management solutions (Windows 10) +description: Use Windows Update for Business deployments with management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Integrate Windows Update for Business with management solutions + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +You can integrate Windows Update for Business deployments with existing management tools such as Windows Server Update Services (WSUS) and System Center Configuration Manager. + +## Integrate Windows Update for Business with Windows Server Update Services + + +For Windows 10, version 1607, devices can now be configured to receive updates from both Windows Update and Windows Server Update Services (WSUS). In a joint WSUS and Windows Update for Business setup: + +- Devices will receive their Windows content from Microsoft and defer these updates according to Windows Update for Business policy +- All other content synced from WSUS will be directly applied to the device; that is, non-Windows Updates content will not follow your Windows Update for Business deferral policies + +### Configuration example \#1: Deferring Windows Update updates with other update content hosted on WSUS + +**Configuration:** + +- Device is configured to defer Windows Quality Updates using Windows Update for Business +- Device is also configured to be managed by WSUS +- Device is not configured to include Microsoft Updates from Windows Update (**Update/AllowMUUpdateService** = not enabled) +- Admin has opted to put Microsoft updates on WSUS +- Admin has also put 3rd party drivers on WSUS + + + + + +
ContentMetadata sourcePayload sourceDeferred?
Windows UpdateWindows UpdateWindows UpdateYes![diagram of content flow](images/wufb-config1.png)
Microsoft Update (such as Office updates)WSUSWSUSNo
Third-party driversWSUSWSUSNo
+ +### Configuration example \#2: Excluding drivers from Windows Quality Updates using Windows Update for Business + +**Configuration:** + +- Device is configured to defer Windows Quality Updates and to exclude drivers from Windows Update Quality Updates (**ExcludeWUDriversInQualityUpdate** = enabled) +- Device is also configured to be managed by WSUS +- Admin has opted to put Windows Update drivers on WSUS + + + + + + + + +
ContentMetadata sourcePayload sourceDeferred?
Windows Update (exclude driver)Windows UpdateWindows UpdateYes![diagram of content flow](images/wufb-config2.png)
Windows Update driversWSUSWSUSNo
Microsoft Update (such as Office updates)WSUSWSUSNo
Windows drivers, third-party driversWSUSWSUSNo
+ +### Configuration example \#3: Device configured to receive Microsoft updates + +**Configuration:** + +- Device is configured to defer Quality Updates using Windows Update for Business and to be managed by WSUS +- Device is configured to “receive updates for other Microsoft products” along with Windows Update updates (**Update/AllowMUUpdateService** = enabled) +- Admin has also placed Microsoft Update content on the WSUS server + +In this example, the Microsoft Update deferral behavior is slightly different than if WSUS were not enabled. +- In a non-WSUS case, the Microsoft Update updates would be deferred just as any Windows Update update would be. +- However, with WSUS also configured, Microsoft Update content is sourced from Microsoft but deferral policies are not applied. + + + + + + +
ContentMetadata sourcePayload sourceDeferred?
Windows Update (exclude drivers)Windows UpdateWindows UpdateYes![diagram of content flow](images/wufb-config3.png)
Microsoft Update (such as Office updates)Microsoft UpdateMicrosoft UpdateNo
Drivers, third-partyWSUSWSUSNo
+ +>[!NOTE] +> Because the admin enabled **Update/AllowMUUpdateService**, placing the content on WSUS was not needed for the particular device, as the device will always receive Microsoft Update content from Microsoft when configured in this manner. + +## Integrate Windows Update for Business with System Center Configuration Manager + +For Windows 10, version 1607, organizations already managing their systems with a Configuration Manager solution can also have their devices configured for Windows Update for Business (i.e. setting deferral policies on those devices). Such devices will be visible in the Configuration Manager console, however they will appear with a detection state of **Unknown**. + +![Example of unknown devices](images/wufb-sccm.png) + + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) + diff --git a/windows/manage/waas-manage-updates-configuration-manager.md b/windows/manage/waas-manage-updates-configuration-manager.md new file mode 100644 index 0000000000..6a560d09d0 --- /dev/null +++ b/windows/manage/waas-manage-updates-configuration-manager.md @@ -0,0 +1,406 @@ +--- +title: Manage Windows 10 updates using System Center Configuration Manager (Windows 10) +description: System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Manage Windows 10 updates using System Center Configuration Manager + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + + +System Center Configuration Manager provides maximum control over quality and feature updates for Windows 10. Unlike other servicing tools, Configuration Manager has capabilities that extend beyond servicing, such as application deployment, antivirus management, software metering, and reporting, and provides a secondary deployment method for LTSB clients. Configuration Manager can effectively control bandwidth usage and content distribution through a combination of BranchCache and distribution points. Microsoft encourages organizations currently using Configuration Manager for Windows update management to continue doing so for Windows 10 client computers. + +You can use Configuration Manager to service Windows 10 devices in two ways. The first option is to use Windows 10 Servicing Plans to deploy Windows 10 feature updates automatically based on specific criteria, similar to an Automatic Deployment Rule for software updates. The second option is to use a task sequence to deploy feature updates, along with anything else in the installation. + +>[!NOTE] +>This topic focuses on updating and upgrading Windows 10 after it has already been deployed. To use Configuration Manager to upgrade your systems from the Windows 8.1, Windows 8, or Windows 7 operating system, see [Upgrade to Windows 10 with System Center Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/upgrade-to-windows-10-with-system-center-configuraton-manager). + +## Windows 10 servicing dashboard + +The Windows 10 servicing dashboard gives you a quick-reference view of your active servicing plans, compliance for servicing plan deployment, and other key information about Windows 10 servicing. For details about what each tile on the servicing dashboard represents, see [Manage Windows as a service using System Center Configuration Manager](https://technet.microsoft.com/library/mt627931.aspx). + +For the Windows 10 servicing dashboard to display information, you must adhere to the following requirements: + +- **Heartbeat discovery**. Enable heartbeat discovery for the site receiving Windows 10 servicing information. Configuration for heartbeat discovery can be found in Administration\Overview\Hierarchy Configuration\Discovery Methods. +- **Windows Server Update Service (WSUS)**. System Center Configuration Manager must have the Software update point site system role added and configured to receive updates from a WSUS 4.0 server with the hotfix KB3095113 installed. +- **Service connection point**. Add the Service connection point site system role in Online, persistent connection mode. +- **Upgrade classification**. Select **Upgrade** from the list of synchronized software update classifications. + + **To configure Upgrade classification** + + 1. Go to Administration\Overview\Site Configuration\Sites, and then select your site from the list. + + 2. On the Ribbon, in the **Settings** section, click **Configure Site Components**, and then click **Software Update Point**. + + ![Example of UI](images/waas-sccm-fig1.png) + + 3. In the **Software Update Point Component Properties** dialog box, on the **Classifications** tab, click **Upgrades**. + +When you have met all these requirements and deployed a servicing plan to a collection, you’ll receive information on the Windows 10 servicing dashboard. + +## Enable CBB clients in Windows 10, version 1511 + +When you use System Center Configuration Manager to manage Windows 10 servicing, you must first set the **Defer Updates or Upgrades** policy on the clients that should be on the Current Branch for Business (CBB) servicing branch so that you can use CBB servicing plans from Configuration Manager. You can do this either manually or through Group Policy. If you don’t set this policy, Configuration Manager discovers all clients, as it would in Current Branch (CB) mode. + +**To use Group Policy to configure a client for the CBB servicing branch** + +>[!NOTE] +>In this example, a specific organizational unit (OU) called **Windows 10 – Current Branch for Business Machines** contains the Windows 10 devices that should be configured for CBB. You can also use a security group to filter the computers to which the policy should be applied. + +1. On a PC running the Remote Server Administration Tools or on a domain controller, open Group Policy Management Console (GPMC). + +2. Expand Forest\Domains\\*Your_Domain*. + +4. Right-click the **Windows 10 – Current Branch for Business Machines** OU, and then click **Create a GPO in this domain, and Link it here**. + + ![Example of UI](images/waas-sccm-fig2.png) + +5. In the **New GPO** dialog box, type **Enable Current Branch for Business** for the name of the new GPO. + + >[!NOTE] + >In this example, you’re linking the GPO to a specific OU. This is not a requirement. You can link the Windows Update for Business GPOs to any OU or the top-level domain, whichever is appropriate for your Active Directory Domain Services (AD DS) structure. + +6. Right-click the **Enable Current Branch for Business** GPO, and then click **Edit**. + +7. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. + +8. Right-click the **Defer Upgrades and Updates** setting, and then click **Edit**. + + ![Example of UI](images/waas-sccm-fig3.png) + +9. Enable the policy, and then click **OK**. + + >[!NOTE] + >The additional options in this setting are only for Windows Update for Business, so be sure not to configure them when using System Center Configuration Manager for Windows 10 servicing. + +10. Close the Group Policy Management Editor. + +This policy will now be deployed to every device in the **Windows 10 – Current Branch for Business Machines** OU. + + +## Enable CBB clients in Windows 10, version 1607 + +When you use Configuration Manager to manage Windows 10 servicing, you must first set the **Select when Feature Updates** are received policy on the clients that should be on the CBB servicing branch so that you can use CBB servicing plans from Configuration Manager. You can do this either manually or through Group Policy. If you don’t set this policy, Configuration Manager discovers all clients, as it would in CB mode. + +>[!NOTE] +>System Center Configuration Manager version 1606 is required to manage devices running Windows 10, version 1607. + +**To use Group Policy to configure a client for the CBB servicing branch** + +>[!NOTE] +>In this example, a specific organizational unit (OU) called **Windows 10 – Current Branch for Business Machines** contains the Windows 10 devices that should be configured for CBB. You can also use a security group to filter the computers to which the policy should be applied. + +1. On a PC running the Remote Server Administration Tools or on a domain controller, open GPMC. + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click the **Windows 10 – Current Branch for Business Machines** OU, and then click **Create a GPO in this domain, and Link it here**. + + ![Example of UI](images/waas-sccm-fig2.png) + +5. In the **New GPO** dialog box, type **Enable Current Branch for Business** for the name of the new GPO. + + >[!NOTE] + >In this example, you’re linking the GPO to a specific OU. This is not a requirement. You can link the Windows Update for Business GPOs to any OU or the top-level domain, whichever is appropriate for your Active Directory Domain Services (AD DS) structure. + +6. Right-click the **Enable Current Branch for Business** GPO, and then click **Edit**. + +7. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update\Defer Windows Updates. + +8. Right-click the **Select when Feature Updates are received** setting, and then click **Edit**. + +9. Enable the policy, select the **CBB** branch readiness level, and then click **OK**. + +10. Close the Group Policy Management Editor. + +This policy will now be deployed to every device in the **Windows 10 – Current Branch for Business Machines** OU. + +## Create collections for deployment rings + +Regardless of the method by which you deploy Windows 10 feature updates to your environment, you must start the Windows 10 servicing process by creating collections of computers that represent your deployment rings. In this example, you create two collections: **Windows 10 – All Current Branch for Business** and **Ring 3 Broad IT**. You’ll use the **Windows 10 – All Current Branch for Business** collection for reporting and deployments that should go to all CBB clients. You’ll use the **Ring 3 Broad IT** collection as a deployment ring for the first CBB users, IT pros. + +>[!NOTE] +>The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. + +**To create collections for deployment rings** + +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. + +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. + +3. In the Create Device Collection Wizard, in the **name** box, type **Windows 10 – All Current Branch for Business**. + +4. Click **Browse** to select the limiting collection, and then click **All Systems**. + +5. In **Membership rules**, click **Add Rule**, and then click **Query Rule**. + +6. Name the rule **CBB Detection**, and then click **Edit Query Statement**. + +7. On the **Criteria** tab, click the **New** icon. + + ![Example of UI](images/waas-sccm-fig4.png) + +8. In the **Criterion Properties** dialog box, leave the type as **Simple Value**, and then click **Select**. + +9. In the **Select Attribute** dialog box, from the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **OSBranch**, and then click **OK**. + + ![Example of UI](images/waas-sccm-fig5.png) + + >[!NOTE] + >Configuration Manager discovers clients’ servicing branch and stores that value in the **OSBranch** attribute, which you will use to create collections based on servicing branch. The values in this attribute can be **0 (Current Branch)**, **1 (Current Branch for Business)**, or **2 (Long-Term Servicing Branch)**. + +10. Leave **Operator** set to **is equal to**; in the **Value** box, type **1**. Click **OK**. + + ![Example of UI](images/waas-sccm-fig6.png) + +11. Now that the **OSBranch** attribute is correct, verify the operating system version. + +12. On the **Criteria** tab, click the **New** icon again to add criteria. + +13. In the **Criterion Properties** dialog box, click **Select**. + +14. From the **Attribute class** list, select **System Resource**. From the **Attribute** list, select **Operating System Name and Version**, and then click **OK**. + + ![Example of UI](images/waas-sccm-fig7.png) + +15. In the **Value** box, type **Microsoft Windows NT Workstation 10.0**, and then click **OK**. + + ![Example of UI](images/waas-sccm-fig8.png) + +16. In the **Query Statement Properties** dialog box, you see two values. Click **OK**, and then click **OK** again to continue to the Create Device Collection Wizard. + +17. Click **Summary**, and then click **Next**. + +18. Close the wizard. + +>[!IMPORTANT] +>Windows Insider PCs are discovered the same way as CB or CBB devices. If you have Windows Insider PCs that you use Configuration Manager to manage, then you should create a collection of those PCs and exclude them from this collection. You can create the membership for the Windows Insider collection either manually or by using a query where the operating system build doesn’t equal any of the current CB or CBB build numbers. You would have to update each periodically to include new devices or new operating system builds. + +After you have updated the membership, this new collection will contain all managed clients on the CBB servicing branch. You will use this collection as a limiting collection for future CBB-based collections and the **Ring 3 Broad IT** collection. Complete the following steps to create the Ring 3 Broad IT device collection, which you’ll use as a CBB deployment ring for servicing plans or task sequences. + +1. In the Configuration Manager console, go to Assets and Compliance\Overview\Device Collections. + +2. On the Ribbon, in the **Create** group, click **Create Device Collection**. + +3. In the Create Device Collection Wizard, in the **name** box, type **Ring 3 Broad IT**. + +4. Click **Browse** to select the limiting collection, and then click **Windows 10 – All Current Branch for Business**. + +5. In **Membership rules**, click **Add Rule**, and then click **Direct Rule**. + +6. In the **Create Direct Membership Rule Wizard** dialog box, click **Next**. + +7. In the **Value** field, type all or part of the name of a device to add, and then click **Next**. + +8. Select the computer that will be part of the **Ring 3 Broad IT** deployment ring, and then click **Next**. + +9. Click **Next**, and then click **Close**. + +10. In the **Create Device Collection Wizard** dialog box, click **Summary**. + +11. Click **Next**, and then click **Close**. + + +## Use Windows 10 servicing plans to deploy Windows 10 feature updates + +There are two ways to deploy Windows 10 feature updates with System Center onfiguration Manager. The first is to use servicing plans, which provide an automated method to update devices consistently in their respective deployment rings, similar to Automatic Deployment Rules for software updates. + +**To configure Windows feature updates for CBB clients in the Ring 3 Broad IT deployment ring using a servicing plan** + +1. In the Configuration Manager console, go to Software Library\Overview\Windows 10 Servicing, and then click **Servicing Plans**. + +2. On the Ribbon, in the **Create** group, click **Create Servicing Plan**. + +3. Name the plan **Ring 3 Broad IT Servicing Plan**, and then click **Next**. + +4. On the **Servicing Plan page**, click **Browse**. Select the **Ring 3 Broad IT** collection, which you created in the [Create collections for deployment rings](#create-collections-for-deployment-rings) section, click **OK**, and then click **Next**. + + >[!IMPORTANT] + >Microsoft added a new protection feature to Configuration Manager that prevents accidental installation of high-risk deployments such as operating system upgrades on site systems. If you select a collection (All Systems in this example) that has a site system in it, you may receive the following message. + > + >![This is a high-risk deployment](images/waas-sccm-fig9.png) + > + >For details about how to manage the settings for high-risk deployments in Configuration Manager, see [Settings to manage high-risk deployments for System Center Configuration Manager](https://technet.microsoft.com/library/mt621992.aspx). + +5. On the **Deployment Ring** page, select the **Business Ready (Current Branch for Business)** readiness state, leave the delay at **0 days**, and then click **Next**. + + Doing so deploys CBB feature updates to the IT deployment ring immediately after they are released to CBB. + + On the Upgrades page, you specify filters for the feature updates to which this servicing plan is applicable. For example, if you wanted this plan to be only for Windows 10 Enterprise, you could select **Title**, and then type **Enterprise**. + +6. For this example, on the **Upgrades** page, click **Next** to leave the criterion blank. + +7. On the **Deployment Schedule** page, click **Next** to keep the default values of making the content available immediately and requiring installation by the 7-day deadline. + +8. On the **User Experience** page, from the **Deadline behavior** list, select **Software Installation and System restart (if necessary)**. From the **Device restart behavior** list, select **Workstations**, and then click **Next**. + + Doing so allows installation and restarts after the 7-day deadline on workstations only. + +9. On the **Deployment Package** page, select **Create a new deployment package**. In **Name**, type **CBB Upgrades**, select a share for your package source location, and then click **Next**. + + In this example, \\contoso-cm01\Sources\Windows 10 Feature Upgrades is a share on the Configuration Manager server that contains all the Windows 10 feature updates. + + ![Example of UI](images/waas-sccm-fig10.png) + +10. On the **Distribution Points** page, from the **Add** list, select **Distribution Point**. + + ![Example of UI](images/waas-sccm-fig11.png) + + Select the distribution points that serve the clients to which you’re deploying this servicing plan, and then click **OK**. + +11. Click **Summary**, click **Next** to complete the servicing plan, and then click **Close**. + + +You have now created a servicing plan for the **Ring 3 Broad IT** deployment ring. By default, this rule is evaluated each time the software update point is synchronized, but you can modify this schedule by viewing the service plan’s properties on the **Evaluation Schedule** tab. + +![Example of UI](images/waas-sccm-fig12.png) + + +## Use a task sequence to deploy Windows 10 updates + +There are times when deploying a Windows 10 feature update requires the use of a task sequence—for example: + +- **LTSB feature updates**. With the LTSB servicing branch, feature updates are never provided to the Windows clients themselves. Instead, feature updates must be installed like a traditional in-place upgrade. +- **Additional required tasks**. When deploying a feature update requires additional steps (e.g., suspending disk encryption, updating applications), you must use task sequences to orchestrate the additional steps. Servicing plans do not have the ability to add steps to their deployments. + +Each time Microsoft releases a new Windows 10 build, it releases a new .iso file containing the latest build, as well. Regardless of the scenario that requires a task sequence to deploy the Windows 10 upgrade, the base process is the same. Start by creating an Operating System Upgrade Package in the Configuration Manager console: + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages. + +2. On the Ribbon, in the **Create** group, click **Add Operating System Upgrade Package**. + +3. On the **Data Source** page, type the path of the extracted .iso file of the new version of Windows 10 you’re deploying, and then click **Next**. + + In this example, the Windows 10 Enterprise 1607 installation media is deployed to \\contoso-cm01\Sources\Operating Systems\Windows 10 Enterprise\Windows 10 Enterprise - Version 1607. + + >[!NOTE] + >System Center Configuration Manager version 1606 is required to manage machines running Windows 10, version 1607. + +4. On the **General** page, in the **Name** field, type the name of the folder (**Windows 10 Enterprise - Version 1607** in this example). Set the **Version** to **1607**, and then click **Next**. + +5. On the **Summary** page, click **Next** to create the package. + +6. On the **Completion** page, click **Close**. + +Now that the operating system upgrade package has been created, the content in that package must be distributed to the correct distribution points so that the clients can access the content. Complete the following steps to distribute the package content to distribution points: + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Operating System Upgrade Packages, and then select the **Windows 10 Enterprise – Version 1607** software upgrade package. + +2. On the Ribbon, in the **Deployment group**, click **Distribute Content**. + +3. In the Distribute Content Wizard, on the **General** page, click **Next**. + +4. On the **Content Destination** page, click **Add**, and then click **Distribution Point**. + +5. In the **Add Distribution Points** dialog box, select the distribution point that will serve the clients receiving this package, and then click **OK**. + +6. On the **Content Destination** page, click **Next**. + +7. On the **Summary** page, click **Next** to distribute the content to the selected distribution point. + +8. On the **Completion** page, click **Close**. + +Now that the upgrade package has been created and its contents distributed, create the task sequence that will use it. Complete the following steps to create the task sequence, using the previously created deployment package: + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences. + +2. On the Ribbon, in the **Create** group, click **Create Task Sequence**. + +3. In the Create Task Sequence Wizard, on the **Create a new task sequence** page, select **Upgrade an operating system from upgrade package**, and then click **Next**. + +4. On the **Task Sequence Information** page, in **Task sequence name**, type **Upgrade Windows 10 Enterprise – Version 1607**, and then click **Next**. + +5. On the **Upgrade the Windows Operating system** page, click **Browse**, select the deployment package you created in the previous steps, and then click **OK**. + +6. Click **Next**. + +7. On the **Include Updates** page, select **Available for installation – All software updates**, and then click **Next**. + +8. On the **Install Applications** page, click **Next**. + +9. On the **Summary** page, click **Next** to create the task sequence. + +10. On the **Completion** page, click **Close**. + +With the task sequence created, you’re ready to deploy it. If you’re using this method to deploy most of your Windows 10 feature updates, you may want to create deployment rings to stage the deployment of this task sequence, with delays appropriate for the respective deployment ring. In this example, you deploy the task sequence to the **Ring 3 Broad IT collection**. + +>[!IMPORTANT] +>This process deploys a Windows 10 operating system feature update to the affected devices. If you’re testing, be sure to select the collection to which you deploy this task sequence carefully. + +**To deploy your task sequence** + +1. In the Configuration Manager console, go to Software Library\Overview\Operating Systems\Task Sequences, and then select the **Upgrade Windows 10 Enterprise – Version 1607** task sequence. + +2. On the Ribbon, in the **Deployment** group, click **Deploy**. + +3. In the Deploy Software Wizard, on the **General** page, click **Browse**. Select the target collection, click **OK**, and then click **Next**. + +4. On the **Deployment Settings** page, for **purpose**, select **Required**, and then click **Next**. + +5. On the **Scheduling** page, select the **Schedule when this deployment will become available** check box (it sets the current time by default). For **Assignment schedule**, click **New**. + +6. In the **Assignment Schedule** dialog box, click **Schedule**. + +7. In the **Custom Schedule** dialog box, select the desired deadline, and then click **OK**. + +8. In the **Assignment Schedule** dialog box, click **OK**, and then click **Next**. + +9. On the **User Experience** page, in the **When the scheduled assignment time is reached, allow the following activities to be performed outside of the maintenance window** section, select **Software Installation** and **System restart** (if required to complete the installation), and then click **Next**. + +10. Use the defaults for the remaining settings. + +11. Click **Summary**, and then click **Next** to deploy the task sequence. + +12. Click **Close**. + + + + +
+ +## Steps to manage updates for Windows 10 + + + + + + + + +
![done](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![done](images/checklistdone.png)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![done](images/checklistdone.png)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![done](images/checklistdone.png)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![done](images/checklistdone.png)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![done](images/checklistdone.png)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or Manage Windows 10 updates using System Center Configuration Manager (this topic)
+
+ + + + + + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) diff --git a/windows/manage/waas-manage-updates-wsus.md b/windows/manage/waas-manage-updates-wsus.md new file mode 100644 index 0000000000..3d3eaf474e --- /dev/null +++ b/windows/manage/waas-manage-updates-wsus.md @@ -0,0 +1,351 @@ +--- +title: Manage Windows 10 updates using Windows Server Update Services (Windows 10) +description: WSUS allows companies to defer, selectively approve, choose when delivered, and determine which devices receive updates. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Manage Windows 10 updates using Windows Server Update Services (WSUS) + + +**Applies to** + +- Windows 10 + + +WSUS is a Windows Server role available in the Windows Server operating systems. It provides a single hub for Windows updates within an organization. WSUS allows companies not only to defer updates but also to selectively approve them, choose when they’re delivered, and determine which individual devices or groups of devices receive them. WSUS provides additional control over Windows Update for Business but does not provide all the scheduling options and deployment flexibility that System Ctype Configuration Manager provides. + +When you choose WSUS as your source for Windows updates, you use Group Policy to point Windows 10 client devices to the WSUS server for their updates. From there, updates are periodically downloaded to the WSUS server and managed, approved, and deployed through the WSUS administration console or Group Policy, streamlining typeprise update management. If you’re currently using WSUS to manage Windows updates in your environment, you can continue to do so in Windows 10. + + + +## Requirements for Windows 10 servicing with WSUS + +To be able to use WSUS to manage and deploy Windows 10 feature updates, you must have WSUS 4.0, which is available in the Windows Server 2012 R2 and Windows Server 2012 operating systems. In addition to WSUS 4.0, you must install the [KB3095113](https://support.microsoft.com/kb/3095113) and [KB3148812](https://support.microsoft.com/kb/3159706) patches on the WSUS server. + +## WSUS scalability + +To use WSUS to manage all Windows updates, some organizations may need access to WSUS from a demilitarized zone, or they might have some other complex scenario. WSUS is highly scalable and configurable for organizations of any size or site layout. For specific information about scaling WSUS, including upstream and downstream server configuration, branch offices, WSUS load balancing, and other complex scenarios, see [Choose a Type of WSUS Deployment](https://technet.microsoft.com/library/cc720448%28v=ws.10%29.aspx). + + +## Express Installation Files + +With Windows 10, quality updates will be larger than traditional Windows Updates because they’re cumulative. To manage the bandwidth clients downloading large updates like these will need, WSUS has a feature called *Express Installation Files*. + + At a binary level, files associated with updates may not change a lot. In fact, with cumulative quality updates, most of the content will be from previous updates. Rather than downloading the entire update when only a small percentage of the payload is actually different, Express Installation Files analyze the differences between the new files associated with an update and the existing files on the client. This approach significantly reduces the amount of bandwidth used because only a fraction of the update content is actually delivered. + + **To configure WSUS to download Express Update Files** + +1. Open the WSUS Administration Console. + +2. In the navigation pane, go to *Your_Server*\\**Options**. + +3. In the **Options** section, click **Update Files and Languages**. + + ![Example of UI](images/waas-wsus-fig1.png) + +4. In the **Update Files and Languages** dialog box, select **Download express installation files**. + + ![Example of UI](images/waas-wsus-fig2.png) + + >[!NOTE] + >Because Windows 10 updates are cumulative, enabling Express Installation Files when WSUS is configured to download Windows 10 updates will significantly increase the amount of disk space that WSUS requires. Alternatively, when using Express Installation Files for previous versions of Windows, the feature’s positive effects aren’t noticeable because the updates aren’t cumulative. + +## Configure automatic updates and update service location + +When using WSUS to manage updates on Windows client devices, start by configuring the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings for your environment. Doing so forces the affected clients to contact the WSUS server so that it can manage them. The following process describes how to specify these settings and deploy them to all devices in the domain. + +**To configure the Configure Automatic Updates and Intranet Microsoft Update Service Location Group Policy settings for your environment** + +1. Open GPMC. + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. + + ![Example of UI](images/waas-wsus-fig3.png) + + >[!NOTE] + >In this example, the **Configure Automatic Updates** and **Intranet Microsoft Update Service Location** Group Policy settings are specified for the entire domain. This is not a requirement; you can target these settings to any security group by using Security Filtering or a specific OU. + +4. In the **New GPO** dialog box, name the new GPO **WSUS – Auto Updates and Intranet Update Service Location**. + +5. Right-click the **WSUS – Auto Updates and Intranet Update Service Location** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. + +7. Right-click the **Configure Automatic Updates** setting, and then click **Edit**. + + ![Example of UI](images/waas-wsus-fig4.png) + +8. In the **Configure Automatic Updates** dialog box, select **Enable**. + +9. Under **Options**, from the **Configure automatic updating** list, select **3 - Auto download and notify for install**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig5.png) + + >[!NOTE] + ?There are three other settings for automatic update download and installation dates and times. This is simply the option this example uses. For more examples of how to control automatic updates and other related policies, see [Configure Automatic Updates by Using Group Policy](https://technet.microsoft.com/library/cc720539%28v=ws.10%29.aspx). + +9. Right-click the **Specify intranet Microsoft update service location** setting, and then click **Edit**. + +9. In the **Specify intranet Microsoft update service location** dialog box, select **Enable**. + +12. Under **Options**, in the **Set the intranet update service for detecting updates** and **Set the intranet statistics server** options, type **http://Your_WSUS_Server_FQDN:PortNumber**, and then click **OK**. + + >[!NOTE] + >The URL `http://CONTOSO-WSUS1.contoso.com:8530` in the following image is just an example. In your environment, be sure to use the server name and port number for your WSUS instance. + + ![Example of UI](images/waas-wsus-fig6.png) + + >[!NOTE] + >The default HTTP port for WSUS is 8530, and the default HTTP over Secure Sockets Layer (HTTPS) port is 8531. If you’re unsure which port WSUS is using for client communication, right-click the WSUS Administration site in IIS Manager, and then click **Edit Bindings**. + +As Windows clients refresh their computer policies (the default Group Policy refresh setting is 90 minutes and when a computer restarts), computers start to appear in WSUS. Now that clients are communicating with the WSUS server, create the computer groups that align with your deployment rings. + +## Create computer groups in the WSUS Administration Console + +>[!NOTE] +>The following procedures use the groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) as examples. + +You can use computer groups to target a subset of devices that have specific quality and feature updates. These groups represent your deployment rings, as controlled by WSUS. You can populate the groups either manually by using the WSUS Administration Console or automatically through Group Policy. Regardless of the method you choose, you must first create the groups in the WSUS Administration Console. + +**To create computer groups in the WSUS Administration Console** + +1. Open the WSUS Administration Console. + +2. Go to *Server_Name*\Computers\All Computers, and then click **Add Computer Group**. + + ![Example of UI](images/waas-wsus-fig7.png) + +3. type **Ring 2 Pilot Business Users** for the name, and then click **Add**. + +4. Repeat these steps for the **Ring 3 Broad IT** and **Ring 4 Broad Business Users** groups. When you’re finished, there should be three deployment ring groups. + +Now that the groups have been created, add the computers to the computer groups that align with the desired deployment rings. You can do this through [Group Policy](#wsus-gp) or manually by using the [WSUS Administration Console](#wsus-admin). + + +## Use the WSUS Administration Console to populate deployment rings + +Adding computers to computer groups in the WSUS Administration Console is simple, but it could take much longer than managing membership through Group Policy, especially if you have many computers to add. Adding computers to computer groups in the WSUS Administration Console is called *server-side targeting*. + +In this example, you add computers to computer groups in two different ways: by manually assigning unassigned computers and by searching for multiple computers. + +### Manually assign unassigned computers to groups + +When new computers communicate with WSUS, they appear in the **Unassigned Computers** group. From there, you can use the following procedure to add computers to their correct groups. For these examples, you use two Windows 10 PCs (WIN10-PC1 and WIN10-PC2) to add to the computer groups. + +**To assign computers manually** + +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers\Unassigned Computers. + + Here, you see the new computers that have received the GPO you created in the previous section and started communicating with WSUS. This example has only two computers; depending on how broadly you deployed your policy, you will likely have many computers here. + +2. Select both computers, right-click the selection, and then click **Change Membership**. + + ![Example of UI](images/waas-wsus-fig8.png) + +3. In the **Set Computer Group Membership** dialog box, select the **Ring 2 Pilot Business Users** deployment ring, and then click **OK**. + + Because they were assigned to a group, the computers are no longer in the **Unassigned Computers** group. If you select the **Ring 2 Pilot Business Users** computer group, you will see both computers there. + +### Search for multiple computers to add to groups + +Another way to add multiple computers to a deployment ring in the WSUS Administration Console is to use the search feature. + +**To search for multiple computers** + +1. In the WSUS Administration Console, go to *Server_Name*\Computers\All Computers, right-click **All Computers**, and then click **Search**. + +2. In the search box, type **WIN10**. + +3. In the search results, select the computers, right-click the selection, and then click **Change Membership**. + + ![Example of UI](images/waas-wsus-fig9.png) + +4. Select the **Ring 3 Broad IT** deployment ring, and then click **OK**. + +You can now see these computers in the **Ring 3 Broad IT** computer group. + + + +## Use Group Policy to populate deployment rings + +The WSUS Administration Console provides a friendly interface from which you can manage Windows 10 quality and feature updates. When you need to add many computers to their correct WSUS deployment ring, however, it can be time-consuming to do so manually in the WSUS Administration Console. For these cases, consider using Group Policy to target the correct computers, automatically adding them to the correct WSUS deployment ring based on an Active Directory security group. This process is called *client-side targeting*. Before enabling client-side targeting in Group Policy, you must configure WSUS to accept Group Policy computer assignment. + +**To configure WSUS to allow client-side targeting from Group Policy** + +1. Open the WSUS Administration Console, and go to *Server_Name*\Options, and then click **Computers**. + + ![Example of UI](images/waas-wsus-fig10.png) + +2. In the **Computers** dialog box, select **Use Group Policy or registry settings on computers**, and then click **OK**. + + >[!NOTE] + >This option is exclusively either-or. When you enable WSUS to use Group Policy for group assignment, you can no longer manually add computers through the WSUS Administration Console until you change the option back. + +Now that WSUS is ready for client-side targeting, complete the following steps to use Group Policy to configure client-side targeting: + +**To configure client-side targeting** + +>[!TIP] +>When using client-side targeting, consider giving security groups the same names as your deployment rings. Doing so simplifies the policy-creation process and helps ensure that you don’t add computers to the incorrect rings. + +1. Open GPMC. + +2. Expand Forest\Domains\\*Your_Domain*. + +3. Right-click *Your_Domain*, and then click **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, type **WSUS – Client Targeting – Ring 4 Broad Business Users** for the name of the new GPO. + +5. Right-click the **WSUS – Client Targeting – Ring 4 Broad Business Users** GPO, and then click **Edit**. + + ![Example of UI](images/waas-wsus-fig11.png) + +6. In the Group Policy Management Editor, go to Computer Configuration\Policies\Administrative Templates\Windows Components\Windows Update. + +7. Right-click **Enable client-side targeting**, and then click **Edit**. + +8. In the **Enable client-side targeting** dialog box, select **Enable**. + +9. In the **Target group name for this computer** box, type **Ring 4 Broad Business Users**. This is the name of the deployment ring in WSUS to which these computers will be added. + + ![Example of UI](images/waas-wsus-fig12.png) + +10. Close the Group Policy Management Editor. + +Now you’re ready to deploy this GPO to the correct computer security group for the **Ring 4 Broad Business Users** deployment ring. + +**To scope the GPO to a group** + +1. In GPMC, select the **WSUS – Client Targeting – Ring 4 Broad Business Users** policy. + +2. Click the **Scope** tab. + +3. Under **Security Filtering**, remove the default **AUTHENTICATED USERS** security group, and then add the **Ring 4 Broad Business Users** group. + + ![Example of UI](images/waas-wsus-fig13.png) + +The next time the clients in the **Ring 4 Broad Business Users** security group receive their computer policy and contact WSUS, they will be added to the **Ring 4 Broad Business Users** deployment ring. + +## Automatically approve and deploy feature updates + +For clients that should have their feature updates approved as soon as they’re available, you can configure Automatic Approval rules in WSUS. + +>[!NOTE] +>WSUS respects the client’s servicing branch. If you approve a feature update while it is still Current Branch (CB), WSUS will install the update only on PCs that are in the CB servicing branch. When Microsoft releases the build for Current Branch for Business (CBB), the PCs in the CBB servicing branch will install it. + +**To configure an Automatic Approval rule for Windows 10 feature updates and approve them for the Ring 3 Broad IT deployment ring** + +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Options, and then select **Automatic Approvals**. + +2. On the **Update Rules** tab, click **New Rule**. + +3. In the **Add Rule** dialog box, select the **When an update is in a specific classification**, **When an update is in a specific product**, and **Set a deadline for the approval** check boxes. + + ![Example of UI](images/waas-wsus-fig14.png) + +4. In the **Edit the properties** area, select **any classification**. Clear everything except **Upgrades**, and then click **OK**. + +5. In the **Edit the properties area**, click the **any product** link. Clear all check boxes except **Windows 10**, and then click **OK**. + + Windows 10 is under All Products\Microsoft\Windows. + +6. In the **Edit the properties** area, click the **all computers** link. Clear all the computer group check boxes except **Ring 3 Broad IT**, and then click **OK**. + +7. Leave the deadline set for **7 days after the approval at 3:00 AM**. + +8. In the **Step 3: Specify a name** box, type **Windows 10 Upgrade Auto-approval for Ring 3 Broad IT**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig15.png) + +9. In the **Automatic Approvals** dialog box, click **OK**. + + >[!NOTE] + >WSUS does not honor any existing month/week/day deferral settings for CB or CBB. That said, if you’re using Windows Update for Business for a computer for which WSUS is also managing updates, when WSUS approves the update, it will be installed on the computer regardless of whether you configured Group Policy to wait. + +Now, whenever Windows 10 feature updates are published to WSUS, they will automatically be approved for the **Ring 3 Broad IT** deployment ring with an installation deadline of 1 week. + +## Manually approve and deploy feature updates + +You can manually approve updates and set deadlines for installation within the WSUS Administration Console, as well. To simplify the manual approval process, start by creating a software update view that contains only Windows 10 updates. + +**To approve and deploy feature updates manually** + +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates. In the **Action** pane, click **New Update View**. + +2. In the **Add Update View** dialog box, select **Updates are in a specific classification** and **Updates are for a specific product**. + +3. Under **Step 2: Edit the properties**, click **any classification**. Clear all check boxes except **Upgrades**, and then click **OK**. + +4. Under **Step 2: Edit the properties**, click **any product**. Clear all check boxes except **Windows 10**, and then click **OK**. + + Windows 10 is under All Products\Microsoft\Windows. + +5. In the **Step 3: Specify a name** box, type **All Windows 10 Upgrades**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig16.png) + +Now that you have the All Windows 10 Upgrades view, complete the following steps to manually approve an update for the **Ring 4 Broad Business Users** deployment ring: + +1. In the WSUS Administration Console, go to Update Services\\*Server_Name*\Updates\All Windows 10 Upgrades. + +2. Right-click the feature update you want to deploy, and then click **Approve**. + + ![Example of UI](images/waas-wsus-fig17.png) + +3. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, select **Approved for Install**. + + ![Example of UI](images/waas-wsus-fig18.png) + +4. In the **Approve Updates** dialog box, from the **Ring 4 Broad Business Users** list, click **Deadline**, click **One Week**, and then click **OK**. + + ![Example of UI](images/waas-wsus-fig19.png) + +5. If the **Microsoft Software License Terms** dialog box opens, click **Accept**. + + If the deployment is successful, you should receive a successful progress report. + + ![Example of UI](images/waas-wsus-fig20.png) + +6. In the **Approval Progress** dialog box, click **Close**. + +
+ +## Steps to manage updates for Windows 10 + + + + + + + + +
![done](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![done](images/checklistdone.png)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![done](images/checklistdone.png)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![done](images/checklistdone.png)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![done](images/checklistdone.png)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![done](images/checklistdone.png)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or Manage Windows 10 updates using Windows Server Update Services (this topic)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + + +## Related topics + +- [Update Windows 10 in the typeprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using System Ctype Configuration Manager](waas-manage-updates-configuration-manager.md) \ No newline at end of file diff --git a/windows/manage/waas-manage-updates-wufb.md b/windows/manage/waas-manage-updates-wufb.md new file mode 100644 index 0000000000..8cf7dfc5f2 --- /dev/null +++ b/windows/manage/waas-manage-updates-wufb.md @@ -0,0 +1,136 @@ +--- +title: Manage updates using Windows Update for Business (Windows 10) +description: Windows Update for Business lets you manage when devices received updates from Windows Update. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Manage updates using Windows Update for Business + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +Windows Update for Business enables information technology administrators to keep the Windows 10 devices in their organization always up to date with the latest security defenses and Windows features by directly connecting these systems to Windows Update service. You can use Group Policy or MDM solutions such as Intune to configure the Windows Update for Business settings. Using Group Policy or MDM solutions such as Intune, you can control how and when Windows 10 devices are updated. In addition, by using Intune, organizations can manage devices that are not joined to a domain at all or are joined to Microsoft Azure Active Directory (Azure AD) alongside your on-premises domain-joined machines. + +Specifically, Windows Update for Business allows for: + +- The creation of deployment and validation groups, where administrators can specify which devices go first in an update wave, and which ones will come later (to ensure any quality bars are met). +- Selectively including or excluding drivers as part of Microsoft-provided updates +- Integration with existing management tools such as Windows Server Update Services (WSUS), System Center Configuration Manager, and Microsoft Intune. +- Peer-to-peer delivery for Microsoft updates, which optimizes bandwidth efficiency and reduces the need for an on-site server caching solution. + +Windows Update for Business is a free service that is available for Windows Pro, Enterprise, Pro Education, and Education. + +## Update types + +Windows Update for Business provides three types of updates to Windows 10 devices: + +- **Feature Updates**: previously referred to as *upgrades*, Feature Updates contain not only security and quality revisions, but also significant feature additions and changes; they are released at a slower cadence, every 4 to 8 months. +- **Quality Updates**: these are traditional operating system updates, typically released the second Tuesday of each month (though they can be released at any time). These include security, critical, and driver updates. Windows Update for Business also treats non-Windows updates (such as those for Microsoft Office or Visual Studio) as Quality Updates. These non-Windows Updates are known as *Microsoft Updates* and devices can be optionally configured to receive such updates along with their Windows Updates. +- **Non-deferrable updates**: Currently, antimalware and antispyware Definition Updates from Windows Update cannot be deferred. + +Both Feature and Quality Updates can be deferred from deploying to client devices by a Windows Update for Business administrator within a bounded rage of time from when those updates are first made available on the Windows Update Service. This deferral capability allows administrators to validate deployments as they are pushed to all client devices configured for Windows Update for Business. + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CategoryMaximum deferralDeferral incrementsExampleClassification GUID
Feature Updates180 daysDaysFrom Windows 10, version 1511 to version 16073689BDC8-B205-4AF4-8D4A-A63924C5E9D5
Quality Updates30 daysDaysSecurity updates0FA1201D-4330-4FA8-8AE9-B877473B6441
Drivers (optional)EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
Non-security updatesCD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
Microsoft updates (Office, Visual Studio, etc.)varies
Non-deferrableNo deferralNo deferralDefinition updatesE0789628-CE08-4437-BE74-2495B842F43B
+ +>[!NOTE] +>For information about classification GUIDs, see [WSUS Classification GUIDs](https://msdn.microsoft.com/en-us/library/ff357803.aspx). + +## Comparing Windows Update for Business in Windows 10, version 1511 and version 1607 + +Windows Update for Business was first made available in Windows 10, version 1511. In Windows 10, version 1607 (also known as the Anniversary Update), there are several new or changed capabilities provided as well as updated behavior. + +>[!NOTE] +>For more information on Current Branch and Current Branch for Business, see [Windows 10 servicing options](introduction-to-windows-10-servicing.md). + + + + + + + + + + + + +
CapabilityWindows 10, version 1511Windows 10, version 1607

Select Servicing Options: CB or CBB

Not available. To defer updates, all systems must be on the Current Branch for Business (CBB)

Ability to set systems on the Current Branch (CB) or Current Branch for Business (CBB).

Quality Updates

Able to defer receiving Quality Updates:

  • Up to 4 weeks
  • In weekly increments

Able to defer receiving Quality Updates:

  • Up to 30 days
  • In daily increments

Feature Updates

Able to defer receiving Feature Updates:

  • Up to 8 months
  • In monthly increments

Able to defer receiving Feature Updates:

  • Up to 180 days
  • In daily increments

Pause updates

  • Feature Updates and Quality Updates paused together
  • Maximum of 35 days

Features and Quality Updates can be paused separately.

  • Feature Updates: maximum 60 days
  • Quality Updates: maximum 35 days

Drivers

No driver-specific controls

Drivers can be selectively excluded from Windows Update for Business.

+ + +## Steps to manage updates for Windows 10 + + + + + + + + +
![done](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![done](images/checklistdone.png)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![done](images/checklistdone.png)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![done](images/checklistdone.png)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![done](images/checklistdone.png)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![done](images/checklistdone.png)Manage updates using Windows Update for Business (this topic)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) + + diff --git a/windows/manage/waas-mobile-updates.md b/windows/manage/waas-mobile-updates.md new file mode 100644 index 0000000000..615e3ec321 --- /dev/null +++ b/windows/manage/waas-mobile-updates.md @@ -0,0 +1,80 @@ +--- +title: Manage updates for Windows 10 Mobile Enterprise (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Manage updates for Windows 10 Mobile Enterprise + + +**Applies to** + +- Windows 10 Mobile + + +>[!TIP] +>If you're not familiar with the Windows 10 servicing or release branches, read [Servicing branches](waas-overview.md#servicing-branches) first. + +Devices running Windows 10 Mobile receive updates from the Current Branch (CB) unless you [enroll the device in the Windows Insider Program](waas-servicing-branches-windows-10-updates.md#enroll-devices-in-the-windows-insider-program) or assign the device to Current Branch for Business (CBB). Only devices running Windows 10 Mobile Enterprise can be assigned to CBB. + +[Learn how to upgrade Windows 10 Mobile to Windows 10 Mobile Enterprise](https://technet.microsoft.com/itpro/windows/deploy/windows-10-edition-upgrades) + +
+ +| Windows 10 edition | CB | CBB | Insider Program | +| --- | --- | --- | --- | --- | +| Mobile | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | + +
+ +Configuration of Windows 10 Mobile devices is limited to the feature set pertaining to Quality Updates only. That is, Windows Mobile Feature Updates are categorized the same as Quality Updates, and can only be deferred by setting the Quality Update deferral period, for a maximum period of 30 days. You can use mobile device management (MDM) to manage updates for Windows 10 Mobile Enterprise. Updates cannot be managed for Windows 10 Mobile. + +## Windows 10 Mobile Enterprise, version 1511 + +Only the following Windows Update for Business policies are supported: + +- ../Vendor/MSFT/Policy/Config/Update/RequireDeferredUpgrade +- ../Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod +- ../Vendor/MSFT/Policy/Config/Update/PauseDeferrals + +To defer the update period or pause deferrals, the device must be configured for CBB servicing branch by applying the **RequireDeferredUpgrade** policy. + +## Windows 10 Mobile Enterprise, version 1607 + +Only the following Windows Update for Business policies are supported: + +- ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel +- ../Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatesInDays +- ../Vendor/MSFT/Policy/Config/Update/PauseQualityUpdates + +In version 1607, you can defer and pause updates for devices on both the CB and CBB servicing branches. + +If a device running Windows 10 Mobile Enterprise, version 1511, has Windows Update for Business policies applied and is then updated to version 1607, version 1511 policies continue to apply until version 1607 policies are applied. + + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) + + + diff --git a/windows/manage/waas-optimize-windows-10-updates.md b/windows/manage/waas-optimize-windows-10-updates.md new file mode 100644 index 0000000000..e094d5389a --- /dev/null +++ b/windows/manage/waas-optimize-windows-10-updates.md @@ -0,0 +1,74 @@ +--- +title: Optimize update delivery for Windows 10 updates (Windows 10) +description: Two methods of peer-to-peer content distribution are available in Windows 10, Delivery Optimization and BranchCache. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Optimize update delivery for Windows 10 updates + + +**Applies to** + +- Windows 10 + + +When considering your content distribution strategy for Windows 10, think about enabling a form of peer-to-peer content sharing to reduce bandwidth issues during updates. Windows 10 offers two peer-to-peer options for update content distribution: Delivery Optimization and BranchCache. These technologies can be used with several of the servicing tools for Windows 10. + +Two methods of peer-to-peer content distribution are available in Windows 10. + +- [Delivery Optimization](waas-delivery-optimization.md) is a new peer-to-peer distribution method in Windows 10. Windows 10 clients can source content from other devices on their local network that have already downloaded the updates or from peers over the internet. Using the settings available for Delivery Optimization, clients can be configured into groups, allowing organizations to identify devices that are possibly the best candidates to fulfil peer-to-peer requests. + + Windows Update, Windows Update for Business, and Windows Server Update Services (WSUS) can use Delivery Optimization. Delivery Optimization can significantly reduce the amount of network traffic to external Windows Update sources as well as the time it takes for clients to retrieve the updates. + +- [BranchCache](waas-branchcache.md) is a bandwidth optimization technology that is included in some editions of the Windows Server 2016 Technical Preview and Windows 10 operating systems, as well as in some editions of Windows Server 2012 R2, Windows 8.1, Windows Server 2012, Windows 8, Windows Server 2008 R2, and Windows 7. + + >[!NOTE] + >Full BranchCache functionality is supported in Windows 10 Enterprise and Education; Windows 10 Pro supports some BranchCache functionality, including BITS transfers used for servicing operations. + + Windows Server Update Services (WSUS) and System Center Configuration Manager can use BranchCache to allow peers to source content from each other versus always having to contact a server. Using BranchCache, files are cached on each individual client, and other clients can retrieve them as needed. This approach distributes the cache rather than having a single point of retrieval, saving a significant amount of bandwidth while drastically reducing the time that it takes for clients to receive the requested content. + +

+ +| Method | Windows Update | Windows Update for Business | WSUS | Configuration Manager | +| --- | --- | --- | --- | --- | +| Delivery Optimization | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | +| BranchCache | ![no](images/crossmark.png) | ![no](images/crossmark.png) |![yes](images/checkmark.png) | ![yes](images/checkmark.png) | + +>[!NOTE] +>Starting with preview version 1604, System Center Configuration Manager has an additional feature called Client Peer Cache that allows peer-to-peer content sharing between clients you use System Center Configuration Manager to manage in the same Configuration Manager boundary group. This is expected to be available in later Configuration Manager current branch releases. +> +>In addition to client content sharing, similar functionality is available in the Windows Preinstallation Environment (Windows PE) for imaging-related content. Using this technology, clients imaging with System Center Configuration Manager task sequences can source operating system images, driver packages, boot images, packages, and programs from peers instead of distribution points. For detailed information about how Windows PE Peer Cache works and how to configure it, see [Prepare Windows PE peer cache to reduce WAN traffic in System Center Configuration Manager](https://technet.microsoft.com/en-us/library/mt613173.aspx). + + +## Steps to manage updates for Windows 10 + + + + + + + + +
![done](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![done](images/checklistdone.png)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![done](images/checklistdone.png)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![done](images/checklistdone.png)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![done](images/checklistdone.png)Optimize update delivery for Windows 10 updates (this topic)
![to do](images/checklistbox.gif)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) + + diff --git a/windows/manage/waas-overview.md b/windows/manage/waas-overview.md new file mode 100644 index 0000000000..6dd88722c4 --- /dev/null +++ b/windows/manage/waas-overview.md @@ -0,0 +1,193 @@ +--- +title: Overview of Windows as a service (Windows 10) +description: In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Overview of Windows as a service + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +The Windows 10 operating system introduces an all-new way to build, deploy, and service Windows: Windows as a service. Microsoft has reimagined each Windows component—build, deploy, and service—to simplify the lives of IT pros and maintain a consistent Windows 10 experience for its customers. These improvements focus on maximizing customer involvement in Windows development, simplifying the deployment and servicing of Windows client computers, and equalizing the number of resources needed to deploy and maintain Windows. + +The build component of Windows as a service refers to the way Microsoft provides rapid innovation to its customers and engages them every step of the way in testing and feedback. The level of visibility customers have into the ongoing development of Windows 10 is unprecedented, given the release cycle of previous Windows builds. Anyone can sign up to be part of the new rapid-release cycle for Windows, helping Microsoft address customer issues, feedback, and concerns faster than before. +Going forward, it will be simpler than ever to deploy Windows. Windows as a service provides a new way to think about strategically deploying new functionality to Windows, including application and device compatibility testing and phased rollouts of the updates themselves. This new strategy significantly reduces the need for the traditionally large migration projects that have plagued organizations looking to upgrade Windows. + +Microsoft has always had a multifaceted approach to Windows servicing, traditionally including Windows updates, operating system upgrades, and service packs, but this approach led to complexity because each servicing component was sourced from different locations and often required multiple delivery methods. In Windows 10, Microsoft has streamlined servicing to make operating system updates simpler to test, manage, and deploy. + +## Building + +Prior to Windows 10, Microsoft released new versions of Windows every few years. This traditional deployment schedule imposed a training burden on users because the feature revisions were often significant. That schedule also meant waiting long periods without new features—a scenario that doesn’t work in today’s rapidly changing world, a world in which new security, management, and deployment capabilities are necessary to address challenges. Windows as a service will deliver smaller feature updates approximately twice per year to help address these issues. + +In the past, when Microsoft developed new versions of Windows, it typically released technical previews and evaluation copies near the release-to-market date. With Windows 10, each feature update will be available to the [Windows Insider community](https://insider.windows.com/) as soon as possible—during the development cycle (approximately weekly)—so that interested parties can see exactly what Microsoft is developing and start their testing as soon as possible. This concept of rapid releases is called *flighting*. + +This new level of visibility throughout the operating system’s development cycle is unprecedented: Microsoft expects feedback throughout the development process so that it can make adjustments as quickly as possible rather than waiting until after release. In addition to the builds it frequently makes available to Windows Insiders, Microsoft has an aggressive internal testing base that consists of daily build testing by the engineering teams and internal self-hosted builds that a broader set of internal Microsoft employees consume. For more information about the Windows Insider Program and how to sign up, see the section [Windows Insider](#windows-insider). + +## Deploying + +Ongoing deployment of Windows 10 feature updates will be simpler than with previous versions of Windows. With previous releases, initial deployments and upgrades could be expensive and time-consuming. Windows as a service, through its focus on easier deployment methods and improved application compatibility, will greatly simplify the deployment process and therefore reduce the overall cost of maintenance. + +One of the biggest challenges for organizations when it comes to deploying a new version of Windows is compatibility testing. Whereas compatibility was previously a concern for organizations upgrading to a new version of Windows, Windows 10 is compatible with most hardware and software capable of running on Windows 7 or later. In Windows 10, compatibility with the Windows 7 operating system and later applications and devices is good. In fact, testing for application compatibility has been simplified to include testing of only the most important business-critical applications. + +### Application compatibility + +Application compatibility testing has historically been a burden when approaching a Windows deployment or upgrade. With Windows 10, application compatibility from the perspective of desktop applications, websites, and apps built on the Universal Windows Platform (UWP) has improved tremendously. Microsoft understands the challenges organizations experienced when they migrated from the Windows XP operating system to Windows 7 and has been working to make Windows 10 upgrades a much better experience. + +Most Windows 7–compatible desktop applications will be compatible with Windows 10 straight out of the box. Windows 10 achieved such high compatibility because the changes in the Win32 application programming interfaces were minimal, the Windows Insider Program provided valuable feedback, and Microsoft received strong telemetry data. As for websites, Windows 10 includes Internet Explorer 11 and its backward-compatibility modes for legacy websites. Finally, UWP apps follow a compatibility story similar to desktop applications, so most of them will be compatible with Windows 10. User feedback from the Windows Insider Program and the telemetry data from insiders and early-adopter upgrades have significantly helped Microsoft diagnose and resolve issues related to UWP app compatibility. + +Overall, most applications that ran on Windows 8.1, Windows 8, and Windows 7 will run on Windows 10. For the most important business-critical applications, organizations should still perform testing on a regular basis to validate compatibility with new builds. For remaining applications, consider testing them in the pilot deployment process to reduce the time spent on compatibility testing. If it’s unclear whether an application is compatible with Windows 10, IT pros can either consult with the ISV or check the supported software directory at [http://www.readyfor10.com](http://www.readyfor10.com). + +### Device compatibility + +Device compatibility in Windows 10 is outstanding. Unlike with some previous releases, most companies will not need to purchase new hardware to take advantage of Windows 10. Any device capable of running Windows 7 or later can run Windows 10. In fact, the minimum hardware requirements to run Windows 10 are the same as those required for Windows 7. Most hardware drivers that functioned in Windows 8.1, Windows 8, or Windows 7 will continue to function in Windows 10. + + +## Servicing + +Traditional Windows servicing has included several release types: major revisions (e.g., the Windows 8.1, Windows 8, and Windows 7 operating systems), service packs, and monthly updates. Typically, each type came from a different source, such as physical media, Windows Update, or downloads from Microsoft, which meant that overall management could become complicated and expensive. With Windows as a service, all Windows servicing can be sourced from the same place, and organizations can manage updates by using any of several servicing tool options. For information about each servicing tool available for Windows 10, see [Servicing tools](#servicing-tools). + +With Windows 10, organizations will need to change the way they approach deploying updates, including new concepts and changes around servicing. IT pros don’t service Windows as a service the same way they did previous builds of Windows. Servicing branches are the first way to separate users into deployment groups for feature and quality updates. With the introduction of servicing branches came the term [deployment ring](waas-deployment-rings-windows-10-updates.md), which is simply a way to categorize the combination of a deployment group and a servicing branch and put them in sequential order. For more information about a predeployment strategy necessary to plan for Windows as a service, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). + +There are two release types for Windows 10: feature updates and quality updates. Feature updates account for the functionality previously deployed in major revision upgrades. Quality updates represent traditional Windows updates. + +To align with this new update delivery model, Windows 10 has three servicing branches, each of which provides different levels of flexibility over when these updates are delivered to client computers. For information about the servicing branches available in Windows 10, see [Servicing branches](#servicing-branches). + + +### Feature updates + +With Windows 10, Microsoft will package new features into feature updates that organizations can use their existing management tools to deploy. Because feature updates are delivered more frequently than with previous Windows releases—approximately twice per year rather than every 3–5 years—changes will be in bite-sized chunks rather than all at once and end user readiness time much shorter. Finally, unlike previous major revisions, Windows 10 feature updates have native rollback capabilities, making it much simpler to retract an update should an issue arise. + +### Quality updates + +Monthly updates in previous Windows versions were often confusing and frustrating because of the sheer number of updates available each month. Many organizations selectively chose which updates they wanted to install and which they didn’t, and this created countless scenarios in which organizations deployed essential security updates but picked only a subset of nonsecurity fixes. + +In Windows 10, rather than receiving several updates for a single machine each month and trying to figure out which the organization needs, ultimately causing platform fragmentation, administrators will see one cumulative monthly update that supersedes the previous month’s update and contains both security and nonsecurity fixes. This approach makes patching simpler and ensures that customers’ PCs are more closely aligned with the testing done at Microsoft, reducing unexpected issues resulting from patching. The left side of Figure 1 provides an example of Windows 7 machines in an enterprise and what their current patch level might look like. On the right is what Microsoft’s test environment PCs contain. This drastic difference is the basis for many compatibility issues and system anomalies related to Windows updates. + +**Figure 1** + +![Comparison of patch environment in enterprise compared to test](images/waas-overview-patch.png) + + + +## Servicing branches + +To align with the new method of delivering feature updates and quality updates in Windows 10, Microsoft introduced the concept of servicing branches to allow customers to designate how aggressively their individual machines are updated. For example, an organization may have test machines that the IT department can update with new features as soon as possible, and then specialized devices that require a longer feature update cycle to ensure continuity. With that in mind, Microsoft offers three servicing branches for Windows 10: Current Branch (CB), Current Branch for Business (CBB), and Long-Term Servicing Branch (LTSB). In addition, the Windows Insider Program provides IT pros and other interested parties with prerelease Windows builds that they can test and ultimately provide feedback on to Microsoft. For details about the versions in each servicing branch, see [Windows 10 release information](https://technet.microsoft.com/windows/release-info.aspx). + +The concept of servicing branches is new, but organizations can use the same management tools they used to manage updates and upgrades in previous versions of Windows. For more information about the servicing tool options for Windows 10 and their capabilities, see [Servicing tools](#servicing-tools). + +>[!NOTE] +>Servicing branches are not the only way to separate groups of machines when consuming updates. Each branch can contain subsets of devices, which staggers servicing even further. For information about the servicing strategy and ongoing deployment process for Windows 10, including the role of servicing branches, see [Plan servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md). + + +### Current Branch + +In the CB servicing model, feature updates are available as soon as Microsoft releases them. Windows 10 version 1511 had few servicing tool options to delay CB feature updates, limiting the use of the CB servicing branch. Windows 10 version 1607, however, includes more servicing tools that can delay CB feature updates for up to 180 days. The CB servicing model is ideal for pilot deployments and testing of Windows 10 feature updates and for users such as developers who need to work with the latest features immediately. + +When Microsoft officially releases a feature update for Windows 10, that update is marked for CB, making it available to any PC not configured to defer feature updates so that those machines can immediately install it. Organizations that use Windows Server Update Services (WSUS), Microsoft System Center Configuration Manager, or Windows Update for Business, however, can defer CB feature updates to selective machines by withholding their approval and deployment. In this scenario, the content available for CB will be available but not necessarily immediately mandatory, depending on the policy of the management system. Only one CB build of Windows is supported at a time, so those clients not on the most current build will not receive quality updates (after a 60 day grace period) until the most current feature update has been installed. For more details about Windows 10 servicing tools, see [Servicing tools](#servicing-tools). + + +### Current Branch for Business + +Organizations typically prefer to have a testing cycle before broadly deploying new features to business users. For Windows 10, most pilot testing will be done using the CB servicing branch. In contrast, the CBB servicing branch is typically used for broad deployment. Windows 10 clients in the CBB servicing branch receive the same build of Windows 10 as those in the CB servicing branch, just at a later time. CB releases are transitioned to CBB after about 4 months, indicating that Microsoft, independent software vendors (ISVs), partners, and customers believe that the release is ready for broad deployment. Therefore, CB and CBB have an inherent “staging” effect. Both of these branches have a purpose in the overall deployment process for an enterprise, providing another layer of testing capabilities in addition to the traditional phased deployment methods to specific groups of machines. Microsoft will support two CBB builds at a time, approximately 1 year after it releases a build to CBB, plus a 60 day grace period. + +Figure 2 outlines an example release cycle for Windows 10 feature updates and shows how updates transition from development to the CB and CBB servicing branches. As shown in the key, the dark blue **Evaluate** region represents the time during which a feature update is in development. These builds are accessible for testing through the Windows Insider Program. For details about how to access pre-released builds by enrolling in the Windows Insider Program, see the section Windows Insider. + +The diamond **Release** on each build represents the point at which Microsoft releases a feature update to the CB servicing branch. It identifies the start of the testing, or **Pilot**, phase. The 4 months in this phase is the approximate amount of time before Microsoft releases the feature update to the CBB servicing branch. The **Deploy and Use** phase represents the broad deployment of the Windows 10 feature update to the clients in the CBB servicing branch. Machines are divided into deployment rings, as discussed in the section Ongoing deployment process. + +Finally, when a build’s support has ended, as represented by the **arrows**, organizations have a 60 day **grace** period to update to a newer release. + +**Figure 2** + +![Example release cycle](images/waas-overview-timeline.png) + +>[!NOTE] +>Organizations can electively delay CB and CBB updates into as many phases as they wish by using one of the servicing tools mentioned in the section Servicing tools. + +Basically, CBB is a configuration state, meaning that if a computer has the **Defer Updates and Upgrades** flag enabled—either through Group Policy, a mobile device management product like Microsoft Intune, or manually on the client—it’s considered to be in the CBB servicing branch. The benefit of tying this servicing model and CB to a configuration state rather than a SKU is that they are easily interchangeable. If an organization accidentally selects CBB on a machine that doesn’t need delayed updates, it’s simple to change it back. + +### Long-term Servicing Branch + +Specialized systems—such as PCs that control medical equipment, point-of-sale systems, and ATMs—often require a longer servicing option because of their purpose. These devices typically perform a single important task and don’t need feature updates as frequently as other machines in the organization. It’s more important that these devices be kept as stable and secure as possible than up to date with user interface changes. The LTSB servicing model prevents Windows 10 Enterprise LTSB devices from receiving the usual feature updates and provides only quality updates to ensure that device security stays up to date. With this in mind, quality updates are still immediately available to Windows 10 Enterprise LTSB clients, but customers can choose to defer them by using one of the servicing tools mentioned in the section Servicing tools. + +Microsoft never publishes feature updates through Windows Update on devices that run Windows 10 Enterprise LTSB. Instead, it typically offers new LTSB releases every 2–3 years, and organizations can choose to install them as in-place upgrades or even skip releases over a 10-year life cycle. + +LTSB is available only in the Windows 10 Enterprise LTSB edition. This build of Windows doesn’t contain many in-box applications, such as Microsoft Edge, Windows Store client, Cortana (limited search capabilities remain available), Microsoft Mail, Calendar, OneNote, Weather, News, Sports, Money, Photos, Camera, Music, and Clock. Therefore, it’s important to remember that Microsoft has positioned the LTSB model primarily for specialized devices. + +>[!NOTE] +>If an organization has devices currently running Windows 10 Enterprise LTSB that it would like to change to the CB or CBB servicing branch, it can make the change without losing user data. Because LTSB is its own SKU, however, an upgrade is required from Windows 10 Enterprise LTSB to Windows 10 Enterprise, which supports CB and CBB. + +### Windows Insider + +For many IT pros, gaining visibility into feature updates early—before they’re available to the CB servicing branch—can be both intriguing and valuable for future end user communications as well as provide additional prestaging for CB machines. With Windows 10, feature flighting enables Windows Insiders to consume and deploy preproduction code to their test machines, gaining early visibility into the next build. Testing the early builds of Windows 10 helps both Microsoft and its customers because they have the opportunity to discover possible issues before the update is ever publicly available and can report it to Microsoft. Also, as flighted builds get closer to their release to CB, organizations can test their deployment on test machines for compatibility validation. + +Microsoft recommends that all organizations have at least a few PCs enrolled in the Windows Insider Program and provide feedback on any issues they encounter. For information about how to sign up for the Windows Insider Program and enroll test devices, go to [https://insider.windows.com](https://insider.windows.com). + +>[!NOTE] +>The Windows Insider Program isn’t intended to replace CB deployments in an organization. Rather, it provides IT pros and other interested parties with prerelease Windows builds that they can test and ultimately provide feedback on to Microsoft. + + + +## Servicing tools + +There are many tools with which IT pros can service Windows as a service. Each option has its pros and cons, ranging from capabilities and control to simplicity and low administrative requirements. The following are examples of the servicing tools available to manage Windows as a service updates: + +- **Windows Update (stand-alone)** provides limited control over feature updates, with IT pros manually configuring the device to be in the CBB servicing branch. Organizations can control which devices defer updates and stay in the CBB servicing branch or remain in CB by selecting the Defer upgrades check box in Start\Settings\Update & Security\Advanced Options on a Windows 10 client. +- **Windows Update for Business** is the second option for servicing Windows as a service. This servicing tool includes a little more control over update deferment and provides centralized management using Group Policy. In Windows 10 version 1511, Windows Update for Business can be used to defer feature updates for up to 8 months and quality updates for up to 4 weeks. Also, these deferment options were available only to clients in the CBB servicing branch. In Windows 10 version 1607 and later, Windows Update for Business can be used to defer feature updates for up to 180 days and quality updates for up to 30 days. These deployment options are available to clients in either the CB or CBB servicing branch. In addition to being able to use Group Policy to manage Windows Update for Business, either option can be configured without requiring any on-premises infrastructure by using Intune. In addition to Intune, organizations can use Group Policy to manage Windows Update for Business. +- **Windows Server Update Services (WSUS)** provides extensive control over Windows 10 updates and is natively available in the Windows Server operating system. In addition to the ability to defer updates, organizations can add an approval layer for updates and choose to deploy them to specific computers or groups of computers whenever ready. +- **System Center Configuration Manager** provides the greatest control over servicing Windows as a service. IT pros can defer updates, approve them, and have multiple options for targeting deployments and managing bandwidth usage and deployment times. + +With all these options, which an organization chooses depends on the resources, staff, and expertise its IT organization already has. For example, if IT already uses System Center Configuration Manager to manage Windows updates, it can continue to use it. Similarly, if IT is using WSUS, it can continue to use that. For a consolidated look at the benefits of each tool, see Table 1. + +**Table 1** + +| Servicing tool | Can updates be deferred? | Ability to approve updates | Peer-to-peer option | Additional features | +| --- | --- | --- | --- | --- | +| Windows Update | Yes (manual) | No | Delivery Optimization | None| +| Windows Update for Business | Yes | No | Delivery Optimization | Other Group Policy objects | +| WSUS | Yes | Yes | BranchCache or Delivery Optimization | Upstream/downstream server scalability | +| Configuration Manager | Yes | Yes | BranchCache, Client Peer Cache | Distribution points, multiple deployment options | + +
+ +## Steps to manage updates for Windows 10 + + + + + + + + +
![to do](images/checklistdone.png)Learn about updates and servicing branches (this topic)
![to do](images/checklistbox.gif)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![to do](images/checklistbox.gif)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![to do](images/checklistbox.gif)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![to do](images/checklistbox.gif)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![to do](images/checklistbox.gif)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) + + + + + + + + diff --git a/windows/manage/waas-servicing-branches-windows-10-updates.md b/windows/manage/waas-servicing-branches-windows-10-updates.md new file mode 100644 index 0000000000..56bade4088 --- /dev/null +++ b/windows/manage/waas-servicing-branches-windows-10-updates.md @@ -0,0 +1,128 @@ +--- +title: Assign devices to servicing branches for Windows 10 updates (Windows 10) +description: tbd +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Assign devices to servicing branches for Windows 10 updates + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +>[!TIP] +>If you're not familiar with the Windows 10 servicing or release branches, read [Servicing branches](waas-overview.md#servicing-branches) first. + +Current Branch is the default servicing branch for all Windows 10 devices except those with the long-term servicing branch edition installed. The following table shows the servicing branches available to each edition of Windows 10. + +| Windows 10 edition | Current branch (CB) | Current branch for business (CBB) | Long-term servicing branch (LTSB) | Insider Program | +| --- | --- | --- | --- | --- | +| Home | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Pro | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | +| Pro Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Education | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | +| Mobile Enterprise | ![yes](images/checkmark.png) | ![yes](images/checkmark.png) | ![no](images/crossmark.png) | ![yes](images/checkmark.png) | + + + +>[!NOTE] +>The LTSB edition of Windows 10 is only available through the [Microsoft Volume Licensing Center](https://www.microsoft.com/Licensing/servicecenter/default.aspx). + +## Assign devices to Current Branch for Business + +**To assign a single PC locally to CBB** + +1. Go to **Settings** > **Update & security** > **Windows Update** > **Advanced options**. +2. Select **Defer feature updates**. + +**To assign PCs to CBB using Group Policy** + +- In Windows 10, version 1511: + + Computer Configuration > Administrative Templates > Windows Components > Windows Update > **Defer Upgrades and Updates** + +- In Windows 10, version 1607: + + Computer Configuration > Administrative Templates > Windows Components > Windows Update > Defer Windows Updates > **Select when Feature Updates are received** - enable policy and set branch readiness level to CBB + +**To assign PCs to CBB using MDM** + +- In Windows 10, version 1511: + + ../Vendor/MSFT/Policy/Config/Update/**RequireDeferredUpgrade** + +- In Windows 10, version 1607: + + ../Vendor/MSFT/Policy/Config/Update/**BranchReadinessLevel** + +**To assign Windows 10 Mobile Enterprise to CBB using MDM** + +- In Windows 10 Mobile Enterprise, version 1511: + + ../Vendor/MSFT/Policy/Config/Update/RequireDeferredUpgrade + +- In Windows 10 Mobile Enterprise, version 1607: + + ../Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel + +## Enroll devices in the Windows Insider Program + +Enrolling devices in the Windows Insider Program is simple and requires only a Microsoft account. To enroll a device in the Windows Insider Program, complete the following steps on the device that you want to enroll: + +1. Go to **Start** > **Settings** > **Update & security** > **Windows Insider Program**. + +2. Select **Get started**. + >[!NOTE] + >If you didn’t use a Microsoft account to log in to the computer, you’ll be prompted to log in. If you don’t have a Microsoft account, you can create one now. + +3. Read the privacy statement and program terms, and then click **Next**. + +6. Click **Confirm**, and then select a time to restart the computer. + +7. After you restart the device, go to **Start** > **Settings** > **Update & security** > **Windows Insider Program** to select your Insider level. The device receives the most recent Windows Insider build for the Insider level you select. The options for Insider level are: + - **Release Preview**: Insiders on this level receive builds of Windows just before Microsoft releases them for CB. Although these builds aren’t final, they are the most complete and stable builds available to Windows Insider Program participants. This level provides the best testing platform for organizations that conduct early application compatibility testing on Windows Insider PCs. + - **Slow**: The Slow Windows Insider level is for users who enjoy seeing new builds of Windows with minimal risk to their devices but still want to provide feedback to Microsoft about their experience with the new build. + - **Fast**: This level is best for Insiders who would like to be the first to experience new builds of Windows, participate in identifying and reporting issues to Microsoft, and provide suggestions on new functionality. + +## Block access to Windows Insider Program + +To prevent devices in your enterprise from being enrolled in the Insider Program for early releases of Windows 10: + +- Group Policy: Computer Configuration\Administrative Templates\Windows Components\Data Collection and Preview Builds\\**Toggle user control over Insider builds** +- MDM: Policy CSP - [System/AllowBuildPreview](https://msdn.microsoft.com/library/windows/hardware/dn904962%28v=vs.85%29.aspx#System_AllowBuildPreview) + +## Steps to manage updates for Windows 10 + + + + + + + + +
![done](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![done](images/checklistdone.png)[Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md)
![done](images/checklistdone.png)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![done](images/checklistdone.png)Assign devices to servicing branches for Windows 10 updates (this topic)
![to do](images/checklistbox.gif)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![to do](images/checklistbox.gif)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) + + diff --git a/windows/manage/waas-servicing-strategy-windows-10-updates.md b/windows/manage/waas-servicing-strategy-windows-10-updates.md new file mode 100644 index 0000000000..20366098fe --- /dev/null +++ b/windows/manage/waas-servicing-strategy-windows-10-updates.md @@ -0,0 +1,67 @@ +--- +title: Prepare servicing strategy for Windows 10 updates (Windows 10) +description: A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Prepare servicing strategy for Windows 10 updates + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +In the past, traditional Windows deployments tended to be large, lengthy, and expensive. Windows 10 offers a new approach to deploying both quality and feature updates, making the process much simpler and therefore the planning much more straightforward. With Windows as a service, the methodology around updating Windows has completely changed, moving away from major upgrades every few years to iterative updates twice per year. Each iteration contains a smaller subset of changes so that they won’t seem like substantial differences, like they do today. Figure 1 shows the level of effort needed for traditional Windows deployments versus servicing Windows 10 and how it is now spread evenly over time versus spiking every few years. + +**Figure 1** + +![Compare traditional servicing to Windows 10](images/waas-strategy-fig1.png) + +Windows 10 spreads the traditional deployment effort of a Windows upgrade, which typically occurred every few years, over smaller, continuous updates. With this change, you must approach the ongoing deployment and servicing of Windows differently. A strong Windows 10 deployment strategy begins with establishing a simple, repeatable process for testing and deploying each feature update. Here’s an example of what this process might look like: + +- **Configure test devices.** Configure testing PCs in the Windows Insider Program so that Insiders can test feature updates before they’re available to the Current Branch (CB) servicing branch. Typically, this would be a small number of test machines that IT staff members use to evaluate prereleased builds of Windows. Microsoft provides current development builds to Windows Insider members approximately every week so that interested users can see the functionality Microsoft is adding. See the section Windows Insider for details on how to enroll in the Windows Insider Program on a Windows 10 device. +- **Identify excluded PCs.** For some organizations, special-purpose devices such as those used to control factory or medical equipment or run ATMs require a stricter, less frequent feature update cycle than CB or Current Branch for Business (CBB) can offer. For those machines, you must install Windows 10 Enterprise LTSB to avoid feature updates for up to 10 years. Identify these PCs, and separate them from the phased deployment and servicing cycles to help remove confusion for your administrators and ensure that devices are handled correctly. +- **Recruit volunteers.** The purpose of testing a deployment is to receive feedback. One effective way to recruit pilot users is to request volunteers. When doing so, clearly state that you’re looking for feedback rather than people to just “try it out” and that there could be occasional issues involved with accepting feature updates right away. With Windows as a service, the expectation is that there should be few issues, but if an issue does arise, you want testers to let you know as soon as possible. When considering whom to recruit for pilot groups, be sure to include members who provide the broadest set of applications and devices to validate the largest number of apps and devices possible. +- **Choose a servicing tool.** Decide which product you’ll use to manage the Windows updates in your environment. If you’re currently using Windows Server Update Services (WSUS) or System Center Configuration Manager to manage your Windows updates, you can continue using those products to manage Windows 10 updates. Alternatively, you can use Windows Update for Business. In addition to which product you’ll use, consider how you’ll deliver the updates. With Windows 10, multiple peer-to-peer options are available to make update distribution faster. For a comparison of tools, see [Servicing tools](waas-overview.md#servicing-tools). +- **Prioritize applications.** First, create an application portfolio. This list should include everything installed in your organization and any webpages your organization hosts. Next, prioritize this list to identify those that are the most business critical. Because the expectation is that application compatibility with Windows 10 will be high, only the most business critical applications should be tested before the pilot phase; everything else can be tested afterwards. + +>[!NOTE] +>This strategy is applicable to approaching an environment in which Windows 10 already exists. For information about how to deploy or upgrade to Windows 10 where another version of Windows exists, see [Plan for Windows 10 deployment](https://technet.microsoft.com/itpro/windows/plan/index). + +Each time Microsoft releases a Windows 10 feature update, the IT department should use the following high-level process to help ensure that the broad deployment is successful: + +1. **Validate compatibility of business critical apps.** Test your most important business-critical applications for compatibility with the new Windows 10 feature update running on your Windows Insider machines identified in the earlier “Configure test machines” step of the Predeployment strategy section. The list of applications involved in this validation process should be small because most applications can be tested during the pilot phase. For more information about device and application compatibility in Windows 10, see the section Compatibility. +2. **Pilot and react to feedback.** With Windows 10, Microsoft expects application and device compatibility to be high, but it’s still important to have pilot groups within both the IT department and business units to verify application compatibility for the remaining applications in your application portfolio. Because only the most business-critical applications are tested beforehand, this will represent the majority of application compatibility testing in your environment. This should not necessarily be a formal process but rather user validation through the use of a particular application. So, the next step is to deploy the feature update to early-adopting IT users and your pilot groups running in the CB servicing branch that you identified in the “Recruit volunteers” step of the Predeployment strategy section. Be sure to communicate clearly that you’re looking for feedback as soon as possible, and state exactly how users can submit feedback to you. Should an issue arise, have a remediation plan in place to address it. For an example of what a remediation plan for an application compatibility issue arising from a Windows 10 feature update might look like, see the . +3. **Deploy broadly.** Finally, focus on the large-scale deployment using deployment rings, like the ones discussed in Table 1. Build deployment rings that target groups of computers in your selected update-management product. To reduce risk as much as possible, construct your deployment rings in a way that splits individual departments into multiple rings. This way, if you were to encounter an issue, you don’t prevent any critical business from continuing. By using this method, each deployment ring reduces risk as more and more people have been updated in any particular department. + + +## Steps to manage updates for Windows 10 + + + + + + + + +
![to do](images/checklistdone.png)[Learn about updates and servicing branches](waas-overview.md)
![to do](images/checklistdone.png)Prepare servicing strategy for Windows 10 updates (this topic)
![to do](images/checklistbox.gif)[Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md)
![to do](images/checklistbox.gif)[Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md)
![to do](images/checklistbox.gif)[Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md)
![to do](images/checklistbox.gif)[Manage updates using Windows Update for Business](waas-manage-updates-wufb.md)
+or [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md)
+or [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md)
+
+ + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) diff --git a/windows/manage/waas-update-windows-10.md b/windows/manage/waas-update-windows-10.md new file mode 100644 index 0000000000..1c2e563153 --- /dev/null +++ b/windows/manage/waas-update-windows-10.md @@ -0,0 +1,54 @@ +--- +title: Update Windows 10 in the enterprise (Windows 10) +description: Windows as a service provides an all-new way to think about building, deploying, and servicing Windows 10. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Update Windows 10 in the enterprise + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + +Windows as a service provides an all-new way to think about building, deploying, and servicing the Windows operating system. The Windows as a service model is focused on continually providing new capabilities and updates while maintaining a high level of hardware and software compatibility. Deploying new versions of Windows is simpler than ever before: Microsoft makes smaller revisions approximately twice per year rather than the traditional, larger upgrades available every few years. Ultimately, this model replaces the need for traditional Windows upgrade projects, which can be costly and time-consuming, and spreads the required effort out into a continuous updating process, reducing the overall effort required to maintain Windows 10 devices in your environment. In addition, with the Windows 10 operating system, organizations have the chance to experience “flighted” builds of Windows as Microsoft develops them, gaining insight into new features and the ability to provide continual feedback about them. + +>[!TIP] +>See [Windows 10 update history](https://support.microsoft.com/help/12387/windows-10-update-history) for details about each Windows 10 update released to date. + +## In this section + +| Topic | Description| +| --- | --- | +| [Overview of Windows as a service](waas-overview.md) | Explains the differences in building, deploying, and servicing Windows 10; introduces feature updates, quality updates, and the different servicing branches; compares servicing tools. | +| [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) | Explains the decisions you need to make in your servicing strategy. | +| [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) | Explains how to make use of servicing branches and update deferrals to manage Windows 10 updates. | +| [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) | Explains how to assign devices to Current Branch (CB) or Current Branch for Business (CBB) for feature and quality updates, and how to enroll devices in Windows Insider. | +| [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) | Explains the benefits of using Delivery Optimization or BranchCache for update distribution. | +| [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) | Explains updates for Windows 10 Mobile Enterprise. | +| [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) | Explains how to use Windows Update for Business to manage when devices receive updates directly from Windows Update. Includes walkthroughs for configuring Windows Update for Business using Group Policy and Microsoft Intune. | +| [Manage Windows 10 updates using Windows Server Update Services (WSUS)](waas-manage-updates-wsus.md) | Explains how to use WSUS to manage Windows 10 updates. | +| [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) | Explains how to use Configuration Manager to manage Windows 10 updates. | + +>[!TIP] +>Windows servicing is changing, but for disaster recovery scenarios and bare-metal deployments of Windows 10, you still can use traditional imaging software such as System Center Configuration Manager or the Microsoft Deployment Toolkit. Using these tools to deploy Windows 10 images is similar to deploying previous versions of Windows. +>With each release of a new feature update for CB, Microsoft makes available new .iso files for use in updating your custom images. Each Windows 10 build has a finite servicing lifetime, so it’s important that images stay up to date with the latest build. For detailed information about how to deploy Windows 10 to bare-metal machines or to upgrade to Windows 10 from previous builds of Windows, see [Deploy Windows 10 with System Center 2012 R2 Configuration Manager](https://technet.microsoft.com/itpro/windows/deploy/deploy-windows-10-with-system-center-2012-r2-configuration-manager). + + +## Related topics + + +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) + + + diff --git a/windows/manage/waas-wufb-group-policy.md b/windows/manage/waas-wufb-group-policy.md new file mode 100644 index 0000000000..9d5bf8c874 --- /dev/null +++ b/windows/manage/waas-wufb-group-policy.md @@ -0,0 +1,348 @@ +--- +title: Walkthrough use Group Policy to configure Windows Update for Business (Windows 10) +description: Configure Windows Update for Business settings using Group Policy. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Walkthrough: use Group Policy to configure Windows Update for Business + + +**Applies to** + +- Windows 10 + + +Using Group Policy to manage Windows Update for Business is simple and familiar: use the same Group Policy Management Console (GPMC) you use to manage other device and user policy settings in your environment. Before configuring the Windows Update for Business Group Policy settings, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment. + +In Windows 10 version 1511, only Current Branch for Business (CBB) upgrades could be delayed, restricting the Current Branch (CB) builds to a single deployment ring. Windows 10 version 1607, however, has a new Group Policy setting that allows you to delay feature updates for both CB and CBB, broadening the use of the CB servicing branch. + +>[!NOTE] +>The terms *feature updates* and *quality updates* in Windows 10, version 1607, correspond to the terms *upgrades* and *updates* in version 1511. + +To use Group Policy to manage quality and feature updates in your environment, you must first create Active Directory security groups that align with your constructed deployment rings. Most customers have many deployment rings already in place in their environment, and these rings likely align with existing phased rollouts of current patches and operating system upgrades. + +## Configure Windows Update for Business in Windows 10 version 1511 + +In this example, you use two security groups to manage your updates: **Ring 3 Broad IT** and **Ring 4 Broad Business Users** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). + +- The **Ring 3 Broad IT** group contains PCs of IT members who test the updates as soon as they’re released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices. +- The **Ring 4 Broad Business Users** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release. + +>[!NOTE] +>Windows 10 version 1511 does not support deferment of CB builds of Windows 10, so you can establish only one CB deployment ring. In version 1607 and later, CB builds can be delayed, making it possible to have multiple CB deployment rings. + + Complete the following steps on a PC running the Remote Server Administration Tools or on a domain controller. + + ### Configure the Ring 3 Broad IT deployment ring for CBB with no deferral + +1. Open GPMC (gpmc.msc). + +2. Expand **Forest** > **Domains** > *your domain*. + +3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. + + ![UI for Create GPO menu](images/waas-wufb-gp-create.png) + +4. In the **New GPO** dialog box, type **Windows Update for Business - CBB1** for the name of the new GPO. + + >[!NOTE] + >In this example, you’re linking the GPO to the top-level domain. This is not a requirement: you can link the Windows Update for Business GPOs to any organizational unit (OU) that’s appropriate for your Active Directory Domain Services (AD DS) structure. + +5. Right-click the **Windows Update for Business - CBB1** GPO, and then click **Edit**. + + ![UI for Edit GPO](images/waas-wufb-gp-edit.png) + +6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update**. + +7. Right-click **Defer Upgrades and Updates**, and then click **Edit**. + + ![UI to edit Defer Upgrades and Updates](images/waas-wufb-gp-edit-defer.png) + + In the **Defer Upgrades and Updates** Group Policy setting configuration, you see several options: + - **Enable/Disable Deferred Updates**. Enabling this policy setting sets the receiving client to the CBB servicing branch. Specifically disabling this policy forces the client into the CB servicing branch, making it impossible for users to change it. + - **Defer upgrades for the following**. This option allows you to delay feature updates up to 8 months, a number added to the default CBB delay (approximately 4 months from CB). By using Windows Update for Business, you can use this option to stagger CBB feature updates, making the total offset up to 12 months from CB. + - **Defer updates for the following**. This option allows you to delay the installation of quality updates on a Windows 10 device for up to 4 weeks, allowing for phased rollouts of updates in your enterprise, but not all quality updates are deferrable with this option. Table 1 shows the deferment capabilities by update type. + - **Pause Upgrades and Updates**. Should an issue arise with a feature update, this option allows a one-time skip of the current month’s quality and feature update. Quality updates will resume after 35 days, and feature updates will resume after 60 days. For example, deploy this setting as a stand-alone policy to the entire organization in an emergency. + + Table 1 summarizes the category of update in Windows 10 and how long Windows Update for Business can defer its installation. + + **Table 1** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CategoryMaximum deferralDeferral incrementsClassification typeClassification GUID
OS upgrades8 months1 monthUpgrade3689BDC8-B205-4AF4-8D4A-A63924C5E9D5
OS updates4 weeks1 weekSecurity updates0FA1201D-4330-4FA8-8AE9-B877473B6441
DriversEBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
UpdatesCD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
Other/non-deferrableNo deferralNo deferralDefinition updatesE0789628-CE08-4437-BE74-2495B842F43B
+ + Simply enabling the **Defer Upgrades and Updates** policy sets the receiving client to the CBB servicing branch, which is what you want for your first deployment ring, **Ring 3 Broad IT**. + +8. Enable the **Defer Updates and Upgrades** setting, and then click **OK**. + +9. Close the Group Policy Management Editor. + +Because the **Windows Update for Business - CBB1** GPO contains a computer policy and you only want to apply it to computers in the **Ring 3 Broad IT** group, use **Security Filtering** to scope the policy’s effect. + +### Scope the policy to the Ring 3 Broad IT group + +1. In the GPMC, select the **Windows Update for Business - CBB1** policy. + +2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 3 Broad IT** group. + + ![Scope policy to group](images/waas-wufb-gp-scope.png) + + +The **Ring 3 Broad IT** deployment ring has now been configured. Next, configure **Ring 4 Broad Business Users** to accommodate a 1-week delay for quality updates and a 1-month delay for feature updates. + + +### Configure the Ring 4 Broad Business Users deployment ring for CBB with deferrals + +1. Open GPMC (gpmc.msc). + +2. Expand **Forest** > **Domains** > *your domain*. + +3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. + + ![UI for Create GPO menu](images/waas-wufb-gp-create.png) + +4. In the **New GPO** dialog box, type **Windows Update for Business - CBB2** for the name of the new GPO. + +5. Right-click the **Windows Update for Business - CBB2** GPO, and then click **Edit**. + + ![UI for Edit GPO](images/waas-wufb-gp-edit.png) + +6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update**. + +7. Right-click **Defer Upgrades and Updates**, and then click **Edit**. + +8. Enable the **Defer Updates and Upgrades** setting, configure the **Defer upgrades for the following** option for 1 month, and then configure the **Defer updates for the following** option for 1 week. + + ![Example of policy settings](images/waas-wufb-gp-broad.png) + +9. Click **OK** and close the Group Policy Management Editor. + + +### Scope the policy to the Ring 4 Broad Business Users group + +1. In the GPMC, select the **Windows Update for Business - CBB2** policy. + +2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 4 Broad Business Users** group. + +## Configure Windows Update for Business in Windows 10 version 1607 + +To use Group Policy to manage quality and feature updates in your environment, you must first create Active Directory security groups that align with your constructed deployment rings. Most customers have many deployment rings already in place in their environment, and these rings likely align with existing phased rollouts of current patches and operating system upgrades. + +In this example, you use three security groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to manage your updates: + +- **Ring 2 Pilot Business Users** contains the PCs of business users which are part of the pilot testing process, receiving CB builds just 14 days after they are released. +- **Ring 3 Broad IT** consists of IT members who receive updates after Microsoft releases a Windows 10 build to the CBB servicing branch. +- **Ring 4 Broad Business Users** consists of LOB users on CBB, who receive quality updates after 7 days and feature updates after 30 days. + +In this example, you configure and scope the update schedules for all three groups. + +### Configure Ring 2 Pilot Business Users policy + +1. Open GPMC (gpmc.msc). + +2. Expand **Forest** > **Domains** > *your domain*. + +3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. + + ![UI for Create GPO menu](images/waas-wufb-gp-create.png) + +4. In the **New GPO** dialog box, type **Windows Update for Business - CB2** for the name of the new GPO. + + >[!NOTE] + >In this example, you’re linking the GPO to the top-level domain. This is not a requirement: you can link the Windows Update for Business GPOs to any organizational unit (OU) that’s appropriate for your Active Directory Domain Services (AD DS) structure. + +5. Right-click the **Windows Update for Business - CB2** GPO, and then click **Edit**. + + ![Edit menu for this GPO](images/waas-wufb-gp-cb2.png) + +6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Defer Windows Updates**. + +7. Right-click **Select when Feature Updates are received**, and then click **Edit**. + +8. In the **Select when Feature Updates are received** policy, enable it, select a branch readiness level of **CB**, set the feature update delay to **14** days, and then click **OK**. + + ![Settings for this GPO](images/waas-wufb-gp-cb2-settings.png) + + Table 3 summarizes the category of updates in Windows 10, version 1607, and how long Windows Update for Business can defer its installation. + + **Table 3** + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
CategoryMaximum deferralDeferral incrementsExampleClassification GUID
Feature Updates180 daysDaysFrom Windows 10, version 1511 to version 16073689BDC8-B205-4AF4-8D4A-A63924C5E9D5
Quality Updates30 daysDaysSecurity updates0FA1201D-4330-4FA8-8AE9-B877473B6441
Drivers (optional)EBFC1FC5-71A4-4F7B-9ACA-3B9A503104A0
Non-security updatesCD5FFD1E-E932-4E3A-BF74-18BF0B1BBD83
Microsoft updates (Office, Visual Studio, etc.)varies
Non-deferrableNo deferralNo deferralDefinition updatesE0789628-CE08-4437-BE74-2495B842F43B
+ +9. Close the Group Policy Management Editor. + +Because the **Windows Update for Business – CB2** GPO contains a computer policy and you only want to apply it to computers in the **Ring 2 Pilot Business Users** group, use **Security Filtering** to scope the policy’s effect. + +### Scope the policy to the Ring 2 Pilot Business Users group + +1. In the GPMC, select the **Windows Update for Business - CB2** policy. + +2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 2 Pilot Business Users** group. + + ![Scope policy to group](images/waas-wufb-gp-scope-cb2.png) + +The **Ring 2 Pilot Business Users** deployment ring has now been configured. Next, configure **Ring 3 Broad IT** to set those clients into the CBB servicing branch so that they receive feature updates as soon as they’re made available for the CB servicing branch. + +### Configure Ring 3 Broad IT policy + +1. Open GPMC (gpmc.msc). + +2. Expand **Forest** > **Domains** > *your domain*. + +3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, type **Windows Update for Business - CBB1** for the name of the new GPO. + +5. Right-click the **Windows Update for Business - CBB1** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Defer Windows Updates**. + +7. Right-click **Select when Feature Updates are received**, and then click **Edit**. + +8. In the **Select when Feature Updates are received** policy, enable it, select a branch readiness level of **CBB**, and then click **OK**. + + ![Settings for this GPO](images/waas-wufb-gp-cbb1-settings.png) + +9. Close the Group Policy Management Editor. + + + +### Scope the policy to the Ring 3 Broad IT group + +1. In the GPMC, select the **Windows Update for Business - CBB1** policy. + +2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 3 Broad IT** group. + + +The **Ring 3 Broad IT** deployment ring has now been configured. Finally, configure **Ring 4 Broad Business Users** to accommodate a 7-day delay for quality updates and a 30-day delay for feature updates + +### Configure Ring 4 Broad Business Users policy + +1. Open GPMC (gpmc.msc). + +2. Expand **Forest** > **Domains** > *your domain*. + +3. Right-click *your domain* and select **Create a GPO in this domain, and Link it here**. + +4. In the **New GPO** dialog box, type **Windows Update for Business - CBB2** for the name of the new GPO. + +5. Right-click the **Windows Update for Business - CBB2** GPO, and then click **Edit**. + +6. In the Group Policy Management Editor, go to **Computer Configuration** > **Policies** > **Administrative Templates** > **Windows Components** > **Windows Update** > **Defer Windows Updates**. + +7. Right-click **Select when Feature Updates are received**, and then click **Edit**. + +8. In the **Select when Feature Updates are received** policy, enable it, select a branch readiness level of **CBB**, set the feature update delay to **30** days, and then click **OK**. + + ![Settings for this GPO](images/waas-wufb-gp-cbb2-settings.png) + +9. Right-click **Select when Quality Updates are received**, and then click **Edit**. + +10. In the **Select when Quality Updates are received** policy, enable it, set the quality update delay to **7** days, and then click **OK**. + + ![Settings for this GPO](images/waas-wufb-gp-cbb2q-settings.png) + +11. Close the Group Policy Management Editor. + + + +### Scope the policy to the Ring 4 Broad IT group + +1. In the GPMC, select the **Windows Update for Business - CBB2** policy. + +2. In **Security Filtering** on the **Scope** tab, remove the default **AUTHENTICATED USERS** security group, and add the **Ring 4 Broad Business Users** group. + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Intune to configure Windows Update for Business](waas-wufb-intune.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) \ No newline at end of file diff --git a/windows/manage/waas-wufb-intune.md b/windows/manage/waas-wufb-intune.md new file mode 100644 index 0000000000..a5690c15e6 --- /dev/null +++ b/windows/manage/waas-wufb-intune.md @@ -0,0 +1,278 @@ +--- +title: Walkthrough use Intune to configure Windows Update for Business (Windows 10) +description: Configure Windows Update for Business settings using Microsoft Intune. +ms.prod: w10 +ms.mktglfcycl: manage +ms.sitesec: library +author: jdeckerMS +localizationpriority: high +--- + +# Walkthrough: use Microsoft Intune to configure Windows Update for Business + + +**Applies to** + +- Windows 10 +- Windows 10 Mobile + + +You can use Intune to configure Windows Update for Business even if you don’t have on-premises infrastructure when you use Intune in conjunction with Azure AD. Before configuring Windows Update for Business, consider a [deployment strategy](waas-servicing-strategy-windows-10-updates.md) for updates and feature updates in your environment. + +Windows Update for Business in Windows 10 version 1511 allows you to delay quality updates up to 4 weeks and feature updates up to an additional 8 months after Microsoft releases builds to the Current Branch for Business (CBB) servicing branch. In Windows 10 version 1607 and later, you can delay quality updates for up to 30 days and feature updates up to an additional 180 days after the release of either a Current Branch (CB) or CBB build. + +To use Intune to manage quality and feature updates in your environment, you must first create computer groups that align with your constructed deployment rings. + +>[!NOTE] +>Coming soon: [Intune Groups will be converted to Azure Active Directory-based Security Groups](https://docs.microsoft.com/en-us/intune/deploy-use/use-groups-to-manage-users-and-devices-with-microsoft-intune) + +## Configure Windows Update for Business in Windows 10, version 1511 + +In this example, you use two security groups to manage your updates: **Ring 3 Broad IT** and **Ring 4 Broad Business Users** from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md). + +- The **Ring 3 Broad IT** group contains PCs of IT members who test the updates as soon as they’re released for Windows clients in the Current Branch for Business (CBB) servicing branch. This phase typically occurs after testing on Current Branch (CB) devices. +- The **Ring 4 Broad Business Users** group consists of the first line-of-business (LOB) users, who consume quality updates after 1 week and feature updates 1 month after the CBB release. + +### Configure the Ring 3 Broad IT deployment ring for CBB with no deferral + +1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. + +5. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. + +7. In the **Value** box, type **1**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + ![Settings for this policy](images/waas-wufb-intune-step7.png) + +8. For this deployment ring, you’re required to enable only CBB, so click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 3 Broad IT** group, click **Add**, and then click **OK**. + +You have now configured the **Ring 3 Broad IT** deployment ring to enable the CBB servicing branch. Now, you must configure **Ring 4 Broad Business Users** to accommodate a 1-week delay for quality updates and a 1-month delay for feature updates. + +### Configure the Ring 4 Broad Business Users deployment ring for CBB with deferrals + +1. In the Policy workspace, click **Configuration Policies**, and then click **Add**. + +2. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +3. Name the policy **Windows Update for Business – CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. + In this policy, you add two OMA-URI settings, one for each deferment type. + +4. In **Setting name**, type **Enable Clients for CBB**, and then in the **Data type** list, select **Integer**. + +6. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/RequireDeferUpgrade**. Then, in the **Value** box, type **1**. + +7. Click **OK** to save the setting. + +8. In the **OMA-URI Settings** section, click **Add**. + +9. For this setting, in **Setting name**, type **Defer Updates for 1 Week**, and then in the **Data type** list, select **Integer**. + +11. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferUpdatePeriod**. + +12. In the **Value** box, type **1**. + +13. Click **OK** to save the setting. + +14. In the **OMA-URI Settings** section, click **Add**. + +15. For this setting, in **Setting name**, type **Defer Upgrades for 1 Month**, and then in the **Data type** list, select **Integer**. + +17. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferUpgradePeriod**. + +18. In the **Value** box, type **1**. + +19. Click **OK** to save the setting. + + Three settings should appear in the **Windows Update for Business – CBB2** policy. + + ![Settings for CBB2 policy](images/waas-wufb-intune-step19.png) + +20. Click **Save Policy**, and then click **Yes** at the **Deploy Policy** prompt. + +21. In the **Manage Deployment** dialog box, select the **Ring 4 Broad Business Users** computer group, click **Add**, and then click **OK**. + +## Configure Windows Update for Business in Windows 10 version 1607 + +To use Intune to manage quality and feature updates in your environment, you must first create computer groups that align with your constructed deployment rings. + +In this example, you use three security groups from Table 1 in [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) to manage your updates: + +- **Ring 2 Pilot Business Users** contains the PCs of business users which are part of the pilot testing process, receiving CB builds just 14 days after they are released. +- **Ring 3 Broad IT** consists of IT members who receive updates after Microsoft releases a Windows 10 build to the CBB servicing branch. +- **Ring 4 Broad Business Users** consists of LOB users on CBB, who receive quality updates after 7 days and feature updates after 30 days. + +### Configure Ring 2 Pilot Business Users policy + +1. Sign in to [https://manage.microsoft.com](https://manage.microsoft.com) with your Intune administrator credentials. + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CB2**. Then, in the **OMA-URI Settings** section, click **Add**. + +4. In **Setting name**, type **Enable Clients for CB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. + +7. In the **Value** box, type **0**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + ![Settings for this policy](images/waas-wufb-intune-cb2.png) + +8. Because the **Ring 2 Pilot Business Users** deployment ring receives the CB feature updates after 14 days, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +8. In **Setting name**, type **Defer feature updates for 14 days**, and then select **Integer** from the **Data type** list. +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatePeriodInDays**. +11. In the **Value** box, type **14**, and then click **OK**. + + ![Settings for this policy](images/waas-wufb-intune-step11.png) + +9. Click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CB2** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment: Windows Update for Business – CB2** dialog box, select the **Ring 2 Pilot Business Users** group, click **Add**, and then click **OK**. + +You have now configured the **Ring 2 Pilot Business Users** deployment ring to enable CB feature update deferment for 14 days. Now, you must configure **Ring 3 Broad IT** to receive CBB features updates as soon as they’re available. + +### Configure Ring 3 Broad IT policy + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB1**. Then, in the **OMA-URI Settings** section, click **Add**. + +4. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. + +7. In the **Value** box, type **1**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + +8. Because the **Ring 3 Broad IT** deployment ring receives the CBB feature updates immediately, in the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +8. In **Setting name**, type **Defer feature updates for 0 days**, and then select **Integer** from the **Data type** list. + +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatePeriodInDays**. + +11. In the **Value** box, type **0**, and then click **OK**. + + ![Settings for this policy](images/waas-wufb-intune-cbb1.png) + +9. Click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CBB1** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment: Windows Update for Business – CBB1** dialog box, select the **Ring 3 Broad IT** group, click **Add**, and then click **OK**. + +You have now configured the **Ring 3 Broad IT** deployment ring to receive CBB feature updates as soon as they’re available. Finally, configure **Ring 4 Broad Business Users** to accommodate a 7-day delay for quality updates and a 30-day delay for feature updates. + + +### Configure Ring 4 Broad Business Users policy + +2. Click the **Policy** workspace. In the middle pane, click **Configuration Policies**, and then click **Add** in the details pane. + + ![Shows the UI for this step](images/waas-wufb-intune-step2.png) + +3. In the Create a New Policy Wizard, select **Windows\Custom Configuration (Windows 10 Desktop and Mobile and later)**, and then click **Create Policy**. + +4. Name the policy **Windows Update for Business - CBB2**. Then, in the **OMA-URI Settings** section, click **Add**. + +4. In **Setting name**, type **Enable Clients for CBB**, and then select **Integer** from the **Data type** list. + +6. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/BranchReadinessLevel**. + +7. In the **Value** box, type **1**, and then click **OK**. + + >[!NOTE] + >The OMA-URI settings are case sensitive, so be sure to review [Policy CSP](https://msdn.microsoft.com/library/windows/hardware/dn904962.aspx) for the proper syntax. + + +8. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +8. In **Setting name**, type **Defer quality updates for 7 days**, and then select **Integer** from the **Data type** list. + +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferQualityUpdatePeriodInDays**. + +11. In the **Value** box, type **7**, and then click **OK**. + +8. In the **OMA-URI Settings** section, click **Add** to add another OMA-URI setting. + +8. In **Setting name**, type **Defer feature updates for 30 days**, and then select **Integer** from the **Data type** list. + +10. In the **OMA-URI** box, type **.Vendor/MSFT/Policy/Config/Update/DeferFeatureUpdatePeriodInDays**. + +11. In the **Value** box, type **30**, and then click **OK**. + + ![Settings for this policy](images/waas-wufb-intune-cbb2.png) + +9. Click **Save Policy**. + +9. In the **Deploy Policy: Windows Update for Business – CBB2** dialog box, click **Yes**. + + >[!NOTE] + >If this dialog box doesn't appear, select the policy, and then click **Manage Deployment**. + +10. In the **Manage Deployment: Windows Update for Business – CBB2** dialog box, select the **Ring 3 Broad Business Users** group, click **Add**, and then click **OK**. + +## Related topics + +- [Update Windows 10 in the enterprise](waas-update-windows-10.md) +- [Overview of Windows as a service](waas-overview.md) +- [Prepare servicing strategy for Windows 10 updates](waas-servicing-strategy-windows-10-updates.md) +- [Build deployment rings for Windows 10 updates](waas-deployment-rings-windows-10-updates.md) +- [Assign devices to servicing branches for Windows 10 updates](waas-servicing-branches-windows-10-updates.md) +- [Optimize update delivery for Windows 10 updates](waas-optimize-windows-10-updates.md) +- [Configure Delivery Optimization for Windows 10 updates](waas-delivery-optimization.md) +- [Configure BranchCache for Windows 10 updates](waas-branchcache.md) +- [Manage updates for Windows 10 Mobile Enterprise](waas-mobile-updates.md) +- [Manage updates using Windows Update for Business](waas-manage-updates-wufb.md) +- [Configure Windows Update for Business](waas-configure-wufb.md) +- [Integrate Windows Update for Business with management solutions](waas-integrate-wufb.md) +- [Walkthrough: use Group Policy to configure Windows Update for Business](waas-wufb-group-policy.md) +- [Manage Windows 10 updates using Windows Server Update Services](waas-manage-updates-wsus.md) +- [Manage Windows 10 updates using System Center Configuration Manager](waas-manage-updates-configuration-manager.md) + + + + + + + + diff --git a/windows/plan/TOC.md b/windows/plan/TOC.md index 7118e1238c..723d5f5e7e 100644 --- a/windows/plan/TOC.md +++ b/windows/plan/TOC.md @@ -1,11 +1,7 @@ # [Plan for Windows 10 deployment](index.md) -## [Windows 10 servicing overview](windows-10-servicing-options.md) ## [Windows 10 deployment considerations](windows-10-deployment-considerations.md) ## [Windows 10 compatibility](windows-10-compatibility.md) ## [Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) -## [Windows Update for Business](windows-update-for-business.md) -### [Setup and deployment](setup-and-deployment.md) -### [Integration with management solutions](integration-with-management-solutions-.md) ## [Windows To Go: feature overview](windows-to-go-overview.md) ### [Best practice recommendations for Windows To Go](best-practice-recommendations-for-windows-to-go.md) ### [Deployment considerations for Windows To Go](deployment-considerations-for-windows-to-go.md) diff --git a/windows/plan/change-history-for-plan-for-windows-10-deployment.md b/windows/plan/change-history-for-plan-for-windows-10-deployment.md index b584bf2f8d..dc184fd7e8 100644 --- a/windows/plan/change-history-for-plan-for-windows-10-deployment.md +++ b/windows/plan/change-history-for-plan-for-windows-10-deployment.md @@ -13,6 +13,13 @@ author: TrudyHa This topic lists new and updated topics in the [Plan for Windows 10 deployment](index.md) documentation for [Windows 10 and Windows 10 Mobile](../index.md). +## August 2016 + +| New or changed topic | Description | +| --- | --- | +| Windows 10 servicing overview | New content replaced this topic; see [Overview of Windows as a service](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview) | +| Windows Update for Business
Setup and deployment of Windows Update for Business
Integration of Windows Update for Business with management solutions | New content replaced these topics; see [Manage updates using Windows Update for Business](https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb) | + ## RELEASE: Windows 10, version 1607 diff --git a/windows/plan/index.md b/windows/plan/index.md index 1a3583938b..011707b9b5 100644 --- a/windows/plan/index.md +++ b/windows/plan/index.md @@ -15,11 +15,9 @@ Windows 10 provides new deployment capabilities, scenarios, and tools by buildi ## In this section |Topic |Description | |------|------------| -|[Windows 10 servicing options](windows-10-servicing-options.md) |Windows 10 provides a new model for organizations to deploy and upgrade Windows by providing updates to features and capabilities through a continual process. | |[Windows 10 deployment considerations](windows-10-deployment-considerations.md) |There are new deployment options in Windows 10 that help you simplify the deployment process and automate migration of existing settings and applications. | |[Windows 10 compatibility](windows-10-compatibility.md) |Windows 10 will be compatible with most existing PC hardware; most devices running Windows 7, Windows 8, or Windows 8.1 will meet the requirements for Windows 10. | |[Windows 10 infrastructure requirements](windows-10-infrastructure-requirements.md) |There are specific infrastructure requirements to deploy and manage Windows 10 that should be in place prior to significant Windows 10 deployments within your organization. | -|[Windows Update for Business](windows-update-for-business.md) |Get an overview of how you can implement and deploy a Windows Update for Business solution and how to maintain enrolled systems. | |[Windows To Go: feature overview](windows-to-go-overview.md) |Windows To Go is a feature in Windows 10 Enterprise and Windows 10 Education that enables the creation of a Windows To Go workspace that can be booted from a USB-connected external drive on PCs. | |[Application Compatibility Toolkit (ACT) Technical Reference](act-technical-reference.md) |The Microsoft® Application Compatibility Toolkit (ACT) helps you determine whether the applications, devices, and computers in your organization are compatible with versions of the Windows® operating system. | |[Change history for Plan for Windows 10 deployment](change-history-for-plan-for-windows-10-deployment.md) |This topic lists new and updated topics in the Plan for Windows 10 deployment documentation for [Windows 10 and Windows 10 Mobile](../index.md). | diff --git a/windows/plan/integration-with-management-solutions-.md b/windows/plan/integration-with-management-solutions-.md index 73206e6baf..7246b22a3a 100644 --- a/windows/plan/integration-with-management-solutions-.md +++ b/windows/plan/integration-with-management-solutions-.md @@ -8,6 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb --- # Integration with management solutions diff --git a/windows/plan/setup-and-deployment.md b/windows/plan/setup-and-deployment.md index 031ddf53b9..5b4e082c43 100644 --- a/windows/plan/setup-and-deployment.md +++ b/windows/plan/setup-and-deployment.md @@ -8,6 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing, devices author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb --- # Setup and deployment diff --git a/windows/plan/windows-10-servicing-options.md b/windows/plan/windows-10-servicing-options.md index 83af9a41f3..8ad9c29c5a 100644 --- a/windows/plan/windows-10-servicing-options.md +++ b/windows/plan/windows-10-servicing-options.md @@ -8,6 +8,7 @@ ms.mktglfcycl: plan ms.pagetype: servicing ms.sitesec: library author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/waas-overview --- # Windows 10 servicing overview diff --git a/windows/plan/windows-update-for-business.md b/windows/plan/windows-update-for-business.md index 663a7bba06..e8d7b01f15 100644 --- a/windows/plan/windows-update-for-business.md +++ b/windows/plan/windows-update-for-business.md @@ -8,6 +8,7 @@ ms.mktglfcycl: plan ms.sitesec: library ms.pagetype: servicing; devices author: jdeckerMS +redirect_url: https://technet.microsoft.com/en-us/itpro/windows/manage/waas-manage-updates-wufb --- # Windows Update for Business