diff --git a/windows/client-management/mdm/policy-csp-settings.md b/windows/client-management/mdm/policy-csp-settings.md index 69c7b52c83..9233d3ba59 100644 --- a/windows/client-management/mdm/policy-csp-settings.md +++ b/windows/client-management/mdm/policy-csp-settings.md @@ -68,38 +68,14 @@ manager: dansimp **Settings/AllowAutoPlay** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -139,38 +115,14 @@ The following list shows the supported values: **Settings/AllowDataSense** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -206,38 +158,14 @@ The following list shows the supported values: **Settings/AllowDateTime** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -270,38 +198,14 @@ The following list shows the supported values: **Settings/AllowLanguage** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -338,38 +242,14 @@ The following list shows the supported values: **Settings/AllowOnlineTips** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -406,38 +286,14 @@ ADMX Info: **Settings/AllowPowerSleep** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -474,38 +330,14 @@ The following list shows the supported values: **Settings/AllowRegion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -542,38 +374,14 @@ The following list shows the supported values: **Settings/AllowSignInOptions** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -610,38 +418,14 @@ The following list shows the supported values: **Settings/AllowVPN** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -674,38 +458,14 @@ The following list shows the supported values: **Settings/AllowWorkplace** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -742,38 +502,14 @@ The following list shows the supported values: **Settings/AllowYourAccount** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -806,38 +542,14 @@ The following list shows the supported values: **Settings/ConfigureTaskbarCalendar** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -880,38 +592,14 @@ The following list shows the supported values: **Settings/PageVisibilityList** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-smartscreen.md b/windows/client-management/mdm/policy-csp-smartscreen.md index e7db6a71e2..3ed9fb87eb 100644 --- a/windows/client-management/mdm/policy-csp-smartscreen.md +++ b/windows/client-management/mdm/policy-csp-smartscreen.md @@ -39,38 +39,14 @@ manager: dansimp **SmartScreen/EnableAppInstallControl** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -114,38 +90,14 @@ The following list shows the supported values: **SmartScreen/EnableSmartScreenInShell** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -186,38 +138,14 @@ The following list shows the supported values: **SmartScreen/PreventOverrideForFilesInShell** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-speech.md b/windows/client-management/mdm/policy-csp-speech.md index 40c0182de2..9ce8943851 100644 --- a/windows/client-management/mdm/policy-csp-speech.md +++ b/windows/client-management/mdm/policy-csp-speech.md @@ -33,38 +33,14 @@ manager: dansimp **Speech/AllowSpeechModelUpdate** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-start.md b/windows/client-management/mdm/policy-csp-start.md index 588586543f..a4659bf1ff 100644 --- a/windows/client-management/mdm/policy-csp-start.md +++ b/windows/client-management/mdm/policy-csp-start.md @@ -120,38 +120,14 @@ manager: dansimp **Start/AllowPinnedFolderDocuments** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -185,38 +161,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderDownloads** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -250,38 +202,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderFileExplorer** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -315,38 +243,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderHomeGroup** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -380,38 +284,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderMusic** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -445,38 +325,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderNetwork** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -510,38 +366,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderPersonalFolder** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -575,38 +407,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderPictures** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -640,38 +448,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderSettings** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -705,38 +489,14 @@ The following list shows the supported values: **Start/AllowPinnedFolderVideos** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -770,38 +530,14 @@ The following list shows the supported values: **Start/DisableContextMenus** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -849,38 +585,14 @@ The following list shows the supported values: **Start/ForceStartSize** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -922,38 +634,14 @@ The following list shows the supported values: **Start/HideAppList** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1003,38 +691,14 @@ The following list shows the supported values: **Start/HideChangeAccountSettings** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1074,38 +738,14 @@ To validate on Desktop, do the following: **Start/HideFrequentlyUsedApps** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1153,38 +793,14 @@ To validate on Desktop, do the following: **Start/HideHibernate** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1228,38 +844,14 @@ To validate on Laptop, do the following: **Start/HideLock** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1299,38 +891,14 @@ To validate on Desktop, do the following: **Start/HidePeopleBar** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1373,38 +941,14 @@ The following list shows the supported values: **Start/HidePowerButton** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1447,38 +991,14 @@ To validate on Desktop, do the following: **Start/HideRecentJumplists** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1528,38 +1048,14 @@ To validate on Desktop, do the following: **Start/HideRecentlyAddedApps** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1615,38 +1111,14 @@ To validate on Desktop, do the following: **Start/HideRestart** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1686,38 +1158,14 @@ To validate on Desktop, do the following: **Start/HideShutDown** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1757,38 +1205,14 @@ To validate on Desktop, do the following: **Start/HideSignOut** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1828,38 +1252,14 @@ To validate on Desktop, do the following: **Start/HideSleep** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1899,38 +1299,14 @@ To validate on Desktop, do the following: **Start/HideSwitchAccount** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1970,38 +1346,14 @@ To validate on Desktop, do the following: **Start/HideUserTile** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2045,38 +1397,14 @@ To validate on Desktop, do the following: **Start/ImportEdgeAssets** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2127,38 +1455,14 @@ To validate on Desktop, do the following: **Start/NoPinningToTaskbar** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2201,38 +1505,14 @@ To validate on Desktop, do the following: **Start/StartLayout** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesNo
BusinessYesNo
EnterpriseYesNo
EducationYesNo
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|No| +|Business|Yes|No| +|Enterprise|Yes|No| +|Education|Yes|No|
diff --git a/windows/client-management/mdm/policy-csp-storage.md b/windows/client-management/mdm/policy-csp-storage.md index d470d7977b..e0164a6227 100644 --- a/windows/client-management/mdm/policy-csp-storage.md +++ b/windows/client-management/mdm/policy-csp-storage.md @@ -57,38 +57,14 @@ manager: dansimp **Storage/AllowDiskHealthModelUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -131,38 +107,14 @@ The following list shows the supported values: **Storage/AllowStorageSenseGlobal** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
Home
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home||| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -210,38 +162,14 @@ ADMX Info: **Storage/AllowStorageSenseTemporaryFilesCleanup** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
Home
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home||| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -292,38 +220,14 @@ ADMX Info: **Storage/ConfigStorageSenseCloudContentDehydrationThreshold** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
Home
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home||| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -374,38 +278,14 @@ ADMX Info: **Storage/ConfigStorageSenseDownloadsCleanupThreshold** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
Home
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home||| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -456,38 +336,14 @@ ADMX Info: **Storage/ConfigStorageSenseGlobalCadence** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
Home
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home||| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -544,38 +400,14 @@ ADMX Info: **Storage/ConfigStorageSenseRecycleBinCleanupThreshold** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
Home
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home||| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -626,38 +458,14 @@ ADMX Info: **Storage/EnhancedStorageDevices** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -702,38 +510,14 @@ ADMX Info: **Storage/RemovableDiskDenyWriteAccess** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-system.md b/windows/client-management/mdm/policy-csp-system.md index 04cccacbb5..6141fdcf82 100644 --- a/windows/client-management/mdm/policy-csp-system.md +++ b/windows/client-management/mdm/policy-csp-system.md @@ -112,33 +112,13 @@ manager: dansimp **System/AllowBuildPreview** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -185,33 +165,13 @@ The following list shows the supported values: **System/AllowCommercialDataPipeline** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -302,33 +262,13 @@ The following list shows the supported values: **System/AllowDeviceNameInDiagnosticData** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -376,33 +316,13 @@ The following list shows the supported values: **System/AllowEmbeddedMode** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -437,33 +357,13 @@ The following list shows the supported values: **System/AllowExperimentation** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -503,33 +403,13 @@ The following list shows the supported values: **System/AllowFontProviders** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -583,33 +463,13 @@ To verify if System/AllowFontProviders is set to true: **System/AllowLocation** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -680,33 +540,13 @@ If you disable this policy setting, devices may not appear in Microsoft Managed **System/AllowStorageCard** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -741,33 +581,13 @@ The following list shows the supported values: **System/AllowTelemetry** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -792,28 +612,6 @@ The following list shows the supported values for Windows 8.1: - 1 – Allowed, except for Secondary Data Requests. - 2 (default) – Allowed. - In Windows 10, you can configure this policy setting to decide what level of diagnostic data to send to Microsoft. @@ -835,35 +633,6 @@ The following list shows the supported values for Windows 10 version 1809 and ol Most restrictive value is 0. - - ADMX Info: @@ -882,33 +651,13 @@ ADMX Info: **System/AllowUpdateComplianceProcessing** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -961,33 +710,13 @@ The following list shows the supported values: **System/AllowUserToResetPhone** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1053,33 +782,13 @@ The following list shows the supported values: **System/BootStartDriverInitialization** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1130,33 +839,13 @@ ADMX Info: **System/ConfigureMicrosoft365UploadEndpoint** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1205,33 +894,13 @@ ADMX Info: **System/ConfigureTelemetryOptInChangeNotification** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1273,33 +942,13 @@ The following list shows the supported values: **System/ConfigureTelemetryOptInSettingsUx** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1346,33 +995,13 @@ The following list shows the supported values: **System/DisableDeviceDelete** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1418,33 +1047,13 @@ ADMX Info: **System/DisableDiagnosticDataViewer** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1490,33 +1099,13 @@ ADMX Info: **System/DisableEnterpriseAuthProxy** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1551,33 +1140,13 @@ ADMX Info: **System/DisableOneDriveFileSync** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1634,33 +1203,13 @@ To validate on Desktop, do the following: **System/DisableSystemRestore** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1711,33 +1260,13 @@ ADMX Info: **System/FeedbackHubAlwaysSaveDiagnosticsLocally** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1770,33 +1299,13 @@ The following list shows the supported values: **System/LimitEnhancedDiagnosticDataWindowsAnalytics** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1851,33 +1360,13 @@ ADMX Info: **System/TelemetryProxy** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1914,33 +1403,13 @@ ADMX Info: **System/TurnOffFileHistory** - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-systemservices.md b/windows/client-management/mdm/policy-csp-systemservices.md index 016911d154..76aaf84d71 100644 --- a/windows/client-management/mdm/policy-csp-systemservices.md +++ b/windows/client-management/mdm/policy-csp-systemservices.md @@ -49,38 +49,14 @@ manager: dansimp **SystemServices/ConfigureHomeGroupListenerServiceStartupMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -112,38 +88,14 @@ GP Info: **SystemServices/ConfigureHomeGroupProviderServiceStartupMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -175,38 +127,14 @@ GP Info: **SystemServices/ConfigureXboxAccessoryManagementServiceStartupMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -238,38 +166,14 @@ GP Info: **SystemServices/ConfigureXboxLiveAuthManagerServiceStartupMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -301,38 +205,14 @@ GP Info: **SystemServices/ConfigureXboxLiveGameSaveServiceStartupMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -364,38 +244,14 @@ GP Info: **SystemServices/ConfigureXboxLiveNetworkingServiceStartupMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-taskmanager.md b/windows/client-management/mdm/policy-csp-taskmanager.md index 2ad2b1c6d6..f671d306e6 100644 --- a/windows/client-management/mdm/policy-csp-taskmanager.md +++ b/windows/client-management/mdm/policy-csp-taskmanager.md @@ -33,38 +33,14 @@ manager: dansimp **TaskManager/AllowEndTask** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-taskscheduler.md b/windows/client-management/mdm/policy-csp-taskscheduler.md index b76c0948ac..ec272ae750 100644 --- a/windows/client-management/mdm/policy-csp-taskscheduler.md +++ b/windows/client-management/mdm/policy-csp-taskscheduler.md @@ -34,38 +34,14 @@ manager: dansimp **TaskScheduler/EnableXboxGameSaveTask** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-textinput.md b/windows/client-management/mdm/policy-csp-textinput.md index 77bf576304..d4bc93e500 100644 --- a/windows/client-management/mdm/policy-csp-textinput.md +++ b/windows/client-management/mdm/policy-csp-textinput.md @@ -134,38 +134,14 @@ Placeholder only. Do not use in production environment. **TextInput/AllowIMELogging** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -204,38 +180,14 @@ The following list shows the supported values: **TextInput/AllowIMENetworkAccess** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -272,38 +224,14 @@ The following list shows the supported values: **TextInput/AllowInputPanel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -342,38 +270,14 @@ The following list shows the supported values: **TextInput/AllowJapaneseIMESurrogatePairCharacters** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -413,38 +317,14 @@ The following list shows the supported values: **TextInput/AllowJapaneseIVSCharacters** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -483,38 +363,14 @@ The following list shows the supported values: **TextInput/AllowJapaneseNonPublishingStandardGlyph** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -553,38 +409,14 @@ The following list shows the supported values: **TextInput/AllowJapaneseUserDictionary** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -623,38 +455,14 @@ The following list shows the supported values: **TextInput/AllowKeyboardTextSuggestions** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -713,38 +521,14 @@ This policy has been deprecated. **TextInput/AllowLanguageFeaturesUninstall** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -791,38 +575,14 @@ The following list shows the supported values: **TextInput/AllowLinguisticDataCollection** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -860,38 +620,14 @@ This setting supports a range of values between 0 and 1. **TextInput/ConfigureJapaneseIMEVersion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -929,38 +665,14 @@ The following list shows the supported values: **TextInput/ConfigureSimplifiedChineseIMEVersion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -998,38 +710,14 @@ The following list shows the supported values: **TextInput/ConfigureTraditionalChineseIMEVersion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1066,38 +754,14 @@ The following list shows the supported values: **TextInput/EnableTouchKeyboardAutoInvokeInDesktopMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1136,38 +800,14 @@ The following list shows the supported values: **TextInput/ExcludeJapaneseIMEExceptJIS0208** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1204,38 +844,14 @@ The following list shows the supported values: **TextInput/ExcludeJapaneseIMEExceptJIS0208andEUDC** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1272,38 +888,14 @@ The following list shows the supported values: **TextInput/ExcludeJapaneseIMEExceptShiftJIS** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1340,38 +932,14 @@ The following list shows the supported values: **TextInput/ForceTouchKeyboardDockedState** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1405,38 +973,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardDictationButtonAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1470,38 +1014,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardEmojiButtonAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1535,38 +1055,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardFullModeAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1600,38 +1096,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardHandwritingModeAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1665,38 +1137,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardNarrowModeAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1730,38 +1178,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardSplitModeAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1795,38 +1219,14 @@ The following list shows the supported values: **TextInput/TouchKeyboardWideModeAvailability** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-timelanguagesettings.md b/windows/client-management/mdm/policy-csp-timelanguagesettings.md index 9d490b2202..4493a8a087 100644 --- a/windows/client-management/mdm/policy-csp-timelanguagesettings.md +++ b/windows/client-management/mdm/policy-csp-timelanguagesettings.md @@ -34,38 +34,14 @@ manager: dansimp **TimeLanguageSettings/ConfigureTimeZone** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-troubleshooting.md b/windows/client-management/mdm/policy-csp-troubleshooting.md index 41deff6293..d04526eee3 100644 --- a/windows/client-management/mdm/policy-csp-troubleshooting.md +++ b/windows/client-management/mdm/policy-csp-troubleshooting.md @@ -32,38 +32,14 @@ ms.date: 09/27/2019 **Troubleshooting/AllowRecommendations** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -101,38 +77,14 @@ Supported values: - 5 - Allow the user to choose their own recommended troubleshooting settings. By default, this policy is not configured and the SKU based defaults are used for managed devices. Current policy values for SKU's are as follows: - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SKUUnmanaged DefaultManaged Default
HomePrompt (OOBE)Off
ProPrompt (OOBE)Off
EducationOn (auto)Off
EnterpriseOffOff
GovernmentOffOff
+ +|SKU|Unmanaged Default|Managed Default| +|--- |--- |--- | +|Home|Prompt (OOBE)|Off| +|Pro|Prompt (OOBE)|Off| +|Education|On (auto)|Off| +|Enterprise|Off|Off| +|Government|Off|Off| diff --git a/windows/client-management/mdm/policy-csp-update.md b/windows/client-management/mdm/policy-csp-update.md index 93db58ce5a..a2120ee9fb 100644 --- a/windows/client-management/mdm/policy-csp-update.md +++ b/windows/client-management/mdm/policy-csp-update.md @@ -223,38 +223,14 @@ ms.collection: highpri **Update/ActiveHoursEnd** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -296,38 +272,14 @@ ADMX Info: **Update/ActiveHoursMaxRange** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -366,38 +318,14 @@ ADMX Info: **Update/ActiveHoursStart** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -439,38 +367,14 @@ ADMX Info: **Update/AllowAutoUpdate** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -525,38 +429,14 @@ The following list shows the supported values: **Update/AllowAutoWindowsUpdateDownloadOverMeteredNetwork** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -601,38 +481,14 @@ The following list shows the supported values: **Update/AllowMUUpdateService** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -674,38 +530,14 @@ The following list shows the supported values: **Update/AllowNonMicrosoftSignedUpdate** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -742,38 +574,14 @@ The following list shows the supported values: **Update/AllowUpdateService** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -821,38 +629,14 @@ The following list shows the supported values: **Update/AutoRestartDeadlinePeriodInDays** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -903,38 +687,14 @@ ADMX Info: **Update/AutoRestartDeadlinePeriodInDaysForFeatureUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -985,38 +745,14 @@ ADMX Info: **Update/AutoRestartNotificationSchedule** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1057,38 +793,14 @@ Supported values are 15, 30, 60, 120, and 240 (minutes). **Update/AutoRestartRequiredNotificationDismissal** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1130,38 +842,14 @@ The following list shows the supported values: **Update/AutomaticMaintenanceWakeUp** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1212,38 +900,14 @@ Supported values: **Update/BranchReadinessLevel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1288,38 +952,14 @@ The following list shows the supported values: **Update/ConfigureDeadlineForFeatureUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1365,38 +1005,14 @@ Default value is 7. **Update/ConfigureDeadlineForQualityUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1442,38 +1058,14 @@ Default value is 7. **Update/ConfigureDeadlineGracePeriod** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1520,38 +1112,14 @@ Default value is 2. **Update/ConfigureDeadlineNoAutoReboot** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1599,38 +1167,14 @@ Supported values: **Update/ConfigureFeatureUpdateUninstallPeriod** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1656,38 +1200,14 @@ Enable IT admin to configure feature update uninstall period. Values range 2 - 6 **Update/DeferFeatureUpdatesPeriodInDays** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1729,38 +1249,14 @@ ADMX Info: **Update/DeferQualityUpdatesPeriodInDays** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1797,38 +1293,14 @@ ADMX Info: **Update/DeferUpdatePeriod** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1883,57 +1355,6 @@ Other/cannot defer: Any update category not specifically enumerated above falls into this category. - Definition Update - E0789628-CE08-4437-BE74-2495B842F43B - - ADMX Info: @@ -1950,38 +1371,14 @@ ADMX Info: **Update/DeferUpgradePeriod** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2026,38 +1423,14 @@ ADMX Info: **Update/DetectionFrequency** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2092,38 +1465,14 @@ ADMX Info: **Update/DisableDualScan** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2170,38 +1519,14 @@ The following list shows the supported values: **Update/DisableWUfBSafeguards** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2255,38 +1580,14 @@ The following list shows the supported values: **Update/EngagedRestartDeadline** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2339,38 +1640,14 @@ ADMX Info: **Update/EngagedRestartDeadlineForFeatureUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2418,38 +1695,14 @@ ADMX Info: **Update/EngagedRestartSnoozeSchedule** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2495,38 +1748,14 @@ ADMX Info: **Update/EngagedRestartSnoozeScheduleForFeatureUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2572,38 +1801,14 @@ ADMX Info: **Update/EngagedRestartTransitionSchedule** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2649,38 +1854,14 @@ ADMX Info: **Update/EngagedRestartTransitionScheduleForFeatureUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2726,38 +1907,14 @@ ADMX Info: **Update/ExcludeWUDriversInQualityUpdate** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2801,38 +1958,14 @@ The following list shows the supported values: **Update/FillEmptyContentUrls** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2877,38 +2010,14 @@ The following list shows the supported values: **Update/IgnoreMOAppDownloadLimit** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2954,38 +2063,14 @@ To validate this policy: **Update/IgnoreMOUpdateDownloadLimit** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3031,38 +2116,14 @@ To validate this policy: **Update/ManagePreviewBuilds** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3105,38 +2166,14 @@ The following list shows the supported values: **Update/PauseDeferrals** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3185,38 +2222,14 @@ The following list shows the supported values: **Update/PauseFeatureUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3261,38 +2274,14 @@ The following list shows the supported values: **Update/PauseFeatureUpdatesStartTime** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3329,38 +2318,14 @@ ADMX Info: **Update/PauseQualityUpdates** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3402,38 +2367,14 @@ The following list shows the supported values: **Update/PauseQualityUpdatesStartTime** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3563,38 +2504,14 @@ By using this Windows Update for Business policy to upgrade devices to a new pro **Update/RequireDeferUpgrade** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesNo
BusinessYesNo
EnterpriseYesNo
EducationYesNo
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|No| +|Business|Yes|No| +|Enterprise|Yes|No| +|Education|Yes|No|
@@ -3638,38 +2555,14 @@ The following list shows the supported values: **Update/RequireUpdateApproval** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesNo
BusinessYesNo
EnterpriseYesNo
EducationYesNo
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|No| +|Business|Yes|No| +|Enterprise|Yes|No| +|Education|Yes|No|
@@ -3708,38 +2601,14 @@ The following list shows the supported values: **Update/ScheduleImminentRestartWarning** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3780,38 +2649,14 @@ Supported values are 15, 30, or 60 (minutes). **Update/ScheduleRestartWarning** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3856,38 +2701,14 @@ Supported values are 2, 4, 8, 12, or 24 (hours). **Update/ScheduledInstallDay** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -3939,38 +2760,14 @@ The following list shows the supported values: **Update/ScheduledInstallEveryWeek** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4009,38 +2806,14 @@ ADMX Info: **Update/ScheduledInstallFirstWeek** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4079,38 +2852,14 @@ ADMX Info: **Update/ScheduledInstallFourthWeek** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4149,38 +2898,14 @@ ADMX Info: **Update/ScheduledInstallSecondWeek** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4219,38 +2944,14 @@ ADMX Info: **Update/ScheduledInstallThirdWeek** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4289,38 +2990,14 @@ ADMX Info: **Update/ScheduledInstallTime** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4367,38 +3044,14 @@ ADMX Info: **Update/SetAutoRestartNotificationDisable** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4440,38 +3093,14 @@ The following list shows the supported values: **Update/SetDisablePauseUXAccess** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4505,38 +3134,14 @@ ADMX Info: **Update/SetDisableUXWUAccess** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4570,38 +3175,14 @@ ADMX Info: **Update/SetEDURestart** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4645,38 +3226,14 @@ The following list shows the supported values: **Update/SetProxyBehaviorForUpdateDetection** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4722,38 +3279,14 @@ The following list shows the supported values: **Update/TargetReleaseVersion** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4796,38 +3329,14 @@ Value type is a string containing Windows 10 version number. For example, 1809, **Update/UpdateNotificationLevel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4879,38 +3388,14 @@ ADMX Info: **Update/UpdateServiceUrl** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -4977,38 +3462,14 @@ Example **Update/UpdateServiceUrlAlternate** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-userrights.md b/windows/client-management/mdm/policy-csp-userrights.md index 606e5b3100..a67e1377cd 100644 --- a/windows/client-management/mdm/policy-csp-userrights.md +++ b/windows/client-management/mdm/policy-csp-userrights.md @@ -197,38 +197,14 @@ For example, the following syntax grants user rights to a specific user or group **UserRights/AccessCredentialManagerAsTrustedCaller** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -260,38 +236,14 @@ GP Info: **UserRights/AccessFromNetwork** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -325,38 +277,14 @@ GP Info: **UserRights/ActAsPartOfTheOperatingSystem** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -390,38 +318,14 @@ GP Info: **UserRights/AllowLocalLogOn** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -455,38 +359,14 @@ GP Info: **UserRights/BackupFilesAndDirectories** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -520,38 +400,14 @@ GP Info: **UserRights/ChangeSystemTime** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -591,38 +447,14 @@ GP Info: **UserRights/CreateGlobalObjects** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -656,38 +488,14 @@ GP Info: **UserRights/CreatePageFile** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -719,38 +527,14 @@ GP Info: **UserRights/CreatePermanentSharedObjects** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -782,38 +566,14 @@ GP Info: **UserRights/CreateSymbolicLinks** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -849,38 +609,14 @@ GP Info: **UserRights/CreateToken** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -914,38 +650,14 @@ GP Info: **UserRights/DebugPrograms** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -979,38 +691,14 @@ GP Info: **UserRights/DenyAccessFromNetwork** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1042,38 +730,14 @@ GP Info: **UserRights/DenyLocalLogOn** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1108,38 +772,14 @@ GP Info: **UserRights/DenyRemoteDesktopServicesLogOn** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1171,38 +811,14 @@ GP Info: **UserRights/EnableDelegation** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1236,38 +852,14 @@ GP Info: **UserRights/GenerateSecurityAudits** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1299,38 +891,14 @@ GP Info: **UserRights/ImpersonateClient** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1372,38 +940,14 @@ GP Info: **UserRights/IncreaseSchedulingPriority** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1440,38 +984,14 @@ GP Info: **UserRights/LoadUnloadDeviceDrivers** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1505,38 +1025,14 @@ GP Info: **UserRights/LockMemory** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1568,38 +1064,14 @@ GP Info: **UserRights/ManageAuditingAndSecurityLog** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1631,38 +1103,14 @@ GP Info: **UserRights/ManageVolume** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1694,38 +1142,14 @@ GP Info: **UserRights/ModifyFirmwareEnvironment** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1759,38 +1183,14 @@ GP Info: **UserRights/ModifyObjectLabel** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1822,38 +1222,14 @@ GP Info: **UserRights/ProfileSingleProcess** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1885,38 +1261,14 @@ GP Info: **UserRights/RemoteShutdown** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1948,38 +1300,14 @@ GP Info: **UserRights/RestoreFilesAndDirectories** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -2013,38 +1341,14 @@ GP Info: **UserRights/TakeOwnership** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-wifi.md b/windows/client-management/mdm/policy-csp-wifi.md index 77728974a0..7c694ce087 100644 --- a/windows/client-management/mdm/policy-csp-wifi.md +++ b/windows/client-management/mdm/policy-csp-wifi.md @@ -64,38 +64,14 @@ This policy has been deprecated. **Wifi/AllowAutoConnectToWiFiSenseHotspots** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -138,38 +114,14 @@ The following list shows the supported values: **Wifi/AllowInternetSharing** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -212,38 +164,14 @@ The following list shows the supported values: **Wifi/AllowManualWiFiConfiguration** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -281,38 +209,14 @@ The following list shows the supported values: **Wifi/AllowWiFi** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -347,38 +251,14 @@ The following list shows the supported values: **Wifi/AllowWiFiDirect** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -411,38 +291,14 @@ The following list shows the supported values: **Wifi/WLANScanMode** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md index a5e847a460..d1a9fd2e11 100644 --- a/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md +++ b/windows/client-management/mdm/policy-csp-windowsconnectionmanager.md @@ -34,38 +34,14 @@ manager: dansimp **WindowsConnectionManager/ProhitConnectionToNonDomainNetworksWhenConnectedToDomainAuthenticatedNetwork** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md index 1236c6edd8..2ec774f05e 100644 --- a/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md +++ b/windows/client-management/mdm/policy-csp-windowsdefendersecuritycenter.md @@ -96,38 +96,14 @@ manager: dansimp **WindowsDefenderSecurityCenter/CompanyName** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -164,38 +140,14 @@ ADMX Info: **WindowsDefenderSecurityCenter/DisableAccountProtectionUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -236,38 +188,14 @@ Valid values: **WindowsDefenderSecurityCenter/DisableAppBrowserUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -310,38 +238,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisableClearTpmButton** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -398,38 +302,14 @@ ADMX Info: **WindowsDefenderSecurityCenter/DisableDeviceSecurityUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -470,38 +350,14 @@ Valid values: **WindowsDefenderSecurityCenter/DisableEnhancedNotifications** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -547,38 +403,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisableFamilyUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -621,38 +453,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisableHealthUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -695,38 +503,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisableNetworkUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -769,38 +553,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisableNotifications** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -843,38 +603,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisableTpmFirmwareUpdateWarning** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -931,38 +667,14 @@ ADMX Info: **WindowsDefenderSecurityCenter/DisableVirusUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1005,38 +717,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/DisallowExploitProtectionOverride** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1079,38 +767,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/Email** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1147,38 +811,14 @@ ADMX Info: **WindowsDefenderSecurityCenter/EnableCustomizedToasts** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1221,38 +861,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/EnableInAppCustomization** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1295,38 +911,14 @@ The following list shows the supported values: **WindowsDefenderSecurityCenter/HideRansomwareDataRecovery** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1367,38 +959,14 @@ Valid values: **WindowsDefenderSecurityCenter/HideSecureBoot** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1439,38 +1007,14 @@ Valid values: **WindowsDefenderSecurityCenter/HideTPMTroubleshooting** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1511,38 +1055,14 @@ Valid values: **WindowsDefenderSecurityCenter/HideWindowsSecurityNotificationAreaControl** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1601,38 +1121,14 @@ ADMX Info: **WindowsDefenderSecurityCenter/Phone** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -1669,38 +1165,14 @@ ADMX Info: **WindowsDefenderSecurityCenter/URL** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md index f463131d83..b4216b2026 100644 --- a/windows/client-management/mdm/policy-csp-windowsinkworkspace.md +++ b/windows/client-management/mdm/policy-csp-windowsinkworkspace.md @@ -36,38 +36,14 @@ manager: dansimp **WindowsInkWorkspace/AllowSuggestedAppsInWindowsInkWorkspace** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -108,38 +84,14 @@ The following list shows the supported values: **WindowsInkWorkspace/AllowWindowsInkWorkspace** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowslogon.md b/windows/client-management/mdm/policy-csp-windowslogon.md index 94a49ce87c..b3254d5ac1 100644 --- a/windows/client-management/mdm/policy-csp-windowslogon.md +++ b/windows/client-management/mdm/policy-csp-windowslogon.md @@ -59,38 +59,14 @@ manager: dansimp **WindowsLogon/AllowAutomaticRestartSignOn** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -144,38 +120,14 @@ ADMX Info: **WindowsLogon/ConfigAutomaticRestartSignOn** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -229,38 +181,14 @@ ADMX Info: **WindowsLogon/DisableLockScreenAppNotifications** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -299,38 +227,14 @@ ADMX Info: **WindowsLogon/DontDisplayNetworkSelectionUI** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -394,38 +298,14 @@ ADMX Info: **WindowsLogon/EnableFirstLogonAnimation** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeYesYes
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|Yes|Yes| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -479,38 +359,14 @@ Supported values: **WindowsLogon/EnumerateLocalUsersOnDomainJoinedComputers** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -549,38 +405,14 @@ ADMX Info: **WindowsLogon/HideFastUserSwitching** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowspowershell.md b/windows/client-management/mdm/policy-csp-windowspowershell.md index a67752e251..478a612256 100644 --- a/windows/client-management/mdm/policy-csp-windowspowershell.md +++ b/windows/client-management/mdm/policy-csp-windowspowershell.md @@ -34,38 +34,14 @@ manager: dansimp **WindowsPowerShell/TurnOnPowerShellScriptBlockLogging** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-windowssandbox.md b/windows/client-management/mdm/policy-csp-windowssandbox.md index f3fd70ab14..c8066ba2b0 100644 --- a/windows/client-management/mdm/policy-csp-windowssandbox.md +++ b/windows/client-management/mdm/policy-csp-windowssandbox.md @@ -48,38 +48,14 @@ ms.date: 10/14/2020 Available in the latest Windows 10 insider preview build. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -142,38 +118,14 @@ The following are the supported values: Available in the latest Windows 10 insider preview build. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -233,38 +185,14 @@ The following are the supported values: Available in the latest Windows 10 insider preview build. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -322,38 +250,14 @@ The following are the supported values: Available in the latest Windows 10 insider preview build. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -412,38 +316,14 @@ The following are the supported values: Available in the latest Windows 10 insider preview build. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -505,38 +385,14 @@ The following are the supported values: Available in the latest Windows 10 insider preview build. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessNoNo
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|No|No| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/policy-csp-wirelessdisplay.md b/windows/client-management/mdm/policy-csp-wirelessdisplay.md index 9d941ee024..008904439b 100644 --- a/windows/client-management/mdm/policy-csp-wirelessdisplay.md +++ b/windows/client-management/mdm/policy-csp-wirelessdisplay.md @@ -53,38 +53,14 @@ manager: dansimp **WirelessDisplay/AllowMdnsAdvertisement** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -117,38 +93,14 @@ The following list shows the supported values: **WirelessDisplay/AllowMdnsDiscovery** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -181,38 +133,14 @@ The following list shows the supported values: **WirelessDisplay/AllowProjectionFromPC** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -245,38 +173,14 @@ The following list shows the supported values: **WirelessDisplay/AllowProjectionFromPCOverInfrastructure** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -309,38 +213,14 @@ The following list shows the supported values: **WirelessDisplay/AllowProjectionToPC** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -385,38 +265,14 @@ The following list shows the supported values: **WirelessDisplay/AllowProjectionToPCOverInfrastructure** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -449,38 +305,14 @@ The following list shows the supported values: **WirelessDisplay/AllowUserInputFromWirelessDisplayReceiver** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
@@ -513,38 +345,14 @@ The following list shows the supported values: **WirelessDisplay/RequirePinForPairing** - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
EditionWindows 10Windows 11
HomeNoNo
ProYesYes
BusinessYesYes
EnterpriseYesYes
EducationYesYes
+ +|Edition|Windows 10|Windows 11| +|--- |--- |--- | +|Home|No|No| +|Pro|Yes|Yes| +|Business|Yes|Yes| +|Enterprise|Yes|Yes| +|Education|Yes|Yes|
diff --git a/windows/client-management/mdm/pxlogical-csp.md b/windows/client-management/mdm/pxlogical-csp.md index 1b7b94e690..5535a11feb 100644 --- a/windows/client-management/mdm/pxlogical-csp.md +++ b/windows/client-management/mdm/pxlogical-csp.md @@ -17,7 +17,8 @@ ms.date: 06/26/2017 The PXLOGICAL configuration service provider is used to add, remove, or modify WAP logical and physical proxies by using WAP or the standard Windows techniques. -> **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application. +> [!NOTE] +> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_NETWORKING\_ADMIN capabilities to be accessed from a network configuration application. The following shows the PXLOGICAL configuration service provider management object in tree format as used by OMA Client Provisioning for initial bootstrapping of the device. The OMA DM protocol is not supported by this configuration service provider. @@ -151,36 +152,12 @@ The following table shows the Microsoft custom elements that this configuration These features are available only for the device technique. In addition, the parameter-query and characteristic-query features are not supported for all PXPHYSICAL proxy parameters for all PXADDR types. All parameters can be queried when the PXPHYSICAL proxy PXADDRType is IPv4. For example, if a mobile operator queries the TO-NAPID parameter of a PXPHYSICAL proxy and the PXADDR Type is E164, a noparm is returned. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
FeatureAvailable

parm-query

Yes

noparm

Yes

nocharacteristic

Yes

characteristic-query

Yes

+|Feature|Available| +|--- |--- | +|parm-query|Yes| +|noparm|Yes| +|nocharacteristic|Yes| +|characteristic-query|Yes|   @@ -189,12 +166,3 @@ These features are available only for the device technique. In addition, the par [Configuration service provider reference](configuration-service-provider-reference.md) -  - -  - - - - - - diff --git a/windows/client-management/mdm/reclaim-seat-from-user.md b/windows/client-management/mdm/reclaim-seat-from-user.md index 3beb6993e3..35928407be 100644 --- a/windows/client-management/mdm/reclaim-seat-from-user.md +++ b/windows/client-management/mdm/reclaim-seat-from-user.md @@ -18,120 +18,31 @@ The **Reclaim seat from user** operation returns reclaimed seats for a user in t ## Request - ---- - - - - - - - - - - - - -
MethodRequest URI

DELETE

https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}

+|Method|Request URI| +|--- |--- | +|DELETE|`https://bspmts.mp.microsoft.com/V1/Inventory/{productId}/{skuId}/Seats/{username}`| ### URI parameters The following parameters may be specified in the request URI. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterTypeDescription

productId

string

Required. Product identifier for an application that is used by the Store for Business.

skuId

string

Required. Product identifier that specifies a specific SKU of an application.

username

string

Requires UserPrincipalName (UPN). User name of the target user account.

+|Parameter|Type|Description| +|--- |--- |--- | +|productId|string|Required. Product identifier for an application that is used by the Store for Business.| +|skuId|string|Required. Product identifier that specifies a specific SKU of an application.| +|username|string|Requires UserPrincipalName (UPN). User name of the target user account.| -  ## Response ### Response body The response body contain [SeatDetails](data-structures-windows-store-for-business.md#seatdetails). - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Error codeDescriptionRetryData fieldDetails

400

Invalid parameters

No

Parameter name

-

Reason: Invalid parameter

-

Details: String

Invalid can include productId, skuId or userName

404

Not found

Item type: Inventory, User, Seat

-

Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName

ItemType: Inventory, User, Seat

-

Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName

409

Conflict

Reason: Not online

+|Error code|Description|Retry|Data field|Details| +|--- |--- |--- |--- |--- | +|400|Invalid parameters|No|Parameter name
Reason: Invalid parameter
Details: String|Invalid can include productId, skuId or userName| +|404|Not found||Item type: Inventory, User, Seat
Values: ProductId/SkuId, UserName,
ProductId/SkuId/UserName|ItemType: Inventory, User, Seat
Values: ProductId/SkuId, UserName, ProductId/SkuId/UserName| +|409|Conflict||Reason: Not online||   - -  - - - - - diff --git a/windows/client-management/mdm/registry-csp.md b/windows/client-management/mdm/registry-csp.md index 4978cc70e0..d678652ec7 100644 --- a/windows/client-management/mdm/registry-csp.md +++ b/windows/client-management/mdm/registry-csp.md @@ -33,7 +33,7 @@ For OMA Client Provisioning, the follows notes apply: - This documentation describes the default characteristics. Additional characteristics may be added. -- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\). +- Because the **Registry** configuration service provider uses the backslash (\\) character as a separator between key names, backslashes, which occur in the name of a registry key must be escaped. Backslashes can be escaped by using two sequential backslashes (\\\\). The default security role maps to each subnode unless specific permission is granted to the subnode. The security role for subnodes is implementation specific, and can be changed by OEMs and mobile operators. @@ -41,38 +41,12 @@ The default security role maps to each subnode unless specific permission is gra The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
ElementsAvailable

parm-query

Yes

noparm

Yes

nocharacteristic

Yes

characteristic-query

Yes

-

Recursive query: Yes

-

Top level query: No

+|Elements|Available| +|--- |--- | +|Parm-query|Yes| +|Noparm|Yes| +|Uncharacteristic|Yes| +|Characteristic-query|Yes

Recursive query: Yes

Top-level query: No|   Use these elements to build standard OMA Client Provisioning configuration XML. For information about specific elements, see MSPROV DTD elements. @@ -82,62 +56,16 @@ Use these elements to build standard OMA Client Provisioning configuration XML. The following table shows the data types this configuration service provider supports. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
XML Data TypeNative Registry TypeXML Format

integer

REG_DWORD

Integer. A query of this parameter returns an integer type.

boolean

REG_DWORD

Integer value of 1 or 0. A query of this parameter returns an integer type.

float

REG_SZ

Float. A query of this parameter returns a string type.

string

REG_SZ

String. A query of this parameter returns a string type.

multiplestring

REG_MULTI_SZ

Multiple strings are separated by  and ended with two  - A query of this parameter returns a multistring type.

binary

REG_BINARY

Base64 encoded. A query of this parameter returns a binary type.

time

FILETIME in REG_BINARY

The time format conforms to the ISO8601 standard, with the date portion optional. If the date portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.

date

FILETIME in REG_BINARY

The date format conforms to the ISO8601 standard, with the time portion optional. If the time portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.

+|XML Data Type|Native Registry Type|XML Format| +|--- |--- |--- | +|Integer|REG_DWORD|Integer. A query of this parameter returns an integer type.| +|Boolean|REG_DWORD|Integer value of 1 or 0. A query of this parameter returns an integer type.| +|Float|REG_SZ|Float. A query of this parameter returns a string type.| +|String|REG_SZ|String. A query of this parameter returns a string type.| +|multiple string|REG_MULTI_SZ|Multiple strings are separated by **** and ended with two **** - A query of this parameter returns a multi-string type.| +|Binary|REG_BINARY|Base64 encoded. A query of this parameter returns a binary type.| +|Time|FILETIME in REG_BINARY|The time format conforms to the ISO8601 standard, with the date portion optional. If the date portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.| +|Date|FILETIME in REG_BINARY|The date format conforms to the ISO8601 standard, with the time portion optional. If the time portion is omitted, also omit the "T" delimiter. A query of this parameter returns a binary type.|   @@ -147,13 +75,3 @@ It is not possible to access registry keys nested under the current path by usin [Configuration service provider reference](configuration-service-provider-reference.md) - -  - -  - - - - - - diff --git a/windows/client-management/mdm/remotelock-csp.md b/windows/client-management/mdm/remotelock-csp.md index 47ee3981e4..86f5a419c8 100644 --- a/windows/client-management/mdm/remotelock-csp.md +++ b/windows/client-management/mdm/remotelock-csp.md @@ -26,71 +26,21 @@ The RemoteLock CSP supports the ability to lock a device that has a PIN set on t **Lock** Required. The setting accepts requests to lock the device screen. The device screen will lock immediately if a PIN has been set. If no PIN is set, the lock request is ignored and the OMA DM (405) Forbidden error is returned over the management channel. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification. The supported operations are Get and Exec. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
StatusDescriptionMeaning [Standard]

(200) OK

The device was successfully locked.

The command and the associated Alert action are completed successfully.

(405)

The device could not be locked because there is no PIN currently set on the device.

The requested command is not allowed on the target.

(500) Command failed

The device was not locked for some unknown reason.

Non-specific errors were created by the recipient while attempting to complete the command.

- -  +|Status|Description|Meaning [Standard]| +|--- |--- |--- | +|(200) OK|The device was successfully locked.|The command and the associated Alert action are completed successfully.| +|(405)|The device could not be locked because there is no PIN currently set on the device.|The requested command is not allowed on the target.| +|(500) Command failed|The device was not locked for some unknown reason.|Non-specific errors were created by the recipient while attempting to complete the command.| **LockAndResetPIN** This setting can be used to lock and reset the PIN on the device. It is used in conjunction with the NewPINValue node. After the **Exec** operation is called successfully on this node, the previous PIN will no longer work and cannot be recovered. The supported operation is Exec. This node will return the following status. All OMA DM errors are listed [here](https://go.microsoft.com/fwlink/p/?LinkId=522607) in the protocol specification. - ----- - - - - - - - - - - - - - - - - - - - -
StatusDescriptionMeaning

(200) OK

The device has been locked with a new password which has been reset.

The command and the associated Alert action are completed successfully.

(500) Command failed

N/A

Non-specific errors were created by the recipient while attempting to complete the command.

+|Status|Description|Meaning| +|--- |--- |--- | +|(200) OK|The device has been locked with a new password which has been reset.|The command and the associated Alert action are completed successfully.| +|(500) Command failed|N/A|Non-specific errors were created by the recipient while attempting to complete the command.| **LockAndRecoverPIN** Added in Windows 10, version 1703. This setting performs a similar function to the LockAndResetPIN node. With LockAndResetPIN any Windows Hello keys associated with the PIN gets deleted, but with LockAndRecoverPIN those keys are saved. After the Exec operation is called successfully on this setting, the new PIN can be retrieved from the NewPINValue setting. The previous PIN will no longer work. diff --git a/windows/client-management/mdm/securitypolicy-csp.md b/windows/client-management/mdm/securitypolicy-csp.md index fbc7a1ec31..a08448947e 100644 --- a/windows/client-management/mdm/securitypolicy-csp.md +++ b/windows/client-management/mdm/securitypolicy-csp.md @@ -17,7 +17,8 @@ ms.date: 06/26/2017 The SecurityPolicy configuration service provider is used to configure security policy settings for WAP push, OMA Client Provisioning, OMA DM, Service Indication (SI), Service Loading (SL), and MMS. -> **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_SECURITY\_POLICIES capabilities to be accessed from a network configuration application. +> [!NOTE] +> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION and ID\_CAP\_DEVICE\_MANAGEMENT\_SECURITY\_POLICIES capabilities to be accessed from a network configuration application.   @@ -36,122 +37,78 @@ Defines the security policy identifier as a decimal value. The following security policies are supported. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
PolicyIDPolicy namePolicy description

4104

-

Hex: 1008

TPS Policy

This setting indicates whether mobile operators can be assigned the Trusted Provisioning Server (TPS) SECROLE_OPERATOR_TPS role.

-

Default value: 1

-

Supported values:

-

0: The TPS role assignment is disabled.

-

1: The TPS role assignment is enabled, and can be assigned to mobile operators.

4105

-

Hex: 1009

Message Authentication Retry Policy

This setting specifies the maximum number of times the user is allowed to try authenticating a Wireless Application Protocol (WAP) PIN-signed message.

-

Default value: 3

-

Possible values: 0 through 256.

4108

-

Hex: 100c

Service Loading Policy

This setting indicates whether SL messages are accepted, by specifying the security roles that can accept SL messages. An SL message downloads new services or provisioning XML to the device.

-

Default value: 256 (SECROLE_KNOWN_PPG)

-

Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG

-

4109

-

Hex:100d

Service Indication Policy

This setting indicates whether SI messages are accepted, by specifying the security roles that can accept SI messages. An SI message is sent to the device to notify users of new services, service updates, and provisioning services.

-

Default value: 256 (SECROLE_KNOWN_PPG)

-

Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG

4111

-

Hex:100f

OTA Provisioning Policy

This setting determines whether PIN signed OMA Client Provisioning messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the following roles in the role mask, then the message is processed. To ensure properly signed OMA Client Provisioning messages are accepted by the configuration client, all of the roles that are set in 4141, 4142, and 4143 policies must also be set in this policy. For example, to ensure properly signed USERNETWPIN signed OMA Client Provisioning messages are accepted by the device, if policy 4143 is set to 4096 (SECROLE_ANY_PUSH_SOURCE) for an carrier-unlocked device, policy 4111 must also have the SECROLE_ANY_PUSH_SOURCE role set.

-

Default value: 384 (SECROLE_OPERATOR_TPS | SECROLE_KNOWN_PPG)

-

Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS

-

4113

-

Hex:1011

WSP Push Policy

This setting indicates whether Wireless Session Protocol (WSP) notifications from the WAP stack are routed.

-

Default value: 1

-

Supported values:

-

0: Routing of WSP notifications is not allowed.

-

1: Routing of WSP notifications is allowed.

4132

-

Hex:1024

Network PIN signed OTA Provision Message User Prompt Policy

This policy specifies whether the device will prompt a UI to get the user confirmation before processing a pure network pin signed OTA Provisioning message. If prompt, the user has the ability to discard the OTA provisioning message.

-

Default value: 0

-

Supported values:

-

0: The device prompts a UI to get user confirmation when the OTA WAP provisioning message is signed purely with network pin.

-

1: There is no user prompt.

4141

-

Hex:102d

OMA CP NETWPIN Policy

This setting determines whether the OMA network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.

-

Default value: 0

-

Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE , SECROLE_OPERATOR_TPS

-

4142

-

Hex:102e

OMA CP USERPIN Policy

This setting determines whether the OMA user PIN or user MAC signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.

-

Default value: 256

-

Supported values: SECROLE_OPERATOR_TPS, SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG

4143

-

Hex:102f

OMA CP USERNETWPIN Policy

This setting determines whether the OMA user network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted.

-

Default value: 256

-

Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS

-

4144

-

Hex:1030

MMS Message Policy

This setting determines whether MMS messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the roles in the role mask, then the message is processed.

-

Default value: 256 (SECROLE_KNOWN_PPG)

-

Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE

+- **PolicyID**: 4104 | Hex: 1008 + - **Policy name**: TPS Policy + - **Policy description**: This setting indicates whether mobile operators can be assigned the Trusted Provisioning Server (TPS) SECROLE_OPERATOR_TPS role. + - Default value: 1 + - Supported values: + - 0: The TPS role assignment is disabled. + - 1: The TPS role assignment is enabled, and can be assigned to mobile operators. + +- **PolicyID**: 4105 | Hex: 1009 + - **Policy name**: Message Authentication Retry Policy + - **Policy description**: This setting specifies the maximum number of times the user is allowed to try authenticating a Wireless Application Protocol (WAP) PIN-signed message. + - Default value: 3 + - Supported values: 0 through 256 + +- **PolicyID**: 4108 | Hex: 100c + - **Policy name**: Service Loading Policy + - **Policy description**: This setting indicates whether SL messages are accepted, by specifying the security roles that can accept SL messages. An SL message downloads new services or provisioning XML to the device. + - Default value: 256 (SECROLE_KNOWN_PPG) + - Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG + +- **PolicyID**: 4109 | Hex:100d + - **Policy name**: Service Indication Policy + - **Policy description**: This setting indicates whether SI messages are accepted, by specifying the security roles that can accept SI messages. An SI message is sent to the device to notify users of new services, service updates, and provisioning services. + - Default value: 256 (SECROLE_KNOWN_PPG) + - Supported values: SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG + +- **PolicyID**: 4111 | Hex:100f + - **Policy name**: OTA Provisioning Policy + - **Policy description**: This setting determines whether PIN signed OMA Client Provisioning messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the following roles in the role mask, then the message is processed. To ensure properly signed OMA Client Provisioning messages are accepted by the configuration client, all of the roles that are set in 4141, 4142, and 4143 policies must also be set in this policy. For example, to ensure properly signed USERNETWPIN signed OMA Client Provisioning messages are accepted by the device, if policy 4143 is set to 4096 (SECROLE_ANY_PUSH_SOURCE) for an carrier-unlocked device, policy 4111 must also have the SECROLE_ANY_PUSH_SOURCE role set. + - Default value: 384 (SECROLE_OPERATOR_TPS | SECROLE_KNOWN_PPG) + - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS + +- **PolicyID**: 4113 | Hex:1011 + - **Policy name**: WSP Push Policy + - **Policy description**: This setting indicates whether Wireless Session Protocol (WSP) notifications from the WAP stack are routed. + - Default value: 1 + - Supported values: + - 0: Routing of WSP notifications is not allowed. + - 1: Routing of WSP notifications is allowed. + +- **PolicyID**: 4132 | Hex:1024 + - **Policy name**: Network PIN signed OTA Provision Message User Prompt Policy + - **Policy description**: This policy specifies whether the device will prompt a UI to get the user confirmation before processing a pure network pin signed OTA Provisioning message. If prompt, the user has the ability to discard the OTA provisioning message. + - Default value: 0 + - Supported values: + - 0: The device prompts a UI to get user confirmation when the OTA WAP provisioning message is signed purely with network pin. + - 1: There is no user prompt. + +- **PolicyID**: 4141 | Hex:102d + - **Policy name**: OMA CP NETWPIN Policy + - **Policy description**: This setting determines whether the OMA network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted. + - Default value: 0 + - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE , SECROLE_OPERATOR_TPS + +- **PolicyID**: 4142 | Hex:102e + - **Policy name**: OMA CP USERPIN Policy + - **Policy description**: This setting determines whether the OMA user PIN or user MAC signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted. + - Default value: 256 + - Supported values: SECROLE_OPERATOR_TPS, SECROLE_ANY_PUSH_SOURCE, SECROLE_KNOWN_PPG + +- **PolicyID**: 4143 | Hex:102f + - **Policy name**: OMA CP USERNETWPIN Policy + - **Policy description**: This setting determines whether the OMA user network PIN signed message will be accepted. The message's role mask and the policy's role mask are combined using the AND operator. If the result is non-zero, then the message is accepted. + - Default value: 256 + - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE, SECROLE_OPERATOR_TPS + +- **PolicyID**: 4144 | Hex:1030 + - **Policy name**: MMS Message Policy + - **Policy description**: This setting determines whether MMS messages will be processed. This policy's value specifies a role mask. If a message contains at least one of the roles in the role mask, then the message is processed. + - Default value: 256 (SECROLE_KNOWN_PPG) + - Supported values: SECROLE_KNOWN_PPG, SECROLE_ANY_PUSH_SOURCE -  ## Remarks @@ -160,41 +117,11 @@ Security roles allow or restrict access to device resources. The security role i The following security roles are supported. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
Security roleDecimal valueDescription

SECROLE_OPERATOR_TPS

128

Trusted Provisioning Server.

-

Assigned to WAP messages that come from a Push Initiator that is authenticated (SECROLE_PPG_AUTH) by a trusted Push Proxy Gateway (SECROLE_TRUSTED_PPG), and where the Uniform Resource Identifier (URI) of the Push Initiator corresponds to the URI of the Trusted Provisioning Server (TPS) on the device.

-

The mobile operator can determine whether this role and the SECROLE_OPERATOR role require the same permissions.

SECROLE_KNOWN_PPG

256

Known Push Proxy Gateway.

-

Messages assigned this role indicate that the device knows the address to the Push Proxy Gateway.

SECROLE_ANY_PUSH_SOURCE

4096

Push Router.

-

Messages received by the push router will be assigned to this role.

+|Security role|Decimal value|Description| +|--- |--- |--- | +|SECROLE_OPERATOR_TPS|128|Trusted Provisioning Server.
Assigned to WAP messages that come from a Push Initiator that is authenticated (SECROLE_PPG_AUTH) by a trusted Push Proxy Gateway (SECROLE_TRUSTED_PPG), and where the Uniform Resource Identifier (URI) of the Push Initiator corresponds to the URI of the Trusted Provisioning Server (TPS) on the device.
The mobile operator can determine whether this role and the SECROLE_OPERATOR role require the same permissions.| +|SECROLE_KNOWN_PPG|256|Known Push Proxy Gateway.
Messages assigned this role indicate that the device knows the address to the Push Proxy Gateway.| +|SECROLE_ANY_PUSH_SOURCE|4096|Push Router.
Messages received by the push router will be assigned to this role.|   @@ -271,28 +198,10 @@ Querying a security policy: The following table shows the Microsoft custom elements that this Configuration Service Provider supports for OMA Client Provisioning. - ---- - - - - - - - - - - - - - - - - -
ElementsAvailable

parm-query

Yes

noparm

Yes. If this is used, then the policy is set to 0 by default (corresponding to the most restrictive of policy values).

+|Elements|Available| +|--- |--- | +|parm-query|Yes| +|noparm|Yes. If this is used, then the policy is set to 0 by default (corresponding to the most restrictive of policy values).|   @@ -300,13 +209,3 @@ The following table shows the Microsoft custom elements that this Configuration [Configuration service provider reference](configuration-service-provider-reference.md) - -  - -  - - - - - - diff --git a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md index 2b482383bd..00da69a8cb 100644 --- a/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md +++ b/windows/client-management/mdm/structure-of-oma-dm-provisioning-files.md @@ -22,32 +22,10 @@ Each message is composed of a header, specified by the SyncHdr element, and a me The following table shows the OMA DM versions that are supported. - ---- - - - - - - - - - - - - - - - - -
VersionFormat

OMA DM version 1.1.2

<SyncML xmlns='SYNCML:SYNCML1.1'>

-

</SyncML>

OMA DM version 1.2

<SyncML xmlns='SYNCML:SYNCML1.2'>

-

</SyncML>

- -  +|Version|Format| +|--- |--- | +|OMA DM version 1.1.2|<SyncML xmlns='SYNCML:SYNCML1.1'>

</SyncML>| +|OMA DM version 1.2|<SyncML xmlns='SYNCML:SYNCML1.2'>

</SyncML>| ## File format @@ -103,7 +81,8 @@ This information is used to by the client device to properly manage the DM sessi The following example shows the header component of a DM message. In this case, OMA DM version 1.2 is used as an example only. -> **Note**   The <LocURI> node value for the <Source> element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](devinfo-csp.md). +> [!NOTE] +> The `` node value for the `` element in the SyncHdr of the device-generated DM package should be the same as the value of ./DevInfo/DevID. For more information about DevID, see [DevInfo configuration service provider](devinfo-csp.md).   @@ -147,7 +126,7 @@ The following example shows the body component of a DM message. In this example, When using SyncML for OMA DM provisioning, a LocURI in SyncBody can have a "." as a valid segment name only in the first segment. However, a "." is not a valid segment name for the other segments. For example, the following LocURI is not valid because the segment name of the seventh segment is a ".". -``` +```xml ./Vendor/MSFT/Registry/HKLM/Security/./Test ``` @@ -188,11 +167,3 @@ The following example illustrates how to use the Replace command to update a dev ``` - -  - - - - - - diff --git a/windows/client-management/mdm/supl-csp.md b/windows/client-management/mdm/supl-csp.md index e41a8c2374..d2df672d1e 100644 --- a/windows/client-management/mdm/supl-csp.md +++ b/windows/client-management/mdm/supl-csp.md @@ -16,56 +16,30 @@ ms.date: 09/12/2019 The SUPL configuration service provider is used to configure the location client, as shown in the following table: - ----- - - - - - - - - - - - - - - - - - - - -
Location ServiceSUPLV2 UPL

Connection type

All connections other than CDMA

CDMA

Configuration

    -
  • Settings that need to get pushed to the GNSS driver to configure the SUPL behavior:

    -
      -
    • Address of the Home SUPL (H-SLP) server.

    • -
    • H-SLP server certificate.

    • -
    • Positioning method.

    • -
    • Version of the protocol to use by default.

    • -
  • -
  • MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches.

  • -
    -
  • Address of the server — a mobile positioning center for non-trusted mode.

  • -
  • The positioning method used by the MPC for non-trusted mode.

  • -
+- **Location Service**: Connection type + - **SUPL**: All connections other than CDMA + - **V2 UPL**: CDMA -  +- **Location Service**: Configuration + - **SUPL**: + - Settings that need to get pushed to the GNSS driver to configure the SUPL behavior: + - Address of the Home SUPL (H-SLP) server. + - H-SLP server certificate. + - Positioning method. + - Version of the protocol to use by default. + - MCC/MNC value pairs which are used to specify which networks' UUIC the SUPL account matches. + - **V2 UPL**: + - Address of the server — a mobile positioning center for non-trusted mode. + - The positioning method used by the MPC for non-trusted mode. The SUPL or V2 UPL connection will be reconfigured every time the device is rebooted, a new UICC is inserted, or new settings are provisioned by using OMA Client Provisioning, OMA DM, or test tools. When the device is in roaming mode, it reverts to Mobile Station Standalone mode, in which only the built–in Microsoft location components are used. The following shows the SUPL configuration service provider management object in tree format as used by OMA DM and OMA Client Provisioning. -> **Note**   This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application. +> [!NOTE] +> This configuration service provider requires the ID\_CAP\_CSP\_FOUNDATION capability to be accessed from a network configuration application.  -  - -``` +```console ./Vendor/MSFT/ SUPL ----SUPL1 @@ -97,6 +71,7 @@ SUPL --------NIDefaultTimeout --------ServerAccessInterval ``` + **SUPL1** Required for SUPL. Defines the account for the SUPL Enabled Terminal (SET) node. Only one SUPL account is supported at a given time. @@ -126,50 +101,21 @@ For OMA DM, if the format for this node is incorrect the entry will be ignored a **HighAccPositioningMethod** Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The value can be one of the following integers: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription

0

None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.

1

Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.

2

Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.

3

Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.

4

OTDOA

5

AFLT

+|Value|Description| +|--- |--- | +|0|None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection and ephemeris data) from the Microsoft Positioning Service.| +|1|Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.| +|2|Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.| +|3|Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.| +|4|OTDOA| +|5|AFLT|   The default is 0. The default method in Windows devices provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator’s network or location services. -> **Important**   The Mobile Station Assisted, OTDOA, and AFLT positioning methods must only be configured for test purposes. +> [!IMPORTANT] +> The Mobile Station Assisted, OTDOA, and AFLT positioning methods must only be configured for test purposes.   @@ -180,44 +126,13 @@ Optional. Boolean. Specifies whether the location toggle on the **location** scr This value manages the settings for both SUPL and v2 UPL. If a device is configured for both SUPL and V2 UPL and these values differ, the SUPL setting will always be used. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Location toggle settingLocMasterSwitchDependencyNII settingNI request processing allowed

On

0

Yes

On

1

Yes

Off

0

Yes

Off

1

No (unless privacyOverride is set)

+|Location toggle setting|LocMasterSwitchDependencyNII setting|NI request processing allowed| +|--- |--- |--- | +|On|0|Yes| +|On|1|Yes| +|Off|0|Yes| +|Off|1|No (unless privacyOverride is set)| -  When the location toggle is set to Off and this value is set to 1, the following application requests will fail: @@ -309,46 +224,18 @@ Optional. The address of the Position Determination Entity (PDE), in the format **PositioningMethod\_MR** Optional. Specifies the positioning method that the SUPL client will use for mobile originated position requests. The value can be one of the following integers: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription

0

None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.

1

Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.

2

Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.

3

Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.

4

AFLT

- -  +|Value|Description| +|--- |--- | +|0|None: The device uses the default positioning method. In this default mode, the GNSS obtains assistance (time injection, coarse position injection, and ephemeris data) from the Microsoft Positioning Service.| +|1|Mobile Station Assisted: The device contacts the H-SLP server to obtain a position. The H-SLP does the calculation of the position and returns it to the device.| +|2|Mobile Station Based: The device obtains location-aiding data (almanac, ephemeris data, time and coarse initial position of the device) from the H-SLP server, and the device uses this information to help GPS obtain a fix. All position calculations are done in the device.| +|3|Mobile Station Standalone: The device obtains assistance as required from the Microsoft location services.| +|4|AFLT| The default is 0. The default method provides high-quality assisted GNSS positioning for mobile originated position requests without loading the mobile operator’s network or location services. -> **Important**   The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes. +> [!IMPORTANT] +> The Mobile Station Assisted and AFLT positioning methods must only be configured for test purposes.   @@ -359,44 +246,12 @@ Optional. Boolean. Specifies whether the location toggle on the **location** scr This value manages the settings for both SUPL and v2 UPL. If a device is configured for both SUPL and V2 UPL and these values differ, the SUPL setting will always be used. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Location toggle settingLocMasterSwitchDependencyNII settingNI request processing allowed

On

0

Yes

On

1

Yes

Off

0

Yes

Off

1

No (unless privacyOverride is set)

- -  +|Location toggle setting|LocMasterSwitchDependencyNII setting|NI request processing allowed| +|--- |--- |--- | +|On|0|Yes| +|On|1|Yes| +|Off|0|Yes| +|Off|1|No (unless privacyOverride is set)| When the location toggle is set to Off and this value is set to 1, the following application requests will fail: @@ -584,32 +439,12 @@ Adding a SUPL account to a device. Values in italic must be replaced with correc The following table shows the Microsoft custom elements that this configuration service provider supports for OMA Client Provisioning. - ---- - - - - - - - - - - - - - - - - -
ElementsAvailable

parm-query

Yes

characteristic-query

Yes

-

Recursive query: No

-

Top level query: No

+|Elements|Available| +|--- |--- | +|parm-query|Yes| +|characteristic-query|Yes

Recursive query: No

Top level query: No|   ## Related topics -[Configuration service provider reference](configuration-service-provider-reference.md) \ No newline at end of file +[Configuration service provider reference](configuration-service-provider-reference.md) diff --git a/windows/client-management/mdm/surfacehub-csp.md b/windows/client-management/mdm/surfacehub-csp.md index 147c460f3b..8c596e748e 100644 --- a/windows/client-management/mdm/surfacehub-csp.md +++ b/windows/client-management/mdm/surfacehub-csp.md @@ -206,63 +206,22 @@ SurfaceHub

The data type is boolean. Supported operation is Get and Replace. **DeviceAccount/ErrorContext** -

If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values: - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ErrorContext valueStage where error occurredDescription and suggestions

1

Unknown

2

Populating account

Unable to retrieve account details using the username and password you provided.

-
    -
  • For Azure AD accounts, ensure that UserPrincipalName and Password are valid.
  • -
  • For AD accounts, ensure that DomainName, UserName, and Password are valid.
  • -
  • Ensure that the specified account has an Exchange server mailbox.
  • -

3

Populating Exchange server address

Unable to auto-discover your Exchange server address. Try to manually specify the Exchange server address using the ExchangeServer field.

4

Validating Exchange server address

Unable to validate the Exchange server address. Ensure that the ExchangeServer field is valid.

5

Saving account information

Unable to save account details to the system.

6

Validating EAS policies

The device account uses an unsupported EAS policy. Make sure the EAS policy is configured correctly according to the admin guide.

-  -

The data type is integer. Supported operation is Get. +If there is an error calling ValidateAndCommit, there is additional context for that error in this node. Here are the possible error values: + +| ErrorContext value | Stage where error occurred | Description and suggestions | +| --- | --- | --- | +| 1 | Unknown | | +| 2 | Populating account | Unable to retrieve account details using the username and password you provided.

-For Azure AD accounts, ensure that UserPrincipalName and Password are valid.
-For AD accounts, ensure that DomainName, UserName, and Password are valid.
-Ensure that the specified account has an Exchange server mailbox. | +| 3 | Populating Exchange server address | Unable to auto-discover your Exchange server address. Try to manually specify the Exchange server address using the ExchangeServer field. | +| 4 | Validating Exchange server address | Unable to validate the Exchange server address. Ensure that the ExchangeServer field is valid. | +| 5 | Saving account information | Unable to save account details to the system. | +| 6 | Validating EAS policies | The device account uses an unsupported EAS policy. Make sure the EAS policy is configured correctly according to the admin guide. | + +The data type is integer. Supported operation is Get. **MaintenanceHoursSimple/Hours** +

Node for maintenance schedule. **MaintenanceHoursSimple/Hours/StartTime** @@ -343,26 +302,11 @@ SurfaceHub **InBoxApps/WirelessProjection/Channel**

Wireless channel to use for Miracast operation. The supported channels are defined by the Wi-Fi Alliance Wi-Fi Direct specification. - ---- - - - - - - - - - - - - - - -

Works with all Miracast senders in all regions

1, 3, 4, 5, 6, 7, 8, 9, 10, 11

Works with all 5ghz band Miracast senders in all regions

36, 40, 44, 48

Works with all 5ghz band Miracast senders in all regions except Japan

149, 153, 157, 161, 165

+|Compatibility|Values| +|--- |--- | +|Works with all Miracast senders in all regions|1, 3, 4, 5, 6, 7, 8, 9, 10, 11| +|Works with all 5ghz band Miracast senders in all regions|36, 40, 44, 48| +|Works with all 5ghz band Miracast senders in all regions except Japan|149, 153, 157, 161, 165|

The default value is 255. Outside of regulatory concerns, if the channel is configured incorrectly the driver will either not boot, or will broadcast on the wrong channel (which senders won't be looking for). @@ -397,50 +341,19 @@ SurfaceHub

The following table shows the permitted values. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription
0Never time out
11 minute
22 minutes
33 minutes
55 minutes (default)
1010 minutes
1515 minutes
3030 minutes
601 hour
1202 hours
2404 hours
+|Value|Description| +|--- |--- | +|0|Never time out| +|1|1 minute| +|2|2 minutes| +|3|3 minutes| +|5|5 minutes (default)| +|10|10 minutes| +|15|15 minutes| +|30|30 minutes| +|60|1 hour| +|120|2 hours| +|240|4 hours|

The data type is integer. Supported operation is Get and Replace. @@ -449,50 +362,19 @@ SurfaceHub

The following table shows the permitted values. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription
0Never time out
11 minute (default)
22 minutes
33 minutes
55 minutes
1010 minutes
1515 minutes
3030 minutes
601 hour
1202 hours
2404 hours
+|Value|Description| +|--- |--- | +|0|Never time out| +|1|1 minute (default)| +|2|2 minutes| +|3|3 minutes| +|5|5 minutes| +|10|10 minutes| +|15|15 minutes| +|30|30 minutes| +|60|1 hour| +|120|2 hours| +|240|4 hours|

The data type is integer. Supported operation is Get and Replace. @@ -501,50 +383,19 @@ SurfaceHub

The following table shows the permitted values. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ValueDescription
0Never time out
11 minute
22 minutes
33 minutes
55 minutes (default)
1010 minutes
1515 minutes
3030 minutes
601 hour
1202 hours
2404 hours
+|Value|Description| +|--- |--- | +|0|Never time out| +|1|1 minute| +|2|2 minutes| +|3|3 minutes| +|5|5 minutes (default)| +|10|10 minutes| +|15|15 minutes| +|30|30 minutes| +|60|1 hour| +|120|2 hours| +|240|4 hours|

The data type is integer. Supported operation is Get and Replace. diff --git a/windows/deployment/usmt/offline-migration-reference.md b/windows/deployment/usmt/offline-migration-reference.md index 3406fdc071..25d44a98a8 100644 --- a/windows/deployment/usmt/offline-migration-reference.md +++ b/windows/deployment/usmt/offline-migration-reference.md @@ -16,7 +16,6 @@ ms.topic: article # Offline Migration Reference - Offline migration enables the ScanState tool to run inside a different Windows® operating system than the Windows operating system from which ScanState is gathering files and settings. There are two primary offline scenarios: - **Windows PE.** The ScanState tool can be run from within Windows PE, gathering files and settings from the offline Windows operating system on that machine. @@ -33,7 +32,6 @@ When you use User State Migration Tool (USMT) 10.0 to gather and restore user s ## In This topic - - [What Will Migrate Offline?](#bkmk-whatwillmigrate) - [What Offline Environments are Supported?](#bkmk-offlineenvironments) @@ -48,7 +46,6 @@ When you use User State Migration Tool (USMT) 10.0 to gather and restore user s ## What Will Migrate Offline? - The following user data and settings migrate offline, similar to an online migration: - Data and registry keys specified in MigXML @@ -67,42 +64,18 @@ For exceptions to what you can migrate offline, see [What Does USMT Migrate?](us ## What Offline Environments are Supported? - The following table defines the supported combination of online and offline operating systems in USMT. - ---- - - - - - - - - - - - - - - - - -
Running Operating SystemOffline Operating System

WinPE 5.0 or greater, with the MSXML library

Windows Vista, Windows 7, Windows 8, Windows 10

Windows 7, Windows 8, Windows 10

Windows.old directory

- - +|Running Operating System|Offline Operating System| +|--- |--- | +|WinPE 5.0 or greater, with the MSXML library|Windows Vista, Windows 7, Windows 8, Windows 10| +|Windows 7, Windows 8, Windows 10|Windows.old directory| **Note**   It is possible to run the ScanState tool while the drive remains encrypted by suspending Windows BitLocker Drive Encryption before booting into WinPE. For more information, see [this Microsoft site](/previous-versions/windows/it-pro/windows-7/ee424315(v=ws.10)). - - ## User-Group Membership and Profile Control - User-group membership is not preserved during offline migrations. You must configure a **<ProfileControl>** section in the Config.xml file to specify the groups that the migrated users should be made members of. The following example places all migrated users into the Users group: ``` xml @@ -125,84 +98,27 @@ For information about the format of a Config.xml file, see [Config.xml File](usm ## Command-Line Options - An offline migration can either be enabled by using a configuration file on the command line, or by using one of the following command line options: - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
ComponentOptionDescription

ScanState.exe

/offline:<path to offline.xml>

This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.

ScanState.exe

/offlineWinDir:<Windows directory>

This command-line option enables the offline-migration mode and starts the migration from the location specified. It is only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.

ScanState.exe

/OfflineWinOld:<Windows.old directory>

This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

+|Component|Option|Description| +|--- |--- |--- | +|ScanState.exe|**/offline:***<path to offline.xml>*|This command-line option enables the offline-migration mode and requires a path to an Offline.xml configuration file.| +|ScanState.exe|**/offlineWinDir:***<Windows directory>*|This command-line option enables the offline-migration mode and starts the migration from the location specified. It is only for use in WinPE offline scenarios where the migration is occurring from a Windows directory.| +|ScanState.exe|**/OfflineWinOld:***<Windows.old directory>*|This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.| - - -You can use only one of the **/offline**,**/offlineWinDir** , or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together. +You can use only one of the **/offline**, **/offlineWinDir**, or **/OfflineWinOld** command-line options at a time; USMT does not support using more than one together. ## Environment Variables - The following system environment variables are necessary in the scenarios outlined below. - ----- - - - - - - - - - - - - - - - - - - - -
VariableValueScenario

USMT_WORKING_DIR

Full path to a working directory

Required when USMT binaries are located on read-only media, which does not support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following:

-
Set USMT_WORKING_DIR=[path to working directory]

MIG_OFFLINE_PLATFORM_ARCH

32 or 64

While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn't function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:

-
Set MIG_OFFLINE_PLATFORM_ARCH=32
- - +|Variable|Value|Scenario| +|--- |--- |--- | +|USMT_WORKING_DIR|Full path to a working directory|Required when USMT binaries are located on read-only media, which does not support the creation of log files or temporary storage. To set the system environment variable, at a command prompt type the following:

Set USMT_WORKING_DIR=[path to working directory]
| +|MIG_OFFLINE_PLATFORM_ARCH|32 or 64|While operating offline, this environment variable defines the architecture of the offline system, if the system does not match the WinPE and Scanstate.exe architecture. This environment variable enables the 32-bit ScanState application to gather data from a computer with 64-bit architecture, or the 64-bit ScanState application to gather data from a computer with 32-bit architecture. This is required when auto-detection of the offline architecture doesn't function properly, for example, when the source system is running a 64-bit version of Windows XP. For example, to set this system environment variable for a 32-bit architecture, at a command prompt type the following:
Set MIG_OFFLINE_PLATFORM_ARCH=32
| ## Offline.xml Elements - Use an offline.xml file when running the ScanState tool on a computer that has multiple Windows directories. The offline.xml file specifies which directories to scan for windows files. An offline.xml file can be used with the /offline option as an alternative to specifying a single Windows directory path with the /offlineDir option. ### <offline> @@ -256,8 +172,4 @@ The following XML example illustrates some of the elements discussed earlier in ## Related topics - [Plan Your Migration](usmt-plan-your-migration.md) - - - diff --git a/windows/deployment/usmt/understanding-migration-xml-files.md b/windows/deployment/usmt/understanding-migration-xml-files.md index e59e727ee5..f6a8ab4221 100644 --- a/windows/deployment/usmt/understanding-migration-xml-files.md +++ b/windows/deployment/usmt/understanding-migration-xml-files.md @@ -16,14 +16,12 @@ ms.topic: article # Understanding Migration XML Files - -You can modify the behavior of a basic User State Migration Tool (USMT)10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the MigDocs.xml and MigUser.xml files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a Config.xml file to further customize your migration. +You can modify the behavior of a basic User State Migration Tool (USMT) 10.0 migration by using XML files; these files provide instructions on where and how the USMT tools should gather and apply files and settings. USMT includes three XML files that you can use to customize a basic migration: the MigDocs.xml and MigUser.xml files, which modify how files are discovered on the source computer, and the MigApps.xml file, which is required in order to migrate supported application settings. You can also create and edit custom XML files and a Config.xml file to further customize your migration. This topic provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file. The MigDocs.xml file uses the new **GenerateDocPatterns** function available in USMT to automatically find user documents on a source computer. ## In This topic - [Overview of the Config.xml file](#bkmk-config) [Overview of the MigApp.xml file](#bkmk-migapp) @@ -50,27 +48,20 @@ This topic provides an overview of the default and custom migration XML files an ## Overview of the Config.xml file +The Config.xml file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The Config.xml file can be used with other XML files, such as in the following example: `scanstate /i:migapps.xml /i:migdocs.xml /genconfig:c:\myFolder\config.xml`. When used this way, the Config.xml file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the Config.xml file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md). -The Config.xml file is the configuration file created by the `/genconfig` option of the ScanState tool; it can be used to modify which operating-system components are migrated by USMT. The Config.xml file can be used in conjunction with other XML files, such as in the following example: `scanstate /i:migapps.xml /i:migdocs.xml /genconfig:c:\myFolder\config.xml`. When used this way, the Config.xml file tightly controls aspects of the migration, including user profiles, data, and settings, without modifying or creating other XML files. For more information about the Config.xml file, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md). - -**Note**   -When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files. - - +> [!NOTE] +> When modifying the XML elements in the Config.xml file, you should edit an element and set the **migrate** property to **no**, rather than deleting the element from the file. If you delete the element instead of setting the property, the component may still be migrated by rules in other XML files. ## Overview of the MigApp.xml file - The MigApp.xml file installed with USMT includes instructions to migrate the settings for the applications listed in [What Does USMT Migrate?](usmt-what-does-usmt-migrate.md). You must include the MigApp.xml file when using the ScanState and LoadState tools, by using the `/i` option in order to migrate application settings. The MigDocs.xml and MigUser.xml files do not migrate application settings. You can create a custom XML file to include additional applications. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md). -**Important**   -The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. See the [Sample migration rules for customized versions of XML files](#bkmk-samples) section of this document for more information about migrating .pst files that are not linked to Outlook. - - +> [!Important] +> The MigApps.xml file will only detect and migrate .pst files that are linked to Microsoft Office Outlook. For more information about migrating .pst files that are not linked to Outlook, see the [Sample migration rules for customized versions of XML files](#bkmk-samples). ## Overview of the MigDocs.xml file - The MigDocs.xml file uses the new **GenerateDocPatterns** helper function to create instructions for USMT to migrate files from the source computer, based on the location of the files. You can use the MigDocs.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The default MigDocs.xml file migrates the following: @@ -141,12 +132,11 @@ You can also use the **/genmigxml** option with the ScanState tool to review and ## Overview of the MigUser.xml file - -The MigUser.xml file includes instructions for USMT to migrate user files based on file name extensions. You can use the MigUser.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The MigUser.xml file will gather all files from the standard user-profile folders, as well as any files on the computer with the specified file name extensions. +The MigUser.xml file includes instructions for USMT to migrate user files based on file name extensions. You can use the MigUser.xml file with the ScanState and LoadState tools to perform a more targeted migration than using USMT without XML instructions. The MigUser.xml file will gather all files from the standard user-profile folders, and any files on the computer with the specified file name extensions. The default MigUser.xml file migrates the following: -- All files from the standard user-profile folders which are described as: +- All files from the standard user-profile folders, which are described as: - CSIDL\_MYVIDEO @@ -166,7 +156,7 @@ The default MigUser.xml file migrates the following: - Files with the following extensions: - .qdf, .qsd, .qel, .qph, .doc\*, .dot\*, .rtf, .mcw, .wps, .scd, .wri, .wpd, .xl\*, .csv, .iqy, .dqy, .oqy, .rqy, .wk\*, .wq1, .slk, .dif, .ppt\*, .pps\*, .pot\*, .sh3, .ch3, .pre, .ppa, .txt, .pst, .one\*, .vl\*, .vsd, .mpp, .or6, .accdb, .mdb, .pub + `.qdf`, `.qsd`, `.qel`, `.qph`, `.doc\*`, `.dot\*`, `.rtf`, `.mcw`, `.wps`, `.scd`, `.wri`, `.wpd`, `.xl\*`, `.csv`, `.iqy`, `.dqy`, `.oqy`, `.rqy`, `.wk\*`, `.wq1`, `.slk`, `.dif`, `.ppt\*`, `.pps\*`, `.pot\*`, `.sh3`, `.ch3`, `.pre`, `.ppa`, `.txt`, `.pst`, `.one\*`, `.vl\*`, `.vsd`, `.mpp`, `.or6`, `.accdb`, `.mdb`, `.pub` The default MigUser.xml file does not migrate the following: @@ -180,62 +170,30 @@ The default MigUser.xml file does not migrate the following: You can make a copy of the MigUser.xml file and modify it to include or exclude standard user-profile folders and file name extensions. If you know all of the extensions for the files you want to migrate from the source computer, use the MigUser.xml file to move all of your relevant data, regardless of the location of the files. However, this may result in a migration that contains more files than intended. For example, if you choose to migrate all .jpg files, you may migrate image files such as thumbnails and logos from legacy applications that are installed on the source computer. -**Note**   -Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than three hundred file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document. - - +> [!NOTE] +> Each file name extension you include in the rules within the MigUser.xml file increases the amount of time needed for the ScanState tool to gather the files for the migration. If you are migrating more than 300 file types, you may experience a slow migration. For more information about other ways to organize the migration of your data, see the [Using multiple XML files](#bkmk-multiple) section of this document. ## Using multiple XML files - You can use multiple XML files with the ScanState and LoadState tools. Each of the default XML files included with or generated by USMT is configured for a specific component of the migration. You can also use custom XML files to supplement these default files with additional migration rules. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
XML migration fileModifies the following components:

Config.xml file

Operating-system components such as desktop wallpaper and background theme.

-

You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see Customize USMT XML Files and Config.xml File.

MigApps.xml file

Applications settings.

MigUser.xml or MigDocs.xml files

User files and profile settings.

Custom XML files

Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.

- - +|XML migration file|Modifies the following components:| +|--- |--- | +|Config.xml file|Operating-system components such as desktop wallpaper and background theme.
You can also overload config.xml to include some application and document settings by generating the config.xml file with the other default XML files. For more information, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [Config.xml File](usmt-configxml-file.md).| +|MigApps.xml file|Applications settings.| +|MigUser.xml or MigDocs.xml files|User files and profile settings.| +|Custom XML files|Application settings, user profile settings, or user files, beyond the rules contained in the other XML files.| For example, you can use all of the XML migration file types for a single migration, as in the following example: -``` +```console Scanstate /config:c:\myFolder\config.xml /i:migapps.xml /i:migdocs.xml /i:customrules.xml ``` ### XML rules for migrating user files -**Important**   -You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer. - - +> [!IMPORTANT] +> You should not use the MigUser.xml and MigDocs.xml files together in the same command. Using both XML files can result in duplication of some migrated files. This occurs when conflicting target-location instructions are given in each XML file. The target file will be stored once during the migration, but will be applied by each XML file to a different location on the destination computer. If your data set is unknown or if many files are stored outside of the standard user-profile folders, the MigDocs.xml is a better choice than the MigUser.xml file, because the MigDocs.xml file will gather a broader scope of data. The MigDocs.xml file migrates folders of data based on location. The MigUser.xml file migrates only the files with the specified file name extensions. @@ -243,13 +201,10 @@ If you want more control over the migration, you can create custom XML files. Se ## Creating and editing a custom XML file - You can use the **/genmigxml** command-line option to determine which files will be included in your migration. The **/genmigxml** option creates a file in a location you specify, so that you can review the XML rules and make modifications as necessary. -**Note**   -If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location. - - +> [!NOTE] +> If you reinstall USMT, the default migration XML files will be overwritten and any customizations you make directly to these files will be lost. Consider creating separate XML files for your custom migration rules and saving them in a secure location. To generate the XML migration rules file for a source computer: @@ -259,14 +214,14 @@ To generate the XML migration rules file for a source computer: 3. At the command prompt, type: - ``` + ```console cd /d scanstate.exe /genmigxml: ``` Where *<USMTpath>* is the location on your source computer where you have saved the USMT files and tools, and *<filepath.xml>* is the full path to a file where you can save the report. For example, type: - ``` + ```console cd /d c:\USMT scanstate.exe /genmigxml:"C:\Documents and Settings\USMT Tester\Desktop\genMig.xml" ``` @@ -275,46 +230,27 @@ To generate the XML migration rules file for a source computer: The MigDocs.xml file calls the **GenerateDocPatterns** function, which takes three Boolean values. You can change the settings to modify the way the MigDocs.xml file generates the XML rules for migration. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
SettingValueDefault Value

ScanProgramFiles

The ScanProgramFiles argument is valid only when the GenerateDocPatterns function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications.

-

For example, when set to TRUE, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The GenerateDocPatterns function generates this inclusion pattern for .doc files:

-
<pattern type="File">C:\Program Files\Microsoft Office[.doc]</pattern>
-

If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions.

False

IncludePatterns

The IncludePatterns argument determines whether to generate exclude or include patterns in the XML. When this argument is set to TRUE, the GenerateDocPatterns function generates include patterns and the function must be added under the <include> element. Changing this argument to FALSE generates exclude patterns and the function must be added under the <exclude> element.

True

SystemDrive

The SystemDrive argument determines whether to generate patterns for all fixed drives or only for the system drive. Changing this argument to TRUE restricts all patterns to the system drive.

False

+- `ScanProgramFiles`: This argument is valid only when the **GenerateDocPatterns** function is called in a system context. This argument determines whether or not to scan the Program Files directory to gather registered file name extensions for known applications. - + **Default value**: False + + For example, when set to **TRUE**, the function discovers and migrates .doc files under the Microsoft Office directory, because .doc is a file name extension registered to a Microsoft Office application. The **GenerateDocPatterns** function generates this inclusion pattern for `.doc` files: + + `C:\Program Files\Microsoft Office[.doc]` + + If a child folder of an included folder contains an installed application, ScanProgramFiles will also create an exclusion rule for the child folder. All folders under the application folder will be scanned recursively for registered file name extensions. + +- `IncludePatterns`: This argument determines whether to generate exclude or include patterns in the XML. When this argument is set to **TRUE**, the **GenerateDocPatterns** function generates include patterns and the function must be added under the `` element. Changing this argument to **FALSE** generates exclude patterns and the function must be added under the `` element. + + **Default value**: True + +- `SystemDrive`: This argument determines whether to generate patterns for all fixed drives or only for the system drive. Changing this argument to **TRUE** restricts all patterns to the system drive. + + **Default value**: False **Usage:** -``` +```console MigXmlHelper.GenerateDocPatterns ("", "", "") ``` @@ -400,42 +336,24 @@ The user context includes rules for data in the User Profiles directory. When ca - FOLDERID\_RecordedTV -**Note**   -Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable. +> [!NOTE] +> Rules contained in a component that is assigned the user context will be run for each user profile on the computer. Files that are scanned multiple times by the MigDocs.xml files will only be copied to the migration store once; however, a large number of rules in the user context can slow down the migration. Use the system context when it is applicable. - + ### Sample migration rules for customized versions of XML files -### Sample migration rules for customized versions of XML files - -**Note**   -For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md). - - +> [!NOTE] +> For best practices and requirements for customized XML files in USMT, see [Customize USMT XML Files](usmt-customize-xml-files.md) and [General Conventions](usmt-general-conventions.md). ### Exclude rules usage examples In the examples below, the source computer has a .txt file called "new text document" in a directory called "new folder". The default MigDocs.xml behavior migrates the new text document.txt file and all files contained in the "new folder" directory. The rules generated by the function are: - ---- - - - - - - - - - - -

Rule 1

<pattern type="File">d:\new folder[new text document.txt]</pattern>

Rule 2

<pattern type="File">d:\new folder[]</pattern>
+| Rule | Syntax | +|--- |--- | +|Rule 1|`d:\new folder[new text document.txt]`| +|Rule 2|`d:\new folder[]`| - - -To exclude the new text document.txt file as well as any .txt files in "new folder", you can do the following: +To exclude the new text document.txt file and any .txt files in "new folder", you can do the following: **Example 1: Exclude all .txt files in a folder** @@ -513,30 +431,17 @@ For locations outside the user profile, such as the Program Files folder, you ca For more examples of include rules that you can use in custom migration XML files, see [Include Files and Settings](usmt-include-files-and-settings.md). -**Note**   -For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). - - +> [!NOTE] +> For more information about the order of precedence for XML migration rules, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). ## Next steps - -You can include additional rules for the migration in the MigDocs.xml file or other XML migration files. For example, you can use the <locationModify> element to move files from the folder where they were gathered to a different folder, when they are applied to the destination computer. +You can include additional rules for the migration in the MigDocs.xml file or other XML migration files. For example, you can use the `` element to move files from the folder where they were gathered to a different folder, when they are applied to the destination computer. You can use an XML schema (MigXML.xsd) file to validate the syntax of your customized XML files. For more information, see [USMT Resources](usmt-resources.md). ## Related topics - [Exclude Files and Settings](usmt-exclude-files-and-settings.md) [Include Files and Settings](usmt-include-files-and-settings.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-choose-migration-store-type.md b/windows/deployment/usmt/usmt-choose-migration-store-type.md index 6985683c08..871da5bf3b 100644 --- a/windows/deployment/usmt/usmt-choose-migration-store-type.md +++ b/windows/deployment/usmt/usmt-choose-migration-store-type.md @@ -16,51 +16,19 @@ ms.topic: article # Choose a Migration Store Type - One of the main considerations for planning your migration is to determine which migration store type best meets your needs. As part of these considerations, determine how much space is required to run the User State Migration Tool (USMT) 10.0 components on your source and destination computers, and how much space is needed to create and host the migration store, whether you are using a local share, network share, or storage device. The final consideration is ensuring that user date integrity is maintained by encrypting the migration store. ## In This Section - - ---- - - - - - - - - - - - - - - - - - - -

Migration Store Types Overview

Choose the migration store type that works best for your needs and migration scenario.

Estimate Migration Store Size

Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.

Hard-Link Migration Store

Learn about hard-link migration stores and the scenarios in which they are used.

Migration Store Encryption

Learn about the using migration store encryption to protect user data integrity during a migration.

- - +| Link | Description | +|--- |--- | +|[Migration Store Types Overview](migration-store-types-overview.md)|Choose the migration store type that works best for your needs and migration scenario.| +|[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)|Estimate the amount of disk space needed for computers in your organization based on information about your organization's infrastructure.| +|[Hard-Link Migration Store](usmt-hard-link-migration-store.md)|Learn about hard-link migration stores and the scenarios in which they are used.| +|[Migration Store Encryption](usmt-migration-store-encryption.md)|Learn about the using migration store encryption to protect user data integrity during a migration.| ## Related topics - [Plan Your Migration](usmt-plan-your-migration.md) [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-command-line-syntax.md b/windows/deployment/usmt/usmt-command-line-syntax.md index 85adbc467d..0631a98022 100644 --- a/windows/deployment/usmt/usmt-command-line-syntax.md +++ b/windows/deployment/usmt/usmt-command-line-syntax.md @@ -16,40 +16,12 @@ ms.topic: article # User State Migration Tool (USMT) Command-line Syntax - The User State Migration Tool (USMT) 10.0 migrates user files and settings during large deployments of Windows. To improve and simplify the migration process, USMT captures desktop, network, and application settings in addition to a user's files. USMT then migrates these items to a new Windows installation. ## In This Section - - ---- - - - - - - - - - - - - - - -

ScanState Syntax

Lists the command-line options for using the ScanState tool.

LoadState Syntax

Lists the command-line options for using the LoadState tool.

UsmtUtils Syntax

Lists the command-line options for using the UsmtUtils tool.

- - - - - - - - - - - +| Link | Description | +|--- |--- | +|[ScanState Syntax](usmt-scanstate-syntax.md)|Lists the command-line options for using the ScanState tool.| +|[LoadState Syntax](usmt-loadstate-syntax.md)|Lists the command-line options for using the LoadState tool.| +|[UsmtUtils Syntax](usmt-utilities.md)|Lists the command-line options for using the UsmtUtils tool.| diff --git a/windows/deployment/usmt/usmt-configxml-file.md b/windows/deployment/usmt/usmt-configxml-file.md index 084c869c9a..ed444aa11e 100644 --- a/windows/deployment/usmt/usmt-configxml-file.md +++ b/windows/deployment/usmt/usmt-configxml-file.md @@ -16,10 +16,8 @@ ms.topic: article # Config.xml File - ## Config.xml File - The Config.xml file is an optional User State Migration Tool (USMT) 10.0 file that you can create using the **/genconfig** option with the ScanState.exe tool. If you want to include all of the default components, and do not want to change the default store-creation or profile-migration behavior, you do not need to create a Config.xml file. However, if you are satisfied with the default migration behavior defined in the MigApp.xml, MigUser.xml and MigDocs.xml files, but you want to exclude certain components, you can create and modify a Config.xml file and leave the other .xml files unchanged. For example, you must create and modify the Config.xml file if you want to exclude any of the operating-system settings that are migrated. It is necessary to create and modify this file if you want to change any of the default store-creation or profile-migration behavior. @@ -31,11 +29,8 @@ For more information about using the Config.xml file with other migration files, **Note**   To exclude a component from the Config.xml file, set the **migrate** value to **"no"**. Deleting the XML tag for the component from the Config.xml file will not exclude the component from your migration. - - ## In this topic - In USMT there are new migration policies that can be configured in the Config.xml file. For example, you can configure additional **<ErrorControl>**, **<ProfileControl>**, and **<HardLinkStoreControl>** options. The following elements and parameters are for use in the Config.xml file only. [<Policies>](#bkmk-policies) @@ -74,14 +69,12 @@ In USMT there are new migration policies that can be configured in the Config.xm ## <Policies> - The **<Policies>** element contains elements that describe the policies that USMT follows while creating a migration store. Valid children of the **<Policies>** element are **<ErrorControl>** and **<HardLinkStoreControl>**. The **<Policies>** element is a child of **<Configuration>**. Syntax: ` ` ## <ErrorControl> - The **<ErrorControl>** element is an optional element you can configure in the Config.xml file. The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. - **Number of occurrences**: Once for each component @@ -108,10 +101,8 @@ Additionally, the order in the **<ErrorControl>** section implies priority ``` -**Important**   -The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. - - +> [!IMPORTANT] +> The configurable **<ErrorControl>** rules support only the environment variables for the operating system that is running and the currently logged-on user. As a workaround, you can specify a path using the (\*) wildcard character. ### <fatal> @@ -125,35 +116,14 @@ The **<fatal>** element is not required. Syntax: ``*<pattern>*`` - ----- - - - - - - - - - - - - - - -
ParameterRequiredValue

errorCode

No

"any" or "specify system error message here"

- - +|Parameter|Required|Value| +|--- |--- |--- | +|errorCode|No|"any" or "*specify system error message here*"| You use the **<fatal>** element to specify that errors matching a specific pattern should cause USMT to halt the migration. ## <fileError> - The **<fileError>** element is not required. - **Number of occurrences**: Once for each component @@ -168,7 +138,6 @@ You use the **<fileError>** element to represent the behavior associated w ## <nonFatal> - The **<nonFatal>** element is not required. - **Number of occurrences**: Once for each component @@ -179,35 +148,14 @@ The **<nonFatal>** element is not required. Syntax: ``*<pattern>*`` - ----- - - - - - - - - - - - - - - -
ParameterRequiredValue

<errorCode>

No

"any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.

- - +|Parameter|Required|Value| +|--- |--- |--- | +|**<errorCode>**|No|"any" or "*specify system error message here*". If system error messages are not specified, the default behavior applies the parameter to all system error messages.| You use the **<nonFatal>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. ## <registryError> - The <registryError>element is not required. - **Number of occurrences**: Once for each component @@ -218,35 +166,14 @@ The <registryError>element is not required. Syntax: `` - ----- - - - - - - - - - - - - - - -
ParameterRequiredValue

<errorCode>

No

"any" or "specify system error message here". If system error messages are not specified, the default behavior applies the parameter to all system error messages.

- - +|Parameter|Required|Value| +|--- |--- |--- | +|**<errorCode>**|No|"any" or "*specify system error message here*". If system error messages are not specified, the default behavior applies the parameter to all system error messages.| You use the **<registryError>** element to specify that errors matching a specific pattern should not cause USMT to halt the migration. ## <HardLinkStoreControl> - The **<HardLinkStoreControl>** element contains elements that describe how to handle files during the creation of a hard-link migration store. Its only valid child is **<fileLocked>**. Syntax: ` ` @@ -261,10 +188,8 @@ Syntax: `` The **<HardLinkStoreControl>** sample code below specifies that hard links can be created to locked files only if the locked file resides somewhere under C:\\Users\\. Otherwise, a file-access error occurs when a locked file is encountered that cannot be copied, even though is technically possible for the link to be created. -**Important**   -The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location. - - +> [!IMPORTANT] +> The **<ErrorControl>** section can be configured to conditionally ignore file access errors, based on the file’s location. ``` xml @@ -282,84 +207,49 @@ The **<ErrorControl>** section can be configured to conditionally ignore f ## <fileLocked> - The **<fileLocked>** element contains elements that describe how to handle files that are locked for editing. The rules defined by the **<fileLocked>** element are processed in the order in which they appear in the XML file. Syntax: `` ## <createHardLink> - The **<createHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application. Syntax: ``*<pattern>*`` ## <errorHardLink> - The **<errorHardLink>** element defines a standard MigXML pattern that describes file paths where hard links should not be created if the file is locked for editing by another application. USMT will attempt to copy files under these paths into the migration store. However, if that is not possible, **Error\_Locked** is thrown. This is a standard Windows application programming interface (API) error that can be captured by the **<ErrorControl>** section to either cause USMT to skip the file or abort the migration. Syntax: ``*<pattern>*`` ## <ProfileControl> - This element is used to contain other elements that establish rules for migrating profiles, users, and policies around local group membership during the migration. **<ProfileMigration>** is a child of **<Configuration>**. Syntax: <`ProfileControl> ` ## <localGroups> - This element is used to contain other elements that establish rules for how to migrate local groups. **<localGroups>** is a child of **<ProfileControl>**. Syntax: ` ` ## <mappings> - This element is used to contain other elements that establish mappings between groups. Syntax: ` ` ## <changeGroup> - This element describes the source and destination groups for a local group membership change during the migration. It is a child of **<localGroups>**. The following parameters are defined: - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
ParameterRequiredValue

From

Yes

A valid local group on the source machine that contains users selected for migration on the command line.

To

Yes

A local group that the users are to be moved to during the migration.

appliesTo

Yes

nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.

- - +|Parameter|Required|Value| +|--- |--- |--- | +|From|Yes|A valid local group on the source machine that contains users selected for migration on the command line.| +|To|Yes|A local group that the users are to be moved to during the migration.| +|appliesTo|Yes|nonmigratedUsers, migratedUsers, AllUsers. This value defines which users the change group operation should apply to.| The valid and required children of **<changeGroup>** are **<include>** and **<exclude>**. Although both can be children at the same time, only one is required. @@ -367,21 +257,18 @@ Syntax: ` ` ## <include> - This element specifies that its required child, *<pattern>*, should be included in the migration. Syntax: ```` ## <exclude> - This element specifies that its required child, *<pattern>*, should be excluded from the migration. Syntax: ``` ` ## Sample Config.xml File - Refer to the following sample Config.xml file for additional details about items you can choose to exclude from a migration. ```xml @@ -577,14 +464,4 @@ Refer to the following sample Config.xml file for additional details about items ## Related topics - [USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-conflicts-and-precedence.md b/windows/deployment/usmt/usmt-conflicts-and-precedence.md index c7dc4a18ce..1236299462 100644 --- a/windows/deployment/usmt/usmt-conflicts-and-precedence.md +++ b/windows/deployment/usmt/usmt-conflicts-and-precedence.md @@ -16,7 +16,6 @@ ms.topic: article # Conflicts and Precedence - When you include, exclude, and reroute files and settings, it is important to know how User State Migration Tool (USMT) 10.0 deals with conflicts and precedence. When working with USMT, the following are the most important conflicts and precedence guidelines to keep in mind. - **If there are conflicting rules within a component, the most specific rule is applied.** However, the <unconditionalExclude> rule is an exception because it takes precedence over all others. Directory names take precedence over file extensions. For examples, see [What happens when there are conflicting include and exclude rules?](#bkmk1) and the first example in [Include and exclude precedence examples](#precexamples)****later in this topic. @@ -33,7 +32,6 @@ When you include, exclude, and reroute files and settings, it is important to kn ## In this topic - **General** - [What is the relationship between rules that are located within different components?](#bkmk2) @@ -60,7 +58,6 @@ When you include, exclude, and reroute files and settings, it is important to kn ## General - ### What is the relationship between rules that are located within different components? Only rules inside the same component can affect each other, depending on specificity, except for the <unconditionalExclude> rule. Rules that are in different components do not affect each other. If there is an <include> rule in one component and an identical <exclude> rule in another component, the data will be migrated because the two rules are independent of each other. @@ -129,7 +126,6 @@ USMT does not distinguish the .xml files based on their name or content. It proc ## The <include> and <exclude> rules - ### What happens when there are conflicting <include> and <exclude> rules? If there are conflicting rules within a component, the most specific rule is applied, except with the <unconditionalExclude> rule, which takes precedence over all other rules. If the rules are equally specific, then the data will be not be migrated. For example if you exclude a file, and include the same file, the file will not be migrated. If there are conflicting rules within different components, the rules do not affect each other because each component is processed independently. @@ -159,212 +155,35 @@ These examples explain how USMT deals with <include> and <exclude> r ### Including and excluding files - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
If you have the following code in the same componentResulting behaviorExplanation
    -
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>

  • -
  • Exclude rule: <pattern type="File">C:* [.txt]</pattern>

  • -

Migrates all files and subfolders in Dir1 (including all .txt files in C:).

The <exclude> rule does not affect the migration because the <include> rule is more specific.

    -
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>

  • -
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

  • -

Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1\Dir2 and its subfolders.

Both rules are processed as intended.

    -
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>

  • -
  • Exclude rule: <pattern type="File">C:\Dir1\ * [.txt]</pattern>

  • -

Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1 and its subfolders.

Both rules are processed as intended.

    -
  • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

  • -
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

  • -

Nothing will be migrated.

The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

    -
  • Include rule: C:\Dir1* [.txt]

  • -
  • Exclude rule: C:\Dir1\Dir2* []

  • -

Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2.

-

No files are migrated from Dir2 or its subfolders.

Both rules are processed as intended.

    -
  • Include rule: C:\Dir1\Dir2* []

  • -
  • Exclude rule: C:\Dir1* [.txt]

  • -

Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2).

Both rules are processed as intended.

+| If you have the following code in the same component | Resulting behavior | Explanation | +|-----|-----|-----| +|
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:* [.txt]</pattern>
| Migrates all files and subfolders in Dir1 (including all .txt files in C:). | The <exclude> rule does not affect the migration because the <include> rule is more specific. | +|
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
| Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1\Dir2 and its subfolders. | Both rules are processed as intended. | +|
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\ * [.txt]</pattern>
| Migrates all files and subfolders in C:\Dir1, except the .txt files in C:\Dir1 and its subfolders. | Both rules are processed as intended. | +|
  • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
| Nothing will be migrated. | The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule. | +|
  • Include rule: C:\Dir1* [.txt]
  • Exclude rule: C:\Dir1\Dir2* []
| Migrates the .txt files in Dir1 and the .txt files from subfolders other than Dir2.
No files are migrated from Dir2 or its subfolders. | Both rules are processed as intended. | +|
  • Include rule: C:\Dir1\Dir2* []
  • Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders of Dir2, except the .txt files from Dir1 and any subfolders of Dir1 (including Dir2). | Both rules are processed as intended. | - - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
If you have the following code in different componentsResulting behaviorExplanation

Component 1:

-
    -
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>

  • -
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

  • -
-

Component 2:

-
    -
  • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

  • -
  • Exclude rule: <pattern type="File">C:\Dir1* []</pattern>

  • -

Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2).

Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed.

Component 1:

-
    -
  • Include rule: C:\Dir1\Dir2* []

  • -
-

Component 2:

-
    -
  • Exclude rule: C:\Dir1* [.txt]

  • -

Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders.

Both rules are processed as intended.

Component 1:

-
    -
  • Exclude rule: C:\Dir1\Dir2* []

  • -
-

Component 2:

-
    -
  • Include rule: C:\Dir1* [.txt]

  • -

Migrates all .txt files in Dir1 and any subfolders.

Component 1 does not contain an <include> rule, so the <exclude> rule is not processed.

- - +| If you have the following code in different components | Resulting behavior | Explanation | +|-----|----|----| +| Component 1:
  • Include rule: <pattern type="File">C:\Dir1* []</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>

Component 2:
  • Include rule: <pattern type="File">C:\Dir1\Dir2* [.txt]</pattern>
  • Exclude rule: <pattern type="File">C:\Dir1* []</pattern>
| Migrates all files and subfolders of C:\Dir1\ (including C:\Dir1\Dir2). | Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, although some .txt files were excluded when Component 1 was processed, they were included when Component 2 was processed. | +| Component 1:
  • Include rule: C:\Dir1\Dir2* []

Component 2:
  • Exclude rule: C:\Dir1* [.txt]
| Migrates all files and subfolders from Dir2 except the .txt files in C:\Dir1 and its subfolders. | Both rules are processed as intended. | +| Component 1:
  • Exclude rule: C:\Dir1\Dir2* []

Component 2:
  • Include rule: C:\Dir1* [.txt]
| Migrates all .txt files in Dir1 and any subfolders. | Component 1 does not contain an <include> rule, so the <exclude> rule is not processed. | ### Including and excluding registry objects - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
If you have the following code in the same componentResulting behaviorExplanation
    -
  • Include rule: HKLM\Software\Microsoft\Command Processor* []

  • -
  • Exclude Rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

  • -

Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor.

Both rules are processed as intended.

    -
  • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

  • -
  • Exclude Rule: HKLM\Software\Microsoft\Command Processor* []

  • -

Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor.

DefaultColor is migrated because the <include> rule is more specific than the <exclude> rule.

    -
  • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

  • -
  • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

  • -

Does not migrate DefaultColor.

The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule.

+| If you have the following code in the same component | Resulting behavior | Explanation | +|-----|-----|-----| +|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor* []
  • Exclude Rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all keys in HKLM\Software\Microsoft\Command Processor except DefaultColor. | Both rules are processed as intended. | +|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude Rule:
    HKLM\Software\Microsoft\Command Processor* []
| Migrates only DefaultColor in HKLM\Software\Microsoft\Command Processor. | DefaultColor is migrated because the <include> rule is more specific than the <exclude> rule. | +|
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Does not migrate DefaultColor. | The rules are equally specific, so the <exclude> rule takes precedence over the <include> rule. | - - - ----- - - - - - - - - - - - - - - -
If you have the following code in different componentsResulting behaviorExplanation

Component 1:

-
    -
  • Include rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

  • -
  • Exclude rule: HKLM\Software\Microsoft\Command Processor* []

  • -
-

Component 2:

-
    -
  • Include rule: HKLM\Software\Microsoft\Command Processor* []

  • -
  • Exclude rule: HKLM\Software\Microsoft\Command Processor [DefaultColor]

  • -

Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor.

Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed.

- - +| If you have the following code in different components | Resulting behavior | Explanation | +|-----|-----|-----| +| Component 1:
  • Include rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor* []

Component 2:
  • Include rule:
    HKLM\Software\Microsoft\Command Processor* []
  • Exclude rule:
    HKLM\Software\Microsoft\Command Processor [DefaultColor]
| Migrates all the keys/values under HKLM\Software\Microsoft\Command Processor. | Rules that are in different components do not affect each other, except for the <unconditionalExclude> rule. Therefore, in this example, the objects that were excluded when Component 1 was processed were included when Component 2 was processed. | ## File collisions - ### What is the default behavior when there are file collisions? If there is not a <merge> rule, the default behavior for the registry is for the source to overwrite the destination. The default behavior for files is for the source to be renamed incrementally: for example, OriginalFileName(1).OriginalExtension, OriginalFileName(2).OriginalExtension, and so on. @@ -399,67 +218,49 @@ You have a custom .xml file that contains the following code:
``` -For this example, the following table describes the resulting behavior if you add the code in the first column to your custom .xml file. +For this example, the following information describes the resulting behavior if you add the code to your custom .xml file. - ---- - - - - - - - - - - - - - - - - - - - - -
If you specify the following codeResulting behavior
<merge script="MigXmlHelper.DestinationPriority()"> 
-   <objectSet> 
-      <pattern type="File">c:\data* []</pattern> 
-   </objectSet> 
-</merge>

During ScanState, all the files will be added to the store.

-

During LoadState, only C:\Data\SampleA.txt will be restored.

<merge script="MigXmlHelper.SourcePriority()"> 
-   <objectSet> 
-      <pattern type="File">c:\data* []</pattern> 
-   </objectSet> 
-</merge> 

During ScanState, all the files will be added to the store.

-

During LoadState, all the files will be restored, overwriting the existing files on the destination computer.

<merge script="MigXmlHelper.SourcePriority()"> 
-   <objectSet> 
-      <pattern type="File">c:\data\ [*]</pattern> 
-   </objectSet> 
-</merge> 

During ScanState, all the files will be added to the store.

-

During LoadState, the following will occur:

-
    -
  • C:\Data\SampleA.txt will be restored.

  • -
  • C:\Data\SampleB.txt will be restored, overwriting the existing file on the destination computer.

  • -
  • C:\Data\Folder\SampleB.txt will not be restored.

  • -
+**Example 1** - +```xml + + + c:\data* [] + + +``` + +**Result**: During ScanState, all the files will be added to the store. During LoadState, only C:\Data\SampleA.txt will be restored. + +**Example 2** + +```xml + + + c:\data* [] + + +``` + +**Result**: During ScanState, all the files will be added to the store. +During LoadState, all the files will be restored, overwriting the existing files on the destination computer. + +**Example 3** + +```xml + + + c:\data\ [*] + + +``` + +**Result**: During ScanState, all the files will be added to the store. During LoadState, the following will occur: + +- C:\Data\SampleA.txt will be restored. +- C:\Data\SampleB.txt will be restored, overwriting the existing file on the destination computer. +- C:\Data\Folder\SampleB.txt will not be restored. ## Related topics - [USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-custom-xml-examples.md b/windows/deployment/usmt/usmt-custom-xml-examples.md index 5096af5a77..7d31c9bdbb 100644 --- a/windows/deployment/usmt/usmt-custom-xml-examples.md +++ b/windows/deployment/usmt/usmt-custom-xml-examples.md @@ -15,26 +15,8 @@ ms.topic: article # Custom XML Examples - -**Note**   -Because the tables in this topic are wide, you may need to adjust the width of its window. - - - -## In This Topic: - - -- [Example 1: Migrating an Unsupported Application](#example) - -- [Example 2: Migrating the My Videos Folder](#example2) - -- [Example 3: Migrating Files and Registry Keys](#example3) - -- [Example 4: Migrating Specific Folders from Various Locations](#example4) - ## Example 1: Migrating an Unsupported Application - The following is a template for the sections that you need to migrate your application. The template is not functional on its own, but you can use it to write your own .xml file. ``` xml @@ -103,37 +85,23 @@ The following is a template for the sections that you need to migrate your appli ## Example 2: Migrating the My Videos Folder +The following sample is a custom .xml file named CustomFile.xml that migrates My Videos for all users, if the folder exists on the source computer. -The following is a custom .xml file named CustomFile.xml that migrates My Videos for all users, if the folder exists on the source computer. +- **Sample condition**: Verifies that My Videos exists on the source computer: - ---- - - - - - - - - - - - - - - - - - - - - -
CodeBehavior
<condition>MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")</condition>

Verifies that My Videos exists on the source computer.

<include filter='MigXmlHelper.IgnoreIrrelevantLinks()'>

Filters out the shortcuts in My Videos that do not resolve on the destination computer. This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering.

<pattern type="File">%CSIDL_MYVIDEO%* [*]</pattern>

Migrates My Videos for all users.

+ `MigXmlHelper.DoesObjectExist("File","%CSIDL_MYVIDEO%")` - +- **Sample filter**: Filters out the shortcuts in My Videos that do not resolve on the destination computer: + + `` + + This has no effect on files that are not shortcuts. For example, if there is a shortcut in My Videos on the source computer that points to C:\Folder1, that shortcut will be migrated only if C:\Folder1 exists on the destination computer. However, all other files, such as .mp3 files, migrate without any filtering. + +- **Sample pattern**: Migrates My Videos for all users: + + `%CSIDL_MYVIDEO%* [*]` + +**XML file** ```xml @@ -160,41 +128,25 @@ The following is a custom .xml file named CustomFile.xml that migrates My Videos ## Example 3: Migrating Files and Registry Keys +The sample patterns describe the behavior in the following example .xml file. -This table describes the behavior in the following example .xml file. +- **Sample pattern**: Migrates all instances of the file Usmttestfile.txt from all sub-directories under `%ProgramFiles%\USMTTestFolder`: - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
CodeBehavior
<pattern type="File">%ProgramFiles%\USMTTestFolder* [USMTTestFile.txt]</pattern>

Migrates all instances of the file Usmttestfile.txt from all sub-directories under %ProgramFiles%\USMTTestFolder.

<pattern type="File">%ProgramFiles%\USMTDIRTestFolder* []</pattern>

Migrates the whole directory under %ProgramFiles%\USMTDIRTestFolder.

<pattern type="Registry">HKCU\Software\USMTTESTKEY* [MyKey]</pattern>

Migrates all instances of MyKey under HKCU\Software\USMTTESTKEY.

<pattern type="Registry">HKLM\Software\USMTTESTKEY* []</pattern>

Migrates the entire registry hive under HKLM\Software\USMTTESTKEY.

+ `%ProgramFiles%\USMTTestFolder* [USMTTestFile.txt]` - +- **Sample pattern**: Migrates the whole directory under `%ProgramFiles%\USMTDIRTestFolder`: + + `%ProgramFiles%\USMTDIRTestFolder* []` + +- **Sample pattern**: Migrates all instances of MyKey under `HKCU\Software\USMTTESTKEY`: + + `HKCU\Software\USMTTESTKEY* [MyKey]` + +- **Sample pattern**: Migrates the entire registry hive under `HKLM\Software\USMTTESTKEY`: + + `HKLM\Software\USMTTESTKEY* []` + +**XML file** ``` xml @@ -230,7 +182,7 @@ This table describes the behavior in the following example .xml file. ## Example 4: Migrating Specific Folders from Various Locations -The behavior for this custom .xml file is described within the <`displayName`> tags in the code. +The behavior for this custom .xml file is described within the `` tags in the code. ``` xml @@ -257,12 +209,12 @@ The behavior for this custom .xml file is described within the <`displayName` Component to migrate all user documents except Sample.doc - + C:\UserDocuments\* [*] - + C:\UserDocuments\ [Sample.doc] @@ -277,9 +229,9 @@ The behavior for this custom .xml file is described within the <`displayName` - - - + + + @@ -291,8 +243,8 @@ The behavior for this custom .xml file is described within the <`displayName` - C:\*\Presentations\* [*] - C:\Presentations\* [*] + C:\*\Presentations\* [*] + C:\Presentations\* [*] @@ -303,16 +255,6 @@ The behavior for this custom .xml file is described within the <`displayName` ## Related topics - [USMT XML Reference](usmt-xml-reference.md) [Customize USMT XML Files](usmt-customize-xml-files.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-determine-what-to-migrate.md b/windows/deployment/usmt/usmt-determine-what-to-migrate.md index 418f73f68c..608624844a 100644 --- a/windows/deployment/usmt/usmt-determine-what-to-migrate.md +++ b/windows/deployment/usmt/usmt-determine-what-to-migrate.md @@ -24,30 +24,12 @@ To reduce complexity and increase standardization, your organization should cons ## In This Section - ---- - - - - - - - - - - - - - - - - - - -

Identify Users

Use command-line options to specify which users to migrate and how they should be migrated.

Identify Applications Settings

Determine which applications you want to migrate and prepare a list of application settings to be migrated.

Identify Operating System Settings

Use migration to create a new standard environment on each of the destination computers.

Identify File Types, Files, and Folders

Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.

+| Link | Description | +|--- |--- | +|[Identify Users](usmt-identify-users.md)|Use command-line options to specify which users to migrate and how they should be migrated.| +|[Identify Applications Settings](usmt-identify-application-settings.md)|Determine which applications you want to migrate and prepare a list of application settings to be migrated.| +|[Identify Operating System Settings](usmt-identify-operating-system-settings.md)|Use migration to create a new standard environment on each of the destination computers.| +|[Identify File Types, Files, and Folders](usmt-identify-file-types-files-and-folders.md)|Determine and locate the standard, company-specified, and non-standard locations of the file types, files, folders, and settings that you want to migrate.| ## Related topics diff --git a/windows/deployment/usmt/usmt-hard-link-migration-store.md b/windows/deployment/usmt/usmt-hard-link-migration-store.md index 45c699be37..02c53344c8 100644 --- a/windows/deployment/usmt/usmt-hard-link-migration-store.md +++ b/windows/deployment/usmt/usmt-hard-link-migration-store.md @@ -16,12 +16,10 @@ ms.topic: article # Hard-Link Migration Store - -A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs and enables entirely new migration scenarios. +A *hard-link migration store* enables you to perform an in-place migration where all user state is maintained on the computer while the old operating system is removed and the new operating system is installed; this is why it is best suited for the computer-refresh scenario. Use of a hard-link migration store for a computer-refresh scenario drastically improves migration performance and significantly reduces hard-disk utilization, reduces deployment costs, and enables entirely new migration scenarios. ## In this topic - [When to Use a Hard-Link Migration](#bkmk-when) [Understanding a Hard-Link Migration](#bkmk-understandhardlinkmig) @@ -46,7 +44,6 @@ A *hard-link migration store* enables you to perform an in-place migration where ## When to Use a Hard-Link Migration - You can use a hard-link migration store when your planned migration meets both of the following criteria: - You are upgrading the operating system on existing hardware rather than migrating to new computers. @@ -57,32 +54,27 @@ You cannot use a hard-link migration store if your planned migration includes an - You are migrating data from one computer to a second computer. -- You are migrating data from one volume on a computer to another volume, for example from C: to D:. +- You are migrating data from one volume on a computer to another volume, for example from `C:` to `D:`. - You are formatting or repartitioning the disk outside of Windows Setup, or specifying a disk format or repartition during Windows Setup that will remove the migration store. ## Understanding a Hard-Link Migration - The hard-link migration store is created using the command-line option, **/hardlink**, and is equivalent to other migration-store types. However, it differs in that hard links are utilized to keep files stored on the source computer during the migration. Keeping the files in place on the source computer eliminates the redundant work of duplicating files. It also enables the performance benefits and reduction in disk utilization that define this scenario. When you create a hard link, you give an existing file an additional path. For instance, you could create a hard link to c:\\file1.txt called c:\\hard link\\myFile.txt. These are two paths to the same file. If you open c:\\file1.txt, make changes, and save the file, you will see those changes when you open c:\\hard link\\myFile.txt. If you delete c:\\file1.txt, the file still exists on your computer as c:\\hardlink\\myFile.txt. You must delete both references to the file in order to delete the file. -**Note**   -A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. +> [!NOTE] +> A hard link can only be created for a file on the same volume. If you copy a hard-link migration store to another drive or external device, the files, and not the links, are copied, as in a non-compressed migration-store scenario. - - -For more information about hard links, please see [Hard Links and Junctions](/windows/win32/fileio/hard-links-and-junctions) +For more information about hard links, see [Hard Links and Junctions](/windows/win32/fileio/hard-links-and-junctions) In most aspects, a hard-link migration store is identical to an uncompressed migration store. It is located where specified by the Scanstate command-line tool and you can view the contents of the store by using Windows® Explorer. Once created, it can be deleted or copied to another location without changing user state. Restoring a hard-link migration store is similar to restoring any other migration store; however, as with creating the store, the same hard-link functionality is used to keep files in-place. As a best practice, we recommend that you delete the hard-link migration store after you confirm that the Loadstate tool has successfully migrated the files. Since Loadstate has created new paths to the files on your new installation of a Windows operating system, deleting the hard links in the migration store will only delete one path to the files and will not delete the actual files or the paths to them from your new operating system. -**Important**   -Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. - - +> [!IMPORTANT] +> Using the **/c** option will force the Loadstate tool to continue applying files when non-fatal errors occur. If you use the **/c** option, you should verify that no errors are reported in the logs before deleting the hard-link migration store in order to avoid data loss. Keeping the hard-link migration store can result in additional disk space being consumed or problems with some applications for the following reasons: @@ -92,22 +84,17 @@ Keeping the hard-link migration store can result in additional disk space being - Editing the file by using different paths simultaneously may result in data corruption. -**Important**   -The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links. - - +> [!IMPORTANT] +> The read-only file attribute on migrated files is lost when the hard-link migration store is deleted. This is due to a limitation in NTFS file system hard links. ## Hard-Link Migration Scenario - For example, a company has decided to deploy Windows 10 on all of their computers. Each employee will keep the same computer, but the operating system on each computer will be updated. 1. An administrator runs the ScanState command-line tool on each computer, specifying the **/hardlink** command-line option. The ScanState tool saves the user state to a hard-link migration store on each computer, improving performance by reducing file duplication, except in certain specific instances. - **Note**   - As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate. - - + > [!NOTE] + > As a best practice, we recommend that you do not create your hard-link migration store until just before you perform the migration in order to migrate the latest versions of your files. You should not use your software applications on the computer after creating the migration store until you have finished migrating your files with Loadstate. 2. On each computer, an administrator installs the company's standard operating environment (SOE), which includes Windows 7 and other applications the company currently uses. @@ -115,19 +102,18 @@ For example, a company has decided to deploy Windows 10 on all of their compute > [!NOTE] > During the update of a domain-joined computer, the profiles of users whose SID cannot be resolved will not be migrated. When using a hard-link migration store, it could cause a data loss. - -## Hard-Link Migration Store Details +## Hard-Link Migration Store Details This section provides details about hard-link migration stores. ### Hard Disk Space -The **/hardlink** command-line option proceeds with creating the migration store only if there is 250 megabytes (MB) of free space on the hard disk. Provided that every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless on the size of the migration. +The **/hardlink** command-line option proceeds with creating the migration store only if there are 250 megabytes (MB) of free space on the hard disk. If every volume involved in the migration is formatted as NTFS, 250 MB should be enough space to ensure success for almost every hard-link migration, regardless on the size of the migration. ### Hard-Link Store Size Estimation -It is not necessary to estimate the size of a hard-link migration store. Estimating the size of a migration store is only useful in scenarios where the migration store is very large, and on NTFS volumes the hard-link migration store will require much less incremental space than other store options. The only case where the local store can be quite large is when non-NTFS file systems exist on the system and contain data being migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual. +It is not necessary to estimate the size of a hard-link migration store. Estimating the size of a migration store is only useful in scenarios where the migration store is large, and on NTFS volumes the hard-link migration store will require much less incremental space than other store options. The only case where the local store can be large is when non-NTFS file systems exist on the system and contain data being migrated. Since NTFS has been the default file system format for Windows XP and newer operating systems, this situation is unusual. ### Migration Store Path on Multiple Volumes @@ -161,57 +147,27 @@ Files that are locked by an application or the operating system are handled diff Files that are locked by the operating system cannot remain in place and must be copied into the hard-link migration store. As a result, selecting many operating-system files for migration significantly reduces performance during a hard-link migration. As a best practice, we recommend that you do not migrate any files out of the \\Windows directory, which minimizes performance-related issues. -Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service is not being utilized. The volume shadow-copy service cannot be used in conjunction with hard-link migrations. However, by modifying the new **<HardLinkStoreControl>** section in the Config.xml file, it is possible to enable the migration of files locked by an application. +Files that are locked by an application are treated the same in hard-link migrations as in other scenarios when the volume shadow-copy service is not being utilized. The volume shadow-copy service cannot be used with hard-link migrations. However, by modifying the new `` section in the Config.xml file, it is possible to enable the migration of files locked by an application. -**Important**   -There are some scenarios in which modifying the **<HardLinkStoreControl>** section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart. - - +> [!IMPORTANT] +> There are some scenarios in which modifying the `` section in the Config.xml file makes it more difficult to delete a hard-link migration store. In these scenarios, you must use USMTutils.exe to schedule the migration store for deletion on the next restart. ## XML Elements in the Config.xml File - A new section in the Config.xml file allows optional configuration of some of the hard-link migration behavior introduced with the **/HardLink** option. - ---- - - - - - - - - - - - - - - - - - - - - - - -

<Policies>

This element contains elements that describe the policies that USMT follows while creating a migration store.

<HardLinkStoreControl>

This element contains elements that describe how to handle files during the creation of a hard link migration store.

<fileLocked>

This element contains elements that describe how to handle files that are locked for editing.

<createHardLink>

This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.

-

Syntax: <createHardLink> [pattern] </createHardLink>

<errorHardLink>

This element defines a standard MigXML pattern that describes file paths where hard links should not be created, if the file is locked for editing by another application.

-

<errorHardLink> [pattern] </errorHardLink>

+| Element | Description | +|--- |--- | +| `` | This element contains elements that describe the policies that USMT follows while creating a migration store. | +| `` | This element contains elements that describe how to handle files during the creation of a hard link migration store. | +| `` | This element contains elements that describe how to handle files that are locked for editing. | +| `` | This element defines a standard MigXML pattern that describes file paths where hard links should be created, even if the file is locked for editing by another application.

Syntax: `` [pattern] `` | +| `` | This element defines a standard MigXML pattern that describes file paths where hard links should not be created, if the file is locked for editing by another application.

`` [pattern] `` | - +> [!IMPORTANT] +> You must use the **/nocompress** option with the **/HardLink** option. -**Important**   -You must use the **/nocompress** option with the **/HardLink** option. - - - -The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use<createhardlink>** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete. +The following XML sample specifies that files locked by an application under the \\Users directory can remain in place during the migration. It also specifies that locked files that are not located in the \\Users directory should result in the **File in Use** error. It is important to exercise caution when specifying the paths using the **File in Use``** tag in order to minimize scenarios that make the hard-link migration store more difficult to delete. ``` xml @@ -226,8 +182,4 @@ The following XML sample specifies that files locked by an application under the ## Related topics - [Plan Your Migration](usmt-plan-your-migration.md) - - - diff --git a/windows/deployment/usmt/usmt-loadstate-syntax.md b/windows/deployment/usmt/usmt-loadstate-syntax.md index 77e214976c..42f918560d 100644 --- a/windows/deployment/usmt/usmt-loadstate-syntax.md +++ b/windows/deployment/usmt/usmt-loadstate-syntax.md @@ -16,29 +16,10 @@ ms.topic: article # LoadState Syntax - This topic discusses the **LoadState** command syntax and options available with it. -## In this topic - - -[Before You Begin](#before) - -[Syntax](#bkmk-s) - -[Storage Options](#bkmk-st) - -[Migration Rule Options](#bkmk-mig) - -[Monitoring Options](#bkmk-mon) - -[User Options](#bkmk-user) - -[Incompatible Command-Line Options](#bkmk-cloi) - ## Before You Begin - Before you run the **LoadState** command, note the following: - To ensure that all operating system settings migrate, we recommend that you run the **LoadState** commands in administrator mode from an account with administrative credentials. @@ -55,7 +36,6 @@ Before you run the **LoadState** command, note the following: ## Syntax - This section explains the syntax and usage of the command-line options available when you use the **LoadState** command. The options can be specified in any order. If the option contains a parameter, you can specify either a colon or space separator. The **LoadState** command's syntax is: @@ -71,390 +51,66 @@ For example, to decrypt the store and migrate the files and settings to a comput USMT provides the following options that you can use to specify how and where the migrated data is stored. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

StorePath

Indicates the folder where the files and settings data are stored. You must specify StorePath when using the LoadState command. You cannot specify more than one StorePath.

/decrypt /key:KeyString

-

or

-

/decrypt /key:"Key String"

-

or

-

/decrypt /keyfile:[Path</em>]FileName

Decrypts the store with the specified key. With this option, you will need to specify the encryption key in one of the following ways:

-
    -
  • /key:KeyString specifies the encryption key. If there is a space in KeyString, you must surround the argument with quotation marks.

  • -
  • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key

  • -
-

KeyString cannot exceed 256 characters.

-

The /key and /keyfile options cannot be used on the same command line.

-

The /decrypt and /nocompress options cannot be used on the same command line.

-
-Important

Use caution with this option, because anyone who has access to the LoadState command-line script will also have access to the encryption key.

-
-
- -
-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /decrypt /key:mykey

/decrypt:"encryption strength"

The /decrypt option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see Migration Store Encryption.

/hardlink

Enables user-state data to be restored from a hard-link migration store. The /nocompress parameter must be specified with /hardlink option.

/nocompress

Specifies that the store is not compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option cannot be used with the /decrypt option.

-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /nocompress

- - +| Command-Line Option | Description | +|--- |--- | +| `StorePath` | Indicates the folder where the files and settings data are stored. You must specify *StorePath* when using the **LoadState** command. You cannot specify more than one *StorePath*. | +| `/decrypt /key`:*KeyString*
or
`/decrypt /key`:"*Key String*"
or
`/decrypt /keyfile`:[*Path*]*FileName* | Decrypts the store with the specified key. With this option, you will need to specify the encryption key in one of the following ways:
  • `/key:`*KeyString* specifies the encryption key. If there is a space in *KeyString*, you must surround the argument with quotation marks.
  • `/keyfile:`*FilePathAndName* specifies a text (.txt) file that contains the encryption key

*KeyString* cannot exceed 256 characters.
The `/key` and `/keyfile` options cannot be used on the same command line.
The `/decrypt` and `/nocompress` options cannot be used on the same command line.
**Important**
Use caution with this option, because anyone who has access to the **LoadState** command-line script will also have access to the encryption key.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /decrypt /key:mykey` | +| `/decrypt:`*"encryption strength"* | The `/decrypt` option accepts a command-line parameter to define the encryption strength specified for the migration store encryption. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | +| `/hardlink` | Enables user-state data to be restored from a hard-link migration store. The `/nocompress` parameter must be specified with `/hardlink` option. | +| `/nocompress` | Specifies that the store is not compressed. You should only use this option in testing environments. We recommend that you use a compressed store during your actual migration. This option cannot be used with the `/decrypt` option.
For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /nocompress` | ## Migration Rule Options - USMT provides the following options to specify what files you want to migrate. - ---- - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

/i:[Path]FileName

(include)

-

Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigSys.xml, MigDocs.xml and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

-

For more information about which files to specify, see the "XML files" section of the Frequently Asked Questions topic.

/config:[Path]FileName

Specifies the Config.xml file that the LoadState command should use. You cannot specify this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then the FileName must be located in the current directory.

-

This example migrates the files and settings based on the rules in the Config.xml, MigDocs.xml, and MigApp.xml files:

-

loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:loadstate.log

/auto:"path to script files"

This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i:MigDocs.xml /i:MigApp.xml /v:5.

- - +| Command-Line Option | Description | +|--- |--- | +| `/i`:[*Path*]*FileName* | **(include)**
Specifies an .xml file that contains rules that define what state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigSys.xml, MigDocs.xml and any custom .xml files that you create). *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* must be located in the current directory.

For more information about which files to specify, see the "XML files" section of the [Frequently Asked Questions](usmt-faq.yml) topic. | +| `/config:`[*Path*]*FileName* | Specifies the Config.xml file that the **LoadState** command should use. You cannot specify this option more than once on the command line. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then the *FileName* must be located in the current directory.

This example migrates the files and settings based on the rules in the Config.xml, MigDocs.xml, and MigApp.xml files:

`loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:5 /l:loadstate.log` | +| `/auto:`*"path to script files"* | This option enables you to specify the location of the default .xml files and then launch your migration. If no path is specified, USMT will use the directory where the USMT binaries are located. The `/auto` option has the same effect as using the following options: `/i:MigDocs.xml` `/i:MigApp.xml /v:5`. | ## Monitoring Options - USMT provides several command-line options that you can use to analyze problems that occur during migration. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

/l:[Path]FileName

Specifies the location and name of the LoadState log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can specify the /v option to adjust the amount of output.

-

If you run the LoadState command from a shared network resource, you must specify this option or USMT will fail with the error: "USMT was unable to create the log file(s)". To fix this issue, use the /l:load.log option.

/v:<VerbosityLevel>

(Verbosity)

-

Enables verbose output in the LoadState log file. The default value is 0.

-

You can set the VerbosityLevel to one of the following levels:

- ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
LevelExplanation

0

Only the default errors and warnings are enabled.

1

Enables verbose output.

4

Enables error and status output.

5

Enables verbose and status output.

8

Enables error output to a debugger.

9

Enables verbose output to a debugger.

12

Enables error and status output to a debugger.

13

Enables verbose, status, and debugger output.

-

-

For example:

-

loadstate \server\share\migration\mystore /v:5 /i:migdocs.xml /i:migapp.xml

/progress:[Path</em>]FileName

Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:loadlog.log

/c

When this option is specified, the LoadState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit on the computer, the LoadState command will log an error and continue with the migration. Without the /c option, the LoadState command will exit on the first error. You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

/r:<TimesToRetry>

(Retry)

-

Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

-

While restoring the user state, the /r option will not recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

/w:<SecondsBeforeRetry>

(Wait)

-

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

/? or /help

Displays Help on the command line.

- - +| Command-Line Option | Description | +|--- |--- | +| `/l:`[*Path*]*FileName* | Specifies the location and name of the **LoadState** log. You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then the log will be created in the current directory. You can specify the **/v** option to adjust the amount of output.

If you run the **LoadState** command from a shared network resource, you must specify this option or USMT will fail with the error: "USMT was unable to create the log file(s)". To fix this issue, use the **/l:load.log** option. | +| `/v:`*``* | **(Verbosity)**

Enables verbose output in the LoadState log file. The default value is 0.
You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.

For example:
`loadstate \server\share\migration\mystore /v:5 /i:migdocs.xml /i:migapp.xml` | +| `/progress:`[*Path*]*FileName* | Creates the optional progress log. You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* will be created in the current directory.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:loadlog.log` | +| `/c` | When this option is specified, the **LoadState** command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit on the computer, the **LoadState** command will log an error and continue with the migration. Without the **/c** option, the **LoadState** command will exit on the first error. You can use the new <**ErrorControl**> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the **/c** command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the **/genconfig** option now generates a sample <**ErrorControl**> section that is enabled by specifying error messages and desired behaviors in the Config.xml file. | +| `/r:`*``* | **(Retry)**

Specifies the number of times to retry when an error occurs while migrating the user state from a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

While restoring the user state, the **/r** option will not recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. | +| `/w:`*``* | **(Wait)**

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. | +| `/?` or `/help` | Displays Help on the command line. | ## User Options - By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or by using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md). - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

/all

Migrates all of the users on the computer.

-

USMT migrates all user accounts on the computer, unless you specifically exclude an account with the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to use the /all option, you cannot also use the /ui, /ue or /uel options.

/ui:DomainName<em>UserName

-

or

-

/ui:"DomainName<em>User Name"

-

or

-

/ui:ComputerName<em>LocalUserName

(User include)

-

Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue option. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotations marks.

-

For example:

-
    -
  • To include only User2 from the Corporate domain, type:

    -

    /ue:* /ui:corporate\user2

  • -
-
-Note

If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

-
-
- -
-

For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.

/uel:<NumberOfDays>

-

or

-

/uel:<YYYY/MM/DD>

-

or

-

/uel:0

(User exclude based on last logon)

-

Migrates only the users that logged onto the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the ScanState command is run. You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.

-
-Note

The /uel option is not valid in offline migrations.

-
-
- -
-

Examples:

-
    -
  • /uel:0 migrates accounts that were logged on to the source computer when the ScanState command was run.

  • -
  • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

  • -
  • /uel:1 migrates users whose accounts have been modified within the last 24 hours.

  • -
  • /uel:2002/1/15 migrates users who have logged on or whose accounts have been modified since January 15, 2002.

  • -
-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /uel:0

/ue:DomainName<em>UserName

-

or

-

/ue:"DomainName<em>User Name"

-

or

-

/ue:ComputerName<em>LocalUserName

(User exclude)

-

Excludes the specified users from the migration. You can specify multiple /ue options but you cannot use the /ue option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /ue:contoso\user1

-

For more examples, see the descriptions of the /uel, /ue, and /ui options in this table.

/md:OldDomain:NewDomain

-

or

-

/md:LocalComputerName:NewDomain

(move domain)

-

Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. OldDomain may contain the asterisk () wildcard character.

-

You can specify this option more than once. You may want to specify multiple /md options if you are consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: /md:corporate:fabrikam and /md:farnorth:fabrikam.

-

If there are conflicts between two /md commands, the first rule that you specify is applied. For example, if you specify the /md:corporate:fabrikam and /md:corporate:farnorth commands, then Corporate users would be mapped to the Fabrikam domain.

-
-Note

If you specify an OldDomain that did not exist on the source computer, the LoadState command will appear to complete successfully, without an error or warning. However, in this case, users will not be moved to NewDomain but will remain in their original domain. For example, if you misspell "contoso" and you specify "/md:contso:fabrikam", the users will remain in contoso on the destination computer.

-
-
- -
-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

-

/progress:prog.log /l:load.log /md:contoso:fabrikam

/mu:OldDomain<em>OldUserName:[NewDomain]NewUserName

-

or

-

/mu:OldLocalUserName:NewDomain<em>NewUserName

Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple /mu options. You cannot use wildcard characters with this option.

-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

-

/progress:prog.log /l:load.log /mu:contoso\user1:fabrikam\user1

/lac:[Password]

(local account create)

-

Specifies that if a user account is a local (non-domain) account, and it does not exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the /lae option.

-

If the /lac option is not specified, any local user accounts that do not already exist on the destination computer will not be migrated.

-

Password is the password for the newly created account. An empty password is used by default.

-
-Caution

Use the Password variable with caution because it is provided in plain text and can be obtained by anyone with access to the computer that is running the LoadState command.

-

Also, if the computer has multiple users, all migrated users will have the same password.

-
-
- -
-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

-

For instructions, see Migrate User Accounts.

/lae

(local account enable)

-

Enables the account that was created with the /lac option. You must specify the /lac option with this option.

-

For example:

-

loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore

-

/progress:prog.log /l:load.log /lac:password /lae

-

For instructions, see Migrate User Accounts.

- +| Command-Line Option | Description | +|--- |--- | +| `/all` | Migrates all of the users on the computer.

USMT migrates all user accounts on the computer, unless you specifically exclude an account with the **/ue** or **/uel** options. For this reason, you do not need to specify this option on the command line. However, if you choose to use the **/all** option, you cannot also use the **/ui**, **/ue** or **/uel** options. | +| `/ui:`*DomainName UserName*
or
`/ui:`*"DomainName User Name"*
or
`/ui:`*ComputerName LocalUserName* | **(User include)**

Migrates the specified user. By default, all users are included in the migration. Therefore, this option is helpful only when used with the **/ue** option. You can specify multiple **/ui** options, but you cannot use the **/ui** option with the **/all** option. *DomainName* and *UserName* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotations marks.
For example:
  • To include only User2 from the Corporate domain, type:
    `/ue:* /ui:corporate\user2`
**Note**
If a user is specified for inclusion with the **/ui** option, and also is specified to be excluded with either the **/ue** or **/uel** options, the user will be included in the migration.

For more examples, see the descriptions of the **/uel**, **/ue**, and **/ui** options in this table. | +| `/uel:`*``*
or
`/uel:`*``*
or
`/uel:0` | **(User exclude based on last logon)**

Migrates only the users that logged onto the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The **/uel** option acts as an include rule. For example, the **/uel:30** option migrates users who logged on, or whose user account was modified, within the last 30 days from the date when the ScanState command is run. You can specify a number of days or you can specify a date. You cannot use this option with the **/all** option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged onto another computer, that logon instance is not considered by USMT.
**Note**
The **/uel** option is not valid in offline migrations.

Examples:
  • `/uel:0` migrates accounts that were logged on to the source computer when the **ScanState** command was run.
  • `/uel:90` migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
  • `/uel:1` migrates users whose accounts have been modified within the last 24 hours.
  • `/uel:2002/1/15` migrates users who have logged on or whose accounts have been modified since January 15, 2002.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /uel:0` | +| `/ue`:*DomainName UserName*
or
`/ue`*"DomainName User Name"*
or
`/ue`:*ComputerName LocalUserName* | **(User exclude)**

Excludes the specified users from the migration. You can specify multiple **/ue** options but you cannot use the **/ue** option with the **/all** option. *DomainName* and *UserName* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /ue:contoso\user1`
For more examples, see the descriptions of the **/uel**, **/ue**, and **/ui** options in this table. | +| `/md:`*OldDomain*:*NewDomain*
or
`/md:`*LocalComputerName:NewDomain* | **(move domain)**
Specifies a new domain for the user. Use this option to change the domain for users on a computer or to migrate a local user to a domain account. *OldDomain* may contain the asterisk () wildcard character.

You can specify this option more than once. You may want to specify multiple **/md** options if you are consolidating users across multiple domains to a single domain. For example, you could specify the following to consolidate the users from the Corporate and FarNorth domains into the Fabrikam domain: `/md:corporate:fabrikam` and `/md:farnorth:fabrikam`.

If there are conflicts between two **/md** commands, the first rule that you specify is applied. For example, if you specify the `/md:corporate:fabrikam` and `/md:corporate:farnorth` commands, then Corporate users would be mapped to the Fabrikam domain.
**Note**
If you specify an *OldDomain* that did not exist on the source computer, the **LoadState** command will appear to complete successfully, without an error or warning. However, in this case, users will not be moved to *NewDomain* but will remain in their original domain. For example, if you misspell "contoso" and you specify "/md:contso:fabrikam", the users will remain in contoso on the destination computer.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore`
` /progress:prog.log /l:load.log /md:contoso:fabrikam` | +| `/mu:`*OldDomain OldUserName*:[*NewDomain*]*NewUserName*
or
`/mu:`*OldLocalUserName*:*NewDomain NewUserName* | Specifies a new user name for the specified user. If the store contains more than one user, you can specify multiple **/mu** options. You cannot use wildcard characters with this option.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore`
`/progress:prog.log /l:load.log /mu:contoso\user1:fabrikam\user1` | +| `/lac:`[*Password*] | **(local account create)**

Specifies that if a user account is a local (non-domain) account, and it does not exist on the destination computer, USMT will create the account on the destination computer but it will be disabled. To enable the account, you must also use the **/lae** option.

If the **/lac** option is not specified, any local user accounts that do not already exist on the destination computer will not be migrated.

*Password* is the password for the newly created account. An empty password is used by default.
**Caution**
Use the *Password* variable with caution because it is provided in plain text and can be obtained by anyone with access to the computer that is running the **LoadState** command.
Also, if the computer has multiple users, all migrated users will have the same password.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore`
For instructions, see [Migrate User Accounts](usmt-migrate-user-accounts.md). | +| `/lae` | **(local account enable)**

Enables the account that was created with the **/lac** option. You must specify the **/lac** option with this option.

For example:
`loadstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore`
`/progress:prog.log /l:load.log /lac:password /lae`

For instructions, see [Migrate User Accounts](usmt-migrate-user-accounts.md). | ### Examples for the /ui and /ue options The following examples apply to both the **/ui** and **/ue** options. You can replace the **/ue** option with the **/ui** option to include, rather than exclude, the specified users. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
BehaviorCommand

Exclude the user named User One in the Corporate domain.

/ue:"corporate\user one"

Exclude the user named User1 in the Corporate domain.

/ue:corporate\user1

Exclude the local user named User1.

/ue:%computername%\user1

Exclude all domain users.

/ue:Domain

Exclude all local users.

/ue:%computername%

Exclude users in all domains named User1, User2, and so on.

/ue:\user

- - +| Behavior | Command | +|--- |--- | +| Exclude the user named User One in the Corporate domain. | `/ue:"corporate\user one"` | +| Exclude the user named User1 in the Corporate domain. | `/ue:corporate\user1` | +| Exclude the local user named User1. | `/ue:%computername%\user1` | +| Exclude all domain users. | `/ue:Domain` | +| Exclude all local users. | `/ue:%computername%` | +| Exclude users in all domains named User1, User2, and so on. | `/ue:\user` | ### Using the Options Together @@ -464,247 +120,46 @@ You can use the **/uel**, **/ue** and **/ui** options together to migrate only t **The /uel option takes precedence over the /ue option.** If a user has logged on within the specified time period set by the **/uel** option, that user's profile will be migrated even if they are excluded by using the **/ue** option. For example, if you specify `/ue:contoso\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
BehaviorCommand

Include only User2 from the Fabrikam domain and exclude all other users.

/ue:* /ui:fabrikam\user2

Include only the local user named User1 and exclude all other users.

/ue:* /ui:user1

Include only the domain users from Contoso, except Contoso\User1.

This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

-
    -
  • Using the ScanState command-line tool, type: /ue:* /ui:contoso

  • -
  • Using the LoadState command-line tool, type: /ue:contoso\user1

  • -

Include only local (non-domain) users.

/ue: /ui:%computername%*

- - +| Behavior | Command | +|--- |--- | +| Include only User2 from the Fabrikam domain and exclude all other users. | `/ue:* /ui:fabrikam\user2` | +| Include only the local user named User1 and exclude all other users. | `/ue:* /ui:user1` | +| Include only the domain users from Contoso, except Contoso\User1. | This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
  • Using the **ScanState** command-line tool, type: `/ue:* /ui:contoso`
  • Using the **LoadState** command-line tool, type: `/ue:contoso\user1`
| +| Include only local (non-domain) users. | `/ue: /ui:%computername%*` | ## Incompatible Command-Line Options - The following table indicates which command-line options are not compatible with the **LoadState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line Option/keyfile/nocompress/genconfig/all

/i

/v

/nocompress

N/A

X

/key

X

X

/decrypt

Required*

X

X

/keyfile

N/A

X

/l

/progress

X

/r

X

/w

X

/c

X

/p

X

N/A

/all

X

/ui

X

X

/ue

X

X

/uel

X

X

/genconfig

N/A

/config

X

StorePath

/md

/mu

/lae

/lac

- - - -**Note** -You must specify either the **/key** or **/keyfile** option with the **/encrypt** option. - +| Command-Line Option | /keyfile | /nocompress | /genconfig | /all | +|--- |--- |--- |--- |--- | +| **/i** | | | | | +| **/v** | | | | | +| **/nocompress** | | N/A | X | | +| **/key** | X | | X | | +| **/decrypt** | Required* | X | X | | +| **/keyfile** | N/A | | X | | +| **/l** | | | | | +| **/progress** | | | X | | +| **/r** | | | X | | +| **/w** | | | X | | +| **/c** | | | X | | +| **/p** | | | X | N/A | +| **/all** | | | X | | +| **/ui** | | | X | X | +| **/ue** | | | X | X | +| **/uel** | | | X | X | +| **/genconfig** | | | N/A | | +| **/config** | | | X | | +| *StorePath* | | | | | +| **/md** | | | | | +| **/mu** | | | | | +| **/lae** | | | | | +| **/lac** | | | | | +> [!NOTE] +> You must specify either the **/key** or **/keyfile** option with the **/encrypt** option. ## Related topics - [XML Elements Library](usmt-xml-elements-library.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-log-files.md b/windows/deployment/usmt/usmt-log-files.md index 63fcf4af6f..3d42379783 100644 --- a/windows/deployment/usmt/usmt-log-files.md +++ b/windows/deployment/usmt/usmt-log-files.md @@ -16,7 +16,6 @@ ms.topic: article # Log Files - You can use User State Migration Tool (USMT) 10.0 logs to monitor your migration and to troubleshoot errors and failed migrations. This topic describes the available command-line options to enable USMT logs, and new XML elements that configure which types of errors are fatal and should halt the migration, which types are non-fatal and should be skipped so that the migration can continue. [Log Command-Line Options](#bkmk-commandlineoptions) @@ -31,66 +30,25 @@ You can use User State Migration Tool (USMT) 10.0 logs to monitor your migratio ## Log Command-Line Options - The following table describes each command-line option related to logs, and it provides the log name and a description of what type of information each log contains. - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command line OptionFile NameDescription

/l[Path]FileName

Scanstate.log or LoadState.log

Specifies the path and file name of the ScanState.log or LoadState log.

/progress[Path]FileName

Specifies the path and file name of the Progress log.

Provides information about the status of the migration, by percentage complete.

/v[VerbosityLevel]

Not applicable

See the "Monitoring Options" section in ScanState Syntax.

/listfiles[Path]FileName

Specifies the path and file name of the Listfiles log.

Provides a list of the files that were migrated.

Set the environment variable MIG_ENABLE_DIAG to a path to an XML file.

USMTDiag.xml

The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.

+|Command line Option|File Name|Description| +|--- |--- |--- | +|**/l** *[Path]FileName*|Scanstate.log or LoadState.log|Specifies the path and file name of the ScanState.log or LoadState log.| +|**/progress** *[Path]FileName*|Specifies the path and file name of the Progress log.|Provides information about the status of the migration, by percentage complete.| +|**/v** *[VerbosityLevel]*|Not applicable|See the "Monitoring Options" section in [ScanState Syntax](usmt-scanstate-syntax.md).| +|**/listfiles** *[Path]FileName*|Specifies the path and file name of the Listfiles log.|Provides a list of the files that were migrated.| +|Set the environment variable MIG_ENABLE_DIAG to a path to an XML file.|USMTDiag.xml|The diagnostic log contains detailed system environment information, user environment information, and information about the migration units (migunits) being gathered and their contents.| - - -**Note**   -You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run. - - +> [!NOTE] +> You cannot store any of the log files in *StorePath*. If you do, the log will be overwritten when USMT is run. ## ScanState and LoadState Logs - ScanState and LoadState logs are text files that are create when you run the ScanState and LoadState tools. You can use these logs to help monitor your migration. The content of the log depends on the command-line options that you use and the verbosity level that you specify. For more information about verbosity levels, see Monitoring Options in [ScanState Syntax](usmt-scanstate-syntax.md). ## Progress Log - You can create a progress log using the **/progress** option. External tools, such as Microsoft System Center Operations Manager 2007, can parse the progress log to update your monitoring systems. The first three fields in each line are fixed as follows: - **Date:** Date, in the format of *day* *shortNameOfTheMonth* *year*. For example: 08 Jun 2006. @@ -101,137 +59,34 @@ You can create a progress log using the **/progress** option. External tools, su The remaining fields are key/value pairs as indicated in the following table. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
KeyValue

program

ScanState.exe or LoadState.exe.

productVersion

The full product version number of USMT.

computerName

The name of the source or destination computer on which USMT was run.

commandLine

The full command used to run USMT.

PHASE

Reports that a new phase in the migration is starting. This can be one of the following:

-
    -
  • Initializing

  • -
  • Scanning

  • -
  • Collecting

  • -
  • Saving

  • -
  • Estimating

  • -
  • Applying

  • -

detectedUser

    -
  • For the ScanState tool, these are the users USMT detected on the source computer that can be migrated.

  • -
  • For the LoadState tool, these are the users USMT detected in the store that can be migrated.

  • -

includedInMigration

Defines whether the user profile/component is included for migration. Valid values are Yes or No.

forUser

Specifies either of the following:

-
    -
  • The user state being migrated.

  • -
  • This Computer, meaning files and settings that are not associated with a user.

  • -

detectedComponent

Specifies a component detected by USMT.

-
    -
  • For ScanState, this is a component or application that is installed on the source computer.

  • -
  • For LoadState, this is a component or application that was detected in the store.

  • -

totalSizeInMBToTransfer

Total size of the files and settings to migrate in megabytes (MB).

totalPercentageCompleted

Total percentage of the migration that has been completed by either ScanState or LoadState.

collectingUser

Specifies which user ScanState is collecting files and settings for.

totalMinutesRemaining

Time estimate, in minutes, for the migration to complete.

error

Type of non-fatal error that occurred. This can be one of the following:

-
    -
  • UnableToCopy: Unable to copy to store because the disk on which the store is located is full.

  • -
  • UnableToOpen: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.

  • -
  • UnableToCopyCatalog: Unable to copy because the store is corrupted.

  • -
  • UnableToAccessDevice: Unable to access the device.

  • -
  • UnableToApply: Unable to apply the setting to the destination computer.

  • -

objectName

The name of the file or setting that caused the non-fatal error.

action

Action taken by USMT for the non-fatal error. The values are:

-
    -
  • Ignore: Non-fatal error ignored and the migration continued because the /c option was specified on the command line.

  • -
  • Abort: Stopped the migration because the /c option was not specified.

  • -

errorCode

The errorCode or return value.

numberOfIgnoredErrors

The total number of non-fatal errors that USMT ignored.

message

The message corresponding to the errorCode.

- - +| Key | Value | +|-----|-------| +| program | ScanState.exe or LoadState.exe. | +| productVersion | The full product version number of USMT. | +| computerName | The name of the source or destination computer on which USMT was run. | +| commandLine | The full command used to run USMT. | +| PHASE | Reports that a new phase in the migration is starting. This can be one of the following:
  • Initializing
  • Scanning
  • Collecting
  • Saving
  • Estimating
  • Applying
| +| detectedUser |
  • For the ScanState tool, these are the users USMT detected on the source computer that can be migrated.
  • For the LoadState tool, these are the users USMT detected in the store that can be migrated.
| +| includedInMigration | Defines whether the user profile/component is included for migration. Valid values are Yes or No. | +| forUser | Specifies either of the following:
  • The user state being migrated.
  • *This Computer*, meaning files and settings that are not associated with a user.
| +| detectedComponent | Specifies a component detected by USMT.
  • For ScanState, this is a component or application that is installed on the source computer.
  • For LoadState, this is a component or application that was detected in the store.
| +| totalSizeInMBToTransfer | Total size of the files and settings to migrate in megabytes (MB). | +| totalPercentageCompleted | Total percentage of the migration that has been completed by either ScanState or LoadState. | +| collectingUser | Specifies which user ScanState is collecting files and settings for. | +| totalMinutesRemaining | Time estimate, in minutes, for the migration to complete. | +| error | Type of non-fatal error that occurred. This can be one of the following:
  • **UnableToCopy**: Unable to copy to store because the disk on which the store is located is full.
  • **UnableToOpen**: Unable to open the file for migration because the file is opened in non-shared mode by another application or service.
  • **UnableToCopyCatalog**: Unable to copy because the store is corrupted.
  • **UnableToAccessDevice**: Unable to access the device.
  • **UnableToApply**: Unable to apply the setting to the destination computer.
| +| objectName | The name of the file or setting that caused the non-fatal error. | +| action | Action taken by USMT for the non-fatal error. The values are:
  • **Ignore**: Non-fatal error ignored and the migration continued because the **/c** option was specified on the command line.
  • **Abort**: Stopped the migration because the **/c** option was not specified.
| +| errorCode | The errorCode or return value. | +| numberOfIgnoredErrors | The total number of non-fatal errors that USMT ignored. | +| message | The message corresponding to the errorCode. | ## List Files Log - The List files log (Listfiles.txt) provides a list of the files that were migrated. This list can be used to troubleshoot XML issues or can be retained as a record of the files that were gathered into the migration store. The List Files log is only available for ScanState.exe. ## Diagnostic Log - You can obtain the diagnostic log by setting the environment variable MIG\_ENABLE\_DIAG to a path to an XML file. The diagnostic log contains: @@ -244,7 +99,6 @@ The diagnostic log contains: ## Using the Diagnostic Log - The diagnostic log is essentially a report of all the migration units (migunits) included in the migration. A migunit is a collection of data that is identified by the component it is associated with in the XML files. The migration store is made up of all the migunits in the migration. The diagnostic log can be used to verify which migunits were included in the migration and can be used for troubleshooting while authoring migration XML files. The following examples describe common scenarios in which you can use the diagnostic log. @@ -253,7 +107,7 @@ The following examples describe common scenarios in which you can use the diagno Let's imagine that we have the following directory structure and that we want the "data" directory to be included in the migration along with the "New Text Document.txt" file in the "New Folder." The directory of **C:\\data** contains: -``` +```console 01/21/2009 10:08 PM . 01/21/2009 10:08 PM .. 01/21/2009 10:08 PM New Folder @@ -264,7 +118,7 @@ Let's imagine that we have the following directory structure and that we want th The directory of **C:\\data\\New Folder** contains: -``` +```console 01/21/2009 10:08 PM . 01/21/2009 10:08 PM .. 01/21/2009 10:08 PM 0 New Text Document.txt @@ -295,7 +149,7 @@ To migrate these files you author the following migration XML: However, upon testing the migration you notice that the "New Text Document.txt" file isn't included in the migration. To troubleshoot this failure, the migration can be repeated with the environment variable MIG\_ENABLE\_DIAG set such that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered: -``` xml +```xml @@ -316,13 +170,13 @@ Analysis of this XML section reveals the migunit that was created when the migra An analysis of the XML elements reference topic reveals that the <pattern> tag needs to be modified as follows: -``` xml +```xml c:\data\* [*] ``` When the migration is preformed again with the modified tag, the diagnostic log reveals the following: -``` xml +```xml @@ -347,7 +201,7 @@ This diagnostic log confirms that the modified <pattern> value enables the In this scenario, you have the following directory structure and you want all files in the "data" directory to migrate, except for text files. The **C:\\Data** folder contains: -``` +```console Directory of C:\Data 01/21/2009 10:08 PM . @@ -360,7 +214,7 @@ Directory of C:\Data The **C:\\Data\\New Folder\\** contains: -``` +```console 01/21/2009 10:08 PM . 01/21/2009 10:08 PM .. 01/21/2009 10:08 PM 0 New Text Document.txt @@ -397,7 +251,7 @@ You author the following migration XML: However, upon testing the migration you notice that all the text files are still included in the migration. In order to troubleshoot this issue, the migration can be performed with the environment variable MIG\_ENABLE\_DIAG set so that the diagnostic log is generated. Upon searching the diagnostic log for the component "DATA1", the following XML section is discovered: -``` xml +```xml @@ -454,7 +308,7 @@ Upon reviewing the diagnostic log, you confirm that the files are still migratin Your revised migration XML script excludes the files from migrating, as confirmed in the diagnostic log: -``` xml +```xml @@ -484,11 +338,3 @@ Your revised migration XML script excludes the files from migrating, as confirme [LoadState Syntax](usmt-loadstate-syntax.md) - - - - - - - - diff --git a/windows/deployment/usmt/usmt-migration-store-encryption.md b/windows/deployment/usmt/usmt-migration-store-encryption.md index c10a7ba4f3..6ba4824bdc 100644 --- a/windows/deployment/usmt/usmt-migration-store-encryption.md +++ b/windows/deployment/usmt/usmt-migration-store-encryption.md @@ -16,62 +16,24 @@ ms.topic: article # Migration Store Encryption - This topic discusses User State Migration Tool (USMT) 10.0 options for migration store encryption to protect the integrity of user data during a migration. ## USMT Encryption Options - USMT enables support for stronger encryption algorithms, called Advanced Encryption Standard (AES), in several bit-level options. AES is a National Institute of Standards and Technology (NIST) specification for the encryption of electronic data. The encryption algorithm you choose must be specified for both the **ScanState** and the **LoadState** commands, so that these commands can create or read the store during encryption and decryption. The new encryption algorithms can be specified on the **ScanState** and the **LoadState** command lines by using the **/encrypt**:*"encryptionstrength"* and the **/decrypt**:*"encryptionstrength"* command-line options. All of the encryption application programming interfaces (APIs) used by USMT are available in Windows 7, Windows 8, and Windows 10 operating systems. However, export restrictions might limit the set of algorithms that are available to computers in certain locales. You can use the Usmtutils.exe file to determine which encryption algorithms are available to the computers' locales before you begin the migration. The following table describes the command-line encryption options in USMT. - ----- - - - - - - - - - - - - - - - - - - - -
ComponentOptionDescription

ScanState

/encrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the ScanState tool employs the 3DES algorithm.

LoadState

/decrypt<AES, AES_128, AES_192, AES_256, 3DES, 3DES_112>

This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the LoadState tool employs the 3DES algorithm.

- - +|Component|Option|Description| +|--- |--- |--- | +|**ScanState**|**/encrypt**<*AES, AES_128, AES_192, AES_256, 3DES, 3DES_112*>|This option and argument specify that the migration store is encrypted and which algorithm to use. When the algorithm argument is not provided, the **ScanState** tool employs the 3DES algorithm.| +|**LoadState**|**/decrypt**<*AES, AES_128, AES_192, AES_256, 3DES, 3DES_112*>|This option and argument specify that the store must be decrypted and which algorithm to use. When the algorithm argument is not provided, the **LoadState** tool employs the 3DES algorithm.| **Important**   Some encryption algorithms may not be available on your systems. You can verify which algorithms are available by running the UsmtUtils command with the **/ec** option. For more information see [UsmtUtils Syntax](usmt-utilities.md) - - ## Related topics - [Plan Your Migration](usmt-plan-your-migration.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-plan-your-migration.md b/windows/deployment/usmt/usmt-plan-your-migration.md index 7ea0c4d341..3090fc7efd 100644 --- a/windows/deployment/usmt/usmt-plan-your-migration.md +++ b/windows/deployment/usmt/usmt-plan-your-migration.md @@ -16,7 +16,6 @@ ms.topic: article # Plan Your Migration - Before you use the User State Migration Tool (USMT) 10.0 to perform your migration, we recommend that you plan your migration carefully. Planning can help your migration proceed smoothly and can reduce the risk of migration failure. In migration planning, both organizations and individuals must first identify what to migrate, including user settings, applications and application settings, and personal data files and folders. Identifying the applications to migrate is especially important so that you can avoid capturing data about applications that may be phased out. @@ -25,48 +24,14 @@ One of the most important requirements for migrating settings and data is restor ## In This Section - - ---- - - - - - - - - - - - - - - - - - - - - - - -

Common Migration Scenarios

Determine whether you will perform a refresh migration or a replace migration.

What Does USMT Migrate?

Learn which applications, user data, and operating system components USMT migrates.

Choose a Migration Store Type

Choose an uncompressed, compressed, or hard-link migration store.

Determine What to Migrate

Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.

Test Your Migration

Test your migration before you deploy Windows to all users.

- - +| Link | Description | +|--- |--- | +|[Common Migration Scenarios](usmt-common-migration-scenarios.md)|Determine whether you will perform a refresh migration or a replace migration.| +|[What Does USMT Migrate?](usmt-what-does-usmt-migrate.md)|Learn which applications, user data, and operating system components USMT migrates.| +|[Choose a Migration Store Type](usmt-choose-migration-store-type.md)|Choose an uncompressed, compressed, or hard-link migration store.| +|[Determine What to Migrate](usmt-determine-what-to-migrate.md)|Identify user accounts, application settings, operating system settings, and files that you want to migrate inside your organization.| +|[Test Your Migration](usmt-test-your-migration.md)|Test your migration before you deploy Windows to all users.| ## Related topics - [USMT XML Reference](usmt-xml-reference.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-recognized-environment-variables.md b/windows/deployment/usmt/usmt-recognized-environment-variables.md index a2ff4251a9..6e522e003e 100644 --- a/windows/deployment/usmt/usmt-recognized-environment-variables.md +++ b/windows/deployment/usmt/usmt-recognized-environment-variables.md @@ -31,441 +31,112 @@ When using the XML files MigDocs.xml, MigApp.xml, and MigUser.xml, you can use e You can use these variables within sections in the .xml files with `context=UserAndSystem`, `context=User`, and `context=System`. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VariableExplanation

ALLUSERSAPPDATA

Same as CSIDL_COMMON_APPDATA.

ALLUSERSPROFILE

Refers to %PROFILESFOLDER%\Public or %PROFILESFOLDER%\all users.

COMMONPROGRAMFILES

Same as CSIDL_PROGRAM_FILES_COMMON.

COMMONPROGRAMFILES(X86)

Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.

CSIDL_COMMON_ADMINTOOLS

Version 10.0. The file-system directory that contains administrative tools for all users of the computer.

CSIDL_COMMON_ALTSTARTUP

The file-system directory that corresponds to the non-localized Startup program group for all users.

CSIDL_COMMON_APPDATA

The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.

CSIDL_COMMON_DESKTOPDIRECTORY

The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.

CSIDL_COMMON_DOCUMENTS

The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.

CSIDL_COMMON_FAVORITES

The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.

CSIDL_COMMON_MUSIC

The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.

CSIDL_COMMON_PICTURES

The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.

CSIDL_COMMON_PROGRAMS

The file-system directory that contains the directories for the common program groups that appear on the Start menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.

CSIDL_COMMON_STARTMENU

The file-system directory that contains the programs and folders which appear on the Start menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.

CSIDL_COMMON_STARTUP

The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.

CSIDL_COMMON_TEMPLATES

The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.

CSIDL_COMMON_VIDEO

The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.

CSIDL_DEFAULT_APPDATA

Refers to the Appdata folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_LOCAL_APPDATA

Refers to the local Appdata folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_COOKIES

Refers to the Cookies folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_CONTACTS

Refers to the Contacts folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_DESKTOP

Refers to the Desktop folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_DOWNLOADS

Refers to the Downloads folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_FAVORITES

Refers to the Favorites folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_HISTORY

Refers to the History folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_INTERNET_CACHE

Refers to the Internet Cache folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_PERSONAL

Refers to the Personal folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_MYDOCUMENTS

Refers to the My Documents folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_MYPICTURES

Refers to the My Pictures folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_MYMUSIC

Refers to the My Music folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_MYVIDEO

Refers to the My Videos folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_RECENT

Refers to the Recent folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_SENDTO

Refers to the Send To folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_STARTMENU

Refers to the Start Menu folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_PROGRAMS

Refers to the Programs folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_STARTUP

Refers to the Startup folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_TEMPLATES

Refers to the Templates folder inside %DEFAULTUSERPROFILE%.

CSIDL_DEFAULT_QUICKLAUNCH

Refers to the Quick Launch folder inside %DEFAULTUSERPROFILE%.

CSIDL_FONTS

A virtual folder containing fonts. A typical path is C:\Windows\Fonts.

CSIDL_PROGRAM_FILESX86

The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).

CSIDL_PROGRAM_FILES_COMMONX86

A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.

CSIDL_PROGRAM_FILES

The Program Files folder. A typical path is C:\Program Files.

CSIDL_PROGRAM_FILES_COMMON

A folder for components that are shared across applications. A typical path is C:\Program Files\Common.

CSIDL_RESOURCES

The file-system directory that contains resource data. A typical path is C:\Windows\Resources.

CSIDL_SYSTEM

The Windows System folder. A typical path is C:\Windows\System32.

CSIDL_WINDOWS

The Windows directory or system root. This corresponds to the %WINDIR% or %SYSTEMROOT% environment variables. A typical path is C:\Windows.

DEFAULTUSERPROFILE

Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile].

PROFILESFOLDER

Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory].

PROGRAMFILES

Same as CSIDL_PROGRAM_FILES.

PROGRAMFILES(X86)

Refers to the C:\Program Files (x86) folder on 64-bit systems.

SYSTEM

Refers to %WINDIR%\system32.

SYSTEM16

Refers to %WINDIR%\system.

SYSTEM32

Refers to %WINDIR%\system32.

SYSTEMPROFILE

Refers to the value in HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath].

SYSTEMROOT

Refers to the root of the system drive.

WINDIR

Refers to the Windows folder located on the system drive.

- -  +|Variable|Explanation| +|--- |--- | +|**ALLUSERSAPPDATA**|Same as **CSIDL_COMMON_APPDATA**.| +|**ALLUSERSPROFILE**|Refers to %**PROFILESFOLDER**%\Public or %**PROFILESFOLDER**%\all users.| +|**COMMONPROGRAMFILES**|Same as **CSIDL_PROGRAM_FILES_COMMON**.| +|**COMMONPROGRAMFILES**(X86)|Refers to the C:\Program Files (x86)\Common Files folder on 64-bit systems.| +|**CSIDL_COMMON_ADMINTOOLS**|Version 10.0. The file-system directory that contains administrative tools for all users of the computer.| +|**CSIDL_COMMON_ALTSTARTUP**|The file-system directory that corresponds to the non-localized Startup program group for all users.| +|**CSIDL_COMMON_APPDATA**|The file-system directory that contains application data for all users. A typical path Windows is C:\ProgramData.| +|**CSIDL_COMMON_DESKTOPDIRECTORY**|The file-system directory that contains files and folders that appear on the desktop for all users. A typical Windows® XP path is C:\Documents and Settings\All Users\Desktop. A typical path is C:\Users\Public\Desktop.| +|**CSIDL_COMMON_DOCUMENTS**|The file-system directory that contains documents that are common to all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Documents. A typical path is C:\Users\Public\Documents.| +|**CSIDL_COMMON_FAVORITES**|The file-system directory that serves as a common repository for favorites common to all users. A typical path is C:\Users\Public\Favorites.| +|**CSIDL_COMMON_MUSIC**|The file-system directory that serves as a repository for music files common to all users. A typical path is C:\Users\Public\Music.| +|**CSIDL_COMMON_PICTURES**|The file-system directory that serves as a repository for image files common to all users. A typical path is C:\Users\Public\Pictures.| +|**CSIDL_COMMON_PROGRAMS**|The file-system directory that contains the directories for the common program groups that appear on the **Start** menu for all users. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs.| +|**CSIDL_COMMON_STARTMENU**|The file-system directory that contains the programs and folders which appear on the **Start** menu for all users. A typical path in Windows is C:\ProgramData\Microsoft\Windows\Start Menu.| +|**CSIDL_COMMON_STARTUP**|The file-system directory that contains the programs that appear in the Startup folder for all users. A typical path in Windows XP is C:\Documents and Settings\All Users\Start Menu\Programs\Startup. A typical path is C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup.| +|**CSIDL_COMMON_TEMPLATES**|The file-system directory that contains the templates that are available to all users. A typical path is C:\ProgramData\Microsoft\Windows\Templates.| +|**CSIDL_COMMON_VIDEO**|The file-system directory that serves as a repository for video files common to all users. A typical path is C:\Users\Public\Videos.| +|**CSIDL_DEFAULT_APPDATA**|Refers to the Appdata folder inside %**DEFAULTUSERPROFILE**%.| +|C**SIDL_DEFAULT_LOCAL_APPDATA**|Refers to the local Appdata folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_COOKIES**|Refers to the Cookies folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_CONTACTS**|Refers to the Contacts folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_DESKTOP**|Refers to the Desktop folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_DOWNLOADS**|Refers to the Downloads folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_FAVORITES**|Refers to the Favorites folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_HISTORY**|Refers to the History folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_INTERNET_CACHE**|Refers to the Internet Cache folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_PERSONAL**|Refers to the Personal folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_MYDOCUMENTS**|Refers to the My Documents folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_MYPICTURES**|Refers to the My Pictures folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_MYMUSIC**|Refers to the My Music folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_MYVIDEO**|Refers to the My Videos folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_RECENT**|Refers to the Recent folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_SENDTO**|Refers to the Send To folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_STARTMENU**|Refers to the Start Menu folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_PROGRAMS**|Refers to the Programs folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_STARTUP**|Refers to the Startup folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_TEMPLATES**|Refers to the Templates folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_DEFAULT_QUICKLAUNCH**|Refers to the Quick Launch folder inside %**DEFAULTUSERPROFILE**%.| +|**CSIDL_FONTS**|A virtual folder containing fonts. A typical path is C:\Windows\Fonts.| +|**CSIDL_PROGRAM_FILESX86**|The Program Files folder on 64-bit systems. A typical path is C:\Program Files(86).| +|**CSIDL_PROGRAM_FILES_COMMONX86**|A folder for components that are shared across applications on 64-bit systems. A typical path is C:\Program Files(86)\Common.| +|**CSIDL_PROGRAM_FILES**|The Program Files folder. A typical path is C:\Program Files.| +|**CSIDL_PROGRAM_FILES_COMMON**|A folder for components that are shared across applications. A typical path is C:\Program Files\Common.| +|**CSIDL_RESOURCES**|The file-system directory that contains resource data. A typical path is C:\Windows\Resources.| +|**CSIDL_SYSTEM**|The Windows System folder. A typical path is C:\Windows\System32.| +|**CSIDL_WINDOWS**|The Windows directory or system root. This corresponds to the %**WINDIR**% or %**SYSTEMROOT**% environment variables. A typical path is C:\Windows.| +|**DEFAULTUSERPROFILE**|Refers to the value in **HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [DefaultUserProfile]**.| +|**PROFILESFOLDER**|Refers to the value in **HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList [ProfilesDirectory]**.| +|**PROGRAMFILES**|Same as **CSIDL_PROGRAM_FILES**.| +|**PROGRAMFILES(X86)**|Refers to the C:\Program Files (x86) folder on 64-bit systems.| +|**SYSTEM**|Refers to %**WINDIR**%\system32.| +|**SYSTEM16**|Refers to %**WINDIR**%\system.| +|**SYSTEM32**|Refers to %**WINDIR**%\system32.| +|**SYSTEMPROFILE**|Refers to the value in **HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-18 [ProfileImagePath]**.| +|**SYSTEMROOT**|Refers to the root of the system drive.| +|**WINDIR**|Refers to the Windows folder located on the system drive.| ## Variables that are recognized only in the user context - You can use these variables in the .xml files within sections with `context=User` and `context=UserAndSystem`. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
VariableExplanation

APPDATA

Same as CSIDL_APPDATA.

CSIDL_ADMINTOOLS

The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.

CSIDL_ALTSTARTUP

The file-system directory that corresponds to the user's non-localized Startup program group.

CSIDL_APPDATA

The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.

CSIDL_BITBUCKET

The virtual folder that contains the objects in the user's Recycle Bin.

CSIDL_CDBURN_AREA

The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.

CSIDL_CONNECTIONS

The virtual folder representing Network Connections that contains network and dial-up connections.

CSIDL_CONTACTS

This refers to the Contacts folder in %CSIDL_PROFILE%.

CSIDL_CONTROLS

The virtual folder that contains icons for the Control Panel items.

CSIDL_COOKIES

The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.

CSIDL_DESKTOP

The virtual folder representing the Windows desktop.

CSIDL_DESKTOPDIRECTORY

The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.

CSIDL_DRIVES

The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.

CSIDL_FAVORITES

The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.

CSIDL_HISTORY

The file-system directory that serves as a common repository for Internet history items.

CSIDL_INTERNET

A virtual folder for Internet Explorer.

CSIDL_INTERNET_CACHE

The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files

CSIDL_LOCAL_APPDATA

The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.

CSIDL_MYDOCUMENTS

The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.

CSIDL_MYMUSIC

The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.

CSIDL_MYPICTURES

The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.

CSIDL_MYVIDEO

The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.

CSIDL_NETHOOD

A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.

CSIDL_NETWORK

A virtual folder representing My Network Places, the root of the network namespace hierarchy.

CSIDL_PERSONAL

The virtual folder representing the My Documents desktop item. This is equivalent to CSIDL_MYDOCUMENTS.

-

A typical path is C:\Documents and Settings\username\My Documents.

CSIDL_PLAYLISTS

The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.

CSIDL_PRINTERS

The virtual folder that contains installed printers.

CSIDL_PRINTHOOD

The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.

CSIDL_PROFILE

The user's profile folder. A typical path is C:\Users\Username.

CSIDL_PROGRAMS

The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.

CSIDL_RECENT

The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.

CSIDL_SENDTO

The file-system directory that contains Send To menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.

CSIDL_STARTMENU

The file-system directory that contains Start menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.

CSIDL_STARTUP

The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.

CSIDL_TEMPLATES

The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.

HOMEPATH

Same as the standard environment variable.

TEMP

The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

TMP

The temporary folder on the computer. A typical path is %USERPROFILE%\AppData\Local\Temp.

USERPROFILE

Same as CSIDL_PROFILE.

USERSID

Represents the current user-account security identifier (SID). For example,

-

S-1-5-21-1714567821-1326601894-715345443-1026.

- -  +|Variable|Explanation| +|--- |--- | +|**APPDATA**|Same as **CSIDL_APPDATA**.| +|**CSIDL_ADMINTOOLS**|The file-system directory that is used to store administrative tools for an individual user. The Microsoft® Management Console (MMC) saves customized consoles to this directory, which roams with the user profile.| +|**CSIDL_ALTSTARTUP**|The file-system directory that corresponds to the user's non-localized Startup program group.| +|**CSIDL_APPDATA**|The file-system directory that serves as a common repository for application-specific data. A typical path is C:\Documents and Settings\username\Application Data or C:\Users\username\AppData\Roaming.| +|**CSIDL_BITBUCKET**|The virtual folder that contains the objects in the user's Recycle Bin.| +|**CSIDL_CDBURN_AREA**|The file-system directory acting as a staging area for files waiting to be written to CD. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\MasteredBurning\Disc Burning.| +|**CSIDL_CONNECTIONS**|The virtual folder representing Network Connections that contains network and dial-up connections.| +|**CSIDL_CONTACTS**|This refers to the Contacts folder in %**CSIDL_PROFILE**%.| +|**CSIDL_CONTROLS**|The virtual folder that contains icons for the Control Panel items.| +|**CSIDL_COOKIES**|The file-system directory that serves as a common repository for Internet cookies. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Cookies.| +|**CSIDL_DESKTOP**|The virtual folder representing the Windows desktop.| +|**CSIDL_DESKTOPDIRECTORY**|The file-system directory used to physically store file objects on the desktop, which should not be confused with the desktop folder itself. A typical path is C:\Users\username\Desktop.| +|**CSIDL_DRIVES**|The virtual folder representing My Computer that contains everything on the local computer: storage devices, printers, and Control Panel. The folder may also contain mapped network drives.| +|**CSIDL_FAVORITES**|The file-system directory that serves as a common repository for the user's favorites. A typical path is C:\Users\Username\Favorites.| +|**CSIDL_HISTORY**|The file-system directory that serves as a common repository for Internet history items.| +|**CSIDL_INTERNET**|A virtual folder for Internet Explorer.| +|**CSIDL_INTERNET_CACHE**|The file-system directory that serves as a common repository for temporary Internet files. A typical path is C:\Users\username\AppData\Local\Microsoft\Windows\Temporary Internet Files| +|**CSIDL_LOCAL_APPDATA**|The file-system directory that serves as a data repository for local, non-roaming applications. A typical path is C:\Users\username\AppData\Local.| +|**CSIDL_MYDOCUMENTS**|The virtual folder representing My Documents.A typical path is C:\Users\Username\Documents.| +|**CSIDL_MYMUSIC**|The file-system directory that serves as a common repository for music files. A typical path is C:\Users\Username\Music.| +|**CSIDL_MYPICTURES**|The file-system directory that serves as a common repository for image files. A typical path is C:\Users\Username\Pictures.| +|**CSIDL_MYVIDEO**|The file-system directory that serves as a common repository for video files. A typical path is C:\Users\Username\Videos.| +|**CSIDL_NETHOOD**|A file-system directory that contains the link objects that may exist in the My Network Places virtual folder. It is not the same as CSIDL_NETWORK, which represents the network namespace root. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Network Shortcuts.| +|**CSIDL_NETWORK**|A virtual folder representing My Network Places, the root of the network namespace hierarchy.| +|**CSIDL_PERSONAL**|The virtual folder representing the My Documents desktop item. This is equivalent to **CSIDL_MYDOCUMENTS**.
A typical path is C:\Documents and Settings\username\My Documents.| +|**CSIDL_PLAYLISTS**|The virtual folder used to store play albums, typically C:\Users\username\My Music\Playlists.| +|**CSIDL_PRINTERS**|The virtual folder that contains installed printers.| +|**CSIDL_PRINTHOOD**|The file-system directory that contains the link objects that can exist in the Printers virtual folder. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Printer Shortcuts.| +|**CSIDL_PROFILE**|The user's profile folder. A typical path is C:\Users\Username.| +|**CSIDL_PROGRAMS**|The file-system directory that contains the user's program groups, which are themselves file-system directories. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs.| +|**CSIDL_RECENT**|The file-system directory that contains shortcuts to the user's most recently used documents. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Recent.| +|**CSIDL_SENDTO**|The file-system directory that contains **Send To** menu items. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\SendTo.| +|**CSIDL_STARTMENU**|The file-system directory that contains **Start** menu items. A typical path in Windows XP is C:\Documents and Settings\username\Start Menu. A typical path in Windows Vista, Windows 7, or Windows 8 is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu.| +|**CSIDL_STARTUP**|The file-system directory that corresponds to the user's Startup program group. A typical path is C:\Users\Username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup.| +|**CSIDL_TEMPLATES**|The file-system directory that serves as a common repository for document templates. A typical path is C:\Users\username\AppData\Roaming\Microsoft\Windows\Templates.| +|**HOMEPATH**|Same as the standard environment variable.| +|**TEMP**|The temporary folder on the computer. A typical path is %**USERPROFILE**%\AppData\Local\Temp.| +|**TMP**|The temporary folder on the computer. A typical path is %**USERPROFILE**%\AppData\Local\Temp.| +|**USERPROFILE**|Same as **CSIDL_PROFILE**.| +|**USERSID**|Represents the current user-account security identifier (SID). For example,
S-1-5-21-1714567821-1326601894-715345443-1026.| ## Related topics - [USMT XML Reference](usmt-xml-reference.md) - -  - -  - - - - - diff --git a/windows/deployment/usmt/usmt-reference.md b/windows/deployment/usmt/usmt-reference.md index 7e00f19577..a24a5da4cd 100644 --- a/windows/deployment/usmt/usmt-reference.md +++ b/windows/deployment/usmt/usmt-reference.md @@ -16,63 +16,22 @@ ms.topic: article # User State Migration Toolkit (USMT) Reference - ## In This Section - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

USMT Requirements

Describes operating system, hardware, and software requirements, and user prerequisites.

USMT Best Practices

Discusses general and security-related best practices when using USMT.

How USMT Works

Learn about the processes behind the ScanState and LoadState tools.

Plan Your Migration

Choose what to migrate and the best migration scenario for your enterprise.

User State Migration Tool (USMT) Command-line Syntax

Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.

USMT XML Reference

Learn about customizing a migration with XML files.

Offline Migration Reference

Find requirements, best practices, and other considerations for performing a migration offline.

- - +| Link | Description | +|--- |--- | +|[USMT Requirements](usmt-requirements.md)|Describes operating system, hardware, and software requirements, and user prerequisites.| +|[USMT Best Practices](usmt-best-practices.md)|Discusses general and security-related best practices when using USMT.| +|[How USMT Works](usmt-how-it-works.md)|Learn about the processes behind the ScanState and LoadState tools.| +|[Plan Your Migration](usmt-plan-your-migration.md)|Choose what to migrate and the best migration scenario for your enterprise.| +|[User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md)|Explore command-line options for the ScanState, LoadState, and UsmtUtils tools.| +|[USMT XML Reference](usmt-xml-reference.md)|Learn about customizing a migration with XML files.| +|[Offline Migration Reference](offline-migration-reference.md)|Find requirements, best practices, and other considerations for performing a migration offline.| ## Related topics - [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-requirements.md b/windows/deployment/usmt/usmt-requirements.md index 9134680979..5df90fe4bb 100644 --- a/windows/deployment/usmt/usmt-requirements.md +++ b/windows/deployment/usmt/usmt-requirements.md @@ -16,10 +16,8 @@ ms.topic: article # USMT Requirements - ## In This Topic - - [Supported Operating Systems](#bkmk-1) - [Windows PE](#windows-pe) - [Credentials](#credentials) @@ -30,63 +28,21 @@ ms.topic: article ## Supported Operating Systems - The User State Migration Tool (USMT) 10.0 does not have any explicit RAM or CPU speed requirements for either the source or destination computers. If your computer complies with the system requirements of the operating system, it also complies with the requirements for USMT. You need an intermediate store location large enough to hold all of the migrated data and settings, and the same amount of hard disk space on the destination computer for the migrated files and settings. The following table lists the operating systems supported in USMT. - +|Operating Systems|ScanState (source computer)|LoadState (destination computer)| +|--- |--- |--- | +|32-bit versions of Windows 7|✔️|✔️| +|64-bit versions of Windows 7|✔️|✔️| +|32-bit versions of Windows 8|✔️|✔️| +|64-bit versions of Windows 8|✔️|✔️| +|32-bit versions of Windows 10|✔️|✔️| +|64-bit versions of Windows 10|✔️|✔️| ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Operating SystemsScanState (source computer)LoadState (destination computer)

32-bit versions of Windows 7

X

X

64-bit versions of Windows 7

X

X

32-bit versions of Windows 8

X

X

64-bit versions of Windows 8

X

X

32-bit versions of Windows 10

X

X

64-bit versions of Windows 10

X

X

- - - -**Note**   -You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. +> [!NOTE] +> You can migrate a 32-bit operating system to a 64-bit operating system. However, you cannot migrate a 64-bit operating system to a 32-bit operating system. USMT does not support any of the Windows Server® operating systems, Windows 2000, Windows XP, or any of the starter editions for Windows Vista or Windows 7. @@ -100,7 +56,7 @@ For more information about previous releases of the USMT tools, see [User State ## Credentials - **Run as administrator** - When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8 or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. + When manually running the **ScanState** and **LoadState** tools on Windows 7, Windows 8, or Windows 10 you must run them from an elevated command prompt to ensure that all specified users are migrated. If you do not run USMT from an elevated prompt, only the user profile that is logged on will be included in the migration. To open an elevated command prompt: @@ -110,8 +66,8 @@ To open an elevated command prompt: 3. Right-click **cmd** or **Command Prompt**, and then click **Run as administrator**. 4. If the current user is not already an administrator, you will be prompted to enter administrator credentials. -**Important**
-You must run USMT using an account with full administrative permissions, including the following privileges: +> [!IMPORTANT] +> You must run USMT using an account with full administrative permissions, including the following privileges: - SeBackupPrivilege (Back up files and directories) - SeDebugPrivilege (Debug programs) @@ -119,11 +75,10 @@ You must run USMT using an account with full administrative permissions, includi - SeSecurityPrivilege (Manage auditing and security log) - SeTakeOwnership Privilege (Take ownership of files or other objects) - ## Config.xml - **Specify the /c option and <ErrorControl> settings in the Config.xml file.**
- USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). + USMT will fail if it cannot migrate a file or setting, unless you specify the **/c** option. When you specify the **/c** option, USMT logs an error each time it encounters a file that is in use that did not migrate, but the migration will not be interrupted. In USMT, you can specify in the Config.xml file, which types of errors should allow the migration to continue, and which should cause the migration to fail. For more information about error reporting, and the **<ErrorControl>** element, see [Config.xml File](usmt-configxml-file.md), [Log Files](usmt-log-files.md), and [XML Elements Library](usmt-xml-elements-library.md). ## LoadState @@ -132,12 +87,10 @@ You must run USMT using an account with full administrative permissions, includi ## Hard-Disk Requirements - Ensure that there is enough available space in the migration-store location and on the source and destination computers. For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md). ## User Prerequisites - This documentation assumes that IT professionals using USMT understand command-line tools. The documentation also assumes that IT professionals using USMT to author MigXML rules understand the following: - The navigation and hierarchy of the Windows registry. @@ -147,10 +100,6 @@ This documentation assumes that IT professionals using USMT understand command-l ## Related topics - [Plan Your Migration](usmt-plan-your-migration.md)
[Estimate Migration Store Size](usmt-estimate-migration-store-size.md)
[User State Migration Tool (USMT) Overview Topics](usmt-topics.md)
- - - diff --git a/windows/deployment/usmt/usmt-return-codes.md b/windows/deployment/usmt/usmt-return-codes.md index 44089d6d19..b10a808b61 100644 --- a/windows/deployment/usmt/usmt-return-codes.md +++ b/windows/deployment/usmt/usmt-return-codes.md @@ -16,14 +16,12 @@ ms.topic: article # Return Codes - This topic describes User State Migration Tool (USMT) 10.0 return codes and error messages. Also included is a table listing the USMT return codes with their associated mitigation steps. In addition, this topic provides tips to help you use the logfiles to determine why you received an error. Understanding the requirements for running USMT can help minimize errors in your USMT migrations. For more information, see [USMT Requirements](usmt-requirements.md). ## In This Topic - [USMT Return Codes](#bkmk-returncodes) [USMT Error Messages](#bkmk-errormessages) @@ -32,7 +30,6 @@ Understanding the requirements for running USMT can help minimize errors in your ## USMT Return Codes - If you encounter an error in your USMT migration, you can use return codes and the more specific information provided in the associated USMT error messages to troubleshoot the issue and to identify mitigation steps. Return codes are grouped into the following broad categories that describe their area of error reporting: @@ -51,731 +48,231 @@ As a best practice, we recommend that you set verbosity level to 5, **/v**:5 ## USMT Error Messages - Error messages provide more detailed information about the migration problem than the associated return code. For example, the **ScanState**, **LoadState**, or **USMTUtils** tool might return a code of "11” (for “USMT\_INVALID\_PARAMETERS") and a related error message that reads "/key and /keyfile both specified". The error message is displayed at the command prompt and is identified in the **ScanState**, **LoadState**, or **USMTUtils** log files to help you determine why the return code was received. You can obtain more information about any listed Windows application programming interface (API) system error codes by typing **net helpmsg** on the command line and, then typing the error code number. For more information about System Error Codes, see [this Microsoft Web site](/windows/win32/debug/system-error-codes--0-499-). ## Troubleshooting Return Codes and Error Messages +The following information lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. -The following table lists each return code by numeric value, along with the associated error messages and suggested troubleshooting actions. +- **0: USMT_SUCCESS** + - **Error message**: Successful run - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Return code valueReturn codeError messageTroubleshooting, mitigation, workaroundsCategory

0

USMT_SUCCESS

Successful run

Not applicable

Success or Cancel

1

USMT_DISPLAY_HELP

Command line help requested

Not applicable

Success or Cancel

2

USMT_STATUS_CANCELED

Gather was aborted because of an EFS file

Not applicable

User chose to cancel (such as pressing CTRL+C)

Not applicable

Success or Cancel

3

USMT_WOULD_HAVE_FAILED

At least one error was skipped as a result of /c

Review ScanState, LoadState, or UsmtUtils log for details about command-line errors.

11

USMT_INVALID_PARAMETERS

/all conflicts with /ui, /ue or /uel

Review ScanState log or LoadState log for details about command-line errors.

/auto expects an optional parameter for the script folder

Review ScanState log or LoadState log for details about command-line errors.

/encrypt can't be used with /nocompress

Review ScanState log or LoadState log for details about command-line errors.

/encrypt requires /key or /keyfile

Review ScanState log or LoadState log for details about command-line errors.

/genconfig can't be used with most other options

Review ScanState log or LoadState log for details about command-line errors.

/genmigxml can't be used with most other options

Review ScanState log or LoadState log for details about command-line errors.

/hardlink requires /nocompress

Review ScanState log or LoadState log for details about command-line errors.

/key and /keyfile both specified

Review ScanState log or LoadState log for details about command-line errors.

/key or /keyfile used without enabling encryption

Review ScanState log or LoadState log for details about command-line errors.

/lae is only used with /lac

Review ScanState log or LoadState log for details about command-line errors.

/listfiles cannot be used with /p

Review ScanState log or LoadState log for details about command-line errors.

/offline requires a valid path to an XML file describing offline paths

Review ScanState log or LoadState log for details about command-line errors.

/offlinewindir requires a valid path to offline windows folder

Review ScanState log or LoadState log for details about command-line errors.

/offlinewinold requires a valid path to offline windows folder

Review ScanState log or LoadState log for details about command-line errors.

A command was already specified

Verify that the command-line syntax is correct and that there are no duplicate commands.

An option argument is missing

Review ScanState log or LoadState log for details about command-line errors.

An option is specified more than once and is ambiguous

Review ScanState log or LoadState log for details about command-line errors.

By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed.

Review ScanState log or LoadState log for details about command-line errors.

Command line arguments are required. Specify /? for options.

Review ScanState log or LoadState log for details about command-line errors.

Command line option is not valid

Review ScanState log or LoadState log for details about command-line errors.

EFS parameter specified is not valid for /efs

Review ScanState log or LoadState log for details about command-line errors.

File argument is invalid for /genconfig

Review ScanState log or LoadState log for details about command-line errors.

File argument is invalid for /genmigxml

Review ScanState log or LoadState log for details about command-line errors.

Invalid space estimate path. Check the parameters and/or file system permissions

Review ScanState log or LoadState log for details about command-line errors.

List file path argument is invalid for /listfiles

Review ScanState log or LoadState log for details about command-line errors.

Retry argument must be an integer

Review ScanState log or LoadState log for details about command-line errors.

Settings store argument specified is invalid

Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

Specified encryption algorithm is not supported

Review ScanState log or LoadState log for details about command-line errors.

The /efs:hardlink requires /hardlink

Review ScanState log or LoadState log for details about command-line errors.

The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7

Review ScanState log or LoadState log for details about command-line errors.

The store parameter is required but not specified

Review ScanState log or LoadState log for details about command-line errors.

The source-to-target domain mapping is invalid for /md

Review ScanState log or LoadState log for details about command-line errors.

The source-to-target user account mapping is invalid for /mu

Review ScanState log or LoadState log for details about command-line errors.

Undefined or incomplete command line option

Review ScanState log or LoadState log for details about command-line errors.

Invalid Command Lines

Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate

Review ScanState log or LoadState log for details about command-line errors.

User exclusion argument is invalid

Review ScanState log or LoadState log for details about command-line errors.

Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08)

Review ScanState log or LoadState log for details about command-line errors.

Volume shadow copy feature is not supported with a hardlink store

Review ScanState log or LoadState log for details about command-line errors.

Wait delay argument must be an integer

Review ScanState log or LoadState log for details about command-line errors.

12

USMT_ERROR_OPTION_PARAM_TOO_LARGE

Command line arguments cannot exceed 256 characters

Review ScanState log or LoadState log for details about command-line errors.

Invalid Command Lines

Specified settings store path exceeds the maximum allowed length of 256 characters

Review ScanState log or LoadState log for details about command-line errors.

13

USMT_INIT_LOGFILE_FAILED

Log path argument is invalid for /l

When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct.

Invalid Command Lines

14

USMT_ERROR_USE_LAC

Unable to create a local account because /lac was not specified

When creating local accounts, the command-line options /lac and /lae should be used.

Invalid Command Lines

26

USMT_INIT_ERROR

Multiple Windows installations found

Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

Setup and Initialization

Software malfunction or unknown exception

Check all loaded .xml files for errors, common error when using /I to load the Config.xml file.

Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries

Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping.

27

USMT_INVALID_STORE_LOCATION

A store path can't be used because an existing store exists; specify /o to overwrite

Specify /o to overwrite an existing intermediate or migration store.

Setup and Initialization

A store path is missing or has incomplete data

Make sure that the store path is accessible and that the proper permission levels are set.

An error occurred during store creation

Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

An inappropriate device such as a floppy disk was specified for the store

Make sure that the store path is accessible and that the proper permission levels are set.

Invalid store path; check the store parameter and/or file system permissions

Invalid store path; check the store parameter and/or file system permissions

The file layout and/or file content is not recognized as a valid store

Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store.

The store path holds a store incompatible with the current USMT version

Make sure that the store path is accessible and that the proper permission levels are set.

The store save location is read-only or does not support a requested storage option

Make sure that the store path is accessible and that the proper permission levels are set.

28

USMT_UNABLE_GET_SCRIPTFILES

Script file is invalid for /i

Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

Setup and Initialization

Unable to find a script file specified by /i

Verify the location of your script files, and ensure that the command-line options are correct.

29

USMT_FAILED_MIGSTARTUP

A minimum of 250 MB of free space is required for temporary files

Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable USMT_WORKING_DIR=<path> to redirect the temporary files working directory.

Setup and Initialization

Another process is preventing migration; only one migration tool can run at a time

Check the ScanState log file for migration .xml file errors.

Failed to start main processing, look in log for system errors or check the installation

Check the ScanState log file for migration .xml file errors.

Migration failed because of an XML error; look in the log for specific details

Check the ScanState log file for migration .xml file errors.

Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table

Check the ScanState log file for migration .xml file errors.

31

USMT_UNABLE_FINDMIGUNITS

An error occurred during the discover phase; the log should have more specific information

Check the ScanState log file for migration .xml file errors.

Setup and Initialization

32

USMT_FAILED_SETMIGRATIONTYPE

An error occurred processing the migration system

Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

Setup and Initialization

33

USMT_UNABLE_READKEY

Error accessing the file specified by the /keyfile parameter

Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

Setup and Initialization

The encryption key must have at least one character

Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

34

USMT_ERROR_INSUFFICIENT_RIGHTS

Directory removal requires elevated privileges

Log on as Administrator, and run with elevated privileges.

Setup and Initialization

No rights to create user profiles; log in as Administrator; run with elevated privileges

Log on as Administrator, and run with elevated privileges.

No rights to read or delete user profiles; log in as Administrator, run with elevated privileges

Log on as Administrator, and run with elevated privileges.

35

USMT_UNABLE_DELETE_STORE

A reboot is required to remove the store

Reboot to delete any files that could not be deleted when the command was executed.

Setup and Initialization

A store path can't be used because it contains data that could not be overwritten

A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use USMTUtils /rd command to delete the store.

There was an error removing the store

Review ScanState log or LoadState log for details about command-line errors.

36

USMT_ERROR_UNSUPPORTED_PLATFORM

Compliance check failure; please check the logs for details

Investigate whether there is an active temporary profile on the system.

Setup and Initialization

Use of /offline is not supported during apply

The /offline command was not used while running in the Windows Preinstallation Environment (WinPE).

Use /offline to run gather on this platform

The /offline command was not used while running in WinPE.

37

USMT_ERROR_NO_INVALID_KEY

The store holds encrypted data but the correct encryption key was not provided

Verify that you have included the correct encryption /key or /keyfile.

Setup and Initialization

38

USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE

An error occurred during store access

Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set.

Setup and Initialization

39

USMT_UNABLE_TO_READ_CONFIG_FILE

Error reading Config.xml

Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

Setup and Initialization

File argument is invalid for /config

Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line.

40

USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG

Error writing to the progress log

The Progress log could not be created. Verify that the location is valid and that you have write access.

Setup and Initialization

Progress log argument is invalid for /progress

The Progress log could not be created. Verify that the location is valid and that you have write access.

41

USMT_PREFLIGHT_FILE_CREATION_FAILED

Can't overwrite existing file

The Progress log could not be created. Verify that the location is valid and that you have write access.

Setup and Initialization

Invalid space estimate path. Check the parameters and/or file system permissions

Review ScanState log or LoadState log for details about command-line errors.

42

USMT_ERROR_CORRUPTED_STORE

The store contains one or more corrupted files

Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see Extract Files from a Compressed USMT Migration Store.

61

USMT_MIGRATION_STOPPED_NONFATAL

Processing stopped due to an I/O error

USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option.

Non-fatal Errors

71

USMT_INIT_OPERATING_ENVIRONMENT_FAILED

A Windows Win32 API error occurred

Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

Fatal Errors

An error occurred when attempting to initialize the diagnostic mechanisms such as the log

Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

Failed to record diagnostic information

Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

Unable to start. Make sure you are running USMT with elevated privileges

Exit USMT and log in again with elevated privileges.

72

USMT_UNABLE_DOMIGRATION

An error occurred closing the store

Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

Fatal Errors

An error occurred in the apply process

Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

An error occurred in the gather process

Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

Out of disk space while writing the store

Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

Out of temporary disk space on the local system

Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

+- **1: USMT_DISPLAY_HELP** + - **Error message**: Command line help requested - +- **2: USMT_STATUS_CANCELED** + - **Error message**: + - Gather was aborted because of an EFS file + - User chose to cancel (such as pressing CTRL+C) + +- **3: USMT_WOULD_HAVE_FAILED** + - **Error message**: At least one error was skipped as a result of /c. + - **Troubleshooting, mitigation, workarounds**: Review ScanState, LoadState, or UsmtUtils log for details about command-line errors. + +- **11: USMT_INVALID_PARAMETERS** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | /all conflicts with /ui, /ue or /uel | Review ScanState log or LoadState log for details about command-line errors. | + | /auto expects an optional parameter for the script folder | Review ScanState log or LoadState log for details about command-line errors. | + | /encrypt can't be used with /nocompress | Review ScanState log or LoadState log for details about command-line errors. | + | /encrypt requires /key or /keyfile | Review ScanState log or LoadState log for details about command-line errors. | + | /genconfig can't be used with most other options | Review ScanState log or LoadState log for details about command-line errors. | + | /genmigxml can't be used with most other options | Review ScanState log or LoadState log for details about command-line errors. | + | /hardlink requires /nocompress | Review ScanState log or LoadState log for details about command-line errors. | + | /key and /keyfile both specified | Review ScanState log or LoadState log for details about command-line errors. | + | /key or /keyfile used without enabling encryption | Review ScanState log or LoadState log for details about command-line errors. | + | /lae is only used with /lac | Review ScanState log or LoadState log for details about command-line errors. | + | /listfiles cannot be used with /p | Review ScanState log or LoadState log for details about command-line errors. | + | /offline requires a valid path to an XML file describing offline paths | Review ScanState log or LoadState log for details about command-line errors. | + | /offlinewindir requires a valid path to offline windows folder | Review ScanState log or LoadState log for details about command-line errors. | + | /offlinewinold requires a valid path to offline windows folder | Review ScanState log or LoadState log for details about command-line errors. | + | A command was already specified | Verify that the command-line syntax is correct and that there are no duplicate commands. | + | An option argument is missing | Review ScanState log or LoadState log for details about command-line errors. | + | An option is specified more than once and is ambiguous | Review ScanState log or LoadState log for details about command-line errors. | + | By default /auto selects all users and uses the highest log verbosity level. Switches like /all, /ui, /ue, /v are not allowed. | Review ScanState log or LoadState log for details about command-line errors. | + | Command line arguments are required. Specify /? for options. | Review ScanState log or LoadState log for details about command-line errors. | + | Command line option is not valid | Review ScanState log or LoadState log for details about command-line errors. | + | EFS parameter specified is not valid for /efs | Review ScanState log or LoadState log for details about command-line errors. | + | File argument is invalid for /genconfig | Review ScanState log or LoadState log for details about command-line errors. | + | File argument is invalid for /genmigxml | Review ScanState log or LoadState log for details about command-line errors. | + | Invalid space estimate path. Check the parameters and/or file system permissions | Review ScanState log or LoadState log for details about command-line errors. | + | List file path argument is invalid for /listfiles | Review ScanState log or LoadState log for details about command-line errors. | + | Retry argument must be an integer | Review ScanState log or LoadState log for details about command-line errors. | + | Settings store argument specified is invalid | Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set. | + | Specified encryption algorithm is not supported | Review ScanState log or LoadState log for details about command-line errors. | + | The /efs:hardlink requires /hardlink | Review ScanState log or LoadState log for details about command-line errors. | + | The /targetWindows7 option is only available for Windows XP, Windows Vista, and Windows 7 | Review ScanState log or LoadState log for details about command-line errors. | + | The store parameter is required but not specified | Review ScanState log or LoadState log for details about command-line errors. | + | The source-to-target domain mapping is invalid for /md | Review ScanState log or LoadState log for details about command-line errors. | + | The source-to-target user account mapping is invalid for /mu | Review ScanState log or LoadState log for details about command-line errors. | + | Undefined or incomplete command line option | Review ScanState log or LoadState log for details about command-line errors.

Category: Invalid Command Lines| + | Use /nocompress, or provide an XML file path with /p"pathtoafile" to get a compressed store size estimate | Review ScanState log or LoadState log for details about command-line errors. | + | User exclusion argument is invalid | Review ScanState log or LoadState log for details about command-line errors. | + | Verbosity level must be specified as a sum of the desired log options: Verbose (0x01), Record Objects (0x04), Echo to debug port (0x08) | Review ScanState log or LoadState log for details about command-line errors. | + | Volume shadow copy feature is not supported with a hardlink store | Review ScanState log or LoadState log for details about command-line errors. | + | Wait delay argument must be an integer | Review ScanState log or LoadState log for details about command-line errors. | + +- **12: USMT_ERROR_OPTION_PARAM_TOO_LARGE** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Command line arguments cannot exceed 256 characters | Review ScanState log or LoadState log for details about command-line errors.

Category: Invalid Command Lines | + | Specified settings store path exceeds the maximum allowed length of 256 characters | Review ScanState log or LoadState log for details about command-line errors. | + +- **13: USMT_INIT_LOGFILE_FAILED** + - **Error message**: Log path argument is invalid for /l + - **Troubleshooting, mitigation, workarounds**: When /l is specified in the ScanState command line, USMT validates the path. Verify that the drive and other information, for example file system characters, are correct. + - **Category**: Invalid Command Lines + +- **14: USMT_ERROR_USE_LAC** + - **Error message**: Unable to create a local account because /lac was not specified + - **Troubleshooting, mitigation, workarounds**: When creating local accounts, the command-line options /lac and /lae should be used. + - **Category**: Invalid Command Lines + +- **26: USMT_INIT_ERROR** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Multiple Windows installations found | Listfiles.txt could not be created. Verify that the location you specified for the creation of this file is valid.

Category: Setup and Initialization | + | Software malfunction or unknown exception | Check all loaded .xml files for errors, common error when using /I to load the Config.xml file. | + | Unable to find a valid Windows directory to proceed with requested offline operation; Check if offline input file is present and has valid entries | Verify that the offline input file is present and that it has valid entries. USMT could not find valid offline operating system. Verify your offline directory mapping. | + +- **27: USMT_INVALID_STORE_LOCATION** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | A store path can't be used because an existing store exists; specify /o to overwrite | Specify /o to overwrite an existing intermediate or migration store.

Category: Setup and Initialization | + | A store path is missing or has incomplete data | Make sure that the store path is accessible and that the proper permission levels are set. | + | An error occurred during store creation | Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store. | + | An inappropriate device such as a floppy disk was specified for the store | Make sure that the store path is accessible and that the proper permission levels are set. | + | Invalid store path; check the store parameter and/or file system permissions | Invalid store path; check the store parameter and/or file system permissions. | + | The file layout and/or file content is not recognized as a valid store | Make sure that the store path is accessible and that the proper permission levels are set. Specify /o to overwrite an existing intermediate or migration store. | + | The store path holds a store incompatible with the current USMT version | Make sure that the store path is accessible and that the proper permission levels are set. | + | The store save location is read-only or does not support a requested storage option | Make sure that the store path is accessible and that the proper permission levels are set. | + +- **28: USMT_UNABLE_GET_SCRIPTFILES** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Script file is invalid for /i | Check all specified migration .xml files for errors. This is a common error when using /i to load the Config.xml file.

Category: Setup and Initialization | + | Unable to find a script file specified by /i | Verify the location of your script files, and ensure that the command-line options are correct. | + +- **29: USMT_FAILED_MIGSTARTUP** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | A minimum of 250 MB of free space is required for temporary files | Verify that the system meets the minimum temporary disk space requirement of 250 MB. As a workaround, you can set the environment variable `USMT_WORKING_DIR=` to redirect the temporary files working directory.

Category: Setup and Initialization | + | Another process is preventing migration; only one migration tool can run at a time | Check the ScanState log file for migration .xml file errors. | + | Failed to start main processing, look in log for system errors or check the installation | Check the ScanState log file for migration .xml file errors. | + | Migration failed because of an XML error; look in the log for specific details | Check the ScanState log file for migration .xml file errors. | + | Unable to automatically map the drive letters to match the online drive letter layout; Use /offline to provide a mapping table | Check the ScanState log file for migration .xml file errors. | + +- **31: USMT_UNABLE_FINDMIGUNITS** + + - **Error message**: An error occurred during the discover phase; the log should have more specific information + - **Troubleshooting, mitigation, workarounds**: Check the ScanState log file for migration .xml file errors. + - **Category**: Setup and Initialization + +- **32: USMT_FAILED_SETMIGRATIONTYPE** + - **Error message**: An error occurred processing the migration system + - **Troubleshooting, mitigation, workarounds**: Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line. + - **Category**: Setup and Initialization + +- **33: USMT_UNABLE_READKEY** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Error accessing the file specified by the /keyfile parameter | Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line.

Category: Setup and Initialization | + | The encryption key must have at least one character | Check the ScanState log file for migration .xml file errors, or use online Help by typing /? on the command line. | + +- **34: USMT_ERROR_INSUFFICIENT_RIGHTS** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Directory removal requires elevated privileges | Log on as Administrator, and run with elevated privileges.

Category: Setup and Initialization | + | No rights to create user profiles; log in as Administrator; run with elevated privileges | Log on as Administrator, and run with elevated privileges. | + | No rights to read or delete user profiles; log in as Administrator, run with elevated privileges | Log on as Administrator, and run with elevated privileges. | + +- **35: USMT_UNABLE_DELETE_STORE** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | A reboot is required to remove the store | Reboot to delete any files that could not be deleted when the command was executed.

Category: Setup and Initialization | + | A store path can't be used because it contains data that could not be overwritten | A migration store could not be deleted. If you are using a hardlink migration store you might have a locked file in it. You should manually delete the store, or use **USMTUtils /rd** command to delete the store. | + | There was an error removing the store | Review ScanState log or LoadState log for details about command-line errors. | + +- **36: USMT_ERROR_UNSUPPORTED_PLATFORM** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Compliance check failure; please check the logs for details | Investigate whether there is an active temporary profile on the system.

Category: Setup and Initialization | + | Use of /offline is not supported during apply | The **/offline** command was not used while running in the Windows Preinstallation Environment (WinPE). | + | Use /offline to run gather on this platform | The **/offline** command was not used while running in WinPE. | + +- **37: USMT_ERROR_NO_INVALID_KEY** + - **Error message**: The store holds encrypted data but the correct encryption key was not provided + - **Troubleshooting, mitigation, workarounds**: Verify that you have included the correct encryption /key or /keyfile. + - **Category**: Setup and Initialization + +- **38: USMT_ERROR_CORRUPTED_NOTENCRYPTED_STORE** + - **Error message**: An error occurred during store access + - **Troubleshooting, mitigation, workarounds**: Review ScanState log or LoadState log for details about command-line errors. Make sure that the store path is accessible and that the proper permission levels are set. + - **Category**: Setup and Initialization + +- **39: USMT_UNABLE_TO_READ_CONFIG_FILE** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Error reading Config.xml | Review ScanState log or LoadState log for details about command-line errors in the Config.xml file.

Category: Setup and Initialization | + | File argument is invalid for /config | Check the command line you used to load the Config.xml file. You can use online Help by typing /? on the command line. | + +- **40: USMT_ERROR_UNABLE_CREATE_PROGRESS_LOG** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Error writing to the progress log | The Progress log could not be created. Verify that the location is valid and that you have write access.

Category: Setup and Initialization | + | Progress log argument is invalid for /progress | The Progress log could not be created. Verify that the location is valid and that you have write access. | + +- **41: USMT_PREFLIGHT_FILE_CREATION_FAILED** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | Can't overwrite existing file | The Progress log could not be created. Verify that the location is valid and that you have write access.

Category: Setup and Initialization | + | Invalid space estimate path. Check the parameters and/or file system permissions | Review ScanState log or LoadState log for details about command-line errors. | + +- **42: USMT_ERROR_CORRUPTED_STORE** + - **Error message**: The store contains one or more corrupted files + - **Troubleshooting, mitigation, workarounds**: Review UsmtUtils log for details about the corrupted files. For information on how to extract the files that are not corrupted, see [Extract Files from a Compressed USMT Migration Store](usmt-extract-files-from-a-compressed-migration-store.md). + +- **61: USMT_MIGRATION_STOPPED_NONFATAL** + - **Error message**: Processing stopped due to an I/O error + - **Troubleshooting, mitigation, workarounds**: USMT exited but can continue with the /c command-line option, with the optional configurable <ErrorControl> section or by using the /vsc command-line option. + - **Category**: Non-fatal Errors + +- **71: USMT_INIT_OPERATING_ENVIRONMENT_FAILED** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | A Windows Win32 API error occurred | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details.

Category: Fatal Errors | + | An error occurred when attempting to initialize the diagnostic mechanisms such as the log | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. | + | Failed to record diagnostic information | Data transfer has begun, and there was an error during the creation of migration store or during the apply phase. Review the ScanState log or LoadState log for details. | + | Unable to start. Make sure you are running USMT with elevated privileges | Exit USMT and log in again with elevated privileges. | + +- **72: USMT_UNABLE_DOMIGRATION** + + | Error message | Troubleshooting, mitigation, workarounds | + | --- | --- | + | An error occurred closing the store | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details.

Category: Fatal Errors| + | An error occurred in the apply process | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | + | An error occurred in the gather process | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | + | Out of disk space while writing the store | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | + | Out of temporary disk space on the local system | Data transfer has begun, and there was an error during migration-store creation or during the apply phase. Review the ScanState log or LoadState log for details. | ## Related topics - [User State Migration Tool (USMT) Troubleshooting](usmt-troubleshooting.md) [Log Files](usmt-log-files.md) - - - diff --git a/windows/deployment/usmt/usmt-scanstate-syntax.md b/windows/deployment/usmt/usmt-scanstate-syntax.md index eaaf29d214..37fb5cbc81 100644 --- a/windows/deployment/usmt/usmt-scanstate-syntax.md +++ b/windows/deployment/usmt/usmt-scanstate-syntax.md @@ -16,12 +16,10 @@ ms.topic: article # ScanState Syntax - The ScanState command is used with the User State Migration Tool (USMT) 10.0 to scan the source computer, collect the files and settings, and create a store. ## In This Topic - [Before You Begin](#bkmk-beforeyoubegin) [Syntax](#bkmk-syntax) @@ -40,7 +38,6 @@ The ScanState command is used with the User State Migration Tool (USMT) 10.0 to ## Before You Begin - Before you run the **ScanState** command, note the following: - To ensure that all operating system settings migrate, in most cases you must run the **ScanState** commands in administrator mode from an account with administrative credentials. @@ -59,7 +56,6 @@ Before you run the **ScanState** command, note the following: ## Syntax - This section explains the syntax and usage of the **ScanState** command-line options. The options can be specified in any order. If the option contains a parameter, you can use either a colon or a space separator. The **ScanState** command's syntax is: @@ -76,80 +72,20 @@ To create an encrypted store using the Config.xml file and the default migration ## Storage Options - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

StorePath

Indicates a folder where files and settings will be saved. Note that StorePath cannot be C:\. You must specify the StorePath option in the ScanState command, except when using the /genconfig option. You cannot specify more than one StorePath location.

/apps

Scans the image for apps and includes them and their associated registry settings.

/ppkg [<FileName>]

Exports to a specific file location.

/o

Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the ScanState command will fail if the migration store already contains data. You cannot use this option more than once on a command line.

/vsc

This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the <ErrorControl> section.

-

This option can be used only with the ScanState executable file and cannot be combined with the /hardlink option.

/hardlink

Enables the creation of a hard-link migration store at the specified location. The /nocompress option must be specified with the /hardlink option.

/encrypt [{/key:<KeyString> | /keyfile:<file>]}

Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key-in one of the following ways:

-
    -
  • /key:KeyString specifies the encryption key. If there is a space in KeyString, you will need to surround KeyString with quotation marks.

  • -
  • /keyfile:FilePathAndName specifies a text (.txt) file that contains the encryption key.

  • -
-

We recommend that KeyString be at least eight characters long, but it cannot exceed 256 characters. The /key and /keyfile options cannot be used on the same command line. The /encrypt and /nocompress options cannot be used on the same command line.

-
-Important

You should use caution with this option, because anyone who has access to the ScanState command-line script will also have access to the encryption key.

-
-
- -
-

The following example shows the ScanState command and the /key option:

-

scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey

/encrypt:<EncryptionStrength>

The /encrypt option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see Migration Store Encryption.

/nocompress

Disables compression of data and saves the files to a hidden folder named "File" at StorePath\USMT. Compression is enabled by default. Combining the /nocompress option with the /hardlink option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the /nocompress option with the /hardlink option.

-

The /nocompress and /encrypt options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the LoadState command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

-

For example:

-

scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress

- - +| Command-Line Option | Description | +|-----|-----| +| *StorePath* | Indicates a folder where files and settings will be saved. Note that *StorePath* cannot be **C:\**. You must specify the *StorePath* option in the **ScanState** command, except when using the **/genconfig** option. You cannot specify more than one *StorePath* location. | +| **/apps** | Scans the image for apps and includes them and their associated registry settings. | +| **/ppkg** [*<FileName>*] | Exports to a specific file location. | +| **/o** | Required to overwrite any existing data in the migration store or Config.xml file. If not specified, the **ScanState** command will fail if the migration store already contains data. You cannot use this option more than once on a command line. | +| **/vsc** | This option enables the volume shadow-copy service to migrate files that are locked or in use. This command-line option eliminates most file-locking errors that are typically encountered by the **<ErrorControl>** section.

This option can be used only with the ScanState executable file and cannot be combined with the **/hardlink** option. | +| **/hardlink** | Enables the creation of a hard-link migration store at the specified location. The **/nocompress** option must be specified with the **/hardlink** option. | +| **/encrypt** [{**/key:** *<KeyString>* | **/keyfile**:*<file>*]} | Encrypts the store with the specified key. Encryption is disabled by default. With this option, you will need to specify the encryption key-in one of the following ways:
  • **/key:** *KeyString* specifies the encryption key. If there is a space in *KeyString*, you will need to surround *KeyString* with quotation marks.
  • **/keyfile:** *FilePathAndName* specifies a text (.txt) file that contains the encryption key.

We recommend that *KeyString* be at least eight characters long, but it cannot exceed 256 characters. The **/key** and **/keyfile** options cannot be used on the same command line. The **/encrypt** and **/nocompress** options cannot be used on the same command line.
**Important**
You should use caution with this option, because anyone who has access to the **ScanState** command-line script will also have access to the encryption key.

The following example shows the ScanState command and the **/key** option:
`scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /encrypt /key:mykey` | +| **/encrypt**:*<EncryptionStrength>* | The **/encrypt** option accepts a command-line parameter to define the encryption strength to be used for encryption of the migration store. For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | +| **/nocompress** | Disables compression of data and saves the files to a hidden folder named "File" at *StorePath*\USMT. Compression is enabled by default. Combining the **/nocompress** option with the **/hardlink** option generates a hard-link migration store. You can use the uncompressed store to view what USMT stored, troubleshoot a problem, or run an antivirus utility against the files. You should use this option only in testing environments, because we recommend that you use a compressed store during your actual migration, unless you are combining the **/nocompress** option with the **/hardlink** option.

The **/nocompress** and **/encrypt** options cannot be used together in one statement on the command line. However, if you do choose to migrate an uncompressed store, the **LoadState** command will migrate each file directly from the store to the correct location on the destination computer without a temporary location.

For example:
`scanstate /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /nocompress` | ## Run the ScanState Command on an Offline Windows System - You can run the **ScanState** command in Windows Preinstallation Environment (WinPE). In addition, USMT supports migrations from previous installations of Windows contained in Windows.old directories. The offline directory can be a Windows directory when you run the **ScanState** command in WinPE or a Windows.old directory when you run the **ScanState** command in Windows. There are several benefits to running the **ScanState** command on an offline Windows image, including: @@ -172,445 +108,87 @@ There are several benefits to running the **ScanState** command on an offline Wi ## Offline Migration Options - - ---- - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDefinition

/offline:"path to an offline.xml file"

This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.

/offlinewindir:"path to a Windows directory"

This option specifies the offline Windows directory that the ScanState command gathers user state from. The offline directory can be Windows.old when you run the ScanState command in Windows or a Windows directory when you run the ScanState command in WinPE.

/offlinewinold:"Windows.old directory"

This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.

- - +|Command-Line Option|Definition| +|--- |--- | +|**/offline:** *"path to an offline.xml file"*|This option is used to define a path to an offline .xml file that might specify other offline migration options, for example, an offline Windows directory or any domain or folder redirection required in your migration.| +|**/offlinewindir:** *"path to a Windows directory"*|This option specifies the offline Windows directory that the **ScanState** command gathers user state from. The offline directory can be Windows.old when you run the **ScanState** command in Windows or a Windows directory when you run the **ScanState** command in WinPE.| +|**/offlinewinold:** *"Windows.old directory"*|This command-line option enables the offline migration mode and starts the migration from the location specified. It is only intended to be used in Windows.old migration scenarios, where the migration is occurring from a Windows.old directory.| ## Migration Rule Options - USMT provides the following options to specify what files you want to migrate. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

/i:[Path]FileName

(include)

-

Specifies an .xml file that contains rules that define what user, application, or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the Frequently Asked Questions topic.

/genconfig:[Path]FileName

(Generate Config.xml)

-

Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications, and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the /i option, when you specify this option.

-

After you create this file, you will need to make use of it with the ScanState command using the /config option.

-

The only options that you can specify with this option are the /i, /v, and /l options. You cannot specify StorePath, because the /genconfig option does not create a store. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

-

Examples:

-
    -
  • The following example creates a Config.xml file in the current directory:

    -

    scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13

  • -

/config:[Path</em>]FileName

Specifies the Config.xml file that the ScanState command should use to create the store. You cannot use this option more than once on the command line. Path can be either a relative or full path. If you do not specify the Path variable, then FileName must be located in the current directory.

-

The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:

-

scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log

-

The following example migrates the files and settings to the destination computer using the Config.xml, MigDocs.xml, and MigApp.xml files:

-

loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log

/auto:path to script files

This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The /auto option has the same effect as using the following options: /i: MigDocs.xml /i:MigApp.xml /v:5.

/genmigxml:path to a file

This option specifies that the ScanState command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the ScanState command is running.

/targetwindows8

Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command-line option in the following scenarios:

-
    -
  • To create a Config.xml file by using the /genconfig option. Using the /targetwindows8 option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.

  • -
  • To create a migration store. Using the /targetwindows8 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows8 command-line option, some settings can be lost during the migration.

  • -

/targetwindows7

Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command-line option in the following scenarios:

-
    -
  • To create a Config.xml file by using the /genconfig option. Using the /targetwindows7 option optimizes the Config.xml file so that it only contains components that relate to Windows 7.

  • -
  • To create a migration store. Using the /targetwindows7 option ensures that the ScanState tool gathers the correct set of operating system settings. Without the /targetwindows7 command-line option, some settings can be lost during the migration.

  • -

/localonly

Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the /localonly option is not specified, then the ScanState command will copy files from these removable or network drives into the store.

-

Anything that is not considered a fixed drive by the OS will be excluded by /localonly. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see Exclude Files and Settings.

-

The /localonly command-line option includes or excludes data in the migration as identified in the following table:

- ---- - - - - - - - - - - - - - - - - - - - - -
Drive typeBehavior with /localonly

Removable drives such as a USB flash drive

Excluded

Network drives

Excluded

Fixed drives

Included

-

- - +| Command-Line Option | Description | +|-----|-----| +| **/i:**[*Path*]*FileName* | **(include)**

Specifies an .xml file that contains rules that define what user, application, or system state to migrate. You can specify this option multiple times to include all of your .xml files (MigApp.xml, MigDocs.xml, and any custom .xml files that you create). *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* must be located in the current directory. For more information about which files to specify, see the "XML Files" section of the [Frequently Asked Questions](usmt-faq.yml) topic. | +| **/genconfig:**[*Path*]*FileName* | (Generate **Config.xml**)

Generates the optional Config.xml file, but does not create a migration store. To ensure that this file contains every component, application and setting that can be migrated, you should create this file on a source computer that contains all the components, applications, and settings that will be present on the destination computers. In addition, you should specify the other migration .xml files, using the **/i** option, when you specify this option.

After you create this file, you will need to make use of it with the **ScanState** command using the **/config** option.

The only options that you can specify with this option are the **/i**, **/v**, and **/l** options. You cannot specify *StorePath*, because the **/genconfig** option does not create a store. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* will be created in the current directory.

Examples:
  • The following example creates a Config.xml file in the current directory:
    `scanstate /i:migapp.xml /i:migdocs.xml /genconfig:config.xml /v:13`
| +| **/config:**[*Path*]*FileName* | Specifies the Config.xml file that the **ScanState** command should use to create the store. You cannot use this option more than once on the command line. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* must be located in the current directory.

The following example creates a store using the Config.xml file, MigDocs.xml, and MigApp.xml files:
`scanstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:scan.log`

The following example migrates the files and settings to the destination computer using the **Config.xml**, **MigDocs.xml**, and **MigApp.xml** files:
`loadstate \server\share\migration\mystore /config:config.xml /i:migdocs.xml /i:migapp.xml /v:13 /l:load.log` | +| **/auto:** *path to script files* | This option enables you to specify the location of the default .xml files and then begin the migration. If no path is specified, USMT will reference the directory where the USMT binaries are located. The **/auto** option has the same effect as using the following options: **/i: MigDocs.xml** **/i:MigApp.xml /v:5**. | +| **/genmigxml:** *path to a file* | This option specifies that the **ScanState** command should use the document finder to create and export an .xml file that defines how to migrate all of the files on the computer on which the **ScanState** command is running. | +| **/targetwindows8** | Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 8 or Windows 8.1 instead of Windows 10. You should use this command-line option in the following scenarios:
  • **To create a Config.xml file by using the /genconfig option.** Using the **/targetwindows8** option optimizes the Config.xml file so that it only contains components that relate to Windows 8 or Windows 8.1.
  • **To create a migration store.** Using the **/targetwindows8** option ensures that the ScanState tool gathers the correct set of operating system settings. Without the **/targetwindows8** command-line option, some settings can be lost during the migration.
| +| **/targetwindows7** | Optimizes Scanstate.exe when using USMT 10.0 to migrate a user state to Windows 7 instead of Windows 10. You should use this command-line option in the following scenarios:
  • **To create a Config.xml file by using the /genconfig option.** Using the **/targetwindows7** option optimizes the Config.xml file so that it only contains components that relate to Windows 7.
  • **To create a migration store.** Using the **/targetwindows7** option ensures that the ScanState tool gathers the correct set of operating system settings. Without the **/targetwindows7** command-line option, some settings can be lost during the migration.
| +| **/localonly** | Migrates only files that are stored on the local computer, regardless of the rules in the .xml files that you specify on the command line. You should use this option when you want to exclude the data from removable drives on the source computer, such as USB flash drives (UFDs), some external hard drives, and so on, and when there are network drives mapped on the source computer. If the **/localonly** option is not specified, then the **ScanState** command will copy files from these removable or network drives into the store.

Anything that is not considered a fixed drive by the OS will be excluded by **/localonly**. In some cases large external hard drives are considered fixed drives. These drives can be explicitly excluded from migration by using a custom.xml file. For more information about how to exclude all files on a specific drive, see [Exclude Files and Settings](usmt-exclude-files-and-settings.md).

The **/localonly** command-line option includes or excludes data in the migration as identified in the following:
  • **Removable drives such as a USB flash drive** - Excluded
  • **Network drives** - Excluded
  • **Fixed drives** - Included
| ## Monitoring Options - USMT provides several options that you can use to analyze problems that occur during migration. -> [!NOTE] +> [!NOTE] > The ScanState log is created by default, but you can specify the name and location of the log with the **/l** option. - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

/listfiles:<FileName>

You can use the /listfiles command-line option with the ScanState command to generate a text file that lists all of the files included in the migration.

/l:[Path]FileName

Specifies the location and name of the ScanState log.

-

You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then the log will be created in the current directory. You can use the /v option to adjust the amount of output.

-

If you run the ScanState or LoadState commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /l: scan.log command.

/v:<VerbosityLevel>

(Verbosity)

-

Enables verbose output in the ScanState log file. The default value is 0.

-

You can set the VerbosityLevel to one of the following levels:

- ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
LevelExplanation

0

Only the default errors and warnings are enabled.

1

Enables verbose output.

4

Enables error and status output.

5

Enables verbose and status output.

8

Enables error output to a debugger.

9

Enables verbose output to a debugger.

12

Enables error and status output to a debugger.

13

Enables verbose, status, and debugger output.

-

-

For example:

-

scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml

-

/progress:[Path</em>]FileName

Creates the optional progress log. You cannot store any of the log files in StorePath. Path can be either a relative or full path. If you do not specify the Path variable, then FileName will be created in the current directory.

-

For example:

-

scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log

/c

When this option is specified, the ScanState command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the ScanState command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the /c option, the ScanState command will exit on the first error.

-

You can use the new <ErrorControl> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /c command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /genconfig option now generates a sample <ErrorControl> section that is enabled by specifying error messages and desired behaviors in the Config.xml file.

/r:<TimesToRetry>

(Retry)

-

Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

-

While storing the user state, the /r option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem.

/w:<SecondsBeforeRetry>

(Wait)

-

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second.

/p:<pathToFile>

When the ScanState command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:

-

Scanstate.exe C:\MigrationLocation [additional parameters]

-

/p:"C:\MigrationStoreSize.xml"

-

For more information, see Estimate Migration Store Size.

-

To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the /p option, without specifying "pathtoafile", in USMT. If you specify only the /p option, the storage space estimations are created in the same manner as with USMT3.x releases.

/? or /help

Displays Help at the command line.

- - +| Command-Line Option | Description | +|-----|-----| +| **/listfiles**:<FileName> | You can use the **/listfiles** command-line option with the **ScanState** command to generate a text file that lists all of the files included in the migration. | +| **/l:**[*Path*]*FileName* | Specifies the location and name of the ScanState log.

You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then the log will be created in the current directory. You can use the **/v** option to adjust the amount of output.

If you run the **ScanState** or **LoadState** commands from a shared network resource, you must specify this option or USMT will fail with the following error: "USMT was unable to create the log file(s)". To fix this issue, use the /**l: scan.log** command. | +| **/v:***<VerbosityLevel>* | **(Verbosity)**

Enables verbose output in the ScanState log file. The default value is 0.

You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.

For example:
`scanstate \server\share\migration\mystore /v:13 /i:migdocs.xml /i:migapp.xml`| +| /**progress**:[*Path*]*FileName* | Creates the optional progress log. You cannot store any of the log files in *StorePath*. *Path* can be either a relative or full path. If you do not specify the *Path* variable, then *FileName* will be created in the current directory.

For example:
`scanstate /i:migapp.xml /i:migdocs.xml \server\share\migration\mystore /progress:prog.log /l:scanlog.log` | +| **/c** | When this option is specified, the **ScanState** command will continue to run, even if non-fatal errors occur. Any files or settings that cause an error are logged in the progress log. For example, if there is a large file that will not fit in the store, the **ScanState** command will log an error and continue with the migration. In addition, if a file is open or in use by an application, USMT may not be able to migrate the file and will log an error. Without the **/c** option, the **ScanState** command will exit on the first error.

You can use the new <**ErrorControl**> section in the Config.xml file to specify which file or registry read/write errors can be safely ignored and which might cause the migration to fail. This enables the /**c** command-line option to safely skip all input/output (I/O) errors in your environment. In addition, the /**genconfig** option now generates a sample <**ErrorControl**> section that is enabled by specifying error messages and desired behaviors in the Config.xml file. | +| **/r:***<TimesToRetry>* | **(Retry)**

Specifies the number of times to retry when an error occurs while saving the user state to a server. The default is three times. This option is useful in environments where network connectivity is not reliable.

While storing the user state, the **/r** option will not be able to recover data that is lost due to a network-hardware failure, such as a faulty or disconnected network cable, or when a virtual private network (VPN) connection fails. The retry option is intended for large, busy networks where connectivity is satisfactory, but communication latency is a problem. | +| **/w:***<SecondsBeforeRetry>* | **(Wait)**

Specifies the time to wait, in seconds, before retrying a network file operation. The default is 1 second. | +| **/p:***<pathToFile>* | When the **ScanState** command runs, it will create an .xml file in the path specified. This .xml file includes improved space estimations for the migration store. The following example shows how to create this .xml file:
`Scanstate.exe C:\MigrationLocation [additional parameters]`
`/p:"C:\MigrationStoreSize.xml"`

For more information, see [Estimate Migration Store Size](usmt-estimate-migration-store-size.md).

To preserve the functionality of existing applications or scripts that require the previous behavior of USMT, you can use the **/p** option, without specifying *"pathtoafile"*, in USMT. If you specify only the **/p** option, the storage space estimations are created in the same manner as with USMT3.x releases. | +| /**?** or /**help** | Displays Help at the command line. | ## User Options - By default, all users are migrated. The only way to specify which users to include and exclude is by using the following options. You cannot exclude users in the migration .xml files or using the Config.xml file. For more information, see [Identify Users](usmt-identify-users.md) and [Migrate User Accounts](usmt-migrate-user-accounts.md). - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionDescription

/all

Migrates all of the users on the computer.

-

USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /ue or /uel options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /all option, you cannot also use the /ui, /ue or /uel options.

/ui:<DomainName>\<UserName>

-

or

-

/ui:<ComputerName>\<LocalUserName>

(User include)

-

Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /ue or /uel options. You can specify multiple /ui options, but you cannot use the /ui option with the /all option. DomainName and UserName can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.

-
-Note

If a user is specified for inclusion with the /ui option, and also is specified to be excluded with either the /ue or /uel options, the user will be included in the migration.

-
-
- -
-

For example:

-
    -

    To include only User2 from the Fabrikam domain, type:

    -

    /ue:*\* /ui:fabrikam\user2

    -

    To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:

    -

    /uel:30 /ui:fabrikam\*

    -

    In this example, a user account from the Contoso domain that was last modified two months ago will not be migrated.

    -
-

For more examples, see the descriptions of the /ue and /ui options in this table.

/uel:<NumberOfDays>

-

or

-

/uel:<YYYY/MM/DD>

-

or

-

/uel:0

(User exclude based on last logon)

-

Migrates the users that logged on to the source computer within the specified time period, based on the Last Modified date of the Ntuser.dat file on the source computer. The /uel option acts as an include rule. For example, the /uel:30 option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

-

You can specify a number of days or you can specify a date. You cannot use this option with the /all option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged on to another computer, that logon instance is not considered by USMT.

-
-Note

The /uel option is not valid in offline migrations.

-
-
- -
-
    -
  • /uel:0 migrates any users who are currently logged on.

  • -
  • /uel:90 migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.

  • -
  • /uel:1 migrates users whose account has been modified within the last 24 hours.

  • -
  • /uel:2002/1/15 migrates users who have logged on or been modified January 15, 2002 or afterwards.

  • -
-

For example:

-

scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0

/ue:<DomainName>\<UserName>

-

-or-

-

-

/ue:<ComputerName>\<LocalUserName>

(User exclude)

-

Excludes the specified users from the migration. You can specify multiple /ue options. You cannot use this option with the /all option. <DomainName> and <UserName> can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

-

For example:

-

scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1

- - +| Command-Line Option | Description | +|-----|-----| +| /**all** | Migrates all of the users on the computer.

USMT migrates all user accounts on the computer, unless you specifically exclude an account with either the /**ue** or /**uel** options. For this reason, you do not need to specify this option on the command line. However, if you choose to specify the /**all** option, you cannot also use the /**ui**, /**ue** or /**uel** options. | +| /**ui**:*<DomainName>*\*<UserName>*
or
/**ui**:*<ComputerName>*\*<LocalUserName>* | **(User include)**

Migrates the specified users. By default, all users are included in the migration. Therefore, this option is helpful only when used with the /**ue** or /**uel** options. You can specify multiple /**ui** options, but you cannot use the /**ui** option with the /**all** option. *DomainName* and *UserName* can contain the asterisk () wildcard character. When you specify a user name that contains spaces, you will need to surround it with quotation marks.
**Note**
If a user is specified for inclusion with the /**ui** option, and also is specified to be excluded with either the /**ue** or /**uel** options, the user will be included in the migration.

For example:
  • To include only User2 from the Fabrikam domain, type:
    `/ue:*\* /ui:fabrikam\user2`
  • To migrate all users from the Fabrikam domain, and only the user accounts from other domains that have been active or otherwise modified in the last 30 days, type:
    `/uel:30 /ui:fabrikam\*`
    In this example, a user account from the Contoso domain that was last modified two months ago will not be migrated.

For more examples, see the descriptions of the /**ue** and /**ui** options in this table. | +| /**uel**:*<NumberOfDays>*
or
/**uel**:*<YYYY/MM/DD>*
or
**/uel:0** | **(User exclude based on last logon)**

Migrates the users that logged on to the source computer within the specified time period, based on the **Last Modified** date of the Ntuser.dat file on the source computer. The /**uel** option acts as an include rule. For example, the **/uel:30** option migrates users who logged on, or whose account was modified, within the last 30 days from the date when the ScanState command is run.

You can specify a number of days or you can specify a date. You cannot use this option with the /**all** option. USMT retrieves the last logon information from the local computer, so the computer does not need to be connected to the network when you run this option. In addition, if a domain user has logged on to another computer, that logon instance is not considered by USMT.
**Note**
The /**uel** option is not valid in offline migrations.
  • **/uel:0** migrates any users who are currently logged on.
  • **/uel:90** migrates users who have logged on, or whose accounts have been otherwise modified, within the last 90 days.
  • **/uel:1** migrates users whose account has been modified within the last 24 hours.
  • **/uel:2002/1/15** migrates users who have logged on or been modified January 15, 2002 or afterwards.

For example:
`scanstate /i:migapp.xml /i:migdocs.xml \\server\share\migration\mystore /uel:0` | +| /**ue**:*<DomainName>*\*<UserName>*
-or-

/**ue**:*<ComputerName>*\*<LocalUserName>* | **(User exclude)**

Excludes the specified users from the migration. You can specify multiple /**ue** options. You cannot use this option with the /**all** option. *<DomainName>* and *<UserName>* can contain the asterisk (
) wildcard character. When you specify a user name that contains spaces, you need to surround it with quotation marks.

For example:
`scanstate /i:migdocs.xml /i:migapp.xml \\server\share\migration\mystore /ue:contoso\user1` | ## How to Use /ui and /ue - The following examples apply to both the /**ui** and /**ue** options. You can replace the /**ue** option with the /**ui** option to include, rather than exclude, the specified users. - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
BehaviorCommand

Exclude the user named User One in the Fabrikam domain.

/ue:"fabrikam\user one"

Exclude the user named User1 in the Fabrikam domain.

/ue:fabrikam\user1

Exclude the local user named User1.

/ue:%computername%\user1

Exclude all domain users.

/ue:Domain\*

Exclude all local users.

/ue:%computername%\*

Exclude users in all domains named User1, User2, and so on.

/ue:*\user*

- - +|Behavior|Command| +|--- |--- | +|Exclude the user named User One in the Fabrikam domain.|`/ue:"fabrikam\user one"`| +|Exclude the user named User1 in the Fabrikam domain.|`/ue:fabrikam\user1`| +|Exclude the local user named User1.|`/ue:%computername%\user1`| +|Exclude all domain users.|`/ue:Domain\*`| +|Exclude all local users.|`/ue:%computername%\*`| +|Exclude users in all domains named User1, User2, and so on.|`/ue:*\user*`| ## Using the Options Together - You can use the /**uel**, /**ue** and /**ui** options together to migrate only the users that you want migrated. The /**ui** option has precedence over the /**ue** and /**uel** options. If a user is specified to be included using the /**ui** option, and also specified to be excluded using either the /**ue** or /**uel** options, the user will be included in the migration. For example, if you specify `/ui:contoso\* /ue:contoso\user1`, then User1 will be migrated, because the /**ui** option takes precedence over the /**ue** option. The /**uel** option takes precedence over the /**ue** option. If a user has logged on within the specified time period set by the /**uel** option, that user’s profile will be migrated even if they are excluded by using the /**ue** option. For example, if you specify `/ue:fixed\user1 /uel:14`, the User1 will be migrated if they have logged on to the computer within the last 14 days. - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
BehaviorCommand

Include only User2 from the Fabrikam domain and exclude all other users.

/ue:*\* /ui:fabrikam\user2

Include only the local user named User1 and exclude all other users.

/ue:*\* /ui:user1

Include only the domain users from Contoso, except Contoso\User1.

This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:

-
    -
  • On the ScanState command line, type: /ue:*\* /ui:contoso\*

  • -
  • On the LoadState command line, type: /ue:contoso\user1

  • -

Include only local (non-domain) users.

/ue:*\* /ui:%computername%\*

- - +|Behavior|Command| +|--- |--- | +|Include only User2 from the Fabrikam domain and exclude all other users.|`/ue:*\* /ui:fabrikam\user2`| +|Include only the local user named User1 and exclude all other users.|`/ue:*\* /ui:user1`| +|Include only the domain users from Contoso, except Contoso\User1.|This behavior cannot be completed using a single command. Instead, to migrate this set of users, you will need to specify the following:
  • On the **ScanState** command line, type: `/ue:*\* /ui:contoso\*`
  • On the **LoadState** command line, type: `/ue:contoso\user1`
| +|Include only local (non-domain) users.|`/ue:*\* /ui:%computername%\*`| ## Encrypted File Options - You can use the following options to migrate encrypted files. In all cases, by default, USMT fails if an encrypted file is found unless you specify an /**efs** option. To migrate encrypted files, you must change the default behavior. For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md). @@ -618,245 +196,49 @@ For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs- > [!NOTE] > EFS certificates will be migrated automatically when migrating to Windows 7, Windows 8 or Windows 10. Therefore, you should specify the /**efs:copyraw** option with the **ScanState** command to migrate the encrypted files - > [!CAUTION] > Take caution when migrating encrypted files. If you migrate an encrypted file without also migrating the certificate, end users will not be able to access the file after the migration. - - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line OptionExplanation

/efs:hardlink

Creates a hard link to the EFS file instead of copying it. Use only with the /hardlink and the /nocompress options.

/efs:abort

Causes the ScanState command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default.

/efs:skip

Causes the ScanState command to ignore EFS files.

/efs:decryptcopy

Causes the ScanState command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the ScanState command succeeds, the file will be unencrypted in the migration store, and once you run the LoadState command, the file will be copied to the destination computer.

/efs:copyraw

Causes the ScanState command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an /efs option. Therefore you should specify the /efs:copyraw option with the ScanState command to migrate the encrypted file. Then, when you run the LoadState command, the encrypted file and the EFS certificate will be automatically migrated.

-

For example:

-

ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw

-
-Important

All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see Migrate EFS Files and Certificates.

-
-
- -
- - +| Command-Line Option | Explanation | +|----|----| +| **/efs:hardlink** | Creates a hard link to the EFS file instead of copying it. Use only with the **/hardlink** and the **/nocompress** options. | +| **/efs:abort** | Causes the **ScanState** command to fail with an error code, if an Encrypting File System (EFS) file is found on the source computer. Enabled by default. | +| **/efs:skip** | Causes the **ScanState** command to ignore EFS files. | +| /**efs:decryptcopy** | Causes the **ScanState** command to decrypt the file, if possible, before saving it to the migration store, and to fail if the file cannot be decrypted. If the **ScanState** command succeeds, the file will be unencrypted in the migration store, and once you run the **LoadState** command, the file will be copied to the destination computer. | +| **/efs:copyraw** | Causes the **ScanState** command to copy the files in the encrypted format. The files will be inaccessible on the destination computer until the EFS certificates are migrated. EFS certificates will be automatically migrated; however, by default USMT fails if an encrypted file is found, unless you specify an **/efs** option. Therefore you should specify the **/efs:copyraw** option with the **ScanState** command to migrate the encrypted file. Then, when you run the **LoadState** command, the encrypted file and the EFS certificate will be automatically migrated.

For example:
`ScanState /i:migdocs.xml /i:migapp.xml \server\share\migration\mystore /efs:copyraw`
**Important**
All files must be encrypted if the parent folder is encrypted. If the encryption attribute on a file inside an encrypted folder has been removed, the file will be encrypted during the migration using the credentials of the account used to run the LoadState tool. For more information, see [Migrate EFS Files and Certificates](usmt-migrate-efs-files-and-certificates.md).
| ## Incompatible Command-Line Options - The following table indicates which command-line options are not compatible with the **ScanState** command. If the table entry for a particular combination is blank, the options are compatible and you can use them together. The X symbol means that the options are not compatible. For example, you cannot use the **/nocompress** option with the **/encrypt** option. - ------- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-Line Option/keyfile/nocompress/genconfig/all

/i

/o

/v

/nocompress

N/A

/localonly

X

/key

X

X

/encrypt

Required*

X

X

/keyfile

N/A

X

/l

/progress

X

/r

X

/w

X

/c

X

/p

X

N/A

/all

X

/ui

X

X

/ue

X

X

/uel

X

X

/efs:<option>

X

/genconfig

N/A

/config

X

<StorePath>

X

- +|Command-Line Option|/keyfile|/nocompress|/genconfig|/all| +|--- |--- |--- |--- |--- | +|**/i**||||| +|**/o**||||| +|**/v**||||| +|/**nocompress**||||N/A| +|/**localonly**|||X|| +|/**key**|X||X|| +|/**encrypt**|Required*|X|X|| +|/**keyfile**|N/A||X|| +|/**l**||||| +|/**progress**|||X|| +|/**r**|||X|| +|/**w**|||X|| +|/**c**|||X|| +|/**p**|||X|N/A| +|/**all**|||X|| +|/**ui**|||X|X| +|/**ue**|||X|X| +|/**uel**|||X|X| +|/**efs**:*<option>*|||X|| +|/**genconfig**|||N/A|| +|/**config**|||X|| +|*<StorePath>*|||X|| > [!NOTE] > You must specify either the /**key** or /**keyfile** option with the /**encrypt** option. - - ## Related topics - [XML Elements Library](usmt-xml-elements-library.md) - diff --git a/windows/deployment/usmt/usmt-troubleshooting.md b/windows/deployment/usmt/usmt-troubleshooting.md index 1a2fbc4401..7a4bedbd54 100644 --- a/windows/deployment/usmt/usmt-troubleshooting.md +++ b/windows/deployment/usmt/usmt-troubleshooting.md @@ -16,46 +16,20 @@ ms.topic: article # User State Migration Tool (USMT) Troubleshooting - The following table describes topics that address common User State Migration Tool (USMT) 10.0 issues and questions. These topics describe tools that you can use to troubleshoot issues that arise during your migration. ## In This Section - - ---- - - - - - - - - - - - - - - - - - - - - - - -

Common Issues

Find troubleshooting solutions for common problems in USMT.

Frequently Asked Questions

Find answers to questions about how to use USMT.

Log Files

Learn how to enable logging to help you troubleshoot issues in USMT.

Return Codes

Learn how to use return codes to identify problems in USMT.

USMT Resources

Find more information and support for using USMT.

- - +| Link | Description | +|--- |--- | +|[Common Issues](usmt-common-issues.md)|Find troubleshooting solutions for common problems in USMT.| +|[Frequently Asked Questions](usmt-faq.yml)|Find answers to questions about how to use USMT.| +|[Log Files](usmt-log-files.md)|Learn how to enable logging to help you troubleshoot issues in USMT.| +|[Return Codes](usmt-return-codes.md)|Learn how to use return codes to identify problems in USMT.| +|[USMT Resources](usmt-resources.md)|Find more information and support for using USMT.| ## Related topics - [USMT Best Practices](usmt-best-practices.md) [User State Migration Tool (USMT) Overview Topics](usmt-topics.md) @@ -63,12 +37,3 @@ The following table describes topics that address common User State Migration To [User State Migration Tool (USMT) How-to topics](usmt-how-to.md) [User State Migration Toolkit (USMT) Reference](usmt-reference.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-utilities.md b/windows/deployment/usmt/usmt-utilities.md index d87666c8b6..0824d0f77f 100644 --- a/windows/deployment/usmt/usmt-utilities.md +++ b/windows/deployment/usmt/usmt-utilities.md @@ -16,7 +16,6 @@ ms.topic: article # UsmtUtils Syntax - This topic describes the syntax for the utilities available in User State Migration Tool (USMT) 10.0 through the command-line interface. These utilities: - Improve your ability to determine cryptographic options for your migration. @@ -29,7 +28,6 @@ This topic describes the syntax for the utilities available in User State Migrat ## In This Topic - [Usmtutils.exe](#bkmk-usmtutils-exe) [Verify Options](#bkmk-verifyoptions) @@ -38,162 +36,34 @@ This topic describes the syntax for the utilities available in User State Migrat ## Usmtutils.exe - The following table lists command-line options for USMTutils.exe. The sections that follow provide further command-line options for the **/verify** and the **/extract** options. The syntax for UsmtUtils.exe is: usmtutils \[/ec | /rd *<storeDir>* | /verify *<filepath>* \[options\] | /extract *<filepath>* *<destinationPath>* \[options\]\] - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-line OptionDescription

/ec

Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the /encrypt command before you run the ScanState tool on the source computer.

/rd<storeDir>

Removes the directory path specified by the <storeDir> argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

-

For example:

-

usmtutils /rd D:\MyHardLinkStore

/y

Overrides the accept deletions prompt when used with the /rd option. When you use the /y option with the /rd option, you will not be prompted to accept the deletions before USMT deletes the directories.

/verify

Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

-

See Verify Options for syntax and options to use with /verify.

/extract

Recovers files from a compressed USMT migration store.

-

See Extract Options for syntax and options to use with /extract.

- - +|Command-line Option|Description| +|--- |--- | +|**/ec**|Returns a list of supported cryptographic algorithms (AlgIDs) on the current system. You can use this on a destination computer to determine which algorithm to use with the **/encrypt** command before you run the ScanState tool on the source computer.| +|**/rd** *<storeDir>* |Removes the directory path specified by the *<storeDir>* argument on the computer. You can use this command to delete hard-link migration stores that cannot otherwise be deleted at a command prompt due to a sharing lock. If the migration store spans multiple volumes on a given drive, it will be deleted from all of these volumes.

For example:
`usmtutils /rd D:\MyHardLinkStore`| +|**/y**|Overrides the accept deletions prompt when used with the **/rd** option. When you use the **/y** option with the **/rd** option, you will not be prompted to accept the deletions before USMT deletes the directories.| +|**/verify**|Returns information on whether the compressed migration store is intact or whether it contains corrupted files or a corrupted catalog.

See [Verify Options](#bkmk-verifyoptions) for syntax and options to use with **/verify**.| +|**/extract**|Recovers files from a compressed USMT migration store.

See [Extract Options](#bkmk-extractoptions) for syntax and options to use with **/extract**.| ## Verify Options - Use the **/verify** option when you want to determine whether a compressed migration store is intact or whether it contains corrupted files or a corrupted catalog. For more information on how to use the **/verify** option, see [Verify the Condition of a Compressed Migration Store](verify-the-condition-of-a-compressed-migration-store.md). The syntax for **/verify** is: usmtutils /verify\[:*<reportType>*\] *<filePath>* \[/l:*<logfile>*\] \[/v:*VerbosityLevel*\] \[/decrypt \[:*<AlgID>*\] {/key:*<keystring>* | /keyfile:*<filename>*}\] - ---- - - - - - - - - - - - - - - - - - - - - - - - - -
Command-line OptionDescription

<reportType>

Specifies whether to report on all files, corrupted files only, or the status of the catalog.

-
    -
  • Summary. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.

  • -
  • all. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.

  • -
  • failureonly. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.

  • -
  • Catalog. Returns only the status of the catalog file.

  • -
/l: -

<logfilePath>

Specifies the location and name of the log file.

/v:<VerbosityLevel>

(Verbosity)

-

Enables verbose output in the UsmtUtils log file. The default value is 0.

-

You can set the VerbosityLevel to one of the following levels:

- ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
LevelExplanation

0

Only the default errors and warnings are enabled.

1

Enables verbose output.

4

Enables error and status output.

5

Enables verbose and status output.

8

Enables error output to a debugger.

9

Enables verbose output to a debugger.

12

Enables error and status output to a debugger.

13

Enables verbose, status, and debugger output.

-

 

/decrypt<AlgID>/:<KeyString>

-

or

-

/decrypt<AlgID>/:<“Key String”>

-

or

-

/decrypt:<AlgID>/keyfile:<FileName>

Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a /key or /keyfile option as follows:

-
    -
  • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

    -

    <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

  • -
  • /key:<KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

  • -
  • /keyfile: <FileName> specifies the location and name of a text (.txt) file that contains the encryption key.

  • -
-

For more information about supported encryption algorithms, see Migration Store Encryption

- - +| Command-line Option | Description | +|-----|--------| +| *<reportType>* | Specifies whether to report on all files, corrupted files only, or the status of the catalog.
  • **Summary**. Returns both the number of files that are intact and the number of files that are corrupted in the migration store. If no algorithm is specified, the summary report is displayed as a default.
  • **all**. Returns a tab-delimited list of all of the files in the compressed migration store and the status for each file. Each line contains the file name followed by a tab spacing, and either “CORRUPTED” or “OK” depending on the status of the file. The last entry reports the corruption status of the "CATALOG" of the store. A catalog file contains metadata for all files in a migration store. The LoadState tool requires a valid catalog file in order to open the migration store. Returns "OK" if the catalog file is intact and LoadState can open the migration store and "CORRUPTED" if the migration store is corrupted.
  • **failureonly**. Returns a tab-delimited list of only the files that are corrupted in the compressed migration store.
  • **Catalog**. Returns only the status of the catalog file.
| +| **/l:**
*<logfilePath>* | Specifies the location and name of the log file. | +| **/v:** *<VerbosityLevel>* | **(Verbosity)**

Enables verbose output in the UsmtUtils log file. The default value is 0.

You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.
| +| **/decrypt** *<AlgID>* **/**:*<KeyString>*
or
**/decrypt** *<AlgID>* **/**:*<“Key String”>*
or
**/decrypt:** *<AlgID>* **/keyfile**:*<FileName>* | Specifies that the **/encrypt** option was used to create the migration store with the ScanState tool. To decrypt the migration store, specify a **/key** or **/keyfile** option as follows:
  • *<AlgID>* specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.
    *<AlgID>* valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.
  • **/key:** *<KeyString>* specifies the encryption key. If there is a space in *<KeyString>*, you must surround the argument with quotation marks.
  • **/keyfile**: *<FileName>* specifies the location and name of a text (.txt) file that contains the encryption key.

For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md) | Some examples of **/verify** commands: @@ -214,116 +84,16 @@ The syntax for **/extract** is: /extract *<filePath>* *<destinationPath>* \[/i:*<includePattern>*\] \[/e: *<excludePattern>*\] \[/l: *<logfile>*\] \[/v: *VerbosityLevel>*\] \[/decrypt\[:*<AlgID>*\] {key: *<keystring>* | /keyfile: *<filename>*}\] \[/o\] - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Command-line OptionDescription

<filePath>

Path to the USMT migration store.

-

For example:

-

D:\MyMigrationStore\USMT\store.mig

<destinationPath>

Path to the folder where the tool puts the individual files.

/i:<includePattern>

Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

/e:<excludePattern>

Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use /i: <includePattern> and /e: <excludePattern> options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns.

/l:<logfilePath>

Specifies the location and name of the log file.

/v:<VerbosityLevel>

(Verbosity)

-

Enables verbose output in the UsmtUtils log file. The default value is 0.

-

You can set the VerbosityLevel to one of the following levels:

- ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
LevelExplanation

0

Only the default errors and warnings are enabled.

1

Enables verbose output.

4

Enables error and status output.

5

Enables verbose and status output.

8

Enables error output to a debugger.

9

Enables verbose output to a debugger.

12

Enables error and status output to a debugger.

13

Enables verbose, status, and debugger output.

-

 

/decrypt<AlgID>/key:<KeyString>

-

or

-

/decrypt<AlgID>/:<“Key String”>

-

or

-

/decrypt:<AlgID>/keyfile:<FileName>

Specifies that the /encrypt option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a /key or /keyfile option as follows:

-
    -
  • <AlgID> specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.

    -

    <AlgID> valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.

  • -
  • /key: <KeyString> specifies the encryption key. If there is a space in <KeyString>, you must surround the argument with quotation marks.

  • -
  • /keyfile:<FileName> specifies a text (.txt) file that contains the encryption key

  • -
-

For more information about supported encryption algorithms, see Migration Store Encryption.

/o

Overwrites existing output files.

- - +| Command-line Option | Description | +|-------|-----| +| *<filePath>* | Path to the USMT migration store.

For example:
`D:\MyMigrationStore\USMT\store.mig` | +| *<destinationPath>* | Path to the folder where the tool puts the individual files. | +| **/i**:*<includePattern>* | Specifies a pattern for files to include in the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use **/i**: *<includePattern>* and **/e**: *<excludePattern>* options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. | +| **/e**:*<excludePattern>* | Specifies a pattern for files to omit from the extraction. You can specify more than one pattern. Separate patterns with a comma or a semicolon. You can use **/i**: *<includePattern>* and **/e**: *<excludePattern>* options in the same command. When both include and exclude patterns are used on the command line, include patterns take precedence over exclude patterns. | +| **/l**:*<logfilePath>* | Specifies the location and name of the log file. | +| **/v:***<VerbosityLevel>* | **(Verbosity)**

Enables verbose output in the UsmtUtils log file. The default value is 0.

You can set the *VerbosityLevel* to one of the following levels:
  • **0** - Only the default errors and warnings are enabled.
  • **1** - Enables verbose output.
  • **4** - Enables error and status output.
  • **5** - Enables verbose and status output.
  • **8** - Enables error output to a debugger.
  • **9** - Enables verbose output to a debugger.
  • **12** - Enables error and status output to a debugger.
  • **13** - Enables verbose, status, and debugger output.
| +| **/decrypt***<AlgID>***/key**:*<KeyString>*
or
**/decrypt***<AlgID>***/**:*<“Key String”>*
or
**/decrypt:***<AlgID>***/keyfile**:*<FileName>* | Specifies that the **/encrypt** option was used to create the migration store with the ScanState tool. To decrypt the migration store, you must also specify a **/key** or **/keyfile** option as follows:
  • *<AlgID>* specifies the cryptographic algorithm that was used to create the migration store on the ScanState command line. If no algorithm is specified, ScanState and UsmtUtils use the 3DES algorithm as a default.
    *<AlgID>* valid values include: AES_128, AES_192, AES_256, 3DES, or 3DES_112.
  • **/key**: *<KeyString>* specifies the encryption key. If there is a space in *<KeyString>*, you must surround the argument with quotation marks.
  • **/keyfile**:*<FileName>* specifies a text (.txt) file that contains the encryption key

For more information about supported encryption algorithms, see [Migration Store Encryption](usmt-migration-store-encryption.md). | +| **/o** | Overwrites existing output files. | Some examples of **/extract** commands: @@ -337,16 +107,6 @@ Some examples of **/extract** commands: ## Related topics - [User State Migration Tool (USMT) Command-line Syntax](usmt-command-line-syntax.md) [Return Codes](usmt-return-codes.md) - - - - - - - - - diff --git a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md index c9c2d3cd28..c8660b4b6d 100644 --- a/windows/deployment/usmt/usmt-what-does-usmt-migrate.md +++ b/windows/deployment/usmt/usmt-what-does-usmt-migrate.md @@ -16,10 +16,8 @@ ms.topic: article # What does USMT migrate? - ## In this topic - - [Default migration scripts](#bkmk-defaultmigscripts) - [User Data](#bkmk-3) @@ -32,7 +30,6 @@ ms.topic: article ## Default migration scripts - The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer can precisely define migrations using the USMT .xml scripting language. USMT provides the following sample scripts: - **MigApp.XML.** Rules to migrate application settings. @@ -41,25 +38,23 @@ The User State Migration Tool (USMT) 10.0 is designed so that an IT engineer ca - **MigUser.XML.** Rules to migrate user profiles and user data. - MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. + MigUser.xml gathers everything in a user’s profile and then does a file extension- based search of most of the system for other user data. If data doesn’t match either of these criteria, the data won’t be migrated. For the most part, this file describes a "core" migration. - The following data does not migrate with MigUser.xml: + The following data does not migrate with MigUser.xml: - - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. - - - Access control lists (ACLs) for folders outside the user profile. + - Files outside the user profile that don’t match one of the file extensions in MigUser.xml. + - Access control lists (ACLs) for folders outside the user profile. ## User data - This section describes the user data that USMT migrates by default, using the MigUser.xml file. It also defines how to migrate ACLs. - **Folders from each user profile.** When you specify the MigUser.xml file, USMT migrates everything in a user’s profiles including the following: - My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. + My Documents, My Video, My Music, My Pictures, desktop files, Start menu, Quick Launch settings, and Favorites. - >[!IMPORTANT] - >Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](./usmt-common-issues.md#usmt-does-not-migrate-the-start-layout). + > [!IMPORTANT] + > Starting in Windows 10, version 1607 the USMT does not migrate the Start menu layout. To migrate a user's Start menu, you must export and then import settings using the Windows PowerShell cmdlets **Export-StartLayout** and **Import-StartLayout**. For more information, see [USMT common issues](./usmt-common-issues.md#usmt-does-not-migrate-the-start-layout). - **Folders from the All Users and Public profiles.** When you specify the MigUser.xml file, USMT also migrates the following from the **All Users** profile in Windows® XP, or the **Public** profile in Windows Vista, Windows 7, or Windows 8: @@ -77,25 +72,20 @@ This section describes the user data that USMT migrates by default, using the Mi - Shared Favorites -- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects and then migrates files with any of the following file extensions: +- **File types.** When you specify the MigUser.xml file, the ScanState tool searches the fixed drives, collects, and then migrates files with any of the following file extensions: - **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** + **.accdb, .ch3, .csv, .dif, .doc\*, .dot\*, .dqy, .iqy, .mcw, .mdb\*, .mpp, .one\*, .oqy, .or6, .pot\*, .ppa, .pps\*, .ppt\*, .pre, .pst, .pub, .qdf, .qel, .qph, .qsd, .rqy, .rtf, .scd, .sh3, .slk, .txt, .vl\*, .vsd, .wk\*, .wpd, .wps, .wq1, .wri, .xl\*, .xla, .xlb, .xls\*.** - **Note**   - The asterisk (\*) stands for zero or more characters. - - + > [!NOTE] + > The asterisk (\*) stands for zero or more characters. - **Access control lists.** USMT migrates ACLs for specified files and folders from computers running both Windows® XP and Windows Vista. For example, if you migrate a file named File1.txt that is read-only for User1 and read/write for User2, these settings will still apply on the destination computer after the migration. -**Important**   -To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. - - +> [!IMPORTANT] +> To migrate ACLs, you must specify the directory to migrate in the MigUser.xml file. Using file patterns like \*.doc will not migrate a directory. The source ACL information is migrated only when you explicitly specify the directory. For example, `c:\test docs`. ## Operating-system components - USMT migrates operating-system components to a destination computer from computers running Windows 7 and Windows 8 The following components are migrated by default using the manifest files: @@ -150,229 +140,72 @@ The following components are migrated by default using the manifest files: \* These settings are not available for an offline migration. For more information, see [Offline Migration Reference](offline-migration-reference.md). -**Important**   -This list may not be complete. There may be additional components that are migrated. +> [!IMPORTANT] +> This list may not be complete. There may be additional components that are migrated. - - -**Note**   -Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. - - +> [!NOTE] +> Some settings, such as fonts, are not applied by the LoadState tool until after the destination computer has been restarted. For this reason, restart the destination computer after you run the LoadState tool. ## Supported applications - Although it is not required for all applications, it is good practice to install all applications on the destination computer before restoring the user state. Installing applications before migrating settings helps to ensure that the migrated settings are not overwritten by the application installers. -**Note**   -The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. - - - -**Note**   -USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. - - +> [!NOTE] +> +> - The versions of installed applications must match on the source and destination computers. USMT does not support migrating the settings of an earlier version of an application to a later version, except for Microsoft Office. +> - USMT migrates only the settings that have been used or modified by the user. If there is an application setting on the source computer that was not touched by the user, the setting may not migrate. When you specify the MigApp.xml file, USMT migrates the settings for the following applications: - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
ProductVersion

Adobe Acrobat Reader

9

AOL Instant Messenger

6.8

Adobe Creative Suite

2

Adobe Photoshop CS

8, 9

Adobe ImageReady CS

Apple iTunes

6, 7, 8

Apple QuickTime Player

5, 6, 7

Apple Safari

3.1.2

Google Chrome

beta

Google Picasa

3

Google Talk

beta

IBM Lotus 1-2-3

9

IBM Lotus Notes

6,7, 8

IBM Lotus Organizer

5

IBM Lotus WordPro

9.9

Intuit Quicken Deluxe

2009

Money Plus Business

2008

Money Plus Home

2008

Mozilla Firefox

3

Microsoft Office

2003, 2007, 2010

Microsoft Office Access®

2003, 2007, 2010

Microsoft Office Excel®

2003, 2007, 2010

Microsoft Office FrontPage®

2003, 2007, 2010

Microsoft Office OneNote®

2003, 2007, 2010

Microsoft Office Outlook®

2003, 2007, 2010

Microsoft Office PowerPoint®

2003, 2007, 2010

Microsoft Office Publisher

2003, 2007, 2010

Microsoft Office Word

2003, 2007, 2010

Opera Software Opera

9.5

Microsoft Outlook Express

(only mailbox file)

Microsoft Project

2003, 2007

Microsoft Office Visio®

2003, 2007

RealPlayer Basic

11

Sage Peachtree

2009

Skype

3.8

Windows Live Mail

12, 14

Windows Live Messenger

8.5, 14

Windows Live MovieMaker

14

Windows Live Photo Gallery

12, 14

Windows Live Writer

12, 14

Windows Mail

(Windows 7 and 8)

Microsoft Works

9

Yahoo Messenger

9

Microsoft Zune™ Software

3

- - +|Product|Version| +|--- |--- | +|Adobe Acrobat Reader|9| +|AOL Instant Messenger|6.8| +|Adobe Creative Suite|2| +|Adobe Photoshop CS|8, 9| +|Adobe ImageReady CS|| +|Apple iTunes|6, 7, 8| +|Apple QuickTime Player|5, 6, 7| +|Apple Safari|3.1.2| +|Google Chrome|beta| +|Google Picasa|3| +|Google Talk|beta| +|IBM Lotus 1-2-3|9| +|IBM Lotus Notes|6,7, 8| +|IBM Lotus Organizer|5| +|IBM Lotus WordPro|9.9| +|Intuit Quicken Deluxe|2009| +|Money Plus Business|2008| +|Money Plus Home|2008| +|Mozilla Firefox|3| +|Microsoft Office|2003, 2007, 2010| +|Microsoft Office Access®|2003, 2007, 2010| +|Microsoft Office Excel®|2003, 2007, 2010| +|Microsoft Office FrontPage®|2003, 2007, 2010| +|Microsoft Office OneNote®|2003, 2007, 2010| +|Microsoft Office Outlook®|2003, 2007, 2010| +|Microsoft Office PowerPoint®|2003, 2007, 2010| +|Microsoft Office Publisher|2003, 2007, 2010| +|Microsoft Office Word|2003, 2007, 2010| +|Opera Software Opera|9.5| +|Microsoft Outlook Express|(only mailbox file)| +|Microsoft Project|2003, 2007| +|Microsoft Office Visio®|2003, 2007| +|RealPlayer Basic|11| +|Sage Peachtree|2009| +|Skype|3.8| +|Windows Live Mail|12, 14| +|Windows Live Messenger|8.5, 14| +|Windows Live MovieMaker|14| +|Windows Live Photo Gallery|12, 14| +|Windows Live Writer|12, 14| +|Windows Mail|(Windows 7 and 8)| +|Microsoft Works|9| +|Yahoo Messenger|9| +|Microsoft Zune™ Software|3| ## What USMT does not migrate - The following is a list of the settings that USMT does not migrate. If you are having a problem that is not listed here, see [Common Issues](usmt-common-issues.md). ### Application settings @@ -417,8 +250,4 @@ Starting in Windows 10, version 1607 the USMT does not migrate the Start menu la ## Related topics - [Plan your migration](usmt-plan-your-migration.md) - - - diff --git a/windows/deployment/usmt/usmt-xml-elements-library.md b/windows/deployment/usmt/usmt-xml-elements-library.md index c97dfbadb0..7077db2d80 100644 --- a/windows/deployment/usmt/usmt-xml-elements-library.md +++ b/windows/deployment/usmt/usmt-xml-elements-library.md @@ -16,13 +16,10 @@ ms.topic: article # XML Elements Library - - -This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. . +This topic describes the XML elements and helper functions that you can employ to author migration .xml files to use with User State Migration Tool (USMT). It is assumed that you understand the basics of XML. ## In this topic - In addition to XML elements and helper functions, this topic describes how to specify encoded locations and locations patterns, functions that are for internal USMT use only, and the version tags that you can use with helper functions. - [Elements and helper functions](#elements) @@ -37,88 +34,14 @@ In addition to XML elements and helper functions, this topic describes how to sp ## Elements and Helper Functions - The following table describes the XML elements and helper functions you can use with USMT. - ----- - - - - - - - - - - - - - - -
Elements A-KElements L-ZHelper functions

<addObjects>

-

<attributes>

-

<bytes>

-

<commandLine>

-

<component>

-

<condition>

-

<conditions>

-

<content>

-

<contentModify>

-

<description>

-

<destinationCleanup>

-

<detect>

-

<detects>

-

<detection>

-

<displayName>

-

<environment>

-

<exclude>

-

<excludeAttributes>

-

<extensions>

-

<extension>

-

<externalProcess>

-

<icon>

-

<include>

-

<includeAttribute>

<library>

-

<location>

-

<locationModify>

-

<_locDefinition>

-

<manufacturer>

-

<merge>

-

<migration>

-

<namedElements>

-

<object>

-

<objectSet>

-

<path>

-

<paths>

-

<pattern>

-

<processing>

-

<plugin>

-

<role>

-

<rules>

-

<script>

-

<text>

-

<unconditionalExclude>

-

<variable>

-

<version>

-

<windowsObjects>

<condition> functions

-

<content> functions

-

<contentModify> functions

-

<include> and <exclude> filter functions

-

<locationModify> functions

-

<merge> functions

-

<script> functions

-

Internal USMT functions

- - +| Elements A-K | Elements L-Z | Helper functions | +|-----|----|-----| +| [<addObjects>](#addobjects)
[<attributes>](#attribute)
[<bytes>](#bytes)
[<commandLine>](#commandline)
[<component>](#component)
[<condition>](#condition)
[<conditions>](#conditions)
[<content>](#content)
[<contentModify>](#contentmodify)
[<description>](#description)
[<destinationCleanup>](#destinationcleanup)
[<detect>](#detect)
[<detects>](#detects)
[<detection>](#detection)
[<displayName>](#displayname)
[<environment>](#bkmk-environment)
[<exclude>](#exclude)
[<excludeAttributes>](#excludeattributes)
[<extensions>](#extensions)
[<extension>](#extension)
[<externalProcess>](#externalprocess)
[<icon>](#icon)
[<include>](#include)
[<includeAttribute>](#includeattributes) | [<library>](#library)
[<location>](#location)
[<locationModify>](#locationmodify)
[<_locDefinition>](#locdefinition)
[<manufacturer>](#manufacturer)
[<merge>](#merge)
[<migration>](#migration)
[<namedElements>](#namedelements)
[<object>](#object)
[<objectSet>](#objectset)
[<path>](#path)
[<paths>](#paths)
[<pattern>](#pattern)
[<processing>](#processing)
[<plugin>](#plugin)
[<role>](#role)
[<rules>](#rules)
[<script>](#script)
[<text>](#text)
[<unconditionalExclude>](#unconditionalexclude)
[<variable>](#variable)
[<version>](#version)
[<windowsObjects>](#windowsobjects) | [<condition> functions](#conditionfunctions)
[<content> functions](#contentfunctions)
[<contentModify> functions](#contentmodifyfunctions)
[<include> and <exclude> filter functions](#persistfilterfunctions)
[<locationModify> functions](#locationmodifyfunctions)
[<merge> functions](#mergefunctions)
[<script> functions](#scriptfunctions)
[Internal USMT functions](#internalusmtfunctions) | ## <addObjects> - The <addObjects> element emulates the existence of one or more objects on the source computer. The child <object> elements provide the details of the emulated objects. If the content is a <script> element, the result of the invocation will be an array of objects. - **Number of occurrences:** unlimited @@ -131,13 +54,14 @@ The <addObjects> element emulates the existence of one or more objects on Syntax: -<addObjects> - -</addObjects> +```xml + + +``` The following example is from the MigApp.xml file: -``` xml +```xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] @@ -154,7 +78,6 @@ The following example is from the MigApp.xml file: ## <attributes> - The <attributes> element defines the attributes for a registry key or file. - **Number of occurrences:** once for each <object> @@ -165,53 +88,17 @@ The <attributes> element defines the attributes for a registry key or file Syntax: -<attributes>*Content*</attributes> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

Content

Yes

The content depends on the type of object specified.

-
    -
  • For files, the content can be a string containing any of the following attributes separated by commas:

    -
      -
    • Archive

    • -
    • Read-only

    • -
    • System

    • -
    • Hidden

    • -
  • -
  • For registry keys, the content can be one of the following types:

    -
      -
    • None

    • -
    • String

    • -
    • ExpandString

    • -
    • Binary

    • -
    • Dword

    • -
    • REG_SZ

    • -
  • -
- +```xml +Content +``` +| Setting | Required? | Value | +|------|-----|----| +| *Content* | Yes | The content depends on the type of object specified.
  • For files, the content can be a string containing any of the following attributes separated by commas:
    • Archive
    • Read-only
    • System
    • Hidden
  • For registry keys, the content can be one of the following types:
    • None
    • String
    • ExpandString
    • Binary
    • Dword
    • REG_SZ
| The following example is from the MigApp.xml file: -``` xml +```xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] DWORD @@ -221,7 +108,6 @@ The following example is from the MigApp.xml file: ## <bytes> - You must specify the <bytes> element only for files because, if <location> corresponds to a registry key or a directory, then <bytes> will be ignored. - **Number of occurrences:** zero or one @@ -232,49 +118,19 @@ You must specify the <bytes> element only for files because, if <locati Syntax: -<bytes string="Yes|No" expand="Yes|No">*Content*</bytes> - - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

string

No, default is No

Determines whether Content should be interpreted as a string or as bytes.

expand

No (default = Yes

When the expand parameter is Yes, the content of the <bytes> element is first expanded in the context of the source computer and then interpreted.

Content

Yes

Depends on the value of the string.

-
    -
  • When the string is Yes: the content of the <bytes> element is interpreted as a string.

  • -
  • When the string is No: the content of the <bytes> element is interpreted as bytes. Each two characters represent the hexadecimal value of a byte. For example, "616263" is the representation for the "abc" ANSI string. A complete representation of the UNICODE string "abc" including the string terminator would be: "6100620063000000".

  • -
- +```xml +Content +``` +|Setting|Required?|Value| +|--- |--- |--- | +|string|No, default is No|Determines whether *Content* should be interpreted as a string or as bytes.| +|expand|No (default = Yes|When the expand parameter is Yes, the content of the <bytes> element is first expanded in the context of the source computer and then interpreted.| +|*Content*|Yes|Depends on the value of the string.
  • When the string is Yes: the content of the <bytes> element is interpreted as a string.
  • When the string is No: the content of the <bytes> element is interpreted as bytes. Each two characters represent the hexadecimal value of a byte. For example, "616263" is the representation for the "abc" ANSI string. A complete representation of the UNICODE string "abc" including the string terminator would be: "6100620063000000".
| The following example is from the MigApp.xml file: -``` xml +```xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [Lang] DWORD @@ -295,35 +151,16 @@ You might want to use the <commandLine> element if you want to start or st Syntax: -<commandLine>*CommandLineString*</commandLine> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

CommandLineString

Yes

A valid command line.

- +```xml +CommandLineString +``` +|Setting|Required?|Value| +|--- |--- |--- | +|*CommandLineString*|Yes|A valid command line.| ## <component> - The <component> element is required in a custom .xml file. This element defines the most basic construct of a migration .xml file. For example, in the MigApp.xml file, "Microsoft® Office 2003" is a component that contains another component, "Microsoft Office Access® 2003". You can use the child elements to define the component. A component can be nested inside another component; that is, the <component> element can be a child of the <role> element within the <component> element in two cases: 1) when the parent <component> element is a container or 2) if the child <component> element has the same role as the parent <component> element. @@ -338,72 +175,23 @@ A component can be nested inside another component; that is, the <component&g Syntax: -<component type="System|Application|Device|Documents" context="User|System|UserAndSystem" defaultSupported="TRUE|FALSE|YES|NO" - -hidden="Yes|No"> - -</component> - - ----- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

type

Yes

You can use the following to group settings, and define the type of the component.

-
    -
  • System: Operating system settings. All Windows® components are defined by this type.

    -

    When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

  • -
  • Application: Settings for an application.

  • -
  • Device: Settings for a device.

  • -
  • Documents: Specifies files.

  • -

context

No

-

Default = UserAndSystem

Defines the scope of this parameter; that is, whether to process this component in the context of the specific user, across the entire operating system, or both.

-

The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If a <rules> element has a context of System, it would act as though the <rules> element is not there.

-
    -
  • User. Evaluates the component for each user.

  • -
  • System. Evaluates the component only once for the system.

  • -
  • UserAndSystem. Evaluates the component for the entire operating system and each user.

  • -

defaultSupported

No

-

(default = TRUE)

Can be any of TRUE, FALSE, YES or NO. If this parameter is FALSE (or NO), the component will not be migrated unless there is an equivalent component on the destination computer.

-

When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.

hidden

This parameter is for internal USMT use only.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| type | Yes | You can use the following to group settings, and define the type of the component.
  • **System:** Operating system settings. All Windows® components are defined by this type.
    When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that is specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name. Otherwise, the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers.
  • **Application:** Settings for an application.
  • **Device:** Settings for a device.
  • **Documents:** Specifies files.
| +| context | No
Default = UserAndSystem | Defines the scope of this parameter; that is, whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If a <rules> element has a context of System, it would act as though the <rules> element is not there.
  • **User**. Evaluates the component for each user.
  • **System**. Evaluates the component only once for the system.
  • **UserAndSystem**. Evaluates the component for the entire operating system and each user.
| +| defaultSupported | No
(default = TRUE) | Can be any of TRUE, FALSE, YES, or NO. If this parameter is FALSE (or NO), the component will not be migrated unless there is an equivalent component on the destination computer.
When type="System" and defaultSupported="FALSE" the settings will not migrate unless there is an equivalent component in the .xml files that are specified on the LoadState command line. For example, the default MigSys.xml file contains components with type="System" and defaultSupported="FALSE". If you specify this file on the ScanState command line, you must also specify the file on the LoadState command line for the settings to migrate. This is because the LoadState tool must detect an equivalent component. That is, the component must have the same migration urlid of the .xml file and an identical display name or the LoadState tool will not migrate those settings from the store. This is helpful when the source computer is running Windows XP, and you are migrating to both Windows Vista and Windows XP because you can use the same store for both destination computers. | +| hidden | | This parameter is for internal USMT use only. | For an example, see any of the default migration .xml files. ## <condition> - Although the <condition> element under the <detect>, <objectSet>, and <addObjects> elements is supported, we recommend that you do not use it. This element might be deprecated in future versions of USMT, requiring you to rewrite your scripts. We recommend that, if you need to use a condition within the <objectSet> and <addObjects> elements, you use the more powerful [<conditions>](#conditions) element, which allows you to formulate complex Boolean statements. The <condition> element has a Boolean result. You can use this element to specify the conditions in which the parent element will be evaluated. If any of the present conditions return FALSE, the parent element will not be evaluated. @@ -418,43 +206,20 @@ The <condition> element has a Boolean result. You can use this element to Syntax: -<condition negation="Yes|No">*ScriptName*</condition> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

negation

No

-

Default = No

"Yes" reverses the True/False value of the condition.

ScriptName

Yes

A script that has been defined within this migration section.

- +```xml +ScriptName +``` +|Setting|Required?|Value| +|--- |--- |--- | +|negation|No
Default = No|"Yes" reverses the True/False value of the condition.| +|*ScriptName*|Yes|A script that has been defined within this migration section.| For example, In the code sample below, the <condition> elements, A and B, are joined together by the AND operator because they are in separate <conditions> sections. For example: -``` xml +```xml A @@ -467,7 +232,7 @@ In the code sample below, the <condition> elements, A and B, are joined to However, in the code sample below, the <condition> elements, A and B, are joined together by the OR operator because they are in the same <conditions> section. -``` xml +```xml A @@ -490,42 +255,18 @@ The <condition> functions return a Boolean value. You can use these elemen All matches are case insensitive. - Syntax: DoesOSMatch("*OSType*","*OSVersion*") + Syntax: `DoesOSMatch("OSType","OSVersion")` - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

OSType

Yes

The only valid value for this setting is NT. Note, however, that you must set this setting for the <condition> functions to work correctly.

OSVersion

Yes

The major version, minor version, build number and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version with a pattern. For example, 5.0.*.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*OSType*|Yes|The only valid value for this setting is **NT**. Note, however, that you must set this setting for the <condition> functions to work correctly.| + |*OSVersion*|Yes|The major version, minor version, build number and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. You can also specify partial specification of the version with a pattern. For example, `5.0.*`.| + For example: - -~~~ -For example: - -<condition>MigXmlHelper.DoesOSMatch("NT","\*")</condition> -~~~ + ```xml + MigXmlHelper.DoesOSMatch("NT","\*") + ``` - **IsNative64Bit** @@ -535,78 +276,29 @@ For example: All comparisons are case insensitive. - Syntax: IsOSLaterThan("*OSType*","*OSVersion*") + Syntax: `IsOSLaterThan("OSType","OSVersion")` - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

OSType

Yes

Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is "9x", the result will be FALSE.

OSVersion

Yes

The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

-

The IsOSLaterThan function returns TRUE if the current operating system is later than or equal to OSVersion.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*OSType*|Yes|Can be **9x** or **NT**. If *OSType* does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and *OSType* is "9x", the result will be FALSE.| + |*OSVersion*|Yes|The major version, minor version, build number, and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. You can also specify partial specification of the version but no pattern is allowed. For example, `5.0`.

The IsOSLaterThan function returns TRUE if the current operating system is later than or equal to *OSVersion*.| + For example: - -~~~ -For example: - -<condition negation="Yes">MigXmlHelper.IsOSLaterThan("NT","6.0")</condition> -~~~ + ```xml + MigXmlHelper.IsOSLaterThan("NT","6.0") + ``` - **IsOSEarlierThan** All comparisons are case insensitive. - Syntax: IsOSEarlierThan("*OSType*","*OSVersion*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

OSType

Yes

Can be 9x or NT. If OSType does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and OSType is "9x" the result will be FALSE.

OSVersion

Yes

The major version, minor version, build number, and corrected service diskette version separated by periods. For example, 5.0.2600.Service Pack 1. You can also specify partial specification of the version but no pattern is allowed. For example, 5.0.

-

The IsOSEarlierThan function returns TRUE if the current operating system is earlier than OSVersion.

+ Syntax: `IsOSEarlierThan("OSType","OSVersion")` + |Setting|Required?|Value| + |--- |--- |--- | + |*OSType*|Yes|Can be **9x** or **NT**. If *OSType* does not match the type of the current operating system, then it returns FALSE. For example, if the current operating system is Windows NT-based and *OSType* is "9x" the result will be FALSE.| + |*OSVersion*|Yes|The major version, minor version, build number, and corrected service diskette version separated by periods. For example, `5.0.2600.Service Pack 1`. You can also specify partial specification of the version but no pattern is allowed. For example, `5.0`.

The IsOSEarlierThan function returns TRUE if the current operating system is earlier than *OSVersion*.| ### Object content functions @@ -615,405 +307,140 @@ For example: The DoesObjectExist function returns TRUE if any object exists that matches the location pattern. Otherwise, it returns FALSE. The location pattern is expanded before attempting the enumeration. - Syntax: DoesObjectExist("*ObjectType*","*EncodedLocationPattern*") + Syntax: `DoesObjectExist("ObjectType","EncodedLocationPattern")` - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType

Yes

Defines the object type. Can be File or Registry.

EncodedLocationPattern

Yes

The location pattern. Environment variables are allowed.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType*|Yes|Defines the object type. Can be File or Registry.| + |*EncodedLocationPattern*|Yes|The [location pattern](#locations). Environment variables are allowed.| - - -~~~ -For an example of this element, see the MigApp.xml file. -~~~ + For an example of this element, see the MigApp.xml file. - **DoesFileVersionMatch** The pattern check is case insensitive. - Syntax: DoesFileVersionMatch("*EncodedFileLocation*","*VersionTag*","*VersionValue*") + Syntax: `DoesFileVersionMatch("EncodedFileLocation","VersionTag","VersionValue")` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

EncodedFileLocation

Yes

The location pattern for the file that will be checked. Environment variables are allowed.

VersionTag

Yes

The version tag value that will be checked.

VersionValue

Yes

A string pattern. For example, "Microsoft*".

+ |Setting|Required?|Value| + |--- |--- |--- | + |*EncodedFileLocation*|Yes|The [location pattern](#locations) for the file that will be checked. Environment variables are allowed.| + |*VersionTag*|Yes|The [version tag](#allowed) value that will be checked.| + |*VersionValue*|Yes|A string pattern. For example, "Microsoft*".| + For example: - -~~~ -For example: - -<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","6.\*")</condition> - -<condition>MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","7.\*")</condition> -~~~ + ```xml + MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","6.\*") MigXmlHelper.DoesFileVersionMatch("%MSNMessengerInstPath%\\msnmsgr.exe","ProductVersion","7.\*") + ``` - **IsFileVersionAbove** The IsFileVersionAbove function returns TRUE if the version of the file is higher than *VersionValue*. - Syntax: IsFileVersionAbove("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

EncodedFileLocation

Yes

The location pattern for the file that will be checked. Environment variables are allowed.

VersionTag

Yes

The version tag value that will be checked.

VersionValue

Yes

The value to compare to. You cannot specify a pattern.

- + Syntax: `IsFileVersionAbove("EncodedFileLocation","VersionTag","VersionValue")` + |Setting|Required?|Value| + |--- |--- |--- | + |*EncodedFileLocation*|Yes|The [location pattern](#locations) for the file that will be checked. Environment variables are allowed.| + |*VersionTag*|Yes|The [version tag](#allowed) value that will be checked.| + |*VersionValue*|Yes|The value to compare to. You cannot specify a pattern.| - **IsFileVersionBelow** - Syntax: IsFileVersionBelow("*EncodedFileLocation*","*VersionTag*","*VersionValue*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

EncodedFileLocation

Yes

The location pattern for the file that will be checked. Environment variables are allowed.

VersionTag

Yes

The version tag value that will be checked.

VersionValue

Yes

The value to compare to. You cannot specify a pattern.

- + Syntax: `IsFileVersionBelow("EncodedFileLocation","VersionTag","VersionValue")` + |Setting|Required?|Value| + |--- |--- |--- | + |*EncodedFileLocation*|Yes|The [location pattern](#locations) for the file that will be checked. Environment variables are allowed.| + |*VersionTag*|Yes|The [version tag](#allowed) value that will be checked.| + |*VersionValue*|Yes|The value to compare to. You cannot specify a pattern.| - **IsSystemContext** The IsSystemContext function returns TRUE if the current context is "System". Otherwise, it returns FALSE. - Syntax: IsSystemContext() + Syntax: `IsSystemContext()` - **DoesStringContentEqual** The DoesStringContentEqual function returns TRUE if the string representation of the given object is identical to `StringContent`. - Syntax: DoesStringContentEqual("*ObjectType*","*EncodedLocation*","*StringContent*") + Syntax: `DoesStringContentEqual("ObjectType","EncodedLocation","StringContent")` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType

Yes

Defines the type of object. Can be File or Registry.

EncodedLocationPattern

Yes

The encoded location for the object that will be examined. You can specify environment variables.

StringContent

Yes

The string that will be checked against.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType*|Yes|Defines the type of object. Can be File or Registry.| + |*EncodedLocationPattern*|Yes|The [encoded location](#locations) for the object that will be examined. You can specify environment variables.| + |StringContent|Yes|The string that will be checked against.| + For example: - -~~~ -For example: - -``` xml -MigXmlHelper.DoesStringContentEqual("File","%USERNAME%","") -``` -~~~ + ```xml + MigXmlHelper.DoesStringContentEqual("File","%USERNAME%","") + ``` - **DoesStringContentContain** The DoesStringContentContain function returns TRUE if there is at least one occurrence of *StrToFind* in the string representation of the object. - Syntax: DoesStringContentContain("*ObjectType*","*EncodedLocation*","*StrToFind*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType

Yes

Defines the type of object. Can be File or Registry.

EncodedLocationPattern

Yes

The encoded location for the object that will be examined. You can specify environment variables.

StrToFind

Yes

A string that will be searched inside the content of the given object.

- + Syntax: `DoesStringContentContain("ObjectType","EncodedLocation","StrToFind")` + |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType*|Yes|Defines the type of object. Can be File or Registry.| + |*EncodedLocationPattern*|Yes|The [encoded location](#locations) for the object that will be examined. You can specify environment variables.| + |*StrToFind*|Yes|A string that will be searched inside the content of the given object.| - **IsSameObject** The IsSameObject function returns TRUE if the given encoded locations resolve to the same physical object. Otherwise, it returns FALSE. - Syntax: IsSameObject("*ObjectType*","*EncodedLocation1*","*EncodedLocation2*") + Syntax: `IsSameObject("ObjectType","EncodedLocation1","EncodedLocation2")` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType

Yes

Defines the type of object. Can be File or Registry.

EncodedLocation1

Yes

The encoded location for the first object. You can specify environment variables.

EncodedLocation2

Yes

The encoded location for the second object. You can specify environment variables.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType*|Yes|Defines the type of object. Can be File or Registry.| + |*EncodedLocation1*|Yes|The [encoded location](#locations) for the first object. You can specify environment variables.| + |*EncodedLocation2*|Yes|The [encoded location](#locations) for the second object. You can specify environment variables.| + For example: - -~~~ -For example: - -``` xml - + ```xml + MigXmlHelper.IsSameObject("File","%CSIDL_FAVORITES%","%CSIDL_COMMON_FAVORITES%") %CSIDL_FAVORITES%\* [*] - -``` -~~~ + + ``` - **IsSameContent** The IsSameContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be compared byte by byte. - Syntax: IsSameContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType1

Yes

Defines the type of the first object. Can be File or Registry.

EncodedLocation1

Yes

The encoded location for the first object. You can specify environment variables.

ObjectType2

Yes

Defines the type of the second object. Can be File or Registry.

EncodedLocation2

Yes

The encoded location for the second object. You can specify environment variables.

- + Syntax: `IsSameContent("ObjectType1","EncodedLocation1","ObjectType2","EncodedLocation2")` + |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType1*|Yes|Defines the type of the first object. Can be File or Registry.| + |*EncodedLocation1*|Yes|The [encoded location](#locations) for the first object. You can specify environment variables.| + |*ObjectType2*|Yes|Defines the type of the second object. Can be File or Registry.| + |*EncodedLocation2*|Yes|The [encoded location](#locations) for the second object. You can specify environment variables.| - **IsSameStringContent** The IsSameStringContent function returns TRUE if the given objects have the same content. Otherwise, it returns FALSE. The content will be interpreted as a string. - Syntax: IsSameStringContent("*ObjectType1*","*EncodedLocation1*","*ObjectType2*","*EncodedLocation2*") - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType1

Yes

Defines the type of the first object. Can be File or Registry.

EncodedLocation1

Yes

The encoded location for the first object. You can specify environment variables.

ObjectType2

Yes

Defines the type of the second object. Can be File or Registry.

EncodedLocation2

Yes

The encoded location for the second object. You can specify environment variables.

- + Syntax: `IsSameStringContent("ObjectType1","EncodedLocation1","ObjectType2","EncodedLocation2")` + |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType1*|Yes|Defines the type of the first object. Can be File or Registry.| + |*EncodedLocation1*|Yes|The [encoded location](#locations) for the first object. You can specify environment variables.| + |*ObjectType2*|Yes|Defines the type of the second object. Can be File or Registry.| + |*EncodedLocation2*|Yes|The [encoded location](#locations) for the second object. You can specify environment variables.| ## <conditions> - The <conditions> element returns a Boolean result that is used to specify the conditions in which the parent element is evaluated. USMT evaluates the child elements, and then joins their results using the operators AND or OR according to the **operation** parameter. - **Number of occurrences:** Unlimited inside another <conditions> element. Limited to one occurrence in [<detection>](#detection), [<rules>](#rules), [<addObjects>](#addobjects), and [<objectSet>](#objectset) @@ -1024,37 +451,18 @@ The <conditions> element returns a Boolean result that is used to specify Syntax: -<conditions operation="AND|OR"> - -</conditions> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

operation

No, default = AND

Defines the Boolean operation that is performed on the results that are obtained from the child elements.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|operation|No, default = AND|Defines the Boolean operation that is performed on the results that are obtained from the child elements.| The following example is from the MigApp.xml file: -``` xml +```xml MigXmlHelper.IsNative64Bit() @@ -1067,7 +475,6 @@ The following example is from the MigApp.xml file: ## <content> - You can use the <content> element to specify a list of object patterns to obtain an object set from the source computer. Each <objectSet> within a <content> element is evaluated. For each resulting object pattern list, the objects that match it are enumerated and their content is filtered by the filter parameter. The resulting string array is the output for the <content> element. The filter script returns an array of locations. The parent <objectSet> element can contain multiple child <content> elements. - **Number of occurrences:** unlimited @@ -1080,34 +487,14 @@ You can use the <content> element to specify a list of object patterns to Syntax: -<content filter="*ScriptInvocation*"> - -</content> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

filter

Yes

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script is called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|filter|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script is called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.| ### <content> functions @@ -1117,50 +504,24 @@ The following functions generate patterns out of the content of an object. These If the registry value is a MULTI-SZ, only the first segment is processed. The returned pattern is the encoded location for a file that must exist on the system. If the specification is correct in the registry value, but the file does not exist, this function returns NULL. - Syntax: ExtractSingleFile(*Separators*,*PathHints*) + Syntax: `ExtractSingleFile(Separators,PathHints)` - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

Separators

Yes

A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You can specify NULL.

PathHints

Yes

A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*Separators*|Yes|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You can specify NULL.| + |*PathHints*|Yes|A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.| + For example: + ```xml + + ``` -~~~ -For example: + and -``` xml - -``` - -and - -``` xml - -``` -~~~ + ```xml + + ``` - **ExtractMultipleFiles** @@ -1168,94 +529,39 @@ and The returned patterns are the encoded locations for files that must exist on the source computer. If the specification is correct in the registry value but the file does not exist, it will not be included in the resulting list. - Syntax: ExtractMultipleFiles(*Separators*,*PathHints*) - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

Separators

Yes

A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. This parameter must be NULL when processing MULTI-SZ registry values.

PathHints

Yes

A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.

- + Syntax: `ExtractMultipleFiles(Separators,PathHints)` + |Setting|Required?|Value| + |--- |--- |--- | + |*Separators*|Yes|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. This parameter must be NULL when processing MULTI-SZ registry values.| + |*PathHints*|Yes|A list of extra paths, separated by colons (;), where the function will look for a file matching the current content. For example, if the content is "Notepad.exe" and the path is the %Path% environment variable, the function will find Notepad.exe in %windir% and returns "c:\Windows [Notepad.exe]". You can specify NULL.| - **ExtractDirectory** The ExtractDirectory function returns a pattern that is the encoded location for a directory that must exist on the source computer. If the specification is correct in the registry value, but the directory does not exist, this function returns NULL. If it is processing a registry value that is a MULTI-SZ, only the first segment will be processed. - Syntax: ExtractDirectory(*Separators*,*LevelsToTrim*,*PatternSuffix*) + Syntax: `ExtractDirectory(Separators,LevelsToTrim,PatternSuffix)` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

Separators

No

A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You must specify NULL when processing MULTI-SZ registry values.

LevelsToTrim

Yes

The number of levels to delete from the end of the directory specification. Use this function to extract a root directory when you have a registry value that points inside that root directory in a known location.

PatternSuffix

Yes

The pattern to add to the directory specification. For example, * [*].

+ |Setting|Required?|Value| + |--- |--- |--- | + |*Separators*|No|A list of possible separators that might follow the file specification in this registry value name. For example, if the content is "C:\Windows\Notepad.exe,-2", the separator is a comma. You must specify NULL when processing MULTI-SZ registry values.| + |*LevelsToTrim*|Yes|The number of levels to delete from the end of the directory specification. Use this function to extract a root directory when you have a registry value that points inside that root directory in a known location.| + |*PatternSuffix*|Yes|The pattern to add to the directory specification. For example, `* [*]`.| + For example: - -~~~ -For example: - -``` xml - + ```xml + %HklmWowSoftware%\Classes\Software\RealNetworks\Preferences\DT_Common [] - -``` -~~~ + + ``` ## <contentModify> - The <contentModify> element modifies the content of an object before it is written to the destination computer. For each <contentModify> element there can be multiple <objectSet> elements. This element returns the new content of the object that is being processed. - **Number of occurrences:** Unlimited @@ -1268,34 +574,14 @@ The <contentModify> element modifies the content of an object before it is Syntax: -<contentModify script="*ScriptInvocation*"> - -</contentModify> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

script

Yes

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2").`

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.| ### <contentModify> functions @@ -1305,284 +591,95 @@ The following functions change the content of objects as they are migrated. Thes The ConvertToDWORD function converts the content of registry values that are enumerated by the parent <ObjectSet> element to a DWORD. For example, ConvertToDWORD will convert the string "1" to the DWORD 0x00000001. If the conversion fails, then the value of DefaultValueOnError will be applied. - Syntax: ConvertToDWORD(*DefaultValueOnError*) - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

DefaultValueOnError

No

The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.

- + Syntax: `ConvertToDWORD(DefaultValueOnError)` + |Setting|Required?|Value| + |--- |--- |--- | + |*DefaultValueOnError*|No|The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.| - **ConvertToString** The ConvertToString function converts the content of registry values that match the parent <ObjectSet> element to a string. For example, it will convert the DWORD 0x00000001 to the string "1". If the conversion fails, then the value of DefaultValueOnError will be applied. - Syntax: ConvertToString(*DefaultValueOnError*) + Syntax: `ConvertToString(DefaultValueOnError)` - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

DefaultValueOnError

No

The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*DefaultValueOnError*|No|The value that will be written into the value name if the conversion fails. You can specify NULL, and 0 will be written if the conversion fails.| + For example: - -~~~ -For example: - -``` xml - + ```xml + HKCU\Control Panel\Desktop [ScreenSaveUsePassword] - -``` -~~~ + + ``` - **ConvertToBinary** The ConvertToBinary function converts the content of registry values that match the parent <ObjectSet> element to a binary type. - Syntax: ConvertToBinary () + Syntax: `ConvertToBinary ()` - **OffsetValue** The OffsetValue function adds or subtracts *Value* from the value of the migrated object, and then writes the result back into the registry value on the destination computer. For example, if the migrated object is a DWORD with a value of 14, and the *Value* is "-2", the registry value will be 12 on the destination computer. - Syntax: OffsetValue(*Value*) - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

Value

Yes

The string representation of a numeric value. It can be positive or negative. For example, OffsetValue(2).

- + Syntax: `OffsetValue(Value)` + |Setting|Required?|Value| + |--- |--- |--- | + |*Value*|Yes|The string representation of a numeric value. It can be positive or negative. For example, `OffsetValue(2)`.| - **SetValueByTable** The SetValueByTable function matches the value from the source computer to the source table. If the value is there, the equivalent value in the destination table will be applied. If the value is not there, or if the destination table has no equivalent value, the *DefaultValueOnError* will be applied. - Syntax: SetValueByTable(*SourceTable*,*DestinationTable*,*DefaultValueOnError*) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

SourceTable

Yes

A list of values separated by commas that are possible for the source registry values.

DestinationTable

No

A list of translated values separated by commas.

DefaultValueOnError

No

The value that will be applied to the destination computer if either 1) the value for the source computer does not match SourceTable, or 2) DestinationTable has no equivalent value.

-

If DefaultValueOnError is NULL, the value will not be changed on the destination computer.

- + Syntax: `SetValueByTable(SourceTable,DestinationTable,DefaultValueOnError)` + |Setting|Required?|Value| + |--- |--- |--- | + |*SourceTable*|Yes|A list of values separated by commas that are possible for the source registry values.| + |*DestinationTable*|No|A list of translated values separated by commas.| + |*DefaultValueOnError*|No|The value that will be applied to the destination computer if either 1) the value for the source computer does not match *SourceTable*, or 2) *DestinationTable* has no equivalent value.

If DefaultValueOnError is NULL, the value will not be changed on the destination computer.| - **KeepExisting** You can use the KeepExisting function when there are conflicts on the destination computer. This function will keep (not overwrite) the specified attributes for the object that is on the destination computer. - Syntax: KeepExisting("*OptionString*","*OptionString*","*OptionString*",…) - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

OptionString

Yes

OptionString can be Security, TimeFields, or FileAttrib:Letter. You can specify one of each type of OptionStrings. Do not specify multiple OptionStrings with the same value. If you do, the right-most option of that type will be kept. For example, do not specify ("FileAttrib:H", "FileAttrib:R") because only Read-only will be evaluated. Instead specify ("FileAttrib:HR") and both Hidden and Read-only attributes will be kept on the destination computer.

-
    -
  • Security. Keeps the destination object's security descriptor if it exists.

  • -
  • TimeFields. Keeps the destination object's time stamps. This parameter is for files only.

  • -
  • FileAttrib:Letter. Keeps the destination object's attribute value, either On or OFF, for the specified set of file attributes. This parameter is for files only. The following are case-insensitive, but USMT will ignore any values that are invalid, repeated, or if there is a space after "FileAttrib:". You can specify any combination of the following attributes:

    -
      -
    • A = Archive

    • -
    • C = Compressed

    • -
    • E = Encrypted

    • -
    • H = Hidden

    • -
    • I = Not Content Indexed

    • -
    • O = Offline

    • -
    • R = Read-Only

    • -
    • S = System

    • -
    • T = Temporary

    • -
  • -
- + Syntax: `KeepExisting("OptionString","OptionString","OptionString",…)` + |Setting|Required?|Value| + |--- |--- |--- | + | *OptionString* | Yes | *OptionString* can be **Security**, **TimeFields**, or **FileAttrib**:*Letter*. You can specify one of each type of *OptionStrings*. Do not specify multiple *OptionStrings* with the same value. If you do, the right-most option of that type will be kept. For example, do not specify **("FileAttrib:H", "FileAttrib:R")** because only Read-only will be evaluated. Instead specify **("FileAttrib:HR")** and both Hidden and Read-only attributes will be kept on the destination computer.
  • **Security**. Keeps the destination object's security descriptor if it exists.
  • **TimeFields**. Keeps the destination object's time stamps. This parameter is for files only.
  • **FileAttrib:** *Letter*. Keeps the destination object's attribute value, either On or OFF, for the specified set of file attributes. This parameter is for files only. The following are case-insensitive, but USMT will ignore any values that are invalid, repeated, or if there is a space after "FileAttrib:". You can specify any combination of the following attributes:
    • **A** = Archive
    • **C** = Compressed
    • **E** = Encrypted
    • **H** = Hidden
    • **I** = Not Content Indexed
    • **O** = Offline
    • **R** = Read-Only
    • **S** = System
    • **T** = Temporary
| - **MergeMultiSzContent** The MergeMultiSzContent function merges the MULTI-SZ content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. `Instruction` and `String` either remove or add content to the resulting MULTI-SZ. Duplicate elements will be removed. - Syntax: MergeMultiSzContent (*Instruction*,*String*,*Instruction*,*String*,…) - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

Instruction

Yes

Can be one of the following:

-
    -
  • Add. Adds the corresponding String to the resulting MULTI-SZ if it is not already there.

  • -
  • Remove. Removes the corresponding String from the resulting MULTI-SZ.

  • -

String

Yes

The string to be added or removed.

- + Syntax: `MergeMultiSzContent (Instruction,String,Instruction,String,…)` + |Setting|Required?|Value| + |--- |--- |--- | + | *Instruction* | Yes | Can be one of the following:
  • **Add**. Adds the corresponding String to the resulting MULTI-SZ if it is not already there.
  • **Remove**. Removes the corresponding String from the resulting MULTI-SZ.
| + | *String* | Yes | The string to be added or removed. | - **MergeDelimitedContent** The MergeDelimitedContent function merges the content of the registry values that are enumerated by the parent <ObjectSet> element with the content of the equivalent registry values that already exist on the destination computer. The content is considered a list of elements separated by one of the characters in the Delimiters parameter. Duplicate elements will be removed. - Syntax: MergeDelimitedContent(*Delimiters*,*Instruction*,*String*,…) - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

Delimiters

Yes

A single character that will be used to separate the content of the object that is being processed. The content will be considered as a list of elements that is separated by the Delimiters.

-

For example, "." will separate the string based on a period.

Instruction

Yes

Can one of the following:

-
    -
  • Add. Adds String to the resulting MULTI-SZ if it is not already there.

  • -
  • Remove. Removes String from the resulting MULTI-SZ.

  • -

String

Yes

The string to be added or removed.

- + Syntax: `MergeDelimitedContent(Delimiters,Instruction,String,…)` + |Setting|Required?|Value| + |--- |--- |--- | + | *Delimiters* | Yes | A single character that will be used to separate the content of the object that is being processed. The content will be considered as a list of elements that is separated by the *Delimiters*.
For example, "." will separate the string based on a period. | + | *Instruction* | Yes | Can one of the following:
  • **Add.** Adds *String* to the resulting MULTI-SZ if it is not already there.
  • **Remove.** Removes *String* from the resulting MULTI-SZ.
| + | *String* | Yes | The string to be added or removed. | ## <description> - The <description> element defines a description for the component but does not affect the migration. - **Number of occurrences:** zero or one @@ -1593,45 +690,26 @@ The <description> element defines a description for the component but does Syntax: -<description>*ComponentDescription*</description> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

ComponentDescription

Yes

The description of the component.

- +```xml +ComponentDescription +``` +|Setting|Required?|Value| +|--- |--- |--- | +|*ComponentDescription*|Yes|The description of the component.| The following code sample shows how the <description> element defines the "My custom component" description.: -``` xml +```xml My custom component ``` ## <destinationCleanup> - The <destinationCleanup> element deletes objects, such as files and registry keys, from the destination computer before applying the objects from the source computer. This element is evaluated only when the LoadState tool is run on the destination computer. That is, this element is ignored by the ScanState tool. -**Important** -Use this option with extreme caution because it will delete objects from the destination computer. +> [!IMPORTANT] +> Use this option with extreme caution because it will delete objects from the destination computer. @@ -1645,38 +723,18 @@ For each <destinationCleanup> element there can be multiple <objectSet& Syntax: -<destinationCleanup filter=*ScriptInvocation*> - -</destinationCleanup> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

filter

Yes

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|filter|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.| For example: -``` xml +```xml HKCU\Software\Lotus\123\99.0\DDE Preferences\* [*] @@ -1687,7 +745,6 @@ For example: ## <detect> - Although the <detect> element is still supported, we do not recommend using it because it may be deprecated in future versions of USMT. In that case, you would have to rewrite your scripts. Instead, we recommend that you use the [<detection>](#detection)**element.** You use the <detect> element to determine if the component is present on a system. If all child <detect> elements within a <detect> element resolve to TRUE, then the <detect> element resolves to TRUE. If any child <detect> elements resolve to FALSE, then their parent <detect> element resolves to FALSE. If there is no <detect> element section, then USMT will assume that the component is present. @@ -1704,61 +761,30 @@ For each <detect> element there can be multiple child <condition> or Syntax: -<detect name="*ID*" context="User|System|UserAndSystem"> - -</detect> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

name

Yes, when <detect> is a child to <namedElements>

-

No, when <detect> is a child to <detects>

When ID is specified, any child elements are not processed. Instead, any other <detect> elements with the same name that are declared within the <namedElements> element are processed.

context

No

-

(default = UserAndSystem)

Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

-

The largest possible scope is set by the component element. For example, if a <component> element has a context of User, and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.

-
    -
  • User. Evaluates the variables for each user.

  • -
  • System. Evaluates the variables only once for the system.

  • -
  • UserAndSystem. Evaluates the variables for the entire operating system and each user.

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| name | Yes, when <detect> is a child to <namedElements>
No, when <detect> is a child to <detects> | When *ID* is specified, any child elements are not processed. Instead, any other <detect> elements with the same name that are declared within the <namedElements> element are processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the component element. For example, if a <component> element has a context of User, and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.
  • **User.** Evaluates the variables for each user.
  • **System.** Evaluates the variables only once for the system.
  • **UserAndSystem.** Evaluates the variables for the entire operating system and each user.
| For examples, see the examples for [<detection>](#detection). ## <detects> - Although the <detects> element is still supported, we recommend that you do not use it because it may be deprecated in future versions of USMT, which would require you to rewrite your scripts. Instead, we recommend that you use the [<detection>](#detection) element if the parent element is <role> or <namedElements>, and we recommend that you use the <conditions> element if the parent element is <rules>. Using <detection> allows you to more clearly formulate complex Boolean statements. The <detects> element is a container for one or more <detect> elements. If all of the child <detect> elements within a <detects> element resolve to TRUE, then <detects> resolves to TRUE. If any of the child <detect> elements resolve to FALSE, then <detects> resolves to FALSE. If you do not want to write the <detects> elements within a component, then you can create the <detects> element under the <namedElements> element, and then refer to it. If there is no <detects> element section, then USMT will assume that the component is present. The results from each <detects> element are joined together by the OR operator to form the rule used to detect the parent element. Syntax: -<detects name="*ID*" context="User|System|UserAndSystem"> - -</detects> +```xml + + +``` - **Number of occurrences:** Unlimited. @@ -1766,47 +792,14 @@ Syntax: - **Required child elements:** <detect> - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

name

Yes, when <detects> is a child to <namedElements>

-

No, when <detects> is a child to <role> or <rules>

When ID is specified, no child <detect> elements are processed. Instead, any other <detects> elements with the same name that are declared within the <namedElements> element are processed.

context

No

-

(default = UserAndSystem)

Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

-

The largest possible scope is set by the <component element>. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.

-
    -
  • User. Evaluates the variables for each user.

  • -
  • System. Evaluates the variables only once for the system.

  • -
  • UserAndSystem. Evaluates the variables for the entire operating system and each user.

  • -
-

The context parameter is ignored for <detects> elements that are inside <rules> elements.

- - +|Setting|Required?|Value| +|--- |--- |--- | +| name | Yes, when <detects> is a child to <namedElements>
No, when <detects> is a child to <role> or <rules> | When *ID* is specified, no child <detect> elements are processed. Instead, any other <detects> elements with the same name that are declared within the <namedElements> element are processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the <component element>. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though the <rules> element were not there.
  • **User.** Evaluates the variables for each user.
  • **System.** Evaluates the variables only once for the system.
  • **UserAndSystem.** Evaluates the variables for the entire operating system and each user.

The context parameter is ignored for <detects> elements that are inside <rules> elements. | The following example is from the MigApp.xml file. -``` xml +```xml MigXmlHelper.DoesFileVersionMatch("%Lotus123InstPath%\123w.exe","ProductVersion","9.*") @@ -1834,50 +827,19 @@ Use the <detection> element under the <namedElements> element if you Syntax: -<detection name="*ID*" context="User|System|UserAndSystem"> - -</detection> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

name

    -
  • Yes, when <detection> is declared under <namedElements>

  • -
  • Optional, when declared under <role>

  • -

If declared, the content of the <detection> element is ignored and the content of the <detection> element with the same name that is declared in the <namedElements> element will be evaluated.

context

No, default = UserAndSystem

Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

-
    -
  • User. Evaluates the component for each user.

  • -
  • System. Evaluates the component only once for the system.

  • -
  • UserAndSystem. Evaluates the component for the entire operating system and each user.

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| name |
  • Yes, when <detection> is declared under <namedElements>
  • Optional, when declared under <role>
| If declared, the content of the <detection> element is ignored and the content of the <detection> element with the same name that is declared in the <namedElements> element will be evaluated. | +| context | No, default = UserAndSystem | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
  • **User.** Evaluates the component for each user.
  • **System.** Evaluates the component only once for the system.
  • **UserAndSystem.** Evaluates the component for the entire operating system and each user.
| For example: -``` xml +```xml MigXmlHelper.DoesObjectExist("Registry","HKCU\Software\Adobe\Photoshop\8.0") @@ -1888,7 +850,7 @@ For example: and -``` xml +```xml @@ -1911,46 +873,23 @@ The <displayName> element is a required field within each <component> Syntax: -<displayName \_locID="*ID*">*ComponentName*</displayName> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

locID

No

This parameter is for internal USMT use. Do not use this parameter.

ComponentName

Yes

The name for the component.

- +```xml +ComponentName +``` +|Setting|Required?|Value| +|--- |--- |--- | +|locID|No|This parameter is for internal USMT use. Do not use this parameter.| +|*ComponentName*|Yes|The name for the component.| For example: -``` xml +```xml Command Prompt settings ``` ## <environment> - The <environment> element is a container for <variable> elements in which you can define variables to use in your .xml file. All environment variables defined this way will be private. That is, they will be available only for their child components and the component in which they were defined. For two example scenarios, see [Examples](#envex). - **Number of occurrences:** unlimited @@ -1963,55 +902,23 @@ The <environment> element is a container for <variable> elements in Syntax: -<environment name="ID" context="User|System|UserAndSystem"> - -</environment> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

name

Yes, when <environment> is a child of <namedElements>

-

No, when <environment> is a child of <role> or <component>

When declared as a child of the <role> or <component> elements, if ID is declared, USMT ignores the content of the <environment> element and the content of the <environment> element with the same name declared in the <namedElements> element is processed.

context

No

-

(default = UserAndSystem)

Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.

-

The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though <rules> were not there.

-
    -
  • User. Evaluates the variables for each user.

  • -
  • System. Evaluates the variables only once for the system.

  • -
  • UserAndSystem. Evaluates the variables for the entire operating system and each user.

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| name | Yes, when <environment> is a child of <namedElements>
No, when <environment> is a child of <role> or <component> | When declared as a child of the <role> or <component> elements, if *ID* is declared, USMT ignores the content of the <environment> element and the content of the <environment> element with the same name declared in the <namedElements> element is processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter: whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the <component> element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it had a context of User. If the <rules> element had a context of System, it would act as though <rules> were not there.
  • **User.** Evaluates the variables for each user.
  • **System.** Evaluates the variables only once for the system.
  • **UserAndSystem.** Evaluates the variables for the entire operating system and each user.
| ## - ### Example scenario 1 In this scenario, you want to generate the location of objects at run time depending on the configuration of the destination computer. For example, you must do this if an application writes data in the directory where it is installed, and users can install the application anywhere on the computer. If the application writes a registry value hklm\\software\\companyname\\install \[path\] and then updates this value with the location where the application is installed, then the only way for you to migrate the required data correctly is to define an environment variable. For example: -``` xml +```xml @@ -2021,7 +928,7 @@ In this scenario, you want to generate the location of objects at run time depen Then you can use an include rule as follows. You can use any of the [<script> functions](#scriptfunctions) to perform similar tasks. -``` xml +```xml %INSTALLPATH%\ [*.xyz] @@ -2031,7 +938,7 @@ Then you can use an include rule as follows. You can use any of the [<script& Second, you can also filter registry values that contain data that you need. The following example extracts the first string (before the separator ",") in the value of the registry Hklm\\software\\companyname\\application\\ \[Path\]. -``` xml +```xml @@ -2049,7 +956,7 @@ Second, you can also filter registry values that contain data that you need. The In this scenario, you want to migrate five files named File1.txt, File2.txt, and so on, from %SYSTEMDRIVE%\\data\\userdata\\dir1\\dir2\\. To do this you must have the following <include> rule in an .xml file: -``` xml +```xml %SYSTEMDRIVE%\data\userdata\dir1\dir2 [File1.txt] @@ -2063,7 +970,7 @@ In this scenario, you want to migrate five files named File1.txt, File2.txt, and Instead of typing the path five times, you can create a variable for the location as follows: -``` xml +```xml %SYSTEMDRIVE%\data\userdata\dir1\dir2 @@ -2073,7 +980,7 @@ Instead of typing the path five times, you can create a variable for the locatio Then, you can specify the variable in an <include> rule as follows: -``` xml +```xml %DATAPATH% [File1.txt] @@ -2100,39 +1007,19 @@ The <exclude> element determines what objects will not be migrated, unless Syntax: -<exclude filter="*ScriptInvocation*"> - -</exclude> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

filter

No

-

(default = No)

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

+```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|filter|No
(default = No)|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.| For example, from the MigUser.xml file: -``` xml +```xml %CSIDL_MYMUSIC%\* [*] @@ -2155,41 +1042,18 @@ You can use the <excludeAttributes> element to determine which parameters Syntax: -<excludeAttributes attributes="Security|TimeFields|Security,TimeFields"> - -</excludeAttributes> - - ----- - - - - - - - - - - - - - - -
ParameterRequired?Value

attributes

Yes

Specifies the attributes to be excluded. You can specify one of the following, or both separated by quotes; for example, "Security","TimeFields":

-
    -
  • Security can be one of Owner, Group, DACL, or SACL.

  • -
  • TimeFields can be one of CreationTime, LastAccessTime and LastWrittenTime

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| attributes | Yes | Specifies the attributes to be excluded. You can specify one of the following, or both separated by quotes; for example, `"Security","TimeFields"`:
  • Security can be one of Owner, Group, DACL, or SACL.
  • TimeFields can be one of CreationTime, LastAccessTime and LastWrittenTime
| Example: -``` xml +```xml @@ -2251,9 +1115,10 @@ The <extensions> element is a container for one or more <extension> Syntax: -<extensions> - -</extensions> +```xml + + +``` ## <extension> @@ -2268,35 +1133,17 @@ You can use the <extension> element to specify documents of a specific ext Syntax: -<extension>*FilenameExtension*</extension> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

FilenameExtension

Yes

A file name extension.

- +```xml +FilenameExtension +``` +|Setting|Required?|Value| +|--- |--- |--- | +|*FilenameExtension*|Yes|A file name extension.| For example, if you want to migrate all \*.doc files from the source computer, specifying the following code under the <component> element: -``` xml +```xml doc @@ -2304,7 +1151,7 @@ For example, if you want to migrate all \*.doc files from the source computer, s is the same as specifying the following code below the <rules> element: -``` xml +```xml @@ -2327,52 +1174,23 @@ You can use the <externalProcess> element to run a command line during the Syntax: -<externalProcess when="pre-scan|scan-success|post-scan|pre-apply|apply-success|post-apply"> - -</externalProcess> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

when

Yes

Indicates when the command line should be run. This value can be one of the following:

-
    -
  • pre-scan before the scanning process begins.

  • -
  • scan-success after the scanning process has finished successfully.

  • -
  • post-scan after the scanning process has finished, whether it was successful or not.

  • -
  • pre-apply before the apply process begins.

  • -
  • apply-success after the apply process has finished successfully.

  • -
  • post-apply after the apply process has finished, whether it was successful or not.

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| when | Yes | Indicates when the command line should be run. This value can be one of the following:
  • **pre-scan** before the scanning process begins.
  • **scan-success** after the scanning process has finished successfully.
  • **post-scan** after the scanning process has finished, whether it was successful or not.
  • **pre-apply** before the apply process begins.
  • **apply-success** after the apply process has finished successfully.
  • **post-apply** after the apply process has finished, whether it was successful or not.
| For an example of how to use the <externalProcess> element, see the example for [<excludeAttributes>](#excludeattributes). ## <icon> - This is an internal USMT element. Do not use this element. ## <include> - The <include> element determines what to migrate, unless there is a more specific [<exclude>](#exclude) rule. You can specify a script to be more specific to extend the definition of what you want to collect. For each <include> element there can be multiple <objectSet> elements. - **Number of occurrences:** Unlimited @@ -2385,39 +1203,18 @@ The <include> element determines what to migrate, unless there is a more s Syntax: -<include filter="*ScriptInvocation*"> - -</include> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

filter

No.

-

If this parameter is not specified, then all patterns that are inside the child <ObjectSet> element will be processed.

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| filter | No.
If this parameter is not specified, then all patterns that are inside the child <ObjectSet> element will be processed. | A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated. | The following example is from the MigUser.xml file: -``` xml +```xml My Video @@ -2453,54 +1250,26 @@ The following functions return a Boolean value. You can use them to migrate cert This filter always returns FALSE. - Syntax: AnswerNo () + Syntax: `AnswerNo ()` - **CompareStringContent** - Syntax: CompareStringContent("*StringContent*","*CompareType*") - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

StringContent

Yes

The string to check against.

CompareType

Yes

A string. Use one of the following values:

-
    -
  • Equal (case insensitive). The function returns TRUE if the string representation of the current object that is processed by the migration engine is identical to StringContent.

  • -
  • NULL or any other value. The function returns TRUE if the string representation of the current object that is processed by the migration engine does not match StringContent.

  • -
- + Syntax: `CompareStringContent("StringContent","CompareType")` + |Setting|Required?|Value| + |--- |--- |--- | + | *StringContent* | Yes | The string to check against. | + | *CompareType* | Yes | A string. Use one of the following values:
  • **Equal** (case insensitive). The function returns TRUE if the string representation of the current object that is processed by the migration engine is identical to `StringContent`.
  • **NULL** **or any other value**. The function returns TRUE if the string representation of the current object that is processed by the migration engine does not match `StringContent`.
| - **IgnoreIrrelevantLinks** This filter screens out the .lnk files that point to an object that is not valid on the destination computer. Note that the screening takes place on the destination computer, so all .lnk files will be saved to the store during ScanState. Then they will be screened out when you run the LoadState tool. - Syntax: IgnoreIrrelevantLinks () + Syntax: `IgnoreIrrelevantLinks ()` For example: - ``` xml + ```xml %CSIDL_COMMON_VIDEO%\* [*] @@ -2512,11 +1281,11 @@ The following functions return a Boolean value. You can use them to migrate cert You can use this function to collect the specified objects from the source computer but then not migrate the objects to the destination computer. When run with the ScanState tool, this function evaluates to TRUE. When run with the LoadState tool, this function evaluates to FALSE. You may want to use this function when you want to check an object's value on the destination computer but do not intend to migrate the object to the destination. - Syntax: NeverRestore() + Syntax: `NeverRestore()` In the following example, HKCU\\Control Panel\\International \[Locale\] will be included in the store, but it will not be migrated to the destination computer: - ``` xml + ```xml HKCU\Control Panel\International [Locale] @@ -2537,59 +1306,23 @@ You can use the <includeAttributes> element to determine whether certain p Syntax: -<includeAttributes attributes="Security|TimeFields|Security,TimeFields"> - -</includeAttributes> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

attributes

Yes

Specifies the attributes to be included with a migrated object. You can specify one of the following, or both separated by quotes; for example, "Security","TimeFields":

-
    -
  • Security can be one of the following values:

    -
      -
    • Owner. The owner of the object (SID).

    • -
    • Group. The primary group for the object (SID).

    • -
    • DACL (discretionary access control list). An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.

    • -
    • SACL (system access control list). An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.

    • -
  • -
  • TimeFields can be one of the following:

    -
      -
    • CreationTime. Specifies when the file or directory was created.

    • -
    • LastAccessTime. Specifies when the file is last read from, written to, or, in the case of executable files, run.

    • -
    • LastWrittenTime. Specifies when the file is last written to, truncated, or overwritten.

    • -
  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| attributes | Yes | Specifies the attributes to be included with a migrated object. You can specify one of the following, or both separated by quotes; for example, `"Security","TimeFields"`:
  • Security can be one of the following values:
    • **Owner.** The owner of the object (SID).
    • **Group.** The primary group for the object (SID).
    • **DACL** (discretionary access control list). An access control list that is controlled by the owner of an object and that specifies the access particular users or groups can have to the object.
    • **SACL** (system access control list). An ACL that controls the generation of audit messages for attempts to access a securable object. The ability to get or set an object's SACL is controlled by a privilege typically held only by system administrators.
  • TimeFields can be one of the following:
    • **CreationTime.** Specifies when the file or directory was created.
    • **LastAccessTime.** Specifies when the file is last read from, written to, or, in the case of executable files, run.
    • **LastWrittenTime.** Specifies when the file is last written to, truncated, or overwritten.
| For an example of how to use the <includeAttributes> element, see the example for [<excludeAttributes>](#excludeattributes). ## <library> - This is an internal USMT element. Do not use this element. ## <location> - The <location> element defines the location of the <object> element. - **Number of occurrences:** once for each <object> @@ -2600,40 +1333,18 @@ The <location> element defines the location of the <object> element. Syntax: -<location type="*typeID*">*ObjectLocation*</location> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

type

Yes

typeID can be Registry or File.

ObjectLocation

Yes

The location of the object.

- +```xml +ObjectLocation +``` +|Setting|Required?|Value| +|--- |--- |--- | +|type|Yes|*typeID* can be Registry or File.| +|*ObjectLocation*|Yes|The location of the object.| The following example is from the MigApp.xml file: -``` xml +```xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] @@ -2650,7 +1361,6 @@ The following example is from the MigApp.xml file: ## <locationModify> - You can use the <locationModify> element to change the location and name of an object before it is migrated to the destination computer. The <locationModify> element is processed only when the LoadState tool is run on the destination computer. In other words, this element is ignored by the ScanState tool. The <locationModify> element will create the appropriate folder on the destination computer if it does not already exist. **Number of occurrences:** Unlimited @@ -2663,38 +1373,18 @@ You can use the <locationModify> element to change the location and name o Syntax: -<locationModify script="*ScriptInvocation*"> - -</locationModify> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

script

Yes

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the include rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.| The following example is from the MigApp.xml file: -``` xml +```xml %CSIDL_APPDATA%\Microsoft\Office\ [Access10.pip] @@ -2710,113 +1400,46 @@ The following functions change the location of objects as they are migrated when The ExactMove function moves all of the objects that are matched by the parent <ObjectSet> element into the given *ObjectEncodedLocation*. You can use this function when you want to move a single file to a different location on the destination computer. If the destination location is a node, all of the matching source objects will be written to the node without any subdirectories. If the destination location is a leaf, the migration engine will migrate all of the matching source objects to the same location. If a collision occurs, the normal collision algorithms will apply. - Syntax: ExactMove(*ObjectEncodedLocation*) + Syntax: `ExactMove(ObjectEncodedLocation)` - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectEncodedLocation

Yes

The destination location for all of the source objects.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectEncodedLocation*|Yes|The destination [location](#locations) for all of the source objects.| + For example: - -~~~ -For example: - -``` xml - + ```xml + HKCU\Keyboard Layout\Toggle [] - -``` -~~~ + + ``` - **Move** The Move function moves objects to a different location on the destination computer. In addition, this function creates subdirectories that were above the longest CSIDL in the source object name. - Syntax: Move(*DestinationRoot*) - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

DestinationRoot

Yes

The location where the source objects will be moved. If needed, this function will create any subdirectories that were above the longest CSIDL in the source object name.

- + Syntax: `Move(DestinationRoot)` + |Setting|Required?|Value| + |--- |--- |--- | + |*DestinationRoot*|Yes|The location where the source objects will be moved. If needed, this function will create any subdirectories that were above the longest CSIDL in the source object name.| - **RelativeMove** You can use the RelativeMove function to collect and move data. Note that you can use environment variables in source and destination roots, but they may be defined differently on the source and destination computers. - Syntax: RelativeMove(*SourceRoot*,*DestinationRoot*) + Syntax: `RelativeMove(SourceRoot,DestinationRoot)` - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

SourceRoot

Yes

The location from where the objects will be moved. Any source objects that are enumerated by the parent <ObjectSet> element that are not in this location will not be moved.

DestinationRoot

Yes

The location where the source objects will be moved to on the destination computer. If needed, this function will create any subdirectories that were above SourceRoot.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*SourceRoot*|Yes|The location from where the objects will be moved. Any source objects that are enumerated by the parent <ObjectSet> element that are not in this location will not be moved.| + |*DestinationRoot*|Yes|The location where the source objects will be moved to on the destination computer. If needed, this function will create any subdirectories that were above *SourceRoot*.| - - -~~~ For example: -``` xml +```xml %CSIDL_COMMON_FAVORITES%\* [*] @@ -2828,7 +1451,6 @@ For example:
``` -~~~ ## <\_locDefinition> @@ -2848,35 +1470,16 @@ The <manufacturer> element defines the manufacturer for the component, but Syntax: -<manufacturer>*Name*</manufacturer> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

Name

Yes

The name of the manufacturer for the component.

- +```xml +Name +``` +|Setting|Required?|Value| +|--- |--- |--- | +|*Name*|Yes|The name of the manufacturer for the component.| ## <merge> - The <merge> element determines what will happen when a collision occurs. A collision is when an object that is migrated is already present on the destination computer. If you do not specify this element, the default behavior for the registry is for the source object to overwrite the destination object. The default behavior for files is for the source file to be renamed to "OriginalFileName(1).OriginalExtension". This element specifies only what should be done when a collision occurs. It does not include objects. Therefore, for your objects to migrate, you must specify <include> rules along with the <merge> element. When an object is processed and a collision is detected, USMT will select the most specific merge rule and apply it to resolve the conflict. For example, if you have a <merge> rule C:\\\* \[\*\] set to <sourcePriority> and a <merge> rule C:\\subfolder\\\* \[\*\] set to <destinationPriority>, then USMT would use the <destinationPriority> rule because it is the more specific. For an example of this element, see [Conflicts and Precedence](usmt-conflicts-and-precedence.md). @@ -2891,38 +1494,18 @@ For an example of this element, see [Conflicts and Precedence](usmt-conflicts-an Syntax: -<merge script="*ScriptInvocation*"> - -</merge> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

script

Yes

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|script|Yes|A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.

The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.| The following example is from the MigUser.xml file: -``` xml +```xml @@ -2947,7 +1530,7 @@ These functions control how collisions are resolved. For example: - ``` xml + ```xml HKCU\Software\Microsoft\Office\9.0\PhotoDraw\ [MyPictures] @@ -2961,66 +1544,21 @@ These functions control how collisions are resolved. The FindFilePlaceByPattern function saves files with an incrementing counter when a collision occurs. It is a string that contains one of each constructs: <F>, <E>, <N> in any order. - Syntax: FindFilePlaceByPattern(*FilePattern*) - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

FilePattern

Yes

    -
  • <F> will be replaced by the original file name.

  • -
  • <N> will be replaced by an incrementing counter until there is no collision with the objects on the destination computer.

  • -
  • <E> will be replaced by the original file name extension.

  • -
-

For example, <F> (<N>).<E> will change the source file MyDocument.doc into MyDocument (1).doc on the destination computer.

- + Syntax: `FindFilePlaceByPattern(FilePattern)` + |Setting|Required?|Value| + |--- |--- |--- | + | *FilePattern* | Yes |
  • **<F>** will be replaced by the original file name.
  • **<N>** will be replaced by an incrementing counter until there is no collision with the objects on the destination computer.
  • **<E>** will be replaced by the original file name extension.

For example, ` ().` will change the source file MyDocument.doc into MyDocument (1).doc on the destination computer. | - **NewestVersion** The NewestVersion function will resolve conflicts on the destination computer based on the version of the file. - Syntax: NewestVersion(*VersionTag*) - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

VersionTag

Yes

The version field that will be checked. This can be "FileVersion" or "ProductVersion". The file with the highest VersionTag version determines which conflicts will be resolved based on the file's version. For example, if Myfile.txt contains FileVersion 1 and the same file on the destination computer contains FileVersion 2, the file on destination will remain.

- + Syntax: `NewestVersion(VersionTag)` + |Setting|Required?|Value| + |--- |--- |--- | + |*VersionTag*|Yes|The version field that will be checked. This can be "FileVersion" or "ProductVersion". The file with the highest *VersionTag* version determines which conflicts will be resolved based on the file's version. For example, if Myfile.txt contains FileVersion 1 and the same file on the destination computer contains FileVersion 2, the file on destination will remain.| - **HigherValue()** @@ -3036,7 +1574,7 @@ These functions control how collisions are resolved. For example: - ``` xml + ```xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Publisher [UpgradeVersion] @@ -3048,7 +1586,6 @@ These functions control how collisions are resolved. ## <migration> - The <migration> element is the single root element of a migration .xml file and is required. Each .xml file must have a unique migration urlid. The urlid of each file that you specify on the command line must be unique. This is because USMT uses the urlid to define the components within the file. For example, you must specify the following at the beginning of each file: <CustomFileName> is the name of the file; for example, "CustomApp". - **Number of occurrences:** one @@ -3061,83 +1598,34 @@ The <migration> element is the single root element of a migration .xml fil Syntax: -<migration urlid="UrlID/Name"> - -</migration> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

urlid

Yes

UrlID is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see Use XML Namespaces.

Name

No

Although not required, it is good practice to use the name of the .xml file.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|urlid|Yes|*UrlID* is a string identifier that uniquely identifies this .xml file. This parameter must be a no-colon-name as defined by the XML Namespaces specification. Each migration .xml file must have a unique urlid. If two migration .xml files have the same urlid, the second .xml file that is specified on the command line will not be processed. For more information about XML Namespaces, see [Use XML Namespaces](/previous-versions/windows/desktop/ms754539(v=vs.85)).| +|Name|No|Although not required, it is good practice to use the name of the .xml file.| The following example is from the MigApp.xml file: -``` xml +```xml ``` ## MigXMLHelper.FileProperties - This filter helper function can be used to filter the migration of files based on file size and date attributes. - ---- - - - - - - - - - - - - - - - - - - - - -
Helper FunctionMigXMLHelper.FileProperties (property, operator, valueToCompare)

Property

filesize, dateCreated, dateModified, dateAccessed

Operator

range, neq, lte, lt, eq, gte, gt

valueToCompare

The value we are comparing. For example:

-

Date: "2008/05/15-2005/05/17", "2008/05/15"

-

Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"

+|Helper Function|MigXMLHelper.FileProperties (property, operator, valueToCompare)| +|--- |--- | +|Property|filesize, dateCreated, dateModified, dateAccessed| +|Operator|range, neq, lte, lt, eq, gte, gt| +|valueToCompare|The value we are comparing. For example:
Date: "2008/05/15-2005/05/17", "2008/05/15"
Size: A numeral with B, KB, MB, or GB at the end. "5GB", "1KB-1MB"| - - -``` xml +```xml File_size @@ -3155,14 +1643,14 @@ This filter helper function can be used to filter the migration of files based o ## <namedElements> - You can use the **<namedElements>** element to define named elements. You can use these elements in any component throughout your .xml file. For an example of how to use this element, see the MigApp.xml file. Syntax: -<namedElements> - -</namedElements> +```xml + + +``` - **Number of occurrences:** Unlimited @@ -3174,7 +1662,6 @@ For an example of this element, see the MigApp.xml file. ## <object> - The <object> element represents a file or registry key. - **Number of occurrences:** Unlimited @@ -3187,13 +1674,14 @@ The <object> element represents a file or registry key. Syntax: -<object> - -</object> +```xml + + +``` The following example is from the MigApp.xml file: -``` xml +```xml %HklmWowSoftware%\Microsoft\Office\12.0\Common\Migration\Office [UpgradeVersion] @@ -3223,13 +1711,14 @@ The <objectSet> element contains a list of object patterns ; for example, Syntax: -<objectSet> - -</objectSet> +```xml + + +``` The following example is from the MigUser.xml file: -``` xml +```xml My Music @@ -3272,7 +1761,7 @@ This is an internal USMT element. Do not use this element. You can use this element to specify multiple objects. You can specify multiple <pattern> elements for each <objectSet> element and they will be combined. If you are specifying files, you may want to use GenerateDrivePatterns with <script> instead. GenerateDrivePatterns is basically the same as a <pattern> rule, without the drive letter specification. For example, the following two lines of code are similar: -``` xml +```xml C:\Folder\* [Sample.doc] ``` @@ -3285,63 +1774,26 @@ You can use this element to specify multiple objects. You can specify multiple & Syntax: -<pattern type="*typeID*">*Path* \[*object*\]</pattern> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

type

Yes

typeID can be Registry, File, or Ini. If typeId is Ini, then you cannot have a space between Path and object. For example, the following is correct when type="Ini":

-

<pattern type="Ini">%WinAmp5InstPath%\Winamp.ini|WinAmp[keeponscreen]</pattern>

Path [object]

Yes

A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.

-
    -
  • Path can contain the asterisk () wildcard character or can be an Recognized Environment Variables. You cannot use the question mark as a wildcard character.You can use HKCU and HKLM to refer to HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE respectively.

  • -
  • Object can contain the asterisk () wildcard character. However, you cannot use the question mark as a wildcard character. For example:

    -

    C:\Folder\ [] enumerates all files in C:<em>Path but no subfolders of C:\Folder.

    -

    C:\Folder* [] enumerates all files and subfolders of C:\Folder.

    -

    C:\Folder\ [*.mp3] enumerates all .mp3 files in C:\Folder.

    -

    C:\Folder\ [Sample.doc] enumerates only the Sample.doc file located in C:\Folder.

    -
    -Note

    If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

    -
    -
    - -
  • -
- +```xml +Path [object] +``` +|Setting|Required?|Value| +|--- |--- |--- | +| type | Yes | *typeID* can be Registry, File, or Ini. If *typeId* is Ini, then you cannot have a space between *Path* and *object*. For example, the following is correct when type="Ini":
**<pattern type="Ini">%WinAmp5InstPath%\Winamp.ini|WinAmp[keeponscreen]</pattern>** | +| *Path* [*object*] | Yes | A valid registry or file path pattern, followed by at least one space, followed by brackets [] that contain the object to be migrated.
  • *Path* can contain the asterisk (*) wildcard character or can be an [Recognized Environment Variables](usmt-recognized-environment-variables.md). You cannot use the question mark as a wildcard character.You can use HKCU and HKLM to refer to HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE respectively.
  • *Object* can contain the asterisk () wildcard character. However, you cannot use the question mark as a wildcard character. For example:
    **`C:\Folder\ [*]`** enumerates all files in C:<em>Path* but no subfolders of C:\Folder.
    **`C:\Folder* [*]`** enumerates all files and subfolders of C:\Folder.
    **`C:\Folder\ [*.mp3]`** enumerates all .mp3 files in C:\Folder.
    **`C:\Folder\ [Sample.doc]`** enumerates only the Sample.doc file located in C:\Folder.
    **Note**
    If you are migrating a file that has a square bracket character ([ or ]) in the file name, you must insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", you must specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`.
| For example: - To migrate a single registry key: - ``` xml + ```xml HKLM\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Cache [Persistent] ``` - To migrate the EngineeringDrafts folder and any subfolders from the C: drive: - ``` xml + ```xml C:\EngineeringDrafts\* [*] ``` @@ -3351,13 +1803,13 @@ For example: - To migrate the Sample.doc file from C:\\EngineeringDrafts: - ``` xml + ```xml C:\EngineeringDrafts\ [Sample.doc] ``` - To migrate the Sample.doc file from where ever it exists on the C: drive use pattern in the following way. If multiple files exist with the same name on the C: drive, then all of these files will be migrated. - ``` xml + ```xml C:\* [Sample.doc] ``` @@ -3365,7 +1817,6 @@ For example: ## <processing> - You can use this element to run a script during a specific point within the migration process. Return values are not expected from the scripts that you specify, and if there are return values, they will be ignored. - **Number of occurrences:** unlimited @@ -3376,50 +1827,21 @@ You can use this element to run a script during a specific point within the migr Syntax: -<processing when="pre-scan|scan-success|post-scan|pre-apply|apply-success|post-apply"> - -</processing> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

when

Yes

Indicates when the script should be run. This value can be one of the following:

-
    -
  • pre-scan means before the scanning process begins.

  • -
  • scan-success means after the scanning process has finished successfully.

  • -
  • post-scan means after the scanning process has finished, whether it was successful or not.

  • -
  • pre-apply means before the apply process begins.

  • -
  • apply-success means after the apply process has finished successfully.

  • -
  • post-apply means after the apply process has finished, whether it was successful or not.

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| when | Yes | Indicates when the script should be run. This value can be one of the following:
  • **pre-scan** means before the scanning process begins.
  • **scan-success** means after the scanning process has finished successfully.
  • **post-scan** means after the scanning process has finished, whether it was successful or not.
  • **pre-apply** means before the apply process begins.
  • **apply-success** means after the apply process has finished successfully.
  • **post-apply** means after the apply process has finished, whether it was successful or not.
| ## <plugin> - This is an internal USMT element. Do not use this element. ## <role> - The <role> element is required in a custom .xml file. By specifying the <role> element, you can create a concrete component. The component will be defined by the parameters specified at the <component> level, and with the role that you specify here. - **Number of occurrences:** Each <component> can have one, two or three child <role> elements. @@ -3432,58 +1854,18 @@ The <role> element is required in a custom .xml file. By specifying the &l Syntax: -<role role="Container|Binaries|Settings|Data"> - -</role> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

role

Yes

Defines the role for the component. Role can be one of:

-
    -
  • Container

  • -
  • Binaries

  • -
  • Settings

  • -
  • Data

  • -
-

You can either:

-
    -
  1. Specify up to three <role> elements within a <component> — one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.

  2. -
  3. Specify one "Container" <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:

  4. -
-
<component context="UserAndSystem" type="Application">
-  <displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName> 
-  <environment name="GlobalEnv" /> 
-  <role role="Container">
-    <detection name="AnyOffice2003Version" /> 
-    <detection name="FrontPage2003" /> 
-    <!-- 
- Office 2003 Common Settings 
-  --> 
-    <component context="UserAndSystem" type="Application">
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| role | Yes | Defines the role for the component. Role can be one of:
  • **Container**
  • **Binaries**
  • **Settings**
  • **Data**
You can either:
  1. Specify up to three <role> elements within a <component> — one "Binaries" role element, one "Settings" role element and one "Data" role element. These parameters do not change the migration behavior — their only purpose is to help you categorize the settings that you are migrating. You can nest these <role> elements, but each nested element must be of the same role parameter.
  2. Specify one "Container" <role> element within a <component> element. In this case, you cannot specify any child <rules> elements, only other <component> elements. And each child <component> element must have the same type as that of parent <component> element. For example:
<component context="UserAndSystem" type="Application"> 
<displayName _locID="migapp.msoffice2003">Microsoft Office 2003</displayName>
<environment name="GlobalEnv" />
<role role="Container">
<detection name="AnyOffice2003Version" />
<detection name="FrontPage2003" />
<!--
Office 2003 Common Settings
-->
<component context="UserAndSystem" type="Application">
| The following example is from the MigUser.xml file. For more examples, see the MigApp.xml file: -``` xml +```xml Start Menu @@ -3527,50 +1909,19 @@ The <rules> element is required in a custom .xml file. This element contai Syntax: -<rules name="*ID*" context="User|System|UserAndSystem"> - -</rules> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

name

Yes, when <rules> is a child to <namedElements>

-

No, when <rules> is a child to any other element

When ID is specified, any child elements are not processed. Instead, any other <rules> elements with the same name that are declared within <namedElements> are processed.

context

No

-

(default = UserAndSystem)

Defines the scope of this parameter — whether to process this component in the context of the specific user, across the entire operating system, or both.

-

The largest possible scope is set by the component element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If <rules> had a context of System, it would act as though <rules> was not there.

-
    -
  • User. Evaluates the variables for each user.

  • -
  • System. Evaluates the variables only once for the system.

  • -
  • UserAndSystem. Evaluates the variables for the entire operating system and each user.

  • -
- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +| name | Yes, when <rules> is a child to <namedElements>
No, when <rules> is a child to any other element | When *ID* is specified, any child elements are not processed. Instead, any other <rules> elements with the same name that are declared within <namedElements> are processed. | +| context | No
(default = UserAndSystem) | Defines the scope of this parameter — whether to process this component in the context of the specific user, across the entire operating system, or both.
The largest possible scope is set by the component element. For example, if a <component> element has a context of User and a <rules> element had a context of UserAndSystem, then the <rules> element would act as though it has a context of User. If <rules> had a context of System, it would act as though <rules> was not there.
  • **User.** Evaluates the variables for each user.
  • **System.** Evaluates the variables only once for the system.
  • **UserAndSystem.** Evaluates the variables for the entire operating system and each user.
| The following example is from the MigUser.xml file: -``` xml +```xml My Music @@ -3611,74 +1962,41 @@ The return value that is required by <script> depends on the parent elemen **Syntax and helper functions:** -- General Syntax: <script>*ScriptWithArguments*</script> +- General Syntax: `` - You can use [GetStringContent](#scriptfunctions) when <script> is within <variable>. - Syntax: <script>MigXmlHelper.GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*")</script> + Syntax: `` Example: `` - You can use [GenerateUserPatterns](#scriptfunctions) when <script> is within <objectSet>. - Syntax: <script>MigXmlHelper.GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*")</script> + Syntax: `` Example: `` - You can use [GenerateDrivePatterns](#scriptfunctions) when <script> is within <objectSet>. - Syntax: <script>MigXmlHelper.GenerateDrivePatterns("*PatternSegment*","*DriveType*")</script> + Syntax: `` Example: `` - You can use the [Simple executing scripts](#scriptfunctions) with <script> elements that are within <processing> elements: AskForLogoff, ConvertToShortFileName, KillExplorer, RemoveEmptyDirectories, RestartExplorer, RegisterFonts, StartService, StopService, SyncSCM. - Syntax: <script>MigXmlHelper.*ExecutingScript*</script> + Syntax: `` Example: `` - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

ScriptWithArguments

Yes

A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, MyScripts.AScript ("Arg1","Arg2").

-

The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.

-

The return value that is required by <script> depends on the parent element.

-
    -
  • When used within <variable>, the return value must be a string.

  • -
  • When used within <objectSet>, the return value must be a two-dimensional array of strings.

  • -
  • When used within <location>, the return value must be a valid location that aligns with the type attribute of <location>. For example, if <location type="File">, the child script element, if specified, must be a valid file location.

    -
    -Note

    If you are migrating a file that has a bracket character ([ or ]) in the file name, insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", specify <pattern type="File">c:\documents\mydocs [file^].txt]</pattern> instead of <pattern type="File">c:\documents\mydocs [file].txt]</pattern>.

    -
    -
    - -
  • -
- - +|Setting|Required?|Value| +|--- |--- |--- | +| *ScriptWithArguments* | Yes | A script followed by any number of string arguments that are separated by a comma and enclosed in parenthesis. For example, `MyScripts.AScript ("Arg1","Arg2")`.
The script will be called for each object that is enumerated by the object sets in the <include> rule. The filter script returns a Boolean value. If the return value is TRUE, the object will be migrated. If it is FALSE, it will not be migrated.
The return value that is required by <script> depends on the parent element.
  • When used within <variable>, the return value must be a string.
  • When used within <objectSet>, the return value must be a two-dimensional array of strings.
  • When used within <location>, the return value must be a valid location that aligns with the type attribute of <location>. For example, if <location type="File">, the child script element, if specified, must be a valid file location.
    **Note**
    If you are migrating a file that has a bracket character ([ or ]) in the file name, insert the carrot (^) character directly before the bracket for it to be valid. For example, if there is a file named "file].txt", specify `c:\documents\mydocs [file^].txt]` instead of `c:\documents\mydocs [file].txt]`.
| Examples: To migrate the Sample.doc file from any drive on the source computer, use <script> as follows. If multiple files exist with the same name, all such files will get migrated. -``` xml +```xml ``` @@ -3700,100 +2018,34 @@ These functions return either a string or a pattern. You can use GetStringContent with <script> elements that are within <variable> elements. If possible, this function returns the string representation of the given object. Otherwise, it returns NULL. For file objects this function always returns NULL. - Syntax: GetStringContent("*ObjectType*","*EncodedLocationPattern*", "*ExpandContent*") + Syntax: `GetStringContent("ObjectType","EncodedLocationPattern", "ExpandContent")` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType

Yes

The type of object. Can be Registry or Ini (for an .ini file).

EncodedLocationPattern

Yes

    -
  • If type of object is Registry, EncodedLocationPattern must be a valid registry path. For example, HKLM\SOFTWARE\MyKey[].

  • -
  • If the type of object is Ini, then EncodedLocationPattern must be in the following format:

    -

    IniFilePath|SectionName[SettingName]

  • -

ExpandContent

No (default=TRUE)

Can be TRUE or FALSE. If FALSE, then the given location will not be expanded before it is returned.

+ |Setting|Required?|Value| + |--- |--- |--- | + | *ObjectType* | Yes | The type of object. Can be Registry or Ini (for an .ini file). | + | *EncodedLocationPattern* | Yes |
  • If type of object is Registry, EncodedLocationPattern must be a valid registry path. For example, HKLM\SOFTWARE\MyKey[].
  • If the type of object is Ini, then EncodedLocationPattern must be in the following format:
    IniFilePath|SectionName[SettingName]
| + | *ExpandContent* | No (default=TRUE) | Can be TRUE or FALSE. If FALSE, then the given location will not be expanded before it is returned. | + For example: - -~~~ -For example: - -``` xml - - - -``` -~~~ + ```xml + + + + ``` - **GenerateDrivePatterns** The GenerateDrivePatterns function will iterate all of the available drives and select the ones that match the requested drive type. It will then concatenate the selected drives with the end part of *PatternSegment* to form a full encoded file pattern. For example, if *PatternSegment* is `Path [file.txt]` and DriveType is `Fixed`, then the function will generate `C:\Path [file.txt]`, and other patterns if there are fixed drives other than C:. You cannot specify environment variables with this function. You can use GenerateDrivePatterns with <script> elements that are within [<objectSet>](#objectset) that are within <include>/<exclude>. - Syntax: GenerateDrivePatterns("*PatternSegment*","*DriveType*") + Syntax: `GenerateDrivePatterns("PatternSegment","DriveType")` - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

PatternSegment

Yes

The suffix of an encoded pattern. It will be concatenated with a drive specification, such as "c:&quot;, to form a complete encoded file pattern. For example, "* [*.doc]". PatternSegment cannot be an environment variable.

DriveType

Yes

The drive type for which the patterns are to be generated. You can specify one of:

-
    -
  • Fixed

  • -
  • CDROM

  • -
  • Removable

  • -
  • Remote

  • -
+ |Setting|Required?|Value| + |--- |--- |--- | + | *PatternSegment* | Yes | The suffix of an encoded pattern. It will be concatenated with a drive specification, such as "c:", to form a complete [encoded file pattern](#locations). For example, "* [*.doc]". *PatternSegment* cannot be an environment variable. | + | *DriveType* | Yes | The drive type for which the patterns are to be generated. You can specify one of:
  • Fixed
  • CDROM
  • Removable
  • Remote
| - - -~~~ -See the last component in the MigUser.xml file for an example of this element. -~~~ + See the last component in the MigUser.xml file for an example of this element. - **GenerateUserPatterns** @@ -3805,50 +2057,21 @@ See the last component in the MigUser.xml file for an example of this element. - "C:\\Documents and Settings\\C\\\* \[\*.doc\]" - Syntax:GenerateUserPatterns("*ObjectType*","*EncodedLocationPattern*","*ProcessCurrentUser*") + Syntax: `GenerateUserPatterns("ObjectType","EncodedLocationPattern","ProcessCurrentUser")` - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ObjectType

Yes

Defines the object type. Can be File or Registry.

EncodedLocationPattern

Yes

The location pattern. Environment variables are allowed.

ProcessCurrentUser

Yes

Can be TRUE or FALSE. Indicates if the patterns should be generated for the current user.

+ |Setting|Required?|Value| + |--- |--- |--- | + |*ObjectType*|Yes|Defines the object type. Can be File or Registry.| + |*EncodedLocationPattern*|Yes|The [location pattern](#locations). Environment variables are allowed.| + |*ProcessCurrentUser*|Yes|Can be TRUE or FALSE. Indicates if the patterns should be generated for the current user.| - - -~~~ **Example:** If GenerateUserPattens('File','%userprofile% \[\*.doc\]','FALSE') is called while USMT is processing user A, then this function will only generate patterns for users B and C. You can use this helper function to build complex rules. For example, to migrate all .doc files from the source computer — but if user X is not migrated, then do not migrate any of the .doc files from user X's profile. The following is example code for this scenario. The first <rules> element migrates all.doc files on the source computer with the exception of those inside C:\\Documents and Settings. The second <rules> elements will migrate all .doc files from C:\\Documents and Settings with the exception of the .doc files in the profiles of the other users. Because the second <rules> element will be processed in each migrated user context, the end result will be the desired behavior. The end result is the one we expected. -``` xml +```xml @@ -3874,47 +2097,18 @@ The following is example code for this scenario. The first <rules> element ``` -~~~ ### MigXmlHelper.GenerateDocPatterns This helper function invokes the document finder to scan the system for all files that can be migrated. It can be invoked in either System or User context to focus the scan. - ----- - - - - - - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

ScanProgramFiles

No (default = FALSE)

Can be TRUE or FALSE. The ScanProgramFiles parameter determines whether or not the document finder scans the Program Files directory to gather registered file extensions for known applications. For example, when set to TRUE it will discover and migrate .jpg files under the Photoshop directory, if .jpg is a file extension registered to Photoshop.

IncludePatterns

No (default = TRUE)

Can be TRUE or FALSE. TRUE will generate include patterns and can be added under the <include> element. FALSE will generate exclude patterns and can be added under the <exclude> element.

SystemDrive

No (default = FALSE)

Can be TRUE or FALSE. If TRUE, restricts all patterns to the system drive.

+|Setting|Required?|Value| +|--- |--- |--- | +|*ScanProgramFiles*|No (default = FALSE)|Can be TRUE or FALSE. The *ScanProgramFiles* parameter determines whether or not the document finder scans the **Program Files** directory to gather registered file extensions for known applications. For example, when set to TRUE it will discover and migrate .jpg files under the Photoshop directory, if .jpg is a file extension registered to Photoshop.| +|*IncludePatterns*|No (default = TRUE)|Can be TRUE or FALSE. TRUE will generate include patterns and can be added under the <include> element. FALSE will generate exclude patterns and can be added under the <exclude> element.| +|*SystemDrive*|No (default = FALSE)|Can be TRUE or FALSE. If TRUE, restricts all patterns to the system drive.| - - -``` xml +```xml MigDocUser @@ -3941,39 +2135,39 @@ The following scripts have no return value. You can use the following errors wit - **AskForLogoff()**. Prompts the user to log off at the end of the migration. For example: - ``` xml - - - - ``` + ```xml + + + + ``` - **ConvertToShortFileName(RegistryEncodedLocation)**. If *RegistryEncodedLocation* is the full path of an existing file, this function will convert the file to its short file name and then it will update the registry value. - **KillExplorer()**. Stops Explorer.exe for the current user context. This allows access to certain keys and files that are kept open when Explorer.exe is running. For example: - ``` xml - - - - ``` + ```xml + + + + ``` - **RegisterFonts(FileEncodedLocation)**. Registers the given font or all of the fonts in the given directory. For example: - ``` xml - + ```xml + - - ``` + + ``` - **RemoveEmptyDirectories (DirectoryEncodedPattern).** Deletes any empty directories that match *DirectoryEncodedPattern* on the destination computer. - **RestartExplorer().** Restarts Explorer.exe at the end of the migration. For example: - ``` xml - - - - ``` + ```xml + + + + ``` - **StartService (ServiceName, OptionalParam1, OptionalParam2,…).** Starts the service identified by *ServiceName. ServiceName* is the subkey in HKLM\\System\\CurrentControlSet\\Services that holds the data for the given service. The optional parameters, if any, will be passed to the StartService API. For more information, see [this Microsoft Web site](/windows/win32/api/winsvc/nf-winsvc-startservicea). @@ -3994,32 +2188,17 @@ You can use the <text> element to set a value for any environment variable Syntax: -<text>*NormalText*</text> - - ---- - - - - - - - - - - - - -
SettingValue

NormalText

This is interpreted as normal text.

- +```xml +NormalText +``` +|Setting|Value| +|--- |--- | +|*NormalText*|This is interpreted as normal text.| For example: -``` xml +```xml %CSIDL_COMMON_APPDATA%\QuickTime @@ -4040,11 +2219,13 @@ Use this element if you want to exclude all .mp3 files from the source computer. Syntax: -<unconditionalExclude></unconditionalExclude> +```xml + +``` The following .xml file excludes all .mp3 files from migration. For additional examples of how to use this element, see the [Exclude Files and Settings](usmt-exclude-files-and-settings.md). -``` xml +```xml Test @@ -4080,42 +2261,19 @@ The <variable> element is required in an <environment> element. For Syntax: -<variable name="*ID*" remap=TRUE|FALSE> - -</variable> - - ----- - - - - - - - - - - - - - - - - - - - -
SettingRequired?Value

name

Yes

ID is a string value that is the name used to reference the environment variable. We recommend that ID start with the component's name to avoid namespace collisions. For example, if your component's name is MyComponent, and you want a variable that is your component's install path, you could specify MyComponent.InstallPath.

remap

No, default = FALSE

Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable's value are automatically moved to where the environment variable points on the destination computer.

- +```xml + + +``` +|Setting|Required?|Value| +|--- |--- |--- | +|name|Yes|*ID* is a string value that is the name used to reference the environment variable. We recommend that *ID* start with the component's name to avoid namespace collisions. For example, if your component's name is MyComponent, and you want a variable that is your component's install path, you could specify `MyComponent.InstallPath`.| +|remap|No, default = FALSE|Specifies whether to evaluate this environment variable as a remapping environment variable. Objects that are located in a path that is underneath this environment variable's value are automatically moved to where the environment variable points on the destination computer.| The following example is from the MigApp.xml file: -``` xml +```xml HKLM\Software @@ -4139,46 +2297,26 @@ The <version> element defines the version for the component, but does not Syntax: -<version>*ComponentVersion*</version> - - ----- - - - - - - - - - - - - - - -
SettingRequired?Value

ComponentVersion

Yes

The version of the component, which can contain patterns.

- +```xml +ComponentVersion +``` +|Setting|Required?|Value| +|--- |--- |--- | +|*ComponentVersion*|Yes|The version of the component, which can contain patterns.| For example: -``` xml +```xml 4.* ``` ## <windowsObjects> - The <windowsObjects> element is for USMT internal use only. Do not use this element. ## Appendix - ### Specifying locations - **Specifying encoded locations**. The encoded location used in all of the helper functions is an unambiguous string representation for the name of an object. It is composed of the node part, optionally followed by the leaf enclosed in square brackets. This makes a clear distinction between nodes and leaves. @@ -4249,5 +2387,4 @@ The following version tags contain values that can be compared: ## Related topics - -[USMT XML Reference](usmt-xml-reference.md) \ No newline at end of file +[USMT XML Reference](usmt-xml-reference.md) diff --git a/windows/deployment/usmt/usmt-xml-reference.md b/windows/deployment/usmt/usmt-xml-reference.md index ec943180e6..a6df44e4a8 100644 --- a/windows/deployment/usmt/usmt-xml-reference.md +++ b/windows/deployment/usmt/usmt-xml-reference.md @@ -16,64 +16,18 @@ ms.topic: article # USMT XML Reference - This section contains topics that you can use to work with and to customize the migration XML files. ## In This Section - - ---- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

Understanding Migration XML Files

Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.

Config.xml File

Describes the Config.xml file and policies concerning its configuration.

Customize USMT XML Files

Describes how to customize USMT XML files.

Custom XML Examples

Gives examples of XML files for various migration scenarios.

Conflicts and Precedence

Describes the precedence of migration rules and how conflicts are handled.

General Conventions

Describes the XML helper functions.

XML File Requirements

Describes the requirements for custom XML files.

Recognized Environment Variables

Describes environment variables recognized by USMT.

XML Elements Library

Describes the XML elements and helper functions for authoring migration XML files to use with USMT.

- - - - - - - - - - - +| Link | Description | +|--- |--- | +|[Understanding Migration XML Files](understanding-migration-xml-files.md)|Provides an overview of the default and custom migration XML files and includes guidelines for creating and editing a customized version of the MigDocs.xml file.| +|[Config.xml File](usmt-configxml-file.md)|Describes the Config.xml file and policies concerning its configuration.| +|[Customize USMT XML Files](usmt-customize-xml-files.md)|Describes how to customize USMT XML files.| +|[Custom XML Examples](usmt-custom-xml-examples.md)|Gives examples of XML files for various migration scenarios.| +|[Conflicts and Precedence](usmt-conflicts-and-precedence.md)|Describes the precedence of migration rules and how conflicts are handled.| +|[General Conventions](usmt-general-conventions.md)|Describes the XML helper functions.| +|[XML File Requirements](xml-file-requirements.md)|Describes the requirements for custom XML files.| +|[Recognized Environment Variables](usmt-recognized-environment-variables.md)|Describes environment variables recognized by USMT.| +|[XML Elements Library](usmt-xml-elements-library.md)|Describes the XML elements and helper functions for authoring migration XML files to use with USMT.| diff --git a/windows/privacy/Microsoft-DiagnosticDataViewer.md b/windows/privacy/Microsoft-DiagnosticDataViewer.md index 32ba2bc16a..8b2b1f883d 100644 --- a/windows/privacy/Microsoft-DiagnosticDataViewer.md +++ b/windows/privacy/Microsoft-DiagnosticDataViewer.md @@ -2,7 +2,7 @@ title: Diagnostic Data Viewer for PowerShell Overview (Windows 10) description: Use this article to use the Diagnostic Data Viewer for PowerShell to review the diagnostic data sent to Microsoft by your device. keywords: privacy -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -13,8 +13,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 01/17/2018 +ms.date: 11/29/2021 ms.reviewer: +ms.technology: privacy --- # Diagnostic Data Viewer for PowerShell Overview diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md index a2c09c70c3..092765080d 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1703.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. title: Windows 10, version 1703 basic diagnostic events and fields (Windows 10) keywords: privacy, telemetry -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -12,9 +12,10 @@ ms.author: brianlic manager: dansimp ms.collection: M365-security-compliance ms.topic: article +ms.date: 11/29/2021 audience: ITPro -ms.date: ms.reviewer: +ms.technology: privacy --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md index 2c105c0127..3c8ba7c332 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1709.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. title: Windows 10, version 1709 basic diagnostic events and fields (Windows 10) keywords: privacy, telemetry -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ ms.topic: article audience: ITPro ms.date: ms.reviewer: +ms.technology: privacy --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md index 89feae1164..fd5ad905a1 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1803.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. title: Windows 10, version 1803 basic diagnostic events and fields (Windows 10) keywords: privacy, telemetry -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ ms.topic: article audience: ITPro ms.date: ms.reviewer: +ms.technology: privacy --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md index e170e13dbe..9b705e998d 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1809.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. title: Windows 10, version 1809 basic diagnostic events and fields (Windows 10) keywords: privacy, telemetry -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -15,6 +15,7 @@ ms.topic: article audience: ITPro ms.date: ms.reviewer: +ms.technology: privacy --- diff --git a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md index 7cd176eb53..1e9eb3a8f7 100644 --- a/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md +++ b/windows/privacy/basic-level-windows-diagnostic-events-and-fields-1903.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what required Windows diagnostic data is gathered. title: Windows 10, version 1909 and Windows 10, version 1903 required diagnostic events and fields (Windows 10) keywords: privacy, telemetry -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -14,6 +14,7 @@ ms.collection: M365-security-compliance ms.topic: article audience: ITPro ms.date: +ms.technology: privacy --- diff --git a/windows/privacy/changes-to-windows-diagnostic-data-collection.md b/windows/privacy/changes-to-windows-diagnostic-data-collection.md index af05ed7135..50f081e04a 100644 --- a/windows/privacy/changes-to-windows-diagnostic-data-collection.md +++ b/windows/privacy/changes-to-windows-diagnostic-data-collection.md @@ -2,7 +2,7 @@ title: Changes to Windows diagnostic data collection description: This article provides information on changes to Windows diagnostic data collection Windows 10 and Windows 11. keywords: privacy, diagnostic data -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -13,7 +13,8 @@ author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- # Changes to Windows diagnostic data collection diff --git a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md index 5e2e41f1a3..5c614eaed1 100644 --- a/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md +++ b/windows/privacy/configure-windows-diagnostic-data-in-your-organization.md @@ -2,7 +2,7 @@ description: Use this article to make informed decisions about how you can configure Windows diagnostic data in your organization. title: Configure Windows diagnostic data in your organization (Windows 10 and Windows 11) keywords: privacy -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -15,7 +15,8 @@ ms.collection: - M365-security-compliance - highpri ms.topic: article -ms.date: 10/04/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- # Configure Windows diagnostic data in your organization diff --git a/windows/privacy/diagnostic-data-viewer-overview.md b/windows/privacy/diagnostic-data-viewer-overview.md index 1a9cf79059..adf1997249 100644 --- a/windows/privacy/diagnostic-data-viewer-overview.md +++ b/windows/privacy/diagnostic-data-viewer-overview.md @@ -2,7 +2,7 @@ title: Diagnostic Data Viewer Overview (Windows 10 and Windows 11) description: Use this article to use the Diagnostic Data Viewer application to review the diagnostic data sent to Microsoft by your device. keywords: privacy -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -15,8 +15,9 @@ ms.collection: - M365-security-compliance - highpri ms.topic: article -ms.date: 01/17/2018 -ms.reviewer: +ms.date: 11/29/2021 +ms.reviewer: +ms.technology: privacy --- # Diagnostic Data Viewer Overview diff --git a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md index 4188fd5ad3..fa3ce2c285 100644 --- a/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md +++ b/windows/privacy/enhanced-diagnostic-data-windows-analytics-events-and-fields.md @@ -2,7 +2,7 @@ title: Enhanced diagnostic data required by Windows Analytics (Windows 10) description: Use this article to learn more about the limit enhanced diagnostic data events policy used by Desktop Analytics keywords: privacy, diagnostic data -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -13,8 +13,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/9/2018 -ms.reviewer: +ms.date: 11/29/2021 +ms.reviewer: +ms.technology: privacy --- diff --git a/windows/privacy/essential-services-and-connected-experiences.md b/windows/privacy/essential-services-and-connected-experiences.md index 6ead597184..eceb613db4 100644 --- a/windows/privacy/essential-services-and-connected-experiences.md +++ b/windows/privacy/essential-services-and-connected-experiences.md @@ -2,7 +2,7 @@ title: Essential services and connected experiences for Windows description: Explains what the essential services and connected experiences are for Windows keywords: privacy, manage connections to Microsoft -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -10,8 +10,10 @@ audience: ITPro author: siosulli ms.author: dansimp manager: dansimp +ms.technology: privacy ms.date: 11/24/2021 ms.collection: highpri + --- # Essential services and connected experiences for Windows diff --git a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md index 3fde86eb4c..76f46a090b 100644 --- a/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md +++ b/windows/privacy/license-terms-windows-diagnostic-data-for-powershell.md @@ -2,7 +2,7 @@ title: MICROSOFT WINDOWS DIAGNOSTIC DATA FOR POWERSHELL description: MICROSOFT SOFTWARE LICENSE TERMS keywords: privacy, license, terms -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -13,9 +13,10 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 11/16/2018 +ms.date: 11/29/2021 ms.reviewer: robots: noindex,nofollow +ms.technology: privacy --- # Microsoft Windows diagnostic data for PowerShell license terms @@ -24,13 +25,13 @@ MICROSOFT SOFTWARE LICENSE TERMS MICROSOFT WINDOWS DIAGNOSTIC DATA FOR POWERSHELL -These license terms are an agreement between you and Microsoft Corporation (or one of its affiliates). They apply to the software named above and any Microsoft services or software updates (except to the extent such services or updates are accompanied by new or additional terms, in which case those different terms apply prospectively and do not alter your or Microsoft’s rights relating to pre-updated software or services). IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. +These license terms are an agreement between you and Microsoft Corporation (or one of its affiliates). They apply to the software named above and any Microsoft services or software updates (except to the extent such services or updates are accompanied by new or another terms, in which case those different terms apply prospectively and don't alter your or Microsoft’s rights relating to pre-updated software or services). IF YOU COMPLY WITH THESE LICENSE TERMS, YOU HAVE THE RIGHTS BELOW. BY USING THE SOFTWARE, YOU ACCEPT THESE TERMS. 1. INSTALLATION AND USE RIGHTS. a) General. You may install and use any number of copies of the software. -b) Third Party Software. The software may include third party applications that Microsoft, not the third party, licenses to you under this agreement. Any included notices for third party applications are for your information only. +b) Third-Party Software. The software may include third-party applications that Microsoft, not the third party, licenses to you under this agreement. Any included notices for third-party applications are for your information only. 2. DATA COLLECTION. The software may collect information about you and your use of the software and send that to Microsoft. Microsoft may use this information to provide services and improve Microsoft’s products and services. Your opt-out rights, if any, are described in the product documentation. Some features in the software may enable collection of data from users of your applications that access or use the software. If you use these features to enable data collection in your applications, you must comply with applicable law, including getting any required user consent, and maintain a prominent privacy policy that accurately informs users about how you use, collect, and share their data. You can learn more about Microsoft’s data collection and use in the product documentation and the Microsoft Privacy Statement at https://go.microsoft.com/fwlink/?LinkId=512132. You agree to comply with all applicable provisions of the Microsoft Privacy Statement. @@ -38,7 +39,7 @@ b) Third Party Software. The software may include third party applications that a) work around any technical limitations in the software that only allow you to use it in certain ways; -b) reverse engineer, decompile or disassemble the software; +b) reverse engineer, decompile, or disassemble the software; c) remove, minimize, block, or modify any notices of Microsoft or its suppliers in the software; @@ -46,7 +47,9 @@ d) use the software in any way that is against the law or to create or propagate e) share, publish, distribute, or lend the software, provide the software as a stand-alone hosted solution for others to use, or transfer the software or this agreement to any third party. -4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. For further information on export restrictions, visit https://aka.ms/exporting. +4. EXPORT RESTRICTIONS. You must comply with all domestic and international export laws and regulations that apply to the software, which include restrictions on destinations, end users, and end use. + + For further information on export restrictions, visit https://aka.ms/exporting. 5. SUPPORT SERVICES. Microsoft is not obligated under this agreement to provide any support services for the software. Any support provided is “as is”, “with all faults”, and without warranty of any kind. @@ -58,13 +61,13 @@ e) share, publish, distribute, or lend the software, provide the software as a s a) Australia. You have statutory guarantees under the Australian Consumer Law and nothing in this agreement is intended to affect those rights. -b) Canada. If you acquired this software in Canada, you may stop receiving updates by turning off the automatic update feature, disconnecting your device from the Internet (if and when you re-connect to the Internet, however, the software will resume checking for and installing updates), or uninstalling the software. The product documentation, if any, may also specify how to turn off updates for your specific device or software. +b) Canada. If you acquired this software in Canada, you may stop receiving updates by turning off the automatic update feature, disconnecting your device from the Internet (if and when you reconnect to the Internet, however, the software will resume checking for and installing updates), or uninstalling the software. The product documentation, if any, may also specify how to turn off updates for your specific device or software. c) Germany and Austria. i. Warranty. The properly licensed software will perform substantially as described in any Microsoft materials that accompany the software. However, Microsoft gives no contractual guarantee in relation to the licensed software. -ii. Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, as well as, in case of death or personal or physical injury, Microsoft is liable according to the statutory law. +ii. Limitation of Liability. In case of intentional conduct, gross negligence, claims based on the Product Liability Act, and, in case of death or personal or physical injury, Microsoft is liable according to the statutory law. Subject to the foregoing clause ii., Microsoft will only be liable for slight negligence if Microsoft is in breach of such material contractual obligations, the fulfillment of which facilitate the due performance of this agreement, the breach of which would endanger the purpose of this agreement and the compliance with which a party may constantly trust in (so-called "cardinal obligations"). In other cases of slight negligence, Microsoft will not be liable for slight negligence. @@ -72,13 +75,13 @@ Subject to the foregoing clause ii., Microsoft will only be liable for slight ne 10. LIMITATION ON AND EXCLUSION OF DAMAGES. IF YOU HAVE ANY BASIS FOR RECOVERING DAMAGES DESPITE THE PRECEDING DISCLAIMER OF WARRANTY, YOU CAN RECOVER FROM MICROSOFT AND ITS SUPPLIERS ONLY DIRECT DAMAGES UP TO U.S. $5.00. YOU CANNOT RECOVER ANY OTHER DAMAGES, INCLUDING CONSEQUENTIAL, LOST PROFITS, SPECIAL, INDIRECT OR INCIDENTAL DAMAGES. -This limitation applies to (a) anything related to the software, services, content (including code) on third party Internet sites, or third party applications; and (b) claims for breach of contract, warranty, guarantee, or condition; strict liability, negligence, or other tort; or any other claim; in each case to the extent permitted by applicable law. +This limitation applies to (a) anything related to the software, services, content (including code) on third-party Internet sites, or third-party applications; and (b) claims for breach of contract, warranty, guarantee, or condition; strict liability, negligence, or other tort; or any other claim; in each case to the extent permitted by applicable law. It also applies even if Microsoft knew or should have known about the possibility of the damages. The above limitation or exclusion may not apply to you because your state, province, or country may not allow the exclusion or limitation of incidental, consequential, or other damages. -Please note: As this software is distributed in Canada, some of the clauses in this agreement are provided below in French. +Note that as this software is distributed in Canada, some of the clauses in this agreement are provided below in French. Remarque: Ce logiciel étant distribué au Canada, certaines des clauses dans ce contrat sont fournies ci-dessous en français. diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md index 482413653a..0435dbbf12 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services-using-MDM.md @@ -3,15 +3,16 @@ title: Manage connections from Windows operating system components to Microsoft description: Use MDM CSPs to minimize connections from Windows to Microsoft services, or to configure particular privacy settings. ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 keywords: privacy, manage connections to Microsoft, Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro -author: robsize +author: siosulli ms.author: dansimp -manager: robsize -ms.date: 12/1/2020 +manager: dansimp +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services using Microsoft Intune MDM Server diff --git a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md index 768ea3d4e6..ee509f813a 100644 --- a/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md +++ b/windows/privacy/manage-connections-from-windows-operating-system-components-to-microsoft-services.md @@ -4,7 +4,7 @@ description: Learn how to minimize connections from Windows to Microsoft service ms.assetid: ACCEB0DD-BC6F-41B1-B359-140B242183D9 ms.reviewer: keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -16,7 +16,8 @@ ms.collection: - M365-security-compliance - highpri ms.topic: article -ms.date: 5/21/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connections from Windows 10 and Windows 11 operating system components to Microsoft services diff --git a/windows/privacy/manage-windows-11-endpoints.md b/windows/privacy/manage-windows-11-endpoints.md index 1e45080fea..93a3b38255 100644 --- a/windows/privacy/manage-windows-11-endpoints.md +++ b/windows/privacy/manage-windows-11-endpoints.md @@ -2,19 +2,18 @@ title: Connection endpoints for Windows 11 Enterprise description: Explains what Windows 11 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 11. keywords: privacy, manage connections to Microsoft, Windows 11 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize -ms.collection: - - M365-security-compliance - - highpri +manager: dansimp +ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 11 Enterprise diff --git a/windows/privacy/manage-windows-1709-endpoints.md b/windows/privacy/manage-windows-1709-endpoints.md index 8c9ec8ec64..68e5185b57 100644 --- a/windows/privacy/manage-windows-1709-endpoints.md +++ b/windows/privacy/manage-windows-1709-endpoints.md @@ -2,7 +2,7 @@ title: Connection endpoints for Windows 10 Enterprise, version 1709 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1709. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 6/26/2018 -ms.reviewer: +ms.date: 11/29/2021 +ms.reviewer: +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 1709 diff --git a/windows/privacy/manage-windows-1803-endpoints.md b/windows/privacy/manage-windows-1803-endpoints.md index 88aab3a7f9..6dd29f8f5e 100644 --- a/windows/privacy/manage-windows-1803-endpoints.md +++ b/windows/privacy/manage-windows-1803-endpoints.md @@ -2,7 +2,7 @@ title: Connection endpoints for Windows 10, version 1803 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1803. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,9 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 6/26/2018 -ms.reviewer: +ms.date: 11/29/2021 +ms.reviewer: +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 1803 @@ -40,7 +41,7 @@ We used the following methodology to derive these network endpoints: 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. +6. All traffic was captured in our lab using an IPV4 network. Therefore no IPV6 traffic is reported here. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. diff --git a/windows/privacy/manage-windows-1809-endpoints.md b/windows/privacy/manage-windows-1809-endpoints.md index eb5e4f6104..f2b61aed53 100644 --- a/windows/privacy/manage-windows-1809-endpoints.md +++ b/windows/privacy/manage-windows-1809-endpoints.md @@ -2,7 +2,7 @@ title: Connection endpoints for Windows 10, version 1809 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1809. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,8 +12,10 @@ ms.author: dansimp manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 6/26/2018 +ms.date: 11/29/2021 ms.reviewer: +ms.technology: privacy + --- # Manage connection endpoints for Windows 10 Enterprise, version 1809 @@ -41,7 +43,7 @@ We used the following methodology to derive these network endpoints: 3. Use globally accepted network protocol analyzer/capturing tools and log all background egress traffic. 4. Compile reports on traffic going to public IP addresses. 5. The test virtual machine was logged in using a local account and was not joined to a domain or Azure Active Directory. -6. All traffic was captured in our lab using a IPV4 network. Therefore no IPV6 traffic is reported here. +6. All traffic was captured in our lab using an IPV4 network. Therefore no IPV6 traffic is reported here. > [!NOTE] > Microsoft uses global load balancers that can appear in network trace-routes. For example, an endpoint for *.akadns.net might be used to load balance requests to an Azure datacenter, which can change over time. @@ -340,7 +342,7 @@ The following endpoint is OfficeHub traffic used to get the metadata of Office a |:--------------:|:--------:|:------------| |Windows Apps\Microsoft.Windows.Photos|HTTPS| `client-office365-tas.msedge.net` | -The following endpoint is used to connect the Office To-Do app to it's cloud service. +The following endpoint is used to connect the Office To-Do app to its cloud service. To turn off traffic for this endpoint, either uninstall the app or [disable the Microsoft Store](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-windowsstore). | Source process | Protocol | Destination | @@ -424,7 +426,7 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op ## Windows Spotlight -The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, as well as suggested apps, Microsoft account notifications, and Windows tips. +The following endpoints are used to retrieve Windows Spotlight metadata that describes content, such as references to image locations, and suggested apps, Microsoft account notifications, and Windows tips. If you [turn off traffic for these endpoints](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-spotlight), Windows Spotlight will still try to deliver new lock screen images and updated content but it will fail; suggested apps, Microsoft account notifications, and Windows tips will not be downloaded. For more information, see [Windows Spotlight](/windows/configuration/windows-spotlight). | Source process | Protocol | Destination | @@ -438,7 +440,7 @@ If you [turn off traffic for these endpoints](manage-connections-from-windows-op ## Windows Update The following endpoint is used for Windows Update downloads of apps and OS updates, including HTTP downloads or HTTP downloads blended with peers. -If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates), Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in re-downloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction. +If you [turn off traffic for this endpoint](manage-connections-from-windows-operating-system-components-to-microsoft-services.md#bkmk-updates), Windows Update downloads will not be managed, as critical metadata that is used to make downloads more resilient is blocked. Downloads may be impacted by corruption (resulting in redownloads of full files). Additionally, downloads of the same update by multiple devices on the same local network will not use peer devices for bandwidth reduction. | Source process | Protocol | Destination | |:--------------:|:--------:|:------------| diff --git a/windows/privacy/manage-windows-1903-endpoints.md b/windows/privacy/manage-windows-1903-endpoints.md index 6045eb3da4..f4254b905d 100644 --- a/windows/privacy/manage-windows-1903-endpoints.md +++ b/windows/privacy/manage-windows-1903-endpoints.md @@ -2,17 +2,18 @@ title: Connection endpoints for Windows 10 Enterprise, version 1903 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1903. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: linque1 ms.author: obezeajo -manager: robsize +manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 7/22/2020 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 1903 diff --git a/windows/privacy/manage-windows-1909-endpoints.md b/windows/privacy/manage-windows-1909-endpoints.md index 5ef89fdb59..4209d8bafd 100644 --- a/windows/privacy/manage-windows-1909-endpoints.md +++ b/windows/privacy/manage-windows-1909-endpoints.md @@ -2,7 +2,7 @@ title: Connection endpoints for Windows 10 Enterprise, version 1909 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 1909. keywords: privacy, manage connections to Microsoft, Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high @@ -12,7 +12,8 @@ ms.author: v-hakima manager: obezeajo ms.collection: M365-security-compliance ms.topic: article -ms.date: 7/22/2020 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 1909 diff --git a/windows/privacy/manage-windows-2004-endpoints.md b/windows/privacy/manage-windows-2004-endpoints.md index 6e2d31cd9a..f701bc0e8d 100644 --- a/windows/privacy/manage-windows-2004-endpoints.md +++ b/windows/privacy/manage-windows-2004-endpoints.md @@ -2,17 +2,18 @@ title: Connection endpoints for Windows 10 Enterprise, version 2004 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 2004. keywords: privacy, manage connections to Microsoft, Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: linque1 -ms.author: robsize -manager: robsize +ms.author: siosulli +manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/22/2020 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 2004 diff --git a/windows/privacy/manage-windows-20H2-endpoints.md b/windows/privacy/manage-windows-20H2-endpoints.md index 4378cb0b1d..9e953d592b 100644 --- a/windows/privacy/manage-windows-20H2-endpoints.md +++ b/windows/privacy/manage-windows-20H2-endpoints.md @@ -2,17 +2,18 @@ title: Connection endpoints for Windows 10 Enterprise, version 20H2 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 20H2. keywords: privacy, manage connections to Microsoft, Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize +manager: dansimp ms.collection: M365-security-compliance ms.topic: article -ms.date: 12/17/2020 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 20H2 diff --git a/windows/privacy/manage-windows-21H1-endpoints.md b/windows/privacy/manage-windows-21H1-endpoints.md index b79b2a57a2..b1f5e5b96d 100644 --- a/windows/privacy/manage-windows-21H1-endpoints.md +++ b/windows/privacy/manage-windows-21H1-endpoints.md @@ -2,19 +2,18 @@ title: Connection endpoints for Windows 10 Enterprise, version 21H1 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 21H1. keywords: privacy, manage connections to Microsoft, Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize -ms.collection: - - M365-security-compliance - - highpri +manager: dansimp +ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 21H1 diff --git a/windows/privacy/manage-windows-21h2-endpoints.md b/windows/privacy/manage-windows-21h2-endpoints.md index 288fffd6a5..9ee456b4e0 100644 --- a/windows/privacy/manage-windows-21h2-endpoints.md +++ b/windows/privacy/manage-windows-21h2-endpoints.md @@ -2,19 +2,18 @@ title: Connection endpoints for Windows 10 Enterprise, version 21H2 description: Explains what Windows 10 endpoints are used for, how to turn off traffic to them, and the impact. Specific to Windows 10 Enterprise, version 21H2. keywords: privacy, manage connections to Microsoft, Windows 10 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize -ms.collection: - - M365-security-compliance - - highpri +manager: dansimp +ms.collection: M365-security-compliance ms.topic: article -ms.date: 10/04/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- # Manage connection endpoints for Windows 10 Enterprise, version 21H2 diff --git a/windows/privacy/required-windows-11-diagnostic-events-and-fields.md b/windows/privacy/required-windows-11-diagnostic-events-and-fields.md index 696afe4f31..beeccde7a0 100644 --- a/windows/privacy/required-windows-11-diagnostic-events-and-fields.md +++ b/windows/privacy/required-windows-11-diagnostic-events-and-fields.md @@ -2,7 +2,7 @@ description: Use this article to learn more about what Windows diagnostic data is gathered at the basic level. title: Required Windows 11 diagnostic events and fields keywords: privacy, telemetry -ms.prod: w11 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.pagetype: security @@ -15,7 +15,8 @@ ms.collection: - highpri ms.topic: article audience: ITPro -ms.date: 10/04/2021 +ms.date: 11/29/2021 +ms.technology: privacy --- diff --git a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md index 8fef9f1e7a..52bd66824a 100644 --- a/windows/privacy/windows-11-endpoints-non-enterprise-editions.md +++ b/windows/privacy/windows-11-endpoints-non-enterprise-editions.md @@ -2,19 +2,18 @@ title: Windows 11 connection endpoints for non-Enterprise editions description: Explains what Windows 11 endpoints are used in non-Enterprise editions. Specific to Windows 11. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize -ms.collection: - - M365-security-compliance - - highpri +manager: dansimp +ms.collection: M365-security-compliance ms.topic: article ms.date: 10/04/2021 +ms.technology: privacy --- # Windows 11 connection endpoints for non-Enterprise editions diff --git a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md index da43880ca5..4a2cf3b71f 100644 --- a/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-1903-non-enterprise-editions.md @@ -9,7 +9,7 @@ ms.localizationpriority: high audience: ITPro author: mikeedgar ms.author: obezeajo -manager: robsize +manager: dansimp ms.collection: M365-security-compliance ms.topic: article ms.date: 7/22/2020 diff --git a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md index d0be97841e..edd183b412 100644 --- a/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-2004-non-enterprise-editions.md @@ -9,7 +9,7 @@ ms.localizationpriority: high audience: ITPro author: linque1 ms.author: obezeajo -manager: robsize +manager: dansimp ms.collection: M365-security-compliance ms.topic: article ms.date: 5/11/2020 diff --git a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md index 66a3637398..69951778e6 100644 --- a/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-20H2-non-enterprise-editions.md @@ -9,7 +9,7 @@ ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize +manager: dansimp ms.collection: M365-security-compliance ms.topic: article ms.date: 12/17/2020 diff --git a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md index 935ca0d986..fccffc6540 100644 --- a/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md +++ b/windows/privacy/windows-endpoints-21H1-non-enterprise-editions.md @@ -2,19 +2,18 @@ title: Windows 10, version 21H1, connection endpoints for non-Enterprise editions description: Explains what Windows 10 endpoints are used in non-Enterprise editions. Specific to Windows 10, version 21H1. keywords: privacy, manage connections to Microsoft, Windows 10, Windows Server 2016 -ms.prod: w10 +ms.prod: m365-security ms.mktglfcycl: manage ms.sitesec: library ms.localizationpriority: high audience: ITPro author: gental-giant ms.author: v-hakima -manager: robsize -ms.collection: - - M365-security-compliance - - highpri +manager: dansimp +ms.collection: M365-security-compliance ms.topic: article ms.date: 10/04/2021 +ms.technology: privacy --- # Windows 10, version 21H1, connection endpoints for non-Enterprise editions diff --git a/windows/security/identity-protection/access-control/service-accounts.md b/windows/security/identity-protection/access-control/service-accounts.md index 6b3c522221..de8358b611 100644 --- a/windows/security/identity-protection/access-control/service-accounts.md +++ b/windows/security/identity-protection/access-control/service-accounts.md @@ -27,7 +27,6 @@ This topic for the IT professional explains group and standalone managed service ## Overview - A service account is a user account that is created explicitly to provide a security context for services running on Windows Server operating systems. The security context determines the service's ability to access local and network resources. The Windows operating systems rely on services to run various features. These services can be configured through the applications, the Services snap-in, or Task Manager, or by using Windows PowerShell. This topic contains information about the following types of service accounts: @@ -50,7 +49,7 @@ In addition to the enhanced security that is provided by having individual accou - Unlike domain accounts in which administrators must manually reset passwords, the network passwords for these accounts are automatically reset. -- You do not have to complete complex SPN management tasks to use managed service accounts. +- You don't have to complete complex SPN management tasks to use managed service accounts. - Administrative tasks for managed service accounts can be delegated to non-administrators. @@ -70,9 +69,9 @@ The Microsoft Key Distribution Service (kdssvc.dll) provides the mechanism to se Group managed service accounts provide a single identity solution for services running on a server farm, or on systems that use Network Load Balancing. By providing a group managed service account solution, services can be configured for the group managed service account principal, and the password management is handled by the operating system. -By using a group managed service account, services or service administrators do not need to manage password synchronization between service instances. The group managed service account supports hosts that are kept offline for an extended time period and the management of member hosts for all instances of a service. This means that you can deploy a server farm that supports a single identity to which existing client computers can authenticate without knowing the instance of the service to which they are connecting. +By using a group managed service account, services or service administrators don't need to manage password synchronization between service instances. The group managed service account supports hosts that are kept offline for an extended time period and the management of member hosts for all instances of a service. This means that you can deploy a server farm that supports a single identity to which existing client computers can authenticate without knowing the instance of the service to which they are connecting. -Failover clusters do not support group managed service account s. However, services that run on top of the Cluster service can use a group managed service account or a standalone managed service account if they are a Windows service, an App pool, a scheduled task, or if they natively support group managed service account or standalone managed service accounts. +Failover clusters don't support group managed service account s. However, services that run on top of the Cluster service can use a group managed service account or a standalone managed service account if they are a Windows service, an App pool, a scheduled task, or if they natively support group managed service account or standalone managed service accounts. ### Software requirements diff --git a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md index 9ad598b76d..6280b25772 100644 --- a/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md +++ b/windows/security/threat-protection/intelligence/cybersecurity-industry-partners.md @@ -1,8 +1,8 @@ --- title: Industry collaboration programs ms.reviewer: -description: Microsoft industry-wide antimalware collaboration programs - Virus Information Alliance (VIA), Microsoft Virus Initiative (MVI), and Coordinated Malware Eradication (CME) -keywords: security, malware, antivirus industry, antimalware Industry, collaboration programs, alliances, Virus Information Alliance, Microsoft Virus Initiative, Coordinated Malware Eradication, WDSI, MMPC, Microsoft Malware Protection Center, partnerships +description: Microsoft industry-wide anti-malware collaboration programs - Virus Information Alliance (VIA), Microsoft Virus Initiative (MVI), and Coordinated Malware Eradication (CME) +keywords: security, malware, antivirus industry, anti-malware Industry, collaboration programs, alliances, Virus Information Alliance, Microsoft Virus Initiative, Coordinated Malware Eradication, WDSI, MMPC, Microsoft Malware Protection Center, partnerships ms.prod: m365-security ms.mktglfcycl: secure ms.sitesec: library @@ -17,7 +17,7 @@ ms.technology: windows-sec --- # Industry collaboration programs -Microsoft has several industry-wide collaboration programs with different objectives and requirements. Enrolling in the right program can help you protect your customers, gain more insight into the current threat landscape, or assist in disrupting the malware ecosystem. +Microsoft has several industry-wide collaboration programs with different objectives and requirements. Enrolling in the right program can help you protect your customers, gain more insight into the current threat landscape, or help disrupting the malware ecosystem. ## Virus Information Alliance (VIA) @@ -29,15 +29,15 @@ Go to the [VIA program page](virus-information-alliance-criteria.md) for more in ## Microsoft Virus Initiative (MVI) -MVI is open to organizations who build and own a Real Time Protection (RTP) antimalware product of their own design, or one developed using a third-party antivirus SDK. +MVI is open to organizations who build and own a Real Time Protection (RTP) anti-malware product of their own design, or one developed using a third-party Antivirus SDK. -Members get access to Microsoft client APIs for the Microsoft Defender Security Center, IOAV, AMSI, and Cloud Files, along with health data and other telemetry to help their customers stay protected. Antimalware products are submitted to Microsoft for performance testing on a regular basis. +Members get access to Microsoft client APIs for the Microsoft Defender Security Center, IOAV, AMSI, and Cloud Files, along with health data and other telemetry to help their customers stay protected. Anti-malware products are submitted to Microsoft for performance testing regularly. Go to the [MVI program page](virus-initiative-criteria.md) for more information. ## Coordinated Malware Eradication (CME) -CME is open to organizations who are involved in cybersecurity and antimalware or interested in fighting cybercrime. +CME is open to organizations who are involved in cybersecurity and anti-malware or interested in fighting cybercrime. The program aims to bring organizations in cybersecurity and other industries together to pool tools, information, and actions to drive coordinated campaigns against malware. The ultimate goal is to create efficient and long-lasting results for better protection of our communities, customers, and businesses. diff --git a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md index 7d7b790bde..0616554f60 100644 --- a/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md +++ b/windows/security/threat-protection/intelligence/virus-information-alliance-criteria.md @@ -17,7 +17,7 @@ ms.technology: windows-sec --- # Virus Information Alliance -The Virus Information Alliance (VIA) is a public antimalware collaboration program for security software providers, security service providers, antimalware testing organizations, and other organizations involved in fighting cybercrime. +The Virus Information Alliance (VIA) is a public anti-malware collaboration program for security software providers, security service providers, anti-malware testing organizations, and other organizations involved in fighting cyber crime. Members of the VIA program collaborate by exchanging technical information on malicious software with Microsoft. The goal is to improve protection for Microsoft customers. @@ -25,7 +25,7 @@ Members of the VIA program collaborate by exchanging technical information on ma The VIA program gives members access to information that will help them improve protection. For example, the program provides malware telemetry and samples to security teams so they can identify gaps and prioritize new threat coverage. -Malware prevalence data is provided to antimalware testers to assist them in selecting sample sets. The data also helps set scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity. +Malware prevalence data is provided to anti-malware testers to assist them in selecting sample sets. The data also helps set scoring criteria that represent the real-world threat landscape. Service organizations, such as a CERT, can leverage our data to help assess the impact of policy changes or to help shut down malicious activity. Microsoft is committed to continuous improvement to help reduce the impact of malware on customers. By sharing malware-related information, Microsoft enables members of this community to work towards better protection for customers. @@ -37,10 +37,10 @@ The criteria is designed to ensure that Microsoft can work with the following gr - Security software providers - Security service providers -- Antimalware testing organizations +- Anti-malware testing organizations - Other organizations involved in the fight against cybercrime -Members will receive information to facilitate effective malware detection, deterrence, and eradication. This information includes technical information on malware as well as metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable. +Members will receive information to facilitate effective malware detection, deterrence, and eradication. This information includes technical information on malware and metadata on malicious activity. Information shared through VIA is governed by the VIA membership agreement and a Microsoft non-disclosure agreement, where applicable. VIA has an open enrollment for potential members. @@ -52,9 +52,9 @@ To be eligible for VIA your organization must: 2. Fit into one of the following categories: - - Your organization develops antimalware technology that can run on Windows and your organization’s product is commercially available. + - Your organization develops anti-malware technology that can run on Windows and your organization’s product is commercially available. - Your organization provides security services to Microsoft customers or for Microsoft products. - - Your organization publishes antimalware testing reports on a regular basis. + - Your organization publishes anti-malware testing reports regularly. - Your organization has a research or response team dedicated to fighting malware to protect your organization, your customers, or the general public. 3. Be willing to sign and adhere to the VIA membership agreement. diff --git a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md index 7794832d3e..29993c408e 100644 --- a/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md +++ b/windows/security/threat-protection/protect-high-value-assets-by-controlling-the-health-of-windows-10-based-devices.md @@ -26,9 +26,9 @@ This article details an end-to-end solution that helps you protect high-value as ## Introduction -In Bring Your Own Device (BYOD) scenarios, employees bring commercially available devices to access both work-related resources and their personal data. Users want to use the device of their choice to access the organization’s applications, data, and resources not only from the internal network but also from anywhere. This phenomenon is also known as the consumerization of IT. +For Bring Your Own Device (BYOD) scenarios, employees bring commercially available devices to access both work-related resources and their personal data. Users want to use the device of their choice to access the organization’s applications, data, and resources not only from the internal network but also from anywhere. This phenomenon is also known as the consumerization of IT. -Users want to have the best productivity experience when accessing corporate applications and working on organization data from their devices. That means they will not tolerate being prompted to enter their work credentials each time they access an application or a file server. From a security perspective, it also means that users will manipulate corporate credentials and corporate data on unmanaged devices. +Users want to have the best productivity experience when accessing corporate applications and working on organization data from their devices. That means they won't tolerate being prompted to enter their work credentials each time they access an application or a file server. From a security perspective, it also means that users will manipulate corporate credentials and corporate data on unmanaged devices. With the increased use of BYOD, there will be more unmanaged and potentially unhealthy systems accessing corporate services, internal resources, and cloud apps. @@ -46,7 +46,7 @@ During recent years, one particular category of threat has become prevalent: adv With the BYOD phenomena, a poorly maintained device represents a target of choice. For an attacker, it’s an easy way to breach the security network perimeter, gain access to, and then steal high-value assets. -The attackers target individuals, not specifically because of who they are, but because of who they work for. An infected device will bring malware into an organization, even if the organization has hardened the perimeter of networks or has invested in its defensive posture. A defensive strategy is not sufficient against these threats. +The attackers target individuals, not specifically because of who they are, but because of who they work for. An infected device will bring malware into an organization, even if the organization has hardened the perimeter of networks or has invested in its defensive posture. A defensive strategy isn't sufficient against these threats. ### A different approach @@ -72,7 +72,7 @@ A device health attestation module can communicate measured boot data that is pr Remote health attestation service performs a series of checks on the measurements. It validates security related data points, including boot state (Secure Boot, Debug Mode, and so on), and the state of components that manage security (BitLocker, Device Guard, and so on). It then conveys the health state of the device by sending a health encrypted blob back to the device. -An MDM solution typically applies configuration policies and deploys software to devices. MDM defines the security baseline and knows the level of compliance of the device with regular checks to see what software is installed and what configuration is enforced, as well as determining the health status of the device. +An MDM solution typically applies configuration policies and deploys software to devices. MDM defines the security baseline and knows the level of compliance of the device with regular checks to see what software is installed and what configuration is enforced, and determining the health status of the device. An MDM solution asks the device to send device health information and forward the health encrypted blob to the remote health attestation service. The remote health attestation service verifies device health data, checks that MDM is communicating to the same device, and then issues a device health report back to the MDM solution. @@ -86,7 +86,7 @@ Depending on the requirements and the sensitivity of the managed asset, device h In Windows 10, there are three pillars of investments: -- **Secure identities.** Microsoft is part of the FIDO Alliance that aims to provide an interoperable method of secure authentication by moving away from the use of passwords for authentication, both on the local system and for services like on-premises resources and cloud resources. +- **Secure identities.** Microsoft is part of the FIDO alliance that aims to provide an interoperable method of secure authentication by moving away from the use of passwords for authentication, both on the local system and for services like on-premises resources and cloud resources. - **Information protection.** Microsoft is making investments to allow organizations to have better control over who has access to important data and what they can do with that data. With Windows 10, organizations can take advantage of policies that specify which applications are considered to be corporate applications and can be trusted to access secure data. - **Threat resistance.** Microsoft is helping organizations to better secure enterprise assets against the threats of malware and attacks by using security defenses relying on hardware. @@ -149,7 +149,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik - The TPM 1.2 specification allows vendors wide latitude when choosing implementation details - TPM 2.0 standardizes much of this behavior -- **Secure Boot.** Devices with UEFI firmware can be configured to load only trusted operating system bootloaders. Secure Boot does not require a TPM. +- **Secure Boot.** Devices with UEFI firmware can be configured to load only trusted operating system bootloaders. Secure Boot doesn't require a TPM. The most basic protection is the Secure Boot feature, which is a standard part of the UEFI 2.2+ architecture. On a PC with conventional BIOS, anyone who can take control of the boot process can boot by using an alternative OS loader, and potentially gain access to system resources. When Secure Boot is enabled, you can boot using only an OS loader that’s signed using a certificate stored in the UEFI Secure Boot DB. Naturally, the Microsoft certificate used to digitally sign the Windows 10 OS loaders are in that store, which allows UEFI to validate the certificate as part of its security policy. Secure Boot must be enabled by default on all computers that are certified for Windows 10 under the Windows Hardware Compatibility Program. @@ -182,7 +182,7 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik The ELAM driver is a small driver with a small policy database that has a very narrow scope, focused on drivers that are loaded early at system launch. The policy database is stored in a registry hive that is also measured to the TPM, to record the operational parameters of the ELAM driver. An ELAM driver must be signed by Microsoft and the associated certificate must contain the complementary EKU (1.3.6.1.4.1.311.61.4.1). - **Virtualization-based security (Hyper-V + Secure Kernel).** Virtualization-based security is a completely new enforced security boundary that allows you to protect critical parts of Windows 10. - Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, refer to the [Virtualization-based security](#virtual) section. + Virtualization-based security isolates sensitive code like Kernel Mode Code Integrity or sensitive corporate domain credentials from the rest of the Windows operating system. For more information, see [Virtualization-based security](#virtual) section. - **Hypervisor-protected Code Integrity (HVCI).** Hypervisor-protected Code Integrity is a feature of Device Guard that ensures only drivers, executables, and DLLs that comply with the Device Guard Code Integrity policy are allowed to run. @@ -210,13 +210,13 @@ Windows 10 supports features to help prevent sophisticated low-level malware lik During each subsequent boot, the same components are measured, which allows comparison of the measurements against an expected baseline. For more security, the values measured by the TPM can be signed and transmitted to a remote server, which can then perform the comparison. This process, called *remote device health attestation*, allows the server to verify health status of the Windows device. - Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an antimalware or an MDM vendor. Unlike Secure Boot, health attestation will not stop the boot process and enter remediation when a measurement does not work. But with conditional access control, health attestation will help to prevent access to high-value assets. + Although Secure Boot is a proactive form of protection, health attestation is a reactive form of boot protection. Health attestation ships disabled in Windows and is enabled by an antimalware or an MDM vendor. Unlike Secure Boot, health attestation won't stop the boot process and enter remediation when a measurement doesn't work. But with conditional access control, health attestation will help to prevent access to high-value assets. ### Virtualization-based security Virtualization-based security provides a new trust boundary for Windows 10 and uses Hyper-V hypervisor technology to enhance platform security. Virtualization-based security provides a secure execution environment to run specific Windows trusted code (trustlet) and to protect sensitive data. -Virtualization-based security helps to protect against a compromised kernel or a malicious user with Administrator privileges. Virtualization-based security is not trying to protect against a physical attacker. +Virtualization-based security helps to protect against a compromised kernel or a malicious user with Administrator privileges. Virtualization-based security isn't trying to protect against a physical attacker. The following Windows 10 services are protected with virtualization-based security: @@ -234,7 +234,7 @@ The schema below is a high-level view of Windows 10 with virtualization-based se ### Credential Guard -In Windows 10, when Credential Guard is enabled, Local Security Authority Subsystem Service (lsass.exe) runs a sensitive code in an Isolated user mode to help protect data from malware that may be running in the normal user mode. This code execution helps ensure that protected data is not stolen and reused on +In Windows 10, when Credential Guard is enabled, Local Security Authority Subsystem Service (lsass.exe) runs a sensitive code in an Isolated user mode to help protect data from malware that may be running in the normal user mode. This code execution helps ensure that protected data isn't stolen and reused on remote machines, which mitigates many PtH-style attacks. Credential Guard helps protect credentials by encrypting them with either a per-boot or persistent key: @@ -255,16 +255,16 @@ Hyper-V Code Integrity is a feature that validates the integrity of a driver or > [!NOTE] > Independently of activation of Device Guard Policy, [Windows 10 by default raises the bar for what runs in the kernel](https://go.microsoft.com/fwlink/p/?LinkId=691613). Windows 10 drivers must be signed by Microsoft, and more specifically, by the WHQL (Windows Hardware Quality Labs) portal. Additionally, starting in October 2015, the WHQL portal will only accept driver submissions, including both kernel and user mode driver submissions, that have a valid Extended Validation (“EV”) Code Signing Certificate. -With Device Guard in Windows 10, organizations are now able to define their own Code Integrity policy for use on x64 systems running Windows 10 Enterprise. Organizations have the ability to configure the policy that determines what is trusted to run. These include drivers and system files, as well as traditional desktop applications and scripts. The system is then locked down to only run applications that the organization trusts. +With Device Guard in Windows 10, organizations are now able to define their own Code Integrity policy for use on x64 systems running Windows 10 Enterprise. Organizations have the ability to configure the policy that determines what is trusted to run. These include drivers and system files, and traditional desktop applications and scripts. The system is then locked down to only run applications that the organization trusts. Device Guard is a built-in feature of Windows 10 Enterprise that prevents the execution of unwanted code and applications. Device Guard can be configured using two rule actions - allow and deny: - **Allow** limits execution of applications to an allowed list of code or trusted publisher and blocks everything else. - **Deny** completes the allow trusted publisher approach by blocking the execution of a specific application. -At the time of this writing, and according to Microsoft’s latest research, more than 90 percent of malware is unsigned completely. So implementing a basic Device Guard policy can simply and effectively help block the vast majority of malware. In fact, Device Guard has the potential to go further, and can also help block signed malware. +At the time of this writing, and according to Microsoft’s latest research, more than 90 percent of malware is unsigned completely. So implementing a basic Device Guard policy can simply and effectively help block malware. In fact, Device Guard has the potential to go further, and can also help block signed malware. -Device Guard needs to be planned and configured to be truly effective. It is not just a protection that is enabled or disabled. Device Guard is a combination of hardware security features and software security features that, when configured together, can lock down a computer to help ensure the most secure and resistant system possible. +Device Guard needs to be planned and configured to be truly effective. It isn't just a protection that is enabled or disabled. Device Guard is a combination of hardware security features and software security features that, when configured together, can lock down a computer to help ensure the most secure and resistant system possible. There are three different parts that make up the Device Guard solution in Windows 10: @@ -276,18 +276,18 @@ For more information on how to deploy Device Guard in an enterprise, see the [De ### Device Guard scenarios -As previously described, Device Guard is a powerful way to lock down systems. Device Guard is not intended to be used broadly and it may not always be applicable, but there are some high-interest scenarios. +As previously described, Device Guard is a powerful way to lock down systems. Device Guard isn't intended to be used broadly and it may not always be applicable, but there are some high-interest scenarios. -Device Guard is useful and applicable on fixed workloads systems like cash registers, kiosk machines, Secure Admin Workstations (SAWs), or well managed desktops. Device Guard is highly relevant on systems that have very well-defined software that are expected to run and don’t change too frequently. -It could also help protect Information Workers (IWs) beyond just SAWs, as long as what they need to run is known and the set of applications is not going to change on a daily basis. +Device Guard is useful and applicable on fixed workloads systems like cash registers, kiosk machines, Secure Admin Workstations (SAWs), or well managed desktops. Device Guard is highly relevant on systems that have a well-defined software that are expected to run and don’t change too frequently. +It could also help protect Information Workers (IWs) beyond just SAWs, as long as what they need to run is known and the set of applications isn't going to change on a daily basis. SAWs are computers that are built to help significantly reduce the risk of compromise from malware, phishing attacks, bogus websites, and PtH attacks, among other security risks. Although SAWs can’t be considered a “silver bullet” security solution to these attacks, these types of clients are helpful as part of a layered, defense-in-depth approach to security. To protect high-value assets, SAWs are used to make secure connections to those assets. -Similarly, on corporate fully-managed workstations, where applications are installed by using a distribution tool like Microsoft Endpoint Configuration Manager, Intune, or any third-party device management, then Device Guard is very applicable. In that type of scenario, the organization has a good idea of the software that an average user is running. +Similarly, on corporate fully-managed workstations, where applications are installed by using a distribution tool like Microsoft Endpoint Configuration Manager, Intune, or any third-party device management, then Device Guard is applicable. In that type of scenario, the organization has a good idea of the software that an average user is running. -It could be challenging to use Device Guard on corporate, lightly-managed workstations where the user is typically allowed to install software on their own. When an organization offers great flexibility, it’s quite difficult to run Device Guard in enforcement mode. Nevertheless, Device Guard can be run in Audit mode, and in that case, the event log will contain a record of any binaries that violated the Device Guard policy. When Device Guard is used in Audit mode, organizations can get rich data about drivers and applications that users install and run. +It could be challenging to use Device Guard on corporate, lightly-managed workstations where the user is typically allowed to install software on their own. When an organization offers great flexibility, it’s difficult to run Device Guard in enforcement mode. Nevertheless, Device Guard can be run in Audit mode, and in that case, the event log will contain a record of any binaries that violated the Device Guard policy. When Device Guard is used in Audit mode, organizations can get rich data about drivers and applications that users install and run. Before you can benefit from the protection included in Device Guard, Code Integrity policy must be created by using tools provided by Microsoft, but the policy can be deployed with common management tools, like Group Policy. The Code Integrity policy is a binary-encoded XML document that includes configuration settings for both the User and Kernel-modes of Windows 10, along with restrictions on Windows 10 script hosts. Device Guard Code Integrity policy restricts what code can run on a device. @@ -306,13 +306,13 @@ On computers with Device Guard, Microsoft proposes to move from a world where un With Windows 10, organizations will make line-of-business (LOB) apps available to members of the organization through the Microsoft Store infrastructure. More specifically, LOB apps will be available in a private store within the public Microsoft Store. Microsoft Store signs and distributes Universal Windows apps and Classic Windows apps. All apps downloaded from the Microsoft Store are signed. -In organizations today, the vast majority of LOB applications are unsigned. Code signing is frequently viewed as a tough problem to solve for a variety of reasons, like the lack of code signing expertise. Even if code signing is a best practice, a lot of internal applications are not signed. +In organizations today, many LOB applications are unsigned. Code signing is frequently viewed as a tough problem to solve for a variety of reasons, like the lack of code signing expertise. Even if code signing is a best practice, a lot of internal applications are not signed. Windows 10 includes tools that allow IT pros to take applications that have been already packaged and run them through a process to create additional signatures that can be distributed along with existing applications. ### Why are antimalware and device management solutions still necessary? -Although allow-list mechanisms are extremely efficient at ensuring that only trusted applications can be run, they cannot prevent the compromise of a trusted (but vulnerable) application by malicious content designed to exploit a known vulnerability. Device Guard doesn’t protect against user mode malicious code run by exploiting vulnerabilities. +Although allow-list mechanisms are efficient at ensuring that only trusted applications can be run, they cannot prevent the compromise of a trusted (but vulnerable) application by malicious content designed to exploit a known vulnerability. Device Guard doesn’t protect against user mode malicious code run by exploiting vulnerabilities. Vulnerabilities are weaknesses in software that could allow an attacker to compromise the integrity, availability, or confidentiality of the device. Some of the worst vulnerabilities allow attackers to exploit the compromised device by causing it to run malicious code without the user’s knowledge. @@ -384,7 +384,7 @@ This section presented information about several closely related controls in Win ## Detect an unhealthy Windows 10-based device -As of today, many organizations only consider devices to be compliant with company policy after they’ve passed a variety of checks that show, for example, that the operating system is in the correct state, properly configured, and has security protection enabled. Unfortunately, with today’s systems, this form of reporting is not entirely reliable because malware can spoof a software statement about system health. A rootkit, or a similar low-level exploit, can report a false healthy state to traditional compliance tools. +As of today, many organizations only consider devices to be compliant with company policy after they’ve passed a variety of checks that show, for example, that the operating system is in the correct state, properly configured, and has security protection enabled. Unfortunately, with today’s systems, this form of reporting isn't entirely reliable because malware can spoof a software statement about system health. A rootkit, or a similar low-level exploit, can report a false healthy state to traditional compliance tools. The biggest challenge with rootkits is that they can be undetectable to the client. Because they start before antimalware, and they have system-level privileges, they can completely disguise themselves while continuing to access system resources. As a result, traditional computers infected with rootkits appear to be healthy, even with antimalware running. @@ -400,7 +400,7 @@ However, the use of traditional malware prevention technologies like antimalware The definition of device compliance will vary based on an organization’s installed antimalware, device configuration settings, patch management baseline, and other security requirements. But health of the device is part of the overall device compliance policy. -The health of the device is not binary and depends on the organization’s security implementation. The Health Attestation Service provides information back to the MDM on which security features are enabled during the boot of the device by leveraging trustworthy hardware TPM. +The health of the device isn't binary and depends on the organization’s security implementation. The Health Attestation Service provides information back to the MDM on which security features are enabled during the boot of the device by leveraging trustworthy hardware TPM. But health attestation only provides information, which is why an MDM solution is needed to take and enforce a decision. @@ -501,7 +501,7 @@ For certain devices that use firmware-based TPM produced by Intel or Qualcomm, t ### Attestation Identity Keys -Because the endorsement certificate is unique for each device and does not change, the usage of it may present privacy concerns because it's theoretically possible to track a specific device. To avoid this privacy problem, Windows 10 issues a derived attestation anchor based on the endorsement certificate. This intermediate key, which can be attested to an endorsement key, is the Attestation Identity Key (AIK) and the corresponding certificate is called the AIK certificate. This AIK certificate is issued by a Microsoft cloud service. +Because the endorsement certificate is unique for each device and doesn't change, the usage of it may present privacy concerns because it's theoretically possible to track a specific device. To avoid this privacy problem, Windows 10 issues a derived attestation anchor based on the endorsement certificate. This intermediate key, which can be attested to an endorsement key, is the Attestation Identity Key (AIK) and the corresponding certificate is called the AIK certificate. This AIK certificate is issued by a Microsoft cloud service. > [!NOTE] > Before the device can report its health using the TPM attestation functions, an AIK certificate must be provisioned in conjunction with a third-party service like the Microsoft Cloud CA service. After it is provisioned, the AIK private key can be used to report platform configuration. Windows 10 creates a signature over the platform log state (and a monotonic counter value) at each boot by using the AIK. @@ -511,9 +511,9 @@ The AIK is an asymmetric (public/private) key pair that is used as a substitute Windows 10 creates AIKs protected by the TPM, if available, that are 2048-bit RSA signing keys. Microsoft is hosting a cloud service called Microsoft Cloud CA to establish cryptographically that it is communicating with a real TPM and that the TPM possesses the presented AIK. After the Microsoft Cloud CA service has established these facts, it will issue an AIK certificate to the Windows 10-based device. -Many existing devices that will upgrade to Windows 10 will not have a TPM, or the TPM will not contain an endorsement certificate. **To accommodate those devices, Windows 10 allows the issuance of AIK certificates without the presence of an endorsement certificate.** Such AIK certificates are not issued by Microsoft Cloud CA. Note that this is not as trustworthy as an endorsement certificate that is burned into the device during manufacturing, but it will provide compatibility for advanced scenarios like Windows Hello for Business without TPM. +Many existing devices that will upgrade to Windows 10 won't have a TPM, or the TPM won't contain an endorsement certificate. **To accommodate those devices, Windows 10 allows the issuance of AIK certificates without the presence of an endorsement certificate.** Such AIK certificates are not issued by Microsoft Cloud CA. Note that this isn't as trustworthy as an endorsement certificate that is burned into the device during manufacturing, but it will provide compatibility for advanced scenarios like Windows Hello for Business without TPM. -In the issued AIK certificate, a special OID is added to attest that endorsement certificate was used during the attestation process. This information can be leveraged by a relying party to decide whether to reject devices that are attested using AIK certificates without an endorsement certificate or accept them. Another scenario can be to not allow access to high-value assets from devices that are attested by an AIK certificate that is not backed by an endorsement certificate. +In the issued AIK certificate, a special OID is added to attest that endorsement certificate was used during the attestation process. This information can be leveraged by a relying party to decide whether to reject devices that are attested using AIK certificates without an endorsement certificate or accept them. Another scenario can be to not allow access to high-value assets from devices that are attested by an AIK certificate that isn't backed by an endorsement certificate. ### Storage root key @@ -527,7 +527,7 @@ The measurement of the boot sequence is based on the PCR and TCG log. To establi PCRs are set to zero when the platform is booted, and it is the job of the firmware that boots the platform to measure components in the boot chain and to record the measurements in the PCRs. Typically, boot components take the hash of the next component that is to be run and record the measurements in the PCRs. The initial component that starts the measurement chain is implicitly trusted. This is the CRTM. Platform manufacturers are required to have a secure update process for the CRTM or not permit updates to it. The PCRs record a cumulative hash of the components that have been measured. -The value of a PCR on its own is hard to interpret (it is just a hash value), but platforms typically keep a log with details of what has been measured, and the PCRs merely ensure that the log has not been tampered with. The logs are referred as a TCG log. Each time a register PCR is extended, an entry is added to the TCG log. Thus, throughout the boot process, a trace of the executable code and configuration data is created in the TCG log. +The value of a PCR on its own is hard to interpret (it is just a hash value), but platforms typically keep a log with details of what has been measured, and the PCRs merely ensure that the log hasn't been tampered with. The logs are referred as a TCG log. Each time a register PCR is extended, an entry is added to the TCG log. Thus, throughout the boot process, a trace of the executable code and configuration data is created in the TCG log. ### TPM provisioning @@ -539,7 +539,7 @@ During the provisioning process, the device may need to be restarted. Note that the **Get-TpmEndorsementKeyInfo PowerShell** cmdlet can be used with administrative privilege to get information about the endorsement key and certificates of the TPM. -If the TPM ownership is not known but the EK exists, the client library will provision the TPM and will store the resulting **ownerAuth** value into the registry if the policy allows it will store the SRK public portion at the following location: +If the TPM ownership isn't known but the EK exists, the client library will provision the TPM and will store the resulting **ownerAuth** value into the registry if the policy allows it will store the SRK public portion at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\Admin\\SRKPub** As part of the provisioning process, Windows 10 will create an AIK with the TPM. When this operation is performed, the resulting AIK public portion is stored in the registry at the following location: **HKLM\\SYSTEM\\CurrentControlSet\\Services\\TPM\\WMI\\WindowsAIKPub** @@ -701,7 +701,7 @@ For more information on how to manage Windows 10 security and system settings wi On most platforms, the Azure Active Directory (Azure AD) device registration happens automatically during enrollment. The device states are written by the MDM solution into Azure AD, and then read by Office 365 (or by any authorized Windows app that interacts with Azure AD) the next time the client tries to access an Office 365 compatible workload. -If the device is not registered, the user will get a message with instructions on how to register (also known as enrolling). If the device is not compliant, the user will get a different message that redirects them to the MDM web portal where they can get more information on the compliance problem and how to resolve it. +If the device isn't registered, the user will get a message with instructions on how to register (also known as enrolling). If the device isn't compliant, the user will get a different message that redirects them to the MDM web portal where they can get more information on the compliance problem and how to resolve it. **Azure AD** authenticates the user and the device, **MDM** manages the compliance and conditional access policies, and the **Health Attestation Service** reports about the health of the device in an attested way. @@ -721,7 +721,7 @@ When a user enrolls, the device is registered with Azure AD, and enrolled with a When a user enrolls a device successfully, the device becomes trusted. Azure AD provides single-sign-on to access company applications and enforces conditional access policy to grant access to a service not only the first time the user requests access, but every time the user requests to renew access. -The user will be denied access to services when sign-in credentials are changed, a device is lost/stolen, or the compliance policy is not met at the time of request for renewal. +The user will be denied access to services when sign-in credentials are changed, a device is lost/stolen, or the compliance policy isn't met at the time of request for renewal. Depending on the type of email application that employees use to access Exchange online, the path to establish secured access to email can be slightly different. However, the key components: Azure AD, Office 365/Exchange Online, and Intune, are the same. The IT experience and end-user experience also are similar. @@ -779,7 +779,7 @@ The following process describes how Azure AD conditional access works: For more information about Azure AD join, see [Azure AD & Windows 10: Better Together for Work or School](https://go.microsoft.com/fwlink/p/?LinkId=691619), a white paper. -Conditional access control is a topic that many organizations and IT pros may not know as well as they should. The different attributes that describe a user, a device, compliance, and context of access are very powerful when used with a conditional access engine. Conditional access control is an essential step that helps organizations secure their environment. +Conditional access control is a topic that many organizations and IT pros may not know and they should. The different attributes that describe a user, a device, compliance, and context of access are very powerful when used with a conditional access engine. Conditional access control is an essential step that helps organizations secure their environment. ## Takeaways and summary @@ -819,7 +819,7 @@ The following list contains high-level key take-aways to improve the security po - **Use AppLocker when it makes sense** - Although AppLocker is not considered a new Device Guard feature, it complements Device Guard functionality for some scenarios like being able to deny a specific Universal Windows apps for a specific user or a group of users. + Although AppLocker isn't considered a new Device Guard feature, it complements Device Guard functionality for some scenarios like being able to deny a specific Universal Windows apps for a specific user or a group of users. - **Lock down firmware and configuration** diff --git a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md index 877251cbc7..9376277ddf 100644 --- a/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md +++ b/windows/security/threat-protection/use-windows-event-forwarding-to-assist-in-intrusion-detection.md @@ -41,7 +41,7 @@ Here's an approximate scaling guide for WEF events: | 5,000 - 50,000 | SEM | | 50,000+ | Hadoop/HDInsight/Data Lake | -Event generation on a device must be enabled either separately or as part of the GPO for the baseline WEF implementation, including enabling of disabled event logs and setting channel permissions. For more info, see [Appendix C - Event channel settings (enable and channel access) methods](#bkmk-appendixc). This condition is because WEF is a passive system regarding the event log. It cannot change the size of event log files, enable disabled event channels, change channel permissions, or adjust a security audit policy. WEF only queries event channels for existing events. Additionally, having event generation already occurring on a device allows for more complete event collection building a complete history of system activity. Otherwise, you'll be limited to the speed of GPO and WEF subscription refresh cycles to make changes to what is being generated on the device. On modern devices, enabling more event channels and expanding the size of event log files has not resulted in noticeable performance differences. +Event generation on a device must be enabled either separately or as part of the GPO for the baseline WEF implementation, including enabling of disabled event logs and setting channel permissions. For more info, see [Appendix C - Event channel settings (enable and channel access) methods](#bkmk-appendixc). This condition is because WEF is a passive system regarding the event log. It cannot change the size of event log files, enable disabled event channels, change channel permissions, or adjust a security audit policy. WEF only queries event channels for existing events. Additionally, having event generation already occurring on a device allows for more complete event collection building a complete history of system activity. Otherwise, you'll be limited to the speed of GPO and WEF subscription refresh cycles to make changes to what is being generated on the device. On modern devices, enabling additional event channels and expanding the size of event log files hasn't resulted in noticeable performance differences. For the minimum recommended audit policy and registry system ACL settings, see [Appendix A - Minimum recommended minimum audit policy](#bkmk-appendixa) and [Appendix B - Recommended minimum registry system ACL policy](#bkmk-appendixb). @@ -66,7 +66,7 @@ This section addresses common questions from IT pros and customers. The short answer is: No. -The longer answer is: The **Eventlog-forwardingPlugin/Operational** event channel logs the success, warning, and error events related to WEF subscriptions present on the device. Unless the user opens Event Viewer and navigates to that channel, they will not notice WEF either through resource consumption or Graphical User Interface pop-ups. Even if there is an issue with the WEF subscription, there is no user interaction or performance degradation. All success, warning, and failure events are logged to this operational event channel. +The longer answer is: The **Eventlog-forwardingPlugin/Operational** event channel logs the success, warning, and error events related to WEF subscriptions present on the device. Unless the user opens Event Viewer and navigates to that channel, they won't notice WEF either through resource consumption or Graphical User Interface pop-ups. Even if there is an issue with the WEF subscription, there is no user interaction or performance degradation. All success, warning, and failure events are logged to this operational event channel. ### Is WEF Push or Pull? @@ -91,13 +91,13 @@ In a domain setting, the connection used to transmit WEF events is encrypted usi This authentication and encryption is performed regardless if HTTP or HTTPS is selected. -The HTTPS option is available if certificate based authentication is used, in cases where the Kerberos based mutual authentication is not an option. The SSL certificate and provisioned client certificates are used to provide mutual authentication. +The HTTPS option is available if certificate based authentication is used, in cases where the Kerberos based mutual authentication isn't an option. The SSL certificate and provisioned client certificates are used to provide mutual authentication. ### Do WEF Clients have a separate buffer for events? The WEF client machines local event log is the buffer for WEF for when the connection to the WEC server is lost. To increase the “buffer size”, increase the maximum file size of the specific event log file where events are being selected. For more info, see [Appendix C – Event Channel Settings (enable and Channel Access) methods](#bkmk-appendixc). -When the event log overwrites existing events (resulting in data loss if the device is not connected to the Event Collector), there is no notification sent to the WEF collector that events are lost from the client. Neither is there an indicator that there was a gap encountered in the event stream. +When the event log overwrites existing events (resulting in data loss if the device isn't connected to the Event Collector), there is no notification sent to the WEF collector that events are lost from the client. Neither is there an indicator that there was a gap encountered in the event stream. ### What format is used for forwarded events? @@ -119,7 +119,7 @@ This table outlines the built-in delivery options: | Event delivery optimization options | Description | | - | - | -| Normal | This option ensures reliable delivery of events and does not attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | +| Normal | This option ensures reliable delivery of events and doesn't attempt to conserve bandwidth. It is the appropriate choice unless you need tighter control over bandwidth usage or need forwarded events delivered as quickly as possible. It uses pull delivery mode, batches 5 items at a time and sets a batch timeout of 15 minutes. | | Minimize bandwidth | This option ensures that the use of network bandwidth for event delivery is strictly controlled. It is an appropriate choice if you want to limit the frequency of network connections made to deliver events. It uses push delivery mode and sets a batch timeout of 6 hours. In addition, it uses a heartbeat interval of 6 hours. | | Minimize latency | This option ensures that events are delivered with minimal delay. It is an appropriate choice if you are collecting alerts or critical events. It uses push delivery mode and sets a batch timeout of 30 seconds. | @@ -149,13 +149,13 @@ Yes. If you desire a High-Availability environment, simply configure multiple WE There are three factors that limit the scalability of WEC servers. The general rule for a stable WEC server on commodity hardware is planning for a total of 3,000 events per second on average for all configured subscriptions. -- **Disk I/O**. The WEC server does not process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. -- **Network Connections**. While a WEF source does not maintain a permanent, persistent connection to the WEC server, it does not immediately disconnect after sending its events. This means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. -- **Registry size**. For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this is not pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time. +- **Disk I/O**. The WEC server doesn't process or validate the received event, but rather buffers the received event and then logs it to a local event log file (EVTX file). The speed of logging to the EVTX file is limited by the disk write speed. Isolating the EVTX file to its own array or using high speed disks can increase the number of events per second that a single WEC server can receive. +- **Network Connections**. While a WEF source doesn't maintain a permanent, persistent connection to the WEC server, it doesn't immediately disconnect after sending its events. This means that the number of WEF sources that can simultaneously connect to the WEC server is limited to the open TCP ports available on the WEC server. +- **Registry size**. For each unique device that connects to a WEF subscription, there is a registry key (corresponding to the FQDN of the WEF Client) created to store bookmark and source heartbeat information. If this isn't pruned to remove inactive clients this set of registry keys can grow to an unmanageable size over time. - When a subscription has >1000 WEF sources connect to it over its operational lifetime, also known as lifetime WEF sources, Event Viewer can become unresponsive for a few minutes when selecting the **Subscriptions** node in the left-navigation, but will function normally afterwards. - At >50,000 lifetime WEF sources, Event Viewer is no longer an option and wecutil.exe (included with Windows) must be used to configure and manage subscriptions. - - At >100,000 lifetime WEF sources, the registry will not be readable and the WEC server will likely have to be rebuilt. + - At >100,000 lifetime WEF sources, the registry won't be readable and the WEC server will likely have to be rebuilt. ## Subscription information @@ -163,9 +163,9 @@ Below lists all of the items that each subscription collects, the actual subscri ### Baseline subscription -While this appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices – a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription does not require special configuration on client devices to enable event channels or modify channel permissions. +While this appears to be the largest subscription, it really is the lowest volume on a per-device basis. (Exceptions should be allowed for unusual devices – a device performing complex developer related tasks can be expected to create an unusually high volume of process create and AppLocker events.) This subscription doesn't require special configuration on client devices to enable event channels or modify channel permissions. -The subscription is essentially a collection of query statements applied to the Event Log. This means that it is modular in nature and a given query statement can be removed or changed without impacting other query statement in the subscription. Additionally, suppress statements which filter out specific events, only apply within that query statement and are not to the entire subscription. +The subscription is essentially a collection of query statements applied to the Event Log. This means that it is modular in nature and a given query statement can be removed or changed without impacting other query statement in the subscription. Additionally, suppress statements which filter out specific events, only apply within that query statement and aren't to the entire subscription. ### Baseline subscription requirements diff --git a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md index 128243e87c..15c64d432d 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md +++ b/windows/security/threat-protection/windows-defender-system-guard/how-hardware-based-root-of-trust-helps-protect-windows.md @@ -16,10 +16,9 @@ ms.date: 03/01/2019 ms.technology: windows-sec --- - # Windows Defender System Guard: How a hardware-based root of trust helps protect Windows 10 -In order to protect critical resources such as the Windows authentication stack, single sign-on tokens, the Windows Hello biometric stack, and the Virtual Trusted Platform Module, a system's firmware and hardware must be trustworthy. +To protect critical resources such as the Windows authentication stack, single sign-on tokens, the Windows Hello biometric stack, and the Virtual Trusted Platform Module, a system's firmware and hardware must be trustworthy. Windows Defender System Guard reorganizes the existing Windows 10 system integrity features under one roof and sets up the next set of investments in Windows security. It's designed to make these security guarantees: @@ -30,20 +29,21 @@ Windows Defender System Guard reorganizes the existing Windows 10 system integri ### Static Root of Trust for Measurement (SRTM) -With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. +With Windows 7, one of the means attackers would use to persist and evade detection was to install what is often referred to as a bootkit or rootkit on the system. This malicious software would start before Windows started, or during the boot process itself, enabling it to start with the highest level of privilege. With Windows 10 running on modern hardware (that is, Windows 8-certified or greater) a hardware-based root of trust helps ensure that no unauthorized firmware or software (such as a bootkit) can start before the Windows bootloader. This hardware-based root of trust comes from the device’s Secure Boot feature, which is part of the Unified Extensible Firmware Interface (UEFI). This technique of measuring the static early boot UEFI components is called the Static Root of Trust for Measurement (SRTM). -As there are thousands of PC vendors that produce numerous models with different UEFI BIOS versions, there becomes an incredibly large number of SRTM measurements upon bootup. -Two techniques exist to establish trust here—either maintain a list of known 'bad' SRTM measurements (also known as a block list), or a list of known 'good' SRTM measurements (also known as an allow list). +As there are thousands of PC vendors that produce many models with different UEFI BIOS versions, there becomes an incredibly large number of SRTM measurements upon bootup. +Two techniques exist to establish trust here—either maintain a list of known 'bad' SRTM measurements (also known as a blocklist), or a list of known 'good' SRTM measurements (also known as an allowlist). + Each option has a drawback: - A list of known 'bad' SRTM measurements allows a hacker to change just 1 bit in a component to create an entirely new SRTM hash that needs to be listed. This means that the SRTM flow is inherently brittle - a minor change can invalidate the entire chain of trust. - A list of known 'good' SRTM measurements requires each new BIOS/PC combination measurement to be carefully added, which is slow. -In addition, a bug fix for UEFI code can take a long time to design, build, retest, validate, and redeploy. +Also, a bug fix for UEFI code can take a long time to design, build, retest, validate, and redeploy. ### Secure Launch—the Dynamic Root of Trust for Measurement (DRTM) @@ -67,20 +67,18 @@ To defend against this, two techniques are used: - Paging protection to prevent inappropriate access to code and data - SMM hardware supervision and attestation -Paging protection can be implemented to lock certain code tables to be read-only to prevent tampering. -This prevents access to any memory that has not been specifically assigned. +Paging protection can be implemented to lock certain code tables to be read-only to prevent tampering. This prevents access to any memory that has not been assigned. -A hardware-enforced processor feature known as a supervisor SMI handler can monitor the SMM and make sure it does not access any part of the address space that it is not supposed to. +A hardware-enforced processor feature known as a supervisor SMI handler can monitor the SMM and make sure it doesn't access any part of the address space that it isn't supposed to. SMM protection is built on top of the Secure Launch technology and requires it to function. In the future, Windows 10 will also measure this SMI Handler’s behavior and attest that no OS-owned memory has been tampered with. ## Validating platform integrity after Windows is running (run time) -While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We should be able to trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. When it comes to platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity. - -As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch will not support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data is not subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. +While Windows Defender System Guard provides advanced protection that will help protect and maintain the integrity of the platform during boot and at run time, the reality is that we must apply an "assume breach" mentality to even our most sophisticated security technologies. We can trust that the technologies are successfully doing their jobs, but we also need the ability to verify that they were successful in achieving their goals. For platform integrity, we can’t just trust the platform, which potentially could be compromised, to self-attest to its security state. So Windows Defender System Guard includes a series of technologies that enable remote analysis of the device’s integrity. +As Windows 10 boots, a series of integrity measurements are taken by Windows Defender System Guard using the device’s Trusted Platform Module 2.0 (TPM 2.0). System Guard Secure Launch won't support earlier TPM versions, such as TPM 1.2. This process and data are hardware-isolated away from Windows to help ensure that the measurement data isn't subject to the type of tampering that could happen if the platform was compromised. From here, the measurements can be used to determine the integrity of the device’s firmware, hardware configuration state, and Windows boot-related components, just to name a few. ![Boot time integrity.](images/windows-defender-system-guard-boot-time-integrity.png) diff --git a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md index 7e081f6ecc..bf7d7d7de2 100644 --- a/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md +++ b/windows/security/threat-protection/windows-defender-system-guard/system-guard-secure-launch-and-smm-protection.md @@ -35,7 +35,7 @@ You can enable System Guard Secure Launch by using any of these options: ### Mobile Device Management -System Guard Secure Launch can be configured for Mobile Device Management (MDM) by using DeviceGuard policies in the Policy CSP, specifically [DeviceGuard/ConfigureSystemGuardLaunch](/windows/client-management/mdm/policy-csp-deviceguard#deviceguard-configuresystemguardlaunch). +System Guard Secure Launch can be configured for Mobile Device Management (MDM) by using DeviceGuard policies in the Policy CSP, [DeviceGuard/ConfigureSystemGuardLaunch](/windows/client-management/mdm/policy-csp-deviceguard#deviceguard-configuresystemguardlaunch). ### Group Policy @@ -79,10 +79,10 @@ To verify that Secure Launch is running, use System Information (MSInfo32). Clic |For Intel® vPro™ processors starting with Intel® Coffeelake, Whiskeylake, or later silicon|Description| |--------|-----------| |64-bit CPU|A 64-bit computer with minimum four cores (logical processors) is required for hypervisor and virtualization-based security (VBS). For more info about Hyper-V, see [Hyper-V on Windows Server 2016](/windows-server/virtualization/hyper-v/hyper-v-on-windows-server) or [Introduction to Hyper-V on Windows 10](/virtualization/hyper-v-on-windows/about/). For more info about hypervisor, see [Hypervisor Specifications](/virtualization/hyper-v-on-windows/reference/tlfs).| -|Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs aren't supported, with the exception of Intel chips that support Platform Trust Technology (PTT), which is a type of integrated hardware TPM that meets the TPM 2.0 spec.| +|Trusted Platform Module (TPM) 2.0|Platforms must support a discrete TPM 2.0. Integrated/firmware TPMs aren't supported, except Intel chips that support Platform Trust Technology (PTT), which is a type of integrated hardware TPM that meets the TPM 2.0 spec.| |Windows DMA Protection|Platforms must meet the Windows DMA Protection Specification (all external DMA ports must be off by default until the OS explicitly powers them).| |SMM communication buffers| All SMM communication buffers must be implemented in EfiRuntimeServicesData, EfiRuntimeServicesCode, EfiACPIMemoryNVS, or EfiReservedMemoryType memory types. | -|SMM Page Tables| Must NOT contain any mappings to EfiConventionalMemory (for example, no OS/VMM owned memory).
Must NOT contain any mappings to code sections within EfiRuntimeServicesCode.
Must NOT have execute and write permissions for the same page
Must allow ONLY that TSEG pages can be marked executable and the memory map must report TSEG EfiReservedMemoryType.
BIOS SMI handler must be implemented such that SMM page tables are locked on every SMM entry. | +|SMM Page Tables| Must NOT contain any mappings to EfiConventionalMemory (for example no OS/VMM owned memory).
Must NOT contain any mappings to code sections within EfiRuntimeServicesCode.
Must NOT have execute and write permissions for the same page
Must allow ONLY that TSEG pages can be marked executable and the memory map must report TSEG EfiReservedMemoryType.
BIOS SMI handler must be implemented such that SMM page tables are locked on every SMM entry. | |Modern/Connected Standby|Platforms must support Modern/Connected Standby.| |TPM AUX Index|Platform must set up a AUX index with index, attributes, and policy that exactly corresponds to the AUX index specified in the TXT DG with a data size of exactly 104 bytes (for SHA256 AUX data). (NameAlg = SHA256)
Platforms must set up a PS (Platform Supplier) index with:
  • Exactly the "TXT PS2" style Attributes on creation as follows:
    • AuthWrite
    • PolicyDelete
    • WriteLocked
    • WriteDefine
    • AuthRead
    • WriteDefine
    • NoDa
    • Written
    • PlatformCreate
  • A policy of exactly PolicyCommandCode(CC = TPM2_CC_UndefineSpaceSpecial) (SHA256 NameAlg and Policy)
  • Size of exactly 70 bytes
  • NameAlg = SHA256
  • Also, it must have been initialized and locked (TPMA_NV_WRITTEN = 1, TPMA_NV_WRITELOCKED = 1) at time of OS launch.
PS index data DataRevocationCounters, SINITMinVersion, and PolicyControl must all be 0x00 | |AUX Policy|The required AUX policy must be as follows:
  • A = TPM2_PolicyLocality (Locality 3 & Locality 4)
  • B = TPM2_PolicyCommandCode (TPM_CC_NV_UndefineSpecial)
  • authPolicy = \{A} OR {{A} AND \{B}}
  • authPolicy digest = 0xef, 0x9a, 0x26, 0xfc, 0x22, 0xd1, 0xae, 0x8c, 0xec, 0xff, 0x59, 0xe9, 0x48, 0x1a, 0xc1, 0xec, 0x53, 0x3d, 0xbe, 0x22, 0x8b, 0xec, 0x6d, 0x17, 0x93, 0x0f, 0x4c, 0xb2, 0xcc, 0x5b, 0x97, 0x24
| @@ -93,9 +93,9 @@ To verify that Secure Launch is running, use System Information (MSInfo32). Clic |For Qualcomm® processors with SD850 or later chipsets|Description| |--------|-----------| |Monitor Mode Communication|All Monitor Mode communication buffers must be implemented in either EfiRuntimeServicesData (recommended), data sections of EfiRuntimeServicesCode as described by the Memory Attributes Table, EfiACPIMemoryNVS, or EfiReservedMemoryType memory types| -|Monitor Mode Page Tables|All Monitor Mode page tables must:
  • NOT contain any mappings to EfiConventionalMemory (for example, no OS/VMM owned memory)
  • They must NOT have execute and write permissions for the same page
  • Platforms must only allow Monitor Mode pages marked as executable
  • The memory map must report Monitor Mode as EfiReservedMemoryType
  • Platforms must provide mechanism to protect the Monitor Mode page tables from modification
| +|Monitor Mode Page Tables|All Monitor Mode page tables must:
  • NOT contain any mappings to EfiConventionalMemory (for example no OS/VMM owned memory)
  • They must NOT have execute and write permissions for the same page
  • Platforms must only allow Monitor Mode pages marked as executable
  • The memory map must report Monitor Mode as EfiReservedMemoryType
  • Platforms must provide mechanism to protect the Monitor Mode page tables from modification
| |Modern/Connected Standby|Platforms must support Modern/Connected Standby.| -|Platform firmware|Platform firmware must carry all code required to perform a launch.| +|Platform firmware|Platform firmware must carry all code required to launch.| |Platform firmware update|System firmware is recommended to be updated via UpdateCapsule in Windows Update. | > [!NOTE] diff --git a/windows/whats-new/whats-new-windows-10-version-21H2.md b/windows/whats-new/whats-new-windows-10-version-21H2.md index f30128f026..faadc0536b 100644 --- a/windows/whats-new/whats-new-windows-10-version-21H2.md +++ b/windows/whats-new/whats-new-windows-10-version-21H2.md @@ -69,9 +69,9 @@ For more information, see: - [What's new in Azure Virtual Desktop?](/azure/virtual-desktop/whats-new) - [Set up MSIX app attach with the Azure portal](/azure/virtual-desktop/app-attach-azure-portal) -## Wi-Fi WPA3 H2E support +## Wi-Fi WPA3-Personal H2E support -Wi-Fi WPA3 H2E (Hash-to-Element) support is built in to Windows 10, version 21H2. +Wi-Fi WPA3-Personal H2E (Hash-to-Element) support is built in to Windows 10, version 21H2. ## Related articles